YT YouTube2Text

YouTube2Text → Transcripts → The Problem With Crin’s Kernel Cheats Video

The Problem With Crin’s Kernel Cheats Video — Transcript

by devlettuce · 4,957 words · 841 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:01So apparently a cheat that writes to a
0:03game's memory is internal
0:06and the cheat that only reads that the
0:08memory is external.
0:11That's the line draws in his video about
0:13kernel cheats
0:16and it's wrong. Windows literally
0:18documents a function for writing into
0:20another program's memory. It's called
0:23write process memory.
0:26Your cheat can stay in its own program.
0:28call that function right into the game
0:31and still be external under every
0:33definition the game hacking scene uses.
0:37This matters because the rest of the
0:39video depends on understanding which
0:41part of a cheat runs where.
0:44Reading memory, injecting code, loading
0:47a driver and running in the kernel are
0:49four different things. Blend them into
0:52one category and you lose the very
0:54architecture you are trying to explain.
0:57And the mistakes don't stop at the
0:59definitions. The video tells us that
1:01dynamic analyzers gets rid of the code
1:04virtualization problem. That ordinary
1:07programs are useless against kernel
1:09drivers. That you need a vulnerable
1:12driver nobody has ever discovered. That
1:14hardware bands are completely unspoable
1:17and that kernel antiche is not a safety
1:20or privacy concern.
1:22Every one of those claims can be checked
1:24against public sources. Microsoft's
1:27documentation, the anti-che vendor's own
1:30engineering articles, published
1:32research, and the forum where the
1:35reversing community does its work in
1:37public. So, let's check them.
1:40First, context and credit where it's
1:42due. Krin makes videos about
1:45programming, games, and cyber security,
1:48and he has also built an anti-che
1:50protection for his own game on camera.
1:53Making a subject this dense accessible
1:55is a genuinely worthwhile goal and a
1:58fair amount of the video holds up.
2:01Anti-che development really is
2:02difficult. Kernel access really does
2:05give defenders powers that ordinary
2:07applications don't have. Attackers
2:10really do abuse vulnerable signed
2:12drivers. Drivers that carry a valid
2:14developer signature but contain security
2:17holes.
2:18Delayed ban waves really are documented
2:21tactic. Wright has described holding
2:23enforcement back so a detected cheat can
2:26spread and a larger group of users can
2:28be actioned at once. There's solid
2:30evidence behind the hardware corporation
2:33claim too. Riot's research has helped
2:36identify a preboot security weakness on
2:38some motherboards and the coordinated
2:40disclosure record credits them by name.
2:43Useful work with benefits beyond one
2:45game. The DMA segment near the start is
2:48also mostly right. A DMA cheat card is
2:51kind of a second small computer sitting
2:54in a PCIe slot, one of the expansion
2:56slots inside your PC that reads the
2:59game's memory without the CPU being
3:01involved.
3:02For a while, that looked invisible to
3:04any software. Crl antiche now catch
3:09these cards by checking what every
3:10device on that bus reports about itself.
3:14That part checks out. The DMA
3:16community's own forums openly discuss
3:18anti-cheets, scanning exactly that
3:20device information and custom firmware
3:23built to copy a legitimate network
3:25card's identity field by field just to
3:28survive those scans. He then adds that
3:31an anti-che could theoretically flash a
3:34card's firmware and make it unusable.
3:37And to his credit, he does say
3:39theoretically.
3:40That part is a legend. When players
3:43believed Vanguard was bricking DMA cards
3:46in May 2026, Riot publicly denied that
3:49its software damages anyone's hardware.
