Detections & Preventions

A full list of detections & preventions are as follows:

Detections:

Integrity checks on .text, .rdata, and sections on disc file vs. loaded image (current process)
Manual mapped module checks (both PE headers & erased headers)
TLS callback structure modification checks (check if someone modified the address of the callback routine)
IAT modification checks (IAT entry's routine points to an unknown module)
Re-re-mapping checks (check if someone remapped sections after we already remapped it)
Function preamble "jmp" checks on certain routines such as ws2_32.send & ws2_32.recv
Integrity checks on sections of WINTRUST.dll (check if someone is manipulating cert check routines)
Scans newly created processes for blacklisted byte patterns
Check if any pages within .text have write permissions
DLL load callback/notifications, newly loaded modules are cert checked
Detect new threads via TLS callback

Simple IsDebuggerPresent call
PEB structure BeingDebugged check
Hardware debugger checks (check debug registers)
CloseHandle() with invalid handle (check if any debugger handles the generated exception)
DebugPort flag check via NtQueryInformationProcess
Process Debug Flags check via NtQueryInformationProcess
Kernel debugger: shared memory (_KUSER_SHARED_DATA) check (KdDebuggerEnabled field)
Kernel debugger: NtQuerySystemInformation with SystemKernelDebuggerInformation (35)
Heap flags check (heap force flags)
CheckRemoteDebuggerPresent on current process
Cheat Engine "VEH debugger" checks (look for loaded vehdebug-x86_64.dll module into our process)

Monitors new process creation
Detects open process handles to our process
Check window names & text of processes (not recommended in a live setting, large false positive risk)
Blacklisted process check by name

Secure boot check
Check if Windows is in "Test signing mode" (driver signature enforcement)
Hypervisor checks
Registry value modification monitoring (only monitors a couple currently, related to DeviceGuard & Secure Boot)
Server-client heartbeat to check if a client is running the program

User APC blocking via undocumented ntdll.Ordinal8 patching
Sections remapping with SEC_NO_CHANGE
Spoofing NumberOfSections in PE header at runtime
Module name randomization at runtime (UltimateAnticheat.exe -> dsfWEF1@45^dsf)
Prevent new threads from being created if their start address isn't in a legitimate module (patch over their start address with a ret, Windows 10 only)
Check return address of certain routines to prevent remote calling/spoofing
Protects the program's Settings class object from being modified/written to at runtime by making use of my project: RemapProtectedClass

Closes known debuggers by creating a remote thread on their ExitProcess routine
Stops debuggers from attaching to program threads by calling NtSetInformationThread with ThreadHideFromDebugger for each thread
Patches over initializeVEH export routine in vehdebug-x86_64.dll
Mitigation policies (may or may not work depending on your OS build)