Vanguard's anti-cheating system is a protection system that pays more attention to the threshold, and the overall design and realization of the national re-examination anti-cheating system is still not the same. Here we first discuss the threshold and the difficulty of analysis, and then discuss these in blocks later.
- After the game is installed, Riot Vanguard will be installed to C:\Program Files\Riot Vanguard Under the catalog. Its overall anti-cheating is driven by vgk.sys And the three-ring program vgc.exe achieve
- The VGK-driven boot is turned on, and the boot mode is activated. When the game is activated, it will be verified that this state cannot be turned on if it is not turned on. VGK drive will intercept all unsigned, loophole-driven and black-driven loading. That is, all public ARK and some Rootkit tools, even Dbgview, cannot be used. However, after testing, the driver can be successfully loaded with a time-poke signature.
- Neither Ring3 nor Ring0 can w