Game Security Research
Scope
Use only local, self-hosted, or intentionally vulnerable game targets with
written authorization. Do not create or deploy online-game cheats, anti-cheat
bypasses, ban evasion, aim assistance, overlays, memory manipulation, or
multiplayer disruption tooling.
Research workflow
- Pin client and server builds. Record executable hashes, engine version,
platform, symbols, server commit, and local-lab topology before inspection.
- Map trust boundaries. Identify which values are authoritative on the
server: inventory, currency, movement, progression, matchmaking, replay, and
entitlement state. Classify client-only checks as hypotheses until server
state is measured.
- Analyze accepted artifacts. Inspect local save files, replay formats,
asset bundles, protocol schemas, and debug telemetry. Keep raw captures and
parsed summaries separate.
- Validate safely. Submit the minimum input to the self-hosted target and
record the server-observed state transition. Run the corresponding ordinary
player action as the negative control.
- Evaluate defenses. Exercise anti-tamper and telemetry only as a defender:
confirm expected alerts, integrity checks, and server-side rejection after a
local test case. Never develop an evasion workflow.
Promotion rule
A reportable finding must include the pinned build identity, minimal replay or
request, packet/trace evidence, server-side state delta, baseline result, and a
post-remediation replay. A client-only display change is not proof of impact.
1---2name: game-security-research3description: Authorized game-client, protocol, replay, and anti-tamper security research for local, self-hosted, or intentionally vulnerable training targets.4---56# Game Security Research78## Scope910Use only local, self-hosted, or intentionally vulnerable game targets with11written authorization. Do not create or deploy online-game cheats, anti-cheat12bypasses, ban evasion, aim assistance, overlays, memory manipulation, or13multiplayer disruption tooling.1415## Research workflow16171. **Pin client and server builds.** Record executable hashes, engine version,18 platform, symbols, server commit, and local-lab topology before inspection.192. **Map trust boundaries.** Identify which values are authoritative on the20 server: inventory, currency, movement, progression, matchmaking, replay, and21 entitlement state. Classify client-only checks as hypotheses until server22 state is measured.233. **Analyze accepted artifacts.** Inspect local save files, replay formats,24 asset bundles, protocol schemas, and debug telemetry. Keep raw captures and25 parsed summaries separate.264. **Validate safely.** Submit the minimum input to the self-hosted target and27 record the server-observed state transition. Run the corresponding ordinary28 player action as the negative control.295. **Evaluate defenses.** Exercise anti-tamper and telemetry only as a defender:30 confirm expected alerts, integrity checks, and server-side rejection after a31 local test case. Never develop an evasion workflow.3233## Promotion rule3435A reportable finding must include the pinned build identity, minimal replay or36request, packet/trace evidence, server-side state delta, baseline result, and a37post-remediation replay. A client-only display change is not proof of impact.
purpleailab