Kernel Level Anti-Cheat Explained (2026)

A kernel-level anti-cheat is a signed Windows driver that runs at Ring 0, the same privilege level as the operating system kernel, instead of behaving like an ordinary Ring 3 app. That position lets it observe process and driver activity, protect game memory, and read hardware identity below the user-space layer where common hooks operate. Riot Vanguard, Easy Anti-Cheat, and BattlEye all use this access, although they do not load at the same time.

What "kernel level" actually means

Windows separates ordinary programs in user space from the kernel space that controls memory, devices, and system calls. Your browser and game launcher normally run at Ring 3. A kernel driver runs at Ring 0, so it can receive operating-system events and enforce access rules before a Ring 3 tool gets a useful view of the game.

That privilege is powerful, but it is not magic. The driver still operates within Windows security controls such as Driver Signature Enforcement and PatchGuard, also called Kernel Patch Protection. Publishers use a signed driver because a user-space scanner can be hidden from or fed altered data by another Ring 3 process with comparable access.

Calling every such driver a rootkit blurs an important distinction. Rootkits use privileged access to hide unauthorized activity; a disclosed anti-cheat driver uses privileged access for an installed game's enforcement. The fair concern is that both occupy a sensitive trust boundary. Valve Anti-Cheat (VAC), nProtect GameGuard, and PunkBuster also appear in anti-cheat discussions, but product architecture varies, so the anti-cheat label alone does not tell you what starts in the kernel or when.

What the driver does once it is loaded

It gets told about system activity

A driver does not need to poll every Windows process blindly. It can register callbacks that ask the kernel to notify it when specific events occur. PsSetCreateProcessNotifyRoutineEx reports process creation, PsSetLoadImageNotifyRoutine reports executable-image and module loads, and CmRegisterCallbackEx exposes registry operations. A filesystem minifilter can give the same event-driven visibility into relevant file activity.

Those notifications create a timeline: which process started, which DLL or driver appeared, what touched a protected registry area, and which file operation followed. The anti-cheat can compare that timeline with integrity checks and memory scanning around the protected game. It can also identify hooks that redirect a function away from its expected code. None of this requires the driver to read every byte on your PC continuously.

The distinction matters because a callback is an observation point, not a verdict. A new process or module load can be legitimate, so an engine can correlate its signer, origin, access pattern, and effect on the game before taking action. Kernel placement improves the quality and ordering of those observations. The publisher's rules still decide what the evidence means.

It can stop another process touching the game

ObRegisterCallbacks lets a driver inspect attempts to open handles to protected processes. It can strip permissions from the requested handle before Windows returns it, which is why a debugger or memory editor may receive access denied even when your account has administrator rights. Administrator is a user-space permission boundary; it does not outrank a policy already enforced in kernel context.

It reads hardware below common user-mode hooks

The hardware consequence is easy to miss. A Ring 3 tool might hook GetSystemFirmwareTable or alter a WMI answer presented to another ordinary app. A kernel driver can request the underlying information without passing through that user-mode interception point, so the substituted answer may never be seen. The companion breakdown shows exactly which serials it reads and how.

When the driver loads, and why timing matters

Windows driver services have start classes. A boot-start driver is loaded by the kernel during startup, before your desktop session and before an ordinary user-space process exists. A demand-start driver is loaded when its service is requested, often as the protected game launches. Both can run at Ring 0; the difference is who arrived first.

Riot Vanguard's boot-start driver, vgk.sys, is the familiar early-loading case. It typically becomes resident during boot, though Riot also provides an on-demand mode for eligible Windows 11 systems. EasyAntiCheat.sys and BEDaisy.sys are normally started with games protected by EAC and BattlEye rather than being treated as universal boot-start drivers.

This timing changes the practical contest. A tool that tries to alter an identity response after a boot-start driver is resident is working above something that started earlier and can obtain the same data from kernel context. A one-time rewrite completed while the anti-cheat is not running avoids that live race because the stored values are already different when the driver next reads them. A per-session interceptor must win the race again after every reboot.

