Research

How AACGUARD works, in detail

Technical writing about AACGUARD's detection methods, our own mistakes and what we learned from them. Research notes cover one feature or one investigation each; the technical report describes the whole system. They are written for server owners, researchers and anyone who wants to check our work, not only take our word for it.

Technical report · TR-2026-01 · DOI 10.5281/zenodo.22966357

AACGUARD: Evidence-Weighted, User-Mode Forensic Cheat Detection for Community Game Servers

The full description of the scanner: evidence sources, the three-stage trust model, scoring, privacy design and evaluation. Archived on Zenodo with a DOI and indexed on Google Scholar and ResearchGate. Raul-Daniel Pelea, September 2026 (client 0.0.10).

Read online PDF on Zenodo Where it is published

Research notes

RN-2026-01 · October 30, 2026 · 6 min read What 12,644 Real Scans Taught Us About False Positives We re-examined every scan uploaded to AACGUARD up to 9 October 2026 to find out how often clean software was mistaken for cheats, why, and what it cost players. Most wrongful verdicts came from four design mistakes: matching cheat names inside longer words, judging programs by t… RN-2026-02 · October 30, 2026 · 4 min read Checking CS 1.6 Game Files Against Valve's Own Depot Manifests Counter-Strike 1.6 can be cheated without any running program: a transparent wall texture or a bright player model is enough. We describe how AACGUARD compares about two thousand CS 1.6 and Half-Life files with the fingerprints Valve publishes in Steam's depot manifests, how fin… RN-2026-03 · October 30, 2026 · 4 min read Post-Mortem: When a New Detection Polluted Its Own Evidence (v0.0.15) On 24 October 2026, AACGUARD 0.0.15 added a check for connections to cheat servers. A fallback in that check resolved the address of every known cheat site, which filled Windows' DNS cache with those sites, and another check then reported them as sites the player had looked up. … RN-2026-04 · October 30, 2026 · 5 min read Beyond File Names: Finding Renamed Cheats With Content Rules, Windows Memory and Fingerprints Name lists are the cheapest way to detect a cheat and the cheapest to evade: rename the file. AACGUARD 0.0.15 added four checks that do not depend on a file's name: content rules that look for the game-specific names a cheat must contain, the program paths Windows services keep …

Using this research

You may quote and cite these notes with a link to the page. For practical, step-by-step help see the guides; for every release and its changes see the changelog. Corrections and questions are welcome through the contact page.

How AACGUARD works, in detail

AACGUARD: Evidence-Weighted, User-Mode Forensic Cheat Detection for Community Game Servers

Research notes

Using this research

We use cookies

Cookie settings