IsReturnAddressInModule - returns true if RetAddr is module's mem region Used to detect attackers calling our functions such as heartbeat generat

IsRunningAsAdmin - returns TRUE if the application is running as administrator context */

IsSecureBootEnabled - checks if secure bool is enabled on machine through a powershell cmdlet (`Confirm-SecureBootUEFI`) returns `true` if secure

IsMachineAllowingSelfSignedDrivers - uses NtQuerySystemInformationFunc to check if bit in CodeIntegrityOptions is set (CODEINTEGRITY_OPTION_TESTSIGN s

IsThreadSuspended - checks if a thread is currently suspended by suspending it has its drawbacks since it suspends threads very briefly, but it w

* @brief Launches the anti-cheat defenses, including starting the monitor and anti-debugger threads, and applying prevention techniques * * @retur

Services::LoadDriver - register a service and load a driver given a driverName and driverPath using SCM return `true` on success */

* @brief places a game event into the queue to be sent to the server * * @param `event` GameEvent object containing the event type, timestamp, and

MakeHeartbeat - Generates a response to server heartbeat requests returns a char* array containing the auth cookie. Very simple example, non-public

ModifyTLSCallbackPtr - changes the program TLS callback at runtime by modifying the data directory ptr (IMAGE_DIRECTORY_ENTRY_TLS) returns true o

Detections::Monitor(LPVOID thisPtr) Routine which monitors aspects of the process for fragments of cheating, loops continuously until the thread

Monitors changes to important registry keys related to secure boot, CI, testsigning mode, etc Meant to be run in its own thread */

Detections::MonitorNewProcesses - Monitors process creation events via WMI Intended thread function, has no return value as it logs in real-time

* @brief Sends a POST HTTP request to a specified URL * * @param requestInfo Structure containing request data, along with response text * * @

PreventWindowsDebuggers - experimental, patches over some common debugging routines */

ProcessRequests - reads packet sent from the server in a loop */

PushAllEvidence - push all unsent flags to server, if any evidence is with a flag it will also send that returns `true` if no flag sends fail. if on

QueryMemory - Server requested client to read bytes @ some memory address returns Error::OK on success */

RandomizeModuleName - Changes the program's main module name (in memory) to a random string returns true on success */

RemapProgramSections - remaps the current module's sections to prevent memory writing/patching Thanks to ChangeOfPace @ Github for the RmpRemapIm

RmppRemapImageRoutine This routine unmaps the original image then reconstructs it as contiguous memory mapped views.

* @brief Pushes the queue of events to the endpoint server * @details if failure occurs, will re-try 5 times until success * @return true/false,

SendFlag - send a detected flag to the server (without evidence) returns `true` on success */

* @brief Sets the data endpoint location * @details Should be a URL supporting HTTP(s) requests * @return void * @usage EventLogger::GetInstanc

StopAPCInjection - prevents APC injection by patching over the first byte of ntdll.Ordinal8. More information about the APC payload can be fetched thr

StopMultipleProcessInstances - Uses shared memory to prevent multiple instances of the process. returns true on success ... Using a mutex in

* @brief TLS callback triggers on process + thread attachment & detachment * * @details Can be used to prevent rogue threads from being created, o

* @brief TLS callback triggers on process + thread attachment & detachment * * @details Can be used to prevent rogue threads from being created,

A Thread constructor with only a thread id implies the thread was spawned by some other mechanism than our own code, and we'd like to keep track of it

UnloadBlacklistedDrivers - attempts to unload/stop blacklisted drivers in `driverPaths` */

Services::UnloadDriver - unregister the driver service and unload a driver given a driverName and driverPath using SCM return `true` on success

* @brief Checks code signature of a file through its catalog file * * @param filePath The file path to the executable or DLL to check * @param c

* @brief Checks code signature of a file through its embedded signature * * * @param filePath The file path to the executable or DLL to check

WasProcessNotRemapped - checks if remapping -did not- occur returns `true` if program was not remapped */