What's is nProtect Gameguard, how it compares to other anticheats.

[McDinglefart]

Since a lot of people don't understand why nProtect is bad when do many play games with other anticheats etc. and I see my posts about it secretly disappearing, here's a general info what's going on with it. I hope you find it useful, and before going rants how exposing yourself to vulnerabilities are actually is a good thing - you at least read this through.

For those who are not aware what I am talking about: A "root-level" program, sometimes also referred to als "Kernel mode driver" or "ring 0 permission" is something, that operates at the highest operation level on your computer. And we are not talking about "Run as Administrator", here. No. A tool like this has more permissions than an Administrator. In fact, almost nothing you can do on your operating system (assuming Windows for most people) has nearly as much power as a Kernel mode driver. This acts so deep in your system, that it can directly access ANY hardware component.

There are far more than a hundred games that use Anti-Cheat systems that have Kernel-Mode access and the list keeps on growing. But - they are not the same.

Why do some Anti-Cheat systems want to operate in Kernel-Mode?

Because the Kernel-Mode allows you to directly interact with the hardware of your computer. This means to directly access anything that is stored in the RAM, aswell as the GPU-RAM, prioritize or manipulate CPU usage or get any input you deliver to the device via mouse, keyboard, gamepad or any other I:O-device. This obviously makes the detection of something like wallhacks, aimbot or similar external programs quite easy, as the Anti-Cheat doesn't have to operate as a "normal" program, which essentially limits the possibilities to check the images you are receiving on your screen for manipulation. It makes it harder, because many hacks run as a Kernel-Mode. They want to directly access the images your GPU produces, manipulate them and alter the image you receive on your screen. A "normal" Anti-Cheat would then have to check the images, compare them to the original output of the game - which they can't really access, as they only receive the already altered version - and look into a library of illegal alterations, to detect that the image you receive on the screen has been illegally messed with. With Kernel-Mode permissions it is much easier to detect any external interaction with the original game-output to basically catch the hacking-tool red-handed. This is also less resource consuming.

2. But why is it bad then?

For a number of reasons. First of all: Anything that runs as a Kernel Mode has straight access to your hardware. Like, full control. Overclock your CPU to 12GHz and watch it initiate meltdown like a faulty nuclear reactor? It could do that. Have your new GTX 4090 run at 150% with disabled fans until it breaks? Sure, no problem. Better have insurance that doesn't ask questions, as your distributor typically won't accept returns if they find out the hardware has been broken by overclocking. This could happen as an error in the program. But this could also happen on purpose. Now, I get what you are thinking right now: "Why would RIOT / EA / etc. want to brick my computer?" They won't. But who assures you, that their Anti-Cheat system is 100% safe against being hacked itself? Who assures you they will take responsibility, if a bug in their system fries your new 5.000€ gaming rig that you safed up on for the last 3 years?

Who assures you, that an external hacker attack on those tools won't end up reading out your online-banking information? Because those tools could. They are able to extract any hardware information - which includes any password you type into your keyboard.

But this could go even further. Be aware - this now is purely hypothetical and I have NO information as of today that it is being used like that, I just want to point out the potential power that comes with anything that runs on Kernel Mode access levels! I already mentioned Vanguard, the RIOT Anti-Cheat system for Valorant, which I claim to be of the "bad" type of Kernel-Mode Anti Cheat. Now look at the company structure of RIOT Games. RIOT Games is mainly owned by Tencent Games, which is the largest Gaming Studio in the world based on its investments and received multiple fundings straight out of the Chinese Ministry of State Security. And since China has been known for a couple of... let's call them "minor mishappenings", where people who voiced anything that criticized the Chinese Government suddenly went on a vacation from which they never returned. As of September 2022, at least 22.5 Million people had been active in Valorant at least once in the last 30 days. Imagine the possibility of the Chinese Government, if they should decide it would be worth the effort of taking over Tencent Games, with which they had control over RIOT Games and could read out any information on the computers of those 22.5 Million people. Their Whatsapp, Mails, Reddit, anything. This does offer a massive spy-potential. Again! This is purely hypothetical, but be aware that it would be basically no effort at all to change Vanguard to a spy software within hours.

3. But why is Vanguard "bad" and others like "Easy Anti Cheat" is not so bad, as you claim?

I've only breached this very briefly so far. For me there are major differences between Vanguard, EAC, and other Kernel-Mode tools. The major difference is, that Vanguard is ALWAYS(!) running! If you boot your computer, Vanguard is running. Sure, you can disable that. But default is, that it is ALWAYS running. It did require a major ♥♥♥♥♥♥♥♥♥ by us to make it possible to just uninstall it, instead of being forced to irradicate it by hand from the folders and your registry, but even today you have to manually stop it from running after you play, to be able to get rid of it. If you want to play Valorant, you have to reinstall Vanguard and then reboot your computer, so Vanguard forces you to be running when you start your computer. This is unacceptable. But it does get worse. I have mentioned nProtect earlier.

nProtect is not new, but they got a new ♥♥♥♥♥♥♥♥♥ for what happened with the game "Undecember" on steam. I got to admit, I don't know whether nProtect always operated the way it does now. If so - holy cow that is bad. If not - what the hell went wrong with it?