3:52So, no, the video isn't all wrong. The
3:55problem is that the loadbearing
3:57explanations, the ones doing the
3:59teaching, are the ones that fail. Let's
4:03take them in order. Distinction number
4:05one from around the 2minut mark of this
4:08video. A quick primer so the correction
4:11lands. Everything running on Windows is
4:14a process. Think of a sealed container
4:17with its own private memory. The game
4:20lives in one container. Your cheat
4:22program lives in another. In the
4:25terminology used across the game hacking
4:27scene and in the academic literature, an
4:30internal cheat runs its own code inside
4:32the game's container. An external sheet
4:36runs outside it and reaches across the
4:38boundary when it wants something. That's
4:41the entire distinction where the code
4:43runs. Now, a program outside the game
4:46can request access to read the game's
4:48memory and with the required permissions
4:51to write to it. Microsoft documents both
4:54operations, read process memory and
4:57write process memory. Writing a bite
4:59into the game from outside does not
5:01teleport your code inside. The operation
5:04you perform and the place your code
5:06executes are two independent questions.
5:10So the video's read versus write
5:12definition fails in both directions. An
5:14injected module can sit inside the game
5:16and only ever read. An outside program
5:19can write all day while its own logic
5:22stays outside. Reading and writing
5:24describe the operation. Internal and
5:26external describe the location.
5:29And yes, the permissions still matter.
5:32Windows provides documented callbacks
5:34that let the driver restrict the access
5:36other programs request on a protected
5:39process and anti-che use mechanisms of
5:42that kind.
5:44But difficulty doesn't redefine the
5:46operation. An external memory writer
5:49doesn't become internal because a
5:51defender made it harder to use.
5:55There is a second distinction the video
5:57blends into. The first user mode and
6:00kernel mode. Windows runs ordinary
6:03applications in user mode restricted
6:06inside their containers. The core of the
6:08operating system runs in kernel mode
6:11often called ring zero. The CPU's most
6:14privileged operating state where code
6:17can reach essentially anything on the
6:19machine. A driver is simply a program
6:22that runs inside that protected core.
6:25though even that needs a footnote.
6:28Windows also supports user mode drivers.
6:30So the word driver alone doesn't
6:32guarantee kernel privilege.
6:34Here's why keeping these apart matters.
6:37Injecting code into the game doesn't put
6:39that code in the kernel. Injected code
6:42still runs in user mode inside the
6:45game's container. Meanwhile, an external
6:48cheat can use a kernel driver as a
6:50helper while it's actually
6:52decision-making logic stays outside the
6:55game. Delivery mechanism, execution
6:58location, and privilege level are three
7:01separate design decisions, and real
7:03products combine them freely. One
7:06published analyzes of a commercial cheat
7:08documents exactly that combination.
7:11injected modules running inside the game
7:14delivered by a hypervisor component that
7:16loads at boot. Calling the platform
7:18hypervisor based doesn't make its in
7:20process module stop being in process.
7:24Screenbased systems are a fourth thing.
7:26Again, a vision sheet starts with
7:29pixels, the picture the game displays. A
7:32memory sheet starts with data
7:34structures. They expose different
7:36information to the cheat and different
7:38evidence to the defender. And how either
7:41one generates your input is yet another
7:43question. Collapsing all of this into
7:46one label doesn't remove those
7:48differences. It just hides which
7:50protection is supposed to address which
7:52behavior.
7:55Next, the claim that cheats and
7:57anti-cheets are basically just operating
8:00system internals.
8:02That leaves out an entire side of the
8:04problem. Take a wall hack. Before asking
8:08how someone reads an enemy's position
8:09out of memory, ask why their computer
8:12has that position at all. Riot's fog of
8:15war system addresses exactly that. The
8:18server simply doesn't send enemy
8:20positions to your client until you could
8:23plausibly see them.
8:25The engineering article describing it is
8:28honest about the limits. A fast game can
8:31only withhold so much. But the principle
8:34is straightforward. Information that
8:37never reaches the cheaters's machine is
8:39information a memory reader can't touch.
8:42Server authority works the same way.
8:44Changing a number in local memory
8:46doesn't force the server to accept it.
8:48An authorative server rejects actions
8:50that break the game's rules. That's why
8:53understanding a cheater means
8:54understanding the game as well as the
8:57operating system. kernel protections are
9:00one layer inside that larger design.
