Cerberus SDK Documentation

Integrate Cerberus anti-cheat into your game in under 2 hours.

Quick Start

Cerberus ships as a single static library (cerberus_sdk.lib) and a header file. The SDK handles all communication with the Cerberus kernel driver — your game code only needs to initialize, start a session, and listen for callbacks.

Cerberus is currently in closed beta. You'll need an API key from your partner dashboard to initialize the SDK.

C++ — Minimal integration

// 1. Include the SDK header
#include "cerberus_sdk.h"

// 2. Initialize on game launch
CerberusConfig config = {};
config.apiKey       = "crb_live_xxxxxxxxxxxxxxxx";
config.gameId       = "your-game-id";
config.enableAI     = true;   // Layer 2: Behavioral AI
config.enableHW     = true;   // Layer 3: Hardware fingerprinting
config.banCallback  = OnPlayerBanned;

CerberusResult result = Cerberus_Init(&config);
if (result != CERBERUS_OK) {
    // Handle init failure — game can still run (graceful degradation)
    Log("Cerberus init failed: %d", result);
}

// 3. Start session when player joins match
Cerberus_StartSession(playerId, matchId);

// 4. End session when match ends
Cerberus_EndSession();

// 5. Shutdown on game exit
Cerberus_Shutdown();

C# / Unity — Minimal integration

// 1. Import the SDK
using Cerberus.SDK;

// 2. Initialize on game launch
public class AntiCheatManager : MonoBehaviour {
    void Start() {
        CerberusSDK.Init(new CerberusConfig {
            ApiKey   = "crb_live_xxxxxxxxxxxxxxxx",
            GameId   = "your-game-id",
            EnableAI = true,   // Layer 2: Behavioral AI
            EnableHW = true,   // Layer 3: Hardware fingerprinting
            OnBan    = HandleBan
        });
    }

    // 3. Start session when player joins match
    void OnMatchStart(string playerId, string matchId) {
        CerberusSDK.StartSession(playerId, matchId);
    }

    // 4. End session when match ends
    void OnMatchEnd() {
        CerberusSDK.EndSession();
    }

    // 5. Shutdown on game exit
    void OnDestroy() => CerberusSDK.Shutdown();

    // Detection callback — fires when a player is banned mid-session
    void HandleBan(BanEvent e) {
        Debug.Log($"Player {e.PlayerId} banned: {e.Reason} ({e.Confidence:P0})");
        NetworkManager.Singleton.DisconnectClient(e.PlayerId);
    }
}

Unreal Engine (C++) — Minimal integration

// 1. Add the module dependency (MyGame.Build.cs)
PublicDependencyModuleNames.Add("CerberusSDK");

// 2. Declare + initialize the subsystem on game launch
UCLASS()
class UCerberusGameSubsystem : public UGameInstanceSubsystem {
    GENERATED_BODY()
public:
    virtual void Initialize(FSubsystemCollectionBase& Collection) override {
        FCerberusConfig Config;
        Config.ApiKey    = TEXT("crb_live_xxxxxxxxxxxxxxxx");
        Config.GameId    = TEXT("your-game-id");
        Config.bEnableAI = true;   // Layer 2: Behavioral AI
        Config.bEnableHW = true;   // Layer 3: Hardware fingerprinting

        Init(Config);
        OnPlayerBanned.AddDynamic(this, &UCerberusGameSubsystem::HandleBan);
    }

    // Detection callback — fires when a player is banned mid-session
    UFUNCTION()
    void HandleBan(const FCerberusBanEvent& Event) {
        UE_LOG(LogTemp, Warning, TEXT("Player %s banned: %s"), *Event.PlayerId, *Event.Details);
    }
};

// 3. Start session when player joins match
void AMyGameMode::BeginPlay() {
    Super::BeginPlay();
    UCerberusGameSubsystem* Cerberus = GetGameInstance()->GetSubsystem<UCerberusGameSubsystem>();
    Cerberus->StartSession(PlayerState->GetUniqueId(), MatchId);
}

// 4. End session when match ends
void AMyGameMode::HandleMatchEnd() {
    GetGameInstance()->GetSubsystem<UCerberusGameSubsystem>()->EndSession();
}

// 5. Shutdown is handled automatically when the GameInstance subsystem is destroyed

