Is it possible to make a good AntiCheat without Ring 0 Kernel access?

[Cleave]

The way I understand it, most programs work through Ring 3 which is one of the lowest privilege access levels. Why would you use the highest access level and potentially open it up to the kind of damage that level could bring when exploits are found?

[Cleave]

Diposting pertama kali oleh Sad Pug:

Diposting pertama kali oleh var:

Damn you dont even know how analogies work. That sucks man I'm sorry.
I mean you're the one saying that since an anti cheat didnt stop every cheater, clearly you dont need it. Just like laws didnt stop every criminal.

Further proof you don't know what you're talking about, don't know how law and society work AND don't know or can't use analogy properly.

Seriously, go before it will be too late for you.

Diposting pertama kali oleh The Fast:

I for one welcome our malware overlords with the knowledge that they can't be as invasive as Windows 10 Update.

(obvious sarcasm/hyperbole but seriously Win10 is malware.)

Wonderful!
Do you have champagne like any cheapskate or go for nice glass of whisky?
If whisky, then wundebar!

Did you just assume my poison?!?!?!

[CLG]

Easy anti cheat is kernel, why do you think it needs to be ran in admin to install? denuvo anti cheat is basically the same thing as EAC, the only reason to complain about it being in doom is that you aways need it on even if you want to play single player.

[❀❀ V ❀❀]

Diposting pertama kali oleh CLG💕:

Easy anti cheat is kernel, why do you think it needs to be ran in admin to install? denuvo anti cheat is basically the same thing as EAC, the only reason to complain about it being in doom is that you aways need it on even if you want to play single player.

Yea this. Should only really be enabled if you have Invasion turned on

[Linyos Torvoltos]

Diposting pertama kali oleh Lyrion:

Diposting pertama kali oleh Weaponized Autism:

People keep bringing up "MUH SINGLEPLAYER" without realising the fact that the game is getting an invasion mechanic for the single player. Hence the requirement for the AC to be run in singleplayer.

How is this even an argument, I dont give a ♥♥♥♥ about the invasion mechanic. I will happily permanently disable it for my game if it means keeping ♥♥♥♥♥♥ anti cheat softwares off my pc.

It is an argument.

I believe it's been stated that you will be able to disable the AC at the cost of losing MP functions so your argument is null.

[Chickenprotector]

*sighs* I ended up believing the bull as well, however a few things to tack on.

1) People are blowing this out of proportion.
2) Supposedly it's a new piece of software by Denuvo; that's not to say I'm defending them, their reputation and track record is HIGHLY suspect.
3) You. Can. Roll. Your. Install. Back. To. A. Previous. Version. Of. The. Game. It's a little complex, but it's possible (I did it with Evolve when it was still a thing) and you can keep it that way with some fanagling with offline mode.
https://www.reddit.com/r/Steam/comments/611h5e/guide_how_to_download_older_versions_of_a_game_on/

So that being said, I'm still a little reluctant to reinstall my copy of DOOM because of the questionable reputation of Bethesda and Denuvo. Frankly, the AC software is brand-new and considering Denuvo's track record with making game(s) having a HUGE performance hit, I'm pretty skeptical they didn't screw up their code.

[DOOT]

VAC

[Cleave]

Diposting pertama kali oleh Chickenprotector:

*sighs* I ended up believing the bull as well, however a few things to tack on.

1) People are blowing this out of proportion.
2) Supposedly it's a new piece of software by Denuvo; that's not to say I'm defending them, their reputation and track record is HIGHLY suspect.
3) You. Can. Roll. Your. Install. Back. To. A. Previous. Version. Of. The. Game. It's a little complex, but it's possible (I did it with Evolve when it was still a thing) and you can keep it that way with some fanagling with offline mode.
https://www.reddit.com/r/Steam/comments/611h5e/guide_how_to_download_older_versions_of_a_game_on/

So that being said, I'm still a little reluctant to reinstall my copy of DOOM because of the questionable reputation of Bethesda and Denuvo. Frankly, the AC software is brand-new and considering Denuvo's track record with making game(s) having a HUGE performance hit, I'm pretty skeptical they didn't screw up their code.

Yeah when it comes to Bethesda, they proved with FO76 that something as simple as website security was such a low priority that they doxxed their own customers.