9:03They don't replace it. Now, the claim
9:06that sets the tone for everything else
9:08that the specific information isn't
9:10documented anywhere because the
9:12companies take it down and you can't
9:14just find it on Google the way you find
9:16Windows internals.
9:18This is the biggest most easily
9:20checkable misunderstanding in the video
9:22because the scene publishes constantly.
9:25There's one forum at the center of this
9:27entire research scene. It has been
9:30around for more than two decades. It has
9:32a sub forum for every major game, and I
9:34am deliberately not naming it here. It's
9:38one search way for anyone who actually
9:40wants it. It reversal threads, where
9:43people publicly document the game's
9:45internal structure, are among the
9:48largest technical threats on the
9:50internet. The Rust threat sits at around
9:525 million views and 27,000 replies. PUBG
9:57is around 4 million. Counterstrike 2,
9:59Escape from Tarov, Legion of Legends,
10:02Fortnite, all in the millions. One
10:05longunning thread simply catalogs every
10:08known method of reading hardware
10:10identifiers from a PC and nearly 450,000
10:14views. That is precisely the specific
10:17information the video says cannot be
10:18found.
10:20And it goes beyond game data. In 2026,
10:23community researchers published full
10:26tear downs of the anti-che drivers
10:28themselves. A two-part analyzis of
10:31Vanguard's driver, the file VGK.
10:35SIS claims to document its TPM checks,
10:38secure boot usage, hypervisor detection,
10:41and hardware identification.
10:43A September writeup traces easy antiche
10:46driver through its hardware inventory
10:48call by call disk serial numbers read
10:51through two different paths motherboard
10:54identity tables monitor serials network
10:57adapter details
11:00worth stressing that analyzes ran inside
11:02an emulated environment. So it's
11:05documents what the driver collects when
11:07it runs not proof of what every player's
11:10machine transmits to a server. A forum
11:13post can be wrong and a confident
11:15writeup can be wrong. That's a reason to
11:17examine the evidence, not to pretend the
11:20research doesn't exist. And around the
11:23forum material, there are vendor
11:25engineering articles explaining their
11:27own defenses, published battle
11:29researchers going back years, and
11:31academic papers defining the field. So,
11:35here's the honest version. Current life
11:37detection rules are secret and they are
11:40hard one. But the claim that the
11:43knowledge itself is hidden has been
11:45forced this entire time. The people
11:47building today's cheats start from these
11:50public foundations.
11:52On to reverse engineering where the
11:54video begins with something correct.
11:56Static analysis examines code without
11:59running it. Dynamic analysis observes
12:02behavior while it runs. So far so good.
12:06Then with dynamic analyzers, there's no
12:09crazy virtualization you have to decode.
12:13Running a program does not remove its
12:15code virtualization.
12:17Here's what that protection is.
12:21An offcator translates selected parts of
12:23the program's real machine instructions
12:25into byte code. Instructions for an
12:28invented processor that exists only
12:31inside the program. An interpreter loop
12:34reads that bite code and performs the
12:36work. The original instructions are
12:39gone. What chips is the interpreter
12:43plus its bite code. Press play. Attach a
12:46debugger. Trace it. The interpreter is
12:49still there and a trace of virtualized
12:51code contains the interpreter's
12:53bookkeeping mixed with the program's
12:55actual logic. Separating the two is a
12:59research problem in its own right. The
13:02academic deopiscation literature has
13:04treated it as one for over a decade.
13:08Dynamic analyzers can absolutely help.
13:10You might watch a value after it's
13:12decrypted or follow one input through
13:15the machine, but observing a result is
13:18not the same as recovering the logic
13:20that produced it. Pressing play doesn't
13:22restore the original code for your
13:24convenience.
13:25And a footnote onwards because it trips
13:28people up. This kind of virtualization
13:31protecting one program with a custom
13:33instruction set is not the same thing as
13:36running Windows inside a virtual
13:37machine. The terminology overlaps, the
13:40mechanisms don't. Which leads to the
13:43next claim that a kernel antiche makes
13:46dynamic analyzers almost impossible and
13:49that the only real way through in the
13:51video's own words is by making your own
13:54custom hypervisor.
