Re: RGB Peripherals Are A Red Line For Windows Anti-Cheat Software Now

Lawrence D’Oliveiro <[email protected]> wrote:
> Yet again, another monthly update for Microsoft Windows is causing
> machines to crash
> <https://www.tomshardware.com/software/windows/microsoft-blames-rgb-peripherals-for-crashing-windows-11-rgb-software-is-causing-blue-screens-crashes-and-game-freezes>.
> 
> This time, Microsoft is blaming an interaction between the drivers for
> RGB peripherals (the ones with colourful LEDs that can be made to
> cycle in different patterns) and anti-cheat mechanisms built into some
> of the more expensive games.
> 
> Quote:
> 
>     RGB software installed on affected PCs was interfering with core
>     system components, causing Windows 11 to become unstable.
> 
> Actually, no it wasn’t. The article goes on to make an educated guess:

Actually it was:
https://windowsforum.com/windows-news.4/kb5121003-remove-inpoutx64-to-fix-arc-raiders-crashes-megathread.442938/

inpoutx64.sys is an _ancient_ driver that allows userspace to poke any
hardware.  Of course that blows through lots of security barriers.  RGB
software uses it to poke their hardware registers from userspace, because
they were too lazy to write a proper kernel driver and get it signed by MS
so they just reuse this already-signed debugging driver from 2008.

In fact we've been here before:
https://www.theverge.com/report/629259/winring0-windows-defender-fan-control-pc-monitoring-alert-quarantine
https://gitlab.com/CalcProgrammer1/OpenRGB/-/merge_requests/1036
https://github.com/ixjf/MSIRGB/issues/115

First they used InpOut32 but it was blocked by anti-cheat, then it was
WinRing0 and now it's InpOutx64.  History keeps repeating.

Theo