Field reference · plain English first

Glossary

A compact map of the words used throughout the book. Each definition says what a term means, what it is not, and—when the distinction matters—how it connects to a neighboring idea.

Meaning the shortest useful definitionDistinction a nearby term people often mix upContext why it matters while studying a running game

Reading tip: do not memorize the list. Return when two words start to blur together—for example, RVA versus file offset, or hash versus encryption.

0–9

2D: Two-dimensional: a position needs two coordinates, usually horizontal x and vertical y. Screen pixels, menus, and tile maps are common 2D spaces.
3D: Three-dimensional: a position needs three coordinates. A 3D engine transforms points through several coordinate systems before they become 2D pixels.
32-bit / 64-bit: The width of the architecture and its usual pointer size. A 32-bit process normally uses four-byte pointers; a 64-bit process normally uses eight-byte pointers. This changes layouts, addresses, registers, and which DLL can load.

A

A* A-star: A graph-search algorithm that combines the cost already paid with a heuristic estimate of the cost remaining. With an admissible heuristic it finds a cheapest path; unlike breadth-first search, it can aim toward promising nodes.
ABI Application Binary Interface: The machine-level agreement between compiled pieces: register use, stack layout, calling convention, type layout, symbol naming, and more. An API describes how source code calls something; an ABI describes how the resulting machine code fits together.
Abstraction: A simpler interface that hides details behind a promise. A safe memory reader can expose “read this typed value” while containing handle management, byte counts, and raw pointers internally.
Access mask: A bit field describing requested or granted operations on a Windows object. Ask for the smallest set needed; a process handle is not simply “open” or “closed,” because its access mask limits what it can do.
Access right: One named permission inside an access mask, such as querying process information or reading memory.
Access token: The Windows object that describes a process or thread’s security identity, groups, privileges, and integrity level. Windows compares the caller’s token with the target object’s security rules before granting a handle.
Address: A number naming a byte location in an address space. An address is not automatically valid, readable, writable, or the start of the value you expect.
Address space: The set of virtual addresses a process can use. Two processes can use the same numeric virtual address while mapping it to different physical memory.
Alignment: A requirement or preference that data begin at an address divisible by a particular power of two. Compilers insert padding so fields satisfy their alignment.
Algorithm: A finite, repeatable method for turning input into output. The code is one implementation; the underlying steps are the algorithm.
Anti-aliasing MSAA / FXAA / TAA: Hiding the stair-steps on the edge of a diagonal shape. MSAA tests coverage at several points inside each pixel, FXAA blurs high-contrast edges in the finished picture, and TAA shifts the camera a little every frame and blends the results over time. They cost memory, a full-screen pass, and a history buffer respectively.
Anti-cheat: Controls that protect game rules against unauthorized advantages, including server validation, client protection, investigation, and enforcement.
Anti-debugging: Behavior that detects or reacts to debugger-related conditions. Defensive analysis names the observable artifact and tests it; it does not assume every delay, exception, or unusual branch proves a debugger check.
Anti-rollback: A check that refuses genuinely signed but older software by comparing each image’s security version with a minimum kept in fuses. It stops anyone reinstalling a version with a known security hole.
API Application Programming Interface: A documented way for one piece of software to request work from another. A function name, its parameters, return value, and error rules form part of an API contract.
Argument: A value supplied to a function call. The calling convention determines where machine code places arguments; the function signature explains what those values mean.
Array: A fixed-size sequence of same-type elements stored contiguously. Given the base, index, and element size, an element address is base + index × size.
ASCII: The standard table that gives English letters, digits, and common symbols the numbers 0 to 127; for example 0x41 is A. Bytes from 0x20 (a space) to 0x7E are printable.
ASLR Address Space Layout Randomization: An operating-system defense that varies where images and other regions are mapped. A module-relative location can stay stable while its absolute virtual address changes between launches.
Assessment: An interpretation made from one or more signals. Keep the measured signal separate from the assessment so a later test can challenge the interpretation without rewriting the observation.
Assembly language: A human-readable notation for machine instructions. It exposes registers, memory operands, branches, and calls more directly than a high-level language, but each line still needs architectural and calling-convention context.
Asset: A reusable game resource such as an image, model, sound, or character definition. Several running instances can share an asset while keeping different identities and changing state. See Game Fundamentals.
Attack surface: The set of inputs, interfaces, privileges, and trust transitions through which a system can be influenced. Reducing unnecessary parsers, handles, loaders, and exposed commands reduces the surface.
Authenticode: Microsoft’s format and verification system for signing Windows files. A valid signature links the exact signed bytes to a certificate chain; it does not prove the program is harmless or bug-free.
Authenticated encryption: Encryption that also detects unauthorized modification, usually through an AEAD construction. Confidentiality hides plaintext; authentication detects tampering. Both properties matter and are different.
Authoritative state: The one copy of a value whose contents decide what happens next, such as the simulation’s entity object or, in a multiplayer game, the server’s record. Checks that protect a value must run against this copy, not a cached or displayed one.
Authority boundary: The separation between a request and the party permitted to decide its result.

