All lessons
155 lessons in 15 chapters, about 72 hours to read and work through the examples. The sequence starts with a game action and works inward to state, bytes, and instructions, then outward to files, messages, and deeper system boundaries. Each lab tests an idea explained beside it; reading in order works best the first time through. Later, use the concept titles and summaries below to find a specific explanation or worked example. Times include the worked exercises; your pace will depend on how much you run and explore.
Tick a lesson when you finish it; the lesson list shows the same ticks. Progress is saved in this browser only.
1. Computer, Game, and Code Foundations
CPU and stored values → game objects → a small Rust program → an owned, resettable lab → memory, scanning, and bits About 4.7 hours.
- 1.1Reasoning from Evidence
Ask precise questions, judge evidence, test assumptions, correct mistakes, and build understanding through practice.
20 min - 1.2How a Computer Runs a Game
Build a game from CPU instructions, a small program, stored values, and the services that make it interactive.
16 min - 1.3Game Fundamentals
Follow actions through a game's entities, checks, space, and time; distinguish live state, display copies, server decisions, saves, and bytes.
39 min - 1.4Programming Fundamentals
Build a guarded gold-purchase function and use it to understand variables, branches, test cases, collections, and ways to organize code.
40 min - 1.5Rust Primer: Logic in Code
Express programming logic in Rust: name state, choose a path, repeat work, group values, borrow safely, and handle missing or failed results.
55 min - 1.6Hacking Fundamentals
Turn observed game behavior into repeatable experiments, test a small tool, and record the evidence needed to reproduce its results.
27 min - 1.7A Windows Lab You Can Reset
Set up a Windows virtual machine with the compiler, debugger, memory scanner, course code, and recovery snapshots.
20 min - 1.8How Memory Actually Works
Trace one game value through bytes, types, addresses, pointers, and offsets, then see why a found address can change.
25 min - 1.9What a Memory Scan Really Finds
Find, test, and change one gold value in Wesnoth, and see what each scan does and does not prove.
18 min - 1.10Bits, Masks, Shifts, and Rotations
Read a byte by its bit positions, select flags with masks, and distinguish discarded shift bits from wrapped rotation bits.
22 min
2. Following Instructions and Addresses
A changing value → assembly and a paused process → callers → moving addresses and pointer paths → preserved control flow About 3.3 hours.
- 2.1What a Debugger Can Reveal
Learn what a debugger actually does and why pausing one instruction can answer a big question.
9 min - 2.2How Source Becomes a Running Process
Compare native compilation, bytecode interpretation, REPLs, and type checking; then follow a native program through linking and loading.
28 min - 2.3How Assembly Describes a Running Game
Understand what assembly is, how the CPU executes it, and how registers, memory, flags, stacks, and calls fit together.
30 min - 2.4Breakpoints: One Moment of Program State
Pause on an instruction or memory access, inspect registers, memory, and the call stack, and continue without losing the thread.
12 min - 2.5From a Game Value to the Code That Changes It
Follow a known gold address backward to the exact instruction that changes it.
20 min - 2.6Tracing an Action Through Its Callers
Follow callers and dependencies from one gold-changing instruction to the menu decision that caused it.
28 min - 2.7Why Addresses Move
Understand dynamic allocation, module bases, ASLR, and why a pointer path survives when one raw address does not.
18 min - 2.8How Pointer Paths Survive Restarts
Trace the player object back to a verified starting point and prove the pointer path across restarts.
20 min - 2.9How Detours Change Control Flow
Understand how a small detour can run extra instructions and still return the game to its original path.
14 min - 2.10What a Working Detour Must Preserve
Build a temporary debugger-only detour, prove every hop, and restore the target.
17 min
3. Typed Memory, Ownership, and Object Layouts
A checked boundary → deeper Rust at that boundary → decoded values → external copies → objects, collections, and text About 5 hours.
- 3.1Safe Boundaries for Game Memory
Learn the ownership, address, byte-buffer, error, and operating-system boundaries used by every memory tool.
