Valve urges AMD users to disable the Anti-Lag+ feature, due to causing VAC bans.

[Sauron]

6 hours ago, hishnash said:

Its not always easy to whitelist DLL mutations without opening up a pathways for attackers.

Sure, that's kind of valve's problem though. If this is only happening wit VAC then I would assume other anti-cheat methods are not detecting a false positive here... not to mention AMD's tool is (as far as I know) game agnostic and not necessarily tied to online games, meaning you could just turn it off for games where it triggers the anti-cheat. This is really only an issue because Valve autobans you if it so much as suspects you're doing something fishy, which is the wrong approach imo. They should just lock you out of online play until the "issue" is resolved. DLLs could get corrupted and fail the VAC test without you doing anything at all and it seems unfair to just ban people immediately if that happens.

[LAwLz]

3 hours ago, leadeater said:

Anti Lag+ only. Also only Valve's anti cheat, no other is banning due to it so far in online competitive games.

There are a lot of reports from Apex players also being banned, and that game does not use VAC. 

 

https://community.amd.com/t5/drivers-software/false-bans-in-counter-strike-2-and-apex-legends-anti-lag/m-p/638264

 

https://answers.ea.com/t5/Technical-Issues/Account-Falsely-Banned/m-p/13066180#M178079

 

https://answers.ea.com/t5/Technical-Issues/Randomly-Banned-after-not-playing-for-months/m-p/13070216#M178150

[hishnash]

4 hours ago, Zodiark1593 said:

To avert wall-hacks, any information not visible to the player, would simply not be sent to the client. In this case, anything on the other side of an opaque wall is not going to be rendered, nor even exist client-side. 

to do that you need to more or less fully render the game server side, sure maybe you can leave some fancy shading to the client side but you still need to do the full geometry projection from the server side for each frame... and then send this to the client somehow in some form of mutli layer video and have the client do final compnositona and shading.. a bit like a deferred lihgint rendering engine were you split it with the client doing the final lighting stages but the server doing the first stage that builds up the buffers needed... the issue here is the amount of dat you send per pixel is 10x to 100x more than it would be if you just rendered it server side. 

[hishnash]

1 hour ago, Sauron said:

not to mention AMD's tool is (as far as I know) game agnostic and not necessarily tied to online games, meaning you could just turn it off for games where it triggers the anti-cheat.

I do not believe the game has any controle over AMDs solution, the AMD driver does the injection when you load the AMD DLLs, unlike other solutions there is no way for the game to turn this setting off or even tell AMDs driver to not turn it on. 

 

1 hour ago, Sauron said:

This is really only an issue because Valve autobans you if it so much as suspects you're doing something fishy, which is the wrong approach imo

The reason devs are aggressive with the banning is to make it much harder for attackers (cheaters) to sniff and disovore the edges of what will be detected.   If the cost of accidentally triggering the detection is that your kicked offline and all you need to do is re-start the game then it is easy to write a automated script that will try 1000s of differnt attack vectors at no cost, but if the cost of being detected is a ban then your more or less limited to 1 try so its much harder to find a way around the anti-cheat. 

 

1 hour ago, Sauron said:

They should just lock you out of online play until the "issue" is resolved. DLLs could get corrupted and fail the VAC test without you doing anything at all and it seems unfair to just ban people immediately if that happens.

On disk mutation is detected at launch and the game will just not start, and are not doing on disk mutation what stye are doing is mutating the DLL post load (just like cheaters do) if your DLL is corrupted on disk your not getting VAC banned, but if you go in and modify the executable memory region that is assign to the DLL once it is loaded then you are going to get VAC banned...  what AMD are doing looks exactly like what a cheat tool does, infact most cheating tools even use gpu drivers as the the attack vectors as they know games can't hard restrict GPU driver signatures due to users updating theses way to fast to keep up to date so games (on PC) will load drivers DLLs without fully checking the signatures always. You can inject your payload into the GPU driver DLL that the game loads and have that payload then jump just like AMDs attack vector into the games code by doing a DLL cache modification that sniffs the loaded excitable memory of the DLLs and applies a patch to them.   