B

Bare-metal programming: Programming that runs without an operating system providing application services. The image needs a suitable startup arrangement, memory layout, and hardware interfaces; Rust’s no_std alone does not supply them.
Base address: The starting virtual address of a mapped image or region. A live image address is commonly module base + RVA.
Base rate: How common a condition is in the population being observed. Rare cheating can make false flags outnumber true flags even with a small false-positive rate.
Batch processing: Processing a collected group of data together, such as recalculating a leaderboard from finished-match results. Stream processing instead handles an ongoing sequence of events as they arrive.
Behavior tree: A tree of conditions and actions that an NPC evaluates from the root every tick. A selector node tries its children until one succeeds; a sequence node runs its children until one fails.
BFS Breadth-first search: A graph search that visits all nodes one edge away, then two edges away, and so on. On an unweighted graph it finds a path with the fewest edges.
Binary: Either base-two notation or a compiled file made of bytes. Context decides which meaning is intended.
Bit: One binary digit, 0 or 1. Flags often pack several yes/no facts into the bits of one integer.
Bootloader: Software that selects, checks, or loads another program to run next. It can support updates or recovery; the application’s runtime startup still has its own initialization responsibilities.
Boot ROM: The first code a chip runs at power-on, written into the chip when it is made and unchangeable afterwards. In secure boot it checks the first stage that can be updated.
Border: In Lua, a key whose value is present while the next key’s value is missing. The length operator # may return any border, so a table with a hole in its sequence has no single length.
Boundary scan: A test method in which a cell between each chip pin and the chip’s logic can capture the pin’s level or drive a chosen level. The cells form a shift register, so every connection on a board can be tested through one serial chain.
Bounding volume: A simple shape, such as a sphere or a box, that stands in for an object’s real shape in fast tests: contact, picking, and deciding whether to draw it. It is a rough fit on purpose, so touching the shape is not always touching the model.
Branch: An instruction that may change which instruction runs next. Conditional branches implement decisions; unconditional jumps always transfer control.
Breakpoint: A debugger stop condition attached to an instruction, memory access, or event. A breakpoint gives you one observation point; it does not by itself explain why execution arrived there.
BSP Binary Space Partitioning: A map format used by Source games. Its sections store compiled world geometry and related level data. It is a level description; it is not the archive that groups many separate game assets.
Buffer: A memory area reserved to hold bytes temporarily. Correct code tracks both capacity and current length and never trusts an external length before checking it.
Bug check Blue screen, stop error: Windows deliberately halting the whole machine after a kernel-mode failure it cannot safely recover from, showing a stop code and writing a crash dump.
Build fingerprint: A set of evidence used to identify one exact program build—such as file size, timestamp, version fields, section layout, and cryptographic hash. Multiple signals are stronger than a filename alone.
Bypass: A way of reaching an outcome without satisfying the control that was meant to guard it. Rigorous analysis states the intended invariant, the observable check, and the unguarded path; defensive work then repairs the invariant rather than merely adding another fragile check.
Byte: Eight bits and the smallest addressable unit on the systems in this book. Types give groups of bytes a size and meaning.
Bytecode: Instructions for a software virtual machine rather than the physical CPU. Lua source may be compiled into Lua VM bytecode before the VM executes it.

