In 2023, Riot experienced a significant data breach that resulted in public exposure of the source code for both League of Legends and its anti-tamper software, Packman. This, alongside outdated anti-cheat software and a rise in botting and scripting, prompted them to use Vanguard as a more sophisticated security system. The macOS version of League of Legends would use an alternative method due to the operating system architecture being vastly different from what Vanguard supports.
In this article, we’ll dive deep into how Riot Vanguard works, why it has raised eyebrows within the gaming community, and whether the concerns surrounding its security are justified.
Riot Vanguard is a two-part anti-cheat solution rolled out by Riot Games to defend its games from cheating software. It consists of a client-side application and a kernel-mode driver, which is where much of the controversy lies.
The client-side application works similarly to traditional anti-cheat programs. It monitors for suspicious behavior while a game is running, detecting unauthorized modifications or programs that could provide an unfair advantage. This is a fairly standard approach and exists in several competitive titles like Counter-Strike: Global Offensive or Fortnite.
The kernel-mode driver, however, operates at a much deeper level. Generally, any program that runs inside the kernel and its environment will be referred to as a driver. So, in essence, Vanguard has the same privileges on your computer as a display or memory driver would.
When Vanguard launched together with Valorant in 2020, Riot Games made the decision to have Vanguard utilize its on-boot positioning to prevent known signed-but-vulnerable drivers from loading in their entirety. However, Riot were not aware of the extraordinarily specific hardware configurations utilizing bespoke's broken kernel drivers to communicate instructions to relatively obscure devices. In one infamous case, this included a driver that was responsible for keyboard lighting. Cheaters unfortunately were able to use this otherwise properly signed driver to load their own malware, allowing them to "look" like a clean Windows installation (with cert verification still enabled), yet still be running kernel-level cheats. Because this driver was only for keyboard lighting and macros, Riot kept the driver deny-listed until the developers released a new one.
Seeing the old anti-tamper software, Packman, on its last legs, the global release for Vanguard in League of Legends, occurred in patch V14.9. In the week following Vanguard's launch, less than 0.03% of active players had reported issues, predominantly related to common errors resolvable through player support or troubleshooting.
In a computer, the kernel is the core software of the operating system. It handles all the fundamental operations, like managing memory, processing tasks, and communicating between your hardware (like your keyboard, mouse, and monitor) and software (like your games and applications).
The kernel operates at the DEEPEST level of your system and has complete control over anything happening in your computer. It decides which programs get resources, serves as a bridge between software and hardware using drivers, and controls essential security measures.
There exists a concept of "Ring protection levels". Their purpose is to define an access level hierarchy in your system. Your everyday apps and games run at Ring3 (least privileged, safest for your system). Specifically, Vanguard runs at Ring0. If you’ve ever heard some stable genius hit you with a “lol my cheat is ring 0 undetected,” this is what they were referring to right before they were banned.
Kernel-level software operates with the highest level of privilege on your computer - it can do things that even you can't do. So far we only covered how incredibly privileged this software is on your machine, but let's talk about what could happen.
It describes a privilege level within an operating system, specifically the most restrictive tier software can run at. Your web browser, your legitimate copy of WinRAR, and your favorite games all run in user-mode. Within it, an application cannot directly “see outside” of itself, and instead, code must generally rely on OS’ native APIs to read or write memory not within its own process.
Essentially, rather than a program being able to interact with things in the memory of other programs, it must rely on the OS's functions to communicate to other programs.
In the last few years, cheat developers have started to leverage vulnerabilities or corrupt Windows’ signing verification to run their applications (or portions of them) at the kernel level. The problem here arises from the fact that code executing in kernel-mode can hook the very system calls League would rely on to retrieve data, modifying the results to appear legitimate in a way League cannot detect, by design of how Windows works. There' even specialized hardware utilizing DMA to read and process system memory—a vector that, done perfectly, could be completely undetectable from user-mode.
Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk. So, most cheats run at a higher privilege level than the previous user-mode anti-cheat did.