28 min - 3.2Rust: Missing Values, Failures, and States
Follow Option and Result through closures, early returns, and pattern matching, then represent game states with enums.
22 min - 3.3Rust: Collections, Bounds, and Bytes
Read iterator chains, overlapping windows, complete records, explicit byte conversion, integer limits, and C layout.
24 min - 3.4Rust: Borrowed Views and Useful Interfaces
Connect lifetimes, typed offsets, From and Into, Display, derived traits, generic capabilities, and validated builders.
24 min - 3.5Rust: Cleanup and Helpful Errors
Use scope-bound cleanup, Drop, structured library errors, and application context without hiding failures.
22 min - 3.6How Bytes Become Numbers and Pointers
Work out by hand how whole numbers, negative numbers, and f32 floats are stored, and exactly what a pointer's type controls.
24 min - 3.7How External Tools Read Game Memory
Open the target, read a verified address, and write through a small checked process-memory wrapper.
24 min - 3.8How C++ Objects Appear in Memory
Turn repeated reads, member-function calls, and virtual dispatch into a tested object layout, then inspect it through typed snapshots.
35 min - 3.9Object-Oriented Clues in Machine Code
Recognize the shapes that factories, states, observers, singletons, and component systems leave in compiled code: repeated pointers, virtual calls, constructors, and update loops.
42 min - 3.10How Collections Live and Die in Memory
Identify vectors, strings, handles, component pools, reference counts, and destruction paths without assuming one compiler's private layout.
40 min - 3.11How Text Becomes Bytes in a Game
Trace visible text to bytes, understand encodings and terminators, and build checked strings at FFI boundaries.
16 min
4. Game State and Bounded Decisions
An engine frame → copied players → guarded actions → coordinates and grids → feedback, targets, paths, events, and basic NPC decisions About 4 hours.
- 4.1Game Engines: Input, Simulation, and Rendering
Follow input, movement, collisions, timers, and drawing through an engine; distinguish live state from the code and files that produce it.
35 min - 4.2From One Player to a Game-State Snapshot
See how one verified player layout becomes a bounded, typed snapshot of every side in a local match.
18 min - 4.3Why Snapshots Need Guarded Actions
Learn why live reads go stale and how snapshots, separate observation, and verified writes protect a game-state tool.
26 min - 4.4Coordinates, Vectors, and Directions
Build distance and direction from positions, use normalization and dot products to express spatial decisions, then blend values and test contact with simple shapes.
26 min - 4.5Maps as Grids of Game State
Understand a map as indexed game state, then trace and visualize one tile's visibility in an offline lab.
16 min - 4.6Automation as a Feedback Loop
Use a recruitment loop to see why feedback, named states, confirmation, and a safe stop make automation reliable.
22 min - 4.7From Coordinates to Target Selection
Trace player and enemy positions in offline Flare, then choose actions from validated coordinates rather than fixed timings.
21 min - 4.8Pathfinding on a Game Map
Turn a verified tile grid into routes with BFS or A-Star, keeping map observation separate from game input.
36 min - 4.9When Changed State Becomes an Event
Turn repeated polls into meaningful events with snapshot differences, debouncing, confirmation, and cooldowns.
25 min - 4.10How NPCs Sense and Decide
Follow a guard through sensing, delayed reactions, and state changes to understand how games choose an NPC's next action.
17 min
5. Executable Maps, Instruction References, and Scans
PE layouts and exports → precise instruction lookup → patterns and regions → decoding → tracing profiles and parallel captures About 5.5 hours.
- 5.1What a Windows Executable Contains
Use the PE header and section map to understand where a Windows executable keeps code, data, imports, and addresses.
24 min - 5.2File Offsets, RVAs, and Live Addresses
Connect positions in a PE file to relative virtual addresses and the addresses Windows gives its loaded modules.
28 min - 5.3DLL Exports and Forwarded Names
Understand how a DLL publishes functions through data directories, names, ordinals, addresses, and forwarded exports.
