Server-side anticheat for standalone VR. It lands every time.
root · frida · repack · speedhack · vpn — all of it caught server-side
0 runtime dependencies
14 day free trial

What's covered

PlatformMeta Quest (2, Pro, 3, 3S)
MonitoringContinuous (native background thread)
EnforcementServer-controlled (severity floors, rules engine, ban waves)
EnginesUnity (IL2CPP). Unreal SDK available.
NetworkingMirror, Photon PUN2, custom (REST API)
EncryptionPer-build metadata encryption, obfuscated detection strings, challenge-response
AccessFree 14-day trial. Managed hosting, closed source.
StatusAvailable

The stack

Eight layers. Every one enforced server-side. Nothing trusts the client.
01
Native scanner
C library scans /proc, loaded modules, network interfaces, system properties. Obfuscated detection strings — string search finds nothing.
02
Challenge-response
Server sends a random token. Only the real, unpatched native library can answer. Patched scanner = wrong answer = flagged.
03
Build trust
Signing cert + native lib hashes verified against server-side trusted build list. Repackaged APK = instant ban.
04
VPN detection
Multi-signal: interface presence, default route, established connections. Graded severity, no false positives from Knox or dev VPNs.
05
Meta OVR attestation
Integrity token from Meta's DeviceApplicationIntegrity API. Server-side verification. Catch device tampering and ban evasion.
06
Memory guard
Checksummed game values + session honeypot. Memory editors detected on every heartbeat.
07
Speed hack detection
libc clock vs raw syscall clock vs server wall clock. Three independent time sources. Nothing slips through.
08
IL obfuscator
Renaming, string encryption, control flow, fake code, external safety. Ships with the anticheat.

Set up in sixty seconds

One CLI command creates your game. One component in your scene starts enforcement. Zero configuration to go live.
blackspear — zsh
$ npm run cli -- create-game "My VR Game"

game id:    game_b06f1bf0
client key: hk_client_519df93c55a1...
admin key:  hk_admin_d89c844c... (shown once)

$ npm start

blackspear server listening on http://0.0.0.0:8080
dashboard: http://localhost:8080/dashboard
BlackspearSetup.cs
C# · UTF-8Ln 1

What it catches

Real detection codes from the server catalog. Enforced server-side with severity floors — a tampered client can't downgrade a critical.
hook/frida_maps
Frida mapped in process
Frida agent, gadget, or gum-js-loop detected in /proc/self/maps or thread names.
server/cert_mismatch
Repackaged APK
APK signed with a different certificate than the trusted build. Instant ban.
server/lib_hash_mismatch
Modified native library
libil2cpp.so, libunity.so, or libblackspear.so hash doesn't match the trusted build.
server/honeypot_modified
Memory editor
Session honeypot value changed in memory. Checked every heartbeat.
speedhack/clock_drift
Speed hack
Client boot clock diverging from server wall clock beyond tolerance.
server/challenge_failed
Patched scanner
Native challenge-response token answered incorrectly. Scanner was patched out.
hook/libc_inline_hook
Inline hook
ARM64 B or BR Xn instruction at libc function entry. Hook framework detected.
server/clock_drift
Server-side clock check
Client elapsed time vs server wall clock. Ratio above tolerance flagged.
memory/secure_value_mismatch
Protected value tamper
Checksummed game value modified without re-signing.
env/vpn_active
VPN detected
Multi-signal: tun/tap/ppp interface + default route + established connections.
server/ovr_failed
Attestation failed
Meta integrity token verification failed. Device or app not trusted.
server/ovr_nonce_mismatch
Attestation replay
OVR attestation nonce doesn't match server-issued value. Replay detected.
server/check_missing
Checks went silent
Server ordered integrity checks; the heartbeat answered none of them. Three missed cycles kick.
server/receipt_invalid
Forged receipt
Receipt nonce, run result, or digest failed verification. A patched SDK can't fake a check it never ran.
server/ghost_answered
Ghost fabrication
The server ordered a check that does not exist and the client ran it anyway. Instant ban.

Under the hood

Three layers. The client scans and reports. The server decides. The game enforces. No single point of trust in the client.
Native
libblackspear.so
Obfuscated strings, /proc scans, module enumeration, VPN detection, library hashing, challenge-response. Background thread.
Client SDK
BlackspearClient
Unity component or Unreal subsystem. Polls scanner, signs heartbeats, reports detections, enforces server verdicts.
Server
Blackspear Server
Zero-dependency Node.js. Verifies signatures, enforces rules with severity floors, tracks builds, issues bans, verifies OVR tokens. The only authority.
Game
Your game
Receives a verdict: allow, kick, or ban. Mirror authenticator and Photon integration included.