13:56Two corrections.
13:58First, Windows ships a kernel debugger.
14:01It's called wind debug. It's documented
14:04by Microsoft. And with a second machine,
14:06you can step through kernel code and
14:08watch drivers run.
14:11A protected game can refuse to run in a
14:14debugging setup. That's a real defense,
14:17but it concerns playing the game with a
14:20debug attached, not studying the driver
14:22itself.
14:25Second, the video misses what the actual
14:28state-of-the-art looks like. There's
14:30also a third way to do dynamic analyzes.
14:33Emulation. An emulator is a program that
14:37fakes the CPU and fakes enough of
14:39Windows that the target driver believes
14:41it's running for real. While every
14:43instruction it executes gets locked, the
14:46target never loads into your real kernel
14:47and the game is never involved at all.
14:50And these tools are public, all of them.
14:53In August 2026, a researcher released
14:55Kevlar, an emulator purposely built for
14:58antiche drivers. Its author reports
15:01around 345 Windows kernel functions
15:04re-implemented so the drivers feel at
15:06home and that it runs easy antiche and
15:08battleized drivers and gets vanguards
15:11past its boot time check. The same
15:13author reports reconstructing a fully
15:16virtualized spoofer driver using nothing
15:18but the emulator's locks and says the
15:21spoofer's original developer confirmed
15:22the reconstruction matched. If that
15:25holds up, note what it means. The
15:27virtualization was decoded, not skipped.
15:31A month later came current. more than
15:34380 reimplemented kernel functions, its
15:36author says, able to take ESC's on
15:39Vanguard's drivers past their entry
15:41points with the analysis logs published
15:43alongside. A third project, Colonel
15:46Forge, does the same kind of work. These
15:50tools have real limits and they should
15:51be stated plainly. Getting past an entry
15:54point is not the same as reproducing an
15:56entire antiche. A missing function or
16:00different device state can change what
16:02an analyst sees. And one of Kernimul's
16:05optional backends actually uses hardware
16:08vitalization for speed. So emulation
16:10isn't automatically hypervisor free
16:13either. But step back almost impossible
16:16is a strange description of a research
16:18category that has three open-source
16:20tools, published logs, and an active
16:23community. As long as we keep two
16:25questions apart. Can researchers study a
16:28protected driver while it runs under
16:31full control on their own machine? Yes,
16:34within the limits just described.
16:37Can someone run a cheat inside a live
16:40protected game session and stay
16:41unnoticed? That is a different much
16:44harder problem and none of these
16:46researchers claim otherwise. The video
16:49treats the two as one. Next claim,
16:52normal programs are useless against
16:55kernel drivers, so it cheat needs one of
16:57its own. Kernel privilege really does
17:00change what an ordinary program can do.
17:02A normal process can't read arbitrary
17:05kernel memory, but the game still
17:07displays images and still accepts input,
17:10and those surfaces don't disappear
17:12because the defender loaded a driver. In
17:15fact, later in the same video, external
17:17hardware gets a segment of its own.
17:19people using microcontrollers,
17:22tiny programmable chips to replay
17:24onetoone mouse movements over USB. And
17:27honestly, that segment is one of the
17:29better parts of the video. It's real,
17:32it's current, and it quietly contradicts
17:34the earlier blanket statement because
17:36that entire ecosystem lives at or below
17:40user mode.
17:42The catalog, according to the
17:44community's own discussion. KMB box, a
17:47small box that presents itself as a
17:49mouse and takes orders over cable or the
17:51network. The classic device, which
17:53anti-cheets learn to fingerprint through
17:55its USB descriptors, the identification
17:58data every USB device announces, and
18:01through its unnaturally perfect movement
18:03curves.
