The Engine Inside Riot Kernel Driver (vgk.sys)
Unlike user-mode anti-cheat software that runs with standard desktop permissions, Riot Vanguard operates as a Boot-Start Kernel Driver (vgk.sys) at Ring 0. This privileged position allows Vanguard to intercept operating system events before unauthorized third-party executables can interact with Valorant or League of Legends.
The Key Windows Kernel Callbacks Utilized by Vanguard
| Kernel Routine | Monitoring Function | Threat Neutralized |
|---|---|---|
PsSetCreateProcessNotifyRoutineEx | Monitors creation of any new executable process | Detects cheat loaders launching in background |
PsSetCreateThreadNotifyRoutine | Intercepts new thread creation across the OS | Detects remote thread injection (CreateRemoteThread) |
ObRegisterCallbacks | Filters open handle requests to game memory | Strips PROCESS_VM_READ and PROCESS_VM_WRITE permissions |
Why Signature-Based Cheats Fail Against Callback Filtering
Even if a cheat author completely rewrites the cheat binary to avoid static file hash signatures, the moment the cheat attempts to acquire an open memory handle to VALORANT-Win64-Shipping.exe, Vanguard kernel callbacks intercept the request and strip all memory access rights.
Review our deep dive on Vanguard HWID ban vs IP ban mechanics.
Audit your system network profile and test your connection security on our DCIPCHECK Pro security portal.