- How does anti-cheat detect a cheat?
- Three broad ways. Signature detection matches known bytes of a build in memory or on disk. Integrity and behavioural checks look for tampered game memory, injected threads, suspicious handles and unsigned drivers. Server-side analytics ignore your PC entirely and score how you play - headshot percentage, snap angles, reaction time and loot routing. A private build can defeat the first two and still get you flagged by the third.
- What is a kernel-level anti-cheat?
- A driver that runs in ring 0, the same privilege level as Windows itself. It can see every process, every driver and every memory region on your machine, which is why kernel anti-cheats require secure boot and blocklist vulnerable drivers. It is also why cheats for those games are harder to build, more expensive, and more sensitive to Windows updates.
- What is a ban wave?
- Detections are collected quietly and actioned in batches, sometimes weeks later, so cheaters cannot tell which build or which session was flagged. That delay is exactly why 'I have been using it for a month with no ban' is not evidence a build is safe.
- Why do builds go on update?
- When an anti-cheat vendor ships a new detection module or the game patches, developers pull the build offline until it is re-verified. On Norium that state is published as 'on update' with the date, and licence timers freeze while it lasts, so you are not billed for downtime.
- Does a HWID spoofer defeat anti-cheat?
- No. A spoofer addresses hardware bans - it changes the identifiers used to recognise your machine after an action. It does not hide a cheat from a memory scan and it does not undo behavioural flags. Our HWID spoofer explainer covers when it genuinely matters.
- Which games are riskiest?
- Anything on Vanguard, because of boot-time kernel enforcement and hardware bans. BattlEye titles are next because modules stream in without warning. Tencent ACE titles sit in the middle technically but lean hard on behavioural review, so playing conservatively matters more than the build you run.
- Can anti-cheat see my whole PC?
- A kernel driver technically can enumerate processes, drivers and memory while it is running. That is a real privacy trade-off you accept when you install the game, not something a cheat changes. It is also why running unknown free loaders as administrator is a much bigger risk than most people assume.