What's is nProtect Gameguard, how it compares to other anticheats.

[Butzeks]

Since a lot of people don't understand why nProtect is bad when do many play games with other anticheats etc. and I see my posts about it secretly disappearing, here's a general info what's going on with it. I hope you find it useful, and before going rants how exposing yourself to vulnerabilities are actually is a good thing - you at least read this through.

For those who are not aware what I am talking about: A "root-level" program, sometimes also referred to als "Kernel mode driver" or "ring 0 permission" is something, that operates at the highest operation level on your computer. And we are not talking about "Run as Administrator", here. No. A tool like this has more permissions than an Administrator. In fact, almost nothing you can do on your operating system (assuming Windows for most people) has nearly as much power as a Kernel mode driver. This acts so deep in your system, that it can directly access ANY hardware component.

There are far more than a hundred games that use Anti-Cheat systems that have Kernel-Mode access and the list keeps on growing. But - they are not the same.

Why do some Anti-Cheat systems want to operate in Kernel-Mode?

Because the Kernel-Mode allows you to directly interact with the hardware of your computer. This means to directly access anything that is stored in the RAM, aswell as the GPU-RAM, prioritize or manipulate CPU usage or get any input you deliver to the device via mouse, keyboard, gamepad or any other I:O-device. This obviously makes the detection of something like wallhacks, aimbot or similar external programs quite easy, as the Anti-Cheat doesn't have to operate as a "normal" program, which essentially limits the possibilities to check the images you are receiving on your screen for manipulation. It makes it harder, because many hacks run as a Kernel-Mode. They want to directly access the images your GPU produces, manipulate them and alter the image you receive on your screen. A "normal" Anti-Cheat would then have to check the images, compare them to the original output of the game - which they can't really access, as they only receive the already altered version - and look into a library of illegal alterations, to detect that the image you receive on the screen has been illegally messed with. With Kernel-Mode permissions it is much easier to detect any external interaction with the original game-output to basically catch the hacking-tool red-handed. This is also less resource consuming.

2. But why is it bad then?

For a number of reasons. First of all: Anything that runs as a Kernel Mode has straight access to your hardware. Like, full control. Overclock your CPU to 12GHz and watch it initiate meltdown like a faulty nuclear reactor? It could do that. Have your new GTX 4090 run at 150% with disabled fans until it breaks? Sure, no problem. Better have insurance that doesn't ask questions, as your distributor typically won't accept returns if they find out the hardware has been broken by overclocking. This could happen as an error in the program. But this could also happen on purpose. Now, I get what you are thinking right now: "Why would RIOT / EA / etc. want to brick my computer?" They won't. But who assures you, that their Anti-Cheat system is 100% safe against being hacked itself? Who assures you they will take responsibility, if a bug in their system fries your new 5.000€ gaming rig that you safed up on for the last 3 years?

Who assures you, that an external hacker attack on those tools won't end up reading out your online-banking information? Because those tools could. They are able to extract any hardware information - which includes any password you type into your keyboard.

But this could go even further. Be aware - this now is purely hypothetical and I have NO information as of today that it is being used like that, I just want to point out the potential power that comes with anything that runs on Kernel Mode access levels! I already mentioned Vanguard, the RIOT Anti-Cheat system for Valorant, which I claim to be of the "bad" type of Kernel-Mode Anti Cheat. Now look at the company structure of RIOT Games. RIOT Games is mainly owned by Tencent Games, which is the largest Gaming Studio in the world based on its investments and received multiple fundings straight out of the Chinese Ministry of State Security. And since China has been known for a couple of... let's call them "minor mishappenings", where people who voiced anything that criticized the Chinese Government suddenly went on a vacation from which they never returned. As of September 2022, at least 22.5 Million people had been active in Valorant at least once in the last 30 days. Imagine the possibility of the Chinese Government, if they should decide it would be worth the effort of taking over Tencent Games, with which they had control over RIOT Games and could read out any information on the computers of those 22.5 Million people. Their Whatsapp, Mails, Reddit, anything. This does offer a massive spy-potential. Again! This is purely hypothetical, but be aware that it would be basically no effort at all to change Vanguard to a spy software within hours.

