Kernel-level anti-cheat runs at Ring 0 — the highest privilege level on Windows. It loads before the game and can see everything: processes, memory, drivers. This sounds scary, but there are hard limits on what it can actually detect.
What It Can See
- All running processes and their memory maps
- Injected DLLs or hooked system functions
- Unsigned or suspicious kernel drivers
- Hypervisor and VM artifacts (in some implementations)
What It Cannot See
- Memory reads from another process using legitimate Windows APIs
- Input simulation through hardware (mouse firmware, Arduino)
- Screen reading (pixel-based aimbots)
- A properly signed external driver that reads process memory without modification
Why External Cheats Work on Vanguard
Vanguard (Valorant) looks for unsigned code inside the Valorant process and for hooks in the call stack. An external tool that reads memory without injecting anything bypasses this scan completely. Our Valorant external uses a read-only kernel driver with a legitimate certificate chain — Vanguard sees it as a normal system tool.
Battleye vs EAC vs Vanguard
| Anti-Cheat | Ring | Injection Detection | External Bypass |
|---|---|---|---|
| VAC (CS2) | User | Good | Easy |
| EAC (Apex) | Kernel | Strong | Hard (external works) |
| Battleye (PUBG) | Kernel | Strong | Hard (external works) |
| Vanguard (Valorant) | Kernel | Very Strong | External-only works |
Patch Cycles and Detection Windows
Anti-cheat detection is rarely continuous. Vanguard updates its driver through the vgc service roughly every few weeks, and each update carries new signatures for known cheat drivers and signed certificates revoked at the Microsoft level. The practical effect is that a driver that worked on Tuesday can be detected on Thursday if its certificate lands on the revocation list. EAC and BattlEye operate differently: EAC pushes module updates with game patches, so Apex Legends detections cluster around season launches, while BattlEye on PUBG can ban retroactively once a signature is confirmed. A useful habit is watching the Windows Event Viewer under System for vgk.sys version changes, which tells you when Vanguard has rotated. Checking the certificate serial of any driver against the Microsoft revocation manifest confirms whether it is still trusted. People assume detection is live and constant; it is mostly batched, which creates narrow windows where a stale driver remains functional until the next push.
Secure Boot and TPM Requirements
Valorant on Windows 11 now requires TPM 2.0 and Secure Boot enabled, and Vanguard checks both at launch through its own service rather than trusting Windows Security Centre. On Windows 10 the requirement is not enforced, but Vanguard still reads the Secure Boot state and flags systems where it is disabled as higher risk, which lengthens manual review queues after a report. Faceit's client went further in 2023 and made Secure Boot mandatory for all CS2 matchmaking, rejecting players without it at the login stage. The measurable consequence is that a driver loaded before Windows boots, with Secure Boot off, sits outside the trust chain and gets treated differently. Verifying your state is straightforward: run msinfo32 and check the Secure Boot State line, and run tpm.msc to confirm the TPM is present and ready. A common mistake is enabling Secure Boot without converting the disk to GPT first, which leaves the machine unbootable until the firmware is reset.
Hardware IDs and Ban Persistence
Bans are not always account-bound. Riot's hardware ban system records a fingerprint built from the motherboard serial, disk serials, MAC address and the SMBIOS UUID, and Vanguard re-checks it on every launch of Valorant. Changing an account does not clear it, and the fingerprint survives a Windows reinstall because it is read from firmware, not the OS. EAC applies a similar approach on Apex Legends, though it is tied more loosely to the account and is often lifted after six months of good behaviour. BattlEye on PUBG is the most aggressive, issuing permanent hardware bans that have caught players who shared a machine with a flagged sibling. The common failure case is a used motherboard bought online that already carries a ban from a previous owner, which surfaces only when the game refuses to launch with a generic block message. Checking is difficult without launching the game, but the ban reason in the Riot support portal distinguishes account from hardware action.
Reading Vanguard's Own Logs
Vanguard writes a log to C:\ProgramData\Riot Games\Vanguard\Logs that records driver load, service start and any blocked modules at launch. The file is small and plain text, and scanning it after a failed launch shows whether the block came from a signature check, a Secure Boot state mismatch or a conflicting driver such as an old version of the Logitech G Hub kernel component. The vgk service runs as a boot-start driver, so problems appear in the System event log under the source vgk with error codes like 0xC0000428, which means Windows refused to load an unsigned or revoked driver. People misread a failed launch as a detection when the log usually shows a straightforward load error. EAC writes to C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.log and BattlEye to the game directory, and both record the handshake result, which confirms whether the client reached the server at all.