C

Cache: A faster storage layer that keeps copies of recently or predictably useful data. CPU caches are not extra variables visible in source; they are part of how memory accesses are served.
Call frame stack frame: The part of a thread’s stack used by one active function call, commonly holding a return address, saved registers, local values, and spilled arguments.
Call stack: The ordered chain of active function calls on one thread. Reading it answers “who called whom?” only when unwind information and stack state are trustworthy.
Callback: A function handed to other code so that code can call it later, at a moment it chooses. You register a callback instead of calling it yourself. Event loops, debuggers, Lua hosts, and game engines all run code this way.
Calling convention: The ABI rules for a function call: where arguments and results go, which registers a callee must preserve, who adjusts the stack, and how the stack is aligned.
Camera space view space: Coordinates expressed relative to the camera. The view transform moves the world so the camera becomes the origin with a chosen forward direction.
Canonical state: The state a game actually consumes to decide an effect. A menu copy, render cache, or old snapshot can resemble canonical state without owning the decision.
Chain of trust: The sequence of secure-boot stages, each trusted only because the stage before it checked its signature. It starts at a root of trust that nothing checks, because nothing can change it.
Change detection: Letting a system ask only for the components written since it last ran. The engine stamps each write with a frame counter, and a write counts as a change even when the new value equals the old one, so a tool that rewrites a value every frame makes everything triggered by that change run every frame.
Cheat code: For an old console game, an address and a value: either a byte substituted when the game reads that address, or a value written to RAM once every frame. It works because those games keep their variables at fixed addresses.
Checksum: A compact value used mainly to detect accidental corruption. Unlike a keyed MAC or digital signature, an ordinary checksum does not prove who produced the data.
Circular array: Fixed-capacity storage whose write position returns to the beginning and replaces the oldest slot.
Client area: The part of a window a program draws into, without the title bar and borders. The window rectangle includes them, so converting between window and screen positions uses the client area’s own origin.
Client protection: Checks and controls running on a player’s machine, with observations limited by permissions and trust in that environment.
Clip space: The homogeneous coordinate space produced by a projection matrix. Clipping happens here before dividing x, y, and z by w to obtain NDC.
Clock cycle Cycle: One tick of a processor’s clock. Emulators count the cycles each instruction takes, so the emulated CPU, graphics, and sound stay in step as they did in the original hardware.
Closure: A function value together with the outside values it captures. In Lua, captured locals live through upvalues.
Code cave: An unused executable byte range large enough to hold added instructions. “Unused” must be proven for the exact build; padding-looking bytes may still be data, alignment, or a branch target.
Code section: A PE section intended to contain executable instructions, usually named .text. Section names are conventions; protection flags and verified layout carry more weight.
Committed memory: Virtual address space for which the operating system promises backing storage. Committed does not mean the page is currently resident in RAM.
Compilation: Translating code from one representation to another. Rust commonly compiles source to native machine code before a program runs; Lua compiles source to virtual-machine bytecode when it loads a chunk.
Compression: A reversible transformation that represents data with fewer bytes. It is not encryption: compressed data may look irregular, but no secret key is required to restore it.
Compute shader: A GPU program that is not part of drawing: it runs once for each item in a grid of work and reads and writes buffers. Engines use it for particles, culling, mesh deformation, and post-processing.
Concurrency: Multiple tasks making progress during overlapping time. Parallelism means work literally runs at the same instant; concurrent tasks may instead take turns.
Console variable cvar: A named setting an engine exposes through its in-game console, which can be read or changed while the game runs. Toggling one gives a clean experiment: whatever changes in memory at the same moment is connected to that feature.
Context switch: Saving one thread’s registers and loading another’s so a core can run a different thread. Switching to a thread of another process also loads that process’s page tables into cr3.
Contradiction: Evidence that two claims cannot both satisfy the stated model—for example, a decision says “denied” while the correlated game effect still changes canonical state.
Control: Logic intended to preserve an invariant, such as validating a command before applying it. This differs from control flow, which describes instruction order.
Control code IOCTL: A 32-bit number sent with DeviceIoControl that packs a device type, the access the caller’s handle must hold, a function number, and a buffer method.
Control flow: The order in which instructions execute, shaped by sequential steps, calls, returns, branches, exceptions, and threads.
ConVar Console variable: A named game-engine setting with a current value and flags. Flags can control who may change it, whether the server replicates it, and whether another process may query it.
Coordinate system: An origin, axes, units, and orientation used to describe positions. Numbers are meaningless until you know which space and convention they belong to.
Correlation: A tendency for observations to vary together. Shared inputs or defects can make detector errors occur together.
Correlation ID: An identifier attached to events from one logical action so observations from different threads or stages can be joined without assuming timestamps alone prove causality.
Coverage: The exact bytes, fields, branches, states, or cases examined by a check. A result is only meaningful for what the check actually covered.
Coverage bypass: A meaningful change that falls outside what a control measures, allowing the checked subset to remain valid while the larger promised relation becomes false.
CPU Central Processing Unit: The processor that executes machine instructions. Registers hold immediate working values; caches and memory supply code and data.
Cross-validation: Confirming a field with independent checks that all agree, such as the instructions that access it, how its value changes when the game changes, the object it belongs to, and its range relative to other fields.
Crash dump: A captured subset of process state around a failure, often including threads, registers, stacks, modules, and selected memory. It is evidence from one moment, not a full recording of everything that happened earlier.
Culling: Skipping work for what cannot be seen: objects outside the camera’s view volume (frustum culling), triangles facing away (back-face culling), or objects hidden behind others (occlusion culling). Culling happens before drawing; the depth buffer decides per fragment afterward.