3. But why is Vanguard "bad" and others like "Easy Anti Cheat" is not so bad, as you claim?

I've only breached this very briefly so far. For me there are major differences between Vanguard, EAC, and other Kernel-Mode tools. The major difference is, that Vanguard is ALWAYS(!) running! If you boot your computer, Vanguard is running. Sure, you can disable that. But default is, that it is ALWAYS running. It did require a major ♥♥♥♥♥♥♥♥♥ by us to make it possible to just uninstall it, instead of being forced to irradicate it by hand from the folders and your registry, but even today you have to manually stop it from running after you play, to be able to get rid of it. If you want to play Valorant, you have to reinstall Vanguard and then reboot your computer, so Vanguard forces you to be running when you start your computer. This is unacceptable. But it does get worse. I have mentioned nProtect earlier.

nProtect is not new, but they got a new ♥♥♥♥♥♥♥♥♥ for what happened with the game "Undecember" on steam. I got to admit, I don't know whether nProtect always operated the way it does now. If so - holy cow that is bad. If not - what the hell went wrong with it?

Again, I want to compare it to Vanguard because I believe you do now have a brief unterstanding of how Vanguard operates and why I think it is a terrible tool. But - at least nowadays Vanguard tells you all about it. If you launch Valorant without Vanguard installed, the game tells you, that Vanguard has to be running at system startup. It tells you, that you can uninstall it - and how to do that.

nProtect doesn't tell you any of that. nProtect does not uninstall when you uninstall the game (Undecember in this example), nProtect doesn't even have an uninstaller. It requires you do manually delete multiple Registry-Keys in your system and a system service. Not everybody knows how to do that or is able to understand whether the online-manual on how to do it is actually legit or will damage your computer.

Also, there is a known bug in some versions of this, which allows ANY(!) program on your computer to issue commands through this tool as if they had Administrator privileges. So this tool sits dormant on the highest permission level on your computer without telling you about it, without telling you how to get rid of it and all that with a known history if security breaches? There are almost as many red flags here as in this years F1 qualifying in Imola...

No way I'm letting this tool anywhere near my computer.

Quick comparison to Easy Anti Cheat, which is also getting some beef every now and then - EAC runs on Kernel Mode, too. But EAC starts with the game. Not on Windows startup. If you stop playing the game, EAC stops. There is nothing to be afraid of from EAC outside of any EAC-correlated game. I still wouldn't access critical passwords, onlinebanking, important documents or similar while playing a game with EAC. But once you close the game, there is nothing to worry about.

And even though EAC surely isn't the most reliable Anti-Cheating tool, it will be sufficient for most games, especially smaller ones.

4. But why are tools like nProtect still getting developed and used?

I don't know. I can only assume they are cheap. And that is the issue. A proper Anti-Cheat system is not cheap. Those tools are either expensive or crap. Kind of like with Anti-Virus tools. The cheap ones are mostly useless and those that actually do something will charge you for that. There is a reason you're getting McAfee thrown at you for a couple of free months with every third installer instead of actually charging you for their service...

But back to the games - I don't get why games like Undecember prefer to rely on crappy systems like nProtect instead of taking alternative budget-systems like EAC. Sure, for high level e-sports or top-matchmaking ranked games EAC might not always be the best, and there are flaws in it. But Undecember is a free to play game and I don't think using EAC would've been much more expensive than nProtect. So to put it harshly - they either don't know or don't care about the flaws of nProtect, and I am not sure which is worse...

