

It’s an arms race, the arms just keep moving deeper into the stack system. Used to happen entirely in usermode, one process poking in and reading/writing memory of the game, so anti-cheat started keeping an eye out for malicious processes. Then at some point someone patched their kernel to cheat in a way the game couldn’t possibly detect from usermode, so someone made an anti-cheat that ran at the kernel level too.
Modern KLA is basically a fully fledged rootkit, living in your system from boot, doing absolutely anything they can to try and make sure nothing has been tampered with. Validating signatures on bins, hooking memory mappings, watching for anything that might try to read/write the kernel or game’s memory space unexpectedly.



You’ll be hoping for a while. This ain’t 2005 anymore.