42 min - 5.4Instruction Reference: Values and Integer Arithmetic
Look up common x86 value operations, then explore each one with a worked trace.
28 min - 5.5Instruction Reference: Decisions, Stack, and Bits
Explore comparisons, branches, call stacks, masks, shifts, and debugger stops one instruction at a time.
35 min - 5.6Instruction Reference: Scalar Floating-Point Values
Trace speed, position, numeric conversions, and NaN comparisons using the SSE instructions common in game code.
20 min - 5.7Byte Signatures and Pattern Scanning
See how byte patterns locate candidate instructions across known builds, and why wildcards and semantic checks matter.
35 min - 5.8Memory Regions and Value Scanning
Understand region permissions, copied snapshots, candidate filtering, and guarded writes in a value scanner.
35 min - 5.9Instruction Decoding and Disassembly
See how a disassembler finds boundaries and meanings in variable-length x86 byte streams.
22 min - 5.10Event Tracing for Windows
Understand how ETW records time-stamped events around a running game and how to read a short performance trace.
28 min - 5.11Parallel Scanning and Stable Snapshots
Use immutable memory snapshots, bounded workers, cancellation, and sorted results to make scanning faster without losing reproducibility.
32 min
6. Windows Processes and Callable Interfaces
Process resources → rights and owned handles → pages and threads → call contracts → engine scheduling, input queues, debug events, and bounded observation About 5.4 hours.
- 6.1The Running Game as a Process
An executable becomes a process with threads, modules, handles, and Windows-managed state; the PEB and TEB reveal useful structure without being a safe API.
24 min - 6.2Game Runtimes and Object Lifetimes
Native code, Mono, IL2CPP, .NET, and Java expose different evidence about objects and their lifetimes; classify a build before trusting an offset.
26 min - 6.3Process Access Rights
A process ID names a target; tokens, integrity levels, DACLs, and access masks decide which operations Windows permits.
26 min - 6.4Handle Ownership and Lifetimes
Windows handles are capabilities with lifetimes. Rust ownership and RAII make leaks and double closes easier to prevent.
25 min - 6.5Virtual Address Spaces and Page Protections
Pages, regions, and R/W/X permissions explain why a game address can exist, fail, or change meaning.
33 min - 6.6Threads, Contexts, and Stacks
A game's threads share process resources while retaining separate execution contexts and call stacks; scheduling and races shape what an observer sees.
33 min - 6.7What a DLL Function Promises Its Caller
Infer an exported function's parameters, calling convention, result, and responsibility for memory cleanup before wrapping it in a small typed API.
28 min - 6.8How an Engine Orders and Shares Its Work
See how an engine's systems share data through components, resources, and events, how one frame's work is ordered and run in parallel, and how the engine notices only what changed.
32 min - 6.9Windows Input: Polling, Events, and Messages
Compare hotkey polling, synthetic input, and window messages so a local game tool chooses the right input boundary, and see how the window's client area, scale, and several windows change the coordinates it works with.
36 min - 6.10Debug Events and Software Breakpoints
Understand how Windows debug events, breakpoint bytes, and thread state let a debugger pause and resume a real instruction.
24 min - 6.11Sampling Game State Under Load
Record changing game state without delaying observation, hiding dropped samples, or losing the log's meaning.
35 min
7. Camera Geometry and Rendering APIs
Coordinate frames → pipeline state → OpenGL observations → collision and aim geometry → motion, radar, projection, and Direct3D interfaces About 6.6 hours.
- 7.1Camera Frames and Projection
Follow a world-space point through engine axis conventions, camera axes, object transforms and their local and world copies, quaternions, homogeneous coordinates, orthographic projection, and texture coordinates.
40 min - 7.2The Rendering Pipeline and Its State
See how objects become pixels through meshes, materials, light, shaders, rasterization, depth testing, transparency, visibility flags and layers, culling, render passes, HDR and anti-aliasing, the renderer's own copy of the world, and the 2D case, and the state that gives each draw its meaning.
