PSA: What's is nProtect Gameguard, how it compares to other anticheats.

[Pekora]

Since a lot of people don't understand why nProtect is bad when do many play games with other anticheats etc. and I see my posts about it secretly disappearing, here's a general info what's going on with it. I hope you find it useful, and before going rants how exposing yourself to vulnerabilities are actually is a good thing - you at least read this through.

For those who are not aware what I am talking about: A "root-level" program, sometimes also referred to als "Kernel mode driver" or "ring 0 permission" is something, that operates at the highest operation level on your computer. And we are not talking about "Run as Administrator", here. No. A tool like this has more permissions than an Administrator. In fact, almost nothing you can do on your operating system (assuming Windows for most people) has nearly as much power as a Kernel mode driver. This acts so deep in your system, that it can directly access ANY hardware component.

There are far more than a hundred games that use Anti-Cheat systems that have Kernel-Mode access and the list keeps on growing. But - they are not the same.

Why do some Anti-Cheat systems want to operate in Kernel-Mode?

Because the Kernel-Mode allows you to directly interact with the hardware of your computer. This means to directly access anything that is stored in the RAM, aswell as the GPU-RAM, prioritize or manipulate CPU usage or get any input you deliver to the device via mouse, keyboard, gamepad or any other I:O-device. This obviously makes the detection of something like wallhacks, aimbot or similar external programs quite easy, as the Anti-Cheat doesn't have to operate as a "normal" program, which essentially limits the possibilities to check the images you are receiving on your screen for manipulation. It makes it harder, because many hacks run as a Kernel-Mode. They want to directly access the images your GPU produces, manipulate them and alter the image you receive on your screen. A "normal" Anti-Cheat would then have to check the images, compare them to the original output of the game - which they can't really access, as they only receive the already altered version - and look into a library of illegal alterations, to detect that the image you receive on the screen has been illegally messed with. With Kernel-Mode permissions it is much easier to detect any external interaction with the original game-output to basically catch the hacking-tool red-handed. This is also less resource consuming.

2. But why is it bad then?

For a number of reasons. First of all: Anything that runs as a Kernel Mode has straight access to your hardware. Like, full control. Overclock your CPU to 12GHz and watch it initiate meltdown like a faulty nuclear reactor? It could do that. Have your new GTX 4090 run at 150% with disabled fans until it breaks? Sure, no problem. Better have insurance that doesn't ask questions, as your distributor typically won't accept returns if they find out the hardware has been broken by overclocking. This could happen as an error in the program. But this could also happen on purpose. Now, I get what you are thinking right now: "Why would RIOT / EA / etc. want to brick my computer?" They won't. But who assures you, that their Anti-Cheat system is 100% safe against being hacked itself? Who assures you they will take responsibility, if a bug in their system fries your new 5.000€ gaming rig that you safed up on for the last 3 years?

Who assures you, that an external hacker attack on those tools won't end up reading out your online-banking information? Because those tools could. They are able to extract any hardware information - which includes any password you type into your keyboard.

But this could go even further. Be aware - this now is purely hypothetical and I have NO information as of today that it is being used like that, I just want to point out the potential power that comes with anything that runs on Kernel Mode access levels! I already mentioned Vanguard, the RIOT Anti-Cheat system for Valorant, which I claim to be of the "bad" type of Kernel-Mode Anti Cheat. Now look at the company structure of RIOT Games. RIOT Games is mainly owned by Tencent Games, which is the largest Gaming Studio in the world based on its investments and received multiple fundings straight out of the Chinese Ministry of State Security. And since China has been known for a couple of... let's call them "minor mishappenings", where people who voiced anything that criticized the Chinese Government suddenly went on a vacation from which they never returned. As of September 2022, at least 22.5 Million people had been active in Valorant at least once in the last 30 days. Imagine the possibility of the Chinese Government, if they should decide it would be worth the effort of taking over Tencent Games, with which they had control over RIOT Games and could read out any information on the computers of those 22.5 Million people. Their Whatsapp, Mails, Reddit, anything. This does offer a massive spy-potential. Again! This is purely hypothetical, but be aware that it would be basically no effort at all to change Vanguard to a spy software within hours.

3. But why is Vanguard "bad" and others like "Easy Anti Cheat" is not so bad, as you claim?

I've only breached this very briefly so far. For me there are major differences between Vanguard, EAC, and other Kernel-Mode tools. The major difference is, that Vanguard is ALWAYS(!) running! If you boot your computer, Vanguard is running. Sure, you can disable that. But default is, that it is ALWAYS running. It did require a major ♥♥♥♥♥♥♥♥♥ by us to make it possible to just uninstall it, instead of being forced to irradicate it by hand from the folders and your registry, but even today you have to manually stop it from running after you play, to be able to get rid of it. If you want to play Valorant, you have to reinstall Vanguard and then reboot your computer, so Vanguard forces you to be running when you start your computer. This is unacceptable. But it does get worse. I have mentioned nProtect earlier.

nProtect is not new, but they got a new ♥♥♥♥♥♥♥♥♥ for what happened with the game "Undecember" on steam. I got to admit, I don't know whether nProtect always operated the way it does now. If so - holy cow that is bad. If not - what the hell went wrong with it?

