Anti-cheat Software Runs Amok Causing System Crashes in Windows 10 Insider Previews

crazyeyesreaper · Feb 28, 2019

In what is likely to cause some hand wringing or chuckles depending on upon your personality, Microsoft's Windows 10 Insider Preview Slow Ring (beta versions of the OS) has not seen a new release in months. This is due to a common Anti-cheat software running amok and causing GSODs (replacement for BSODs in preview builds). The problem itself has existed for a few months and needs to be fixed by the creators of the software as noted by Chief of the Windows Insider program, Dona Sarkar, on twitter. Apparently, this isn't something Microsoft can fix due to how the software itself functions. Essentially the unspecified anti-cheat software runs in kernel mode and tampers with various aspects of the OS that it is not supposed to tamper with. While it is possible, the software is using allowed hooks in order to function. It is also possible that in the process it is damaging kernel data structures and code. This situation is likely to stir up debate on how effective anti-cheat software is considering it seldom seems to stop determined cheaters and as of now is causing the OS crash and is proving to be a thorn in Microsoft's side.

Still, this has more ramifications than just some system crashes or a software company that needs to edit some code. It directly results in Microsoft having to delay Preview releases. Since these Slow Ring builds can't be tested or validated. Pair that with the fact Microsoft's testing of Windows 10 builds is already considered lackluster with many bugs and issues going unresolved and you end up with a rather grim situation. After all, it was only a few short months ago that the October 2018 update was released after suffering numerous problems and delays. If issues like that continue, it seems the April 2019 update could be delayed as well. To avoid this and to get something done, Microsoft will be pushing out a Slow Ring build to systems that do not have the offending anti-cheat software. Better late than never but you would have thought that this solution would have been implemented sooner.

View at TechPowerUp Main Site

Ferrum Master · Feb 28, 2019

Prff... it is news? It has been like that since DECEMBER?...

Anticheat has gone overbroad imho... it has no connection or responsibility from microsoft...

bug · Feb 28, 2019

I would like to take this opportunity to thank all sites that review games for sweeping DRM under the rug :wtf:

FreedomEclipse · Feb 28, 2019

Ferrum Master said:
Prff... it is news? It has been like that since DECEMBER?...

Anticheat has gone overbroad imho... it has no connection or responsibility from microsoft...

well, rather it goes overbroad then abroad. keke

I digress... Microsoft..

windwhirl · Feb 28, 2019

bug said:
I would like to take this opportunity to thank all sites that review games for sweeping DRM under the rug

I thought anti-cheat was unrelated to DRM...?

If it was up to me, this late in the game, I'd say who is the developer responsible for the anti-cheat software and screw everything else.

FreedomEclipse · Feb 28, 2019

windwhirl said:
I thought anti-cheat was unrelated to DRM...?

If it was up to me, this late in the game, I'd say who is the developer responsible for the anti-cheat software and screw everything else.

I think its to do with with Microsoft allowing Xbox games to be run on PC. Its all baby steps. baby steps without hand holding of a QA department.

R-T-B · Feb 28, 2019

Ferrum Master said:
Anticheat has gone overbroad imho... it has no connection or responsibility from microsoft...

Are you sure about that?

Say hello to Windows 10 TruePlay:

Granted, being they wrote the kernel, they are probably the only ones who can really do this right. I'm still skeptical that they will, sadly.

Ferrum Master · Feb 28, 2019

R-T-B said:
Are you sure about that?

Say hello to Windows 10 TruePlay:

View attachment 117603

Granted, being they wrote the kernel, they are probably the only ones who can really do this right. I'm still skeptical that they will, sadly.

It is battleye and actually only it... other ones were fine. So PUBG and Rainbow 6...

If an app goes rogue and starts to mess in memory registers where it should not? It has to be compatible with the kernel, but they are the lazy bums, it has been months and they didn't fix it and ignored. It was reported in the hub.

AND most importantly... if that shit code could even work against cheaters...

also mate... insider builds doesn't have true play. yet it didn't change the behavior. You are blaming the wrong party.