Seeing a driver file on disk does not prove that its code is currently executing. The active service state and start class matter. That is why two Ring 0 products can feel completely different on the same PC: one has visibility from startup, while the other begins its observation window only when a protected title requests the service.

Which anti-cheats run at Ring 0 in 2026

The list mixes middleware with publisher-owned systems. Easy Anti-Cheat and BattlEye are licensed across many publishers, while Vanguard, RICOCHET, and EA AntiCheat serve narrower catalogues. The table is a load-timing and scope reference, not a ranking of detection strength.

For the wider roster, see which games each engine covers. If you need architecture and scope side by side, use the separate guide to how the major engines compare.

What kernel access reveals about your hardware

A useful device fingerprint is a bundle, not one magic HWID. It can include the SMBIOS/BIOS serial, motherboard UUID, the physical disk's firmware serial, a Windows disk and volume serial such as VolumeID, NIC MAC addresses, and RAM module serials. Software identity can add MachineGuid from HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid.

Modern checks can also consider the TPM 2.0 endorsement key, TPM state, Secure Boot state, and whether the boot chain matches the platform's claims. The TPM endorsement key is designed as a durable hardware-rooted identity, while Secure Boot reports whether trusted components controlled startup. They are different signals. The deeper guide explains why Secure Boot and TPM checks appeared on top of it.

Kernel access makes these reads harder for a user-space substitution layer to falsify. The engine can normalize several values, hash or otherwise transform them, and compare the resulting profile after an account changes or Windows is reinstalled. Missing or changed fields are signals too, so replacing one serial does not necessarily create a clean identity.

Middleware can collect the same categories of fingerprint across every title where it runs, creating cross-game exposure. Publishers still administer their own ban lists, so a ban in one EAC title does not automatically ban every EAC game. The practical risk is recognition or re-flagging when the same machine appears elsewhere, not a guaranteed portfolio-wide ban.

The real risks, without the fear

Any kernel driver expands the code trusted with the most sensitive part of Windows. A defect can cause a BSOD or conflict with another low-level security, virtualization, or hardware-control driver. A security flaw can also make a legitimately signed driver useful to an attacker; that class of abuse is called bring-your-own-vulnerable-driver, or BYOVD, and mhyprot2.sys is a widely discussed example.

The 2024 CrowdStrike outage was not an anti-cheat incident, but it demonstrated the general blast radius of faulty kernel software delivered at scale. Driver signing blocks unsigned code from taking the normal path into the kernel, and PatchGuard protects important kernel structures. Neither proves that signed code is bug-free.

Ring 0 is also not the bottom of the stack. A hypervisor can sit below a guest kernel at Ring -1, and a DMA-capable device on the PCIe bus can access memory without a normal CPU-mediated read. That ceiling helps explain why publishers layered Secure Boot, TPM attestation, and IOMMU requirements over kernel monitoring. It is architectural context, not a bypass recipe.

Privacy concerns are reasonable because the driver can observe more than a Ring 3 scanner, and you must trust the vendor's collection and retention choices. The balancing fact is that major engines operate under sustained technical scrutiny and use Windows signing controls. "Kernel" should trigger informed caution, not an assumption that every driver is malicious.

What this means if you are already banned

Once a kernel anti-cheat has recorded a machine profile, changing an account or reinstalling the game does not change the identifiers underneath it. Reinstalling Windows can replace some software-level values, but it does not normally replace the motherboard UUID, SMBIOS serial, physical disk firmware serial, MAC address, or TPM identity as a complete set.

Your first decision is architectural: understand the difference between a one-time rewrite and a per-session tool. A session tool stays part of the launch path and must intercept reads again after a restart. A permanent rewrite changes the supported stored identifiers before the next anti-cheat read, with no need for a resident background process.

TraceX Spoofer follows the second model: rewrite those values once and delete the tool. TraceX is free, the rewrite is permanent, and no daemon or recurring session remains. That does not erase an account sanction or guarantee a publisher will accept a new account; it addresses the hardware values a driver can use to recognize the same PC.