I highly doubt there was any QA considerations for buying Denuvo's Anti Cheat and it had everything to do with cost effectiveness.

[Wh1te_Substance]

The only thing I didnt like about their approach to DOOM eternal is how they were wanting to just push out this garbage invasion mode.

[Linyos Torvoltos]

Diposting pertama kali oleh Wh1te_Substance:

The only thing I didnt like about their approach to DOOM eternal is how they were wanting to just push out this garbage invasion mode.

It was advertised that it was going to be in before the game was launched. It's not exactly a surprise if you've been following all the pre-release stuff for the game.

[RiO]

Diposting pertama kali oleh var:

Again, How would the anti cheat running ON THE SERVER prevent the CLIENT COMPLETELY DISCONNECTED FROM THE SERVER AT LAUNCH from spoofing the data the server is looking for when it finally connects, which is how hacks and viruses work already?

Clearly, you have no experiencing with older multiplayer FPS games.
In ye olden days, games in the FPS genre were built with the game server having the end-all-be-all say over game state.

The clients would send button presses to the server, where input would be processed in a central controlled manner; the server would decide if your aim was true and bullets were meant to hit or not; the server would decide if your opponent's health would drop; if they would keel over or not; or if you just ate a rocket from that one other player you didn't spot. The server decided; and the clients were pretty much dumb slaves replaying what the server would state.

Wall-hacks could be defeated by having the server load a coarse version of the level's geometry and do line-of-sight calculations between players. If the server decided a player should not be able to 'see' another player, their coordinates would simply never be sent to the client. If you don't get the data in the first place; you can't abuse it.

Aim-bots would be tracked by analyzing for super-human accuracy while aiming; taking into account sharp angles; lack of overshot; lack of proper human acceleration curves while operating a mouse; etc.


Basically, all of that was tossed out the window when online gaming and FPS games moved from a primarily PC environment to a primarily console environment. As consoles were pretty much a walled garden, developers quickly realized they could start to 'trust the client' and make their lives a hell of a lot easier. Publishers were clued in as well; they needed less budget to have dedicated servers kept up in the air, because the servers became simpler.

And then, when those same nu-FPS games came back to PC, well... they were hit by a tidal wave of cheats. So what did the industry do instead of going back to the tried and true architecture design of the past, and refine from there? They invested into a band-aid. Anti-cheat.


What's needed now, in the age of cloud computing is to take a step back and take another look at that old design where the server dictates and the clients follow. With cloud-hosted servers being able to up and down scale on demand and many server farms being available with GPU compute power, nothing is standing in the way of taking that old design and applying it to new games. The hardware is there to make it viable.

That, along with using AI-assistance to detect unnatural movement and aiming patterns, flagging a subset of players for further scrutiny.

[Cleave]

Diposting pertama kali oleh RiO:

Diposting pertama kali oleh var:

Again, How would the anti cheat running ON THE SERVER prevent the CLIENT COMPLETELY DISCONNECTED FROM THE SERVER AT LAUNCH from spoofing the data the server is looking for when it finally connects, which is how hacks and viruses work already?

Clearly, you have no experiencing with older multiplayer FPS games.
In ye olden days, games in the FPS genre were built with the game server having the end-all-be-all say over game state.

The clients would send button presses to the server, where input would be processed in a central controlled manner; the server would decide if your aim was true and bullets were meant to hit or not; the server would decide if your opponent's health would drop; if they would keel over or not; or if you just ate a rocket from that one other player you didn't spot. The server decided; and the clients were pretty much dumb slaves replaying what the server would state.

Wall-hacks could be defeated by having the server load a coarse version of the level's geometry and do line-of-sight calculations between players. If the server decided a player should not be able to 'see' another player, their coordinates would simply never be sent to the client. If you don't get the data in the first place; you can't abuse it.

Aim-bots would be tracked by analyzing for super-human accuracy while aiming; taking into account sharp angles; lack of overshot; lack of proper human acceleration curves while operating a mouse; etc.


Basically, all of that was tossed out the window when online gaming and FPS games moved from a primarily PC environment to a primarily console environment. As consoles were pretty much a walled garden, developers quickly realized they could start to 'trust the client' and make their lives a hell of a lot easier. Publishers were clued in as well; they needed less budget to have dedicated servers kept up in the air, because the servers became simpler.

