developing an anti-cheat search with proxy dll

Question

There's a commom cheat program for a game.

I can make a proxy directx dll and inject any code i want in it. should I scan the processlist and then try to find footprints?

someone point me in the direction of suitable heuristics?

Answer 1

"Easiest" way to detect if it's a proxy or not would be to determine the path of the loaded d3d9.dll, calculate hash and compare it with stored hashes.