Learn how games work, down to the bytes.
Game Hacking Academy starts from how a computer runs a game and works up to memory, assembly, debuggers, graphics, networks, game files and anti-cheat. 155 lessons explain one idea at a time, with every number worked out. You do not need to know how to program yet.
Suppose a health bar says 100. The player takes a hit, and the bar says 75. Somewhere inside the running game, a stored value changed.
One value on screen and in memory
Health 100
0x64 = 6 × 16 + 4 = 100. The other three bytes stay 00 while health is below 256.
Start here
Section titled “Start here”Read Lessons 1.1 to 1.6 in order.
They cover how a computer runs a game, what game state is, and your first Rust program, in about 3.5 hours of reading. Nothing needs installing yet.
Build the lab in Lesson 1.7, A Windows Lab You Can Reset.
You need a Windows virtual machine with Rust, the x64dbg debugger and the Cheat Engine memory scanner. The lesson lists every tool and how to snapshot the machine so you can undo any experiment.
Find your first value in Lessons 1.8 and 1.9.
The four bytes at the top of this page come from Lesson 1.8. In Lesson 1.9 you find, test and change a gold value in the game Wesnoth while it runs.
How the book fits together
Section titled “How the book fits together”A game shows you a result: a number changes, a character moves, or a frame is drawn. To understand that result, you can look closer at the rule that changed the game’s state, the bytes that held it, and the instructions that acted on those bytes. You can also look outward at the files, messages, and operating system boundaries around the process. Those are connected views of the same running game, and each chapter gives you another way to explain what you see.
The opening chapters establish the computer, game, programming, Rust, and memory concepts. The middle of the book follows state through debuggers, object layouts, executable analysis, hooks, graphics, networks, and game files. The later chapters connect scripting and virtual machines to Windows processes, driver boundaries, integrity checks, hardware, and emulators. Worked labs stay beside the ideas they demonstrate, so you can read an explanation and then test its consequences.
Read from the beginning for the guided path. For a particular question, use the complete contents or site search to return to the relevant concept, diagram, code example, or lab. Each lesson explains its own example; you only need the ideas introduced in earlier lessons, not the names or values from an earlier exercise.
15 chapters, one idea at a time
You do not need to know the language yet. The early lessons teach each piece right before you use it.
Computer, Game, and Code Foundations
CPU and stored values → game objects → a small Rust program → an owned, resettable lab → memory, scanning, and bits
Chapter 02Following Instructions and Addresses
A changing value → assembly and a paused process → callers → moving addresses and pointer paths → preserved control flow
Chapter 03Typed Memory, Ownership, and Object Layouts
A checked boundary → deeper Rust at that boundary → decoded values → external copies → objects, collections, and text
Chapter 04Game State and Bounded Decisions
An engine frame → copied players → guarded actions → coordinates and grids → feedback, targets, paths, events, and basic NPC decisions
Chapter 05Executable Maps, Instruction References, and Scans
PE layouts and exports → precise instruction lookup → patterns and regions → decoding → tracing profiles and parallel captures
Chapter 06Windows Processes and Callable Interfaces
Process resources → rights and owned handles → pages and threads → call contracts → engine scheduling, input queues, debug events, and bounded observation
Chapter 07Camera Geometry and Rendering APIs
Coordinate frames → pipeline state → OpenGL observations → collision and aim geometry → motion, radar, projection, and Direct3D interfaces
Chapter 08In-Process Tools, Input, and Integration
DLL lifetime → loading → reversible detours and import hooks → game input and commands → rendered menus and snapshots → architecture and safe removal
Chapter 09Network Messages, Authority, and IPC
Programs exchanging messages → what the server discloses → capture, parsing, and legal session order → clients, relays, local transports, and an engine example
Chapter 10Game Files, Mods, and Artifact Trust
Saved state and assets → inspect and edit a copied file → safe packages and reversible mods → hashes, exact build identity, signatures, and encryption
Chapter 11NPC Policy, Lua, and Script Execution
Remembered observations and decisions → Lua and the host interface → bounded script policy → computability limits → bytecodes, values, and call frames
Chapter 12Loaders, Kernel Services, and Trust Boundaries
Module identity and loading → dynamic calls → kernel authority and system calls → driver requests → trust boundaries and failed checks
Chapter 13Physical Memory, Machines, and Hardware
DMA and page translation → virtual guests → firmware and consoles → chip debug access → emulated instructions and time
Chapter 14Versioned Evidence, State, and Integrity
An exact-build layout → bounded call logs and saved captures → state invariants and correlated telemetry → integrity signals and reversible representations
Chapter 15Defensive Design and Anti-Cheat
Why validation matters → server and client observations → detection and review → two isolated control-gap examples → documented protection and resilient game design
Make every assumption visible.
The compiler is a coach. It catches dangling references, mixed-up types, and many memory mistakes before the program runs.
Danger stays visible. When an operating-system call needs raw pointers, that small unsafe boundary states exactly why the operation is valid.
Feedback stays close. Builds, tests, formatting, and documentation use a small set of repeatable commands.
Labs you can run anywhere
Section titled “Labs you can run anywhere”The portable algorithms used throughout the book are collected in the repository’s rust-labs crate. Run cargo test there to experiment with byte parsing, pattern scanning, angle math, and world-to-screen projection without attaching to any process. The advanced lessons in Chapters 3, 9, and 12 use advanced-memory-labs for toy obfuscation, authenticated encryption, and read-only x86-64 translation of offline capture files.
Interactive learning tools
Section titled “Interactive learning tools”Ownership lessons include step-by-step memory models inspired by Aquascope, which presents both Rust’s execution behavior and the facts checked by the borrow checker. Knowledge checks are inspired by mdbook-quiz, including multiple-choice, short-answer, and compile-tracing questions with saved attempts. Memory figures and diagrams are drawn by the site itself, so every one follows your chosen palette.
Where this book came from
Section titled “Where this book came from”This book began as a copy of Game Hacking Academy, a set of game hacking tutorials by attilathedud. It has since been rewritten for beginners, with new lessons, figures, quizzes and labs, and its examples are written in Rust. The original PDF is still available as a legacy snapshot. It predates this rewrite, so the website is the source of truth. The links below lead to the original project’s GitHub organisation and news account, and to a Discord server for learners.
This book grew out of the original Game Hacking Academy by attilathedud and has been rewritten as a beginner-first course. Like the original repository, its source is published under the Apache License 2.0.