What's is nProtect Gameguard, how it compares to other anticheats.

[McDinglefart]

Since a lot of people don't understand why nProtect is bad when do many play games with other anticheats etc. and I see my posts about it secretly disappearing, here's a general info what's going on with it. I hope you find it useful, and before going rants how exposing yourself to vulnerabilities are actually is a good thing - you at least read this through.

For those who are not aware what I am talking about: A "root-level" program, sometimes also referred to als "Kernel mode driver" or "ring 0 permission" is something, that operates at the highest operation level on your computer. And we are not talking about "Run as Administrator", here. No. A tool like this has more permissions than an Administrator. In fact, almost nothing you can do on your operating system (assuming Windows for most people) has nearly as much power as a Kernel mode driver. This acts so deep in your system, that it can directly access ANY hardware component.

There are far more than a hundred games that use Anti-Cheat systems that have Kernel-Mode access and the list keeps on growing. But - they are not the same.

Why do some Anti-Cheat systems want to operate in Kernel-Mode?

Because the Kernel-Mode allows you to directly interact with the hardware of your computer. This means to directly access anything that is stored in the RAM, aswell as the GPU-RAM, prioritize or manipulate CPU usage or get any input you deliver to the device via mouse, keyboard, gamepad or any other I:O-device. This obviously makes the detection of something like wallhacks, aimbot or similar external programs quite easy, as the Anti-Cheat doesn't have to operate as a "normal" program, which essentially limits the possibilities to check the images you are receiving on your screen for manipulation. It makes it harder, because many hacks run as a Kernel-Mode. They want to directly access the images your GPU produces, manipulate them and alter the image you receive on your screen. A "normal" Anti-Cheat would then have to check the images, compare them to the original output of the game - which they can't really access, as they only receive the already altered version - and look into a library of illegal alterations, to detect that the image you receive on the screen has been illegally messed with. With Kernel-Mode permissions it is much easier to detect any external interaction with the original game-output to basically catch the hacking-tool red-handed. This is also less resource consuming.

2. But why is it bad then?

For a number of reasons. First of all: Anything that runs as a Kernel Mode has straight access to your hardware. Like, full control. Overclock your CPU to 12GHz and watch it initiate meltdown like a faulty nuclear reactor? It could do that. Have your new GTX 4090 run at 150% with disabled fans until it breaks? Sure, no problem. Better have insurance that doesn't ask questions, as your distributor typically won't accept returns if they find out the hardware has been broken by overclocking. This could happen as an error in the program. But this could also happen on purpose. Now, I get what you are thinking right now: "Why would RIOT / EA / etc. want to brick my computer?" They won't. But who assures you, that their Anti-Cheat system is 100% safe against being hacked itself? Who assures you they will take responsibility, if a bug in their system fries your new 5.000€ gaming rig that you safed up on for the last 3 years?

Who assures you, that an external hacker attack on those tools won't end up reading out your online-banking information? Because those tools could. They are able to extract any hardware information - which includes any password you type into your keyboard.

But this could go even further. Be aware - this now is purely hypothetical and I have NO information as of today that it is being used like that, I just want to point out the potential power that comes with anything that runs on Kernel Mode access levels! I already mentioned Vanguard, the RIOT Anti-Cheat system for Valorant, which I claim to be of the "bad" type of Kernel-Mode Anti Cheat. Now look at the company structure of RIOT Games. RIOT Games is mainly owned by Tencent Games, which is the largest Gaming Studio in the world based on its investments and received multiple fundings straight out of the Chinese Ministry of State Security. And since China has been known for a couple of... let's call them "minor mishappenings", where people who voiced anything that criticized the Chinese Government suddenly went on a vacation from which they never returned. As of September 2022, at least 22.5 Million people had been active in Valorant at least once in the last 30 days. Imagine the possibility of the Chinese Government, if they should decide it would be worth the effort of taking over Tencent Games, with which they had control over RIOT Games and could read out any information on the computers of those 22.5 Million people. Their Whatsapp, Mails, Reddit, anything. This does offer a massive spy-potential. Again! This is purely hypothetical, but be aware that it would be basically no effort at all to change Vanguard to a spy software within hours.

