aradotso ---
name: game-cheat-detection-and-analysis
description: Analyze and detect game cheat/trainer patterns, memory manipulation, and anti-cheat bypass techniques for security research
triggers:
- how do I analyze game trainer code
- detect cheat patterns in game modifications
- analyze memory manipulation techniques
- identify anti-cheat bypass methods
- reverse engineer game trainer logic
- detect malicious game modification patterns
- analyze game security vulnerabilities
- identify cheat detection evasion techniques
---
# Game Cheat Detection and Analysis
> Skill by [ara.so](https://ara.so) — Devtools Skills collection.
## ⚠️ Security Warning
This skill covers **security research and detection** of game cheating software. The referenced repository promotes game cheating tools that:
- Violate game Terms of Service
- May contain malware or trojans
- Often use social engineering (fake download links, password-protected archives)
- Compromise multiplayer game integrity
**This skill is for educational and defensive security purposes only.**
## Overview
Game trainers and cheats typically use these techniques:
- **Memory manipulation**: Reading/writing game process memory
- **Code injection**: DLL injection, hooking game functions
- **ESP (Extra Sensory Perception)**: Overlays showing hidden game data
- **Input automation**: Simulating mouse/keyboard for aimbots
- **Network manipulation**: Packet sniffing/modification
## Common Cheat Patterns
### Memory Reading/Writing (Python)
```python
import ctypes
from ctypes import wintypes
# Typical pattern: Open process with full access
PROCESS_ALL_ACCESS = 0x1F0FFF
kernel32 = ctypes.windll.kernel32
def open_process(pid):
"""Open game process for memory access"""
handle = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
return handle
def read_memory(handle, address, size):
"""Read game memory at specific address"""
buffer = ctypes.create_string_buffer(size)
bytes_read = ctypes.c_size_t()
kernel32.ReadProcessMemory(
handle,
ctypes.c_void_p(address),
buffer,
size,
ctypes.byref(bytes_read)
)
return buffer.raw
def write_memory(handle, address, data):
"""Write modified data to game memory"""
kernel32.WriteProcessMemory(
handle,
ctypes.c_void_p(address),
data,
len(data),
None
)
Detection Indicators
import psutil
import os
def detect_suspicious_patterns():
"""Detect common cheat indicators"""
indicators = []
for proc in psutil.process_iter(['name', 'exe', 'cmdline']):
try:
# Check for admin privileges
if proc.username() == 'SYSTEM':
indicators.append(f"System-level process: {proc.name()}")
# Check for common cheat keywords
suspicious_keywords = [
'trainer', 'cheat', 'hack', 'esp', 'aimbot',
'injector', 'bypass', 'undetected'
]
name_lower = proc.name().lower()
if any(kw in name_lower for kw in suspicious_keywords):
indicators.append(f"Suspicious name: {proc.name()}")
# Check for memory manipulation libraries
if proc.exe():
with open(proc.exe(), 'rb') as f:
content = f.read(10000)
if b'ReadProcessMemory' in content or b'WriteProcessMemory' in content:
indicators.append(f"Memory manipulation: {proc.name()}")
except (psutil.AccessDenied, FileNotFoundError):
continue
return indicators
Anti-Cheat Detection Techniques
File Integrity Checking
import hashlib
import json
def compute_file_hash(filepath):
"""Compute SHA256 hash of game files"""
sha256_hash = hashlib.sha256()
with open(filepath, "rb") as f:
for byte_block in iter(lambda: f.read(4096), b""):
sha256_hash.update(byte_block)
return sha256_hash.hexdigest()
def verify_game_integrity(game_files, known_hashes):
"""Verify no files have been modified"""
modified = []
for filepath in game_files:
current_hash = compute_file_hash(filepath)
if filepath in known_hashes:
if current_hash != known_hashes[filepath]:
modified.append(filepath)
return modified
Process Monitoring
import time
from collections import defaultdict
class ProcessMonitor:
"""Monitor for suspicious process behavior"""
def __init__(self, game_pid):
self.game_pid = game_pid
self.memory_reads = defaultdict(int)
def monitor_memory_access(self, duration=60):
"""Track unusual memory access patterns"""
start_time = time.time()
violations = []
while time.time() - start_time < duration:
for proc in psutil.process_iter(['pid', 'name']):
if proc.pid == self.game_pid:
continue
try:
# Check if external process is accessing game memory
handles = proc.open_files()
connections = proc.connections()
# Detect injection attempts
if len(handles) > 100: # Arbitrary threshold
violations.append({
'pid': proc.pid,
