Until now, yes.
Hidden checker watch for changes on files.
It don't write anything to disk.
LOL,
GEngine uses a driver to hook Ring3 and Ring0.
Remove this hook on Win XP SP1 & SP2 is Easy.
Only restore de SDT and all is gone.
You don't need either to stop driver.
But Vista and newer OS don't accept unsigned drivers and Kernel land access on User land.
I don't stop the service driver.
As you can see it still running, but in pending status.
Until GG_Protection device is closed.
It's only marked for deletion too.
So windows removes the garbage after shutdown.
Stopping the driver and removing the GG_Protection handle will cause a crash on Garena.
My tool is indeed to Garena 3.3.0.1922.
If they change it all is gone too.
An advanced user, don't need any Crack or Hack.
Just
Process Hacker and
Kernel Detective.
But I made this to normal users.
The only solution to Garena is to use some warden approach:
Watch the offsets and advice the other users in game that this user is a Cheater. Even need to BAN.
Maybe a drop like -ah switch.
Nice to see that you take your time to check this out.
Regards.