Anticheat Telemetry

Anticheat Telemetry is a Windows Ring 0/3 process-integrity sensor consisting of an optional x64 WDM telemetry driver, an x64/Win32 user-mode collector, a versioned buffered IOCTL ABI, and tamper-evident JSONL output.

The implementation records telemetry only. It does not patch memory, hide objects, block image loads, terminate processes, or implement account enforcement.

Technical documentation

• System architecture
• Integrator sequence
• Kernel driver development
• Event pipeline
• Security operations
• Contribution workflow
• Driver ABI and lifecycle
• Event schema
• Adversarial analysis
• Engineering project contract

Engineering coordination

• GitHub repository
• Engineering project
• Roadmap
• Open issues
• Technical discussions
• Private vulnerability reporting

Build status

Windows x64, Win32, and sanitizer CI and CodeQL C/C++ analysis run on changes to the protected main branch and on pull requests.