Rust — Minimal integration

// 1. Add the crate and import the SDK
use cerberus_sdk::{CerberusConfig, CerberusResult};

fn main() {
    // 2. Initialize on game launch
    let config = CerberusConfig::new("crb_live_xxxxxxxxxxxxxxxx", "your-game-id")
        .enable_ai(true)   // Layer 2: Behavioral AI
        .enable_hw(true)   // Layer 3: Hardware fingerprinting
        .on_ban(on_player_banned);

    let result = cerberus_sdk::init(&config);
    if result != CerberusResult::Ok {
        // Handle init failure — game can still run (graceful degradation)
        eprintln!("Cerberus init failed: {:?}", result);
    }

    // 3. Start session when player joins match
    cerberus_sdk::start_session(&player_id, &match_id);

    // 4. End session when match ends
    cerberus_sdk::end_session();

    // 5. Shutdown on game exit
    cerberus_sdk::shutdown();
}

// Detection callback — fires when a player is banned mid-session
fn on_player_banned(event: &BanEvent) {
    println!("Player {} banned: {} ({:.1}% confidence)", event.player_id, event.details, event.confidence * 100.0);
}

System Requirements

Developer / Studio Requirements

Visual Studio 2019+ or compatible C++ compiler (MSVC v142+)
.NET 6.0+ for C# bindings (Unity integration)
Unreal Engine 5.1+ for UE plugin
Partner dashboard account + API key

Player / End-User Requirements

Players running games protected by Cerberus need:

OS: Windows 10 21H2+ or Windows 11 (x64 only). The v0.6 driver requires 21H2; titles on the 0.5.x beta channel still support 20H2 until 2026-12-01
BIOS — Secure Boot: Must be enabled. Required for hardware verification (Layer 3). Check: msinfo32 → "Secure Boot State" should show "On"
BIOS — TPM 2.0: Recommended — enables boot-chain attestation (Secure Boot state, ELAM measurements, PCR 7/11 quotes) on the v0.6 driver; sessions without it fall back to driver-only attestation. Most modern systems have this enabled by default
Windows Update: System must be on a supported Windows build. Outdated builds may fail driver signature verification
GPU Drivers: Up to date. Outdated GPU drivers can trigger false positives on overlay detection
No unsigned drivers: Systems with test-signing mode enabled (bcdedit /set testsigning on) will be flagged
Virtualization: Running inside a VM (VirtualBox, VMware, Hyper-V) is not supported for competitive multiplayer. Cerberus will detect and flag virtualized environments

Players do NOT need to change any BIOS settings beyond enabling Secure Boot. No manual TPM configuration, no VT-x/AMD-V changes, no special setup. If Secure Boot is already on (default on most PCs sold after 2016), the player is ready.

Not sure whether a player's PC qualifies? Point them at the free Readiness Check — no account, no network access.

Platform Coverage

Cerberus is Windows PC only today (Windows 10 21H2+ / Windows 11, x64). We don't have a console (PlayStation, Xbox, Switch) or mobile SDK yet — if your title ships cross-platform, Cerberus currently only covers the PC player base, not console/mobile lobbies. Console support is on our long-term roadmap but has no committed timeline in closed beta; if that's a blocker for your integration, reach out and we'll talk through options.

Installation

There are two packages. The evaluation package is a public download — no account, no key, no driver — and is enough to write and compile a complete integration. The partner runtime adds the signed driver and the production libraries and is delivered through the partner portal once your API key is issued. The header and the API are identical in both, so nothing in your integration changes when the runtime is swapped in.

Evaluation package (public, no account)

Shell

# Download from /downloads/ — no account required
cerberus-sdk-eval-0.6.0.zip

# Contents:
cerberus-sdk-eval-0.6.0/
├── include/
│   └── cerberus_sdk.h              # The complete public API (C99 / C++17)
├── src/
│   └── cerberus_eval_stub.cpp      # Evaluation runtime — compiles and runs, detects nothing
├── bindings/
│   ├── csharp/
│   │   └── Cerberus.cs             # .NET 8 / Unity P/Invoke binding
│   └── rust/                       # cargo crate wrapping the same entry points
├── examples/
│   ├── cpp/                        # minimal.cpp, session_loop.cpp — buildable
│   ├── unreal/                     # CerberusSubsystem.h/.cpp — illustrative
│   └── unity/                      # CerberusManager.cs — illustrative
├── CMakeLists.txt
├── package.json
├── CHANGELOG.md
├── EVALUATION-LICENSE.txt
├── README.md
├── THIRD_PARTY_NOTICES.txt
└── SHA256SUMS.txt                  # Checksums for every file in the archive

