Checks reference

This page is generated from CHECK_CATALOG in packages/shared, the same catalog the scanner implements and the API uses, so it cannot drift from the product.

How to read it

• Reads (consent screen) is the exact sentence the player sees before accepting.
• Highest severity caps every finding of that check, including findings produced by signatures.
• Coverage weight is how much a skipped check lowers confidence in a clean verdict.
• Administrator rights: without them, these checks report skipped.
• DUXAC admins can publish new versions of a check (enable or disable it, change options or its severity cap); the scanner receives the effective configuration when a scan starts.

Summary#

All checks#

System Security State#

SYS-001 · System Profile#

Collects the OS build, uptime, administrator status and a pseudonymous hardware reference used to link scans of the same PC.

• Reads (consent screen): Windows version, uptime, CPU/motherboard/disk identifiers (hashed on your PC, never sent in clear).

• Administrator rights: not required

• Highest severity: info · coverage weight: 1

• False-positive notes: Informational only.

SYS-002 · Virtual Machine & Sandbox#

Detects hypervisors, virtual hardware and sandboxes — scans run in a VM do not reflect the gaming PC.

• Reads (consent screen): Hardware vendor strings, BIOS information, hypervisor flag.

• Administrator rights: not required

• Highest severity: medium · coverage weight: 2

• False-positive notes: Hyper-V/WSL enabled on the host sets the hypervisor flag; reported as info unless virtual hardware is also present.

SYS-003 · Test Signing & Debug Mode#

Windows test-signing, kernel debugging or disabled driver signature enforcement allow unsigned kernel cheats to load.

• Reads (consent screen): Boot configuration flags (code integrity state).

• Administrator rights: not required

• Highest severity: high · coverage weight: 3

• False-positive notes: Driver developers may legitimately enable test signing; staff should ask.

SYS-004 · Security Features Disabled#

Memory integrity (HVCI), Secure Boot, Defender real-time protection or tamper protection turned off.

• Reads (consent screen): Windows security feature states.

• Administrator rights: not required

• Highest severity: medium · coverage weight: 2

• False-positive notes: Many users disable Defender for performance; low severity on its own.

SYS-005 · Defender Exclusions#

Antivirus exclusions on folders or processes — cheat loaders routinely ask users to exclude them.

• Reads (consent screen): Microsoft Defender exclusion list (paths, processes, extensions).

• Administrator rights: required — skipped without them

• Highest severity: high · coverage weight: 3

• Signature types evaluated: file_path, file_name

• False-positive notes: Game and development folders are common exclusions; only matches and exclusions in user-writable temp/download folders are raised above info.

Running Processes & Modules#

PRC-001 · Running Processes#

Matches every running process (name, path, file hash, publisher, window titles) against the signature database.

• Reads (consent screen): List of running programs, their file paths, hashes and window titles.

• Administrator rights: not required

• Highest severity: critical · coverage weight: 5

• Options (defaults): maxHashFileMb = 64

• Signature types evaluated: process_name, file_hash, file_path, window_title, certificate_subject

• False-positive notes: Hash matches are exact; name matches are capped at medium unless the signature says otherwise.

PRC-002 · Unsigned Processes in User Folders#

Unsigned executables running from Temp, Downloads, AppData or removable drives — typical of loaders.

• Reads (consent screen): Paths and signature status of running programs.

• Administrator rights: not required

• Highest severity: medium · coverage weight: 2

• False-positive notes: Many indie tools are unsigned; never raised above medium without a signature match.

PRC-003 · FiveM Process Modules#

Lists DLLs loaded into FiveM/GTA processes and flags unsigned or unexpected modules (injected cheats, proxy DLLs).

• Reads (consent screen): Modules loaded in FiveM processes (only if FiveM is running).

• Administrator rights: not required

• Highest severity: critical · coverage weight: 5

• Signature types evaluated: module_name, file_hash, file_path

• False-positive notes: Overlays (Discord, Steam, NVIDIA, RivaTuner, OBS) are allow-listed by publisher. Skipped when FiveM is not running.

PRC-004 · Process Handles to FiveM#

Processes holding memory read/write handles to FiveM — external cheats need them.

• Reads (consent screen): Which programs have open access to the FiveM process.

• Administrator rights: required — skipped without them

• Highest severity: high · coverage weight: 3

• False-positive notes: System services, anti-virus and overlays are excluded by publisher.

Memory String Scan#

MEM-001 · Memory String Scan#

Searches the memory of selected processes (Explorer, FiveM, the Windows search and service hosts) for strings that cheat menus and loaders leave behind.

• Reads (consent screen): Text in the memory of selected Windows and FiveM processes; only matching strings are reported.
• Administrator rights: required — skipped without them
• Highest severity: critical · coverage weight: 4
• Plan feature: memory_scan
• Options (defaults): maxRegionMb = 64, maxProcessMb = 1024, timeBudgetSeconds = 60
• Signature types evaluated: memory_string
• False-positive notes: Strings shorter than 6 characters are refused by the signature validator. Only the matched string and process are reported, never surrounding memory.

