News for hackers. Stuff that matters.
Re:Deobfuscation and Analysis of Ring-1.io by not_a9 on Wednesday February 11, 2026 @11:53PM (#46985024)
Always a treat to see these people’s articles. Game hacking is wild - though in this case, wouldn’t enforcement of Secure Boot do the trick?
Re:Deobfuscation and Analysis of Ring-1.io by mafriese on Thursday February 12, 2026 @02:01AM (#46985655)
From the conclusion

> Importantly, this work also highlights the defensive implications of such techniques. While Secure Boot and firmware integrity mechanisms would prevent this attack chain when correctly enforced, the explicit requirement for users to disable Secure Boot demonstrates how social and usability tradeoffs continue to undermine otherwise effective platform defenses.

Re:Deobfuscation and Analysis of Ring-1.io by Hikikomori on Thursday February 12, 2026 @06:16AM (#46987360)
Valorant and Battlefield 6 does require secure boot and they do not sell their cheat for those games. Though there are still cheats available for those games, in particular using DMA hardware.

You connect the DMA PCIe card to a laptop/pc with USB, then it can read any memory on the game PC and display a radar on the laptop screen. They even sell mouse and hdmi/dp mergers, these allow the laptop to show an ESP overlay over your game and aimbotting by sending mouse inputs.

Re:Deobfuscation and Analysis of Ring-1.io by not_a9 on Thursday February 12, 2026 @08:42AM (#46988729)
I am aware, but thank you. However, DMA seems to still be far from making your cheat invincible against anticheats.
Re:Deobfuscation and Analysis of Ring-1.io by hrimfaxi on Thursday February 12, 2026 @08:26AM (#46988566)
I got a refund for battlefield 6 after finding out it requires secure boot (the error was not helpful in figuring that out though).
Re:Deobfuscation and Analysis of Ring-1.io by arcfour on Thursday February 12, 2026 @12:50PM (#46992279)
There are a number of Microsoft-signed drivers that have vulnerabilities in them that can be exploited allowing kernel-level access (memory read/write primitives, etc.) - they would load fine under Secure Boot - and, indeed, malware already has exploited this before.

This does make cheating harder, and does make it a cat-and-mouse game where signatures are revoked and they move on to a new driver, but the fact of the matter is - there are a ton of drivers out there and some of them will always be vulnerable in some way. To this end, I think focusing on client-side anti-cheat at all is a lost cause.