18:05So, the scene moved on to Maxu, which
18:07reportedly emulates a real mouse down to
18:10vendor and product IDs. borrowed from
18:12known manufacturers.
18:14Arduino boards microcontrollers get
18:18programmed as mice for the same job. On
18:20the vision side, open source color bots
18:22get published. One released in February
18:252026 captures the screen, finds enemies
18:28by their outline color, merges the
18:30pixels into a box, aims at the head, and
18:33applies smoothing. So the crosshair
18:35decelerates like a human wrist with its
18:37own input layer deliberately modular. So
18:40users switch between a signed mouse
18:41driver, hardware devices, or a second
18:45computer that does the thinking and
18:46sends the movements back over USB.
18:49None of that is undetectable. The same
18:52forums are full of detection reports,
18:54and none of it proves any particular
18:56setup survives any particular antiche.
19:00But that is exactly the correction.
19:03Privilege is one axis, not the whole
19:06picture. And the USB device isn't a rung
19:09on the CPU's privilege letter at all.
19:12It's a different part of the system
19:13entirely. Which is why a kernel drive
19:16alone has never been the end of the
19:18story. No drivers. And the claim that an
19:20internal cheat developer needs a
19:22vulnerable driver that Microsoft, the
19:24anti-che vendor, and a security
19:26researchers have never discovered.
19:29Writing a driver and getting a system to
19:32trust that are two different problems
19:34and the video merges them into one.
19:37Microsoft documents the legitimate path
19:40end to end. Develop test sign run on a
19:43test machine then sign properly for
19:45release. Antiche do refuse machines with
19:49test settings enabled. That separates
19:51research machines from gaming machines.
19:54It doesn't make the knowledge stop
19:56existing.
19:57And the scene's most famous loading tool
19:59contradicts the undiscovered requirement
20:02all by itself. It's called KD Mapper and
20:05its own documentation identifies what it
20:07exploits. An old Intel network
20:10diagnostic driver signed and valid whose
20:13vulnerability has been public and
20:15blocklisted for years.
20:17That tool's entire development history
20:19is about cleaning up the traces a known
20:21block driver leaves behind and forum
20:24threads asking whether it is currently
20:26detected by this anti-che or that one
20:28stretch back years. That's what a public
20:31arms race looks like. To be fair,
20:34whether that route still works depends
20:35on the systems protections and the tools
20:37existence doesn't prove it defeats an
20:40enabled block list. but undiscovered by
20:43everyone describes the rarest path, not
20:46the standard one. There's a separately
20:49documented route too and it comes from
20:51the vendor itself. In its February 2025
20:54report, write described kernel cheats
20:57using drivers signed with stolen or
20:59fraudulent certificates, not discovered
21:02vulnerabilities at all. Someone else's
21:04signing identity.
21:06One more thing about Microsoft site
21:08because the video states it too
21:10strongly. Signing is an identity check,
21:13not a safety guarantee. A signature says
21:16who a driver claims to come from. It
21:18doesn't prove the code is buck free, and
21:20it doesn't prove the credentials weren't
21:22abused. That's exactly why vulnerable
21:25driver block list exists. And Microsoft
21:28own documentation says plainly that the
21:30block list cannot cover every vulnerable
21:32driver because compatibility has to be
21:35maintained. the wall is real, useful,
21:38and explicitly documented as incomplete.
21:43Then there's the hypervisor claim. The
21:46only real way is maybe building your own
21:48custom hypervisor, which the video calls
21:50extremely hard. A hypervisor is a layer
21:54that sits underneath the operating
21:55system and pretends to be the entire
21:58computer. Windows runs as its guest and
22:00the hypervisor can hide things from it.
22:03And to be fair to the video, building
22:06one that is stable and stays undetected
22:08is genuinely difficult. Nobody should
22:11walk away thinking that part is easy.
