36

How do I stop [Warden][1]-type programs from reading outside the game's allocated RAM?

I know they use this as anti-cheat, but it's supposed to be illegal. This example includes Valorant's Vanguard software and World of Warcraft. [1]: https://wowwiki-archive.fandom.com/wiki/Warden_(software)#cite_note-3

8
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – DavidPostill
    Jun 1, 2021 at 7:28
  • 3
    You should consider having a computer only for gaming. I have a multiple input monitor and USB-connected keyboard/mouse. All I need to do to switch is to move a USB plug. Jun 1, 2021 at 10:21
  • 5
    @ThorbjørnRavnAndersen Yeah, not everybody can afford that.
    – wha7ever
    Jun 1, 2021 at 15:46
  • 2
    @wha7ever Yes. Not everyone can afford even one computer. That was not part of the question here though. Jun 1, 2021 at 16:57
  • 2
    Run the thing inside Wine with its own WINEPREFIX and Z: unmapped and running from its own user account. While this isn't an inescapable sandbox, stuff like this is known to confuse Warden because when it tries to look outside it doesn't see anything there. I'm pretty sure I could actually cheat and go undetected. Not that I've tried.
    – Joshua
    Jun 1, 2021 at 18:24

7 Answers 7

27

How do I stop Warden-type programs from reading outside the game's allocated RAM?

There is no way to prevent anti-cheating mechanics from preventing you from cheating. Attempting to disable Vanguard or Warden will result in your account being banned. In order to do what they were designed to do, systems like Warden must have access to the processes running on your system, anti-cheating systems are not interested in the contents of your files.

Sadly, without a dedicated secondary GPU, it’s unlikely you will be able to run any modern video game mentioned in your question within a VM. This leaves you with only one option, choose not to run any application, that implements the anti-cheating mechanism you describe in your question.

I know they use this as anti-cheat but it's supposed to be illegal.

Anti-cheating mechanics like Vanguard, Warden, and Easy Anti Cheat are not actually illegal.

they're reading personal information on your computer. so any data protection law. I know they won't keylog your passwords or anything but it's more intrusive than what Facebook and Google do to your data(which is arguably non-intrusive since you agree to share it), don't you think?

There isn't any trustworthy evidence what you describe is actually happening. If you truly do not trust those anti-cheating mechanics then you will simply have to avoid them entirely. This means NOT playing any application that uses them.

Any answer to my question? I can use a virtual machine for this and probably will but I'd like a software-based solution.

You probably won't be able to actually play Valorant or World of Warcraft within a virtual machine. In order to use GPU passthrough you would need a dedicated GPU for the VM. You would also need a processor that supports VT-d or AMD-Vi.

0
20

Dual boot

Some have suggested virtual machines, but those have poorer performance and are well, not real machines, so they might fail at running the software at all (as suggested in other answers).

However if you dual boot this problem goes away. Now, unless the malware is so sophisticated that reads into your other unmounted partitions, you should be fine.

While this technically requires an extra OS license (in case you are planning to run Windows on both), even a VM would do (plus the cost of the VM itself).

3
  • 6
    This is the best answer assuming you're not trying to cheat. It has the additional downside of requiring a separate drive or partition, which a VM does not require.
    – hemp
    May 31, 2021 at 23:41
  • 4
    Better yet, have physically separate boot drives (HDD/SSD), and whenever you boot the spyware gaming OS, never connect the sensitive OS drive.
    – Nayuki
    Jun 1, 2021 at 2:31
  • 4
    If you're really paranoid, make sure the operating systems you don't want software reading from (and don't have currently booted) are running encrypted filesystems; and don't decrypt and mount them into your gaming OS. Jun 1, 2021 at 14:06
10

You may run them in a virtual machine.

You may lose in terms of performance (it depends on the program requests), but you can usually afford to have even more than one virtual machine (dedicated to each single program) on the same host.

Any exploit will only see the inside of the virtual machine.

Moreover, if you use that virtual machine only for that game, it will not take any other info from the guest.

4
  • 8
    It's worth noting that it is possible for malware to break out of a VM, but it's very unlikely that this software attempts that.
    – Hearth
    May 31, 2021 at 1:50
  • @Hearth Proper, although implicit in my intention in the word "dedicated", I had omitted to specify security layers. The OP was mainly concerned about the privacy of the information available from RAM, and ergo from the browser and accessible files. "Dedicated" should have been better phrased with something like: "in a properly set up VM, dedicated to that game, connected to the internet via a separate virtual network interface possibly connected via a separate router subnet (and firewall) to a VPN, contactless on the Host disk, with limited or no personal information about the Guest ... "
    – Hastur
    May 31, 2021 at 10:26
  • 8
    I'd like to add that there's plenty of anti cheating tools that block you from running the game inside a virtual machine. This is for example done to limit the player to running the more then once on the same (hardware) machine. May 31, 2021 at 12:19
  • Of the two specific games the OP mentioned in the question, according to some internet searches, Valorant will refuse to run when virtualised, while WoW appears to work fine
    – 小太郎
    Jun 2, 2021 at 13:07
10

These types of programs use published Windows API to survey executing tasks.

They may also do DLL injection to incorporate their own code into executing tasks and access their memory, or Hook Windows API functions invoked by executing tasks and examine their parameters or block them.

Once installed, such "spyware" is unstoppable. Games that use it may refuse to run if that software is somehow uninstalled or blocked.