D

DACL Discretionary Access Control List: The Windows rules that allow or deny requested access to a securable object. The object’s DACL, the caller’s token, and the requested access mask participate in the access check.
Data model: The values, relationships, and constraints chosen to describe a problem. A character model names attributes and owned items; a save or message format describes how selected model data is represented. See storage models.
Data structure: A layout and set of rules for organizing values so operations such as lookup, insertion, traversal, or deletion have useful costs.
Dead zone: A range around the centre of a stick or trigger that the game treats as zero, so a resting stick that reads 0.06 does not make a character drift. Engines usually rescale the rest of the range so the output starts from 0 instead of jumping.
Debouncing: Suppressing repeated triggers until an input has stayed stable or enough time has passed. It turns noisy changes into one intentional event.
Debug build Release build: A build made for finding mistakes, with most optimizations left out. Engine code that loops over thousands of entities can run many times slower in it than in a release build, so a frame time means little until you know which kind of build produced it.
Debugger: A tool that controls and observes a running program: pausing threads, reading registers and memory, stepping instructions, and receiving debug events.
Debugger artifact: An observable condition associated with debugging, such as a flag, handle, exception path, timing change, or modified instruction byte. Each artifact has false positives and can disappear across versions, so treat it as evidence rather than proof.
Dedicated server: A server process that runs the shared simulation without a local player client. A listen server hosts the simulation while its owner also plays through a client.
Deferred command: A request such as “spawn a bullet here” or “despawn brick 7” that a system records instead of doing at once. The engine applies the queue at a safe point, so a spawned entity is first seen by systems that run later, or by every system on the next frame.
Deferred procedure call DPC: Driver code queued by an interrupt service routine to run shortly afterward at a lower priority, where it finishes the device work and completes waiting requests.
Delta time: The time since the previous frame or step, in seconds. Movement is scaled by it (distance = speed × delta time) so a character’s speed does not depend on the frame rate.
Depth buffer: A per-sample store used to decide which fragment is in front. Its values are produced by projection and are often nonlinear; it is not simply “distance from the camera.”
Detection precision: The fraction of flagged cases that actually have the condition being detected.
Detection recall: The fraction of cases with the condition that the detector successfully flags.
Detection rule: A precise query over observations that identifies evidence of a stated condition. A useful rule names its inputs and possible false results instead of hiding them behind an unexplained score.
Detector: Logic that reports evidence that a condition or invariant failure may be present. A detector can be noisy, incomplete, or independent from the control that prevents the failure.
Detour: A redirection that sends execution into your own code and then back. You overwrite instructions at a chosen point with a jump; a correct detour only ever replaces whole instructions, keeps a copy of the originals, and provides a way back so the interrupted function finishes normally.
Device register: A small storage location inside a device that software reads to learn the device’s state or writes to command it. Unlike RAM, reading or writing a register can have side effects, such as removing data from a queue.
Differential comparison: Running the same code on two inputs that differ in one known way and comparing the outputs. For an XOR-based value transform the key cancels out, so the comparison exposes the rest of the transform without knowing the key.
Digital signature: A cryptographic value that lets a verifier detect byte changes and check that a holder of a particular private key signed the data. Trust still depends on key identity and certificate policy.
Disassembler: A tool that decodes machine-code bytes into assembly instructions. Decoding does not recover original variable names, types, comments, or guaranteed function boundaries.
DLL Dynamic-Link Library: A Windows PE image designed to be mapped into a process and share code or data through exported functions and other interfaces.
DllMain: An optional DLL entry routine Windows calls for loader events. It runs under loader constraints, so substantial initialization should occur later under application-controlled synchronization.
DMA Direct Memory Access: A hardware mechanism that lets a device move data without the CPU copying every byte. Physical-memory evidence still requires address translation, consistent snapshots, and structure validation before it has meaning.
Dot product: Two vectors’ matching parts multiplied and added: a.x × b.x + a.y × b.y. For two unit vectors it equals the cosine of the angle between them.
Draining: A shutdown phase that refuses new work while existing users finish. Hook code and callback state must remain alive until the active count reaches zero.
Draw call: A command submitting geometry for rendering with the currently bound pipeline state. A draw call does not carry every fact by itself; textures, shaders, buffers, transforms, and tests may already be bound elsewhere.
Driver Device driver: Software that lets the operating system control or communicate with hardware or a kernel service. Kernel-mode drivers have broad authority and therefore a much larger failure and trust boundary than ordinary process code.
Driver signing: The rule that 64-bit Windows loads kernel-mode drivers only with a valid digital signature; since Windows 10 version 1607, with Secure Boot on, new drivers must be signed through Microsoft’s hardware developer program.
Driver stack: The drivers layered on one device: optional filter drivers that watch or adjust requests, the function driver that operates the device, and the bus driver for the bus it is plugged into.
Dynamic recompilation Dynarec, JIT: Translating guest machine code into host machine code while the program runs, one block at a time, and reusing the stored translation. It is much faster than interpreting, but it needs memory that is written and then executed, and it must discard translations when the guest rewrites its code.
Dynamic typing: Values have types, but a variable can refer to values of different types while the program runs. Lua permits assigning a number and later a string to the same variable; an invalid operation on the current value can fail at run time.

