Why is VAC the best anti-cheat?

On March 27, 2024, the game called Counter-Strike 2 officially turned six months old. Throughout this time, the company Valve has made thousands of apologies to the gameplay by fixing various bugs and deficiencies. However, besides the advantage of peeking, broken hitboxes, and much more, there is a problem that stands above all, but Valve seems to be ignoring it.

And the name of this problem is cheaters. There are so many of them now that even the cheaters themselves complain that getting banned in the game has become very difficult. And it doesn't matter if you're playing with a free cheat or a paid one, the chance of getting banned is super low. After all, right now VAC (Valve Anti-Cheat) simply doesn't work or Valve has given up on it. But maybe Valve is really very concerned about the cheater problem? Let's figure out together why VAC can be considered the best of its kind.

About the Ailing

At the moment, one might think that to remove all cheats from the game, it's enough to just give a couple of good slaps to the developer working on VAC. This is why communities start to rebel not against cheaters, but against Valve, who in their opinion, are not doing anything to combat this problem.

Can't you just make a program that will check the entire system and not let anything into the game, that's why Faceit managed to do it, but you didn't? Well, if a cheater has an extra hundred dollars, it will be practically impossible to ban them online. All because of this fee:

Rumors have been circulating that with the help of this gadget, players have already started winning major online tournaments. And there are good anti-cheats out there, such as Faceit AC or EASY AC. Although, essentially, they just legitimize cheaters by allowing them to play and win. But what about Valve? What if Valve not only creates iconic games, the best platforms for gamers, and much more but also understands cheats? But let's start from the very beginning, in order.

What kinds of cheats are there?

To understand what cheats VAC is supposed to ban, one needs to at least superficially understand what kinds of cheats exist and how they work. Generally speaking, cheats are divided into two types.

Inject cheats

The most common and cheapest are considered to be malicious software that is injected into the game using an injector and begins to affect the game itself, namely rewriting lines of code. To use such software, you only need to download the application, run it, and you're already playing better than s1mple. However, not for long, as VAC and other anti-cheats ban for this very quickly.

But such a cheat also has its advantages, so to speak. After all, because it affects the game code by altering it, the cheater is essentially provided with a huge range of possible manipulations. Hence the emergence of cheats like:

• Skinchanger
• Speedhack
• Shots through walls
• Respawn alterations 

And much more, all achievable by editing the game's code.

Internal & External 

Let's start with the fact that cheats built on this architecture are banned much less frequently than previous ones. But how do they work? This type of cheats neither alters the game's code nor attempts to interfere with it; it simply observes what is happening within the game at the code level. This makes it much more difficult to ban such software because there is no injection into the game process.

For example, your opponent is standing behind a wall; visually, you can't see them on your monitor, but their model is defined in the game's code. Moreover, the locations and actions of your opponents are always stored in your computer's RAM. And this cheat simply reads information from RAM and displays an image on your monitor based on the lines of code. That's how wallhacks work.

The solution to the problem may seem superficial, but what's the catch here?

It might seem that when we already know how 90% of cheats work, solving the problem should be easy. After all, all cheats are somehow executed on a PC, and all that's needed is to create a program that scans every file on the computer. Following this logic, Faceit developed an anti-cheat system that scans every computer at the driver level.

Such an anti-cheat is called "driver-based". It has such privileges in Windows that the computer doesn't always recognize whether you installed this program or it was there from the beginning. The essence is that any software attempting to infiltrate the game will be banned even before it reaches the drivers.

However, we know that despite Faceit AC running on the computer even before Windows itself and managing all the processes running on the computer, there are still cheaters on Faceit. But how is this possible?

It's all because we live in the 21st century, and many cheats operate beyond your PC. And now we smoothly transition to that very board, called the DMA card.

DMA card, what is it and what's it eaten with?

Initially, DMA cards were created for convenience, specifically for uninterrupted communication between two computers. This allowed for transferring gigabytes of data from one device to another at any time. The DMA card is inserted into the motherboard of the first PC and connected to the second one with a cable, providing you with your own personal data transmitter.