Partner runtime (partner portal)

Shell

# Delivered through the partner portal after key issuance — never published on this site
├── lib/
│   ├── cerberus_sdk.lib            # Production static library (Release)
│   └── cerberus_sdk_d.lib          # Debug build
├── bin/
│   └── cerberus_driver.sys         # Kernel driver (EV code-signed)
├── docs/
│   └── integration_guide.pdf
└── tools/
    └── cerberus-diag.exe           # Driver, key and hardware validation

Migrating to v0.6

v0.6.0.0a ships the second-generation kernel driver on a new alpha channel. Nothing changes for your title until you switch its driver channel in the partner dashboard (Settings → Driver Channel). The 0.5.x beta driver keeps receiving signature updates, and rollback is one click. When you do move, these are the changes that will break a 0.5.x integration:

Breaking: initialization is asynchronous, ban callbacks receive a struct, and the minimum SDK on the 0.6 channel is v0.5.0.0b. Players need Windows 10 21H2 or Windows 11. Most partners we tested with finished the migration in under an hour.

1. Asynchronous initialization

cerberus_init() used to block for up to 400 ms while the driver loaded. The gen-2 driver loads in ~140 ms but attestation now completes asynchronously, so initialization returns immediately and you wait for CERBERUS_EVT_READY before starting a session.

C++

// v0.5.x
CerberusResult r = cerberus_init(&config);
if (r == CERBERUS_OK) cerberus_session_start(&session);

// v0.6.x
cerberus_init_async(&config, [](CerberusEvent ev) {
  if (ev.type == CERBERUS_EVT_READY) cerberus_session_start(&session);
  if (ev.type == CERBERUS_EVT_ATTEST_FAILED) log_attestation(ev.attest);  // legacy fallback, session still allowed
});

2. Ban callback signature

OnBan now receives a CerberusBanInfo struct instead of a bare ban ID. The struct carries the 20-character appeal reference that you should surface on your ban screen so players can self-serve at cerberusac.dev/appeal.

C++

// v0.5.x
void OnBan(const char* banId);

// v0.6.x
void OnBan(const CerberusBanInfo& ban);
// ban.id               "ban_9f2c..."
// ban.appealReference  "CB-7K3QX-M9P2A-4HD8W"
// ban.layer            CERBERUS_LAYER_KERNEL | BEHAVIORAL | HARDWARE | NETWORK
// ban.confidence       0.0 - 1.0
// ban.attestation      signed per-session integrity report

3. Callback ABI v3

All callbacks are registered through cerberus_set_callbacks(&CerberusCallbacksV3). The v2 table still works for this release and logs a deprecation warning; it is removed in v0.7. C# and Rust bindings ship with the v3 table only.

4. New optional policies

config.requireIommu = true — flag sessions where DMA remapping is disabled instead of trusting them. Off by default in the alpha.
config.zeroFootprint = true — opt into the Zero-Footprint Mode preview. See KI-2026-018 before enabling on latency-critical titles.
config.attestationReport = true — attach the signed per-session attestation report to session.end webhooks.

5. Webhooks

Two new events, appeal.received and appeal.decided, fire for the appeal pipeline. The v1 payload format has been removed; every payload is signed and carries a replay nonce. If you verify signatures manually, read the nonce from X-Cerberus-Nonce and reject repeats.

6. Removed

Usermode-only scan mode. Every session requires the kernel driver.
32-bit process scanning. 64-bit game binaries only.
Windows 10 20H2 / 21H1 on the 0.6 channel.

Initialization

CerberusConfig

Parameter	Type	Description
apiKey	const char*	Your API key from the partner dashboard. Required.
gameId	const char*	Unique game identifier. Required.
enableAI	bool	Enable Layer 2 (behavioral AI). Default: true. Aegis+ tier required.
enableHW	bool	Enable Layer 3 (hardware fingerprinting). Default: true. Cerberus+ tier required.
scanInterval	uint32_t	Kernel scan interval in ms. Default: 2000. Min: 500.
aiSampleRate	uint32_t	Input sampling rate in Hz. Default: 1000. Range: 250-2000.
banCallback	CerberusBanFn	Called when a player is banned mid-session.
flagCallback	CerberusFlagFn	Called when a player is flagged for review (optional).
logLevel	CerberusLogLevel	LOG_NONE, LOG_ERROR, LOG_WARN, LOG_INFO, LOG_DEBUG.

