A small PowerShell script that runs the same Layer 1 and Layer 3 platform checks a protected game performs at launch, and tells you what would pass, what would warn, and what would block you — before you're in a lobby.
A zip with one PowerShell script, a double-click launcher, and a README. It reads system state that Windows already exposes, prints a table, and writes a JSON report next to itself. Nothing is installed and nothing leaves your machine.
Free, offline, MIT-licensed. Also listed on the Downloads page with the signed SHA256SUMS.txt if you want to verify it independently.
Version and checksum are read from the release manifest at load. If they don't match what the Downloads page shows, don't run it — tell us at security@arsenalrx.dev.
The script is plain text. Read it before you run it — that's the point of shipping it as a script rather than an executable.
Windows PowerShell 5.1 ships with every supported Windows build, so there's nothing to install first. PowerShell 7 works too.
Right-click the zip → Extract All…. Any folder is fine; the script writes its report next to itself, so pick somewhere you can find again.
Double-click Run-ReadinessCheck.cmd, or open a PowerShell window in the folder and run the command below. The launcher just calls the script with the right flags and waits so the window stays open.
You get a table, a verdict, a short readiness code, and a link back to this page that decodes it. The full detail is in cerberus-readiness-report.json in the same folder.
# from the extracted folder
powershell -NoProfile -ExecutionPolicy Bypass -File .\Cerberus-ReadinessCheck.ps1
SmartScreen or "not digitally signed"? Files downloaded from the internet carry a Mark-of-the-Web, and Windows may refuse to run the script or show a SmartScreen prompt. The script isn't code-signed — it's a text file you can read. To clear the flag, run Unblock-File .\Cerberus-ReadinessCheck.ps1 in the folder (or tick Unblock in the file's Properties). -ExecutionPolicy Bypass in the command above only affects that one process; it doesn't change your system policy.
Run as administrator for full coverage. Everything runs fine unelevated, but two checks (test-signing mode and the firmware-level Secure Boot confirmation) need admin rights and will show SKIP otherwise. SKIPs never change your verdict — they just mean "couldn't look". Re-run from an elevated PowerShell to fill them in.
These mirror the platform requirements in the documentation. Layer 1 checks concern the kernel environment the driver has to trust; Layer 3 checks concern the hardware and firmware attestation path. The last two are plain resource floors. Each check reads one or two Windows sources — registry, CIM/WMI, or PnP — and reports PASS, WARN, FAIL, or SKIP.
| # | Check | Why it matters |
|---|---|---|
| Loading check definitions… | ||
Verdict rule. Any FAIL → NOT READY. Otherwise any WARN → READY WITH WARNINGS. Otherwise READY. SKIP is ignored. The script's exit code follows the same rule (0 / 1 / 2), so you can call it from your own tooling.
We're asking you to run a script from an anti-cheat vendor on your own PC, so this deserves to be explicit rather than implied.
You don't have to take our word for it. The script uses none of the PowerShell or .NET APIs that can open a connection, and the build refuses to package it if that ever changes. Run this from the extracted folder — it should print nothing:
Select-String -Path .\Cerberus-ReadinessCheck.ps1 -Pattern 'Invoke-WebRequest|Invoke-RestMethod|System\.Net|WebClient|HttpClient|Sockets|Start-Process|ComputerName|Test-Connection'
If you'd rather not run anything, the readiness code you paste into the decoder below is processed entirely in your browser — this page makes no requests with it either.
The script prints a code like CRC1-XXXX-XXXX-XXXX. Paste it here (or share it with a support person) to see the 14 check results and what to do about each. Decoding happens in your browser; nothing is sent anywhere.
Codes are Crockford base32 — O, I and L are accepted and read as 0 and 1. Dashes and spaces are optional. Links of the form /readiness/#code=… decode automatically.
A code only carries the status of each check and a few coarse buckets — the exact build number, driver list and other detail is in the JSON report on the machine that ran the script. If a check fails and the guidance doesn't get you there, the requirements page has the longer version, and Known Issues lists hardware we know about.
mbr2gpt converts in place if it isn't).bcdedit) for test-signing mode, and the firmware Secure Boot query (Confirm-SecureBootUEFI). Unelevated, those show SKIP and the script says so. Elevation gives it no extra reach beyond those reads; it still writes nothing but its own report.Every public artifact, its checksum, and the signed SHA256SUMS you can verify in the browser.
Browse downloads →The full platform requirements the check is derived from, with the reasoning behind each one.
Read the docs →If you've been flagged in a protected title and believe it's wrong, this is where to start.
Open an appeal →