[GH-ISSUE #885] Apparently a vulnerability. #771

New issue

Closed

opened 2026-02-26 00:33:32 +03:00 by kerem · 3 comments

kerem commented

2026-02-26 00:33:32 +03:00

Owner

Originally created by @thederp on GitHub (May 6, 2020).
Original GitHub issue: https://github.com/hirschmann/nbfc/issues/885

Valorant's Riot Vanguard is apparently blocking this application probably because of this vulnerability.
https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=WinRing0&search_type=all

This is a message from Valorant's reddit moderators:
"Vanguard will automatically disable certain software that has known exploits used by hackers to cheat. Quite a few popular software packages used for overclocking, fan control, RGB lighting, and more are vulnerable to these exploits. Usually, either uninstalling or updating these software packages is enough."

Originally created by @thederp on GitHub (May 6, 2020). Original GitHub issue: https://github.com/hirschmann/nbfc/issues/885 Valorant's Riot Vanguard is apparently blocking this application probably because of this vulnerability. https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=WinRing0&search_type=all This is a message from Valorant's reddit moderators: "Vanguard will automatically disable certain software that has known exploits used by hackers to cheat. Quite a few popular software packages used for overclocking, fan control, RGB lighting, and more are vulnerable to these exploits. Usually, either uninstalling or updating these software packages is enough."

kerem closed this issue

2026-02-26 00:33:32 +03:00

kerem commented

2026-02-26 00:33:33 +03:00

Author

Owner

@hirschmann commented on GitHub (May 6, 2020):

While the WinRing0 driver allows unrestricted access to the CPU's model specific registers (MSR), the OpenHardwareMonitorLib plugin which NBFC uses to access the hardware on Windows machines restricts access to the driver to builtin administrators and the SYSTEM user (see KernelDriver.cs)
This means the exploits you've posted require at least the privileges of the builtin admin account if the driver was installed by NBFC/OpenHardwareMonitorLib which makes them effectively useless.

I understand that this doesn't prevent someone from manipulating their system, but I also think it's not possible to lock out users from their own systems anyway (if they have administrative permissions). Cheaters will always find a way to cheat.

That being said, it will probably not be possible to fix issues in the WinRing0 driver, because nowadays a kernel mode driver has to be signed with an Extended Validation Code Signing Certificate which afaik are only sold to companies, not to individual users.
(see Signing a Driver for Public Release)

Unfortunately I have no solution or workaround for this problem.
I know it sucks, but unless Riot changes their anti cheat system NBFC will not run on systems where Vanguard is active :(

@hirschmann commented on GitHub (May 6, 2020): While the WinRing0 driver allows unrestricted access to the CPU's model specific registers (MSR), the OpenHardwareMonitorLib plugin which NBFC uses to access the hardware on Windows machines restricts access to the driver to builtin administrators and the SYSTEM user (see [KernelDriver.cs](https://github.com/hirschmann/nbfc/blob/master/Core/Plugins/OpenHardwareMonitor/Hardware/KernelDriver.cs#L72)) This means the exploits you've posted require at least the privileges of the builtin admin account if the driver was installed by NBFC/OpenHardwareMonitorLib which makes them effectively useless. I understand that this doesn't prevent someone from manipulating their system, but I also think it's not possible to lock out users from their own systems anyway (if they have administrative permissions). Cheaters will always find a way to cheat. That being said, it will probably not be possible to fix issues in the WinRing0 driver, because nowadays a kernel mode driver has to be signed with an Extended Validation Code Signing Certificate which afaik are only sold to companies, not to individual users. (see [Signing a Driver for Public Release](https://docs.microsoft.com/en-us/windows-hardware/drivers/develop/signing-a-driver-for-public-release)) Unfortunately I have no solution or workaround for this problem. I know it sucks, but unless Riot changes their anti cheat system NBFC will not run on systems where Vanguard is active :(

kerem commented

2026-02-26 00:33:33 +03:00

Author

Owner

@thederp commented on GitHub (May 9, 2020):

I just got an update from Riot's support and this was there message:

Hello Agent,

We wanted to follow-up on the issue you're experiencing with Vanguard when trying to play VALORANT. Our devs pushed out a new update today; with the newest patch of Vanguard, we have improved compatibility on many cheat-vulnerable drivers. Most previously blocked drivers should now have full functionality. Some specific drivers, used almost exclusively for tampering with the game, will cause the game not to start as explained here:

https://twitter.com/PlayVALORANT/status/1258493180510519296
To get the new version, you'll need to launch VALORANT and the patcher will update you. After that, a reboot (restarting your device, not shutting down and powering back on) will be required to get the full effect.

So, NBFC works fine now after restart, it will not block it at startup or login anymore. And it also continues to work without issue while Valorant is running. At least for now. So, thanks for taking the time to look into it and responding. Seems it's resolved now, so, I'll close this issue.
You may want to close this issue as well #884

@thederp commented on GitHub (May 9, 2020): I just got an update from Riot's support and this was there message: > Hello Agent, > > We wanted to follow-up on the issue you're experiencing with Vanguard when trying to play VALORANT. Our devs pushed out a new update today; with the newest patch of Vanguard, we have improved compatibility on many cheat-vulnerable drivers. Most previously blocked drivers should now have full functionality. Some specific drivers, used almost exclusively for tampering with the game, will cause the game not to start as explained here: > > https://twitter.com/PlayVALORANT/status/1258493180510519296 > To get the new version, you'll need to launch VALORANT and the patcher will update you. After that, a reboot (restarting your device, not shutting down and powering back on) will be required to get the full effect. So, NBFC works fine now after restart, it will not block it at startup or login anymore. And it also continues to work without issue while Valorant is running. At least for now. So, thanks for taking the time to look into it and responding. Seems it's resolved now, so, I'll close this issue. You may want to close this issue as well #884

kerem commented

2026-02-26 00:33:33 +03:00

Author

Owner

@hirschmann commented on GitHub (May 10, 2020):

Wow, I didn't expect that. I'm glad it works again now. Thanks for letting me know :)

@hirschmann commented on GitHub (May 10, 2020): Wow, I didn't expect that. I'm glad it works again now. Thanks for letting me know :)