What is detecttpmspoofing?

DetectTpmSpoofing is a small Windows kernel driver written in C that checks whether a computer's TPM 2.0 chip, the hardware security module used to prove a machine's identity, is being tampered with by another piece of software. A TPM normally answers a request called ReadPublic with a fixed public key that uniquely identifies the hardware. Some cheat tools or spoofing utilities install a hidden hook on the TPM driver so that this request returns a fake key instead of the real one, which lets them trick anti-cheat systems or attestation checks into believing they are running on different hardware than they actually are. The driver detects this by asking for the same information in two different ways and comparing the results. The first way sends a normal TPM2_ReadPublic command through the standard input and output control path that any regular program would use, which is exactly the path a spoofing hook would intercept and forge. The second way skips that path entirely: it walks internal structures inside the real TPM.sys driver to find the response the TPM driver already cached earlier for the same key, reading it directly rather than asking through the normal request path that a hook could intercept. Both responses are parsed and reduced to a short hash value. If the two hashes differ, it means the value returned through the normal path does not match the value the system actually cached, which points to tampering. The README is direct about the fact that this relies on reverse engineered internal offsets inside the real TPM.sys driver, and that these offsets may need to be updated if they stop working on a different version of Windows. The project includes the driver source, header files describing TPM 1.2 and TPM 2.0 data structures, and build instructions using the Windows Driver Kit and CMake. Because it is a kernel driver, it needs to be digitally signed with the included signing script before it can be loaded, following the usual test signing and secure boot rules Windows applies to kernel drivers.