5. What is the matter with EA Anti Cheat?

First of all - why on earth does a football simulation (or soccer, for our US-friends) require an Anticheat system after all? Are FIFA hacks actually a thing? I've never heard of it. Second - if you develop your own Anti-Cheat system, at least test it on more than the 2 test-machines you've had in your development studio... This tool was so full of bugs and errors, that it made FIFA 23 essentially unplayable on PC for millions of people during the initial 1-3 days of the PC release... The list of fixes the players were supposed to do to fix EA's faulty system was obnoxious... From "update your GPU", over "disable any overlay tools, including NVidia Geforce Replay, discord and XBOX Gamebar" up to "disable your Anti-Virus" this was just sad... And this is by far not the full list... By researching just 5 min for this post I found over 20 fixes that where mostly suggested by players to the players to try out to fix the EA Anti Cheat, and even about a dozen fixes EA suggested themselves. In general - anything that runs on Kernel Mode and then tells me to "disable my AntiVirus" is about as reliable as that Nigerian prince scam.

AFAIK EA Anti Cheat also only runs as long as FIFA does, so I don't really care too much about it. But it has become a thing in the past couple of years, that large gaming companies are trying to develop their own Anti Cheat software and typically they fail in a horrible way.

After all there are far better ways to protect your games than to purely throw Anti-Cheat software at the players. There is no 100% safe Anti-Cheat program, no matter how many privileges you throw at it. The most effective way to prevent cheating is to bind a users account to their real life identity. Be this by their phone-number like in CS:GO or something like the system Blizzard implemented a couple of years back (I think it was to prevent people doing shady stuff with the real-money auction house in Diablo 3, but I could be wrong here) - they implemented the Real-ID, which allowed you to befriend others with their real name and register yourself with yours. This did require you to deliver proof of identity in some way.

Stuff like this will also come with other issues, but your name, age and address of living is something you've given to most companies anyways after you paid for the game or any service inside it by credit card once. So there is nothing new you'd give them.

So finally we have to ask ourselves the question: Do I trust that company enough, to let them access everything on my computer, give them unlimited control over my hardware and be assured, that they will care about those systems enough, that they will still manage to keep them safe from external attacks even in the upcoming years? And in most cases the answer is "no". Because we don't know how much they care. We don't know how much effort they will continue to put into fighting against security breaches. We don't know how long they can keep winning the fight against the hackers until they lose.

6. What happens if they lose?

Depends on the tool. EAC / EA Anti-Cheat? You'd only be affected if you are playing an EAC-related game right now during the attack. Vanguard / nProtect? If you haven't cleaned up and uninstalled the tool after you finished playing you might be in deep trouble. If you did - you will be safe.

Finally - you've made it to the end of this wall of rant. But it frustrates me that this greed for permission on our computer is reaching those dimensions. You could be running 4 or 5 different Kernel Mode Anti Cheat tools right now while reading this. And that is too many. Games are not supposed to have such powerful tools on our computers.

[Amaranth]

Just don't install it and move along then,

[NobleFeret]

kernel-level rootkit do not install

[Butzeks]

Originally posted by Amaranth:

Just don't install it and move along then,

Oh I won't. I'm 100% sure I would've enjoyed this game, but I cannot trust one of the cheapest and most infamous anticheat which wouldn't even unistall, reinstall itself via browser and would boot with OS while running even when game is off (I don't trust devs, I trust reports from 1 year ago with undecember issues).

There's reason why it's so cheap and mostly used by cheap Korean F2P games.

Security is not cheap. Lineage with GameGuard is still full of bots. It doesn't work as anticheat.

[Pakete.xXGSIXx.]

You are not going to be able to boycott the game, buy a life and stop fooling around like kids

[why are we here? just to suffer?]

i read this post

and i now fear

but will buy day 1 BAYBAY

[Butzeks]

Originally posted by woah:

i read this post

and i now fear

but will buy day 1 BAYBAY

Buy preorder. They add 3 OP armors items like +50% HP etc.

[why are we here? just to suffer?]

wait

why do they got anti cheat

its...

co-op


..........................................................................

cash shop game?

[Butzeks]

Originally posted by woah:

wait

why do they got anti cheat

its...

co-op


..........................................................................

cash shop game?

