0

How does one find out if a game uses KernelMode anti cheat or UserMode?

For example the Game Black Desert Online uses Xigncode.

If i google a bit about Xigncode i immediately find out that:

"Xigncode uses a driver called xhunter1.sys. to protect" -> KernelMode

What Tools and Steps are used by the people to determine this?

1 Answer 1

2

There is not a single Anti Cheat(AC) I am aware of that is kernel mode without using ObRegisterCallbacks to block access to the process. In fact a good number of the AC drivers I've looked at are nothing more than these callbacks and, sometimes, kernel pattern scans. Nearly every kernel mode AC will also have an IOCTL pipe that's pretty obvious (e.g \Device\AcName). No kernel AC is going to hide themselves, using a tool like Driver List should also be obvious. Many will also use DbgLog in DriverEntry which you can see with DebugView using kernel capture. They will also almost universally be signed with a certificate matching the AC name. I guess the best answer to this is just to use generic tools to look through loaded drivers, it's typically very obvious if an AC driver is loaded.

1
  • 1
    That "IOCTL pipe" is called a device object, by the way ;)
    – 0xC0000022L
    Dec 5, 2019 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.