22:14But making your own from scratch stopped
22:16being the reality years ago. Public
22:19open- source hypervisor frameworks
22:21exist. HVP and Hyperplatform are the
22:24best known and they are the community's
22:26standard starting points. When the 2026
22:30Vanguard analyzes describes what the
22:32driver tries to detect, it lists matter
22:36of factly custom hypervisors built on
22:39such public frameworks because that's
22:41what people actually run. A bootle
22:44hypervisor written in Rust has been
22:46re-released publicly on the same forum.
22:49Reusing a framework is still real work.
22:52It just isn't the lone genius mythology
22:54the video sells.
22:56And the counter measures are public too.
22:58The part presented as unknowable.
23:01According to the same writeup, the
23:03driver times how long hypervisor
23:05transitions take. On real hardware, a
23:08specific instruction sequence costs
23:10roughly 50 to 100 CPU cycles. Under a
23:14hypervisor, several hundred to several
23:16thousand. It reportedly runs the probe
23:19on every core, cross checks two
23:22independent clocks so that spoofing one
23:24desynchronizes them and folds the result
23:27into a hardened rolling signature before
23:30deciding. If those findings hold, this
23:33is an arms race conducted in the open by
23:35both sides in 2026.
23:38So the honest version of the segment
23:40reads, "Hypervisor cheat exist. They are
23:43built on public foundations and staying
23:45undetected is a constant race. Exactly
23:48the back and forth the video describes
23:50in its opening minutes before replacing
23:53it with a myth. And for pure analyzers,
23:56you don't even need one. The emulators
23:58we just covered run the driver without
24:00the hypervisor at all.
24:03The band site gets the same treatment
24:06that some anti-cheets have completely
24:08unspoable hardware bands. That for
24:10certain hardware there is literally
24:11nothing you can do. And that for certain
24:14anti-cheets, no, spoofers don't actually
24:16work. Hardware bands are real and they
24:20are serious. The vendor's own privacy
24:22policies disclose collecting hardware
24:24and device identifiers. And that easy
24:27anti-che tearown shows the driver
24:29gathering disk serial through two
24:31independent paths, motherboard identity,
24:34monitor serials, network adapter
24:36details, and TPM material. A TPM being
24:40the security chip on modern motherboards
24:42designed not to be rewritable.
24:45But unspoofable describes the marketing
24:48of the ARMS race, not at state. The
24:51community's main public spoofer thread
24:53for Vanguard has a quarter of a million
24:56views and nearly 400 replies with free
24:59tools maintained across years, including
25:01ones operating at the boot firmware
25:03level before Windows even starts and an
25:07entire companion thread dedicated just
25:09to undoing TPM bans. What actually
25:12happened is escalation and it's a better
25:15story than nothing works. Anti-cheets
25:18leaned on the TPM and secure boot to
25:21anchor identity in hardware that resists
25:24rewriting. And the Vanguard analyzes
25:27taken it as reported describes the
25:29driver verifying TPM certificates with
25:32researchers noting that naive TPM
25:35spoofing gets flagged.
25:37Each generation of defenses killed the
25:40cheap tricks and forced the next
25:42generation of tools.
25:44Spoofing got harder. harder is true.
25:48There is literally nothing you can do is
25:50folklore and the people doing it daily
25:53in public are the evidence. Which brings
25:56us to the most serious mistake in the
25:59video that none of this is a safety or
26:01privacy concern. The argument is that
26:04people already install plenty of other
26:06drivers, hardware drivers, fan control
26:08apps, even MSA after burner. So the only
26:11valid complaints are Linux support and
26:13stability. But those components deserve
26:16scrutiny too. And having privileged code
26:19on your machine doesn't make the next
26:21privileged program risk-free.
26:24It means you now depend on the security
26:27of all of it. A kernel driver runs with
26:30powers an ordinary application never
26:32gets and the bug there can destabilize
26:34the whole system or be weaponized by
26:36actual malware. That isn't a fringe
26:39opinion. It's why driver security
26:42matters to Microsoft in the first place.
