Skip to content

Add rules for AntiCheat.TheiaAntiTamper #898

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Sep 8, 2025
Merged

Add rules for AntiCheat.TheiaAntiTamper #898

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
53c8b63
Add rules for AntiCheat.TheiaAntiTamper
thug-shaker Sep 8, 2025
50de37f
Rename AntiCheat.TheiaAntiTamper to AntiCheat.TheiaAntiTamper.txt
thug-shaker Sep 8, 2025
c3f44f3
Update rules.ini
thug-shaker Sep 8, 2025
07dae6c
Remove _s pattern from tests
thug-shaker Sep 8, 2025
72ecc91
Update rules.ini Remove _s pattern
thug-shaker Sep 8, 2025
6a795c4
Shorten description
thug-shaker Sep 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions descriptions/AntiCheat.TheiaAntiTamper.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Theia is an anti-tamper system developed by [**ZeroITLab**](https://zeroitlab.com/).
Theia provides detections for tools commonly used to reverse engineer games such as IDA Pro, X64DBG and pe-bear.
1 change: 1 addition & 0 deletions rules.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,6 +254,7 @@ PunkBuster[] = (?:^|/)pbsv\.dll$
PunkBuster[] = (?:^|/)Punkbuster(?:$|/)
Ricochet = (?:^|/)Randgrid\.sys$
TenProtect = (?:^|/)TP3Helper\.exe$
TheiaAntiTamper = (?:^|/)preloader(?:_l)?\.dll$
XIGNCODE3 = \.xem$

[SDK]
Expand Down
8 changes: 8 additions & 0 deletions tests/types/AntiCheat.TheiaAntiTamper.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
/preloader.dll
/preloader_l.dll
preloader.dll
preloader_l.dll
Win64/preloader.dll
Win64/preloader_l.dll
Sub/Win64/preloader.dll
Sub/Win64/preloader_l.dll
Loading