E

Easing: Reshaping the fraction used in an interpolation so a motion starts gently, ends gently, or both, instead of moving at one constant speed.
ECS Entity component system: A design in which entities are only identities, components are plain data attached to them, and systems are functions that run over every entity that has a given set of components. Behavior comes from which components an entity has.
Effect boundary: The shared point where a requested operation becomes canonical game state. Preconditions are strongest when enforced here rather than on a distant UI flag or copied value.
eFuse One-time programmable fuse: A bit on a chip that can be changed once, from 0 to 1, and never back. Chips keep settings that must not be undone in fuses, such as a locked debug port, a key hash, or an anti-rollback counter.
Emulator: A program that imitates another computer’s hardware closely enough that the other computer’s software runs on it unchanged. The imitated machine and its software are the guest; the computer running the emulator is the host.
Encoding: A conventional representation of information, such as UTF-8 for text or Base64 for bytes. Encoding changes form, not secrecy.
Encoded value: The stored result of a reversible representation transform. Its bytes must be interpreted through the exact operation width, key or parameter, and inverse order used by the program.
Endianness: The byte order used to store a multi-byte number. Little-endian stores the least significant byte first; network byte order is conventionally big-endian.
Entry point: The image-relative address where the loader begins executing a PE image after mapping and initialization. It is not necessarily the source-language main function.
Encryption: A key-controlled reversible transformation that hides plaintext. Encryption alone may not detect modification; authenticated encryption combines confidentiality with integrity checking.
Entity: A distinct thing in game state, such as a player, projectile, or unit. Engines may represent entities as objects, IDs into tables, or bundles of components.
ETW Event Tracing for Windows: A Windows system for structured, timestamped events from the kernel and applications. ETW shows emitted events; absence of an event is not proof that an action never occurred.
Evasion: Changing observable behavior so a detection or validation rule does not fire. A defensive analysis models the rule, its blind spots, and stronger invariants without assuming one bypass generalizes to other products or versions.
Event: A record that something happened — a key press, an arriving network message, an expired timer, a resized window — delivered to code that responds to it.
Event-driven programming: A program structure built around waiting for events and running a handler for each one, instead of running from top to bottom. Window procedures, debuggers, and servers work this way; a game combines it with a loop that runs every frame.
Event loop: The loop at the centre of an event-driven program: wait for the next event, find its handler, call it, repeat. A handler that runs slowly delays every event queued behind it.
Exception: A synchronous event raised while executing an instruction, such as an access violation or breakpoint. The operating system transfers control to an exception handler or debugger.
Exponent bias Bias: A fixed number added to a floating-point value’s real exponent so the stored exponent never needs a minus sign. An f32 stores the exponent plus 127, so a stored 130 means 2³ and a stored 126 means 2⁻¹.
Export table: PE metadata mapping exported names or ordinals to RVAs. It tells other modules what a DLL makes available; it does not fully describe parameter types or behavior.
External tool: A program running in a different process from the target. It crosses a process boundary through operating-system APIs instead of sharing the target’s pointers directly.
Extrapolation: Continuing a line past the last known value to guess the present, such as a remote player’s position from their last two updates. Compare interpolation, which stays between known values and so lags behind the truth, but never shows a place the player was not.

