Enum EDesktopCheatingType

Kinds of cheating that can be reported by the desktop detectors (Windows, macOS, Linux).

Namespace: GUPS.AntiCheat.Detector.Desktop

Assembly: cs.temp.dll.dll

Syntax

public enum EDesktopCheatingType : byte

Remarks

Used by ModLoaderDetector, DebuggerDetector and VirtualEnvironmentDetector to classify the evidence that triggered the notification.

Fields

Name	Description
DEBUGGER_KERNEL_MODE	A kernel-mode debugger (WinDbg in kernel mode, Syser, SoftICE, ...) is currently active on the system.
DEBUGGER_REMOTE	A remote debugger is currently attached or a debug port has been assigned to the process.
DEBUGGER_USER_MODE	A user-mode debugger (Visual Studio, dnSpy, x64dbg, OllyDbg, ...) is currently attached to the process.
MOD_LOADER_ASSEMBLY	A managed assembly belonging to a known mod loader (BepInEx, MelonLoader, HarmonyLib, MonoMod, ...) was found loaded into the current System.AppDomain.
MOD_LOADER_FILE	A file or folder belonging to a known mod loader (e.g. BepInEx/, MelonLoader/, doorstop_config.ini, Mods/) was found next to the game executable.
MOD_LOADER_INJECTOR	A native module typical for a mod loader injector was found loaded into the process (e.g. a winhttp.dll or version.dll loaded from the game directory instead of System32 - the UnityDoorstop signature).
UNKNOWN	Default sentinel used when the type of cheating could not be classified.
VIRTUAL_MACHINE_BIOS	The system BIOS / DMI strings indicate a virtual machine vendor (VirtualBox, VMware, QEMU, Xen, Parallels, Hyper-V, ...).
VIRTUAL_MACHINE_HYPERVISOR_BIT	The CPUID hypervisor present bit is set, indicating the OS is running inside a hypervisor.
VIRTUAL_MACHINE_MAC	A network interface MAC address belongs to a known virtual machine vendor OUI (e.g. 08:00:27 for VirtualBox, 00:0C:29 for VMware, 00:15:5D for Hyper-V).
VIRTUAL_MACHINE_PROCESS	A process belonging to a virtual machine guest additions package was found running on the system (VBoxService, vmtoolsd, prl_tools_service, ...).