# Game Hacking Exploits

> Game exploit classes: memory R/W cheats, packets, authority breaks, race bugs, movement exploits, server RPC abuse.

- Skill: `netvar1337/game-hacking-exploits` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add netvar1337/game-hacking-exploits`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/game-hacking-exploits/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/game-hacking-exploits

---


# Game hacking exploits

## Classes
| Class | Where | Notes |
|---|---|---|
| Client memory | local process | ESP/aim/speed if not server-auth |
| Packet abuse | protocol | spoofed movement, inventory dups |
| RPC/cmd abuse | server handlers | unchecked args, authz gaps |
| Race/TOCTOU | servers | double-spend, interact races |
| Prediction abuse | client-server | bunny/strafe edge cases |
| Asset/logic | scripts | exposed debug, GM cmds |
| OOB R/W | parsers | custom binary protocols |
| Auth/parser CVE | CoD / FiveM | momo5502 `cod-exploits`: Steam-Auth CVE-2018-20817, Huffman CVE-2018-10718 (`E:\Tools\git\momo5502\cod-exploits`). Aftermath 2022-09-26 FiveM/GTA V client RCE. |

## Workflow
1. Authority analysis first: what does the server trust?
2. If server-auth: focus packets/RPC/logic bugs, not local godmode fantasies.
3. Build minimal PoC with logging; then reliability.
4. AC/EAC considerations only after PoC (pair `game-hacking`).

## Deliverables
- Repro steps, net capture, offset/version table, risk to stability.

## Authority-break deep classes

### Movement/prediction abuse
- UE `SavedMove` replay: client-simulated movement re-simulated on server; mismatches snap back. Exploits: temporal desync (delayed ServerMove batches to rewind hit windows), speed via tick-rate mismatch (moves computed at higher dt), strafe-acceleration edge cases (source-style air-control yielded 1.5-2x speed classes historically).
- Source1 lag-comp: server rewinds hit targets to shooter's cmd time — fake latency shoots rewind-further; `cl_interp` manipulation class.

### RPC surface methodology
1. Dump protocol: hook engine send/recv → map opcodes → rebuild structs (`network-protocol-re`).
2. Enumerate handlers in the dispatch switch; for each opcode: client-callable? server-side authz? (most bugs = missing authz, not authn).
3. Replay privileged RPC with mutated args — classic: item-drop-on-death race, remote interact, force-trade states.
4. Server-trust inversion: still found in projectile-despawn-on-client and interact-confirm paths of otherwise hardened titles.

### Race/dup patterns
- Double-spend: two sessions same inventory (weak session locking, mobile titles); ToCTOU equip/use (start use → drop → finish = use-while-not-held).
- Server-tick race: two rapid interacts pre-transition (verify via timestamp deltas in capture).

### OOB in custom protocols
- Declared-length trusted for both alloc and copy → adjacent-struct corruption via negative/oversized length.
- Mutation-fuzz captured flows with grammar rebuilt from structs; kick-vs-crash signatures tell authz vs parser bugs.

## PoC discipline
- Live-like private server first; PoC as minimal script (python raw socket or engine replay).
- Full logs (timestamps, seq, opcodes); dup bugs can permanently corrupt character state — burn accounts knowingly.