OSdevr · Feb 28, 2019

If it has to run in kernel mode it MUST be well written! Microsoft has gone to great lengths to move as many things into user mode as possible for this very reason.

bug · Feb 28, 2019

windwhirl said:
I thought anti-cheat was unrelated to DRM...?

If it was up to me, this late in the game, I'd say who is the developer responsible for the anti-cheat software and screw everything else.

Technically, they're both rootkits

eidairaman1 · Mar 1, 2019

How about wringing the nose or a hurtzdonut

OC-Ghost · Mar 1, 2019

Why not do it like with the first few feature updates, just remove programs that are not compatible /sarcasm

R-T-B · Mar 1, 2019

Ferrum Master said:
You are blaming the wrong party.

No, because I'm not blaming anyone. I'm only pointing out Microsoft is an anticheat industry player, not that anything is or isn't their fault.

If you need blame, battleeye does indeed suck.

Ferrum Master said:
insider builds doesn't have true play.

More like it's just on by default as a kernel feature now. It was only togglable in early builds nearly a year old.

trparky · Mar 1, 2019

OSdevr said:
If it has to run in kernel mode it MUST be well written! Microsoft has gone to great lengths to move as many things into user mode as possible for this very reason.

Yes, because usually if you screw up in kernel land things can go really wrong really quickly. It's not like in user land where you can say... "Something went wrong, please restart the application." In kernel land, when things go wrong it's usually catastrophic and immediately ends up blue (or green) screening the PC.

bug · Mar 2, 2019

trparky said:
Yes, because usually if you screw up in kernel land things can go really wrong really quickly. It's not like in user land where you can say... "Something went wrong, please restart the application." In kernel land, when things go wrong it's usually catastrophic and immediately ends up blue (or green) screening the PC.

Yes, but WHQL is meant precisely to ensure drivers behave. I understand no screening/validation is perfect, but a problem that goes unsolved for months is cause for concern in my book.

Ferrum Master · Mar 2, 2019

R-T-B said:
No, because I'm not blaming anyone. I'm only pointing out Microsoft is an anticheat industry player

Gosh Frog... it is the overall toxicity towards Microsoft, for no reason, just because. Yet someone could ever properly contribute instead of whine. The whole handling of the idea testing a beta product on slow ring is to trigger bugs, the more the better.

Basically... if AMD or Nvidia driver causes gsod in a specific game, then it is their fault, okay, everyone and their dog understands it. If not then it is Microsoft's fault? Also the article is about beta unfinished product, thirds, why certain game creators do not suffer it, and for the matter switch to another anticheat group, that ships side by side inside the game, for example like Fortnite. When someone uses their head, it saves a lot of problems, ain't it? Yet someone has to make a yellow press article from it, without any experience using the insider builds at all. There cannot be any WHQL by now anyways, there is no gold code shipped. So basically Microsoft has no rights to alter their kernel code during development phase, and if it causes to break some specific code it becomes an issue? That's the whole point of this news?

From where did you pull out that TruePlay is a kernel feature now? It is actually a xbgmsvc service, as usually you have many ways of enabling windows features on or off... in current builds such service is not present at all and is omitted. Also... what it has to do with this particular issue is beyond me. They have xbox right? They really know how to protect their ecosystem for years... sky is blue also btw...

lemonadesoda · Mar 2, 2019

I dont like that the kernel is being compromised for the sake of anti-cheat software. A better solution is for tru-play to force a locked virtualised signed environment that can only crash the game VM not bring down the whole OS.

Seriously, back to the drawing board. Find another way.

bug · Mar 2, 2019

lemonadesoda said:
I dont like that the kernel is being compromised for the sake of anti-cheat software. A better solution is for tru-play to force a locked virtualised signed environment that can only crash the game VM not bring down the whole OS.

Seriously, back to the drawing board. Find another way.

