What Runs Below the Operating System, and Why It Matters

Rings, privileges and an arms race

Modern operating systems separate code into privilege levels. Ordinary applications, including most games, run in user mode, where the operating system mediates their access to memory and hardware. Drivers run in kernel mode, sometimes called ring 0, where code can read and modify almost anything. An anti-cheat running in user mode can be fooled by a cheat running in the kernel, because the cheat can hide itself from every query the anti-cheat makes.

That is precisely what happened. As user-mode scanning improved through the 2010s, commercial cheat makers shipped kernel drivers, often loaded through vulnerable but legitimately signed third-party drivers. Vendors followed them down. BattlEye and Easy Anti-Cheat introduced kernel components for many titles, FACEIT built a kernel client for its Counter-Strike platform, and in 2020 Riot Games launched Vanguard alongside Valorant with a driver that loads when Windows boots.¹

The boot-time detail is the controversial one. Riot argued that loading early prevents a cheat driver from establishing itself before the anti-cheat arrives. Critics answered that a game's software now runs whenever the computer does, whether or not the game is open. Riot added a tray icon allowing players to disable Vanguard, at the cost of needing a reboot before playing again. That compromise is a useful model of what "reversible" can mean in practice.

The security case against

A kernel driver is attack surface. If it contains a vulnerability, an attacker who exploits it gains the highest privilege on the machine. If it is signed but poorly designed, attackers may load it themselves and use its functions for their own ends. This is not hypothetical. In 2022, security firm Trend Micro reported that ransomware operators were abusing mhyprot2.sys, the anti-cheat driver distributed with Genshin Impact, to kill antivirus processes on compromised systems. The driver did not need the game to be installed; its valid signature was enough.²

Earlier incidents point the same way. Researchers have repeatedly documented games whose drivers exposed memory-reading functions to any caller. Each case was patched, but patches do not recall old signed binaries already in circulation. A vendor that ships kernel code therefore takes on obligations usually borne by operating-system and hardware companies: secure development, external audits, fast patching and certificate revocation when necessary.

The privacy case, stated carefully

Privacy complaints about kernel anti-cheat often collapse two distinct claims. The first is about capability: a ring-0 driver could read personal files, browser data or keystrokes. That is true. The second is about behaviour: a given driver does read them. That is a factual claim requiring evidence, and we have not seen credible public evidence that major vendors harvest personal documents. What vendors do disclose, in privacy policies written under laws such as the EU's General Data Protection Regulation, typically includes hardware identifiers, information about running processes and loaded modules, and data about the game session.

Hardware identifiers deserve attention. They allow "hardware bans" that survive account changes, which is effective against repeat offenders. But they are also persistent identifiers of a physical machine, and under GDPR they can count as personal data. A player in France has the right to ask what is held and why, and the French data-protection authority, the CNIL, accepts complaints when answers are unsatisfactory.

Platform friction

Kernel anti-cheat is built for Windows. That made Linux players, and later Steam Deck owners, collateral damage. In 2021 Valve announced that Easy Anti-Cheat and BattlEye would support Proton, Valve's compatibility layer, on an opt-in basis per game. Many developers enabled it; some prominent multiplayer titles did not, citing the weaker guarantees of user-mode protection. The episode shows that "accepting" kernel anti-cheat is sometimes not a choice a player can make at all.

Questions a player can reasonably ask

• Does the driver run only while the game runs, or from boot?
• Can I disable or uninstall it cleanly, and is that documented?
• Has the driver been reviewed by an independent security firm, and is a summary public?
• What data leaves my machine, how long is it kept, and how do I request it?
• Is there a published vulnerability disclosure or bug bounty programme?

Those questions do not settle whether kernel anti-cheat is justified. They establish whether a specific deployment is proportionate. For organisers, they are a procurement checklist; for players, they are the minimum a system should answer before asking for ring-0 access. The next essay moves from home PCs to the controlled environment of a LAN stage.