The Reality of Anti-cheats
Rootkits in Disguise? The Truth About Kernel Anti-Cheat Software
The Double-Edged Sword of Anti-Cheat Systems
We all love video game whether its valorant or League of Legends, or the punishing world of Elden Ring. And let’s be honest, who hasn’t at least thought about hacking a game to get infinite resources or god like powers? But ding din anti-cheat systems are waiting for you.
So, I asked myself: What exactly is an anti-cheat, and how does it work?
Turns out, there are two main types:
User-Level Anti-Cheats (Ring 3)
These programs run in the background when you launch a game, with the same privileges as any normal application (like your web browser). Their job is to: Scan game files for tampering Monitor player behavior Check running processes for cheat tools like Cheat Engine or debuggers
Examples: Dota 2 or oldest games of CS
so user level anticheats do a Less intrusive doesn’t require deep system access and Lower security risk (can’t be easily exploited by malware).
But in the opposite side Easier for cheaters to bypass (many hacks run at kernel level).
Kernel-Level Anti-Cheats (Ring 0)
These are far more powerful—and far more invasive. They load at system boot, sometimes even before Windows itself, giving them unrestricted access to: All memory (not just the game’s) Hardware devices (USB, PCIe slots) Other drivers (can block or modify them).
Examples:
Riot Vanguard (Valorant) – Runs 24/7 unless uninstalled.
BattlEye (Fortnite, PUBG) – Blocks DMA cheats.
Easy Anti-Cheat (EAC) (Apex Legends, Elden Ring) – HWID bans.
So what Kernel level anticheats does Extremely effective against advanced cheats (DMA, kernel drivers). Real-time detection (instant bans).
But The opposite side . Acts like a true rootkit full system control. . Many security risks (a bug or zero day could let hackers take over your PC). . 0% Privacy concerns (can scan everything, even unrelated processes). The Big Question: Is This a Fair Trade ?
Kernel anti-cheats work, but at what cost?
They’re Literally Rootkits (But Legal way as they are promoted to be)
By definition, a rootkit is malware that hides in the kernel.
Anti-cheats do the same thing just for “fair play.”
If hacked, they could be a wepon that has already shoots you ( spyware, ransomware)
History Shows They’re Not Perfect
BattlEye had a zero-day exploit (CVE-2019-12592).
Vanguard has had privilege escalation flaws.
EAC can be bypassed via signed driver exploits.
Do You Trust the Companies Behind Them?
Riot (Tencent-owned) forces Vanguard to run 24/7.
Epic Games (BattlEye) scans your system constantly.
No transparency—what data do they really collect?
Can We Have Both Fair Play and Privacy?