Game devs would love it if modern x86 CPUs adopted the now common place restrictions on apple silicon were loaded executable memory is restricted to be read only (this is a HW MMU flag that even the kernel cant bypass) but modern AMD, and Intel cpus have not such restrictions so if your within a process (or using a debugger) you can modify loaded excitable memory pages as much as you like... 

[leadeater]

9 hours ago, LAwLz said:

There are a lot of reports from Apex players also being banned, and that game does not use VAC. 

 

https://community.amd.com/t5/drivers-software/false-bans-in-counter-strike-2-and-apex-legends-anti-lag/m-p/638264

 

https://answers.ea.com/t5/Technical-Issues/Account-Falsely-Banned/m-p/13066180#M178079

 

https://answers.ea.com/t5/Technical-Issues/Randomly-Banned-after-not-playing-for-months/m-p/13070216#M178150

Hard to really know, many cheaters will swear till the cows come home they weren't. So far only Valve and AMD have acknowledged it's affecting them and the rest likely aren't the best to believe. And to be fair I would have said the same about CS2 bans initially, critical mass does matter then followed by official acknowledgement, so far it's only CS2. 

 

Of course the other problem is not all anti cheat tools ban immediately and just collect information and then group ban, so yea could be a bunch of wave bans coming from this heh.

[leadeater]

8 hours ago, hishnash said:

I do not believe the game has any controle over AMDs solution, the AMD driver does the injection when you load the AMD DLLs, unlike other solutions there is no way for the game to turn this setting off or even tell AMDs driver to not turn it on. 

Actually a game can, ADLX API can be used to set GPU driver options, so this might start appearing in games to force these types of features off

 

https://gpuopen.com/manuals/adlx/adlx-cpp__anti_lag/ 

[Sauron]

12 hours ago, hishnash said:

The reason devs are aggressive with the banning is to make it much harder for attackers (cheaters) to sniff and disovore the edges of what will be detected.   If the cost of accidentally triggering the detection is that your kicked offline and all you need to do is re-start the game then it is easy to write a automated script that will try 1000s of differnt attack vectors at no cost, but if the cost of being detected is a ban then your more or less limited to 1 try so its much harder to find a way around the anti-cheat. 

Just make it lock you out for one or two days, no need for a permaban. Maybe that can come after repeat offences in a short time span.

12 hours ago, hishnash said:

On disk mutation is detected at launch and the game will just not start, and are not doing on disk mutation what stye are doing is mutating the DLL post load (just like cheaters do) if your DLL is corrupted on disk your not getting VAC banned, but if you go in and modify the executable memory region that is assign to the DLL once it is loaded then you are going to get VAC banned..

Even so, memory corruption is a thing

12 hours ago, hishnash said:

Game devs would love it if modern x86 CPUs adopted the now common place restrictions on apple silicon were loaded executable memory is restricted to be read only (this is a HW MMU flag that even the kernel cant bypass) but modern AMD, and Intel cpus have not such restrictions so if your within a process (or using a debugger) you can modify loaded excitable memory pages as much as you like... 

That has pros and cons, in this case for instance you're giving up performance for the sake of not triggering a false positive in a specific anti cheat system... and personally I'd rather it be up to me what I do with my memory, though of course that also opens you up to some forms of malicious attacks.

4 hours ago, leadeater said:

Actually a game can, ADLX API can be used to set GPU driver options, so this might start appearing in games to force these types of features off

 

https://gpuopen.com/manuals/adlx/adlx-cpp__anti_lag/ 

This seems like the best solution for everyone involved

[Kisai]

1 hour ago, Sauron said:

Just make it lock you out for one or two days, no need for a permaban. Maybe that can come after repeat offences in a short time span.

 

Nah

 

When this is caused by a bug, or by hardware failure, the person accused of cheating, should be able to appeal by reviewing the circumstances. Like if there was no consequences to a W/L ratio in a game, then it really should be "appealable". 

 

BUT.

