Hypervisor anti-cheat that operates below the kernel. Protects client memory via EPT, detects injections before execution, and fingerprints real hardware. Built by a team that knows every attack vector from firsthand experience.
Solutions like EAC, BattlEye, and EMAC operate at Ring 0 — the same level an attacker with a signed driver can reach. Drenox Security operates one level below, where no cheat can get to.
Talk to the teamUser processes, kernel drivers, and the CPU hypervisor occupy different privilege levels. The lower the level, the more power over everything above. Conventional anti-cheats stopped at Ring 0. Attackers already got there. We went deeper.
Where cheats inject DLLs, hook APIs, and run overlays. Every user process operates here. Anti-cheats that only monitor user-mode are easily bypassed by attackers with privileged access.
Enters VMX root mode via VT-x (Intel) or SVM (AMD). Controls EPT (Extended Page Tables) to intercept all physical memory access without kernel awareness. Traps privileged instructions (CPUID, CR3 write, MSR access) before execution. The kernel thinks it controls the machine. We control the kernel.
The kernel thinks it controls the machine. We control the kernel.
Every module was born from a real attack vector found in online games. We know each technique because we studied it first.
VMX root mode monitor. Uses EPT (Extended Page Tables) to protect client memory pages at the physical level. Any modification attempt, even from Ring 0, triggers a violation the hypervisor catches before execution. No cheat operates below this.
Detects import table hooks, executable section patches, injected threads, and unsigned loaded modules. Any injection attempt is identified before a single instruction runs in the protected process.
Cryptographic baseline of every critical client region, signed per build. EPT violations detect changes in real time with no polling. Unlike anti-cheats that scan periodically, the hypervisor intercepts at the exact moment of the attempt. Zero time window.
Deep network protocol validation. Detects proxies and interceptors by latency and fingerprint, packet replay by sequence, and invalid data injection. Server-side timing, order, and integrity validation of every message.
Persistent hardware identification collected directly by the hypervisor via IOMMU. Does not rely on hookable user-mode APIs. Survives reinstalls, VPNs, and conventional spoofers. Hardware bans that actually work.
Full red team: we analyze your client binary, test the network, identify vulnerabilities, and deliver a report with working PoC. We attack your server before someone else does. You get the report, we build the defense.
Drenox Security installs before the operating system, intercepts Hyper-V loading and controls memory violations in real time. Native Intel VT-x and AMD-V support.
Drenox Security monitors the game client continuously. When a threat appears, the hypervisor blocks it before execution.
Market anti-cheats operate at Ring 0 at most. When the attacker reaches the same level, protection becomes an update race. Drenox Security eliminates the race by operating one level below.
| Vector | EAC / BattlEye / EMAC | Drenox Security |
|---|---|---|
| Operation level | Ring 0 (kernel driver) | Ring −1 (VMX root, EPT) |
| Attacker's signed driver | ✗ Same level, no advantage | ✓ EPT intercepts below the driver |
| DMA / hardware cheats | ✗ Invisible to kernel | ✓ IOMMU controlled by hypervisor |
| Memory patches | ○ Periodic scan (time window) | ✓ Instant EPT violation |
| Proxy / network MITM | ✗ No native detection | ✓ Fingerprint + timing + protocol |
| Reversing the AC itself | ○ Obfuscation (ConfuserEx, Themida) | ✓ Code in VMX root, inaccessible |
| Public bypass available | ✗ Yes (forums, GitHub) | ✓ 0 known bypasses |
Every known attack vector in the market is covered by a dedicated module. The technology operates at Ring −1, where no cheat can hide.
DLL injection, IAT hooks, inline hooks, remote threads, and unsigned modules. Blocked before execution via EPT.
.text patches, memory redirects, protected region modifications. Instant EPT violation, zero time window.
Proxies, MITM, packet replay, data injection, and latency anomalies. Server-side timing and sequence validation.
Two independent services. The audit finds vulnerabilities. The anti-cheat protects in real time. Hire them separately or together.
We analyze your game files and executables, identify attack vectors, test the latest techniques players use to create hacks and bypasses, and deliver a report with actionable fixes.
On request
Pricing defined internally with the team based on scope and complexity.
Continuous protection for online servers, integrated with the game client and infrastructure. Licensing is defined by the capacity of concurrent protected players (CCU).
| Plan | Licensed capacity | Monthly fee | |
|---|---|---|---|
| Starter | Up to 2,000 CCU | R$ 3,598 | Subscribe |
| Basic | Up to 20,000 CCU | R$ 35,980 | Subscribe |
| Custom | Any volume | On request | Subscribe |
Custom covers any volume — below 2,000, above 20,000, or a tailored range in between.
Offensive audit, hypervisor anti-cheat, or both. Describe the problem, we show the solution.
Prefer a direct email?
Response within 24 hours. NDA available before the first conversation.