Running the game in a virtual machine may isolate it from your running system, but performance may be impacted or become impossible.

The best advice is to do nothing - if the game is distributed by a respectable company, it is highly unlikely that it will exceed its assigned functions.

EDIT

There have been some reserves about trusting well-known companies, citing the 2005 Sony BMG copy protection rootkit scandal. That case has helped in drawing specific red lines for the industry which it will be very costly to cross (as Sony has learnt).

However, the Sony scandal is nothing compared with the 2011 RSA Hack (recommended reading) and the 2020 United States federal government data breach. These have shown that any software can be compromised, either by direct attack or via indirect one via its software supply chain.

Today, we can only deal with probabilities: It's highly probable that any respectable company will do its utmost to protect its product and avoid any scandal. It's also probable that there is some weak link in its defenses, whose effect depends on it being exploited with success.

We must trust something, or we can stop using software. We have to trust some companies, as we don't really have a choice in the matter. All we can do is keep our defenses up with antivirus, firewall and more, keeping good backups for the case that the worst would happen.

1
  • 32
    I wouldn't be so sure about the last point. A counter example is eg the Sony BMG rootkit (which came from a respectable company, but did all sorts of harmful stuff beyond what was claimed & without the users consent). Not that I think that that's the norm, but it's one example that shows that your last sentence might be phrased in too absolute terms.
    – tim
    May 31, 2021 at 8:06
7

Reading your RAM is a non-issue, if you manage what and when you load into it. I haven't played Valorant yet myself, because I don't see why I should introduce a kernel-level security issue into any system on purpose; that said, if you trust it from only reading your RAM, just don't fire up any password managers and messengers where you communicate about topics you want to keep private (e.g., use Discord for gaming and just don't open Signal before/while you play Valorant).

You can even go one step further and set up a dual-boot with a gaming-only Windows install and a separate work-OS (e.g., Linux or another Windows install). This way you can separately encrypt both OSes and also don't have to worry about your hard-drive being scanned by said introduced vulnerability.

Or you just wait until sandboxing/virtualization technologies advance to the point they can be used for gaming; though that might never happen.

3
  • 2
    VMs already can be used for gaming. The problem is bleeding-edge games require latest/greatest tech while VM developers need time to catch up. So VMs are inherently unsuited to bleeding-edge games.
    – hemp
    May 31, 2021 at 23:40
  • 3
    That's absolutely correct. In fact, many very old games, e.g. from GOG.com, come with a VM for compatibility reasons. However since OP asked about new games with modern Anti-Cheat Software I left that out.
    – jaaq
    Jun 1, 2021 at 8:05
  • DirectX-in-VMs is already supported in some software. Likewise, OpenGL-in-VMs, and PCI-passthrough-of-a-second-video-card-into-VMs (that last finally no longer requires explicit workarounds to pass through an nVidia card -- they previously made it a feature only available for their expensive "professional" cards). Jun 1, 2021 at 14:07
2

You don't need a virtual machine. Just create another user, encrypt the original users directories with bitlocker or veracrypt, so "Warden" cannot read from disk either. While playing WoW make sure you are logged out from the original account. Then there is nothing of interest to be read by the anti-cheat tool.

Although I think it's good as a normal user to trust the developers enough that they won't read your personal information. They have a lot to lose if anyone would ever find out, more than they would gain.

4
  • 17
    You should not trust the developer of the game to not read your private information. If there is no stopping companies like Google/Facebook/Microsoft from tracking you, do you really think the average Joe would care if your rootkit sends unanonymized usage details about what programs you have to their servers. It happens and it's a major issue that people should care about. Yes that information may be useful to stop cheating, but it's still a major invasion of my privacy, which I'd rather not have.
    – Anunay
    May 31, 2021 at 9:15
  • 2
    @Anunay Well our entire society relies on some levels of trust. We trust our coworkers not the hack our computers at work and put some incriminating stuff on there, whil we are on the toilet. Although they could if they wanted because they have physical access. In the same way: these companies would be punished if they stole your personal information.
    – Thomas
    May 31, 2021 at 9:22
  • 2
    So your solution is to not use any private things while playing Valorant and forcefully disable Warden when not? This is a good solution but imo could be made more clear May 31, 2021 at 15:16
  • 6
    “Although I think it's good as a normal user to trust the developers enough that they won't read your personal information.” Very naive assumption. Especially in the case of game software. This should be the case, but often is not the case at all. May 31, 2021 at 17:16
-2

Like others pointed out, you could try to use a VM, but I would advise you to use a simple rootkit (like it probably does too) that blocks all reads of Warden you don't like. I don't know if there is already something like that, so you'll likely have to write it yourself (I'm not a Windows user, so I can't help you on this, but it should not be that difficult.) But a malice or erroneous rootkit can be very dangerous (you can see that in the fact that many think rootkits are inherently bad), so be careful!

3
  • 20
    You greatly overestimate average user's programming abilities.
    – gronostaj
    May 31, 2021 at 5:28
  • 13
    You greatly overestimate the average professional programmer's abilities.
    – wizzwizz4
    May 31, 2021 at 20:12
  • 4
    I'm not sure "abilities" is the right word. Although I am a professional programmer and surely have the ability to write a rootkit, I have no interest in writing one and therefore don't poses any of the specific knowledge required to do so. Thus, it would be both a major time investment and a terrible use of that time.
    – hemp
    May 31, 2021 at 23:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.