Vanguard runs at boot because cheats run at boot.
Riot clones the PML4 table, inserts a shadow entry into a free slot, hooks SwapContext, and swaps CR3 per-thread at context switch time.
If it was spyware, researchers would have found it. They found this instead.
Reverse engineering is an art. When in doubt, reverse it.
#ReverseEngineering #Vanguard #InfoSec
Full RE breakdown by @Xyrem256: https://t.co/RyUreWosL5
People complain about kernel anti-cheat until they see what EAC actually does to stay ahead.
CR3 encrypted inside EPROCESS. KdpTrap hooked to catch anything touching it during context switches. NtCreateUserProcess emulated so cheats grabbing DirectoryTableBase at process creation get a fake one.
This is what fighting kernel-level cheats actually looks like.
Full breakdown by 0xavx: https://t.co/qEFEWSKEPC
#AntiCheat #GameSecurity
Gamers worry about kernel anti-cheats when any user-mode software (ring-3) can already read your passwords, browser history, log your keystrokes, record your camera, steal your files, and exfiltrate your data.
Spyware has never needed the kernel. Kernel access is not what makes something spyware.
Cheaters have been loading kernel drivers and hypervisors for years to hide from detection. A usermode anti-cheat has no way to detect something already operating below it.
Loading at boot is necessary. If anti-cheat loads after a cheat driver is already in the kernel, it has already lost.
Read: Why Anti-Cheat Software Utilize Kernel Drivers
https://t.co/eTi683zHgc
Author: @vm_call from @the_secret_club
#AntiCheat #GameSecurity
While gamers debate kernel anti-cheat, ring-1[.]io was shipping a Themida-protected UEFI bootkit that injects into Hyper-V, manipulates EPT entries, clones game page tables, and hides memory contents below the OS entirely.
After partially deobfuscating their binaries and recovering critical functions, this is what was inside.
Bungie and Ubisoft sued them.
They found $12 million in Bitcoin and kept going.
This is what kernel anti-cheat is actually fighting.
https://t.co/zHjWeLgQ3X
Authors: @BackEngineerLab
#AntiCheat #Malware #InfoSec
Me aburrí e hice un mini emulador x86 + PE + NT + WinAPI (Kernel32, MSVCRT, NTDLL, User32) en Rust, para compilarlo en WASM por lo cual puedo "correr" un .exe en el navegador:
📚 Be a Hacker — A Practical Roadmap for Self-Taught Hackers
Hacking isn't about tools.
It's about curiosity, understanding how things work, and using them in unintended ways.
This roadmap covers:
• Computer Science basics
• Networking fundamentals
• Linux & Terminal
• Programming (Python)
• Core hacking concepts
• Web, Mobile, OSINT, Malware Analysis & more
Key takeaway:
Learn how systems work. Build. Break. Share. Repeat.
🔗 https://t.co/td3GMefHu3
Created by @s0md3v — one of the most practical guides for beginners entering cybersecurity.
#CyberSecurity #EthicalHacking #OSINT #bugbounty #InfoSec #Linux #Python #LearningInPublic
Valve: "We banned 900k inactive bots, so the problem’s fixed. Please stop complaining."
Also Valve: "Anyway, time to add aim punch on armoured players…"
(Video credit: u/Pik4ur on r/cs2)
Please consider displaying the rank of every player in the scoreboard by default.
It would be very easy to tell in what kind of lobbies we are placed in because most of the times, the skillgap is pretty big even on global lobbies. @CounterStrike
this is how i handle errors in C
this is the cleanest error handling pattern
you call 10 functions and handle all errors in one place
the Linux kernel uses this pattern throughout its drivers and subsystems because it stays readable even when error paths get complicated
Years ago i purchased a pair of flawless MW vice gloves in CSGO for $16,000..
Before CS2, FN vice gloves were rarely flawless and the best pairs peaked at more than $50,000
Today, all FN pairs are flawless, many MW pairs are flawless and even some FT pairs
Todays prices:
My gloves: $16,000➡ $3,000
Flawless FN: $50,000➡️$6,500