Configuration

Cerberus can be configured at runtime. Common patterns:

C++

// Disable hardware scanning for singleplayer modes
Cerberus_SetOption(CERBERUS_OPT_HW_SCAN, false);

// Lower scan frequency for menu screens (save CPU)
Cerberus_SetOption(CERBERUS_OPT_SCAN_INTERVAL, 5000);

// Enable enhanced monitoring for ranked matches
Cerberus_SetOption(CERBERUS_OPT_AI_SAMPLE_RATE, 2000);
Cerberus_SetOption(CERBERUS_OPT_SCAN_INTERVAL, 500);

Callbacks

C++

void OnPlayerBanned(const CerberusBanEvent* event) {
    // event->playerId   — the banned player
    // event->reason     — CERBERUS_BAN_AIMBOT, _DMA, _INJECTION, etc.
    // event->confidence — 0.0 to 1.0
    // event->details    — human-readable description

    Log("Player %s banned: %s (%.1f%% confidence)",
        event->playerId,
        event->details,
        event->confidence * 100.0);

    // Kick the player from the match
    Game_KickPlayer(event->playerId, "Anti-cheat violation detected");
}

void OnPlayerFlagged(const CerberusFlagEvent* event) {
    // Player flagged but NOT banned — under enhanced monitoring
    // event->confidence will be between 0.30 and 0.95
    // No action needed — Cerberus handles escalation internally
    Analytics_Track("cerberus_flag", event->playerId);
}

Session Lifecycle

Always call Cerberus_EndSession() when a match ends. Orphaned sessions consume monitoring resources and may trigger false stale-session alerts.

Typical flow:

Cerberus_Init()          // Game launch — loads driver
  ├─ Cerberus_StartSession() // Match start — begins scanning
  │   ├─ ... gameplay ...
  │   ├─ Ban/Flag callbacks fire if needed
  │   └─ Cerberus_EndSession()  // Match end — stops scanning
  ├─ Cerberus_StartSession() // Next match...
  │   └─ Cerberus_EndSession()
  └─ Cerberus_Shutdown()     // Game exit — unloads driver

Ban API

Query and manage bans via the REST API. All endpoints require your API key in the Authorization header.

GET /api/v2/bans

List recent bans for your game.

Response (200 OK)

{
  "bans": [
    {
      "id": "ban_8f2a1b3c",
      "player_id": "steam_76561198012345678",
      "reason": "AIMBOT",
      "confidence": 0.992,
      "detection_layer": "AI",
      "hardware_id": "hw_a1b2c3d4e5f6",
      "timestamp": "2026-05-19T14:32:01Z",
      "session_id": "ses_9d8e7f6a"
    }
  ],
  "total": 847,
  "page": 1
}

POST /api/v2/bans/{ban_id}/appeal

Submit a ban appeal for manual review. Returns the review ticket ID.

Webhooks

Cerberus sends real-time webhook events to your configured endpoint. Configure webhooks in your partner dashboard.

Webhook payload — ban.created

{
  "event": "ban.created",
  "timestamp": "2026-05-19T14:32:01Z",
  "data": {
    "ban_id": "ban_8f2a1b3c",
    "player_id": "steam_76561198012345678",
    "reason": "DMA_EXTERNAL_READ",
    "confidence": 0.997,
    "layers_triggered": ["KERNEL", "HW"],
    "hardware_fingerprint": "hw_a1b2c3d4e5f6"
  }
}

Detection Evidence

When Cerberus detects a cheat, it captures a structured evidence package for review. This data is stored on the Cerberus backend and accessible through your partner dashboard.