3. But why is Vanguard "bad" and others like "Easy Anti Cheat" is not so bad, as you claim?

I've only breached this very briefly so far. For me there are major differences between Vanguard, EAC, and other Kernel-Mode tools. The major difference is, that Vanguard is ALWAYS(!) running! If you boot your computer, Vanguard is running. Sure, you can disable that. But default is, that it is ALWAYS running. It did require a major ♥♥♥♥♥♥♥♥♥ by us to make it possible to just uninstall it, instead of being forced to irradicate it by hand from the folders and your registry, but even today you have to manually stop it from running after you play, to be able to get rid of it. If you want to play Valorant, you have to reinstall Vanguard and then reboot your computer, so Vanguard forces you to be running when you start your computer. This is unacceptable. But it does get worse. I have mentioned nProtect earlier.

nProtect is not new, but they got a new ♥♥♥♥♥♥♥♥♥ for what happened with the game "Undecember" on steam. I got to admit, I don't know whether nProtect always operated the way it does now. If so - holy cow that is bad. If not - what the hell went wrong with it?

Again, I want to compare it to Vanguard because I believe you do now have a brief unterstanding of how Vanguard operates and why I think it is a terrible tool. But - at least nowadays Vanguard tells you all about it. If you launch Valorant without Vanguard installed, the game tells you, that Vanguard has to be running at system startup. It tells you, that you can uninstall it - and how to do that.

nProtect doesn't tell you any of that. nProtect does not uninstall when you uninstall the game (Undecember in this example), nProtect doesn't even have an uninstaller. It requires you do manually delete multiple Registry-Keys in your system and a system service. Not everybody knows how to do that or is able to understand whether the online-manual on how to do it is actually legit or will damage your computer.

Also, there is a known bug in some versions of this, which allows ANY(!) program on your computer to issue commands through this tool as if they had Administrator privileges. So this tool sits dormant on the highest permission level on your computer without telling you about it, without telling you how to get rid of it and all that with a known history if security breaches? There are almost as many red flags here as in this years F1 qualifying in Imola...

No way I'm letting this tool anywhere near my computer.

Quick comparison to Easy Anti Cheat, which is also getting some beef every now and then - EAC runs on Kernel Mode, too. But EAC starts with the game. Not on Windows startup. If you stop playing the game, EAC stops. There is nothing to be afraid of from EAC outside of any EAC-correlated game. I still wouldn't access critical passwords, onlinebanking, important documents or similar while playing a game with EAC. But once you close the game, there is nothing to worry about.

And even though EAC surely isn't the most reliable Anti-Cheating tool, it will be sufficient for most games, especially smaller ones.

4. But why are tools like nProtect still getting developed and used?

I don't know. I can only assume they are cheap. And that is the issue. A proper Anti-Cheat system is not cheap. Those tools are either expensive or crap. Kind of like with Anti-Virus tools. The cheap ones are mostly useless and those that actually do something will charge you for that. There is a reason you're getting McAfee thrown at you for a couple of free months with every third installer instead of actually charging you for their service...

But back to the games - I don't get why games like Undecember prefer to rely on crappy systems like nProtect instead of taking alternative budget-systems like EAC. Sure, for high level e-sports or top-matchmaking ranked games EAC might not always be the best, and there are flaws in it. But Undecember is a free to play game and I don't think using EAC would've been much more expensive than nProtect. So to put it harshly - they either don't know or don't care about the flaws of nProtect, and I am not sure which is worse...