The kernel isn't compromised in any way. That is just the nature of software that runs at the kernel level: it can take the kernel down when it breaks.
The only peculiarity here is Microsoft (and presumably the makers of said anti-cheat) being unable to figure this out for months and being unable to come up with a workaround in the meantime.

trparky · Mar 2, 2019

This is the danger of working with undocumented APIs.

lexluthermiester · Mar 2, 2019

WTAH, Microsoft? And you wonder why people don't want to adopt Windows 10? Monkey's diddling a football...

Yet another reason not to allow Microsoft to meddle in PC gaming. Multiplayer anti-cheat code needs to run local to the game itself, server side, NOT in the OS kernel. Luckily, I remove all of the files related to the XBox service and then delete the Xbox services themselves.

FreedomEclipse · Mar 2, 2019

Ferrum Master said:
Prff... it is news? It has been like that since DECEMBER?...

Anticheat has gone overbroad imho... it has no connection or responsibility from microsoft...

FreedomEclipse said:
well, rather it goes overbroad then abroad. keke

I digress... Microsoft..

Also - since we're heading in the same direction. Sooner or later we'll need anti-cheat for the anti-cheat to prevent the anti-cheat from being cheated <AsthamticCoughingFit> D E N U V O

Being online wont be enough.

lexluthermiester · Mar 2, 2019

FreedomEclipse said:
Also - since we're heading in the same direction. Sooner or later we'll need anti-cheat for the anti-cheat to prevent the anti-cheat from being cheated <AsthamticCoughingFit> D E N U V O

Being online wont be enough.

I have a solution for that. Can you guess what it is?

FreedomEclipse · Mar 2, 2019

lexluthermiester said:
I have a solution for that. Can you guess what it is?

Not installing trashware?

lexluthermiester · Mar 2, 2019

FreedomEclipse said:
Not installing trashware?

That and not playing online. Buying only DRM free games generally helps too.

FreedomEclipse · Mar 2, 2019

lexluthermiester said:
That and not playing online. Buying only DRM free games generally helps too.

Not easy since most triple ay titles comes with DRM and GoG is having a hard time financially. Steam is technically still DRM. though they used to allow a lot of games to be run in offline mode. these days not so much. Theyve even stopped L4D from being run in offline mode but that was a while ago when i attempted it.

System Name	Old reliable
Processor	Intel 8700K @ 4.8 GHz
Motherboard	MSI Z370 Gaming Pro Carbon AC
Cooling	Custom Water
Memory	32 GB Crucial Ballistix 3666 MHz
Video Card(s)	MSI RTX 3080 10GB Suprim X
Storage	3x SSDs 2x HDDs
Display(s)	ASUS VG27AQL1A x2 2560x1440 8bit IPS
Case	Thermaltake Core P3 TG
Audio Device(s)	Samson Meteor Mic / Generic 2.1 / KRK KNS 6400 headset
Power Supply	Zalman EBT-1000
Mouse	Mionix NAOS 7000
Keyboard	Mionix

System Name	HELLSTAR
Processor	AMD RYZEN 9 5950X
Motherboard	ASUS Strix X570-E
Cooling	2x 360 + 280 rads. 3x Gentle Typhoons, 3x Phanteks T30, 2x TT T140 . EK-Quantum Momentum Monoblock.
Memory	4x8GB G.SKILL Trident Z RGB F4-4133C19D-16GTZR 14-16-12-30-44
Video Card(s)	Sapphire Pulse RX 7900XTX. Water block. Crossflashed.
Storage	Optane 900P[Fedora] + WD BLACK SN850X 4TB + 750 EVO 500GB + 1TB 980PRO+SN560 1TB(W11)
Display(s)	Philips PHL BDM3270 + Acer XV242Y
Case	Lian Li O11 Dynamic EVO
Audio Device(s)	SMSL RAW-MDA1 DAC
Power Supply	Fractal Design Newton R3 1000W
Mouse	Razer Basilisk
Keyboard	Razer BlackWidow V3 - Yellow Switch
Software	FEDORA 41