What is collected on detection

Data	Scope	Description
Detection type	Always	Which detection layer triggered (KERNEL, AI, HW, NET) and the specific detection category (e.g., AIMBOT, INJECTION, DMA_READ)
Confidence score	Always	0.0-1.0 float representing detection certainty. Auto-ban threshold: 0.95+
Session snapshot	Always	Anonymized session metadata: game ID, session duration, region, SDK version
Hardware fingerprint	Layer 3	Hashed device identifiers for ban evasion tracking. No PII — hardware IDs are one-way hashed
Memory region info	Kernel	Address range, permissions (RWX), and module association of suspicious memory regions. Game memory content is NOT captured
Behavioral profile	AI	Statistical summary: aim correction speed, reaction time distribution, shot-placement distribution against the player baseline
Device audit log	Layer 3	List of enumerated PCIe devices and firmware verification results. Used to identify DMA boards
Network anomaly report	Layer 4 (NET)	Server-side traffic analysis summary: packet timing anomalies, impossible state transitions, and position desync indicators

Cerberus never captures game memory contents, screenshots, keystrokes, browsing data, or any PII. All hardware identifiers are one-way hashed before transmission. Evidence is retained for 90 days (configurable per partner) to support ban appeals.

Where evidence is stored

Detection evidence is processed locally on the player's machine and only the structured metadata is sent to the Cerberus API over TLS 1.3. Raw memory dumps or input recordings are never transmitted. Partners can access evidence through:

Partner Dashboard — visual timeline of detection events with evidence viewer
Ban API — GET /api/v2/bans/{id}/evidence returns the full evidence package as JSON
Webhooks — ban.created events include a summary; full evidence available via API

Event Types

Event	Trigger	Description
ban.created	Auto-ban	Player banned with >95% confidence
ban.appealed	Player action	Ban appeal submitted
flag.created	Threshold	Player flagged (30-95% confidence), under enhanced monitoring
flag.escalated	Auto	Flag escalated to manual review after re-analysis
flag.cleared	Auto/Manual	Flag cleared — player confirmed clean
session.start	SDK call	Cerberus session started for a player
session.end	SDK call	Session ended cleanly
hw.anomaly	Layer 3	Unrecognized or suspicious hardware detected

Unreal Engine Integration

For Unreal Engine projects, use the Cerberus plugin instead of the raw SDK:

// In your .Build.cs
PublicDependencyModuleNames.Add("CerberusSDK");

// In your GameInstance or GameMode
#include "CerberusSubsystem.h"

void AMyGameMode::BeginPlay() {
    UCerberusSubsystem* Cerberus = GetGameInstance()->GetSubsystem<UCerberusSubsystem>();
    Cerberus->StartSession(PlayerState->GetUniqueId(), MatchId);
}

Unity Integration

C# — Unity

using Cerberus.SDK;

public class AntiCheatManager : MonoBehaviour {
    void Start() {
        CerberusSDK.Init(new CerberusConfig {
            ApiKey = "crb_live_xxxxxxxxxxxxxxxx",
            GameId = "your-game-id",
            OnBan = HandleBan,
            OnFlag = HandleFlag
        });
    }

    void HandleBan(BanEvent e) {
        Debug.Log($"Player {e.PlayerId} banned: {e.Reason} ({e.Confidence:P0})");
        NetworkManager.Singleton.DisconnectClient(e.PlayerId);
    }

    void OnDestroy() => CerberusSDK.Shutdown();
}

FAQ

Does Cerberus run at boot?

No. The kernel driver loads only when your game launches and unloads when it exits. Cerberus has zero presence on the system outside of active game sessions.

What happens if a player is falsely banned?

Detections below the 95% confidence threshold are never auto-banned — they go to manual review. If a ban is appealed, our threat analyst team reviews the full session replay within 4 hours (Cerberus tier SLA). False positive rate in our current beta cohort is 0.14%.

Does Cerberus collect player data?

No PII is ever collected. Cerberus processes hardware IDs, input patterns, and memory state locally. Only detection events (ban/flag) with anonymized session metadata are sent to the API. Zero telemetry — we don't know what games your players play, how long they play, or anything else.

What kernel access does Cerberus need?

The driver requires kernel-mode access (ring-0) to monitor memory permissions, detect mapped drivers, and enumerate PCIe devices. The driver is EV code-signed and submitted for WHQL certification (pending). We plan to complete third-party security audits before public release.

Can I use Cerberus for singleplayer games?

Yes, but it's designed for competitive multiplayer. For singleplayer, you can use Layer 1 only (kernel integrity) at the free Argus tier to prevent save file tampering or achievement exploits.

What engines are supported?

Cerberus works with any Windows game that can link a C++ or C# library. We have first-class plugins for Unreal Engine 5.x and Unity 2022+. Custom engine integration takes 1-2 hours with the raw SDK.