Kernel Mode Game Hacking

He is not talking about any provider, and providers have nothing to do with the discussion/dns caches (provider stands for ISP or for a business which provides a service). He said that there are some DRM servers (this is how he calls them, which stands for servers containing a database useful for some access control) in which cheat programs connected to, in this case to limit the usage of the cheat to people who didn't pay for it. So VAC downloaded the DNS caches from the users and hashed them individually. Then all them get sent to VAC servers, and get checked by programmers one by one. Then every bad DNS gets blacklisted, and a future comparison between users' DNS caches with the blacklisted ones had to be done. A single match identified a ban.
However, I clinch with this:
- - - Updated - - -

I'm not sure if for provider you meant DRM providers. If yes, in this case it's better to call them DRM servers.

By a provider I meant p2c companies, sorry for the inconvenience

I'm not sure of what you are talking about.

DRM servers.

And to be more specific; servers of those known premium cheat providers, which are used for databases/logins. You obviously dont get banned for visiting *******.net, but it's known database server used for clientlogin (such as ftp.aimwr.net/database.sql)

Actually, you do open a handle known as a "kernel handle". Kernel Object Handle Table is what would keep track of your kernel-level object such as process / driver.
As I assume you utilize KeStackAttackProcess for your memory rundown technique? Also, your device has something called a "symbolic link" aswell, it's known as a "symbolic link" for that aswell.

"A symbolic link is a file-system object that points to another file system object. The object being pointed to is called the target. Symbolic links are transparent to users; the links appear as normal files or directories, and can be acted upon by the user or application in exactly the same manner."

VAC can also access the handle table if wanting to, it's tedious and easy to look up any created symbolic links too.
Also VAC can if it wants, find the ObjectName of the device. It can also detect your driver via NtQuerySymbolicLinkObject function to retrieve your handle and target driver name.

So I mean, you're just throwing tantrums and guesses on what VAC is able to detect or not. User-mode rights doesn't essentially mean zero rights. VAC is also able to retrieve your device via Object Security Descriptor for each object created as all objects has one.

I mean, there are tons of attack vectors, a driver is sticky without protection.