Occasionally, some anti-cheat software gets dissected and the analysis posted publicly. Here is an analysis of BattlEye with some information on its development

Occasionally, some anti-cheat software gets dissected and the analysis posted publicly. Here is an analysis of BattlEye with some information on its development history: https://vmcall.blog/battleye-anticheat-analysis-and-mitigation/ https://vmcall.blog/battleye-anticheat-analysis-and-mitigati... Typically, anti-cheat is separated into a frontend and a backend. The frontend becomes active at an enumerated set of events/criteria and collects data (screenshots, keystrokes, directory listings, process lists, results of memory scans, if instructed by the backend also memory contents or file contents) to the backend for further analysis. These criteria are often ad-hoc (such as "if processes are running out of a user directory, capture them") and usually accumulate over time.