Microtransactions probably be important considering rotating armor shop and preorder armors bonuses like:

TR-7 provides extra padding (higher armor)

TR-9 provides a 50% chance not to die when taking lethal damage and prevents bleeding out from chest wounds

TR-62 provides increasing throwing range by 30% and +50% limb health

[Carcharodon Vizcara]

Originally posted by woah:

wait

why do they got anti cheat

its...

co-op


..........................................................................

cash shop game?

It will have a cash-shop. They've already discussed warbonds on their discord, and shown some videos. Someone Copy/Pasted it in a post here in the Steam forums as well.

In the previous HD1, the cash-shop also sold weapons, gear, utility devices (healing drones, turrets..etc), and vehicles like mechs/tanks. Warbonds do something similar but we haven't gotten specifics on what exactly will be sold to us overtime besides the warbonds.

[Pakete.xXGSIXx.]

Originally posted by Loken:

Thanks for the info, I'm going to avoid this game.

No le hagas ni caso, solo esta spameando en todos los hilos para boicotear el juego

[CTmanGer]

For those who dont know what this lvl of acces means: kernel level

ALL of your files, everything you type will be scanned for cheats.
And it will be updated... and because its a shady company... do you really trust them not to thorougly "scan" a file called "my naked girlfriend"?

It turned out almost every doorbell cam, vacuum robot, security cam was once missused

- Biggest recent case - EUFY cams ... they could all spy in your bedroom for years
- Linus techtips even had to cancel the sponsorhip with Them and Anker

Is this really worth it?
The risk is real and high with this shady software from a shady company

[OldSnake]

Originally posted by Pakete.xXGSIXx.:

You are not going to be able to boycott the game, buy a life and stop fooling around like kids

We already are and the shrinking wishlist numbers were the proof...

[Butzeks]

Originally posted by CTmanGer:

For those who dont know what this lvl of acces means: kernel level

ALL of your files, everything you type will be scanned for cheats.
And it will be updated... and because its a shady company... do you really trust them not to thorougly "scan" a file called "my naked girlfriend"?

It turned out almost every doorbell cam, vacuum robot, security cam was once missused

- Biggest recent case - EUFY cams ... they could all spy in your bedroom for years
- Linus techtips even had to cancel the sponsorhip with Them and Anker

Is this really worth it?
The risk is real and high with this shady software from a shady company

Ring doorbell sharing your webcam/video library with randoms, or children camera that were hacked to spy on room or even talk with children, or scandal about toys that spied on children and companies kept all the data comes to mind.

https://eandt.theiet.org/2017/05/11/children-unaware-smart-toys-storing-conversations-study-finds

But probably esport drama where some dev installed Bitcoin miner via anticheat on 500.000 players machine is more relevant.

https://kotaku.com/e-sports-league-hit-with-lawsuit-over-bitcoin-mining-sc-692954889

The big issue... Why GameGuard. It's riddled with online talks about so many issues, both technical and security, and inability to protect from cheats anyway (lineage still full of bots) It's reputation tanked, especially after "undecember" many issues just a year ago.
https://www.gamepressure.com/newsroom/undecember-with-hidden-rootkit-in-game-files/zf4afd

[Fili]

OP, are you familiar with Linux? I'm not sure about this, but I heard that Nprotect on Linux does not have access to the whole system and stays isolated in the game's wine directory (Proton and all of that.). Can I ask some insight on this?

[Butzeks]

Originally posted by Fili:

OP, are you familiar with Linux? I'm not sure about this, but I heard that Nprotect on Linux does not have access to the whole system and stays isolated in the game's wine directory (Proton and all of that.). Can I ask some insight on this?

I only use Linux for selected few apps, jobs to do. The thing is, your PC still share other drivers, and rootkit app if it behaves same as per undecember reports (always online, runs on boot), it still can affect data on whole PC, damaging some driver and bricking PC.
That's my biggest issue with potential issues.
Can't really tell much about Linux, I only have very basic understand on them.