5. What is the matter with EA Anti Cheat?

First of all - why on earth does a football simulation (or soccer, for our US-friends) require an Anticheat system after all? Are FIFA hacks actually a thing? I've never heard of it. Second - if you develop your own Anti-Cheat system, at least test it on more than the 2 test-machines you've had in your development studio... This tool was so full of bugs and errors, that it made FIFA 23 essentially unplayable on PC for millions of people during the initial 1-3 days of the PC release... The list of fixes the players were supposed to do to fix EA's faulty system was obnoxious... From "update your GPU", over "disable any overlay tools, including NVidia Geforce Replay, discord and XBOX Gamebar" up to "disable your Anti-Virus" this was just sad... And this is by far not the full list... By researching just 5 min for this post I found over 20 fixes that where mostly suggested by players to the players to try out to fix the EA Anti Cheat, and even about a dozen fixes EA suggested themselves. In general - anything that runs on Kernel Mode and then tells me to "disable my AntiVirus" is about as reliable as that Nigerian prince scam.

AFAIK EA Anti Cheat also only runs as long as FIFA does, so I don't really care too much about it. But it has become a thing in the past couple of years, that large gaming companies are trying to develop their own Anti Cheat software and typically they fail in a horrible way.

After all there are far better ways to protect your games than to purely throw Anti-Cheat software at the players. There is no 100% safe Anti-Cheat program, no matter how many privileges you throw at it. The most effective way to prevent cheating is to bind a users account to their real life identity. Be this by their phone-number like in CS:GO or something like the system Blizzard implemented a couple of years back (I think it was to prevent people doing shady stuff with the real-money auction house in Diablo 3, but I could be wrong here) - they implemented the Real-ID, which allowed you to befriend others with their real name and register yourself with yours. This did require you to deliver proof of identity in some way.

Stuff like this will also come with other issues, but your name, age and address of living is something you've given to most companies anyways after you paid for the game or any service inside it by credit card once. So there is nothing new you'd give them.

So finally we have to ask ourselves the question: Do I trust that company enough, to let them access everything on my computer, give them unlimited control over my hardware and be assured, that they will care about those systems enough, that they will still manage to keep them safe from external attacks even in the upcoming years? And in most cases the answer is "no". Because we don't know how much they care. We don't know how much effort they will continue to put into fighting against security breaches. We don't know how long they can keep winning the fight against the hackers until they lose.

6. What happens if they lose?

Depends on the tool. EAC / EA Anti-Cheat? You'd only be affected if you are playing an EAC-related game right now during the attack. Vanguard / nProtect? If you haven't cleaned up and uninstalled the tool after you finished playing you might be in deep trouble. If you did - you will be safe.

Finally - you've made it to the end of this wall of rant. But it frustrates me that this greed for permission on our computer is reaching those dimensions. You could be running 4 or 5 different Kernel Mode Anti Cheat tools right now while reading this. And that is too many. Games are not supposed to have such powerful tools on our computers.

[Sacred)(Rhaine]

"nProtect does not uninstall when you uninstall the game (Undecember in this example)"
Helldivers devs already confirmed it will be removed if you uninstall the game.

"nProtect doesn't even have an uninstaller."
It does.
https://gameguardfaq.nprotect.com/eng/con_22.html

[Dark Exile]

i stopped reading at "idk why they dont use EAC".

EAC has been cracked on every game its on, and i dont mean its running, i mean you can literally start the games without it running and do what you want, its one of the easiest anti cheats to bypass (if we ignore the existence of battle eye).

Theres a reason everyone with half a mind to protect their store or online progression is going rootkit, dont have to like it, dont have to buy it.
As for there being no way to uninstall it, so far thats false considering theyve already posted the directory you can find the uninstaller in.

[McDinglefart]

Opprinnelig skrevet av Dark Exile:

i stopped reading at "idk why they dont use EAC".

EAC has been cracked on every game its on, and i dont mean its running, i mean you can literally start the games without it running and do what you want, its one of the easiest anti cheats to bypass (if we ignore the existence of battle eye).

Theres a reason everyone with half a mind to protect their store or online progression is going rootkit, dont have to like it, dont have to buy it.
As for there being no way to uninstall it, so far thats false considering theyve already posted the directory you can find the uninstaller in.

