corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a087d9-fe6b-72ba-8a5c-1e951d5eced3

How Kernel Anti-Cheats Work: A Deep Dive into Modern Game Protection

s4dbrd.github.io · published 22 February 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at s4dbrd.github.io Wayback capture
1blogs citing
First cited
21 Mar 2026
Most recent
21 Mar 2026
Rank this month
not ranked
Links from this post
71
Words captured
13,962

Cited by

Blog
In the post
Date
underkube.com
What Edu is reading this week (March 16 - 22, 2026) Read at the source ↗
21 Mar 2026

Links from this post

Link
Host
https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-readprocessmemory
learn.microsoft.com
https://ntdoc.m417z.com/ntreadvirtualmemory
ntdoc.m417z.com
https://learn.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-enumprocessmodules
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/ioapiset/nf-ioapiset-deviceiocontrol
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/irp-mj-device-control
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwcreatesection
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwmapviewofsection
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-zwloaddriver
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethread
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/battleye-architecture.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-obregistercallbacks
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_ob_pre_operation_information
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/obcallback-demo.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetcreateprocessnotifyroutineex
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-_ps_create_notify_info
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetcreateprocessnotifyroutine
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetcreatethreadnotifyroutine
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-pslookupthreadbythreadid
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-obdereferenceobject
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetloadimagenotifyroutine
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-_image_info
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-cmregistercallbackex
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nf-fltkernel-fltgetfilenameinformation
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nf-fltkernel-fltreleasefilenameinformation
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-writeprocessmemory
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-kestackattachprocess
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-keunstackdetachprocess
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntimage/nf-ntimage-rtlimagentheader
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-zwqueryvirtualmemory
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-memory_basic_information
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/vad-injected-rwx-region.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-queueuserapc
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_kapc
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/reflective-dll-setup.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/reflective-dll-vad-legit.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/reflective-dll-injected-pe.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/reflective-dll-peb-modules.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-rtlwalkframechain
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/winnt/nf-winnt-rtlcapturestackbacktrace
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntimage/nf-ntimage-rtlimagedirectoryentrytodata
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/inline-hook-setup.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/inline-hook-before.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/inline-hook-after.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-_image_info_ex
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-mmmapiospace
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/piddb-binja-compare.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/piddb-avl-table.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/piddb-balanced-links.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/piddb-cache-entries.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntqueryinformationprocess
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-kuser_shared_data
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/hidethread-setup.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/hidethread-before.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/hidethread-after.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-context
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-kegetcontextthread
learn.microsoft.com
https://s4dbrd.github.io/assets/img/posts/dma-cheat-architecture.png
s4dbrd.github.io
https://s4dbrd.github.io/assets/img/posts/mouse-trajectory-comparison.png
s4dbrd.github.io
https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntquerysysteminformation
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddstor/ni-ntddstor-ioctl_storage_query_property
learn.microsoft.com
https://secret.club/2020/04/08/eac_integrity_check_bypass.html
secret.club
https://tomchothia.gitlab.io/Papers/AntiCheat2024.pdf
tomchothia.gitlab.io
https://arxiv.org/pdf/2408.00500
arxiv.org
https://arxiv.org/html/2508.06348v1
arxiv.org
https://secret.club/2019/02/10/battleye-anticheat.html
secret.club
https://back.engineering/blog/2020/08/22/
back.engineering
https://github.com/Aki2k/BEDaisy
github.com
https://archie-osu.github.io/2025/04/11/vanguard-research.html
archie-osu.github.io
https://gist.github.com/rhaym-tech/f636b76deeca15528e70304b5ee95980
gist.github.com
https://github.com/donnaskiez/ac
github.com