55 min - 7.3OpenGL Draw Calls and State
Understand what indexed OpenGL draws request, how bound state, depth settings and shader inputs change their meaning, and why observation must keep the render thread moving.
40 min - 7.4Render Categories and Color Probes
Use temporary color to distinguish render categories while accounting for materials, lighting, blending, color space, and the several passes that draw one frame.
20 min - 7.5Camera Rays, Collisions, and Crosshairs
See how a camera ray, collision query, and occlusion test become a game's crosshair target, and how the same ray from a mouse cursor picks what is under it.
34 min - 7.6Aim Geometry and Target Selection
Connect vectors to yaw, pitch, angular error, target ranking, how animation poses a skeleton, target points, timing, and projectile motion.
44 min - 7.7Recoil, Spread, and Camera Motion
Separate input, weapon kick, random spread, camera shake and other camera motion, and recovery to understand why the view moves after a shot.
32 min - 7.8Radar Coordinates and Marker Filtering
Follow team and alive filters, local coordinate transforms, radar scale, range clipping, and elevation markers.
23 min - 7.9World-to-Screen Projection and Overlays
Follow a 3D point through world, view, clip, normalized, and screen coordinates, with the field of view, aspect ratio, and each camera's viewport, to place stable overlays.
44 min - 7.10Direct3D Interfaces and Vtables
Understand how COM vtables expose Direct3D methods, why export lookup differs from OpenGL, and how a reversible swap-chain hook works.
34 min - 7.11Direct3D Draw Calls and Bound State
Read Direct3D draw calls in the context of their bound state, compare what the same arguments mean in Direct3D 9 and 11, and see how shader variants, instancing, and many small draws change a frame's cost.
32 min
8. In-Process Tools, Input, and Integration
DLL lifetime → loading → reversible detours and import hooks → game input and commands → rendered menus and snapshots → architecture and safe removal About 5.3 hours.
- 8.1In-Process DLLs and Loader Boundaries
Understand what changes when Rust code runs inside a game process and how DLL loading constrains initialization.
20 min - 8.2DLL Loading Across Process Boundaries
Follow the module path, process handle, remote memory, and loader call involved in loading a DLL into a controlled game process.
20 min - 8.3Detours and Reversible Patches
Understand how a detour redirects execution, preserves displaced instructions, verifies target bytes, and restores the original path.
44 min - 8.4Import Table Hooks
See how an imported function pointer can be redirected inside a controlled process and safely restored.
28 min - 8.5How a Game Reads Input
Follow a key press, a stick movement, and a mouse move from the device to a game action, and see why buttons have edges, sticks have dead zones, and typed text is not the same as keys.
28 min - 8.6Menus as State and Command Interfaces
See how a settings menu expresses feature state, sends commands to a worker, and shuts down without leaving stale changes.
38 min - 8.7In-Game Menus and Text Rendering
Understand what a game's interface is made of, how its text function can draw a small menu, and why input edges, frame timing, and string lifetimes matter.
36 min - 8.8Render Snapshots and Feature Integration
Combine camera and player observations, graphics features, versioned profiles, and reversible hooks, including two exact-build Urban Terror wallhacks, without mixing frames or losing game state.
24 min - 8.9Tool Architecture, Commands, and Cleanup
Organize a local tool around owned snapshots, typed commands, feature lifecycles, version checks, and dependable cleanup.
26 min - 8.10Hooks as Live Control-Flow Changes
A hook changes live control flow under threads, ABI rules, and versioned bytes; safe installation and removal preserve those contracts.
52 min
9. Network Messages, Authority, and IPC
Programs exchanging messages → what the server discloses → capture, parsing, and legal session order → clients, relays, local transports, and an engine example About 4.2 hours.
- 9.1Messages, Streams, and Multiplayer
See how a client and server turn a move into framed bytes, and why TCP transport does not define a game's message boundaries.
25 min - 9.2What the Server Can See
Validate commands against server-owned state, withhold hidden information, and use replays carefully.
