# Game Cheat Detection And Analysis > ```markdown - Skill: `aradotso/game-cheat-detection-and-analysis` (Agent Skill) - Install (CLI): `npx skillmds@latest add aradotso/game-cheat-detection-and-analysis` - Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso/game-cheat-detection-and-analysis/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Docs & Writing - Author: aradotso (https://skillmd.com/u/aradotso) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/aradotso/game-cheat-detection-and-analysis --- ```markdown --- name: game-cheat-detection-and-analysis description: Analyze and detect game cheat/trainer patterns, memory manipulation, and anti-cheat bypass techniques for security research triggers: - how do I analyze game trainer code - detect cheat patterns in game modifications - analyze memory manipulation techniques - identify anti-cheat bypass methods - reverse engineer game trainer logic - detect malicious game modification patterns - analyze game security vulnerabilities - identify cheat detection evasion techniques --- # Game Cheat Detection and Analysis > Skill by [ara.so](https://ara.so) — Devtools Skills collection. ## ⚠️ Security Warning This skill covers **security research and detection** of game cheating software. The referenced repository promotes game cheating tools that: - Violate game Terms of Service - May contain malware or trojans - Often use social engineering (fake download links, password-protected archives) - Compromise multiplayer game integrity **This skill is for educational and defensive security purposes only.** ## Overview Game trainers and cheats typically use these techniques: - **Memory manipulation**: Reading/writing game process memory - **Code injection**: DLL injection, hooking game functions - **ESP (Extra Sensory Perception)**: Overlays showing hidden game data - **Input automation**: Simulating mouse/keyboard for aimbots - **Network manipulation**: Packet sniffing/modification ## Common Cheat Patterns ### Memory Reading/Writing (Python) ```python import ctypes from ctypes import wintypes # Typical pattern: Open process with full access PROCESS_ALL_ACCESS = 0x1F0FFF kernel32 = ctypes.windll.kernel32 def open_process(pid): """Open game process for memory access""" handle = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, pid) return handle def read_memory(handle, address, size): """Read game memory at specific address""" buffer = ctypes.create_string_buffer(size) bytes_read = ctypes.c_size_t() kernel32.ReadProcessMemory( handle, ctypes.c_void_p(address), buffer, size, ctypes.byref(bytes_read) ) return buffer.raw def write_memory(handle, address, data): """Write modified data to game memory""" kernel32.WriteProcessMemory( handle, ctypes.c_void_p(address), data, len(data), None ) ``` ### Detection Indicators ```python import psutil import os def detect_suspicious_patterns(): """Detect common cheat indicators""" indicators = [] for proc in psutil.process_iter(['name', 'exe', 'cmdline']): try: # Check for admin privileges if proc.username() == 'SYSTEM': indicators.append(f"System-level process: {proc.name()}") # Check for common cheat keywords suspicious_keywords = [ 'trainer', 'cheat', 'hack', 'esp', 'aimbot', 'injector', 'bypass', 'undetected' ] name_lower = proc.name().lower() if any(kw in name_lower for kw in suspicious_keywords): indicators.append(f"Suspicious name: {proc.name()}") # Check for memory manipulation libraries if proc.exe(): with open(proc.exe(), 'rb') as f: content = f.read(10000) if b'ReadProcessMemory' in content or b'WriteProcessMemory' in content: indicators.append(f"Memory manipulation: {proc.name()}") except (psutil.AccessDenied, FileNotFoundError): continue return indicators ``` ## Anti-Cheat Detection Techniques ### File Integrity Checking ```python import hashlib import json def compute_file_hash(filepath): """Compute SHA256 hash of game files""" sha256_hash = hashlib.sha256() with open(filepath, "rb") as f: for byte_block in iter(lambda: f.read(4096), b""): sha256_hash.update(byte_block) return sha256_hash.hexdigest() def verify_game_integrity(game_files, known_hashes): """Verify no files have been modified""" modified = [] for filepath in game_files: current_hash = compute_file_hash(filepath) if filepath in known_hashes: if current_hash != known_hashes[filepath]: modified.append(filepath) return modified ``` ### Process Monitoring ```python import time from collections import defaultdict class ProcessMonitor: """Monitor for suspicious process behavior""" def __init__(self, game_pid): self.game_pid = game_pid self.memory_reads = defaultdict(int) def monitor_memory_access(self, duration=60): """Track unusual memory access patterns""" start_time = time.time() violations = [] while time.time() - start_time < duration: for proc in psutil.process_iter(['pid', 'name']): if proc.pid == self.game_pid: continue try: # Check if external