AACGUARD – Technical Report

AACGUARD is a user‑mode forensic anti‑cheat system designed for community game servers that don’t have access to kernel‑level protection like official matchmaking. Instead of running all the time, it works as an on‑demand scanner: a player launches the client when an admin suspects cheating, and the tool checks the machine for traces of cheat software across 22 different evidence sources (Windows execution history, file system, autostart locations, USB history, browser history, game configs, virtualization indicators, anti‑forensic tools, live process and kernel state, etc.). Each finding is treated as a piece of evidence with a weight, and a two‑dimensional rule over total score and number of findings produces one of three verdicts: CLEAN, SUSPICIOUS, or CHEAT DETECTED. Version 0.0.10 adds automatic identification of six games, attributes the exact server a player is connected to (using packet observation, A2S queries and DNS checks), detects 32‑bit processes and manually mapped code, and introduces a three‑stage trust model that significantly reduces false positives from legitimate system components. In a documented case study, this trust model dropped a clean player’s score from 395 to 130 and changed the verdict from CHEAT DETECTED to CLEAN. A full scan takes around 17 seconds, performs roughly 190,000 individual checks, and the public deployment had logged over 11,000 scans at the time of writing. The report describes the full detection catalogue, scoring model, server attribution method, false‑positive mitigation, and the web panel used by admins to review scans and make moderation decisions. More info and source: https://aacguard.com