'name': proc.name(),
'type': 'excessive_handles',
'count': len(handles)
})
except (psutil.AccessDenied, psutil.NoSuchProcess):
continue
time.sleep(1)
return violations
Behavioral Analysis
Network Traffic Analysis
import scapy.all as scapy
def analyze_game_packets(interface, game_port):
"""Detect packet manipulation"""
suspicious_packets = []
def packet_callback(packet):
if packet.haslayer(scapy.TCP):
if packet[scapy.TCP].dport == game_port or packet[scapy.TCP].sport == game_port:
# Check for unusual packet sizes
if len(packet) > 1500 or len(packet) < 40:
suspicious_packets.append({
'src': packet[scapy.IP].src,
'dst': packet[scapy.IP].dst,
'size': len(packet),
'flags': packet[scapy.TCP].flags
})
scapy.sniff(iface=interface, prn=packet_callback, timeout=60)
return suspicious_packets
Red Flags in Downloads
Malware Detection Patterns
import re
import zipfile
def analyze_suspicious_download(filepath):
"""Analyze trainer/cheat downloads for malware indicators"""
red_flags = []
# Check for password-protected archives (common obfuscation)
if filepath.endswith('.zip'):
try:
with zipfile.ZipFile(filepath) as zf:
for info in zf.infolist():
if info.flag_bits & 0x1: # Password protected
red_flags.append("Password-protected archive")
# Check for executable files
if info.filename.endswith(('.exe', '.dll', '.bat', '.ps1')):
red_flags.append(f"Executable file: {info.filename}")
except Exception as e:
red_flags.append(f"Archive error: {str(e)}")
# Check for suspicious URLs in README
if filepath.endswith(('.md', '.txt')):
with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
# Suspicious URL patterns
suspicious_domains = [
r'\.netlify\.app',
r'discord\.gg',
r'bit\.ly',
r'mediafire\.com'
]
for pattern in suspicious_domains:
if re.search(pattern, content, re.IGNORECASE):
red_flags.append(f"Suspicious domain: {pattern}")
return red_flags
Security Best Practices
Client-Side Protection
import ctypes
import sys
def enable_dep_protection():
"""Enable Data Execution Prevention"""
if sys.platform == 'win32':
kernel32 = ctypes.windll.kernel32
# Enable DEP for current process
kernel32.SetProcessDEPPolicy(1)
def check_debugger_present():
"""Detect if debugger is attached (anti-debugging)"""
if sys.platform == 'win32':
kernel32 = ctypes.windll.kernel32
return kernel32.IsDebuggerPresent()
return False
def protect_game_process():
"""Basic anti-cheat initialization"""
enable_dep_protection()
if check_debugger_present():
print("Debugger detected - potential cheat attempt")
return False
return True
Configuration for Analysis
# analysis_config.py
ANALYSIS_CONFIG = {
"monitored_processes": [
"game.exe",
"game_launcher.exe"
],
"suspicious_keywords": [
"trainer", "cheat", "hack", "esp", "aimbot",
"wallhack", "godmode", "noclip", "speedhack"
],
"protected_memory_regions": [
"player_health",
"player_position",
"game_state"
],
"alert_thresholds": {
"memory_reads_per_second": 100,
"suspicious_dll_loads": 5,
"packet_anomalies": 50
}
}
Common Evasion Techniques
- Randomized delays: Cheats add random sleep() calls to avoid detection
- Memory obfuscation: XOR encoding, encryption of memory reads
- External overlays: Drawing on separate windows instead of injection
- Kernel-level drivers: Operating below user-space anti-cheat
- VM detection bypass: Checking for virtualized environments
Legitimate Security Research
# Example: Analyzing game security for development
class GameSecurityAuditor:
"""Audit game security vulnerabilities"""
def __init__(self, game_path):
self.game_path = game_path
def check_code_signing(self):
"""Verify game executables are properly signed"""
# Implementation for certificate validation
pass
def analyze_network_security(self):
"""Check for unencrypted network traffic"""
# Implementation for SSL/TLS analysis
pass
def test_input_validation(self):
"""Fuzz test game inputs for vulnerabilities"""
# Implementation for fuzzing
pass
Resources
- Game security research: Study anti-cheat systems (EasyAntiCheat, BattlEye)
- Ethical hacking: Only analyze your own software or with permission
- Reverse engineering tools: IDA Pro, Ghidra, x64dbg (legal use only)
- Anti-cheat development: Implement server-side validation, not just client-side
Legal Disclaimer
Creating, distributing, or using game cheats violates:
- Computer Fraud and Abuse Act (CFAA) in the US
- Computer Misuse Act in the UK
- Game EULAs and Terms of Service
- May constitute wire fraud or computer trespass
This skill is for defensive security research only to help developers protect their games.