Again, I want to compare it to Vanguard because I believe you do now have a brief unterstanding of how Vanguard operates and why I think it is a terrible tool. But - at least nowadays Vanguard tells you all about it. If you launch Valorant without Vanguard installed, the game tells you, that Vanguard has to be running at system startup. It tells you, that you can uninstall it - and how to do that.

nProtect doesn't tell you any of that. nProtect does not uninstall when you uninstall the game (Undecember in this example), nProtect doesn't even have an uninstaller. It requires you do manually delete multiple Registry-Keys in your system and a system service. Not everybody knows how to do that or is able to understand whether the online-manual on how to do it is actually legit or will damage your computer.

Also, there is a known bug in some versions of this, which allows ANY(!) program on your computer to issue commands through this tool as if they had Administrator privileges. So this tool sits dormant on the highest permission level on your computer without telling you about it, without telling you how to get rid of it and all that with a known history if security breaches? There are almost as many red flags here as in this years F1 qualifying in Imola...

No way I'm letting this tool anywhere near my computer.

Quick comparison to Easy Anti Cheat, which is also getting some beef every now and then - EAC runs on Kernel Mode, too. But EAC starts with the game. Not on Windows startup. If you stop playing the game, EAC stops. There is nothing to be afraid of from EAC outside of any EAC-correlated game. I still wouldn't access critical passwords, onlinebanking, important documents or similar while playing a game with EAC. But once you close the game, there is nothing to worry about.

And even though EAC surely isn't the most reliable Anti-Cheating tool, it will be sufficient for most games, especially smaller ones.

4. But why are tools like nProtect still getting developed and used?

I don't know. I can only assume they are cheap. And that is the issue. A proper Anti-Cheat system is not cheap. Those tools are either expensive or crap. Kind of like with Anti-Virus tools. The cheap ones are mostly useless and those that actually do something will charge you for that. There is a reason you're getting McAfee thrown at you for a couple of free months with every third installer instead of actually charging you for their service...

But back to the games - I don't get why games like Undecember prefer to rely on crappy systems like nProtect instead of taking alternative budget-systems like EAC. Sure, for high level e-sports or top-matchmaking ranked games EAC might not always be the best, and there are flaws in it. But Undecember is a free to play game and I don't think using EAC would've been much more expensive than nProtect. So to put it harshly - they either don't know or don't care about the flaws of nProtect, and I am not sure which is worse...

5. What is the matter with EA Anti Cheat?

First of all - why on earth does a football simulation (or soccer, for our US-friends) require an Anticheat system after all? Are FIFA hacks actually a thing? I've never heard of it. Second - if you develop your own Anti-Cheat system, at least test it on more than the 2 test-machines you've had in your development studio... This tool was so full of bugs and errors, that it made FIFA 23 essentially unplayable on PC for millions of people during the initial 1-3 days of the PC release... The list of fixes the players were supposed to do to fix EA's faulty system was obnoxious... From "update your GPU", over "disable any overlay tools, including NVidia Geforce Replay, discord and XBOX Gamebar" up to "disable your Anti-Virus" this was just sad... And this is by far not the full list... By researching just 5 min for this post I found over 20 fixes that where mostly suggested by players to the players to try out to fix the EA Anti Cheat, and even about a dozen fixes EA suggested themselves. In general - anything that runs on Kernel Mode and then tells me to "disable my AntiVirus" is about as reliable as that Nigerian prince scam.

AFAIK EA Anti Cheat also only runs as long as FIFA does, so I don't really care too much about it. But it has become a thing in the past couple of years, that large gaming companies are trying to develop their own Anti Cheat software and typically they fail in a horrible way.

After all there are far better ways to protect your games than to purely throw Anti-Cheat software at the players. There is no 100% safe Anti-Cheat program, no matter how many privileges you throw at it. The most effective way to prevent cheating is to bind a users account to their real life identity. Be this by their phone-number like in CS:GO or something like the system Blizzard implemented a couple of years back (I think it was to prevent people doing shady stuff with the real-money auction house in Diablo 3, but I could be wrong here) - they implemented the Real-ID, which allowed you to befriend others with their real name and register yourself with yours. This did require you to deliver proof of identity in some way.

Stuff like this will also come with other issues, but your name, age and address of living is something you've given to most companies anyways after you paid for the game or any service inside it by credit card once. So there is nothing new you'd give them.

So finally we have to ask ourselves the question: Do I trust that company enough, to let them access everything on my computer, give them unlimited control over my hardware and be assured, that they will care about those systems enough, that they will still manage to keep them safe from external attacks even in the upcoming years? And in most cases the answer is "no". Because we don't know how much they care. We don't know how much effort they will continue to put into fighting against security breaches. We don't know how long they can keep winning the fight against the hackers until they lose.

