Process Hacker and Windows discussion

 
User avatar
MadMark
New User
Posts: 1
Joined: 21 Feb 2021 16:20
OS: Windows 10 1709

Problem with Faceit AC

22 Feb 2021 22:16

Hi,
I changed csrss.exe affinity and after this completely shut down Process Haker (kernel driver/service too), but Faceit anticheat somehow still detect this and I have to restart system. If I don't run the program, everything is fine and faceit AC works properly.
What may still remain in the background after the Process Haker?
 
User avatar
dmex
Admin
Posts: 1640
Joined: 17 Jan 2011 05:43

Re: Problem with Faceit AC

25 Feb 2021 23:26

MadMark wrote: 22 Feb 2021 22:16
I changed csrss.exe affinity and after this completely shut down Process Haker (kernel driver/service too), but Faceit anticheat somehow still detect this and I have to restart system. If I don't run the program, everything is fine and faceit AC works properly.
Why does changing affinity generate an AC check? Affinity requires PROCESS_SET_INFORMATION access which is completely harmless and cannot read/write memory or do anything except change affinity and priority.
MadMark wrote: 22 Feb 2021 22:16
What may still remain in the background after the Process Haker?
The files on disk maybe? There are also kernel structures for unloaded drivers which they're probably scanning but you cannot do anything with PH that would let you cheat in games so there isn't any purpose checking for our driver... which is why it's compatible with BattlEye, EAC and VAC.

BattlEye, EAC and VAC have in the past all blocked our drivers but all those restrictions were removed once they realized you cannot actually use our driver to cheat. Faceit AC shouldn't be blocking the driver either because it's dumb and unnecessary - you can't cheat with PH so you shouldn't block it.