And then, when those same nu-FPS games came back to PC, well... they were hit by a tidal wave of cheats. So what did the industry do instead of going back to the tried and true architecture design of the past, and refine from there? They invested into a band-aid. Anti-cheat.

Very interesting, I miss the UnrealTournament99, Quake3, CS1.6 days if not just for the reason that lag compensation didn't ♥♥♥♥♥♥♥♥ over because you had a better connection than someone else.

[flajann]

And it would help that the "Anti Cheat" only affects multiplayer mode. Those of us happy to play as a single player should not be affected by the Anti Cheat AT ALL.

[CJones]

Why exactly do we need anti cheat software, Ring 0 or otherwise, in the first place. Were the handful of people playing multiplayer really clamoring for an update to stop cheaters? I find that hard to believe.

That, combined with the timing of this update, make it seem very suspect.

[rusty_dragon]

Yes, it's possible.

Truth is, even most intrusive anticheats like EAC, which monitors and restricts everything on your PC, doesn't eliminate cheating. Otherwise it tend to be less effective than VAC(the one EAC promoters bash a useless).

And you can't solve cheating problem on PC unless you turn it into a console. Which defeats the purpose of PC. If you want to get read of cheaters - buy a console(which presume to have no cheaters). There is no other way around.

Now back to anticheats with high level of intrusion. Which is indeed nothing new for PC. We have them at last since 00s. And all this time users have problems with them. It's same as with intrusive DRMs. Likes of Starforce, Securom, Denuvo. Punkbuster and Battleye are hated for years. To the point many people avoid buying games with them.

There is one common problem with all those solutions. They are too much in the radical spectrum. They use every way to combat cheaters and pirates in expence of user's comfort and sense of reason. Same usually goes to it's developers. Which try to achieve elimination of cheaters. Which is, as you can see above, is impossible task. People who develop and implement those systems are also often radical persons. As a result of radical approach users suffer. To the point of bans or scapegoat insane lawsuits(which doesn't solve the cheaters problem, only fulfilling lust for violence).

Thing is, you only hear about problematic and scandal anticheat systems. Because when something works there are no much talk about it. VAC was one of the anti-cheat systems that was designed to improve upon radical and intrusive anticheats of 00s. It's imperfect, but it does it job pretty descent without irritating users. And while VAC is also somewhat intrusive - Valve has build up some trust by how they handling things. Same can't be said about companies like Denuvo or Irdeto. Which are not good companies or businesses, run by not so good people. Trust is a problem when you think about EAC. That's being now owned by Epic Games. Which is owned by Chinese infamous corporation Tencent.

Anti-cheat solutions on the market don't end with Denuvo, EAC, Battle Eye and Punkbuster. Those are just the most aggressively marketed or the most infamous. And as you see loud mouth does not mean best solution for end users.

One of the reasons need for anti-cheats rised in recent years is because most of big publishers don't allow LAN or self-hosting servers anymore. Because of that you can't even disable anticheat and run a private server if you have problems with Anticheat software that is bundled with the game. Publishers also cut expences on cloud servers(server time is cheap like peanuts, but GREED knows no limits) moving everything they can to be processed by user's PCs. And they want ot automate everything to cut even more expences(including support and false ban appeal process). As a result end user suffers.

If gaming community won't rise up, and demand to be treated properly - we would keep getting more and more of Denuvo. It's on you how you want to be treated. Valve style or Denuvo style.

[DetectiveYellNow]

Diposting pertama kali oleh The Fast:

Diposting pertama kali oleh var:

https://secret.club/2020/04/17/kernel-anticheats.html

Good link.

Still I wonder if there's a way to give it the ability to detect game exploits at Ring 0 and stop the game application and flag the serverside system instead of having full control over Ring 0 in its entirety. If not, then this would be a good idea to create something capable of not being abused.

I'm certainly not that knowledgeable on this subject but going from 0 to 100 in terms of how much access an anti cheat is given just sounds like a recipe for disaster in the future.

No cause imagine having to ask every time to get into Area 51 versus working in Area 51.

EAC uses Kernel Drivers along with Battleeye. I don't really see the deal about this, besides a shady install part. Heck just remove it and get EAC. Fortnite uses it with the million capable victims there.

The second thing is that at kernel level 0 it can update silently, well in retrospect makes sense since I don't want to tell the cheating community what I am doing, cause once they find it's out of date they go rampaging.