6. What happens if they lose?

Depends on the tool. EAC / EA Anti-Cheat? You'd only be affected if you are playing an EAC-related game right now during the attack. Vanguard / nProtect? If you haven't cleaned up and uninstalled the tool after you finished playing you might be in deep trouble. If you did - you will be safe.

Finally - you've made it to the end of this wall of rant. But it frustrates me that this greed for permission on our computer is reaching those dimensions. You could be running 4 or 5 different Kernel Mode Anti Cheat tools right now while reading this. And that is too many. Games are not supposed to have such powerful tools on our computers.

[Kraze]

I don't got time to read all that. Pre-ordered.

[Pakete.xXGSIXx.]

mass hysteria

[Rogue]

Only problem with EAC is it's the one of the most used anti-cheat and heavily focused by hackers. Life is easier if you focus on one brand of security vs many brands of securities. Then sell those bannable cheats to their payers or subscribers, once banned either rename said cheat and rework a tiny bit and repeat and sell to the same fools.

[BigTplaysGamesTTV]

Yea the main cheat sites all make mods for huge sports games like Madden and FIFA. Its awesome for single player challenges that are impossible or teeth-grindingly frustrating. But unfortuntely taking those same hacks online is super easy unless they add anti cheat.

[♫RL]

The fun part about these anti-cheats as well is that 99% of the time they don't actually stop cheats effectively. Cheats consistently get around them so in the end people will run into cheaters anyway. The only thing they actually DO stop is mods. Seen this same thing happen in multiple games, particularly games with EAC. That program is next to worthless.
Lets just say the real reason why they added this though, they're trying to protect their micro transactions. They say they added this "for us" and to "avoid cheaters" but that's a load of crap. Wish they would just stop pretending. Disappointing, honestly.

[why are we here? just to suffer?]

yeah, this was added as it is necessary for them to deeply scan anyone using the game between certain time periods to check their characters and playtime


hard pass.

[Hurricane]

You know, beside the fact this is a cheap anti-cheat rootkit, the game is a live-service.
That's for me a way bigger incentive not to get the game.

[McDinglefart]

Автор сообщения: Hurricane

You know, beside the fact this is a cheap anti-cheat rootkit, the game is a live-service.
That's for me a way bigger incentive not to get the game.

Rotating armor store is a bit weird. Armors gives stats and passive abilities like +50% HP+30% throw range (one of 3 preorder bonus armors), so if you miss 48 hour window and you wanted a specific play armor, you may need to wait for whole 2-4 months login in daily into the game to catch it.

It's about preying on impulsive people who fear to miss out. Same is in darktide, but it's only skins. Still sucks.

[Hurricane]

Автор сообщения: Butzeks

Автор сообщения: Hurricane

You know, beside the fact this is a cheap anti-cheat rootkit, the game is a live-service.
That's for me a way bigger incentive not to get the game.

Rotating armor store is a bit weird. Armors gives stats and passive abilities like +50% HP+30% throw range (one of 3 preorder bonus armors), so if you miss 48 hour window and you wanted a specific play armor, you may need to wait for whole 2-4 months login in daily into the game to catch it.

It's about preying on impulsive people who fear to miss out. Same is in darktide, but it's only skins. Still sucks.

That's what this is for: exploiting kids.
The funniest part is when the service closes (and it will, sooner or later) all the money sunk into it is lost.

[NexAngelus *X*]

armors have stats, the ones u buy or get with money or preorder are suppose to be able to be obtained INGAME. just pro dont look as cool. many games do that. the bonds also dont rotate, they agian claim no FOMO. the small things that will rotate are suppose to be on short rotations not long ones. while it seems misguided they also pointed out the game guard crap, so it seems unlikely they are outright lying. espcially since we have HD1 to look at with its DLCs. cheap and always there.

its annoying though they go on a big rant about why they need game guard and as everyone points out... is NOT the reason to be using "game guard". so thats awkward. and while admitting they dont want to take the time to code.... why dont they have any server checks anywhere? i mean its online only right? we have to login through sony or something. many other games check for a "normal" gain from ur playtime and check to makesure ur not crazy cheating. adding an anti cheat cause cheaters is like banning guns cause gang bangers... plot twist, both are still around and just piss off the customer/citizen

[Godspeed]

Yeah, lost interest on whole game.
It's nice that some people find out this things.

[ScV]

According to this video, even Vanguard cannot protect against cheaters.

[Rosefall]

So you are running Windows systems and talking about how bad kernel anti-cheats are? Yeah, this is hypocrisy right there.

[endercraftsman]

Anyone here who plays PUBG, Phantasy Star online or Blade and Soul, congrats! You have used nProtect Game Guard!

[Jaevwyn]

scraped from here I guess: https://www.reddit.com/r/pcgaming/comments/y5jvzf/root_level_anticheat_is_getting_out_of_hand_again/

either way worrying addition