Processor	Intel i5-12600k
Motherboard	Asus H670 TUF
Cooling	Arctic Freezer 34
Memory	2x16GB DDR4 3600 G.Skill Ripjaws V
Video Card(s)	EVGA GTX 1060 SC
Storage	500GB Samsung 970 EVO, 500GB Samsung 850 EVO, 1TB Crucial MX300 and 2TB Crucial MX500
Display(s)	Dell U3219Q + HP ZR24w
Case	Raijintek Thetis
Audio Device(s)	Audioquest Dragonfly Red :D
Power Supply	Seasonic 620W M12
Mouse	Logitech G502 Proteus Core
Keyboard	G.Skill KM780R
Software	Arch Linux + Win10

System Name	WorkInProgress
Processor	AMD 7800X3D
Motherboard	MSI X670E GAMING PLUS
Cooling	Thermalright AM5 Contact Frame + Phantom Spirit 120SE
Memory	2x32GB G.Skill Trident Z5 NEO DDR5 6000 CL32-38-38-96
Video Card(s)	Asus Dual Radeon™ RX 6700 XT OC Edition
Storage	WD SN770 1TB (Boot)\|1x WD SN850X 8TB (Gaming) \| 2x2TB WD SN770\| 2x2TB+2x4TB Crucial BX500
Display(s)	LG GP850-B
Case	Corsair 760T (White) {1xCorsair ML120 Pro\|5xML140 Pro}
Audio Device(s)	Yamaha RX-V573\|Speakers: JBL Control One\|Auna 300-CN\|Wharfedale Diamond SW150
Power Supply	Seasonic Focus GX-850 80+ GOLD
Mouse	Logitech G502 X
Keyboard	Duckyshine Dead LED(s) III
Software	Windows 11 Home
Benchmark Scores	ლ(ಠ益ಠ)ლ

System Name	System V
Processor	AMD Ryzen 5 3600
Motherboard	Asus Prime X570-P
Cooling	Cooler Master Hyper 212 // a bunch of 120 mm Xigmatek 1500 RPM fans (2 ins, 3 outs)
Memory	2x8GB Ballistix Sport LT 3200 MHz (BLS8G4D32AESCK.M8FE) (CL16-18-18-36)
Video Card(s)	Gigabyte AORUS Radeon RX 580 8 GB
Storage	SHFS37A240G / DT01ACA200 / ST10000VN0008 / ST8000VN004 / SA400S37960G / SNV21000G / NM620 2TB
Display(s)	LG 22MP55 IPS Display
Case	NZXT Source 210
Audio Device(s)	Logitech G430 Headset
Power Supply	Corsair CX650M
Software	Whatever build of Windows 11 is being served in Canary channel at the time.
Benchmark Scores	Corona 1.3: 3120620 r/s Cinebench R20: 3355 FireStrike: 12490 TimeSpy: 4624

Anti-cheat Software Runs Amok Causing System Crashes in Windows 10 Insider Previews

crazyeyesreaper

Not a Moderator

Ferrum Master

bug

FreedomEclipse

~Technological Technocrat~

windwhirl

FreedomEclipse

~Technological Technocrat~

R-T-B

Ferrum Master

OSdevr

bug

eidairaman1

The Exiled Airman

OC-Ghost

R-T-B

trparky

bug

Ferrum Master

lemonadesoda

bug

trparky

lexluthermiester

FreedomEclipse

~Technological Technocrat~

lexluthermiester

FreedomEclipse

~Technological Technocrat~

lexluthermiester

FreedomEclipse

~Technological Technocrat~

System Name	Pioneer
Processor	Ryzen R9 9950X
Motherboard	GIGABYTE Aorus Elite X670 AX
Cooling	Noctua NH-D15 + A whole lotta Sunon and Corsair Maglev blower fans...
Memory	64GB (4x 16GB) G.Skill Flare X5 @ DDR5-6000 CL30
Video Card(s)	XFX RX 7900 XTX Speedster Merc 310
Storage	Intel 905p Optane 960GB boot, +2x Crucial P5 Plus 2TB PCIe 4.0 NVMe SSDs
Display(s)	55" LG 55" B9 OLED 4K Display
Case	Thermaltake Core X31
Audio Device(s)	TOSLINK->Schiit Modi MB->Asgard 2 DAC Amp->AKG Pro K712 Headphones or HDMI->B9 OLED
Power Supply	FSP Hydro Ti Pro 850W
Mouse	Logitech G305 Lightspeed Wireless
Keyboard	WASD Code v3 with Cherry Green keyswitches + PBT DS keycaps
Software	Gentoo Linux x64 / Windows 11 Enterprise IoT 2024

