I just do random reverse engineering.
A few days ago, a seemingly random thought came up in the back of my mind. On every system, there’s a process whose Process ID is 0. This process is called the System Idle Process, and contains threads that execute when no other thread is ready to run on a given processor.
Riot Vanguard is an anti-cheat system developed by Riot Games for their first-person shooter VALORANT. Unlike other popular anti-cheat solutions (EasyAntiCheat, Battleye), the anti-cheat driver is loaded at boot time. By loading this early in the boot process, Vanguard can inspect every driver loaded after Windows boots. This is a luxury that other anti-cheats lack, as they typically launch…
Event Tracing for Windows (ETW) is a kernel mechanism designed to log certain activity happening in the system. Despite its seemingly innocuous description, ETW can be a valuable source of information and a very interesting hook point for both anti-cheats and other drivers.