Class DebuggerDetector

Detects whether a user mode or kernel mode debugger is attached to the running game.

Inheritance

System.Object

ADetector

DebuggerDetector

Implements

IDetector

Inherited Members

ADetector.IsActive

ADetector.Subscribe(IObserver<IDetectorStatus>)

ADetector.Notify(IDetectorStatus)

ADetector.Dispose()

ADetector.Awake()

Namespace: GUPS.AntiCheat.Detector.Desktop

Assembly: cs.temp.dll.dll

Syntax

public class DebuggerDetector : ADetector

Remarks

Each scan queries System.Diagnostics.Debugger.IsAttached for managed debuggers (Visual Studio, Rider, dnSpy), for native user mode debuggers (x64dbg, OllyDbg, ptrace on Linux/macOS) and for kernel mode debuggers (WinDbg in kernel mode, Syser, SoftICE on Windows).

User mode and kernel mode evidence carry separate threat ratings because a kernel debugger on a player machine is far more suspicious than a managed debugger attached during development.

Fields

CheckOnlyOnGameStart

Run the debugger check only once on game start. Disable to also run a periodic recheck.

Declaration

public bool CheckOnlyOnGameStart

Field Value

Type	Description
System.Boolean

OnCheatingDetectionEvent

Unity event raised on every detection. Useful to wire up reactions through the inspector without writing an .

Declaration

public CheatingDetectionEvent<DesktopCheatingDetectionStatus> OnCheatingDetectionEvent

Field Value

Type	Description
CheatingDetectionEvent<DesktopCheatingDetectionStatus>

RecheckIntervalForPossibleCheating

Interval in seconds between debugger checks. Lower than the mod loader interval because attaching a debugger mid-game is a common workflow.

Declaration

public float RecheckIntervalForPossibleCheating

Field Value

Type	Description
System.Single

Properties

IsSupported

Gets a value indicating whether the detector is supported on the current platform.

Declaration

public override bool IsSupported { get; }

Property Value

Type	Description
System.Boolean

Overrides

ADetector.IsSupported

Name

Gets the human-readable name of the detector.

Declaration

public override String Name { get; }

Property Value

Type	Description
String

Overrides

ADetector.Name

PossibleCheatingDetected

Gets a value indicating whether the detector has observed possible cheating activity.

Declaration

public override bool PossibleCheatingDetected { get; protected set; }

Property Value

Type	Description
System.Boolean

Overrides

ADetector.PossibleCheatingDetected

ThreatRating

Gets the larger of the user mode and kernel mode threat ratings, satisfying the ADetector contract.

Declaration

public override uint ThreatRating { get; protected set; }

Property Value

Type	Description
System.UInt32

Overrides

ADetector.ThreatRating

Methods

ManualScan()

Performs all enabled checks once and notifies observers if any evidence is found.

Declaration

public bool ManualScan()

Returns

Type	Description
System.Boolean	true if any evidence of a debugger was found; otherwise false.

OnCompleted()

Called when an observed subject signals completion.

Declaration

public override void OnCompleted()

Overrides

ADetector.OnCompleted()

OnError(Exception)

Called when an observed subject reports an error.

Declaration

public override void OnError(Exception _Error)

Parameters

Type	Name	Description
Exception	_Error	The error reported by the observed subject.

Overrides

ADetector.OnError(Exception)

OnNext(IWatchedSubject)

Called when an observed subject publishes a new status.

Declaration

public override void OnNext(IWatchedSubject _Subject)

Parameters

Type	Name	Description
IWatchedSubject	_Subject	The status published by the observed subject.

Overrides

ADetector.OnNext(IWatchedSubject)

Start()

Caches the platform probe, runs the first scan and starts the periodic recheck loop.

Declaration

protected virtual void Start()

Implements

IDetector

See Also

AntiCheatMonitor