Watching the Watchers: Exploring and Testing Defenses of Anti-Cheat Systems

Watching the Watchers: Exploring and Testing Defenses of Anti-Cheat Systems

Speakers:

• Sam — PhD Student, University of Birmingham (UK); man-in-the-middle attacks and reverse engineering
• Tom — Co-presenter, University of Birmingham (UK); data analysis and cheat ecosystem research

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=lAW2mAl96KI

Reading Time: ~10 minutes

Type: Briefing

TL;DR

Anti-cheat systems for modern first-person shooters like Valorant and Rainbow Six Siege have independently developed Windows kernel defenses — PatchGuard bypass, memory invisibility cloaks, rogue hardware detection, and runtime software diversification — that exceed what most enterprise EDR products implement. A six-month empirical study of the cheat marketplace shows these defenses measurably raise attacker costs by an order of magnitude and cut cheat uptime from near-100% to roughly 50%. The next battleground is the hypervisor layer.

Introduction

Video game anti-cheat is an often-dismissed corner of the security industry, yet it operates under uniquely harsh conditions: the attacker is the authenticated local user, the attack surface covers hardware, firmware, kernel, and network layers simultaneously, and the attacker-defender cycle runs far faster than anywhere in enterprise security. Researchers Sam and Tom from the University of Birmingham came to Black Hat not as cheat developers or anti-cheat developers, but as interested third parties who spent months investigating what defenses this environment has quietly invented — and what lessons the broader security community should steal from it.

This is explicitly not a talk about bypassing anti-cheat systems or developing cheats. It is a study of defense.

The Cheat Marketplace: An Attacker Ecosystem With Economics

▶ Watch: The Commercial Cheat Ecosystem (04:00)

Over six months, the researchers monitored websites selling game cheats, tracking prices, uptime, and operational patterns. Cheats are sold on subscription models — daily and monthly pricing — and many of the vendors are professionally run: user reviews, credit card payments, and in some jurisdictions, tax filings and incorporation.

Key economic finding: a single well-maintained cheat targeting a game with weak anti-cheat can generate enough revenue that selling cheats is more profitable than selling equivalent Windows zero-days or participating in bug bounty programs. This explains why the ecosystem is so active and why development cycles are measured in days rather than months.

The uptime data for Valorant cheats illustrates the tempo: individual cheat products go live, get detected and killed in days or hours, and the developer immediately works to restore them. This is materially faster than the malware-to-antivirus detection cycle.

The Technical Arms Race: From User Mode to Kernel

▶ Watch: Windows Security Model and the Kernel Arms Race (06:00)

Cheats require access to game memory. Early cheats operated at user mode by hooking Windows API calls to read memory across process boundaries. Anti-cheat moved into the kernel to intercept those calls; Microsoft signs kernel-mode anti-cheat drivers. This should have been a decisive advantage: signed kernel-mode code versus unsigned user-mode code. It was not, because Bring Your Own Vulnerable Driver (BYOVD) attacks provide a path to unsigned kernel code without a zero-day.

BYOVD works by loading a legitimate, signed driver that contains an exploitable bug — arbitrary read/write is sufficient — and using that vulnerability to write unsigned code into kernel memory. The technique has since moved from the cheat world into mainstream ransomware: BlackByte, Scattered Spider, and APT41 all used BYOVD attacks around 2022, typically with vulnerable drivers that anti-cheat systems had already blocked years earlier. BattleEye blocked the vulnerable Gigabyte GPCID driver in May 2019 — more than a year before Sophos and Check Point developed detections for the same driver appearing in the Robinhood ransomware.

Defense 1: Detecting BYOVD with Kernel Hooks and NX Pages

▶ Watch: Vanguard Kernel Defense — NX Page Enforcement (18:01)

Valorant's Riot Vanguard anti-cheat driver takes an aggressive approach to unsigned kernel code that goes beyond load-time blocking or signature scanning. The system:

1. Installs inline hooks on two specific Windows kernel functions: the page fault handler and a software trap handler (an obscure deferred-work dispatcher).

1. Marks suspect memory regions as No-Execute (NX) — specifically the non-paged pool and similar spaces where code-mapped cheats or DMA card payloads often live. At the PPE level, only one or two pages need to be marked, making this very fast.

1. Any execution attempt from NX-marked pages triggers a trap that routes back to Vanguard's custom handler, delivering the fault address for analysis and reporting.

The critical engineering problem: hooking the Windows page fault handler and the software trap handler normally triggers Kernel PatchGuard, which would blue-screen the machine. Vanguard bypasses PatchGuard through a multi-pronged approach: adding a function call to the software interrupt handler that routes to HalPerformEndOfInterrupt and terminates the PatchGuard entry point; queuing infinite wait times on running PatchGuard system threads (setting wait values to 0xFFFFFFFF); and corrupting Deferred Procedure Call (DPC) structures that PatchGuard relies on for its periodic checks.

Sam verified this independently — attempting a simple inline hook on the page fault handler without the PatchGuard bypass triggers an immediate blue screen. Vanguard's approach works in production because it disables the very mechanism that should prevent it.

Defense 2: Software Diversification — Rainbow Six Siege's Build Pool System

▶ Watch: Software Diversification in Rainbow Six Siege (24:02)

Most cheats work by reading memory at hardcoded offsets — the location within the game process where a specific value (enemy health, player coordinates) lives. When a game is patched and recompiled, offsets change, breaking cheats until developers reverse-engineer and update them.

