Why does everyone act like Vanguard (Valorant's anti-cheat) is any good?

[kabanod1m #NotoToxicity]

Apart from just being a closed-source kernel level blob of code, which is by itself already not very safe due to the increased risk of potential vulnerabilities, and just overall not sounding very trustworthy (who knows what else it is doing?), it really isn't that much better than VAC.

Its main difference from which it benefits is the fact that it starts pretty early compared to everything else on your system. However, all a hacker needs to do to circumvent Vanguard is to write another kernel level blob of code that loads before Vanguard, and in this situation Vanguard is already completely on par with VAC! (Write "I read the post thoroughly" at the start of your comment if you read up until this point) The only thing it can do at this point is to trust that nothing extraordinary happened so far (like modification of Vanguard itself, or some spoofing, anything really!) before it loaded and maybe check other kernel drivers for whether they match some known cheating software or not, like VAC has been doing for all these years.

Vanguard might be better because they find more cheats to add to their known cheating software database, but technologically — they are not that far away from each other.
And I did try researching this, despite both systems being pretty secretive about their inner workings (as they should be).

I am, however, open to explanations, especially if a hacker (not a cheater) experienced with both anti-cheats comes by and at least points into the right direction.

[ʚ alex ɞ]

because ur average joe thinks 'kernel driver anticheat = good, usermode = bad' and knows nothing about what actually goes into making a good anticheat

[Pipo Snake]

shoutout to vanguard who made some peoples pcs crash

[󠀡]

Roit games Claim when They HWID ban you they don't do it, it's Vanguard that does it and they can't "Lift the HWID ban" crazy

[ʚ alex ɞ]

Originally posted by '*•.¸♡'Broken'*•♡¸.•:

Roit games Claim when They HWID ban you they don't do it, it's Vanguard that does it and they can't "Lift the HWID ban" crazy

I mean that isn't wrong, HWID bans are of course issued automatically by the anticheat instead of manually by an employee at the company

[coda]

because kernel anticheats is a good marketing tool

[seven]

Originally posted by kabanod1m:

Apart from just being a closed-source kernel level blob of code, which is by itself already not very safe due to the increased risk of potential vulnerabilities, and just overall not sounding very trustworthy (who knows what else it is doing?), it really isn't that much better than VAC.

Its main difference from which it benefits is the fact that it starts pretty early compared to everything else on your system. However, all a hacker needs to do to circumvent Vanguard is to write another kernel level blob of code that loads before Vanguard, and in this situation Vanguard is already completely on par with VAC! (Write "I read the post thoroughly" at the start of your comment if you read up until this point) The only thing it can do at this point is to trust that nothing extraordinary happened so far (like modification of Vanguard itself, or some spoofing, anything really!) before it loaded and maybe check other kernel drivers for whether they match some known cheating software or not, like VAC has been doing for all these years.

Vanguard might be better because they find more cheats to add to their known cheating software database, but technologically — they are not that far away from each other.
And I did try researching this, despite both systems being pretty secretive about their inner workings (as they should be).

I am, however, open to explanations, especially if a hacker (not a cheater) experienced with both anti-cheats comes by and at least points into the right direction.

well vac dosn't work and vanguard does

[Pizzashot]

People do not understand that hackers made kernel anti-cheats and hackers can figure out how to bypass a kernel anti-cheat. Valorant is like CS but cheaters now got cheats + abilities which makes it easier to hide their cheats.. What is needed is a system that just ban you for playing weird for too long, spinhack and kill people, just ban because nobody plays like that. Shoot a scout like a laserbeam, just ban.. Kill players in T spawn from CT spawn, just ban because that is not possible.. CS2 has no rules to how you play, you can do whatever you want with a cheat because the game does not have any rules. They banned players for spinning around but that was not the problem, the problem was that people got kills while spinning around, but the developer were too dumb to understand that.

[Teeth]

Because people in this forum are dumb af, all they think is kernel = good no cheat epik

[Mago ®]

Why do they say it's really good!

[local microwave]

few things wrong with this,
1. "however, all a hacker needs to do to circumvent Vanguard is to write another kernel level blob of code that loads before Vanguard"
to so this they would first need to develop a kernel driver which isn't easy as you would need to have test signing on, for it to even work
most anticheats however will not let you run their games if test signing is on
2. if you want to run a driver without test signing you will need to get it signed by microsoft which both takes time, money and they review the drivers to make sure they're secure
3. vanguard (unlike VAC) actually works enough of the time that it at least allows for peace of mind that you probably just have a skill issue

[ATLAS]

it's made in china guys

['Guti]

I don't play that game and never will.

Relative to the userbase of both games what's the percentage of cheaters over there?

At the end of the day it's all that matter to the end user.

Security this security that... People already install things on their PC/Phone that are more likely to do damage than an anticheat.

[elite outsider]

well i did read the whole first post and i mostly agree
the guy above talking about signing-related details might have a point BUT

i don't see why something needs to be running kernelspace code to detect cheats anyway (but i'm no expert on this)

can't the cs2 userspace code detect when other processes read/write its memory?

Originally posted by 'Guti:

Security this security that... People already install things on their PC/Phone that are more likely to do damage than an anticheat.

unfortunately, two things:
- valve is a very incompetent company
- there is a very large community of people who use valve's games and the steam platform to scam one another (so if there is a vulnerability in the client<->kernelmodule interface they will exploit it to do serious harm)

more things that are likely to do more damage => more chance of actual damage
(adding the cs2 kernel module still makes things worse even if they already had risky stuff installed)

[Raffi]

Originally posted by kabanod1m #NotoToxicity:

not very safe due to the increased risk of potential vulnerabilities

Specifically which "vulnerabilities" are you talking about? Are you just parroting?

Originally posted by kabanod1m #NotoToxicity:

and just overall not sounding very trustworthy (who knows what else it is doing?)

There's the real reason

Originally posted by kabanod1m #NotoToxicity:

it really isn't that much better than VAC... Vanguard is already completely on par with VAC... they are not that far away from each other.

All of the evidence shows that vanguard is significantly better than VAC currently is and even was during VAC's prime. VAC ban stats have been public for nearly a decade and Riot has published their vanguard stats showing a how much more. Vanguard is banning thousands of players a day, VAC barely manages to ban 50.

VAC in it's prime was doing ~800k bans a year which was split up into 4 manual ban waves throughout the year. At best 3 cheaters would spend 3 months ruining hundreds of games and then after a ban wave just buy a new acct and repeat the cycle every 3 months.

The entire point of anti-cheat is to have the highest possible ban rate in the shortest possible time.

You essentially did some "research" into the technical difference of VAC and Kernel AC without actually understanding what you're reading and ignoring the very public ban rates.

Do you think the entire AAA gaming industry adopted Kernel AC and pays $$$$ to AC companies because it's "the same"? You don't think AAA devs evaluate the difference to consider kernel AC over VAC?

You guys love to complain about Kernel AC and how Kernel access = vulnerability while you gobble down every game and software made by devs all around the world who could get instant access to everything or brick your entire PC from one malicious or oopsie update. There is no more or less vulnerability between vanguard and any of the software you install.

[oldirty`]

Thhe awnser is very simple and disappointing. Good marketing. Thats it.