Again, I want to compare it to Vanguard because I believe you do now have a brief unterstanding of how Vanguard operates and why I think it is a terrible tool. But - at least nowadays Vanguard tells you all about it. If you launch Valorant without Vanguard installed, the game tells you, that Vanguard has to be running at system startup. It tells you, that you can uninstall it - and how to do that.

nProtect doesn't tell you any of that. nProtect does not uninstall when you uninstall the game (Undecember in this example), nProtect doesn't even have an uninstaller. It requires you do manually delete multiple Registry-Keys in your system and a system service. Not everybody knows how to do that or is able to understand whether the online-manual on how to do it is actually legit or will damage your computer.

Also, there is a known bug in some versions of this, which allows ANY(!) program on your computer to issue commands through this tool as if they had Administrator privileges. So this tool sits dormant on the highest permission level on your computer without telling you about it, without telling you how to get rid of it and all that with a known history if security breaches? There are almost as many red flags here as in this years F1 qualifying in Imola...

No way I'm letting this tool anywhere near my computer.

Quick comparison to Easy Anti Cheat, which is also getting some beef every now and then - EAC runs on Kernel Mode, too. But EAC starts with the game. Not on Windows startup. If you stop playing the game, EAC stops. There is nothing to be afraid of from EAC outside of any EAC-correlated game. I still wouldn't access critical passwords, onlinebanking, important documents or similar while playing a game with EAC. But once you close the game, there is nothing to worry about.

And even though EAC surely isn't the most reliable Anti-Cheating tool, it will be sufficient for most games, especially smaller ones.

4. But why are tools like nProtect still getting developed and used?

I don't know. I can only assume they are cheap. And that is the issue. A proper Anti-Cheat system is not cheap. Those tools are either expensive or crap. Kind of like with Anti-Virus tools. The cheap ones are mostly useless and those that actually do something will charge you for that. There is a reason you're getting McAfee thrown at you for a couple of free months with every third installer instead of actually charging you for their service...

But back to the games - I don't get why games like Undecember prefer to rely on crappy systems like nProtect instead of taking alternative budget-systems like EAC. Sure, for high level e-sports or top-matchmaking ranked games EAC might not always be the best, and there are flaws in it. But Undecember is a free to play game and I don't think using EAC would've been much more expensive than nProtect. So to put it harshly - they either don't know or don't care about the flaws of nProtect, and I am not sure which is worse...

5. What is the matter with EA Anti Cheat?

First of all - why on earth does a football simulation (or soccer, for our US-friends) require an Anticheat system after all? Are FIFA hacks actually a thing? I've never heard of it. Second - if you develop your own Anti-Cheat system, at least test it on more than the 2 test-machines you've had in your development studio... This tool was so full of bugs and errors, that it made FIFA 23 essentially unplayable on PC for millions of people during the initial 1-3 days of the PC release... The list of fixes the players were supposed to do to fix EA's faulty system was obnoxious... From "update your GPU", over "disable any overlay tools, including NVidia Geforce Replay, discord and XBOX Gamebar" up to "disable your Anti-Virus" this was just sad... And this is by far not the full list... By researching just 5 min for this post I found over 20 fixes that where mostly suggested by players to the players to try out to fix the EA Anti Cheat, and even about a dozen fixes EA suggested themselves. In general - anything that runs on Kernel Mode and then tells me to "disable my AntiVirus" is about as reliable as that Nigerian prince scam.

AFAIK EA Anti Cheat also only runs as long as FIFA does, so I don't really care too much about it. But it has become a thing in the past couple of years, that large gaming companies are trying to develop their own Anti Cheat software and typically they fail in a horrible way.

After all there are far better ways to protect your games than to purely throw Anti-Cheat software at the players. There is no 100% safe Anti-Cheat program, no matter how many privileges you throw at it. The most effective way to prevent cheating is to bind a users account to their real life identity. Be this by their phone-number like in CS:GO or something like the system Blizzard implemented a couple of years back (I think it was to prevent people doing shady stuff with the real-money auction house in Diablo 3, but I could be wrong here) - they implemented the Real-ID, which allowed you to befriend others with their real name and register yourself with yours. This did require you to deliver proof of identity in some way.

Stuff like this will also come with other issues, but your name, age and address of living is something you've given to most companies anyways after you paid for the game or any service inside it by credit card once. So there is nothing new you'd give them.