Processor	Threadripper 1950X
Motherboard	ASRock X399 Professional Gaming
Cooling	IceGiant ProSiphon Elite
Memory	48GB DDR4 2934MHz
Video Card(s)	MSI GTX 1080
Storage	4TB Crucial P3 Plus NVMe, 1TB Samsung 980 NVMe, 1TB Inland NVMe, 2TB Western Digital HDD
Display(s)	2x 4K60
Power Supply	Cooler Master Silent Pro M (1000W)
Mouse	Corsair Ironclaw Wireless
Keyboard	Corsair K70 MK.2
VR HMD	HTC Vive Pro
Software	Windows 10, QubesOS

System Name	PCGOD
Processor	AMD FX 8350@ 5.0GHz
Motherboard	Asus TUF 990FX Sabertooth R2 2901 Bios
Cooling	Scythe Ashura, 2×BitFenix 230mm Spectre Pro LED (Blue,Green), 2x BitFenix 140mm Spectre Pro LED
Memory	16 GB Gskill Ripjaws X 2133 (2400 OC, 10-10-12-20-20, 1T, 1.65V)
Video Card(s)	AMD Radeon 290 Sapphire Vapor-X
Storage	Samsung 840 Pro 256GB, WD Velociraptor 1TB
Display(s)	NEC Multisync LCD 1700V (Display Port Adapter)
Case	AeroCool Xpredator Evil Blue Edition
Audio Device(s)	Creative Labs Sound Blaster ZxR
Power Supply	Seasonic 1250 XM2 Series (XP3)
Mouse	Roccat Kone XTD
Keyboard	Roccat Ryos MK Pro
Software	Windows 7 Pro 64

Processor	Ryzen 1700 @3.8
Motherboard	Asus Crosshair 6 Hero
Cooling	Corsair H100i v1
Memory	16GB G.Skill F4-3200C14-8GFX
Video Card(s)	Asus R9 380 4GB
Storage	Samsung 840EVO 250GB, Crucial MX500 500GB, 2xWD Black 2T
Display(s)	Benq 24" 144Hz 1080p
Case	Antec P280
Power Supply	Corsair AXi 860
Mouse	Logitech G402
Keyboard	Logitech G110
Software	Win10 Pro

System Name	My Ryzen 7 7700X Super Computer
Processor	AMD Ryzen 7 7700X
Motherboard	Gigabyte B650 Aorus Elite AX
Cooling	DeepCool AK620 with Arctic Silver 5
Memory	2x16GB G.Skill Trident Z5 NEO DDR5 EXPO (CL30)
Video Card(s)	XFX AMD Radeon RX 7900 GRE
Storage	Samsung 980 EVO 1 TB NVMe SSD (System Drive), Samsung 970 EVO 500 GB NVMe SSD (Game Drive)
Display(s)	Acer Nitro XV272U (DisplayPort) and Acer Nitro XV270U (DisplayPort)
Case	Lian Li LANCOOL II MESH C
Audio Device(s)	On-Board Sound / Sony WH-XB910N Bluetooth Headphones
Power Supply	MSI A850GF
Mouse	Logitech M705
Keyboard	Steelseries
Software	Windows 11 Pro 64-bit
Benchmark Scores	https://valid.x86.fr/liwjs3

System Name	ICE-QUAD // ICE-CRUNCH
Processor	Q6600 // 2x Xeon 5472
Memory	2GB DDR // 8GB FB-DIMM
Video Card(s)	HD3850-AGP // FireGL 3400
Display(s)	2 x Samsung 204Ts = 3200x1200
Audio Device(s)	Audigy 2
Software	Windows Server 2003 R2 as a Workstation now migrated to W10 with regrets.