Riot taunts would-be hackers using physical hardware to cheat: ‘congrats to the owners of a brand new $6k paperweight’

“Congrats to the owners of a brand new $6k paperweight,” Riot Games taunts on X. A whole bunch of nefarious hardware tinkerers seem to now be on the wrong end of the company’s Vanguard anti-cheat, as it seems Riot has gone beyond kernel-level and confounded even cheaters’ attempts to bypass the anti-cheat by using a physical piece of hardware that directly accesses system memory to get to game data.

As anti-cheats have gotten more advanced, so have cheats, thus the perpetual arms race between game devs and cheaters. Usually, this involves going deeper and deeper into the system.

Once upon a time, cheat software would have run as a standard app in the OS by hooking game data directly from the game through normal methods—ie, using data that the operating system normally allows apps to read and change.

Most big games can prevent these attacks very easily now, though, so cheat makers started making their cheats hook information from deeper in the software stack, at ‘ring 0’, the kernel level where things like drivers live. Here, the cheat can read game data from memory without having to jump through the usual hoops that apps do, meaning they can bypass the anti-cheats that were developed to stop the previously mentioned cheats.

Thus, the kernel-level anti-cheat was born. These anti-cheats, which are used in games like Valorant, get access to relevant information at the kernel level, allowing them to check for dodgy software that runs at this level, too. If they detect cheat software running at the kernel level and hooking and changing game data illegitimately, they can block it and ban you.

So that’s that, right? Nothing more to solve? Not quite, because there is a layer deeper than ring 0, and that’s the hardware level. Kernel-level anti-cheats check for dodgy doings at the lowest level of the operating system, but that won’t help if the dodginess occurs prior to making its way into the operating system’s proper stack. Which is exactly the case with these DMA cards Riot is referring to.

Essentially, Direct Memory Access (DMA) cards do what they say on the tin: access memory directly. When games run, the data that’s used regularly and needed quickly is held in RAM, and other hardware (such as the GPU) usually reads and writes to this with the CPU’s mediation.

Many modern CPUs, however, sometimes permit hardware to bypass the CPU and access RAM directly for the sake of latency. Naturally, cheaters have jumped on this and started using DMA cards that physically slot into your PCIe slot and pretend to be harmless, but actually read game data directly from system memory to cheat at the lowest level, getting in before even ring 0, kernel-level anti-cheats can spot them.

Combatting this has meant ensuring the CPU’s IOMMU (Input–output memory management unit) actually checks the right hardware and doesn’t let rogue DMA cards, for instance, bypass the CPU. Previously, motherboard firmware didn’t get IOMMU booting up and checking things soon enough to detect the dodgy DMAs, but this was patched with BIOS updates late last year.

Riot’s X post was actually in response to another by ogisada which states, “Today’s Vanguard anti-cheat update blocked the majority of DMA firmwares using SATA/NVMe.”

Given this, and Riot’s lack of contestation over any of these details, it seems cheaters had still been managing to use DMA cards to cheat by disguising them as SATA or NVMe drives. But no longer.

The post by ogisada—which, again, Riot doesn’t seem to contest—also states the following: “VGK suddenly triggered an IOMMU restart warning in-game, after which the DMA firmware becomes completely unusable, even without the game running or after uninstalling Vanguard. Only fix is a full OS reinstall.”

(Image credit: Riot Games)

In other words: paperweights. $6,000 bricks.

The response I’ve seen online has been mixed, with some claiming it’s too far for Riot to mess with hardware like this. To my understanding, at least, it doesn’t seem like any actual hardware has been messed with, just its means of interfacing with the operating system. Whatever the case, love it or hate it, Riot’s never been one to hold back on its anti-cheat methods, and a bunch of cheaters are presumably finding that out now in a very expensive way.