process is accessing game memory handles = proc.open_files() connections = proc.connections() # Detect injection attempts if len(handles) > 100: # Arbitrary threshold violations.append({ 'pid': proc.pid, 'name': proc.name(), 'type': 'excessive_handles', 'count': len(handles) }) except (psutil.AccessDenied, psutil.NoSuchProcess): continue time.sleep(1) return violations ``` ## Behavioral Analysis ### Network Traffic Analysis ```python import scapy.all as scapy def analyze_game_packets(interface, game_port): """Detect packet manipulation""" suspicious_packets = [] def packet_callback(packet): if packet.haslayer(scapy.TCP): if packet[scapy.TCP].dport == game_port or packet[scapy.TCP].sport == game_port: # Check for unusual packet sizes if len(packet) > 1500 or len(packet) < 40: suspicious_packets.append({ 'src': packet[scapy.IP].src, 'dst': packet[scapy.IP].dst, 'size': len(packet), 'flags': packet[scapy.TCP].flags }) scapy.sniff(iface=interface, prn=packet_callback, timeout=60) return suspicious_packets ``` ## Red Flags in Downloads ### Malware Detection Patterns ```python import re import zipfile def analyze_suspicious_download(filepath): """Analyze trainer/cheat downloads for malware indicators""" red_flags = [] # Check for password-protected archives (common obfuscation) if filepath.endswith('.zip'): try: with zipfile.ZipFile(filepath) as zf: for info in zf.infolist(): if info.flag_bits & 0x1: # Password protected red_flags.append("Password-protected archive") # Check for executable files if info.filename.endswith(('.exe', '.dll', '.bat', '.ps1')): red_flags.append(f"Executable file: {info.filename}") except Exception as e: red_flags.append(f"Archive error: {str(e)}") # Check for suspicious URLs in README if filepath.endswith(('.md', '.txt')): with open(filepath, 'r', encoding='utf-8', errors='ignore') as f: content = f.read() # Suspicious URL patterns suspicious_domains = [ r'\.netlify\.app', r'discord\.gg', r'bit\.ly', r'mediafire\.com' ] for pattern in suspicious_domains: if re.search(pattern, content, re.IGNORECASE): red_flags.append(f"Suspicious domain: {pattern}") return red_flags ``` ## Security Best Practices ### Client-Side Protection ```python import ctypes import sys def enable_dep_protection(): """Enable Data Execution Prevention""" if sys.platform == 'win32': kernel32 = ctypes.windll.kernel32 # Enable DEP for current process kernel32.SetProcessDEPPolicy(1) def check_debugger_present(): """Detect if debugger is attached (anti-debugging)""" if sys.platform == 'win32': kernel32 = ctypes.windll.kernel32 return kernel32.IsDebuggerPresent() return False def protect_game_process(): """Basic anti-cheat initialization""" enable_dep_protection() if check_debugger_present(): print("Debugger detected - potential cheat attempt") return False return True ``` ## Configuration for Analysis ```python # analysis_config.py ANALYSIS_CONFIG = { "monitored_processes": [ "game.exe", "game_launcher.exe" ], "suspicious_keywords": [ "trainer", "cheat", "hack", "esp", "aimbot", "wallhack", "godmode", "noclip", "speedhack" ], "protected_memory_regions": [ "player_health", "player_position", "game_state" ], "alert_thresholds": { "memory_reads_per_second": 100, "suspicious_dll_loads": 5, "packet_anomalies": 50 } } ``` ## Common Evasion Techniques 1. **Randomized delays**: Cheats add random sleep() calls to avoid detection 2. **Memory obfuscation**: XOR encoding, encryption of memory reads 3. **External overlays**: Drawing on separate windows instead of injection 4. **Kernel-level drivers**: Operating below user-space anti-cheat 5. **VM detection bypass**: Checking for virtualized environments ## Legitimate Security Research ```python # Example: Analyzing game security for development class GameSecurityAuditor: """Audit game security vulnerabilities""" def __init__(self, game_path): self.game_path = game_path def check_code_signing(self): """Verify game executables are properly signed""" # Implementation for certificate validation pass def analyze_network_security(self): """Check for unencrypted network traffic""" # Implementation for SSL/TLS analysis pass def test_input_validation(self): """Fuzz test game inputs for vulnerabilities""" # Implementation for fuzzing pass ``` ## Resources - **Game security research**: Study anti-cheat systems (EasyAntiCheat, BattlEye) - **Ethical hacking**: Only analyze your own software or with permission - **Reverse engineering tools**: IDA Pro, Ghidra, x64dbg (legal use only) - **Anti-cheat development**: Implement server-side validation, not just client-side ## Legal Disclaimer Creating, distributing, or using game cheats violates: - Computer Fraud and Abuse Act (CFAA) in the US - Computer Misuse Act in the UK - Game EULAs and Terms of Service - May constitute wire fraud or computer trespass This skill is for **defensive security research only** to help developers protect their games. ```