 

If you just put a cooldown instead of a ban, users who attempt to find a way around because there is no penalty to it.  The thing I would even go so far as to say is that any kind of anti-cheat should be a one month ban, their fault or not. That will also make hardware manufacturers think twice about putting "technically it's a cheat" features into drivers and hardware and marketing based on it. (Less you forget that gaming monitors often come with "targeting crosshairs" features and gaming mice and keyboards can be macro programmed.)

 

League of Legends, Starcraft 2, Apex Legends and World of Warcraft have banned people for using programmable macro functions. Stories are anecdotal, so we don't know if it's just "ToS says No, company has generally not banned anyone that wasn't cheating, and cheaters get called out for being idiots."

 

Anyway, point being that Anti-cheat software by third parties is generally "too stupid" to stop someone who is intent on cheating, but will stop people from using memory-hacking tools like cheat engine and stuff to tamper with the GPU or the game memory to enable wall hacking or teleporting.

 

This Anti lag feature appears to trigger the same memory integrity monitoring in the anti-cheat.

 

[Sauron]

31 minutes ago, Kisai said:

That will also make hardware manufacturers think twice about putting "technically it's a cheat" features into drivers and hardware and marketing based on it. (Less you forget that gaming monitors often come with "targeting crosshairs" features and gaming mice and keyboards can be macro programmed.)

Are those even detectable by anti-cheat..? The crosshairs are usually drawn by the monitor on top of the image, it's the same as drawing it on with a marker. Macro functions are more obvious because there's a limit to human reaction times.

 

A one or two day timeout is more than enough to discourage brute force approaches and if you intentionally use macros to cheat you'll just run into a repeat offender ban.

51 minutes ago, Kisai said:

Anyway, point being that Anti-cheat software by third parties is generally "too stupid" to stop someone who is intent on cheating, but will stop people from using memory-hacking tools like cheat engine and stuff to tamper with the GPU or the game memory to enable wall hacking or teleporting.

Well again this kind of seems like a problem for Valve to address, and they should at least give people a warning if they can accidentally trigger their "stupid" system.

[leadeater]

1 hour ago, Kisai said:

When this is caused by a bug, or by hardware failure, the person accused of cheating, should be able to appeal by reviewing the circumstances. Like if there was no consequences to a W/L ratio in a game, then it really should be "appealable". 

Ban appeals and support from most games, especially free, doesn't exist. Having 'a form' and it actually be a worthwhile legitimate process are different things.

[LAwLz]

8 hours ago, leadeater said:

So far only Valve and AMD have acknowledged it's affecting them and the rest likely aren't the best to believe.

I think that's a very weird stance to take. To say that a bunch of people are lying and that we should only believe them if a company confirms what they are saying.

 

I personally will file this under "with this much smoke, there is probably a fire". Apex and Warzone are getting quite a lot of headlines and support threads about them right now. Maybe all those reports are from actual cheaters who are lying, but I think it sounds more plausible that it is an issue with Anti-Lag(+) and the anti-cheat systems.

 

 

Either way, Anti-Lag seems to need more testing before it's ready for prime time, and it is probably best to advise people to turn it off for a while as to not risk getting banned.

[Kisai]

2 hours ago, Sauron said:

Are those even detectable by anti-cheat..? The crosshairs are usually drawn by the monitor on top of the image, it's the same as drawing it on with a marker. Macro functions are more obvious because there's a limit to human reaction times.

There is a way to tell if you have a monitor with it, but not if it's turned on. Some monitors (eg Dell) can actually have their functionality controlled by the desktop if you install the application for it. Macro mice/keyboards/joysticks are hard to detect by circumstances. You can get the EDID for a screen or a the HID identifier for the mice/keyboards/joysticks and compare it to a database of devices that have "cheat capability" and just straight up tell the user that using X function of this device constitutes cheating, and (company name) has logged the fact you have this device. Basically highlighting the fact if they continue and "accidently" use that function, they have been warned it will result in a ban.

 

 

 

2 hours ago, Sauron said:

A one or two day timeout is more than enough to discourage brute force approaches and if you intentionally use macros to cheat you'll just run into a repeat offender ban.

 

Not when it's client-sided stuff. You underestimate a determined cheater's ability to talk to their script kiddie friends.

