Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
How does one find out if a game uses KernelMode anti cheat or UserMode?
For example the Game Black Desert Online uses Xigncode.
If i google a bit about Xigncode i immediately find out that:
"Xigncode uses a driver called xhunter1.sys. to protect" -> KernelMode
What Tools and Steps are used by the people to determine this?
There is not a single Anti Cheat(AC) I am aware of that is kernel mode without using ObRegisterCallbacks to block access to the process. In fact a good number of the AC drivers I've looked at are nothing more than these callbacks and, sometimes, kernel pattern scans. Nearly every kernel mode AC will also have an IOCTL pipe that's pretty obvious (e.g \Device\AcName). No kernel AC is going to hide themselves, using a tool like Driver List should also be obvious. Many will also use DbgLog in DriverEntry which you can see with DebugView using kernel capture. They will also almost universally be signed with a certificate matching the AC name. I guess the best answer to this is just to use generic tools to look through loaded drivers, it's typically very obvious if an AC driver is loaded.
