Client checks · server verdicts
ServerShield watches the game from inside the player's own client and reports what it finds. Nothing that runs on their machine is trusted on its own: every verdict is reached on yours, in code a cheater cannot reach, patch or delete.
Seven checks, each on its own timer, each switchable on its own. They cover the things a cheat actually has to do — not a long list written to look impressive.
| Check | What it finds |
|---|---|
| real-time protection | Real-time protection across processes, files, memory, and network activity — focused on suspicious, unsigned, or malware-infected components, not legitimate and trusted software. Every detection includes a clear evidence trail, giving you the technical context needed to verify threats and make confident decisions. |
| debugger | A debugger attached to the game: the obvious flag, the PEB, debug ports, and the CPU's hardware breakpoint registers — the ones people reach for precisely because they leave no bytes behind. |
| injected module | Foreign DLLs inside the game process, modules with no file on disk, and threads started from memory that belongs to no module at all. Manual mapping is exactly what a serious cheat does to stay invisible. |
| hooked function | System functions redirected somewhere else. The prologue is compared against a clean copy read from disk, and where it differs the jump is decoded and followed to see where it lands. |
| patched code | The game's own code changed in memory. A fingerprint is taken at startup and re-checked while you play, so a patch applied after launch does not slip by. |
| speedhack | The process clock measured against the kernel's clock. The kernel's cannot be moved without a signed driver, so a client running fast has nowhere to hide. |
| unsigned binary | The other way round from a blacklist: instead of asking what is known to be bad, it asks what nobody vouches for. A file passes if it comes from the game folder, from Windows, or carries a valid digital signature. What passes none of those — a module loaded into the game, or a program running from the Desktop, Downloads or Temp — is reported with its name, the folder it ran from, and its MD5, one click away from a verdict on VirusTotal. |
| cheat window | Windows, overlays and consoles that do not belong to the game, plus processes by name. Weak on its own, useful as the thread you pull when something else already looks wrong. Anything unrecognised is noted with where on disk it runs from — Program Files reads rather differently from Downloads or a USB stick. |
Everything above happens inside the player's client. Two things never load it at all — so the answer to those comes from your server instead.
The programs behind advertising spam never start the game at all — they talk to your server directly, so there is no window and no process for anything on the machine to find. Your server recognises them anyway, and shows them the door.
A client running without ServerShield, or with an old copy of it, stays in the game but deals no damage and cannot send messages — and is told why, in plain words, instead of being dropped without explanation.
Three moving parts: a DLL next to the client, a module in your game server, and this panel.
When a player enters the game, your server hands the client a random salt, good for that session and nothing else. Everything the client answers afterwards is tied to it.
At uneven intervals the server sends a challenge. The client answers with a value derived from the salt and that challenge, plus a fingerprint of its own code. An answer copied from another player — or from earlier in the same session — does not fit.
The DLL never bans anyone; it only reports. Log, block or kick is chosen by a table in your server's code. On the findings that cannot happen by accident, the client also shuts itself down on the spot, with a message the player can read.
An anti-cheat that closes an honest player's game is worse than no anti-cheat at all. That player does not file a ticket. They just stop logging in, and you never learn why. So a good part of the work here went into not reporting things.
A clean copy of a system DLL almost never lands at the same address as the loaded one, and relocation alone rewrites bytes across the whole image. So a difference is only the first filter: the jump is decoded and followed. Back into the same module, or into another Windows module, is normal. Into a stranger — or into memory with no module behind it — is not.
A module that stays loaded would otherwise be reported on every pass and bury the log in one sentence repeated four hundred times. Each finding goes quiet for a while after it is sent, so what reaches you is a list you can actually read.
Every kind of finding has its own action in a table you edit: log only, block, kick. Start with everything on log, watch the panel for a couple of weeks, and tighten it once you know what your own players' machines look like.
Sits next to the game executable and is loaded at startup. It can be replaced on your server without rebuilding the client, so a new build reaches every player the next time they patch.
Source you drop into your server and compile: the challenge logic, the action table, and the part that ships reports here. Three lines in each core's CONFIG and it is wired up.
Reports arrive over HTTP, signed with your licence secret. Filter by character, account, IP, reason or date; see which accounts share an address; see who trips several different checks rather than the same one over and over.
No. Everything runs in user mode, inside the game process. There is no driver to sign, nothing extra to install on a player's machine, and nothing that can blue-screen somebody in the middle of a siege. That also means it cannot see what a driver would see — it is an honest trade, and you should know which side of it you are buying.
One thread, and the checks are spread across it rather than run together: the cheap ones every few seconds, the expensive ones every half a minute or so. The costly parts — reading a clean DLL from disk, walking the module list — are the rare ones by design.
The server keeps sending challenges either way. A client that cannot answer correctly gets whatever your action table says for that case. The protection is not the file being present; it is the server expecting an answer only that file can produce.
What you already log today: character, account, IP, server and channel, plus the reason and a short detail — a module name, a function name. No files are scanned, no screenshots are taken, and nothing leaves the machine except that one line.
The licence is what lets your server ship reports to the panel. When it lapses, the panel stops accepting them. Nothing reaches into your game and breaks it — your players keep playing, you just stop seeing what got caught.
How many people play at peak, what you have been fighting lately, and what you have tried. That is enough to tell you whether this is worth your money.
Get in touch