Cerberus Readiness Check

A zip with one PowerShell script, a double-click launcher, and a README. It reads system state that Windows already exposes, prints a table, and writes a JSON report next to itself. Nothing is installed and nothing leaves your machine.

Readiness Check 1.0.0

No account required

Free, offline, MIT-licensed. Also listed on the Downloads page with the signed SHA256SUMS.txt if you want to verify it independently.

File
cerberus-readiness-check-1.0.0.zip
Size
see Downloads page
Released
2026-09
Requires
Windows 10 21H2 (build 19044) or later, or Windows 11 · x64 · Windows PowerShell 5.1 (built in)
SHA-256
published in /downloads/SHA256SUMS.txt

Version and checksum are read from the release manifest at load. If they don't match what the Downloads page shows, don't run it — tell us at security@arsenalrx.dev.

What's in the zip

  • Cerberus-ReadinessCheck.ps1 the script
  • Run-ReadinessCheck.cmd double-click launcher
  • README.md usage, checks, privacy
  • LICENSE.txt MIT
  • SHA256SUMS.txt in-zip checksums

The script is plain text. Read it before you run it — that's the point of shipping it as a script rather than an executable.

Three steps, no installer

Windows PowerShell 5.1 ships with every supported Windows build, so there's nothing to install first. PowerShell 7 works too.

STEP 1

Extract the zip

Right-click the zip → Extract All…. Any folder is fine; the script writes its report next to itself, so pick somewhere you can find again.

STEP 2

Run it

Double-click Run-ReadinessCheck.cmd, or open a PowerShell window in the folder and run the command below. The launcher just calls the script with the right flags and waits so the window stays open.

STEP 3

Read the result

You get a table, a verdict, a short readiness code, and a link back to this page that decodes it. The full detail is in cerberus-readiness-report.json in the same folder.

# from the extracted folder
powershell -NoProfile -ExecutionPolicy Bypass -File .\Cerberus-ReadinessCheck.ps1
⚠️

SmartScreen or "not digitally signed"? Files downloaded from the internet carry a Mark-of-the-Web, and Windows may refuse to run the script or show a SmartScreen prompt. The script isn't code-signed — it's a text file you can read. To clear the flag, run Unblock-File .\Cerberus-ReadinessCheck.ps1 in the folder (or tick Unblock in the file's Properties). -ExecutionPolicy Bypass in the command above only affects that one process; it doesn't change your system policy.

🔐

Run as administrator for full coverage. Everything runs fine unelevated, but two checks (test-signing mode and the firmware-level Secure Boot confirmation) need admin rights and will show SKIP otherwise. SKIPs never change your verdict — they just mean "couldn't look". Re-run from an elevated PowerShell to fill them in.

Fourteen checks, in the order the engine runs them

These mirror the platform requirements in the documentation. Layer 1 checks concern the kernel environment the driver has to trust; Layer 3 checks concern the hardware and firmware attestation path. The last two are plain resource floors. Each check reads one or two Windows sources — registry, CIM/WMI, or PnP — and reports PASS, WARN, FAIL, or SKIP.

#CheckWhy it matters
Loading check definitions…
ℹ️

Verdict rule. Any FAIL → NOT READY. Otherwise any WARN → READY WITH WARNINGS. Otherwise READY. SKIP is ignored. The script's exit code follows the same rule (0 / 1 / 2), so you can call it from your own tooling.

What the script does and doesn't do

We're asking you to run a script from an anti-cheat vendor on your own PC, so this deserves to be explicit rather than implied.

  • Makes no network calls of any kind — no update check, no "phone home", no DNS lookups
  • Sends no telemetry to Cerberus or anyone else
  • Does not record your computer name, user name, serial numbers, MAC or IP addresses
  • Does not record driver names — the third-party driver check stores a count only
  • The JSON report stays on disk, next to the script, until you delete it
  • The readiness code encodes 14 statuses plus coarse buckets (RAM, disk, driver count, TPM, OS class) — nothing that identifies a machine
  • Installs nothing, changes no settings, and leaves no scheduled task or service behind
  • Needs no account, key, or partner relationship

You don't have to take our word for it. The script uses none of the PowerShell or .NET APIs that can open a connection, and the build refuses to package it if that ever changes. Run this from the extracted folder — it should print nothing:

Select-String -Path .\Cerberus-ReadinessCheck.ps1 -Pattern 'Invoke-WebRequest|Invoke-RestMethod|System\.Net|WebClient|HttpClient|Sockets|Start-Process|ComputerName|Test-Connection'

If you'd rather not run anything, the readiness code you paste into the decoder below is processed entirely in your browser — this page makes no requests with it either.