Rainbow Six Siege's QB system extends this disruption by distributing players across a pool of distinct compiled game builds — approximately seven to eight different pools — so that different players are simultaneously running game versions with different offsets, different encryption keys for runtime-decrypted sections, and different obfuscation layouts. A cheat working against pool 1 will fail silently or produce garbage for a player on pool 3.

The practical effect: cheat developers must maintain N separate cheat variants (one per pool), and must repeat the offset-finding process after every game update for all N variants. Dynamic signature scanning to find offsets at runtime is possible but significantly more expensive to engineer. The system drives up cheat development and maintenance cost without requiring any exploit or vulnerability on the attacker's part. Academic software diversification research has discussed this concept for years; the researchers credit Rainbow Six Siege with being among the first to deploy it at production scale in a competitive game.

Defense 3: Detecting and Blocking DMA Cards (Rogue Hardware)

▶ Watch: DMA Card Detection (28:03)

Direct Memory Access (DMA) hardware cheats represent the highest-sophistication tier of the cheating ecosystem. A DMA card plugged into a PCIe slot (or via Thunderbolt) can read game memory directly, bypassing the kernel entirely — including all kernel-mode anti-cheat protections. A companion device intercepts the HDMI signal and overlays enemy positions on the display. DMA cheats do not execute any code on the target system, making them invisible to software-based detection. The same technique (Thunderclap attacks) allows bypassing Windows login screens or dumping cloud VM memory.

Anti-cheat response: enumerate all PCI devices, collect their metadata, serial numbers, and configuration registers. Compare against a database of known DMA card identities. If a device matches, the IOMMU is instructed to disable it. As DMA card vendors responded by configuring their hardware to impersonate legitimate network cards, anti-cheats escalated: they now probe the device's interrupt behavior, send actual network traffic to claimed network cards to verify they respond correctly, and flag devices that fail behavioral verification. As of the time of this research, anti-cheat systems are among the most effective defenses against rogue hardware attacks in any commercial software category.

Defense 4: Memory Invisibility via Page Table Cloning

▶ Watch: Vanguard Memory Cloaking (32:03)

Valorant's most architecturally inventive defense prevents memory-scanning cheats from reading game values even with kernel access. The technique exploits the Windows memory architecture directly:

Each process has a virtual address space backed by a page map — the address in control register CR3. Context-switching between processes loads a new CR3. Vanguard hooks the context switch and inspects the incoming thread: Is it Valorant? Does it belong to the Valorant process? Is it on a pre-defined allowlist?

If all three conditions are met, Vanguard rewrites CR3 to point to a cloned, augmented version of Valorant's page map that contains secret values (enemy locations, etc.) at different virtual addresses. The standard page map — visible to any process that reads Valorant's address space normally — contains only non-sensitive game state. The secret map exists only in kernel-controlled memory, invisible unless an attacker knows to enumerate all of kernel space or successfully reverse-engineers the hook.

The result is an invisibility cloak for sensitive memory values: any process that attaches to Valorant through normal means sees a deliberately impoverished view of the address space.

Measuring Effectiveness

▶ Watch: Empirical Impact of Anti-Cheat Defenses (34:03)

Returning to the cheat marketplace dataset, the researchers correlated anti-cheat defense strength (ranked by number of deployed defenses) against cheat uptime and cheat subscription price. The findings are striking:

• Games with weak anti-cheat showed cheat uptime near 100% and monthly subscription prices of a few dollars.
• Valorant, with the most defenses deployed, showed cheat uptime around 50% and prices an order of magnitude higher than weak-anti-cheat games.
• Game popularity was controlled for and did not explain the price differential. Defense strength was the dominant variable.

This is empirical evidence — not anecdotal — that these kernel-level defenses work.

The Next Battleground: The Hypervisor

Both the cheat and anti-cheat communities are beginning to move toward hypervisor-layer capabilities. Kernel-level defenses can be circumvented by running the cheat inside a hypervisor, which makes kernel-mode detection invisible. Anti-cheat developers are already discussing leveraging Windows' Virtualization-Based Security (VBS) features as a response. The researchers observed that attempting to attach hypervisor-based analysis tools already triggers crashes in some anti-cheat systems — the battle has begun.

Notable Quotes

"Your computer is never as safe as when you're playing Fortnite."

— Sam [00:00]

"Anti-cheat systems blocked all of these four vulnerable drivers already years ahead — like in 2020. So the main takeaway is that cheats and anti-cheats move way faster than malware and EDRs in this attack and defense game."

— Tom [16:01]

"Strong anti-cheats massively increase the price by an order of magnitude. These defenses literally increase the price for the attacker."

— Tom [36:04]

"Anti-cheats implement some of the best defenses out there. We should really get inspiration from what we have learned here and bring it to more software."

— Sam [38:04]

Key Takeaways

• Anti-cheat systems are a leading-edge defense research lab. Vanguard's PatchGuard bypass, memory cloaking, and DMA blocking are not available in most commercial EDR products.
• BYOVD detection was pioneered by anti-cheat, years before enterprise security. BattleEye was blocking vulnerable drivers that later appeared in ransomware campaigns more than a year before any EDR vendor shipped detections.
• Software diversification at scale is proven and deployable. Rainbow Six Siege's build pool system demonstrably raises cheat development cost without any vulnerability or exploit required.
• DMA hardware attacks are real and growing. Anti-cheat systems' multi-layer device verification (including behavioral probing) represents the current state of the art for rogue hardware defense.
• Empirical evidence shows defenses work. Cheat subscription prices correlate strongly with anti-cheat defense depth — a measurable proxy for attacker cost.
• The hypervisor is the next frontier. Enterprise security teams should anticipate that both attacker and defender capability will migrate to the hypervisor layer in coming years.

Slides were not listed as available for this talk.