The difference between this card and a typical LAN connection is that the DMA card only has access to the computer's memory and doesn't interfere with the processor, meaning it practically doesn't strain the system. It's a very convenient tool and an ideal cheat. But how does it work?

And even the best anti-cheat systems in history, namely driver-based ones, cannot detect such software.

How do cheats work through a DMA card?

Here's a simple explanation: A DMA card is inserted into the first computer—it reads data from the RAM and sends it to the second computer, where a compiler is running, turning the code into an image. And there you have your Wallhack, which is impossible to detect online unless evidence is found while reviewing the demo.

It's important to note that a driver-based anti-cheat won't see the cheat itself, but it will detect the DMA card connected to your PC. However, what function it performs on the second monitor is unknown, so essentially, there's no reason to ban. Nevertheless, Faceit AC will ban for a DMA card, as it assumes that in 99% of cases, it's used for cheats.

It turns out that the suspect will receive a ban not for the presence of the cheat itself, but simply for the DMA card. This means that developers of cheats have thought about something to do with this card, and they have.

Cheating developers realized that they simply needed to change the firmware of the card, and then the AC wouldn't be able to understand what's connected to the PC—whether it's a hard drive, flash drive, or just a second keyboard or mouse. In that case, there would simply be no grounds for a ban.

The only chance of getting banned for such manipulations is if the firmware of this DMA card leaks onto the network, where it will be marked as a way to bypass anti-cheat systems. Consequently, all accounts that used a DMA card with such firmware will also get banned soon.

However, if you manage to obtain high-quality firmware or ask your programmer friend to write it for you, it will be practically impossible to catch you, which is why players who win various online tournaments take advantage of this.

Fuser - the final nail in the coffin for all anti-cheats

Having a wallhack image on the second monitor is cool but quite inconvenient. So cheaters use a so-called "Fuser," which merges the images from two monitors, allowing you to have the game on one monitor and the cheat on the other. And you'll see all of this on the first monitor.

Does VAC come to the rescue or what?

All these cheats using DMA cards and Fuser are impossible to detect, and they simply render all anti-cheats useless. In general, Faceit should disable its anti-cheat to avoid unnecessarily burdening the system for regular players. But what does VAC have to do with this?

What if Valve—the creators of games with the highest number of cheaters in gaming history—understand malicious software well and realize that traditional anti-cheat measures are no longer sufficient? Moreover, if VAC suddenly starts banning Inject, Internal, and External software aggressively, demand for DMA cards will skyrocket.

They will be flashed in every basement, as even a standard DMA card now costs just $50. After such developments, it will be game over for all online leagues and the like—there will be no chance left.

Currently, to play without cheaters, you have to go to Faceit, but if DMA cards enter circulation, Faceit will become just as polluted as Premier Mode. There will always be players who want to ruin the game for everyone with cheats, and until proper protection is in place, they will continue to do so on servers protected or not-so-protected by VAC.

"And where does the best anti-cheat come into play?" you might ask.

Since 2016, Valve has been working on VAC Net, namely a neural network that currently monitors the behavior of all players and learns from their actions. Of course, it's unclear why it took so long, but recently bans have started being issued for sudden mouse movements. For example, if you were to set your mouse to 16000 DPI and in-game sensitivity to 100, you wouldn't get banned.

However, the slightest sudden movement from software triggers a ban. What else is this if not AI? This is why you can now get banned for "suspicious movements." But nobody knows exactly how it works, just like Trust Factor.

But perhaps they work together. If the AI can't determine with 100% certainty whether a player is cheating or not, Trust Factor steps in and lowers your rating. Now you'll end up with similar cheaters. But if it was a mistake, you'll quickly be removed from there, as you won't be able to play there. But if your movements continue to be suspicious, then a ban is necessary.

All of this represents the best defense against cheaters in history. Moreover, you can add "Patrol" where real players will be able to decide who is cheating and who isn't.

Conclusion

It's hard to say exactly what Valve is currently doing to improve their anti-cheat system, but something is definitely being done, and perhaps by the end of the year, we will see that creation from Valve that will outshine Faceit and other third-party platforms. Good luck in your future matches!