Where Vanguard starts to further distinguish itself from other anti-cheats is in its enforcement of security standards even further to the left of the game client—on the operating system itself. Several of these requirements aren't totally frictionless, but they inflict many hurdles onto those that want to distribute cheats successfully. For this reason, th anti cheat team is constantly having to make tradeoffs for the security of the game versus the ease with which players can access it.
LoL x Vanguard comes with a TPM 2.0 requirement, and while Microsoft originally intended to require one for all new Windows 11 installations, their actual implementation of this enforcement was relatively weak and easily bypassable. Riot took them up on their original offer and instead elected to enforce it themselves. So, a select few Windows 11 users may find their ability to play League is impacted, especially if you modified registry keys to bypass this requirement.
TPM stands for "Trusted Platform Module," and Vanguard requires it for two reasons. The first is because it adds security to cert signing validation (something it relies on to know if other software can be trusted), but the second (and more important), is because it acts as an extremely non-fungible form of hardware ID. If it's on and working, it can be pretty much assumed you don't intend to cheat, because if you did, they could easily just deny the hardware next time you run it. Since it's incredibly hard to change the TPM hardware ID, Vanguard can just refuse to connect if your chip is in the cheater list.
Despite its intended purpose of maintaining fair gameplay and deterring cheating, Vanguard's implementation and functionality have raised concerns amongst the player base. The Head of Anti-Cheat, Phillip 'MirageOfPenguins' Koskinas, tried to shed light on some of the concerns the community has had about the incorporation of Vanguard.
Vanguard operates at the kernel level, allowing it to identify cheat software that also functions at this level or lower, which encompasses most cheats. However, some cheats may operate with elevated privileges, which can enable them to avoid detection.
For instance, DMA-based cheats can access system memory directly, circumventing standard detection methods that monitor external processes. Likewise, scripts made with Auto Hot Key and Pixel bots can automate gameplay actions in a way that closely resembles human behavior, enabling them to bypass Vanguard.
On the other hand, external or hardware methods of cheating, such as modified mice or cheat-specific devices, can completely evade software detection. As cheating algorithms continue to evolve, it raises the question of whether a kernel-level anti-cheat driver like Vanguard can effectively counter the occasional kernel-level cheats. This challenge is common across all competitive gaming environments.
For those looking to experience the grind from the very bottom, check out our Iron-tier League of Legends accounts. They offer a fresh start for players eager to climb the ranks.
Riot Games has faced difficulties in addressing the changing landscape of cheating techniques. Koskinas pointed out DMA-based cheats, which often use external hardware to subtly inject cheat code into gaming systems. Nick 'Everdox' Peterson has dedicated nearly six years to researching this technology, and his knowledge has helped Riot stay ahead of the most significant threats.
For many players, the question of whether Riot Vanguard is safe comes down to balancing privacy and security with the need for a fair, cheat-free gaming environment. The majority of Valorant players seem to have fared just fine during the earlier versions of Vanguard.
However, there remains a vocal group of players who are uncomfortable with the idea of kernel-mode access, no matter how necessary it may be for stopping cheats. They argue that the risks, while minimal, are still present, and that the gaming industry should focus on developing anti-cheat systems that don’t require such deep-level access to users’ computers. This is a universal issue for all anti-cheat software.
From a technical standpoint, the anti-cheat team has gone to great lengths to ensure that Vanguard doesn’t compromise users' security or privacy. Their bug bounty program and transparency efforts help reinforce their commitment to a safe anti-cheat solution. However, ANY kernel-mode driver inherently carries risks, and it’s up to individual users to decide whether they trust developers to manage these risks responsibly.
For now, Riot Vanguard appears to be incredibly effective at stopping cheaters, while maintaining transparency and keeping the program open-source. There’s still a possibility for a time where Riot Games could choose to go for less transparent solutions, but as of 2024, Vanguard remains more transparent and stable than most other anti-cheat systems like PunkBuster or EasyAntiCheat.