So finally we have to ask ourselves the question: Do I trust that company enough, to let them access everything on my computer, give them unlimited control over my hardware and be assured, that they will care about those systems enough, that they will still manage to keep them safe from external attacks even in the upcoming years? And in most cases the answer is "no". Because we don't know how much they care. We don't know how much effort they will continue to put into fighting against security breaches. We don't know how long they can keep winning the fight against the hackers until they lose.

6. What happens if they lose?

Depends on the tool. EAC / EA Anti-Cheat? You'd only be affected if you are playing an EAC-related game right now during the attack. Vanguard / nProtect? If you haven't cleaned up and uninstalled the tool after you finished playing you might be in deep trouble. If you did - you will be safe.

Finally - you've made it to the end of this wall of rant. But it frustrates me that this greed for permission on our computer is reaching those dimensions. You could be running 4 or 5 different Kernel Mode Anti Cheat tools right now while reading this. And that is too many. Games are not supposed to have such powerful tools on our computers.

[CrypticTaco]

Honestly good post and nails home the exact problem

[Uncle Dre]

you literally copied and pasted another person's discussion post word for word. Like why

https://steamcommunity.com/app/553850/discussions/0/4206993639701617701/

[Pekora]

Originally posted by Larry June:

you literally copied and pasted another person's discussion post word for word. Like why :yaranaika:

https://steamcommunity.com/app/553850/discussions/0/4206993639701617701/

1. Because that user is banned and is unable to repost it again
2. For visibility and awareness, why else.

I understand some people want to put the topic under the rug, but you don't have to be that obvious.

[Reiniell]

Nice Post with actual knowledge and the first time seeing someone writing kernel right... All those "kernal" posts only show how knowledgeable people are about this topic...

[Uncle Dre]

Originally posted by Pekora:

Originally posted by Larry June:

you literally copied and pasted another person's discussion post word for word. Like why

https://steamcommunity.com/app/553850/discussions/0/4206993639701617701/

1. Because that user is banned and is unable to repost it again
2. For visibility and awareness, why else.

I understand some people want to put the topic under the rug, but you don't have to be that obvious.

1.Why repost it if its already up and still up. The post is still easily found. you can still make comments on the post.
2. post is still easily found therefore its visible. Seems like you are just farming

[Pekora]

Originally posted by Larry June:

Originally posted by Pekora:

1. Because that user is banned and is unable to repost it again
2. For visibility and awareness, why else.

I understand some people want to put the topic under the rug, but you don't have to be that obvious.

1.Why repost it if its already up and still up. The post is still easily found. you can still make comments on the post.
2. post is still easily found therefore its visible. Seems like you are just farming

Do you realize we're not even on the same forum category right? If you're gonna troll, please do it harder. Ignored for offtopic

[Uncle Dre]

Originally posted by Pekora:

Originally posted by Larry June:

1.Why repost it if its already up and still up. The post is still easily found. you can still make comments on the post.
2. post is still easily found therefore its visible. Seems like you are just farming

Do you realize we're not even on the same forum category right? If you're gonna troll, please do it harder. Ignored for offtopic

Not being in the same category doesnt really negate the fact you just copied and pasted a whole post to award farm. Gotta really stop using "spreading awareness " as an excuse.

[BlkTA]

point #3 - note that the devs of this game outright lie in their Q&A. NProtect will not uninstall when you uninstall the game. It MUST be cleaned with a registry tool and manual file deletion as I've experienced in other games.

[Hornet]

Originally posted by BlkTA:

point #3 - note that the devs of this game outright lie in their Q&A. NProtect will not uninstall when you uninstall the game. It MUST be cleaned with a registry tool and manual file deletion as I've experienced in other games.

They mention that there's an uninstall .exe in the game files. It's the same file the Undecember devs gave to players of their game to uninstall gameguard, but I don't actually know if it fully removes all the registry entries and stuff. I can't seem to find anyone saying whether it does or not.
That said, even if that uninstall exe does fully remove gameguard, I kind of doubt it runs automatically when you uninstall the game.

[Jeff]

Is there a techinical explanation on what it actually does, instead of everyone just copy pasting the same schmuck everywhere?
Either the game doesn't have a hard requirement for the anti-cheat or it doesn't actually run at the kernel level, since it runs fine under Linux.

[HrznEnigma]

This guy just copy pasting?

[Thomas Anderson]

How do we request a topic get stickied? This is very important for users to know.

[★ ace ★]

this is not important information at all

[DiabloKhel]

Originally posted by ★ ace ★:

this is not important information at all

Why not?

[Thomas Anderson]

Originally posted by DiabloKhel:

Originally posted by ★ ace ★:

this is not important information at all

Why not?

Just ignore and report Ace's posts. They're trolling all over the forum. Best to not acknowledge them unless you want to be goaded into a fruitless argument.