 

2 hours ago, Sauron said:

Well again this kind of seems like a problem for Valve to address, and they should at least give people a warning if they can accidentally trigger their "stupid" system.

 

My perspective of this is, since AMD is what, 30% of computer GPU's? If they don't address it promptly, it will make a lot of work for Valve and other game developers.

 

1 hour ago, leadeater said:

Ban appeals and support from most games, especially free, doesn't exist. Having 'a form' and it actually be a worthwhile legitimate process are different things.

Good games have support departments. Bad games outsource this to their fans to deal with.

 

For better or worse, game devs should not be dealing with "PEBKAC", which "user is cheater" is a PEBKAC problem.

 

Script kiddie cheaters complain on official support channels that they can't play the game because the anti-cheat breaks their toys, when the reality is they were just caught.

 

It's like when people complain on this forum about ads on youtube to the person who makes the videos on youtube. Do you think such people deserve sympathy? No. If someone's ability to cheat, steal or hack something is nerfed, maybe they should reconsider their priorities.

 

[porina]

7 minutes ago, Kisai said:

My perspective of this is, since AMD is what, 30% of computer GPU's? If they don't address it promptly, it will make a lot of work for Valve and other game developers.

Steam Hardware Survey for September 2023 says just under 15%. Maybe the mix is different if you include all systems but unless you're really looking to minimise your Outlook latency I don't think the average box user is going to care.

 

Expanding it a bit more for listed GPUs: (some may go unlisted if they do not make 0.15% share, and will probably get lumped into "others")

 

Others: 9.4%

 

All listed AMD: 10.1%, which includes:

RDNA3: 0.2% solely made up of 7900 XTX, lower models have yet to get enough share to show up as a listed item

RDNA2: 2.8%

RDNA1: 1.1%

Polaris: 2.5%

Vega: 1.1%

 

All listed Intel: 4.0%. Arc isn't big enough to get split out.

 

All listed NV: 73.5%, of which includes:

40: 6.7%

30: 28.9%

20: 9.1%

16: 12.0%

10: 12.7%

9: 1.6%

 

60.7% of NVIDIA GPUs listed are RTX models.

47.6% of all GPUs listed are RT capable (RDNA2+, NV RTX) - we're getting ever closer to the point where RT capable GPUs outnumber those who don't.

[leadeater]

31 minutes ago, Kisai said:

Good games have support departments. Bad games outsource this to their fans to deal with.

Apex is liked by a lot of people and considered good, EA support is garbage, who you have to deal with for bans in Apex.

[leadeater]

1 hour ago, LAwLz said:

To say that a bunch of people are lying

The report numbers not in CS2 in your linked threads did not seem like a lot, so many comments in it were about CS2. So yes a few people absolutely will try and use this CS2 issue as a way to appeal legitimate actual bans. I mean why not? And you'd also get support, from people like you, because it seems legit enough.

 

Lets just say your smoke to me is as much as comes off a single lit match, not a hell of a lot.

 

Also by now, if it were a problem AMD would have advised so, like they have for CS2. Confirmation absence does actually matter too. Lots of things matter, everything is always in context and situation but here we are talking about people that got banned and if it's legitimate have literally every reason in the world to lie about it and do.

 

Personally I find it weird to believe cheaters.

 

P.S. It's mostly one person complaining across multiple forum topics, so be weary of how many you actually think are complaining outside of CS2.

[wanderingfool2]

2 hours ago, leadeater said:

The report numbers not in CS2 in your linked threads did not seem like a lot, so many comments in it were about CS2. So yes a few people absolutely will try and use this CS2 issue as a way to appeal legitimate actual bans. I mean why not? And you'd also get support, from people like you, because it seems legit enough.

 

Lets just say your smoke to me is as much as comes off a single lit match, not a hell of a lot.

 

Also by now, if it were a problem AMD would have advised so, like they have for CS2. Confirmation absence does actually matter too. Lots of things matter, everything is always in context and situation but here we are talking about people that got banned and if it's legitimate have literally every reason in the world to lie about it and do.

 

Personally I find it weird to believe cheaters.

