Valve announced a change for Steam today that will make things a lot clearer for everyone, as developers will now need to clearly list the kernel-level anti-cheat used on Steam store pages.
Now if only they could more clearly communicate when games are playable offline.
If I was trying to prevent cheating, I’d hash the relevant game files, encrypt the values, and hard-code them into the executable. Then when the game is launched, calculated the hash of the existing files and compare to the saved values.
What is gained by running anti-cheat in kernel mode? I only play single-player games, so I assume I’m missing something.
What you proposed can very easily be bypassed without even needing kernel access by just editing the executable code that checks hashes to always return true
It’s not like there are so many other ways to cheat, actually used in many games with anticheats.
We should all stop pretending it’s necessary to put malware into your computer just so some company can claim they have no cheaters, which is never even true.
The point of anti-cheat is to create a substantial barrier for cheating. If you have to go the extra mile to run an external hardware cheat so as to be “undetected” then surely this means the anti-cheat is working. If it were as ineffective as you imply, cheaters would be cheating on their main accounts.
Modern cheats for multiplayer games don’t modify local files (or attribute values in memory), since the server validates everything anyway. They’re about giving you information that’s available but not shown in the game (like see-through walls, or exact skill ranges), or manipulate input (dodge enemy damage, easy combos). Those cheat can run in kernel mode (or at least evade detection from user mode), so the anti-cheat needs kernel mode to be more effective.
The server doesn’t validate shit, because that takes up CPU cycles on THEIR hardware, which costs them money. A huge part of kernel level anticheat is forcing YOU to pay the cost for anticheat, so they can squeeze a few more pennies out of it. And if your computer gets owned because they installed insecure, buggy malware on your system…? Well, they’ll just deny. After all, it’s kernel-level, how are YOU going to prove anything?
They can prevent you from running cheats that other anti-cheats can’t detect. For instance, they could modify the value in memory so that your calculated hash always succeeds even when it’s modified. This doesn’t stop cheating though; it just means cheaters have to use cheat hardware that exists at a layer that even kernel anti-cheat can’t detect.
And then a game gets updated so the hashes don’t match and uh oh, everything is fucked. Oh, but we can change the hashes of the files in the executable! Yeah, so can they. People modding shit into the executable is basically a given. Let alone the fact that you’d need to sit through a steam “validation of files” length of time every time you’d need to launch a game (because validation works exactly as you have described).
What is gained is that it has access to more information. Some cheats use an entirely different program / process that reads memory and outputs info that is available to the game but hidden from the player. Like a client needs to know where a person on the other team is to be able to draw their model. So you read that, you put a little box over where they are, and bang you have wallhacks.
Why is kernel-level anti-cheat even a thing?
If I was trying to prevent cheating, I’d hash the relevant game files, encrypt the values, and hard-code them into the executable. Then when the game is launched, calculated the hash of the existing files and compare to the saved values.
What is gained by running anti-cheat in kernel mode? I only play single-player games, so I assume I’m missing something.
Because there are kernel-level cheats
What you proposed can very easily be bypassed without even needing kernel access by just editing the executable code that checks hashes to always return true
Boo freaking hoo.
It’s not like there are so many other ways to cheat, actually used in many games with anticheats.
We should all stop pretending it’s necessary to put malware into your computer just so some company can claim they have no cheaters, which is never even true.
The point of anti-cheat is to create a substantial barrier for cheating. If you have to go the extra mile to run an external hardware cheat so as to be “undetected” then surely this means the anti-cheat is working. If it were as ineffective as you imply, cheaters would be cheating on their main accounts.
Modern cheats for multiplayer games don’t modify local files (or attribute values in memory), since the server validates everything anyway. They’re about giving you information that’s available but not shown in the game (like see-through walls, or exact skill ranges), or manipulate input (dodge enemy damage, easy combos). Those cheat can run in kernel mode (or at least evade detection from user mode), so the anti-cheat needs kernel mode to be more effective.
Oh you sweet summer child.
The server doesn’t validate shit, because that takes up CPU cycles on THEIR hardware, which costs them money. A huge part of kernel level anticheat is forcing YOU to pay the cost for anticheat, so they can squeeze a few more pennies out of it. And if your computer gets owned because they installed insecure, buggy malware on your system…? Well, they’ll just deny. After all, it’s kernel-level, how are YOU going to prove anything?
They can prevent you from running cheats that other anti-cheats can’t detect. For instance, they could modify the value in memory so that your calculated hash always succeeds even when it’s modified. This doesn’t stop cheating though; it just means cheaters have to use cheat hardware that exists at a layer that even kernel anti-cheat can’t detect.
And then a game gets updated so the hashes don’t match and uh oh, everything is fucked. Oh, but we can change the hashes of the files in the executable! Yeah, so can they. People modding shit into the executable is basically a given. Let alone the fact that you’d need to sit through a steam “validation of files” length of time every time you’d need to launch a game (because validation works exactly as you have described).
What is gained is that it has access to more information. Some cheats use an entirely different program / process that reads memory and outputs info that is available to the game but hidden from the player. Like a client needs to know where a person on the other team is to be able to draw their model. So you read that, you put a little box over where they are, and bang you have wallhacks.
I think the popular thing now is to mod your mouse so it clicks on the enemy player’s head.
You don’t need to modify the files to modify data in memory.