8 min - 9.3Protocol Capture and Message Framing
Learn how a short local capture reveals message direction, boundaries, and the bytes associated with one game action.
17 min - 9.4Message Parsing and Serialization
Connect raw chat frames to typed messages through bounded parsing, serialization, and round-trip checks.
30 min - 9.5Protocol State Machines and Replay
Understand legal message order through session states, replay, real-time ticks, snapshots, and sequence numbers.
39 min - 9.6Clients, Handshakes, and Chat Automation
See a complete protocol client perform Wesnoth's local handshake, read framed messages, and respond to one chat command.
24 min - 9.7Local Proxies and Bidirectional Streams
Understand how a local proxy relays two byte streams while preserving direction, framing, and the original messages.
20 min - 9.8Shared Memory Between Processes
See how two processes communicate through named shared memory, with explicit layouts, permissions, synchronization, and cleanup.
34 min - 9.9Named Pipes and Local Message Framing
Compare byte and message modes in Windows named pipes, then account for framing, bounded reads, connection races, and handle ownership.
38 min - 9.10How the Source Engine Works
Follow a player's command through Source's modules, prediction, server simulation, and snapshots, then connect those boundaries to settings and game files.
18 min
10. Game Files, Mods, and Artifact Trust
Saved state and assets → inspect and edit a copied file → safe packages and reversible mods → hashes, exact build identity, signatures, and encryption About 5.1 hours.
- 10.1Game Files and Live Memory
See how saves, configuration, textures, maps, and archives preserve game state outside a running process, how a game turns an asset file into something it can draw or play, and how long that asset stays loaded, changes, or reloads.
32 min - 10.2Save Formats and Safe Editing
See how text saves encode state, how controlled comparisons reveal fields, and why writes must be atomic.
24 min - 10.3Binary Saves and Hex Editing
Read offsets and bytes in a hex editor, decode a small binary save, compare two files, and update a checksum.
32 min - 10.4Textures and Asset Replacement
Connect a visible game surface to its texture file, preserve the expected format, and package a reversible replacement, then read the same ideas in a 3D model (glTF) and a sound, including how a sound is placed between two ears and fades with distance.
34 min - 10.5Data-Driven Game Mods
Understand how a game turns editable unit definitions into behavior and how small changes can be validated.
18 min - 10.6Mod Archives and Safe Extraction
Learn why archive entry names require path, size, and file-type checks before a mod is installed.
27 min - 10.7Reversible Mods and Manifests
Use a manifest to record installed files, hashes, and restore actions so a mod can be checked and removed.
24 min - 10.8File Hashes and Digital Signatures
Separate byte integrity from publisher identity through hashes, signatures, certificates, and Windows trust checks.
37 min - 10.9Build Identity and Versioned Evidence
Learn why a version label is not enough and how a verified SHA-256 manifest ties addresses, patterns, mods, and patches to exact files.
30 min - 10.10Encryption and Key Lifecycles
Compare encoding, hashing, MACs, and encryption, then follow the keys and metadata needed to protect a save.
46 min
11. NPC Policy, Lua, and Script Execution
Remembered observations and decisions → Lua and the host interface → bounded script policy → computability limits → bytecodes, values, and call frames About 5.7 hours.
- 11.1How an NPC Sees, Chooses, and Remembers
Work through the arithmetic inside Lesson 4.12's toy guard: the distance and dot product behind its view cone, stepped line-of-sight checks, utility scores and their switch points, and behavior trees.
22 min - 11.2Why Games Use Lua
See why a game hosts Lua, run a small observer script, and learn the values and host boundary that later lessons build on.
20 min - 11.3Lua Tables, Functions, and Metatables
Lua's flexible tables and first-class functions express records, sequences, callbacks, methods, and lookup behavior.
30 min - 11.4The Host–Script Boundary
An embedded Lua VM can act only through the host functions and libraries the game exposes; typed contracts and error context keep that boundary clear.
35 min - 11.5Snapshots as a Script Interface
Immutable, versioned observations and bounded action requests connect Lua to game state without exposing arbitrary pointers.