F

Fail closed: On error or uncertainty, deny the operation or move to the safer state. This protects an invariant but can reduce availability.
Fail open: On error or uncertainty, continue or allow the operation. This may preserve availability but weakens protection when the check itself fails.
Falloff: How quickly a sound’s volume, or a light’s brightness, fades with distance. Inverse falloff is 1 ÷ distance and never reaches silence; a linear falloff drops in a straight line to 0 at a set limit.
False negative: A test reports “not present” even though the condition is present. Tightening a detector to reduce false negatives often increases false positives.
False positive: A test reports a condition that is not actually present. A noisy indicator should be combined with independent evidence.
Field: One named value inside a structure or object. In recovered layouts, the offset may be known before the original field name or exact type.
File offset: A byte distance from the beginning of a file. A PE section table is needed to translate between file offsets and RVAs; adding the module base to a file offset is usually wrong.
Finite-state machine: A model with a finite set of states and explicit transitions caused by inputs or events. It makes automation behavior reviewable instead of scattering related booleans through the program.
Firmware: Software that operates a device, commonly stored in nonvolatile memory. Firmware can include a real-time operating system or run bare-metal; it is distinct from the device driver running on a host computer. Firmware and Bare-Metal Rust builds an example.
Fixed timestep: Running the simulation in steps of one set length, such as 1/60 second, and carrying leftover real time into the next frame. Physics then behaves the same at any frame rate. Compare delta time, which scales each update by the time that passed.
Flash memory: Nonvolatile memory that retains contents without power and can be erased and programmed again. Firmware instructions commonly live in flash, while ordinary changing state uses RAM; flash has different update constraints and finite endurance.
Floating point f32 / f64: A way to store numbers with a fractional part as a sign, an exponent, and a fraction, like scientific notation in binary. An f32 uses 1 + 8 + 23 bits; an f64 uses 1 + 11 + 52. Most values are stored as the nearest representable number, not exactly.
Fog of war: A game rule that limits what world information a player may currently observe. Engines often separate authoritative world state from per-player visibility state.
FOV Field of view: The angular extent a camera sees. A projection matrix may encode vertical or horizontal FOV, so aspect ratio and convention matter when converting between them.
Frame: One produced image or one update interval, depending on context. Game simulation and rendering can run at different rates, so “once per frame” needs a named loop.
Frame budget Frame time: The time one frame may take to keep up with the display: 16.67 ms at 60 frames per second. Frame time is how long a frame actually took, and the frame rate is its reciprocal, so frame times add up where frame rates do not.
Fragment: A candidate contribution to a screen sample produced during rasterization. Depth, stencil, and blending tests decide whether and how it changes the framebuffer.
Framing: The rule that divides a byte stream into messages—for example, a fixed-size record, delimiter, or length prefix. TCP preserves byte order, not message boundaries, so applications provide framing.
Freshness: Whether a check result still describes the state being used now. A correct result can become stale after an object generation, command, frame, or thread-visible state changes.
Function: A reusable unit of behavior with an input/output contract. At machine level, calls also depend on an ABI and calling convention.
Function pointer: An address treated as callable code with a specific function signature. The address and ABI must both be correct; “points into executable memory” is not enough.

