Open source anticheat for protecting your software against tampering and reverse engineering.
It uses serverside for detection logic, the clientside/driver just acts as a collector of the detection info.
The anti-cheat monitors both the operating system's kernel as well as the protected usermode processes to find any illegitimate code execution or tampering. The ways in which the anti-cheat does so are described below.
- Detects loaded user and kernel modules which are not digitally signed.
- Detects patches to non writable sections in loaded user and kernel modules.
- Detects kernel threads whose start address is outside of a valid module.
- Detects execution outside of a valid kernel or user module by interrupting CPU cores with a NMI (non maskable interrupt).
- Detects the usage of reserved MSRs (model specific registers), to detect a virtual machine environment.
- Blocks handles being opened with certain privileges (e.g. memory read or write permissions) using object callbacks. This does not report to server.
- Detects handles being opened past the object callback, and strips their permissions and reports to server.
- Detects emulated environments via DbgPrompt, DBGCTL MSR being unchanged after a write, various ntoskrnl and KUSER_SHARED_DATA fields indicating a debugger, calling ZwSystemDebugControl and expecting a 'debugger inactive' response.
This project has been placed under the GNU General Public License, if there are any specific enquiries regarding usage, please contact the founder of the project noahware.