Tencent ACE VM Devirtualized: How Its CET‑Preserving Dispatch Lets Hackers Bypass Anti‑Cheat
Back Engineering Labs reverse‑engineered Tencent’s ACE anti‑cheat virtual machine, exposing a static devirtualization that translates its .tvm dispatcher while preserving CET shadow‑stack and SEH semantics. The analysis shows the VM’s boxed native instructions and RDSSPQ/INCSSPQ balancing are vulnerable to guided symbolic evaluation, making cheat‑bypass on Linux/Proton feasible.