How Kernel ANTI-CHEATS are BYPASSED — Transcript

Full transcript

1. 0:00A lot of people ask me how they can hack
2. 0:01games that are protected with a kernel
3. 0:03level anti-cheat like Fortnite,
4. 0:04Valorant, Rainbow Six, or PUBG. In this
5. 0:07video, we are going to learn how kernel
6. 0:08level anti-cheats are bypassed by game
7. 0:10hackers and how people actually manage
8. 0:12to make cheats for them. If you watch
9. 0:13this video until the end, you will know
10. 0:15every working technique that they use to
11. 0:17get through kernel level anti-cheats.
12. 0:18The first method hackers use is making
13. 0:20their own kernel drivers. They do this
14. 0:22because the anti-cheat software also
15. 0:23uses a kernel driver to work. If you do
16. 0:25not know what a kernel driver is, here
17. 0:27is an easy way to understand it. Your
18. 0:28computer runs programs in two different
19. 0:30areas, user mode and kernel mode. In
20. 0:32user mode, all your normal programs run.
21. 0:33This includes the regular games you play
22. 0:35like Fortnite, PUBG, or Rainbow Six.
23. 0:37But, the anti-cheat protecting these
24. 0:39games runs in kernel mode. Anti-cheats
25. 0:41are programs built to watch your
26. 0:42computer and see if you are cheating. It
27. 0:44is just like an anti-virus program which
28. 0:46checks if a virus is trying to attack
29. 0:47your computer. To do this job well,
30. 0:49anti-cheats run in kernel mode. Any
31. 0:51program running in kernel mode has a lot
32. 0:52of power that normal user mode apps do
33. 0:54not have. For example, a kernel program
34. 0:56can control everything on your computer.
35. 0:58It can look at and change the hidden
36. 0:59memory of any program, including the
37. 1:01game you are playing. It can directly
38. 1:02control your hardware like your mouse,
39. 1:04keyboard, and graphics card. It can hide
40. 1:06files and running software so that
41. 1:07normal tools like the Windows Task
42. 1:09Manager cannot see them. And it can
43. 1:11block or completely turn off other
44. 1:12programs that it does not want running.
45. 1:14When we hack a game that is not
46. 1:15protected by a kernel anti-cheat like
47. 1:17Counter-Strike 2 or Assault Cube, we can
48. 1:19easily use standard Windows API
49. 1:21functions like read process memory and
50. 1:23write process memory to view and change
51. 1:25the game's data. But, in games protected
52. 1:27by a kernel anti-cheat, these normal
53. 1:29Windows functions cannot be used. This
54. 1:31is because the anti-cheat runs with
55. 1:32highest privileges inside the kernel. It
56. 1:34sets up strict blocks and hooks that
57. 1:36intercept these specific Windows
58. 1:37functions. The moment your cheat asks
59. 1:38Windows to read or write to the game's
60. 1:40process, the anti-cheat instantly blocks
61. 1:42the request and flags your account for a
62. 1:43ban. And that is exactly why game
63. 1:45hackers develop their own kernel driver.
64. 1:47By running inside the kernel themselves,
65. 1:49they can completely bypass these blocked
66. 1:51Windows functions and directly read and
67. 1:52write the physical memory of the game
68. 1:54without the anti-cheat seeing it. But,
69. 1:56because kernel drivers have total
70. 1:57control over your computer, the Windows
71. 1:59operating system is very strict. It will
72. 2:01not let you load any kernel driver that
73. 2:03it does not trust. To make Windows trust
74. 2:05your kernel driver, you must sign it
75. 2:06with an official digital certificate
76. 2:08issued by Microsoft. However, this
77. 2:09official certificate is not free. It
78. 2:11costs a few hundred dollars, which is
79. 2:13way too expensive for most regular
80. 2:15people. Because of this, game hackers
81. 2:16use different techniques to sneak their
82. 2:18own unsigned cheat drivers into the
83. 2:19kernel instead. The first method they
84. 2:21use is called manual mapping. Many real
85. 2:23companies make software for normal
86. 2:25things like overclocking tools to speed
87. 2:27up your graphics card or apps that show
88. 2:29your hardware information. These apps
89. 2:30need their own kernel drivers to work,
90. 2:32which are legitimately signed using a
91. 2:33valid Microsoft certificate. Because
92. 2:35these real drivers are legitimately
93. 2:37signed, Windows allows you to load them
94. 2:39easily. This is exactly what game
95. 2:41hackers take advantage of. They start by
96. 2:42loading one of these trusted real
97. 2:43drivers onto the computer. Normally,
98. 2:45these real drivers use a communication
99. 2:47system called IOCTL to talk to their own
100. 2:49user mode apps. However, some of these
101. 2:51real drivers have a big flaw. They do
102. 2:53not check who is sending the IOCTL
103. 2:55message. They just assume the message is
104. 2:56coming from their own trusted app. Game
105. 2:58hackers look for these weak, unprotected
106. 3:00drivers and build their own custom app
107. 3:02to send an IOCTL message to them. By
108. 3:04using this vulnerable driver and
109. 3:05controlling it through IOCTL, the
110. 3:07hackers can exactly mimic the process of
111. 3:09how Windows itself loads a driver. They
112. 3:11use this trick to do all the heavy
113. 3:13lifting manually, allowing them to
114. 3:14successfully load their own cheat
115. 3:15drivers directly into the kernel without
116. 3:17needing an expensive Microsoft
117. 3:18certificate. An open-source tool called
118. 3:20KDMapper on GitHub is a great way to
119. 3:22learn how manual mapping works. However,
120. 3:24directly using any modern game will get
121. 3:26you banned in minutes. Because KDMapper
122. 3:28is public, all major anti-cheats already
123. 3:30know exactly how to look for it. To beat
124. 3:31this, game hackers study how KDMapper
125. 3:33works, but build their own custom manual
126. 3:35mapping systems instead using much more
127. 3:37stealthy techniques to remain completely
128. 3:39hidden. Another method they use to load
129. 3:40their unsigned driver is even easier and
130. 3:42safer than manual mapping. Once again,
131. 3:44they start by loading a legitimately
132. 3:46signed driver that has a vulnerability.
