Guide Valorant — Vanguard SDK Heartbeat Spoofing & Offline Mode

[byte_corvus]

Anyone still sweating over Riot's kernel-level leash? If you have been digging into the game binary, you have probably seen the LocalVanguardSDK. This module is the bridge between the game and vgc, handling session creation, status checks, and the inevitable heartbeats that keep you from getting kicked.

While reversing the binary, I found that you can essentially run Valorant (and other Riot titles) without the actual Vanguard driver active by spoofing the IPC mechanism it relies on. This is huge for debugging API calls with tools like Fiddler or Charles, or for enabling offline modes in upcoming titles like 2XKO where Riot’s DRM logic is just unnecessary bloat for local play.

The Technical Core
The game uses standard Windows service control instrumentation to verify the vgc service. If it is missing or stopped, it throws those lovely error codes like -81 or -83. Once the service is "active," the game opens a named pipe for communication. Named pipes are far stealthier and faster for IPC than local socket servers, and Riot leans heavily on the pipe identified by the GUID 933823D3-C77B-4BAE-89D7-A92B567236BC.

Spoiler: Reversed SDK Logic

  v11 = OpenServiceW(v6, L"vgc", 0x14u);
  // ... service status checks ...
  while ( 1 )
  {
    v18 = (struct _Mtx_internal_imp_t *)(*(_QWORD *)(v5 + 48) + 8LL);
    Mtx_lock(v18);
    v20 = *(void ***)(v5 + 48);
    FileW = CreateFileW(L"\\\\.\\pipe\\933823D3-C77B-4BAE-89D7-A92B567236BC", 0xC0000000, 0, 0LL, 3u, 0, 0LL);
    // ... pipe communication and heartbeat logic ...
    *(_BYTE *)(v5 + 9) = 1;  // Sets \"Vanguard active\" flag internally
  }

How to Spoof the Connection
To trick the game into thinking Vanguard is healthy, you need to:

1. Spawn a zombie vgc.exe process.
2. Register it as a system service so OpenServiceW returns a valid handle.
3. Host a named pipe with the exact GUID prefix mentioned above.
4. Echo back the 3rd heartbeat message received from the game client.

You cant view this link please login.

You cant view this link please login.

Risks and Reality Check
I need to be crystal clear: This is NOT a Vanguard bypass for online matchmaking. The heartbeat exists for a reason beyond simple presence checks. If you try to queue for a Premier match or even a basic Unrated game, the server-side validation will fail. You will get hit with a VAL 5 ban (session error) or Error 2266 in League of Legends before the match even begins.

This method is purely for reversing, debugging game APIs without SSL pinning issues (if you use a mitm DLL), or playing games with confirmed offline modes like 2XKO without a kernel driver breathing down your neck. Do not run this on your main account if you value your skins.

Any of you guys managed to map the specific packet structures for the heartbeats yet?