26:44The Genshin Impact example the video
26:46itself brings up proves the point. Trent
26:49Micro documented real attackers dropping
26:51Genchin's anti-che driver onto machines
26:54they had already compromised and using
26:56that signed legitimate driver to
26:58terminate antivirus processes. The
27:01driver didn't have to be written as
27:02malware for its powers to serve malware.
27:07There's even a formal vulnerability
27:08record for an access control flaw on one
27:11specified version of the ACE anti-che
27:13driver allowing local privilege
27:15escalation.
27:16A name product and version nothing more
27:19nothing less. It is an evidence about
27:21Vanguard and it doesn't indicate every
27:24antiche.
27:26It does show that security defects in
27:28antiche drivers are a real documented
27:30category.
27:32Microsoft's own guidance treats kernel
27:34security software as a trade-off.
27:36Visibility and resistance to
27:38interference in exchange for the
27:40consequences of running privileged code.
27:43A well-funded team manages that risk
27:45better. Funding doesn't remove it. So
27:49yes, safety is a valid concern. The
27:51interesting discussion is whether the
27:53benefit justifies the access and how
27:56well the risk is controlled. Telling
27:58people the concern doesn't exist avoids
28:00the engineering question entirely.
28:03And privacy gets dismissed with the same
28:06wave of the hand. You don't need a
28:08conspiracy theory to have this
28:10conversation. The vendor's own policies
28:13are enough. Battle Eyes privacy policy
28:16lists the categories of personal data it
28:19may process. IP addresses, game
28:22identifiers, hardware information and
28:24serial numbers, operating system
28:26details, and information about running
28:29processes and drivers. That's the
28:31company's own list. A policy describes
28:34disclosed scope, not a claim that every
28:37value is collected from every player on
28:40every launch. Keep that distinction. But
28:44this close to scope is exactly what
28:46makes collection limits and safeguards a
28:48legitimate question. Beta also describes
28:52data minimization and limits on storage
28:55and those safeguards belong in the
28:57conversation too. It helps to keep the
29:00stages separate. Inspecting something
29:02locally, transmitting it and retaining
29:04it are different operations and the
29:07technical analyzers of one product
29:09doesn't automatically establish what
29:11another one does.
29:13What we can say is simple. Persistent
29:15hardware identifiers can link activity
29:18to a device or an account and a
29:20protective purpose doesn't make that
29:22property disappear.
29:25That's true for anti-che. Anti virus and
29:29every other privileged program. An
29:31ordinary application can also access
29:34sensitive information within its
29:36permissions. The kernel component simply
29:38adds its own deeper reach.
29:42None of this makes antiche spyware. It
29:44means asking software to catch cheaters
29:47doesn't exempt it from questions about
29:50data handling. Security and privacy
29:53aren't slurs directed at developers.
29:56They are properties of the system you
29:58are asking millions of people to
30:00install. So about Crim, the intent is
30:04good. Genuinely, he's taking a subject
30:07locked behind Jarian and trying to hand
30:09it to regular people in 20 minutes. And
30:12the craft is real. Good pacing, good
30:15production, confident delivery. The
30:17world needs people who attempt this. But
30:21look at what a trusting viewer walks
30:22away with. That internal and external
30:25are about reading versus writing. That
30:28dynamic analyzes the solves
30:30virtualization.
30:32that the knowledge is secret because
30:34companies suppress it. That you need an
30:37undiscovered vulnerable driver. That
30:39hypervisor are near mythical solo
30:42projects. That spoofing is literally
30:44impossible. That safety and privacy
30:47complaints have no valid basis. Those
30:50aren't the side anecdotes. They are the
30:53loadbearing explanations, the ones doing
30:55the teaching.
30:57check them against the primary sources,
30:59Microsoft documentation, the vendor's
31:01own articles, the public researches, and
31:05most of them don't survive. And
31:07oversimplification is not the defense.
31:10It sounds like simplifying means
31:12removing detail while keeping the truth.
31:15If you change where code runs, you
31:17haven't shortened the subject. You've
31:20thought a different wrong subject.
