Yes, a checksum against the running code would normally be considered enough to prove that code had changed functionally. I don't think anyone's seriously trying to engineer a cheat and trying to at the same time engineer a checksum clash, at least not unless they know that's that's how the anti-cheat software is working. But once the computed checksum doesn't match the original from the anti cheat software's perspective it might make sense to get a listing of all running processes and send that to the game publisher, to help diagnose what's exactly is out there modifying the running code. Although it's fair to say any time I've cracked a game before now, I've modified the code on disc well before it actually launches, but if there was code out there which actively intercepted the game's internet traffic and modified it there that would need to be running, but in that case it wouldn't need to modify the game code. Perhaps the game server can get a signal back to the game that it's being compromised that might be a good time to see what else is running and fire that down the pipe.
yewtu.be
