[vablings]

It is not kernel level, they use a number of pretty fancy user mode tricks to prevent people messing with the game.

They encrypt every page and register an exception handler that decrypts the page when a fault is reached to keep memory secure. They do cache timing checks to see if a page was recently in the working set outside of the expected control flow and will flag you if you fail the check too many times because it indicates tampering.

[not_a9]

While the page decryption trick should work in Wine just fine (ZeroIT Lab Theia does that too, right?), I don’t remember if Wine provides workingset info like Windows.

[nekitamo]

Yes, Wine was (EDIT: partially) compatible with the Roblox anti-cheat, and there was a period in time where Roblox with its anti-cheat ran on Wine. Eventually, however, a decision was made to block Wine.

EDIT It looks like the Roblox anti-cheat devs themselves explained why Wine was blocked:

https://devforum.roblox.com/t/roblox-on-linux-everything-sum...

[vablings]

Yes, it does. Wine lets you register a VEH. They do other stuff to prevent Wine and virtual machines in general that I am not fully aware of.

Even then it's just a fancy party trick, you can suspend the process call the decryption function enumerating all the pages and take a full dump to get the binary

FYI; Theia is a very bad product. It absolutely tanks binary performance and does little to prevent a moderately competent engineer from cheating in your game.

[not_a9]

Are the other Zero IT Lab products like their code virtualizer of similar quality to Theia? My only exposure has been that one RE//verse presentation and shitposts on UC.

[vablings]

I can't speak for all the products, but from what I have heard it's pretty bad. Pay close attention to the shitposts on UC, they regularly get taken down but have some interesting information in them.

[nekitamo]

I personally liked their Code virtualizer. And it's under active development. Sorry to hear about Theia, I haven't run into it yet.