Kingsman Anti-Cheat (KAC)

What it does: This is the core of the system's startup. It securely loads a public key provided by the game administrator to verify a digital signature against a license file. This ensures the license is authentic, hasn't been tampered with, and is authorized for use.

What it does: The system uses a developer-provided public key to verify the digital signature of a master file list. This list contains the correct cryptographic hashes for all critical game files. This process guarantees that the list of official file hashes is authentic and has not been altered. The system then scans the game directory, hashing each file and comparing it to the verified master list. If any file is missing, modified, or if extra unauthorized files are found, the game is terminated. It uses a local cache to speed up scans on subsequent launches.

What it does: A background thread continuously scans for running processes on the user's computer. It compares them against a hardcoded blacklist of known cheating, hacking, and reverse-engineering tools. If a blacklisted program is found, the game terminates immediately.

What it does: Similar to process detection, this feature continuously scans the DLLs loaded within the game's own process. It checks against a blacklist of DLLs known to be used for cheating. If a forbidden module is detected, the game is shut down.

What it does: This is an advanced defense against in-memory attacks. It monitors the starting bytes of critical Windows functions. If these bytes are modified, the system flags it as a violation. It can then capture a screenshot of the game, encrypt a detailed report, save it locally, and terminate the process.

What it does: The system uses low-level keyboard and mouse hooks to analyze player inputs. It looks for patterns that are not human-like, such as: Injected Inputs, Repetitive Timing, Mouse Teleporting, and Robotic Motion. A multi-factor system detects unnaturally straight, constant-speed, and "perfect" mouse movements characteristic of bots, while using a flagging system to avoid punishing legitimate players for occasional frantic movements.

What it does: This feature monitors for other processes that are frequently trying to capture the game's screen image. This is a common technique used by bots to read game state information directly from the screen. If a process is detected doing this excessively, it is flagged as suspicious.

What it does: To make it harder for reverse engineers to analyze the DLL, a critical function is stored in memory in an encrypted state using a simple XOR cipher. The code is only decrypted for the brief moment it needs to be executed and is immediately re-encrypted afterward. This prevents it from being easily read in a disassembler.

What it does: The system checks how many instances of the game executable are running on the PC. If the count exceeds a limit defined in the secure file list, it prevents the new instance from launching.