GG opening browser on its own to download file to reinstall itself:
https://steamcommunity.com/app/1549250/discussions/0/3388420307306147309/

Gameguard is also a failure to function as anticheat. Just look at lineage game. Nothing changed since GameGuard was added. Still full of bots.

[Dark Exile]

Opprinnelig skrevet av Butzeks:

Opprinnelig skrevet av Dark Exile:

i stopped reading at "idk why they dont use EAC".

EAC has been cracked on every game its on, and i dont mean its running, i mean you can literally start the games without it running and do what you want, its one of the easiest anti cheats to bypass (if we ignore the existence of battle eye).

Theres a reason everyone with half a mind to protect their store or online progression is going rootkit, dont have to like it, dont have to buy it.
As for there being no way to uninstall it, so far thats false considering theyve already posted the directory you can find the uninstaller in.

GG opening browser on its own to download file to reinstall itself:
https://steamcommunity.com/app/1549250/discussions/0/3388420307306147309/

Gameguard is also a failure to function as anticheat. Just look at lineage game. Nothing changed since GameGuard was added. Still full of bots.

Funny, i played that game and it didnt do that when i ran it, hasnt done it since i uninstalled it either.

[phlux]

Opprinnelig skrevet av Rosefall:

So you are running Windows systems and talking about how bad kernel anti-cheats are? Yeah, this is hypocrisy right there.

I always find it funny how people choose what security issue they're absolutely hysteric about and preach to the masses to wake up because of the risks and which ones they straight up choose to ignore.
Shoutout to my boy Snowden :D

[Hurricane]

Opprinnelig skrevet av Dark Exile:

i stopped reading at "idk why they dont use EAC".

EAC has been cracked on every game its on, and i dont mean its running, i mean you can literally start the games without it running and do what you want, its one of the easiest anti cheats to bypass (if we ignore the existence of battle eye).

Theres a reason everyone with half a mind to protect their store or online progression is going rootkit, dont have to like it, dont have to buy it.
As for there being no way to uninstall it, so far thats false considering theyve already posted the directory you can find the uninstaller in.

You'll be surprised to learn they all have about the same level of detection rate.
Which implies they all have about the same level of efficiency, which is pretty low.

[Drake1988]

Opprinnelig skrevet av Carcharodon Vizcara:

Opprinnelig skrevet av woah:

wait

why do they got anti cheat

its...

co-op


..........................................................................

cash shop game?

It will have a cash-shop. They've already discussed warbonds on their discord, and shown some videos. Someone Copy/Pasted it in a post here in the Steam forums as well.

In the previous HD1, the cash-shop also sold weapons, gear, utility devices (healing drones, turrets..etc), and vehicles like mechs/tanks. Warbonds do something similar but we haven't gotten specifics on what exactly will be sold to us overtime besides the warbonds.

since when do microtransaction need to be protected by anticheats? thats new to me.

and tbh, it seems stupid to me as a dev. probably just another studio that isnt able to implement a client-server system where the server has authority over whats happening at the client. :D
but instead throws some random anti cheat at it. and by the looks one of the worst at that.

[Nick Naughty]

Anti-cheat sounds like PunkBuster, always active.

[Tardicus Maximus]

Opprinnelig skrevet av Amaranth:

Just don't install it and move along then,

Clown alert dude. Yeah I won't give the devs money till they get rid of the ♥♥♥♥♥♥ anti cheat that can SA my PC. I'm willing to bet you're the kinda guy that'll be comfortable not owning their games.

[sgtkoolaid]

The responses about the store sounds kind of p2w to me. Hard pass. Besides the intrusive anti cheat. Was kind of interested in getting this game. Kind of sad really.

[McDinglefart]

How are you enjoying your gameguard, kids?

[Ellie]

Oh well, that's me out then. Thanks!

