Hacker News new | ask | show | jobs
by nananana9 76 days ago
The goal of kernel mode anticheat is to prevent other kernel-mode modules from tampering with the game's memory. This can kind of be done on Windows, as there's a pretty short list of kernel binaries, and all device drivers are signed.

This is out of the question on Linux, where there's probably 100,000 distro kernel binaries floating around, plus the ability to build your own with whatever modules you wish.

The only plausible solution is to force everyone to use the same kernel image. "To run Valorant, please apt install linux-vanguard-botnet-bin!"

Unfortunately this is a plausable enough outcome, and those games are so absurdly popular, that people will do it, especially given that having support for these games will likely drive new users to Linux.

If enough people do it, this opens the door for other software to latch onto it and start requiring a "verified kernel", so I'd rather just never see these games on Linux.

2 comments

I think, it's not unreasonable to see basically a verifiable reference single-purpose gaming OS everyone has to use in competitive esports games. Steam and Linux are probably positioned well there.

Would be hilarious, if all gaming ultimately settles on a hardware independent console platform running on a locked-down linux! This would really please and piss off every faction at the same time. But honestly, not the worst compromise IMO.

We probably could run Linux distros under hypervisor (just like default Windows install those days runs not on bare metal, but under Hyper-V).

And then games that wish for anticheat start a separate VM in hypervisor with complete secure boot chain of trust. Would require GPUs to support SR-IOV though.

Maybe something using AI could be implemented - does a screenshot of your game e.g. every second and if it detects anything that would suggest cheating then it informs some central system and sends it a movie of you playing for the final verdict.

Of course this all is based on the assumption that the local AI can do this fast enough with enough precision.

That runs on client side, so can easily be tampered with (assuming you're suggesting that instead of secure boot chain).

Also cheat HUD elements can be simply rendered outside of game window (or even on another device like smartphone).

Well my suggestion is that the local part (which could analyze everything that is happening locally, not only the screen) would be the initial filter and if it detects any hint it takes some data package and sends it to some centralized online system that would provide a final verdict (and ban if needed).

But as you say if it is local then you can essentially run anything on the computer and modify what is ran on it. That basically means it is impossible to make an anti-cheat that is 100% bulletproof aside from something strange like buying a locked-in camera which you need to place behind you as it records everything you do on the PC and then the AI thing happens as I explained.

Maybe for pro play and tournaments that would be acceptable but not for the average player.