While gamers debate kernel anti-cheat, ring-1[.]io was shipping a Themida-protected UEFI bootkit that injects into Hyper-V, manipulates EPT entries, clones game page tables, and hides memory contents below the OS entirely.
After partially deobfuscating their binaries and recovering critical functions, this is what was inside.
Bungie and Ubisoft sued them.
They found $12 million in Bitcoin and kept going.
This is what kernel anti-cheat is actually fighting.
https://t.co/zHjWeLgQ3X
Authors: @BackEngineerLab
#AntiCheat #Malware #InfoSec