Technically, they 'need' a kernel based driver in order to detect certain cheats. Cheat-writers are getting more and more sophisticated in what they do, and it's becoming harder and harder to detect someone cheating lose from the human eye.
These cheats are becoming more like malware. They nestle themself outside the OS, simply unable to be detected by any regular anticheat / anti-virus and all.
There are many cheat writers who code these stuff up for a living. Some of them made serious money with many cheats, wallhacks and all that stuff.
Back in the days, i used to work on anticheat for a certain game as well. We where able to view anyone's processes in XP or any other OS. But the moment they started to hook on a game outside the game itself, it was pretty much done, and nothing much we could do back then since the game itself was very limited. It was just a demo version of some game with just one map. There was a decent community for it every day tho.
Mostly a anticheat looks for is:
- File checksum (modded files)
- Memory checksum (modded memory parts of the game)
- Make screenshots and uploads it at random intervals
- Some more relevant stuff, such as proces viewing, which programs you are running with proberly a checksum as well
It can be updated as simular to a antivirus, that checks for certain *known* files. If anticheat is smart, it simply brings in map who cheats currently, and start some huge banning within a period of time.
