I agree that kernel-level protection offers much deeper visibility and control, especially when it comes to advanced bots and bypass techniques.
That said, I'm not trying to claim that a usermode solution is impossible to bypass. My goal is simply to increase the cost and complexity of bypassing the protection while keeping deployment simple, stable, and compatible for server owners.
A lot of Interlude server operators don't want to install kernel drivers or deal with the risks and maintenance that come with them. That's why I'm currently focusing on a layered approach: secure launcher architecture, HWID licensing, session validation, anti-debugging, injection detection, integrity checks, replay protection, and heartbeat monitoring.
I'm not ruling out kernel support in the future. Right now, my priority is gathering real-world feedback, improving the product, and learning how people attempt to bypass different protection layers.
I appreciate the feedback and the discussion.