Decode a readiness code

The script prints a code like CRC1-XXXX-XXXX-XXXX. Paste it here (or share it with a support person) to see the 14 check results and what to do about each. Decoding happens in your browser; nothing is sent anywhere.

Codes are Crockford base32 — O, I and L are accepted and read as 0 and 1. Dashes and spaces are optional. Links of the form /readiness/#code=… decode automatically.

A code only carries the status of each check and a few coarse buckets — the exact build number, driver list and other detail is in the JSON report on the machine that ran the script. If a check fails and the guidance doesn't get you there, the requirements page has the longer version, and Known Issues lists hardware we know about.

Common questions

Why does Cerberus care about Secure Boot?
Layer 3 attests the boot chain — firmware, boot manager, kernel — before it trusts anything the kernel reports about itself. Without Secure Boot there's no signed chain to measure, so a tampered boot component is indistinguishable from a clean one and the attestation has nothing to stand on. It's the single most common FAIL we see on otherwise capable PCs, and it's usually a two-minute fix in firmware setup: enable Secure Boot, disable CSM/legacy boot, and make sure the system disk is GPT (mbr2gpt converts in place if it isn't).
Is a TPM required?
No. A TPM 2.0 lets Layer 3 verify boot measurements independently, which raises confidence in the attestation, but a machine without one is still supported at reduced coverage — it's a WARN, not a FAIL. Most desktop boards since roughly 2017 have a firmware TPM (AMD fTPM / Intel PTT) that just needs enabling in firmware setup. TPM 1.2 is treated the same as absent for attestation purposes.
Can I play inside a virtual machine?
No. Cerberus can't attest hardware it can't see, and a VM is exactly the environment where DMA and hypervisor-level cheats hide. Protected titles refuse to launch when the platform reports itself as VMware, VirtualBox, QEMU/KVM, Xen, Parallels or Hyper-V guest. Note this is about running inside a VM — having Hyper-V or WSL2 installed on a physical machine is fine and is in fact what VBS relies on.
Why does it ask for administrator rights?
It doesn't require them — it runs fully unelevated and the verdict is valid either way. Two sources are only readable when elevated: the boot configuration (bcdedit) for test-signing mode, and the firmware Secure Boot query (Confirm-SecureBootUEFI). Unelevated, those show SKIP and the script says so. Elevation gives it no extra reach beyond those reads; it still writes nothing but its own report.
Does it install anything or change settings?
No. It's a script, not an installer. It reads registry keys, CIM/WMI classes and PnP device state, prints a table, and writes one JSON file next to itself. It doesn't create services, scheduled tasks, registry values, or files anywhere else, and it doesn't modify the settings it checks. Delete the folder and it's gone.
I got a DMA Protection warning on a laptop or with an eGPU. Is that a problem?
Usually not on its own. The check reports whether Kernel DMA Protection is available, not whether every port enforces it, and many laptops with Thunderbolt/USB4 ports report it as unavailable or partially available depending on firmware. External GPUs over Thunderbolt are a known rough edge for Layer 3 — the engine treats them conservatively, and we track affected configurations under Known Issues. If you hit a false flag in a protected title, the appeal form is the right route; include your readiness code.
What Windows versions are supported?
Windows 10 21H2 (build 19044) or later and Windows 11, x64 only. Older Windows 10 builds are out of Microsoft's own servicing window and lack kernel interfaces Layer 1 depends on. Windows Server and ARM64 (including Windows on Arm and Apple silicon under any hypervisor) are not supported. Insider builds generally work but aren't tested.