Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
How do I stop [Warden][1]-type programs from reading outside the game's allocated RAM?
I know they use this as anti-cheat, but it's supposed to be illegal. This example includes Valorant's Vanguard software and World of Warcraft. [1]: https://wowwiki-archive.fandom.com/wiki/Warden_(software)#cite_note-3
How do I stop Warden-type programs from reading outside the game's allocated RAM?
There is no way to prevent anti-cheating mechanics from preventing you from cheating. Attempting to disable Vanguard or Warden will result in your account being banned. In order to do what they were designed to do, systems like Warden must have access to the processes running on your system, anti-cheating systems are not interested in the contents of your files.
Sadly, without a dedicated secondary GPU, it’s unlikely you will be able to run any modern video game mentioned in your question within a VM. This leaves you with only one option, choose not to run any application, that implements the anti-cheating mechanism you describe in your question.
I know they use this as anti-cheat but it's supposed to be illegal.
Anti-cheating mechanics like Vanguard, Warden, and Easy Anti Cheat are not actually illegal.
they're reading personal information on your computer. so any data protection law. I know they won't keylog your passwords or anything but it's more intrusive than what Facebook and Google do to your data(which is arguably non-intrusive since you agree to share it), don't you think?
There isn't any trustworthy evidence what you describe is actually happening. If you truly do not trust those anti-cheating mechanics then you will simply have to avoid them entirely. This means NOT playing any application that uses them.
Any answer to my question? I can use a virtual machine for this and probably will but I'd like a software-based solution.
You probably won't be able to actually play Valorant or World of Warcraft within a virtual machine. In order to use GPU passthrough you would need a dedicated GPU for the VM. You would also need a processor that supports VT-d or AMD-Vi.
Some have suggested virtual machines, but those have poorer performance and are well, not real machines, so they might fail at running the software at all (as suggested in other answers).
However if you dual boot this problem goes away. Now, unless the malware is so sophisticated that reads into your other unmounted partitions, you should be fine.
While this technically requires an extra OS license (in case you are planning to run Windows on both), even a VM would do (plus the cost of the VM itself).
You may lose in terms of performance (it depends on the program requests), but you can usually afford to have even more than one virtual machine (dedicated to each single program) on the same host.
Any exploit will only see the inside of the virtual machine.
Moreover, if you use that virtual machine only for that game, it will not take any other info from the guest.
These types of programs use published Windows API to survey executing tasks.
They may also do DLL injection to incorporate their own code into executing tasks and access their memory, or Hook Windows API functions invoked by executing tasks and examine their parameters or block them.
Once installed, such "spyware" is unstoppable. Games that use it may refuse to run if that software is somehow uninstalled or blocked.
Running the game in a virtual machine may isolate it from your running system, but performance may be impacted or become impossible.
The best advice is to do nothing - if the game is distributed by a respectable company, it is highly unlikely that it will exceed its assigned functions.
EDIT
There have been some reserves about trusting well-known companies, citing the 2005 Sony BMG copy protection rootkit scandal. That case has helped in drawing specific red lines for the industry which it will be very costly to cross (as Sony has learnt).
However, the Sony scandal is nothing compared with the 2011 RSA Hack (recommended reading) and the 2020 United States federal government data breach. These have shown that any software can be compromised, either by direct attack or via indirect one via its software supply chain.
Today, we can only deal with probabilities: It's highly probable that any respectable company will do its utmost to protect its product and avoid any scandal. It's also probable that there is some weak link in its defenses, whose effect depends on it being exploited with success.
We must trust something, or we can stop using software. We have to trust some companies, as we don't really have a choice in the matter. All we can do is keep our defenses up with antivirus, firewall and more, keeping good backups for the case that the worst would happen.
Reading your RAM is a non-issue, if you manage what and when you load into it. I haven't played Valorant yet myself, because I don't see why I should introduce a kernel-level security issue into any system on purpose; that said, if you trust it from only reading your RAM, just don't fire up any password managers and messengers where you communicate about topics you want to keep private (e.g., use Discord for gaming and just don't open Signal before/while you play Valorant).
You can even go one step further and set up a dual-boot with a gaming-only Windows install and a separate work-OS (e.g., Linux or another Windows install). This way you can separately encrypt both OSes and also don't have to worry about your hard-drive being scanned by said introduced vulnerability.
Or you just wait until sandboxing/virtualization technologies advance to the point they can be used for gaming; though that might never happen.
You don't need a virtual machine. Just create another user, encrypt the original users directories with bitlocker or veracrypt, so "Warden" cannot read from disk either. While playing WoW make sure you are logged out from the original account. Then there is nothing of interest to be read by the anti-cheat tool.
Although I think it's good as a normal user to trust the developers enough that they won't read your personal information. They have a lot to lose if anyone would ever find out, more than they would gain.
Like others pointed out, you could try to use a VM, but I would advise you to use a simple rootkit (like it probably does too) that blocks all reads of Warden you don't like. I don't know if there is already something like that, so you'll likely have to write it yourself (I'm not a Windows user, so I can't help you on this, but it should not be that difficult.) But a malice or erroneous rootkit can be very dangerous (you can see that in the fact that many think rootkits are inherently bad), so be careful!
