Issue with Valorant anti-cheat system Vanguard blocking process

[nyxmon]

Hi there,

I'm new to GitHub and I wanted to say I absolutely love what you've done with MSIRGB script which is infinite times better than the Mystic Light on my MSI Z370 PC PRO motherboard.

However, saying that I wanted to bring up a certain issue I've encountered after installing Valorant yesterday (if it hasn't been brought to your notice already).

As you can see, the Valorant anti-cheat system Vanguard (which works like a rootkit, I believe) is stopping the inpout x64.sys , essentially preventing the RGB on my motherboard from working. The official consensus from Valorant's team insists that the process might be vulnerable to exploits and hence the countermeasure. And there is no way to restore my RGB lighting without disabling or uninstalling Vanguard (which would render Valorant unplayable).

I'm curious to see if you can work out any fix for this via update? Or can at least give me some additional information from your perspective on the issue.

Thanks, and have a great day!

[nyxmon]

Hello? Please respond.

[khalidwaleed0]

I have the same problem too

[nyxmon]

Did you find any workaround?

[khalidwaleed0]

Did you find any workaround?

no

[ixjf]

I'm sorry about the delay.

I can understand why Vanguard would stop the driver from loading. You could build a version of inpoutx64 that includes some cheat. In this case, inpoutx64 is digitally signed and therefore you could not do this without enabling developer mode on your computer.

The only solution I can see for this is for the Vanguard team to make an exception for inpoutx64 by checking its digital signature (they can confirm it has not been altered and thus poses no threat). If you could forward this to them, they may be willing to work on it. Here is a GitHub link for the digitally-signed driver and its source code: https://github.com/ellysh/InpOut32.

[nyxmon]

Ah damn, that sure sounds icky on their side - blocking a signed driver for absoutely zero purposes. Anyway, I'll raise a ticket and let them know regarding the driver and hope for the best! Will keep you updated here.

[ixjf]

Anyone could have a driver signed, although it's expensive, so it's not completely crazy. But in this case, if they can compare the digital signature against the one on the GitHub link above, there should be no problem.

[nyxmon]

Hey,

So I did reach out to the Riot team by raising a ticket explaining what you advised me the other day, and well, here is the official response (pic attached).

Its kinda disappointing to say the least. But I guess there will be no workaround any time soon (unless one disables Vanguard and/or stops playing Valorant). Thanks for your support, regardless!

[ixjf]

Yes, it is. I'm not sure what vulnerabilities they're talking about. However, I can't think of anything right now that I can do on my end to work around this. The driver is essential to MSIRGB and I cannot alter it in any way.

Perhaps in July/August I can look into this further and try to communicate with Riot to see what can be done.

[nyxmon]

Beats me, honestly. And yeah no worries, I can't already thank you enough for the beautiful utility - I hope Riot fixes this soon. Cheers!

[ixjf]

Let me leave this open so I don't forget about it.

[PicoPlanetDev]

I brought up a similar ticket with Riot Games, heard the same things back. Meaning, I've recently been restricted to Mystic Light s opposed to MSIRGB but I'm still trying to find a solid fix.

[vFones]

Any update on work status? What component we should check? I'd like to contribute

[ixjf]

Hi. No, there isn't yet :( I'll see what I can do once my exams are over (February).

[vFones]

Don't worry, education first. Maybe you can tell what component we should check so in my free time I can experiment.

[ixjf]

There's really not much you can do. It's up to Riot to block or not block MSIRGB. The only way to work around this right now is to disable the anti cheat if you want to use MSIRGB.

I had planned to reach out to Riot to see what could be done, but I haven't yet.

[ixjf]

Unfortunately, there's nothing that I can do that doesn't look like a very suspicious workaround around either anti-cheat. I can't fix any of the vulnerabilities in the driver, either. Although the driver is open source, recompiling it requires a new digital signature, which costs a lot of money. And publishing my own unsigned driver doesn't work on the latest versions of Windows (unless the end user specifically allows running unsigned drivers, which makes your computer vulnerable to kernel-level hacks). So there's no good solution. I'm closing this issue and leaving it as is.

[PicoPlanetDev]

That is really unfortunate. Wish there was a better way. Thank you for working on this.

[azmannx]

Hi, OP here

So I found out sort of a workaround (purely by coincidence of course)

I was doing some AV related stuff which prompted me to check and enable memory integrity in Windows Security. Of course, I had resolve a bunch of useless outdated incompatible drivers in the process, but once I got around to finally enabling it - guess what, the rainbow breathing appeared right from the next reboot!

Those of you are facing the same problem, you can ->

1. Go to Settings
2. Search in "Windows Security" ; open the same
3. Go to Device Security
4. Click on Core isolation details
5. Enable Memory integrity

It will prompt you to reboot your system, but once you've done that you're good to go!

PS - Vanguard will still show the same error dialogue, but as of now it isn't blocking MSIRGB from functioning PPS - You need to have virtualization enabled on your BIOS and resolve any incompatible drivers for memory integrity to work

It worked for me, hope it works for you all too!