Plugs into your netcode

Drop-in components. No custom protocol to implement.
Mirror
NetworkAuthenticator that verifies every connection against the server before spawn. Host policy component for periodic re-verification.
Photon PUN2
Host verifies every player via /v1/peer/verify. Client auto-disconnects on ban or kick. Identity wired to Photon userId.
Unity IL2CPP
Native arm64-v8a plugin. Works out of the box with IL2CPP builds. Graceful fallback if the library fails to load — which is itself a detection.
Unreal Engine
C++ plugin with the same wire protocol. Session lifecycle, detection reporting, punch physics system included.
Dedicated server
POST /v1/verify with your admin key before accepting a player into gameplay. Full session status and risk score.
CI/CD
Obfuscator CLI with --prove behavioral verification and SHA-256 output hash. Register the hash as a trusted build in one command.

The $600 one vs this

Feature matrix. Not marketing — check the source.
BlackspearTomahawkGUPS Anti-CheatACTk
Server-side enforcement
Native scanner (C, arm64)
Obfuscated detection strings
Challenge-response?
Build trust / anti-repack
VPN detection (multi-signal)
Meta OVR attestation
Speed hack detection
Memory guard
Metadata encryption
Mirror integration
Photon integration
Unreal Engine SDK
IL obfuscator included
Free trial???
Price$49/mo$600/mo~$150~$40

Pricing

No sales call. No seat count. No per-CCU surprise bill.
Free trial
$0/14 days
Every feature, 14 days. No card.
  • Server + client + native plugin
  • IL obfuscator
  • Mirror + Photon + Unreal integrations
  • Admin dashboard
  • Metadata encryption
  • VPN detection

What's next

Public changelog. Done means shipped.
01
Server + Unity SDK + native plugin
Session lifecycle, heartbeat, detections, rules engine, dashboard, CLI, challenge-response, build trust, VPN detection, OVR attestation, metadata encryption
Live
02
IL obfuscator
Renaming, string encryption, control flow, fake code, External Impact Analysis, --prove behavioral verification, SHA-256 output hash
Live
03
Mirror + Photon integrations
Authenticator, host policy, peer verification, identity wiring
Live
04
Unreal Engine SDK
C++ plugin with the same wire protocol and punch physics system
Live
05
Ban wave system
Queue detections, ban in batches on a schedule. Cheat devs can't correlate patches with bans.
Planned
06
Replay capture
Record 30 seconds of head/hand positions when a detection fires. Watch the cheat in action.
Planned
07
Team roles
Owner, moderator, viewer. Scoped API keys per team member.
Planned
08
Webhook notifications
Discord/Slack alerts on ban. Real-time community moderation.
Planned
09
Device reputation
Device ID history across sessions. Auto-flag repeat offenders on new accounts.
Planned
10
Managed hosting
Hosted dashboard, automated build trust, per-title isolation.
In development
11
Native-signed receipts
libblackspear itself signs every integrity check receipt with the per-build key. Fake summaries stop being possible at the binary layer.
Planned

FAQ

What platforms does Blackspear support?

Meta Quest 2, Pro, 3, and 3S running Unity IL2CPP builds. Native plugin is arm64-v8a. Unreal Engine SDK available. PC VR and standalone iOS are on the roadmap.

How long does integration take?

One CLI command creates your game. One component in your scene starts enforcement. The native plugin is already compiled — drop it in. Most studios integrate in under an hour. Metadata encryption and challenge keys are optional add-ons.

How is pricing calculated?

Free for your first 14 days with every feature enabled. Managed hosting is $49/month flat after that. Tomahawk starts at $600/month.

Why is it closed source?

The server is the product. You get the full detection catalog, your own session data, and signed builds to verify every deploy. The source stays ours. Every SDK build is stamped with your key, so a leaked build points back to whoever leaked it.

What makes Blackspear different?

Three things: (1) The server is the only authority — client detections can't be trusted or bypassed. (2) The price: $49 flat instead of $600/month. (3) External Impact Analysis — the obfuscator proves it doesn't break your game before you ship.

Does it affect game performance?

The native scanner runs on a background thread. The C# SDK polls at a configurable interval (default: every heartbeat). No per-frame overhead. IL2CPP builds see zero measurable impact.

What happens when a cheater is detected?

The native scanner detects, the SDK reports, the server validates and applies your rules. You choose: flag (mark and monitor), kick (end session), or ban (permanent or timed, with optional device ban). Metadata encryption prevents reverse engineering. Challenge-response catches patched scanners.

Does it work with Photon?

Yes. The SDK runs independently of your networking solution. It catches device-level cheating (root, Frida, mod menus, repackaged APKs) regardless of whether you use Photon, Mirror, or custom networking. For full game-action validation, use Mirror with a dedicated server.

Is the obfuscator safe to use?

Yes. External Impact Analysis scans your other assemblies and auto-keeps anything they reference, so renames can't break cross-assembly calls. The CLI's --prove check compares the obfuscated build against the original before you ship.

Get started

Start free for 14 days, or tell us what you're building and we'll help you integrate.