Overview

PC scans (Echo, Detect, Napse, Anticheat.ac/Ocean, Nexora) are forensic tools: they read disk, registry, logs, processes, memory, and drivers.

Bypass does not mean shutting down the scanner. See Status and Honest bypass.

Honest bypass

What bypass really is

Official scanner claims

From public sites — not internal rules.

What the Rolex stack does

Two axes — not magic:

Limits & risks

• Old traces: may still appear.
• New rules: undetect today ≠ tomorrow.
• Human review: staff reads reports.
• Live AC: separate from PC scan.
• UEFI/BIOS: Private tier via staff.
• Status: not a vendor certificate.

CPU privilege rings

x86/x64 uses rings 0–3. Most games and scanners run in Ring 3. The OS kernel and drivers run in Ring 0.

Ring 0 — Kernel

Kernel mode can register callbacks (process, image load, registry), filter minifilter I/O, and manipulate handles/objects before usermode sees them. Rolex’s kernel module loads early (or via mapped image on advanced builds) and establishes a trust boundary between the game process and inspection tools.

Ring 3 — Usermode

The in-game menu (107+ functions), config, and injector live here. Usermode talks to the kernel component through a private channel (device object + IOCTL or shared communication buffer). Scanners without kernel access see less of some paths — but advanced scans (Detect, Nexora) also hunt drivers and hooks. Nothing is guaranteed hidden.

Rolex stack (layers)

Kernel bypass flow (simplified)

Typical sequence when Rolex is active and a scan starts:

Bypass map

PC scanners build a timeline from many sources. Rolex aims to split work between usermode (policy, timing, game-side) and kernel (filtering what the OS records when supported). Below is the intended approach per surface — see limits for what we do not promise.

// Ring 3 — before creating a service key
if (Rolex.Policy.ScanWindowActive())
    QueueServiceInstall(AfterScan);  // no fresh traces mid-scan
else
    Rolex.Kernel.Ioctl(REGISTER_SERVICE_ALIAS, aliasName);

// Ring 0 — registry callback (simplified)
NTSTATUS OnRegNotify(..., PVOID path, ...) {
    if (SnapshotMode && IsScannerCaller() && IsSensitivePath(path))
        return STATUS_ACCESS_DENIED;
    return STATUS_SUCCESS;
}

// Ring 0 — minifilter pre-operation
FLT_PREOP_CALLBACK_STATUS PreWrite(PFLT_CALLBACK_DATA Data, ...) {
    if (IsRolexProtectedFile(Data) && ShouldMaskUsn(Data))
        SuppressUsnForThisOperation(Data);
    return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}

// Ring 3 — policy
Rolex.Policy.OnScannerStart("detect.ac", () => {
    Rolex.Kernel.Ioctl(ENABLE_JOURNAL_SNAPSHOT);
});

// Ring 3
void InstallRolexDriver() {
    if (!Rolex.Kernel.AlreadyLoadedThisBoot()) {
        Rolex.Kernel.MapAndInit();  // one shot — avoids SCM churn
    }
}

// Ring 0 — open evtx for read
if (IsScannerProcess(PsGetCurrentProcess()) && IsProtectedLogPath(path))
    return STATUS_OBJECT_NAME_NOT_FOUND;

// Ring 3 — central policy engine
enum RolexMode { Idle, PreScan, Snapshot, Cooldown };

void SetMode(RolexMode m) {
    Rolex.Kernel.Ioctl(SET_MODE, m);
    switch (m) {
    case Snapshot:
        PauseMenuFeatures();
        BlockRegistryWrites();
        EnableJournalMask();
        EnableLogReadFilter();
        break;
    case Idle:
        RestoreDefaults();
        break;
    }
}

Scanners — detect vs aim

Each section: official claims → what the Rolex stack aims for (UM/K). No guarantee. Bypass map · Honest bypass · Status.

// Triggered when Echo scan app is detected (~60s window)
Rolex.Status.OnProvider("echo.ac", () => {
    SetMode(Snapshot);
    BlockFileTimelineWrites();     // no new "Executed/Renamed" story
    Kernel.FilterProcessOpen(gamePid);
    Usermode.PauseHighSignalFeatures();
});

Rolex.Status.OnProvider("detect.ac", () => {
    SetMode(Snapshot);
    Usermode.BlockCleanersAndWipers();      // Detect hunts these by name
    Kernel.EnableFullArtifactMask();        // journal + reg + evtx together
    Kernel.SanitizeMemoryWalk(gamePid);
});

// Napse = long scan — extend snapshot
Rolex.Status.OnProvider("napse.ac", () => {
    SetMode(Snapshot);
    Policy.SetDurationMinutes(8);           // match their 6–8 min window
    Usermode.PauseAllRiskyFeatures();
    Kernel.EnableSustainedArtifactMask();
});

Rolex.Status.OnProvider("nexorascanner.ac", () => {
    SetMode(Snapshot);
    Usermode.PauseHighSignalFeatures();
    Kernel.EnableArtifactMask(SHIMCACHE | PREFETCH | AMCACHE | REG);
    Kernel.BlockFirmwareCheatProbes();     // BIOS/UEFI class
    Kernel.SanitizeMemoryForDump(gamePid);
});

Method catalog

Index of all methods — same data as Status.

Reduce footprint

Scanners sell anti-forensic detection. Goal: fewer new traces. See limits.

Claims: Scanner claims. Methods: Scanners.

Trace types (all scanners)

Footprint policy — Ring 3

Usermode: fewer disk/registry touches — no cleaners. See Ring 3 (privilege model).