33 min - 11.6State Machines for Lua Automation
Named states, guarded transitions, timeouts, and a stop path make a scripted game observer predictable.
31 min - 11.7Script Budgets, Errors, and Recovery
Memory and instruction limits, tracebacks, and failure handling keep useful scripts from overrunning their host.
30 min - 11.8What Any Computer Can Compute
Build a Turing machine by hand, see why one computer can run every program, and learn which questions about programs no tool can always answer.
22 min - 11.9From Lua Source to a Tiny Virtual Machine
Tokens, syntax, bytecode, and a bounded interpreter loop turn a short Lua-like expression into machine behavior.
42 min - 11.10Values, Tables, Strings, and Garbage Collection
See how a dynamic language represents values, why tables combine array and map behavior, and why automatic memory management must understand shared references and cycles.
38 min - 11.11Call Frames, Closures, and Upvalues
Understand VM call frames, multiple returns, captured locals, open and closed upvalues, and the host boundary where native functions enter Lua.
40 min
12. Loaders, Kernel Services, and Trust Boundaries
Module identity and loading → dynamic calls → kernel authority and system calls → driver requests → trust boundaries and failed checks About 4.3 hours.
- 12.1DLL Identity and Search Order
A loaded module has a path, bytes, signer, and dependency context; names alone cannot prove which code entered a game.
30 min - 12.2DLL Loading and the Loader Lock
Mapping imports and running DllMain require careful ordering; a tiny entry point avoids work that can deadlock the loader.
27 min - 12.3Dynamic Windows API Resolution
Runtime export lookup turns an optional Windows API into a checked capability with an explicit ABI and fallback.
29 min - 12.4What an Operating System Kernel Does
The processor separates user and kernel authority. System calls, scheduling, memory, interrupts, and drivers show what the kernel does for a running game.
18 min - 12.5From Win32 Calls to Kernel Services
A Windows API call crosses layers of exports, native APIs, and system calls before a kernel service acts on a request.
28 min - 12.6System Calls and Privilege Checks
Privilege bits, page permissions, API stubs, handle checks, and NTSTATUS together explain one request's route through the kernel.
13 min - 12.7How Device Drivers Work
Drivers translate operating-system requests into hardware work through I/O packets, registers, interrupts, and DMA, including the path from key press to game input.
18 min - 12.8Driver Requests and Device Registers
Control-code fields, device registers, interrupt work, and USB reports reveal how a driver turns a request or key press into an observable result.
18 min - 12.9The Kernel Trust Boundary
Kernel drivers have authority beyond a game process; driver inventories and narrow privileges make that boundary visible.
22 min - 12.10Failure Modes at Trust Boundaries
Eight further failure modes, from wrapping arithmetic to partial commits, show where an invariant must be enforced.
55 min
13. Physical Memory, Machines, and Hardware
DMA and page translation → virtual guests → firmware and consoles → chip debug access → emulated instructions and time About 4.1 hours.
- 13.1DMA and Physical Memory
DMA gives devices a path to memory, while page tables and IOMMUs determine which physical bytes correspond to an address.
40 min - 13.2Virtual-to-Physical Address Translation
An offline page-table walk maps one process address to bounded offsets in a RAM capture, including reads that cross pages.
48 min - 13.3Hypervisors and Virtual Machines
A hypervisor gives guest machines controlled access to processors and memory through VM exits, two-stage translation, and snapshots.
18 min - 13.4Guest Execution and Address Translation
A guest relies on virtualization support and two-stage address translation; walking one address shows both the isolation and its cost.
10 min - 13.5Firmware and Bare-Metal Rust
Follow a microcontroller from reset to Rust, build a working firmware image, and understand what changes when you program a physical board.
28 min - 13.6How Game Consoles Are Built
Consoles combine familiar computer parts with secure boot, signing, and platform rules that shape how games can run and be modified.
20 min - 13.7Hardware Debugging with JTAG
JTAG began as a board-test port and became a hardware debugging path through scan chains, the TAP controller, and SWD.
