The software that guards your ranked matches no longer lives inside the game. On today’s PC shooters and MOBAs, the anti-cheat that decides whether you may queue loads before Windows finishes booting, runs in the operating system’s own privilege tier, and increasingly checks your motherboard’s firmware. Two architectures define the field: Riot’s boot-start Vanguard driver, built in-house, and Epic’s Easy Anti-Cheat, a service-scoped system shipped to third-party games. This guide walks the stack from user mode down to DMA hardware — and what each layer asks of the player.
What this covers: how kernel-mode anti-cheat works, why it loads at boot, how Easy Anti-Cheat’s game-scoped model differs, and how vendors answer hypervisor-level and DMA hardware attacks. Why it matters: ranked integrity now depends on your TPM, your Secure Boot state and even your BIOS version — parts of the PC a mouse and keyboard never touch. Who should care: anyone who installs a kernel anti-cheat to play a competitive game, and anyone who has been told to “just enable TPM 2.0” without knowing why.
The privilege ladder: why user mode lost
Windows runs software in tiers. User mode, in the words of Riot’s anti-cheat team, is “the most restrictive tier software can run at” — your browser, your games, your copy of WinRAR. An application there “cannot directly ‘see outside’ of itself” and must go through the operating system’s APIs to read or write another process’s memory. Cheat developers broke exactly that boundary: exploiting vulnerabilities or corrupting Windows’ driver-signing verification, they moved code into kernel mode, where it “can hook the very system calls we would rely on to retrieve our data, modifying the results to appear legitimate.” When a player brags that a cheat is “ring 0 undetected,” this is the tier being described.
Riot’s own history is the case study. League of Legends spent roughly six years on Packman, a user-mode anti-tamper meant to make the game binary hard to analyze; by 2024, bypassing it had become “something closer to a training exercise,” worsened by the 2023 breach that exposed League’s source code. Before Vanguard arrived, Riot measured a scripter or botter in as many as 1 in 15 games globally, and more than 10% of Master-plus ranked games contained a cheater. Hence the principle Riot stated plainly in 2020: “If anti-cheat software is only run in user-mode, its capabilities would be compromised by a cheat running at a higher privilege level.”
| Layer | What runs there | The problem for an anti-cheat | The industry’s answer |
|---|---|---|---|
| User mode (Ring 3) | The game client, browsers, overlay tools | A user-mode scanner can be hooked and fed forged answers by anything above it | Authoritative servers (League simulates all game state server-side) plus client-side detection |
| Kernel (Ring 0) | The OS core and signed drivers | Kernel-mode cheats intercept the APIs a user-mode anti-cheat depends on | Boot-start kernel drivers — Vanguard’s model, following EAC, BattlEye and Xigncode3 |
| Windows hypervisor (VTL 1) | Virtualization-based security, memory integrity (HVCI) | A kernel driver cannot fully verify a kernel that was compromised first | Microsoft’s VBS isolates code integrity in an environment that “assumes the kernel can be compromised”; vendors push or require it |
| Firmware and hardware | UEFI, TPM 2.0, IOMMU, PCIe DMA cards | Components that load earlier are more privileged; DMA cards read memory without the CPU | Secure Boot and TPM 2.0 enforcement, the IOMMU’s memory “bouncer”, mandatory firmware updates |
Inside a boot-start kernel driver
Vanguard consists of three components: a user-mode client that handles all detections while a game runs, a kernel-mode driver that validates memory and system state and guards the client against tampering, and the platform backend that issues detections. The decisive design choice is timing: the driver “runs at start-up to prevent loading cheats prior to the client initialization” — a cheat that loads first can hide where the anti-cheat cannot look. That boot position puts it below everything else a player runs: below your GPUGPU. Graphics Processing Unit — the chip that renders the game's visuals; the main driver of framerate and image quality. driver, below the frame generation and latency tools competitive players already tune, below the game itself.
Riot is candid this is not “always on”: the driver “loads at boot, but nothing is making calls to it, and there’s no network connectivity until you run one of Riot’s games.” Its boot job is to attest “that nothing’s happened between Windows loading and the game starting that would break the operating system.” At launch, the client asks the driver to confirm the trust chain; if it checks out, you get a valid anti-cheat session. Disable or uninstall it and you can — but a fresh reboot is required to recertify the machine, and no Riot game runs without it. The driver is signed with Riot’s Extended Validation certificate, countersigned through Microsoft’s process, and its boot position doubles as a deny-list for signed-but-vulnerable third-party drivers that cheaters co-opt as load vectors.
