DRM in video games has been a topic of discussion for quite a while, as far as I can recall. It’s a great topic that lends itself well to ignoramuses who can band together and spew jargon they don’t understand at a shared enemy as a form of self-validation. There’s a lot to say on the topic, but I feel like the masses have recently shifted their focus from DRM to anti-cheat. My hot, victim-blaming take for today is: the problem isn’t the developers, nor is it the cheaters—it’s the players.
When I think of invasive anti-cheat in video games, three somewhat recent examples that come to mind are Genshin, Valorant, and Street Fighter V (all of which happen to be terrible games, I might add). As far as I can tell, the common factor that had people up in arms about these games is the fact that their anti-cheat mechanisms were implemented in the kernel. This made it very easy for people to point and shout “rootkit!” despite having a fragmented at best understanding of the actual risks or motivations.
While “rootkit” definitely has negative connotations due to its association with malicious software, rootkits aren’t necessarily malignant by definition. I’ve written a rootkit in the past as a proof of concept that did nothing more than hide itself from userland and provide a privilege escalation vector. Sure, it could be exploited for malicious purposes, but just because you can beat someone over the head with a baseball bat doesn’t mean baseball bats are inherently evil.
I can't believe people at Riot thought "pretend to be a shitty virus scanner and block apps randomly" was the correct answer instead of "disable playing the game until you reboot"
— Katelyn Gadd (@antumbral) 2020年4月28日
Like holy shit is this a video game or an enterprise asset control system pic.twitter.com/vaTL3VSmJg
So, you might be wondering why the developers felt it was necessary to ship kernel modules with their video games. Detecc Philippe from Riot Games summarises the technical details quite succinctly in a kind of cringey blog post, but the tl;dr is that cheaters are using kernel modules too, and these would be impossible to detect without kernel privileges.
I recall MiHoYo being under fire for having their Genshin anti-cheat active even when the game was not running. “Why does the anti-cheat need to be on when I’m not playing the game?” is the knee-jerk response, but if you take the time to think about the implementation then the reasoning is quite apparent. The game doesn’t need to be running for you to load kernel modules and overwrite syscalls, and discovering these modifications after the fact is extremely difficult. Essentially you want the anti-cheat to be running before the malicious code does, and you have no way of knowing when the malicious code will be run, so anti-cheat needs to be on all the time to work effectively.
On the other hand, Street Fighter V was censured for the exact opposite reason. Although most players were upset just at the thought of a rootkit because they didn’t know any better, more learned individuals were appalled at how awful the actual implementation was. Capcom’s kernel module was built so poorly that it could be easily exploited by any userland application to gain kernel privileges. It’s amusing how people were effectively mad that Genshin’s anti-cheat was built too well, but also mad that Street Fighter’s was not built well enough—though the latter was kind of blown out of proportion. It’s not something that’s exclusive to Street Fighter or Japanese developers, as you may have been led to believe. It’s actually a fairly common complaint with software that installs kernel modules. Plenty of antivirus programs are guilty of this, for example.
oh dear god this capcom.sys has an ioctl that disables smep and calls a provided function pointer, and sets SMEP back what even pic.twitter.com/jBCXO7YtNe
— slipstream/RoL (@TheWack0lian) 2016年9月23日
Now, I think this would be a good point to stop and make it clear that, despite everything I’ve said so far, I am definitely not in favour of anti-cheat. Aside from the obvious security risks, there are also concerns around adverse effects on performance and genuinely malicious behaviour, like that time some company installed a bitcoin miner. Of course, none of these make for a very pleasant video game-playing experience.
The point I was trying to get across was that building functional anti-cheat is actually a very difficult engineering problem. I’d go so far as to say that it’s impossible to implement highly performant anti-cheat without violating the user’s freedom in some way. Playing defensively is always a losing battle no matter how you spin it, so I can appreciate the difficulty in the challenges that game developers need to face.
Even with kernel modules, virtual machines can be used to externally modify states. You can try to detect this, but then that becomes the surface area where you have to fight the attackers. You can integrate with increasingly lower levels (such as SGX) and reduce the surface area for attackers that way, which comes at the expense of increased opacity. But there are even hardware components that snoop buses in ways software cannot detect to provide cheats. At the end of the day, it comes down to what kind of trade-offs the developers and users are willing to make, since there’s no easy solution.
This brings me to my next point. A good friend of mine once mentioned that whenever he’s facing a hard programming problem, it’s usually because he shouldn’t be doing it that way. If the problem seems really hard, or impossible, then you’re probably operating under a bugged assumption. Piracy is a great example of this. You’ll never be able to “fix” piracy, but Spotify and Netflix changed the game by thinking differently. This is also the solution to cheating in video games. The winning play is to not care.
Developers are only shipping anti-cheat solutions because players get upset when they play with cheaters. Nobody wants to play games that have a reputation for high amounts of cheating, so developers are financially motivated to build better anti-cheat. But better anti-cheat is necessarily more invasive, which again makes the players upset. You can’t have your cake and eat it, so do you care more about cheaters, or privacy, security and performance? There’s probably a happy medium somewhere, but I’m not going to pretend I know where that is.
Personally though, I’d much rather play without anti-cheat and deal with cheaters than give some closed-source video game kernel access on the machine I manage my life and finances with. Someone’s ruining your Dota game? Just leave or play with friends next time. The problem wouldn’t exist if people didn’t get so heated about video games in the first place. People cheat all the time when playing chess online, but nobody really cares that much. They actually enjoy the game so they just say “ugh, whatever” and get on with their day.
Just my opinion though. Maybe it’s different for people who live on CS:GO and it’s meaningful to their lives in some way. I dunno.