18 min - 13.8JTAG Scan Chains and Debug Access
Shift registers, TAP states, IDCODE, and SWD packets show how a hardware debugger discovers and controls a chip.
23 min - 13.9How Emulators Work
An emulator recreates a console in software through instruction execution, memory-mapped I/O, timing, graphics, audio, and save states.
18 min - 13.10Emulator Timing and State
A toy console makes instruction costs, frame timing, save states, and register races concrete inside a Rust emulator.
20 min
14. Versioned Evidence, State, and Integrity
An exact-build layout → bounded call logs and saved captures → state invariants and correlated telemetry → integrity signals and reversible representations About 6.8 hours.
- 14.1Object Layouts Across Game Updates
Object identity, field offsets, and layouts must be recovered for each build through several independent access patterns, starting from a toy guard whose padded layout is known.
50 min - 14.2Call Tracing and Bounded Logs
Connect scanning, decoding, breakpoints, and bounded logging to a trace of calls made by a running game.
35 min - 14.3Crash Dumps as Process Snapshots
A small dump preserves selected threads, modules, registers, and stacks for later inspection without a running process.
24 min - 14.4Capture Provenance and Validation
A plausible translation can still describe the wrong process, build, or moment; provenance and independent checks give offline bytes meaning.
34 min - 14.5Game State and Invariants
A game's state changes through transitions. Invariants describe which states remain valid, while controls and detectors answer different parts of that promise.
30 min - 14.6Telemetry as Evidence of Game Behavior
Bounded event traces connect inputs, decisions, and effects so a suspected control gap becomes a testable claim.
47 min - 14.7Integrity Checks and Their Boundaries
An integrity check is meaningful only when its inputs, timing, and decision path cover the state it promises to protect.
50 min - 14.8Anti-Debug Signals and Responses
Anti-debug behavior is a sequence of signals, interpretations, and responses; explicit states expose false positives and weak assumptions.
45 min - 14.9When Game Values Are Encoded
Learn the difference between representation and security, trace small encode/decode paths, and implement a reversible value plus integrity check.
38 min - 14.10Obfuscated Values and Reversible Transforms
Reversible transforms can hide a value in memory without providing encryption; round trips and controlled changes reveal the rule.
55 min
15. Defensive Design and Anti-Cheat
Why validation matters → server and client observations → detection and review → two isolated control-gap examples → documented protection and resilient game design About 2.6 hours.
- 15.1Why Games Need Anti-Cheat
Separate a player's requests from the game's decisions, and connect prevention, detection, and fair enforcement.
7 min - 15.2Server Plugins, Counters, and False Flags
Read Macrodox and other SourceMod designs as measurement systems, separating button edges, weighted history, and enforcement.
10 min - 15.3What Client Protection Can See
Connect local integrity checks and kernel protection to boot trust, driver risk, privacy, and reliability.
8 min - 15.4How Detections Work
Compare detector signals and count the real people behind a false-positive rate.
8 min - 15.5Layers, Trust, and Review
Combine game, platform, league, and server observations without treating duplicated reports as independent proof.
7 min - 15.6Cheat Categories from the Defender's Side
Connect different locations of unauthorized code and automation to the observations and boundaries a defender can use.
8 min - 15.7Control Gaps in Toy Defenses
Three small defenses show how an apparently valid check can miss the path that produces an effect, and how to repair its invariant.
32 min - 15.8Control Gaps in Game Logic
Three toy game controls reveal a recurring mismatch between the checked proxy and the effect that actually changes state.
58 min - 15.9Anti-Cheat in Modern Games
Compare documented protection boundaries and lifetimes without treating product names as proof of effectiveness.
8 min - 15.10Designing a Game That Is Hard to Cheat In
Place authority, disclosure, retries, evidence, and permissions into the game's design from the beginning.
8 min
This book grew out of the original Game Hacking Academy by attilathedud and has been rewritten as a beginner-first course. Like the original repository, its source is published under the Apache License 2.0.