Vanguard Host Trust Interactive Security Demonstrator

System Model

Interactive Security Demonstrator · simplified public components and privilege levels.

User
Mode

Riot / League Client

Game client and anti-cheat user components

vgc Service

Vanguard user-mode service

Privilege Boundary
Kernel
Mode

vgk Driver

Vanguard kernel-mode driver

Windows Kernel / System Resources

Protected OS components and hardware-backed controls

Simplified conceptual view. Arrows show a high-level trust and communication relationship, not a complete or independently verified data flow.

Posture Model

Manually combine the five public On-Demand groups. This page has not inspected a device.

Windows 11 25H2 or laterRequired for the documented runtime report.
Secure Boot (UEFI mode)Helps protect the boot chain.
TPM 2.0Hardware-backed measurement and key support.
VBS / HVCI (Memory Integrity)Strengthens kernel code-integrity enforcement.
IOMMU (DMA Protection)Restricts device access to system memory.

Checklist incomplete — 0 of 5 public groups confirmed.

No attributes are confirmed. This page has not inspected a device.

    Integrity Demonstrator

    Compare harmless local files with an in-memory SHA-256 baseline.

    1 Select File

    No file selected.

    2 SHA-256 Digest

    —

    3 Baseline

    No baseline set for this session.

    4 Compare

    Select a second file, then compare its bytes with the baseline.

    Result

    — No comparison yet.

    Role of the Demonstrator

    It is a supporting research artifact—not the project itself, a Vanguard audit, Pre-Check, or substitute for live Windows measurement.

    Make boundaries visible
    The diagram exposes where authority and failure impact change across user and kernel modes.
    Test a claim
    Deterministic samples make the difference between byte integrity and authenticity directly observable.
    Stay ethically bounded
    The demonstrator teaches the model without inspecting proprietary software, devices, accounts, memory, or traffic.
    Remain cross-platform
    Static web standards make the same exercise reproducible on macOS, Windows, and Linux.

    Evidence and Limitations

    Product statements, platform mechanisms, project inference, and demonstrator results stay separate.

    EvidenceUsed forImportant limitation
    Riot Security & Privacy Architecture (2020) Client, driver, and platform component model. Vendor description; private implementation details are not independently verified.
    Vanguard x LoL (2024) League threat context and the earlier boot-start trust model. Riot's own explanation, not an independent effectiveness study.
    Vanguard On-Demand (24 June 2026) Five public requirement groups and optional On-Demand operation. The checklist is a teaching summary, not the real Vanguard Pre-Check.
    Microsoft Runtime Attestation Report API OS-native driver attestation background. The API does not reveal Riot's private implementation.
    Microsoft User Mode and Kernel Mode Privilege separation and failure-impact background. Windows architecture documentation does not verify Vanguard's private implementation.
    NIST rootkit glossary Terminology used to avoid classifying software from privilege alone. A glossary definition is not a product assessment.
    No live observationThe public project performs no Windows or Vanguard measurement and makes no claim about a specific device.
    No security testingNo reverse engineering, bypass attempt, memory inspection, traffic interception, or modification of Vanguard files.
    No authenticity claimA matching SHA-256 digest only means the compared bytes match the selected baseline.