// === ROLEX USERMODE: reduce new artifacts (honest goal) ===

bool RolexUsermode::LaunchFiveMStack() {
    // 1) No dropper on disk
    if (!Kernel.IsReady()) return false;
    DWORD pid = FindFiveMProcess();
    if (pid == 0) return false;

    // 2) Map payload from kernel buffer — not WriteFile("cheat.dll")
    PVOID image = Kernel.IoctlMapImage(IOCTL_ROLEX_GET_IMAGE);
  ManualMapIntoProcess(pid, image);   // no new Prefetch for "cheat.exe"

    // 3) No registry footprint for menu
    //    — config stays in encrypted heap, not RegSetValue
    return true;
}

void RolexUsermode::OnScannerDetected(const char* provider) {
    PauseAllFeatures();                  // stop hooks/strings in game
    CloseHelperProcesses();              // injectors, debug tools

    // NEVER do this — Detect/Napse/Nexora flag it:
    // RunCleaner("ccleaner"); WipeUsnJournal(); DeletePrefetch();

    Kernel.Ioctl(SET_MODE, MODE_SNAPSHOT);
}

void RolexUsermode::BeforeAnyDiskTouch() {
    if (Policy.ScanWindowActive()) {
        QueueUntilAfterScan(DiskOp);     // defer = 0 new USN/prefetch rows
        return;
    }
    DiskOp();
}

Footprint policy — Ring 0

Filter reads/writes for scanner PIDs when the build supports it. Advanced scans hunt drivers/callbacks — see Ring 0. Not a fully invisible driver guarantee.

// === ROLEX KERNEL: fewer new artifacts + filtered view when possible ===

NTSTATUS RolexDriverEntry(...) {
    RegisterMinifilter(VolumeCallback);       // USN / write path
    RegisterRegistryCallback(RegCallback);
    RegisterProcessNotify(ProcCallback);
    CreateDeviceIoctl("\\Device\\RolexLink");
    return STATUS_SUCCESS;
}

// --- don't CREATE traces ---
FLT_PREOP_CALLBACK_STATUS VolumePreWrite(...) {
    if (IsRolexProtectedPath(File) && Policy.MinimizeFootprint)
        SuppressUsnRecord(Operation);        // no new journal row
    return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

// --- don't LET scanner READ raw traces ---
NTSTATUS RegCallback(..., PVOID path, ...) {
    if (Policy.SnapshotMode && IsScannerProcess())
        if (IsSensitiveHivePath(path))
            return STATUS_ACCESS_DENIED;
    return STATUS_SUCCESS;
}

NTSTATUS HookNtReadVirtualMemory(...) {
    if (IsScannerCaller() && TargetIsProtectedGameProcess())
        return SanitizedRead(...);           // no cheat strings in dump
    return OriginalNtReadVirtualMemory(...);
}

// --- driver: one clean story per boot ---
VOID LoadRolexImage() {
    if (g_LoadedThisBoot) return;
    MapDriverFromSignedBuffer(...);          // not repeated SCM install/uninstall
    g_LoadedThisBoot = TRUE;
}

Rules checklist

Short list — details in Honest bypass.

• Reduce footprint = fewer new artifacts — no cleaners before scan.
• Consistency — registry, journal, logs, files, RAM: same snapshot story (unified policy).
• Timing — pause features while scanner runs (Status).
• Per surface — Bypass map.
• Per scanner — Scanners.
• Updates — provider rule changes; no pass guarantee.

Code examples

Handshake, callbacks, orchestrator. Footprint: Ring 3 policy · Ring 0 policy.

Usermode → kernel handshake

// Ring 3 — after menu loads
HANDLE h = CreateFile("\\\\.\\RolexLink", ...);
ROLEX_HANDSHAKE in = { .magic = ROLEX_MAGIC, .ver = BUILD_ID };
DeviceIoControl(h, IOCTL_ROLEX_INIT, &in, sizeof(in), &out, sizeof(out), ...);

if (out.status == STATUS_READY)
    InjectFiveMProcess(out.protected_pid);

Kernel — hide module from enumeration

// Ring 0 — simplified process notify
VOID OnProcessCreate(PEPROCESS proc, HANDLE pid, ...) {
    if (IsScannerProcess(proc))
        EnterFilterMode(pid);  // restrict what this PID can Open/Read
}

VOID OnModuleLoad(...) {
    if (IsRolexModule(base) && FilterActive())
        SkipFromPebList(...);  // usermode walker sees less
}

Anti-forensic trap — what scanners catch (do NOT do)

// Detect.ac literally markets catching these:
Run("ccleaner.exe");              // cleaner prefetch + gaps
WipeUsnJournal();                    // "anti-forensic" spike
DeletePrefetch("*.pf");             // inconsistent with Amcache
TimestompFile(path);                 // MFT $SI vs $FN — Nexora-class
LoadDriver("vulnerable.sys");     // BYOVD trail
UnloadCheatDll();                    // Ocean "suspicious unloaded module"

// Rolex: none of the above — reduce footprint + snapshot (see honest-bypass)

Forensics — scan-time snapshot (all Status providers)

// Match any Status provider
const char* PROVIDERS[] = {
    "echo.ac", "detect.ac", "napse.ac",
    "anticheat.ac", "nexorascanner.ac"
};

void OnAnyScanner(const char* id) {
    Usermode.OnScannerDetected(id);      // pause, no cleaners
    Kernel.Ioctl(SET_MODE, MODE_SNAPSHOT);
    if (strcmp(id, "napse.ac") == 0)
        Policy.SetDurationMinutes(8);    // long scan
    Kernel.EnableFullArtifactMask();    // reg + journal + logs + RAM
}

Product depth

Stack depth per Rolex product. Pricing.

Setup and onboarding for slotted tiers: Contact staff on Discord.