G

Game engine: The reusable software that runs a game’s loop, draws its frames, loads its files, and manages its objects, on which a particular game’s content and rules are built. An engine calls the game’s code every frame, which is what separates it from a library. Where a rule lives — engine code, a script, or a data file — decides how you change it and how long the change lasts.
Game loop: The cycle a running game repeats for as long as it runs: read input, update the world, draw a frame. The engine owns this loop and calls the game’s update and draw code from it, which is why once-per-frame calls make reliable places to observe a game.
Game time: The clock a game’s rules use: the real time since the previous frame, limited to a maximum and multiplied by a time scale, so it stops while the game is paused. Real time is the wall clock and never stops. See delta time.
Garbage collection: Automatic reclamation of allocated objects that are no longer reachable. In a Lua host, native references and Lua references must agree so live objects are not collected too early or retained forever.
General-protection fault: The processor exception, vector 13, raised when code breaks a protection rule, such as running a privileged instruction like hlt or wrmsr in ring 3.
Generation: A counter or version paired with an identity so reuse of the same slot or address can be distinguished from the older object that occupied it.
Gimbal lock: The loss of one rotation control when two of the yaw, pitch, and roll angles end up turning around the same line, as happens when the view points straight up. Quaternions avoid it.
Gizmo Debug drawing: A shape drawn for a single frame to show something invisible, such as a line, an arrow, a box around a collision shape, or an object’s axes. Nothing is added to the game world. In an editor, a transform gizmo also lets you drag an object.
glTF: An open format from the Khronos Group for 3D models and scenes: a JSON description whose lists point at each other by position, plus binary buffers of vertex data. A .glb file packs both into one.
Glyph atlas: A texture holding every character of a font as a small image, so text is drawn as one textured rectangle per character.
GPIO General-purpose input/output: A configurable hardware pin used to sense an electrical input or drive an output. A pin’s high/low level must be interpreted using the circuit’s meaning; an active-low button is pressed when the input is low.
Graph: A set of nodes connected by edges. Tile paths, call relationships, pointer relationships, and dependency networks can all be modeled as graphs.
Guard check validation check: A condition that must pass before an operation proceeds. A strong guard checks the underlying precondition at the boundary where it matters rather than relying on a distant flag.
Guard page: A Windows memory page marked so the first access raises an exception and clears the guard flag. It is often used for stack growth and diagnostics; it is not ordinary unreadable memory.
GPU Graphics Processing Unit: A processor designed for highly parallel workloads such as transforming vertices, shading fragments, and processing textures.
Guest: The operating system and programs running inside a virtual machine.
Guest physical address: An address a guest believes is physical. The hypervisor’s second-stage tables translate it into the host physical address where the byte really is.

