Any countermeasures employed by anti-cheat, including using kernel level code (drivers), etc, can be eventually bypassed by a motivated attacker. That's not to say that we shouldn't try, of course. I think about the best that could be done at this time, if client-side processing must be done, would be to leverage Intel's IME or AMD's equivalent and actually do the anti-cheat logic within that. A lot of people hate on IME (and similar things) due to the privacy and security implications, but this is definitely one task that it would be well suited to. Surprisingly I haven't seen any companies go for this approach--possibly because IME and such are heavily, heavily locked down and a lot of process is involved in even getting anything to run on it (all code is encrypted + signed, keys only known by Intel/AMD, etc). However, IME could easily be used to detect kernel-level hacks in the OS, including things like modded graphics drivers, rootkit-like things, etc. In order to bypass that, the attacker would need to obtain the keys to the IME themselves and load their code on the IME as well. There's no way for even kernel-level code to compromise the IME due to the isolation involved.