Since June 2026, the posture is optional where hardware allows: machines passing a bar Riot calls Vanguard Pre-Check — Windows 11 25H2 with UEFI mode, Secure Boot, TPM 2.0, VBS/HVCI and IOMMU, about 35% of players by Riot’s count — can run on-demand, the driver launching with the game instead of at boot. The enabler is 25H2’s Runtime Driver Attestation, which measures every driver loaded since boot into the TPM so the anti-cheat can verify the chain without being present; the opt-in is, in Riot’s words, “100% optional.”
The measurable results, per Riot’s four-year VALORANT retrospective: more than 3.6 million accounts banned for cheating, roughly one ban every 37 seconds. Those bans are deliberately not instant — immediate action would let cheat developers A/B test a bypass and iterate around it, so Riot delays enforcement based on the cheat’s sophistication. Riot has also paid out almost two million dollars in HackerOne bug bounties for its games, with a dedicated higher-bounty scope for Vanguard vulnerabilities.
The EAC contrast: game-scoped, not boot-scoped
Easy Anti-Cheat — the Anti-Cheat Interfaces of Epic Online Services — takes a different shape. A game ships a bootstrapper (start_protected_game.exe) and a Windows service (EasyAntiCheat_EOS.exe). When a protected game starts, the bootstrapper starts the service; when the game exits, the service stops. Administrator rights are needed once, at install, not to start the game later. Protection splits into prevention of “common cheating techniques such as reading and writing the game process memory using straightforward methods” and detection of specialized tools; Epic’s paid enterprise tier adds game-specific detections and machine-learning models that catch aim-assisting cheats from server data. On consoles, Epic offers no client anti-cheat at all: “console platforms generally rely on hardware security features to prevent arbitrary code execution.”
EAC is not user-mode-only, and Riot says so itself: EasyAntiCheat, BattlEye and Xigncode3 were using kernel drivers years before Vanguard existed. The real architectural split is scope and lifecycle — what the anti-cheat attests, and for how long.
| Design choice | Riot Vanguard | Easy Anti-Cheat |
|---|---|---|
| When protection starts | Kernel driver loads at system boot | Windows service starts when the protected game launches |
| When protection stops | Boot-start by default, with an on-demand opt-in on Pre-Check-qualified machines since June 2026; exiting requires a reboot to recertify the trust chain | The service stops automatically when the game exits |
| Install privileges | Ships with the game; uninstallable, but no game runs without it | Administrator rights once, at install; not required to play later |
| Primary target | Cheats that load before the client initializes, kernel hooks, driver abuse | “Straightforward” memory read/write of the game process and common cheat tools |
| Linux via Wine/Proton | Not supported — the driver cannot attest boot state on that path | Supported via the Linux client module (EOS SDK 1.14+) |
| Virtual machines | “Heightened VM prevention” | The client interface does not support VMs |
| Firmware-level enforcement | TPM 2.0 required; Secure Boot on VALORANT; IOMMU restrictions rolling out against DMA cheating; VBS/HVCI required for the on-demand Pre-Check tier | Secure Boot, TPM and HVCI required on Windows on Arm, Beta and Insider builds |
The lifecycle difference has consequences: EAC supports Linux play through Wine and Proton, while Vanguard’s Wine-based path cannot satisfy the driver, because Linux “does not currently afford us sufficient ability to attest boot state or kernel modules,” and a virtualized environment would let cheats run on the host, “invisible to Vanguard within it.”
Below the kernel: DMA cards and the hypervisor fight
Push an anti-cheat into Ring 0 and the cheat economy moves below it. Two vectors dominate the high end of the arms race.
Direct Memory Access hardware plugs directly into the motherboard and reads game memory “without going through the CPU,” as Riot describes it — mature cheating communities have used DMA “to rebroadcast memory to a separate computer for later processing.” Done perfectly, the vector “could be undetectable from user-mode,” as Riot’s engineers admit — one reason they hired the researcher who developed the detection technique. By winter 2023 Riot called DMA cheats “one of the more advanced methods” in VALORANT’s cheating communities, attempted disproportionately at the highest ranks, and said it had deployed “best-in-class technology” against them. The hardware answer is the IOMMU — an input-output memory management unit that acts, in Riot’s metaphor, as “a bouncer for your RAM,” checking the ID of every device that tries to touch memory. Consoles ship with this protection as standard, and Riot notes that DMA cheating is “virtually nonexistent in that space.”
