KTP / Anti-Cheat / Field Client

What it sees

• Keyboard and mouse input — only while DoD is the active (foreground) window; the AC ignores your input the moment another program takes focus. The AC measures things like how fast you switch between A and D, how regular your clicks are, your mouse movement (both horizontal and vertical) and the on-screen position of your clicks, and your scroll-wheel input (to catch firing or crouching bound to the wheel). Stops the moment the session ends.
• Screenshots, every so often — taken at regular intervals during the session for admins to look at. Same Windows tool OBS uses to record gameplay. On fullscreen setups where the normal capture comes back black, the AC falls back to grabbing the whole monitor your game is on, then immediately crops to just the game window before anything is saved — only the game window is stored, never your other monitors or whatever else is on screen behind it. For each shot the AC also notes which window actually had focus at that instant — normally DoD; if you'd tabbed out, that window's title is recorded so a reviewer can see the game wasn't in focus. There's one setup that gives it trouble: "true" fullscreen (the exclusive kind, which DoD's older OpenGL video mode uses) running at a resolution that isn't your normal desktop resolution. In that mode Windows hands the whole screen over to the game, and no safe screenshot method can read it — so shots come through sometimes and not others. The AC keeps retrying through the session, and tries again the instant you change resolution or fullscreen setting; only if it still can't get usable frames by the end of a session does it note that capture was unavailable for that stretch — so an admin can see why the screenshots are thin instead of mistaking it for hidden activity. It's a coverage note, never a flag against you. (If this is you, running the game in borderless windowed — the -window -noborder launch option — sidesteps it entirely.)
• Running programs and loaded DLLs — a list taken at session start so admins can spot known cheat software. The AC has an allowlist of normal Source-engine files, so the usual stuff doesn't show up as suspicious.
• Loaded drivers — the kernel-mode drivers loaded on your system at session start (name, path, fingerprint, and whether they're validly signed), so admins can spot drivers known to be used as cheat enablers or ones loaded outside the normal Windows set. The AC loads no driver of its own — it only reads the list.
• Network connections — a snapshot of your active network connections (the remote address and port, and which program owns each) plus your system's DNS lookup cache, taken at the start and end of a session. This is to catch cheats that talk to an external service; it's inventory for a reviewer, and only captured during a session.
• Overlay windows — the title, window class, and owning program of any see-through, always-on-top windows drawn over the game — since external cheats often paint an overlay (ESP/radar) on top of DoD.
• System environment — basic machine facts read at session start: your Windows version and computer name, system model and manufacturer, memory/CPU/uptime, whether a debugger is attached to the game, and whether you're running inside a virtual machine. Context for a reviewer — none of it is a mark against you on its own.
• Game-file fingerprints — the AC takes a fingerprint (SHA256 hash) of your DoD files and compares against the league's official list. Anything different shows up in the report. As of 0.7.0 it looks harder for your DoD install — checking every Steam library and, if needed, your fixed drives — so the check still runs when the game isn't in the default location.
• Config files — binds and setup values — the AC reads your DoD .cfg files for two things. First, mousewheel-bound fire or crouch binds, which Rule 4.6 disallows (a wheel scroll multiplies a single flick into a burst of inputs). Second, as of 0.7.0, the values of a small, fixed set of cvars — your netcode settings and the visual cvars the league already enforces (like gl_picmip and r_fullbright). The netcode and sensitivity values feed your public profile only if you opt in (see below); the enforced-cvar values are for admin review. Your .cfg files are included in the encrypted bundle for admin review, but as of 0.7.1 secret values — rcon_password, server/join passwords — are redacted out before the file is bundled, so credentials never leave your machine. Your binds and personal setup are never published to your profile.
• Hardware ID — a stable code that identifies your PC across logins. It's derived from your motherboard, CPU, and disk serial numbers, plus (as of 0.6.9) your network MAC addresses. Every one of those raw values is scrambled into a one-way hash on your own machine before anything is sent — the raw serials and MACs never leave your PC. Admins only ever see the resulting code, which lets them tie sessions to the same machine without holding your actual serial numbers.
• Connected devices (0.6.9) — for the USB devices attached during a session, the AC reads what each device reports about itself: its product and manufacturer name, its vendor/product ID, and its device path (so an unusual keyboard or mouse shows up as what it actually is, instead of a generic "USB Input Device"). Identification only — it's context for a reviewer, never used as a mark against you, and never published to your profile.
• Display & in-game video settings — your monitor's resolution and refresh rate (used to tell exclusive-fullscreen from windowed when a screenshot comes back blank) and, as of 0.7.1, DoD's own in-game video setting — render resolution, color depth, and fullscreen/windowed — read from the game's own Windows registry key. This lets your profile show the resolution you actually play at (e.g. 640×480 stretched) rather than just your monitor's. Context only, never a mark against you.
• Peripheral software — fingerprints of the config files from Logitech G HUB, SteelSeries GG, Razer Synapse, and similar. Some of these support firmware features like SOCD / Snap-Tap that matter for cheat detection. Starting in 0.5.3, the AC also reads CPI/DPI, polling rate, and lift-off distance from those configs — Razer Synapse, Logitech G HUB (both the JSON and, as of 0.5.7, the settings.db path), Wooting Wootility, and SteelSeries GG — so detection thresholds normalize correctly across testers running very different mouse setups. For the vendors whose firmware exposes Hall-effect / Rapid-Trigger, SOCD, or macro features, the relevant vendor config files are also collected (hashed and parsed) so an admin can confirm which firmware features were enabled — which may include your macros and button rebinds. As of 0.7.1 this collection is restricted to the actual config/profile files (settings databases, profile JSON); vendor login tokens, browser cookies, and crash dumps that happen to live in the same folders are explicitly excluded and never leave your machine. That data is used only for cheat detection, never anything else.
• A "still here" ping, every ~30 seconds — while a session is active the client sends the server a tiny heartbeat: which game server you're on, the client version, and (as of 0.6.9) whether screenshot capture is currently working. Your session is identified by the secure token issued at login, not by re-sending your Steam ID. No gameplay, input, or screenshot data — it exists only so admins can tell a live session apart from one whose client was closed or killed mid-match, and see in real time if your capture has gone blind. It stops the instant the session ends.
• Weapon timeline (from the game server) — the KTP game server records which weapon you had equipped and when, and links it to your session, so a reviewer can line up detector evidence (like recoil control on automatic weapons) with the weapon you were actually holding. This comes from the server, not from the client reading your PC.