[uhx]

Everything you described increases the cost of attack (creating a cheat), and as a result, not everyone can afford it, which means anti-cheats work. They don't have to be a panacea. Gameplay analysis will only help against blatant cheaters, but will miss players with simple ESP.

It's almost the same as saying "you don't need a password on your phone" or something like that.

[hananova]

> but will miss players with simple ESP.

False, people that have information they shouldn't have will act in detectable ways, even if they try their hardest not to.

[himata4113]

Economics work out, harder to make means that it's more profitable to do so. DMA crackdown has actually lead into innovation which has drove the prices down for "normal" DMA hardware what used to be thousands is now $120, excessive spoofing detection has driven down the cost of bios level spoofing and as a result the creation of bios level DMA backdoors - no additional hardware required.

ESP is a lot more obvious to a machine than one might think, the subtle behavior differences are obvious to a human and even more so for a model. Of course none of that can be proven, but it can increase the scrutiny of such players from player reports.

[maccard]

The number of people willing to spend $120 and hook up a hardware device compared to downloading and running an executable is significantly less. That’s kind of the point of it!

[kay_o]

You are already spending more than $120/month on the executable. The hardware device cheap inclus

[himata4113]

You can achieve the same with usermode anticheats, once you have bare minimum obfuscations the level of entry is roughly the same as kernel mode anticheats in terms of price. Cheats cost more than $100 a month (rest are scams or don't put any effort into being undetected).

[maccard]

A DMA cheat requires a hardware change (and a second device). That is a much higher barrier than a download plus reboot.

> you can achieve the same with user mode anticheats

A user mode anti cheat is immediately defeated by a kernel mode cheat, and cheaters have already moved past this in practice.

A user mode anti cheat (on windows) with admin privileges has pretty much full system access anyway, so presumably if you have a problem with kernel AC you also have a problem with user mode.

Lastly, cheating is an arms race. While in theory, the cheaters will always win, the only thing that actually matters is what the cheaters are doing in practice. Kernel mode is default even for free cheats you download, so the defaults have to cover that.

[himata4113]

this is a common misconception, just because you're in kernel-mode doesn't mean you are immediately undetected and things are not as easy people initinally think.

First, point of ingress: registry, file caches, dns, vulnerable driver logs.

Memory probe detection: workingsets, page guards, non trivial obfuscation, atoms, fibers.

Detection: usermode exposes a lot of kernel internals: raw access to window and process handles, 'undocumented' syscalls, win32, user32, kiucd, apcs.

Loss of functionality: no hooks, limited point of ingress, hardened obfuscation, encrypted pages, tamper protection.

I could go on, but generally "lol go kernelmode" is sometimes way more difficult than just hiding yourself among the legitimate functionality of 3rd party applications.

This is everything used by anticheats today, from usermode. The kernel module is more often than not used for integrity checks, vm detection and walking physical memory.

[phendrenad2]

It's too bad we have to play this semantics game of "most vs all" every. Single. Time. On. This Damn Site.

So let me summarize the above thread:

Yes, there will always be workarounds for ANY level of anti-cheat. Yes, kernel-mode anti-cheat detects a higher number of cheats in practice, and that superiority seems durable going forward.

There, I think we can all agree on those. No need to reiterate what has already been posted.

[simsla]

For reference, I knew a guy who built bespoke cheats (less likely to get caught by ban waves) and he charged a few thousand per project.