Modern cheats for multiplayer games don't modify local files (or attribute values in memory), since the server validates everything anyway. They're about giving you information that's available but not shown in the game (like see-through walls, or exact skill ranges), or manipulate input (dodge enemy damage, easy combos). Those cheat can run in kernel mode (or at least evade detection from user mode), so the anti-cheat needs kernel mode to be more effective.

[–] ysjet@lemmy.world 14 points 2 weeks ago

since the server validates everything anyway

Oh you sweet summer child.

The server doesn't validate shit, because that takes up CPU cycles on THEIR hardware, which costs them money. A huge part of kernel level anticheat is forcing YOU to pay the cost for anticheat, so they can squeeze a few more pennies out of it. And if your computer gets owned because they installed insecure, buggy malware on your system...? Well, they'll just deny. After all, it's kernel-level, how are YOU going to prove anything?

[–] Katana314@lemmy.world 2 points 2 weeks ago

If server validation was still a common practice (as it should be) then cheats wouldn't come in the form of speed hacks, teleportation hacks, or invincibility. The traditional thing in CS that was hard to prevent is aimhacks and wallhacks. I respect that those are hard to prevent, but they can be much less impactful in modern hero shooters.