 

P.S. It's mostly one person complaining across multiple forum topics, so be weary of how many you actually think are complaining outside of CS2.

https://answers.ea.com/t5/Technical-Issues/What-to-do-if-your-account-got-banned-or-suspended-in-Apex/td-p/10027236

I think this sort of solidifies your point.  Prior to the AMD stuff, there already were enough people who were saying they got banned for cheating while they weren't.

 

3 hours ago, LAwLz said:

I personally will file this under "with this much smoke, there is probably a fire". Apex and Warzone are getting quite a lot of headlines and support threads about them right now. Maybe all those reports are from actual cheaters who are lying, but I think it sounds more plausible that it is an issue with Anti-Lag(+) and the anti-cheat systems.

Or people hear about it, so the people who are normally caught cheating have an excuse to make a thread claiming innocence.

 

There was a dev back in the day who, as an anti-piracy measure, made one level have a glitch with the floor if you pirated the game.  This was back when there was actually a technical support number on games.  As a result, they got a bunch of people who called in claiming their game was broken and then upon being told they pirated a game there would still be those who claimed they didn't pirate it.

 

People as a whole, especially cheaters, are opportunistic.

 

People also have a tendency to associate random events with things that happen.  As a hypothetical, if people are "wrongly" banned for cheating while they might still try appealing it; they won't necessarily be very vocal about it.  Have something like the AMD thing happen, and now you will have lots of people who just assume their ban was because of it; and you will have a lot more vocal people.

 

It's similar to telling people the food they ate was tainted; you will get a whole lot more people who report symptoms than before (even though they didn't eat the tainted food)

[agatong439]

 

[hishnash]

13 hours ago, Sauron said:

That has pros and cons, in this case for instance you're giving up performance for the sake of not triggering a false positive in a specific anti cheat system... and personally I'd rather it be up to me what I do with my memory, though of course that also opens you up to some forms of malicious attacks.

No there are no real modern JIT pipelines that requires RWX memory, JIT operations these days write out new instructions to new chunks of memory rather than self modify. And in this situations were are talking about memory pages that have been loaded from disk (not JIT) so should never be writable at all, there would be no perf impact for these memory pages to be strictly read execute.  

This does not have a perfomance hit, if anything it improves perf as your anti cheat doe does not need to constantly check the state of the data loaded into that region of memory, once its loaded its immutable so check it once and then you good. 

[williamcll]

Reminder that there has been cases where cheaters wiretap themselves to avoid detection since VAC can't see any computers between the client and server. 

[Forbidden Wafer]

For people that were wrongly blaming AMD, changing your mouse DPI settings could also get you VAC banned...

 

[Arika]

11 minutes ago, Forbidden Wafer said:

For people that were wrongly blaming AMD, changing your mouse DPI settings could also get you VAC banned...

 

Completely different situation... you can't use this to say that AMD is innocent for messing with dlls. Shill less hard please.

[Mark Kaine]

5 hours ago, Forbidden Wafer said:

For people that were wrongly blaming AMD, changing your mouse DPI settings could also get you VAC banned...

 

why don't people get how outdated tech this vac thing is already?  stockholm syndrome?  (well that seems likely ig)

 

like there are legitimate ok anti cheats... i will never understand how people can put up with this... I'll also *never* play a valve game for exactly that reason...

 

5 hours ago, Arika said:

Completely different situation... you can't use this to say that AMD is innocent for messing with dlls. Shill less hard please.

no, its the exactly *same* situation, vac sucks donkey balls.

 

ps: and as i already said,  "messing with a dll" should *never* get you banned, cheating should get you banned, so either prove there was a cheat or leave me alone, idc about cheats... 

 

[Forbidden Wafer]

6 minutes ago, Mark Kaine said:

ps: and as i already said,  "messing with a dll" should *never* get you banned, cheating should get you banned, so either prove there was a cheat or leave me alone, idc about cheats... 

 

Yup. Flying across the map, shooting across walls, faster than normal firing/walking, more weapons/ammo than possible... 

 

Its not like the server can't check for these on their side. It's crazy going around banning for absolutely nothing.