[Roland]

Opprinnelig skrevet av Butzeks:

5. What is the matter with EA Anti Cheat?

First of all - why on earth does a football simulation (or soccer, for our US-friends) require an Anticheat system after all? Are FIFA hacks actually a thing? I've never heard of it. Second - if you develop your own Anti-Cheat system, at least test it on more than the 2 test-machines you've had in your development studio... This tool was so full of bugs and errors, that it made FIFA 23 essentially unplayable on PC for millions of people during the initial 1-3 days of the PC release... The list of fixes the players were supposed to do to fix EA's faulty system was obnoxious... From "update your GPU", over "disable any overlay tools, including NVidia Geforce Replay, discord and XBOX Gamebar" up to "disable your Anti-Virus" this was just sad... And this is by far not the full list... By researching just 5 min for this post I found over 20 fixes that where mostly suggested by players to the players to try out to fix the EA Anti Cheat, and even about a dozen fixes EA suggested themselves. In general - anything that runs on Kernel Mode and then tells me to "disable my AntiVirus" is about as reliable as that Nigerian prince scam.
.

I was going to address a different matter, but then I saw this and hold up, stop. Just stop. You're clearly sheltered and know nothing of the real world.
First off, YES FIFA hacks are a thing, there's entire gambling communities around FIFA. I know this and I'm American and surrounded by people that don't like Soccer/football or FIFA. (It's primarily a European thing)


♥♥♥♥♥♥ hell normally I like to quote the part I'ma ddressing but your post is such a train wreck of information that is true and false that it's obnoxious as ♥♥♥♥ to parse so I'm just going to give you a list:

Gamegaurd does uninstall with the game. Just because Undecember ♥♥♥♥♥♥ up doesn't mean they did here.
Proof:
https://steamcommunity.com/app/553850/discussions/2/4206994023681287288/
(also you can just verify the game files and see it ask you to confirm uninstalling GG before it ever even starts verifying. It does not reinstall until you launch the game again)

EAC is literally the worst Anti cheat out there and APex Legends is in a whole mess of ♥♥♥♥ because of how bad it is
Proof:
https://esi.si.com/apex-legends/nickmercs-demands-jail-time-for-cheaters

ALSO Undecember was ♥♥♥♥♥♥♥ stupid because there's been a tool to remove GG for 20 years.
Proof:
https://steamcommunity.com/app/553850/discussions/0/4206994023675674196/
They were just bad at their job all around and not a good example of anything; except maybe that anyone can be a game dev.

I could nitpick a bunch of minor ♥♥♥♥ you got wrong too but frankly trying to parse the ♥♥♥♥♥♥♥♥ is exhausting. You got some stuff right but you are completely ♥♥♥♥♥♥♥ wrong on a lot of things that make your other arguments fall apart (like EAC being good for example)

Your intent is good but your sources are bad and your building arguments on bad sources.

[McDinglefart]

Opprinnelig skrevet av Roland:

Opprinnelig skrevet av Butzeks:

5. What is the matter with EA Anti Cheat?

First of all - why on earth does a football simulation (or soccer, for our US-friends) require an Anticheat system after all? Are FIFA hacks actually a thing? I've never heard of it. Second - if you develop your own Anti-Cheat system, at least test it on more than the 2 test-machines you've had in your development studio... This tool was so full of bugs and errors, that it made FIFA 23 essentially unplayable on PC for millions of people during the initial 1-3 days of the PC release... The list of fixes the players were supposed to do to fix EA's faulty system was obnoxious... From "update your GPU", over "disable any overlay tools, including NVidia Geforce Replay, discord and XBOX Gamebar" up to "disable your Anti-Virus" this was just sad... And this is by far not the full list... By researching just 5 min for this post I found over 20 fixes that where mostly suggested by players to the players to try out to fix the EA Anti Cheat, and even about a dozen fixes EA suggested themselves. In general - anything that runs on Kernel Mode and then tells me to "disable my AntiVirus" is about as reliable as that Nigerian prince scam.
.