31:23A viewer who knows the field will shrug
31:25and move on. A viewer who doesn't, the
31:28exact audience this is made for, walks
31:31away with confident wrong mental models
31:34they will carry into arguments, into
31:36studies, into their own content. At some
31:39point, whether it's half of the claims
31:41or 90% stops mattering. The lesson being
31:44taught is the misinformation. Clean
31:47delivery doesn't make wrong information
31:49kinder. It makes it more contagious.
31:52And it's worth being blunt about the
31:54pattern. This isn't a oneoff slip in
31:58otherwise careful coverage. It's the
32:00format. Confident narration over loosely
32:04checked technical claims is what
32:06produced this video. And until that
32:08process changes, there's no reason to
32:11expect a different hit rate from the
32:13next one. Based on what's here, treat
32:16the rest of the channel the way you
32:18would treat any source, one claim at a
32:20time.
32:22Because here's the thing, the accurate
32:25version is the better video. A public
32:28forum where strangers reverse the most
32:30defended drivers on Earth. Open source
32:33emulators that run anti-cheats like lab
32:36specimens. A TPM arms race deciding
32:38whether your motherboard trusts your own
32:40chip. Custom firmware that disguises a
32:43cheat card as a capture card so well
32:45that if the community reports are right,
32:48anti-cheets ban the real capture cards.
32:51All real, all public, all more
32:54interesting than a myth about
32:55undiscovered drivers and unbeatable
32:58defenses.
32:59And there's an uncomfortable irony. Krin
33:02made a whole video about cyber YouTubers
33:05wasting people's time with shallow,
33:08confident content.
33:11He was right about the genre. By its own
33:13standard, this video that he made is a
33:16member of it. The intent was to lower
33:19the barrier. The result is a barrier
33:22built from the wrong bricks, higher for
33:24anyone who wants to actually understand
33:26the stuff and invisible to anyone who
33:29believes they already do. The genuinely
33:32frustrating part is that the real
33:34subject needs none of this. Colonel
33:37anti-che is difficult. Fascinating
33:40engineering software that must protect
33:42the game on a machine the player fully
33:45controls. Stay compatible with thousands
33:47of hardware and software combinations
33:50and adapt while an entire public
33:52research industry tears its drivers
33:54apart and emulators hunts for signatures
33:57and studies every timing probe it ships.
34:00That story can absolutely be told
34:03simply. Just keep the vocabulary honest
34:06while you do it.
34:08Internal and external describe where the
34:10code runs. Reading and writing describes
34:13what it does. Kernel access changes
34:16privileges, not categories. Server
34:19design changes what information exists
34:22to steal. And when powerful software
34:25asks for deep access, security and
34:28privacy questions come standard.
34:31Give the anti-cheat engineers credit for
34:33what they built. Some of the best
34:34documented defenses in the industry are
34:36theirs. Give the researchers credit for
34:39publishing work anyone can inspect and
34:42give the audience an explanation that
34:44keeps the boundaries straight. All three
34:47are possible at the same time. Colonel
34:50Antiche is sophisticated software and
34:52the community around it is sophisticated
34:55too. It deserves better than ring zero
34:57as magic in both directions.
35:01If you want more claims like these taken
35:03apart from the channel we just talked
35:06about or anywhere else, say so in the
35:08comments. That is the standard
35:10educational content posted on YouTube
35:12and on any other platform should be held
35:14to, including my own channel. And with
35:17this being said, thanks for watching
35:18this video and I hope you really enjoyed
35:21it. I really tried hard to not make it
35:26overly complicated. Even though I have
35:29used quite a lot of words that some of
35:31you may not understand,
35:34I did try to explain everything as much
35:37as possible. So, I hope you all really
35:39did like it.
35:41And with that being said, thanks for
35:43watching again and we we will see us in
35:46the next video. Bye-bye.

About this transcript

This page contains the full transcript of The Problem With Crin’s Kernel Cheats Video by devlettuce, generated from the public captions YouTube serves with the video. The transcript has 4,957 words across 841 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.