{"id":516555,"date":"2026-06-24T21:00:13","date_gmt":"2026-06-24T21:00:13","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/516555\/"},"modified":"2026-06-24T21:00:13","modified_gmt":"2026-06-24T21:00:13","slug":"vanguard-on-demand-anti-cheat-update","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/516555\/","title":{"rendered":"Vanguard On-Demand – Anti-Cheat Update"},"content":{"rendered":"

Cheaters are not Secure Boot enjoyers, because by turning it on, they lose access to one of the more convenient ways to bypass Driver Signing Enforcement and PatchGuard, meaning they can\u2019t load their unsigned malware. In tandem with driver attestation, this dramatically reduces the kernel surface that Vanguard need be wary of.<\/p>\n

2. Trusted Platform Module 2.0<\/p>\n

The TPM 2.0 chip is a secure cryptoprocessor embedded on a PC\u2019s motherboard (dTPM) or integrated into the CPU\u2019s firmware (fTPM), for which the primary function is generation, storage, and retrieval of cryptographic keys. It operates with 100% logical independence from the device\u2019s processor and RAM, meaning the keys are not directly exposed to the operating system or any software running on it. So, if you\u2019re an anti-cheat developer, this immutable secret store is the equivalent of a digital one-way mirror, and if you\u2019re an aspiring cheater, you can do only the equivalent of pressing your face against the glass.<\/p>\n

The TPM is a necessary requirement for the very same driver attestation service we\u2019ve championed above, but more importantly, it also works beautifully as a non-fungible form of hardware identity. A TPM\u2019s Endorsement Key is physically burned into its non-volatile memory at the factory, so if we were to decide to ban this key on sight, any cheater hoping to bypass that ban would need to physically remove and replace their banned chip, or even more amusingly, replace the entire CPU, just to avoid re-detection. For the purposes of satisfying Vanguard Pre-Check, either discrete or firmware TPMs are considered sufficient, but if an account is restricted, only an fTPM will do.\u00a0<\/p>\n

Vanguard Restrictions<\/a> are placed on accounts that are too \u201cbotty,\u201d \u201ccheaty,\u201d or \u201cspeedy,\u201d necessitating that they meet certain hardware requirements in order to continue further into the competitive ecosystem. It\u2019s a lot like saying \u201cwe literally dare you to enable your fTPM,\u201d and perhaps unsurprisingly, most cheaters find themselves unwilling to do that, resulting in their immediately abandoning the account they\u2019ve clearly stolen. That said, we can only allow fTPMs to satisfy this requirement, because discrete TPMs are often not even soldered to the motherboard anymore, and we think a hardware ban bypass should cost more than $5 and the 10 minutes it takes to pop in a new one.\u00a0<\/p>\n

3. IOMMU<\/p>\n

The Input-Output Memory Management Unit is a piece of hardware that acts as a firewall between PCIe devices and system memory. Without one, when a DMA request is made from a $6000 cheating peripheral, it is directly asking the memory controller for a raw, physical address in RAM, and this creates an unmitigated disaster of access policy violations where any cheater can undetectably browse the game client\u2019s memory for anything they might be interested in, like exactly what a radar cheat does.\u00a0<\/p>\n

But once the IOMMU enters the game, those devices are no longer allowed to access physical RAM directly, and instead, they must use only virtual addresses over the unit itself, which relies upon a translation table to get the real, physical one. This gives us the opportunity to mark game memory as unreadable, forcing the translation process to throw a hardware fault, and forcing the cheater to stare into their reflection on a black computer monitor when they try to cheat in our games.<\/p>\n

Proper enforcement of IOMMU requires that the device\u2019s corresponding DMA driver have support for memory remapping, and like many examples in this article, there are a few, exasperating devices that are still used by a good percentage of players but do not yet have the necessary support. This makes some annoying gaps in its protections that we must deal with, but rest assured that we are dealing with them. For the last year, we\u2019ve been surgically placing full IOMMU restrictions onto high-ranked VALORANT cheaters that are abusing DMA, immediately rendering their wallet useless.\u00a0<\/p>\n

IOMM me?
\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"Cheaters are not Secure Boot enjoyers, because by turning it on, they lose access to one of the…\n","protected":false},"author":2,"featured_media":516556,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61,60,80],"class_list":["post-516555","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ie","tag-ireland","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/516555","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=516555"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/516555\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/516556"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=516555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=516555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=516555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}