FiveM & GTA V Installation#

FIV-001 · FiveM Installation#

Inspects FiveM.app: plugins folder, citizen and mods directories, ASI loaders and proxy DLLs (dinput8, d3d11, dxgi, version).

• Reads (consent screen): File names, sizes and hashes inside the FiveM installation folder.

• Administrator rights: not required

• Highest severity: critical · coverage weight: 5

• Options (defaults): maxFiles = 20000

• Signature types evaluated: file_name, file_hash, file_path

• False-positive notes: ReShade and graphics mods are reported as info; the operator decides whether they are allowed.

FIV-002 · GTA V Directory#

Script hooks, ASI loaders and trainers in the GTA V installation (ScriptHookV, dsound/dinput8 proxies, .asi files).

• Reads (consent screen): File names and hashes in the GTA V installation folder.

• Administrator rights: not required

• Highest severity: high · coverage weight: 3

• Signature types evaluated: file_name, file_hash

• False-positive notes: Single-player mods are common; staff decide whether they matter for their server.

FIV-003 · Modified Game Data#

Modified game data files in FiveM's citizen folder (weapons/visualsettings/timecycle overrides used for no-recoil or visual advantages).

• Reads (consent screen): Hashes of game data files inside FiveM.app/citizen.

• Administrator rights: not required

• Highest severity: high · coverage weight: 3

• Signature types evaluated: file_hash, file_path

• False-positive notes: Compared against hashes of the official FiveM build; FiveM updates are tracked by the signature database.

FIV-004 · FiveM Logs & Crash Dumps#

FiveM client logs for injected modules, loader messages and abnormal resource activity.

• Reads (consent screen): FiveM log files (only matching lines are reported).

• Administrator rights: not required

• Highest severity: high · coverage weight: 2

• Options (defaults): maxLogMb = 32, lookbackDays = 14

• Signature types evaluated: file_string, module_name

• False-positive notes: Only lines matching signatures are reported.

File System Artefacts#

FS-001 · Known Cheat Files#

Hashes executables and archives in Downloads, Desktop, Documents, Temp and AppData and matches names, paths and hashes against signatures.

• Reads (consent screen): Names, sizes, dates and hashes of executable/archive files in your user folders.

• Administrator rights: not required

• Highest severity: critical · coverage weight: 5

• Options (defaults): maxFiles = 60000, maxHashFileMb = 64, maxDepth = 6

• Signature types evaluated: file_hash, file_name, file_path, file_string, certificate_subject

• False-positive notes: Document and media files are never read. Paths are reported with your user name replaced by %USERPROFILE%.

FS-002 · Recently Created Executables#

Unsigned executables and DLLs created in user folders during the lookback window.

• Reads (consent screen): Executable files created recently in your user folders.

• Administrator rights: not required

• Highest severity: medium · coverage weight: 2

• Options (defaults): lookbackHours = 72

• False-positive notes: Reported as low unless combined with other indicators.

FS-003 · Recycle Bin#

Deleted executables still in the recycle bin, matched against signatures.

• Reads (consent screen): Original names and deletion dates of executable files in the recycle bin.

• Administrator rights: not required

• Highest severity: high · coverage weight: 2

• Signature types evaluated: file_name, file_hash

• False-positive notes:

FS-004 · Removable & Virtual Drives#

Connected USB / virtual drives and evidence of programs executed from them.

• Reads (consent screen): Drive letters, types and labels; executables on removable drives are hashed.

• Administrator rights: not required

• Highest severity: medium · coverage weight: 1

• Signature types evaluated: file_hash, file_name

• False-positive notes: Executing from USB is not cheating by itself.

Execution History#

EXE-001 · Prefetch#

Windows Prefetch records of programs run in the lookback window, matched against signatures; programs that ran and were then deleted are flagged.

• Reads (consent screen): Names, run counts and last run times from C:\Windows\Prefetch.

• Administrator rights: required — skipped without them

• Highest severity: critical · coverage weight: 5

• Options (defaults): lookbackDays = 14

• Signature types evaluated: file_name, file_path

• False-positive notes: Deleted-after-run is low severity unless the name matches a signature.

EXE-002 · Background Activity Moderator#

BAM registry entries (full path + last execution time) matched against signatures; missing files flagged.

• Reads (consent screen): Program paths and last execution times recorded by Windows (BAM).

• Administrator rights: required — skipped without them

• Highest severity: critical · coverage weight: 4

• Options (defaults): lookbackDays = 14

• Signature types evaluated: file_name, file_path

• False-positive notes:

EXE-003 · User Execution Traces#

UserAssist, MUICache, Compatibility Assistant and recent-documents traces of executed programs.

• Reads (consent screen): Program names recorded by Windows in your user registry.

• Administrator rights: not required

• Highest severity: high · coverage weight: 3

• Options (defaults): lookbackDays = 30

• Signature types evaluated: file_name, file_path

• False-positive notes:

EXE-004 · USN Journal#

NTFS change journal of the system drive: executables/DLLs created, renamed or deleted recently, matched against signatures.

• Reads (consent screen): File names (not contents) of recently created/deleted executable files on the system drive.

