Arduino, KMBox, Cronus and DMA Cards: How Hardware Cheats Are Handled

Not every cheat is a program. Some sit between your mouse and your PC, and some read the game's memory from a second computer through a PCIe card. Since version 0.0.15, AACGUARD recognises the most common cheat devices from the records Windows keeps about connected hardware.

What AACGUARD looks for

• Microcontroller boards acting as a mouse or keyboard: Arduino, Teensy and similar boards can pretend to be a mouse and move it for an aimbot or a recoil script. A board on its own is ordinary electronics; AACGUARD only looks at boards that also present themselves to Windows as an input device.
• Input adapters: KMBox, Cronus, Titan Two and XIM devices, which sit between the mouse or controller and the PC.
• DMA cards: FPGA boards and USB 3 bridge chips used to read a game's memory from another computer.

The check reads Windows' device records for USB, input and PCI devices, including devices that are no longer connected, with the times Windows saw them arrive and leave.

When a device counts

A device only counts toward the verdict if it is connected now or was last seen today. Older devices are listed for information only. Many players own an Arduino for school, a hobby or a custom keyboard, and a device used months ago says nothing about today's match.

When it counts, a device is a medium-strength finding. Medium findings can make a scan SUSPICIOUS, but they never produce CHEAT DETECTED on their own; that always needs strong evidence such as a cheat running or a cheat's code being present.

What AACGUARD cannot see

A device can be built to look exactly like an ordinary mouse or network card, and a second PC reading memory through a card leaves nothing on your PC except the card. Hardware checks are therefore one piece of the picture. For high-stakes matches, admins still rely on demos, in-person rules and the rest of the scan.

For players with a legitimate board

• Unplug development boards you don't need while playing. That is the simplest way to avoid questions.
• If a board you use for something else was connected during a scan, say so in your appeal and explain what it is for. See How to appeal a verdict.
• Custom keyboards built on a microcontroller are common. If yours is reported, use Report false positive so we can recognise that model.

For admins

Look at the date and the device name. A KMBox or DMA card seen today, together with other findings, is worth acting on. An Arduino seen once last spring is information only, and the scan already treats it that way.