

The problem here arises from the fact that code executing in kernel-mode can hook the very system calls we would rely on to retrieve our data, modifying the results to appear legitimate in a way we might have difficulty detecting. In the last few years, cheat developers have started to leverage vulnerabilities or corrupt Windows’ signing verification to run their applications (or portions of them) at the kernel level. If you’ve ever heard some stable genius hit you with a “lol my cheat is ring 0 undetected,” this is what they were referring to right before they were banned.

Or to wrap that up in a semi-intelligible metaphor: We (in user-mode) have to ask the kitchen (Microsoft Windows) what’s been added to our beef goulash (League of Legends). Within it, an application cannot directly “see outside” of itself, and instead, code must generally rely on OS’ native APIs to read or write memory not within its own process.

Your web browser, your legitimate copy of WinRAR, and your favorite games all run in user-mode. It describes a privilege level within an operating system, specifically the most restrictive tier software can run at. These techniques can compromise an anti-cheat’s ability to retrieve good data, and that effect is compounded if that anti-cheat has to run in user-mode. Over the last two decades, the development of cheats and the technology to prevent them have escalated from the honorable fight for control of game client memory into methods that attempt to modify the underlying operating system-or even the hardware-of a cheater’s machine. While its precise origin remains indeterminate, one reality has become accepted as established fact: Cheaters gonna cheat. In a partnered study lasting approximately 8 years and backed by $20 million in federal funding, leading scientists managed to chronologically place the invention of cheating somewhere between 3.5 billion BCE and November 20th, 1985.

Other games (like Project A) will be protected by the referenced upgrade before LoL is. 1.6.0 200+ access account add added address addresses advance advice age agent ahk aim aimbot ammo angles animation anti anti-cheat antiban anticheat aob apex aram aram-boost arduino arguments ark attach auto autofarm ban bans base based battlepass battleye bf3 bgmi bit black blocked bones boost bot broke buffs bullet buttons bypass c++ c++/c# calculate call calling camhedz camo camos capture car castspell cg_fov chams chance change changer chase chat cheaters cheating check checking class clean client client.Disclaimer: This post is kinda tech-heavy and concerns anti-cheat tooling that won’t be exclusive to League of Legends.