133. 3:47But instead of manually mimicking the
134. 3:49load process, they use this trusted
135. 3:51driver to change a tiny bit of the
136. 3:52Windows operating system itself. They do
137. 3:54this by patching specific Windows kernel
138. 3:56function pointers. Essentially, they
139. 3:57change the code in the kernel that is
140. 3:59responsible for checking driver
141. 4:00signature. By turning off or changing
142. 4:02this check, Windows is tricked into
143. 4:03thinking that any driver being loaded is
144. 4:05completely legitimate. This technique is
145. 4:07called a DSE bypass, which stands for
146. 4:09driver signature enforcement bypass.
147. 4:11Because it lets hackers load their cheat
148. 4:13driver using normal Windows functions
149. 4:15without getting blocked, it is often
150. 4:16much easier and safer than manual
151. 4:18mapping. In the end, the kernel driver
152. 4:20used to allow game hackers to read and
153. 4:21write to the game's memory. The next
154. 4:23thing their cheat needs is an overlay.
155. 4:24Many beginner game hackers use standard
156. 4:26transparent Windows functions to draw
157. 4:28their overlays on the screen. But kernel
158. 4:29mode anti-cheats constantly check if a
159. 4:31window is being drawn on top of their
160. 4:33game using these traditional methods. If
161. 4:34the anti-cheat finds out that a separate
162. 4:36program is drawing over the game, the
163. 4:37player gets banned instantly. To counter
164. 4:39this, hackers look at legitimate apps
165. 4:41that actually need to draw an overlay on
166. 4:42top of your game. For example, apps like
167. 4:44Discord, Steam, or Nvidia GeForce
168. 4:46Experience use overlays to provide
169. 4:48helpful features while you play. These
170. 4:50features include showing your friends
171. 4:51list or a chat overlay so you can
172. 4:53message people mid-game, showing a
173. 4:55notification when you earn an
174. 4:56achievement or get an invite, showing an
175. 4:58in-game frame counter FPS, or
176. 5:00performance statistics in the corner of
177. 5:01your screen. And because these apps are
178. 5:03completely trusted by the anti-cheat,
179. 5:04their overlays are allowed to run
180. 5:05safely. What game hackers do is hijack
181. 5:08these trusted overlays. They inject
182. 5:09their own code into Discord or Steam and
183. 5:11trick those real overlays into drawing
184. 5:13their cheats ESP lines, boxes, and IMGUI
185. 5:17cheat menus instead. To the anti-cheat,
186. 5:18it just looks like Discord is doing job,
187. 5:20keeping the cheats visuals completely
188. 5:22hidden. However, all the tactics we have
189. 5:24talked about so far are still not enough
190. 5:25to completely bypass a modern
191. 5:27anti-cheat. They are just the starting
192. 5:28steps. Modern kernel anti-cheats already
193. 5:31know about these tricks. They actively
194. 5:32check if a driver is being manually
195. 5:34mapped or if a trusted overlay like
196. 5:35Discord is being hijacked. Because
197. 5:37anti-cheat developers already know these
198. 5:38moves, game hackers have to take things
199. 5:40a step further. They have to attack the
200. 5:41anti-cheat itself. This is the ultimate
201. 5:43method used by advanced undetected
202. 5:45cheats. Attacking the anti-cheat means
203. 5:46finding the exact piece of code inside
204. 5:48the anti-cheat that looks for things
205. 5:49like manual mapping or overlay
206. 5:51hijacking. Once hackers find that
207. 5:53detection code, they change it so it
208. 5:54simply ignores the cheat on purpose.
209. 5:56They do this using a technique called
210. 5:57hooking. Hooking means changing a
211. 5:59software's code in real time while it is
212. 6:01running on your computer to force it to
213. 6:02behave differently. To find these
214. 6:03specific detection functions, hackers
215. 6:05have to take the anti-cheat apart to
216. 6:07study how it works. This process is
217. 6:08called reverse engineering. They use
218. 6:10special tools like IDA Pro along with
219. 6:12kernel level debuggers and scripts to
220. 6:14look deep inside
221. 6:15code and find the exact functions they
222. 6:17want to disable. In the end, a bypass is
223. 6:19not a single magical thing that simply
224. 6:21turns off a kernel level anti-cheat.
225. 6:23Instead, a successful bypass is built by
226. 6:26defeating every single detection method
227. 6:27the anti-cheat uses one by one. It's not
228. 6:29just a single trick, it is a whole group
229. 6:31of small fixes, patches, and clever
230. 6:33workarounds working together to keep the
231. 6:35cheat running smoothly and completely
232. 6:37hidden. If you want to learn all of this
233. 6:38in more depth and see how it works in
234. 6:39the real world, check out my Patreon.
235. 6:41Over there, you will learn reverse
236. 6:43engineering, game hacking, and
237. 6:45anti-cheat bypassing with real practical
238. 6:46lessons. The link is in the video
239. 6:48description down below. Or, if you want
240. 6:49to make your very first cheat for
241. 6:51absolutely free right now, watch the
242. 6:53video on your screen.