The hypervisor is the second front. Riot’s cheat taxonomy describes the vector plainly: a hypervisor sits between hardware and the guest OS, modifying memory “from the ‘outside,’ invisible to the anti-cheat on the ‘inside.’” Defense is where Microsoft’s work becomes the industry’s foundation. Virtualization-based security “uses hardware virtualization and the Windows hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised,” in Microsoft’s documentation. Memory integrity — hypervisor-protected code integrity, or HVCI — runs the kernel’s driver-signing checks inside that isolated environment, a tier Riot describes as operating “at a higher privilege level (Ring -1) than even the OS itself (Ring 0),” so even a compromised kernel cannot load unsigned code. The vendors converge from both directions: Riot requires VBS and HVCI for on-demand opt-ins, Epic requires Secure Boot, TPM and HVCI on Windows on Arm, Beta and Insider builds. The logic is the same one that pushed anti-cheat into the kernel a decade ago — whatever runs higher can defend, or cheat, undetected.
The pre-boot gap: when firmware lies to the OS
The deepest illustration of this arms race shipped in December 2025, with CVE numbers attached. CERT/CC’s advisory VU#382314 describes the flaw plainly: “Although the firmware indicates that DMA protection is active, it fails to correctly initialize the IOMMU,” so “a malicious PCIe device with physical access can read or modify system memory before the operating system’s defenses load.” The researchers who found it — Nick Peterson and Mohamed Al-Sharifi — work for Riot Games. The bug was assigned per vendor: CVE-2025-11901 (ASUS), CVE-2025-14302 (Gigabyte, which assessed it at CVSS 6.8 Medium), CVE-2025-14303 (MSI) and CVE-2025-14304 (ASRock).
Riot’s response is the enforcement model this whole architecture has been building toward. Players on affected boards hit VAN:Restriction and cannot launch VALORANT until they update their motherboard firmware — a requirement Riot is investigating for all Ascendant-and-above players. Riot frames the stakes in industry terms: had the flaw gone unnoticed, it “would have completely nullified all existing DMA detection and prevention tech currently on the market — including that of other gaming companies.” For players, the practical translation is blunt — your BIOS update is now an anti-cheat patch.
What you actually consent to
The player-facing contract, from Riot’s support documentation: Vanguard shows a system-tray icon while running, can be exited from that icon, and can be uninstalled — but it “must be running to use League of Legends,” and re-enabling it after a disable takes a reboot. Vanguard will also notify you “what vulnerable vectors are being affected through a Windows notification” when something on the machine looks risky, and machines deemed too vulnerable can be restricted from playing entirely.
On data, Riot’s claims are specific: the 2020 security team stated the driver “does not collect or send any information about your computer back to us,” and the 2024 engineering retrospective describes client-side checks built on signature scanning that return mostly binary answers — “it was present or it wasn’t” — including an “are you currently using a DMA device” query. The same article concedes logged data can include the file path of every library loaded into the game, which can contain a username, retained in warm storage for 14 days and used only for cheat detection. On the Tencent question, Riot says the Chinese publisher runs its own separate anti-cheat for its region, that Vanguard’s code is not shared, and that anti-cheat data “has never left Riot’s warehouse.” An official Riot staff update on Reddit adds that Vanguard captures the game-client region for ESP-related review, not the whole desktop — “a very normal practice when it comes to anti-cheat.”
The consent is also physical: TPM 2.0, Secure Boot on VALORANT, and on affected boards, a firmware update. Microsoft’s own TPM 2.0 enforcement for Windows 11 was, in Riot’s telling, “easily bypassable,” so Riot enforces the chip itself — both to harden certificate validation and because the chip acts as “an extremely non-fungible form of hardware ID” for hardware bans. That raises the machine floor for who can play at all, a tension the industry’s accessibility leaders are still working through. The trajectory is worth naming: what began as “please update Windows” has become “please update your motherboard” — and since June 2026 can end at the OS itself, with on-demand mode handing the boot watch to Windows’ native defenses on machines that qualify. Until hardware catches up everywhere, the rule Riot offers its skeptics applies to every kernel anti-cheat on this list: “If Riot hasn’t earned your trust, do not run our software.”