I was going to address a different matter, but then I saw this and hold up, stop. Just stop. You're clearly sheltered and know nothing of the real world.
First off, YES FIFA hacks are a thing, there's entire gambling communities around FIFA. I know this and I'm American and surrounded by people that don't like Soccer/football or FIFA. (It's primarily a European thing)


♥♥♥♥♥♥ hell normally I like to quote the part I'ma ddressing but your post is such a train wreck of information that is true and false that it's obnoxious as ♥♥♥♥ to parse so I'm just going to give you a list:

Gamegaurd does uninstall with the game. Just because Undecember ♥♥♥♥♥♥ up doesn't mean they did here.
Proof:
https://steamcommunity.com/app/553850/discussions/2/4206994023681287288/
(also you can just verify the game files and see it ask you to confirm uninstalling GG before it ever even starts verifying. It does not reinstall until you launch the game again)

EAC is literally the worst Anti cheat out there and APex Legends is in a whole mess of ♥♥♥♥ because of how bad it is
Proof:
https://esi.si.com/apex-legends/nickmercs-demands-jail-time-for-cheaters

ALSO Undecember was ♥♥♥♥♥♥♥ stupid because there's been a tool to remove GG for 20 years.
Proof:
https://steamcommunity.com/app/553850/discussions/0/4206994023675674196/
They were just bad at their job all around and not a good example of anything; except maybe that anyone can be a game dev.

I could nitpick a bunch of minor ♥♥♥♥ you got wrong too but frankly trying to parse the ♥♥♥♥♥♥♥♥ is exhausting. You got some stuff right but you are completely ♥♥♥♥♥♥♥ wrong on a lot of things that make your other arguments fall apart (like EAC being good for example)

Your intent is good but your sources are bad and your building arguments on bad sources.

Gameguard is good tho? Ever heard of lineage. It does not prevent any cheating.

[Roland]

Opprinnelig skrevet av Butzeks:

Opprinnelig skrevet av Roland:

I was going to address a different matter, but then I saw this and hold up, stop. Just stop. You're clearly sheltered and know nothing of the real world.
First off, YES FIFA hacks are a thing, there's entire gambling communities around FIFA. I know this and I'm American and surrounded by people that don't like Soccer/football or FIFA. (It's primarily a European thing)


♥♥♥♥♥♥ hell normally I like to quote the part I'ma ddressing but your post is such a train wreck of information that is true and false that it's obnoxious as ♥♥♥♥ to parse so I'm just going to give you a list:

Gamegaurd does uninstall with the game. Just because Undecember ♥♥♥♥♥♥ up doesn't mean they did here.
Proof:
https://steamcommunity.com/app/553850/discussions/2/4206994023681287288/
(also you can just verify the game files and see it ask you to confirm uninstalling GG before it ever even starts verifying. It does not reinstall until you launch the game again)

EAC is literally the worst Anti cheat out there and APex Legends is in a whole mess of ♥♥♥♥ because of how bad it is
Proof:
https://esi.si.com/apex-legends/nickmercs-demands-jail-time-for-cheaters

ALSO Undecember was ♥♥♥♥♥♥♥ stupid because there's been a tool to remove GG for 20 years.
Proof:
https://steamcommunity.com/app/553850/discussions/0/4206994023675674196/
They were just bad at their job all around and not a good example of anything; except maybe that anyone can be a game dev.

I could nitpick a bunch of minor ♥♥♥♥ you got wrong too but frankly trying to parse the ♥♥♥♥♥♥♥♥ is exhausting. You got some stuff right but you are completely ♥♥♥♥♥♥♥ wrong on a lot of things that make your other arguments fall apart (like EAC being good for example)

Your intent is good but your sources are bad and your building arguments on bad sources.

Gameguard is good tho? Ever heard of lineage. It does not prevent any cheating.

Ever heard of PSO2?
Show me the cheaters.

Don't ignore the fact that GG DOES UNINSTALL and that EAC is literally killing Apex Legends because of how bad it is...

Or that you built your entire argument around bad information.