this post was submitted on 14 Nov 2025
633 points (99.2% liked)
Linux
10721 readers
290 users here now
A community for everything relating to the GNU/Linux operating system (except the memes!)
Also, check out:
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It's an arms race, the arms just keep moving deeper into the stack system. Used to happen entirely in usermode, one process poking in and reading/writing memory of the game, so anti-cheat started keeping an eye out for malicious processes. Then at some point someone patched their kernel to cheat in a way the game couldn't possibly detect from usermode, so someone made an anti-cheat that ran at the kernel level too.
Modern KLA is basically a fully fledged rootkit, living in your system from boot, doing absolutely anything they can to try and make sure nothing has been tampered with. Validating signatures on bins, hooking memory mappings, watching for anything that might try to read/write the kernel or game's memory space unexpectedly.