• Administrator rights: required — skipped without them

• Highest severity: critical · coverage weight: 4

• Options (defaults): lookbackHours = 48, maxRecords = 2000000

• Signature types evaluated: file_name

• False-positive notes: Software updates create and delete many files; only signature matches and deleted unsigned executables are reported.

EXE-005 · Scheduled Tasks & Autoruns#

Run keys, startup folders and scheduled tasks pointing to user-writable locations or known loaders.

• Reads (consent screen): Startup entries and scheduled task commands.

• Administrator rights: not required

• Highest severity: high · coverage weight: 2

• Signature types evaluated: file_path, file_name, registry_key

• False-positive notes:

Drivers & Services#

DRV-001 · Loaded Drivers#

Kernel drivers currently loaded, matched against known cheat drivers and vulnerable drivers abused to map cheats (kdmapper-style).

• Reads (consent screen): Names, paths and signers of loaded drivers.

• Administrator rights: not required

• Highest severity: critical · coverage weight: 4

• Signature types evaluated: driver_name, file_hash, certificate_subject

• False-positive notes: Vulnerable drivers also ship with legitimate hardware tools; a match alone is high, not critical.

DRV-002 · Services#

Installed services and kernel services with binaries in user-writable locations or matching signatures.

• Reads (consent screen): Service names and binary paths.

• Administrator rights: not required

• Highest severity: high · coverage weight: 2

• Signature types evaluated: service_name, file_path

• False-positive notes:

Hardware & DMA#

HW-001 · PCIe DMA Devices#

PCI devices whose vendor/device ids match FPGA boards used for DMA cheats, and devices masquerading with mismatched ids.

• Reads (consent screen): PCI device identifiers.

• Administrator rights: not required

• Highest severity: high · coverage weight: 2

• Signature types evaluated: pci_device

• False-positive notes: A well-configured DMA card can spoof ids; absence of a finding is not proof.

HW-002 · Input Devices & Macro Software#

Input-injection devices (e.g. KMBox/Arduino HID spoofers) and macro tools like AutoHotkey running scripts.

• Reads (consent screen): USB input device identifiers, running macro tools.

• Administrator rights: not required

• Highest severity: medium · coverage weight: 1

• Signature types evaluated: pci_device, process_name

• False-positive notes: Gaming-mouse macro software is reported as info only.

Network & Browser Traces#

NET-001 · DNS Cache#

Recently resolved domains matched against known cheat sellers, loaders and auth servers.

• Reads (consent screen): Domains in the Windows DNS cache; only matching domains are reported.

• Administrator rights: not required

• Highest severity: high · coverage weight: 2

• Signature types evaluated: domain

• False-positive notes: Visiting a cheat website is not cheating; a loader auth domain is stronger evidence.

NET-002 · Browser History Domains#

Domains in Chrome, Edge, Brave, Opera and Firefox history matched against cheat-seller signatures. Nothing else from the history leaves the PC.

• Reads (consent screen): Browser history domains; only matching domains and their last visit date are reported.

• Administrator rights: not required

• Highest severity: medium · coverage weight: 1

• Options (defaults): lookbackDays = 30

• Signature types evaluated: domain

• False-positive notes: Capped at medium.

Anti-Forensics & Cleaning#

AF-001 · Event Log Clearing#

Security/System event logs cleared recently (events 1102 / 104).

• Reads (consent screen): Timestamps of log-clearing events.

• Administrator rights: required — skipped without them

• Highest severity: high · coverage weight: 2

• Options (defaults): lookbackDays = 7

• False-positive notes: Some optimisation tools clear logs; staff should ask.

AF-002 · Disabled Forensic Features#

Prefetch disabled, UserAssist logging disabled, USN journal recently recreated or BAM entries wiped.

• Reads (consent screen): Registry settings controlling Windows activity recording.

• Administrator rights: not required

• Highest severity: high · coverage weight: 2

• False-positive notes: SSD 'optimisation' guides sometimes disable Prefetch.

AF-003 · Cleaners & Timestamp Tools#

Trace cleaners (and their recent runs), timestamp-changing tools and file shredders.

• Reads (consent screen): Execution traces of cleaning tools.

• Administrator rights: not required

• Highest severity: medium · coverage weight: 1

• Options (defaults): lookbackDays = 7

• Signature types evaluated: process_name, file_name

• False-positive notes: CCleaner use is common; reported higher only if run shortly before the scan.

AF-004 · System Time Manipulation#

Local clock differs from the DUXAC server clock or was changed recently (used to fake artefact timestamps).

• Reads (consent screen): Your PC clock and recent time-change events.

• Administrator rights: not required

• Highest severity: medium · coverage weight: 1

• Options (defaults): maxSkewSeconds = 300

• False-positive notes: Time-zone changes are excluded.

Scanner Integrity#

INT-001 · Scanner Tampering#

Debuggers attached to the scanner, hooks in its process, or a scanner binary whose hash does not match an official release.

• Reads (consent screen): State of the DUXAC scanner process itself.

• Administrator rights: not required

• Highest severity: critical · coverage weight: 3

• False-positive notes: The hash check is done by the server against published release hashes.