MU Services GameGuard

MU Services GameGuard is a professional Windows AntiCheat and monitoring system built specifically for MU Online private servers, supporting environments from classic 97d versions up to modern Season 20-21 builds.

The system was originally built, tested, and mainly operated around IGCN Season 20-21 servers, while still being flexible enough to handle different main.exe versions, client structures, launcher setups, and server environments with the proper configuration.

It can also be configured for multiple MU Online servers hosted on the same computer, allowing separate projects or server environments to be monitored from the same machine when the setup is prepared correctly.

GameGuard was built from real MU Online administration work, not theory. It focuses on client integrity, launcher control, multi-client behavior, suspicious tool detection, process monitoring, screenshot verification, live reporting, and AntiCheat connection enforcement.

• MU Online client integrity protection
• Cheat and dangerous tool detection
• DLL killer and Cheat Engine focused detection methods
• Process monitoring and screenshot verification
• Remote blacklist updates
• Server-side reporting and live administrator control
• AntiCheat connection enforcement
• Low CPU usage design that is not noticeable to normal players

The system includes a Windows server-side reporter application that receives live AntiCheat reports from connected players. The reporter gives the server owner one central place to monitor who is connected, who is reporting correctly, and who may be suspicious.

One of the strongest protections is comparing watched game server TCP connections against AntiCheat reports. If an IP is connected to the game port but does not send valid AntiCheat reports within the configured time, it can be flagged as missing AntiCheat signal.

• Player public IP and machine identifier
• Game window prefix and active game window count
• Watched TCP connection status
• Reporter status and last AntiCheat report time
• Missing AntiCheat signal warnings
• Temporary anti-DoS bans
• Search and filter support by IP
• Detection of players trying to block or bypass the monitoring channel

The client-side AntiCheat module performs multiple checks to detect suspicious activity on the player machine. When a violation is detected, the AntiCheat can log the event, show a warning popup, and close the game client.

GameGuard also includes a dedicated dangerous tool watchdog designed to detect tools used for debugging, injection, DLL killing, memory editing, process manipulation, and cheat development.

• Suspicious processes and known cheat tool names
• Dangerous background tools, memory editors, and debuggers
• Suspicious services, drivers, named pipes, mutexes, and windows
• Dangerous handles to the game process
• Suspicious DLLs, modules, exports, and imports
• File hash blacklist and remote blacklist matches
• Detection layers that do not rely only on visible process names

The AntiCheat includes module scanning logic to inspect loaded DLLs inside the game process. This is important because many cheats work by injecting DLLs into the game process or loading modified libraries.

GameGuard can verify whether loaded modules are trusted, whitelisted, signed, or suspicious.

• Loaded module enumeration
• Trusted publisher checks
• Windows catalog signature checks
• System-folder DLL validation
• MD5 whitelist checks
• Suspicious DLL detection
• Suspicious export and import checks
• Optional full and incremental DLL scan modes

The reporter can send remote blacklist updates to connected clients, allowing the server owner to update cheat detection rules without rebuilding the full AntiCheat client every time a new cheat tool appears.

Administrators can also request a process list, file hashes, or a screenshot from selected clients when suspicious behavior appears.

• Remote EXE name blacklist
• Remote DLL name blacklist
• Remote SHA-256 blacklist
• Reload remote blacklist from the reporter menu
• Running process names, exact paths, and loaded DLL files
• MD5 and SHA-256 file hash requests
• Administrator-requested screenshot verification
• Screenshot transfer validation, size limits, speed limits, timeout, retry window, and logging

GameGuard can enforce launcher binding so the game client must start through the expected launcher flow before the AntiCheat allows normal operation.

The client-side AntiCheat can also enforce communication with the reporter server. If the AntiCheat cannot connect to the configured reporter host continuously for the configured failure window, it can close the game client.

• Reduces direct main.exe launching
• Helps stop unauthorized startup methods
• Protects against disabled reporting
• Protects against broken monitoring channels
• Detects players connected to the game but invisible to the admin panel
• Keeps the AntiCheat alive while the player is in game

MU Online players often run multiple game windows. Instead of making every game window perform heavy scans independently, the system includes a global scanner ownership model.

One game process can act as the global scanner owner while the system maintains heartbeat and takeover logic. This reduces unnecessary CPU load while keeping protection active.

• Global scanner ownership
• Shared scanner state
• Heartbeat tracking
• Automatic scanner takeover if the owner exits
• Scoped names based on the game folder
• Controlled scan intervals
• Cached file hash and publisher checks
• Better behavior for multi-client users

A bad AntiCheat can harm the player experience if it freezes, crashes, or overloads the client. GameGuard includes stability safeguards to protect the server without making normal players suffer.

The server-side reporter also includes protection against connection abuse, helping keep the AntiCheat monitoring port stable if someone tries to spam or flood it.

• Worker thread protection and supervisor recovery
• Try/catch handling around important loops
• Low-priority reporting thread
• Throttled DLL scans
• Non-blocking warning popup
• Multi-sweep game close logic when enforcement is required
• Maximum active connections and new connections per IP
• Temporary IP ban system and automatic cleanup of expired bans
• Maximum reads and bytes per second per IP

GameGuard is designed to be applied without turning your whole server setup upside down. For a normal MU Online installation, the flow is simple: provide the protected client files to players, start the reporter on the server, and begin monitoring live AntiCheat reports.

Players receive a new protected main.exe with the AntiCheat DLL included in the client package. On the server side, you run the GameGuard reporter application and configure the expected connection/reporting settings for your project.

Once everything is in place, the reporter gives you immediate visibility over connected players, reporting status, watched TCP state, process investigations, screenshot requests, and missing AntiCheat signal warnings.

• Ship a protected main.exe and AntiCheat DLL to players
• Start the server-side GameGuard reporter application
• Configure reporter host, protected flow, and watched server ports
• Use the existing MU Online launcher/client distribution process
• Begin monitoring players from the reporter panel after setup
• Request screenshots, process lists, MD5, or SHA-256 checks when needed

GameGuard is built around MU Online private server needs: launcher flow, multi-client behavior, game window monitoring, server port monitoring, and daily private server administration.

For MU Online, it is a ready protection system. Other Windows games may be possible only after custom technical review because every game has different executable behavior, launcher flow, connection method, protected ports, window names, allowed files, modules, and false-positive risks.

If you want GameGuard reviewed for another Windows game, contact MU Services with your project details first so we can check whether proper integration is possible.

• MU Online client protection
• MU Online launcher flow support
• MU Online multi-client behavior support
• MU Online game window monitoring
• MU Online server port monitoring
• Custom review possible for other Windows games

Private servers are constantly targeted by players using unfair tools, modified clients, injected DLLs, memory editors, bypass tools, packet tools, and suspicious background applications.

Many servers only rely on basic client files or weak launcher checks. That is not enough anymore. A serious server needs to know whether the player is really running the AntiCheat, whether the client is reporting correctly, and whether dangerous tools are running in the background.

MU Services GameGuard is built to answer those questions in real time.

• Detects players connected without valid AntiCheat reporting
• Identifies suspicious processes and background tools
• Checks for injected or untrusted DLL modules
• Helps detect modified clients and suspicious files
• Lets administrators request proof from the player machine
• Gives server owners real visibility before cheaters damage gameplay