H

HAL Hardware abstraction layer: An interface for hardware operations such as configuring a timer or reading a pin. It handles many register details but still depends on the selected chip, board wiring, and clock configuration.
Halting problem: The question of whether a program will eventually stop. No program can answer it correctly for every program and input, which is why analysis tools approximate and why a script host enforces a step budget instead of predicting.
Handedness Right-handed / Left-handed: Whether positive rotation about an axis follows the right hand or the left, which also fixes the direction of a cross product. Bevy and Godot are right-handed; Unity and Unreal are left-handed, so converting a position between them flips one axis.
Handle: A numbered ticket standing for something Windows is managing on your behalf — an open process, file, or thread — together with what you are permitted to do with it. It is meaningful only inside the process that obtained it, it is not a pointer to the underlying object, and whoever opens it must close it.
Hardware virtualization Intel VT-x, AMD-V: Processor support that runs a guest in a separate mode with its own rings 0 to 3, at full speed, until an action the hypervisor listed causes a VM exit.
Hash: A fixed-size digest computed from arbitrary input. A cryptographic hash is useful for change detection, but an unkeyed hash does not prove who created the input and cannot recover the original bytes.
HDR High dynamic range: Drawing into wider, floating-point colour channels so brightness above 1.0 survives until tone mapping squeezes it into the range a display can show. It costs memory: 8 bytes per pixel instead of 4 at 16 bits per channel, and it is what lets bloom glow only where something is really bright.
Heap: Memory handed out on request for things that must outlive the function that created them, such as game entities and growable lists. An allocator decides when each block is freed, so nothing is automatic. “Heap” names that allocation behaviour, not one guaranteed contiguous region.
Hex editor: A program that shows and edits a file as numbered bytes, each written as two hexadecimal digits, beside an offset column and a character column. Unlike a text editor, it never converts line endings or text encodings when it saves.
Hexadecimal: Base-sixteen notation using digits 0–9 and A–F. One hex digit represents four bits, so hex is a compact way to display bytes and addresses.
HID Human interface device: The USB standard for keyboards, mice, and game controllers. A HID device sends reports; a boot-format keyboard report is 8 bytes holding modifier bits and up to six held keys.
Hidden bit: The leading 1 of a normal floating-point number. It is always 1, so it is not stored; the reader adds it back, which gives an f32 24 bits of precision from 23 stored fraction bits.
Homebrew: Software written by hobbyists for a platform without the platform holder’s licence, such as games, tools, and emulators. Its legal position depends on the country and on how the platform’s protections are treated.
Hook: An intentional interception point that observes, augments, or replaces a call or event. Detours and import-table replacements are two different hook mechanisms.
Homogeneous coordinate: A coordinate with an extra w component that lets matrices represent translation and perspective. Dividing clip-space components by w produces normalized device coordinates.
Host: The real computer, and its operating system if there is one, on which a hypervisor runs virtual machines.
Hot reloading: Watching the asset folder while a game runs and, when a file changes, decoding it again and replacing the data behind the same handle, so the new version shows without a restart. Shipped games usually turn it off, which is why a replaced file often shows only at the next load.
Hypervisor Virtual machine monitor: Software that creates virtual machines and shares the real processors, memory, and devices among them.

I

I/O manager: The part of the Windows kernel that runs every device request: it checks the caller’s handle, builds an I/O request packet, sends it down the driver stack, and returns the result.
I/O request packet IRP: The kernel data structure that describes one device request, such as a read or a control code, with its parameters and buffers. A driver completes it with a status and a byte count.
IAT Import Address Table: The live PE table whose slots contain resolved addresses of imported functions. Replacing one slot redirects calls that go through that slot, not every possible call to the function.
IDCODE: A 32-bit JTAG register that identifies a chip by version, part number, and JEDEC manufacturer code. Its bit 0 is always 1, which tells it apart from a bypass register’s captured 0.
Idempotence: The property that repeating an operation has the same effect as applying it once. It makes retries safe for actions such as rewards.
Identity check: Evidence that a candidate object is the intended instance reached through the expected ownership path. This is stronger than a shape check that only says its bytes look plausible.
Image base: The preferred or actual starting address of a mapped PE image. ASLR may move the live base away from the preferred value recorded in the file.
Immediate: A constant encoded directly inside a machine instruction, such as the 5 in “add 5.” Relocations and build changes can make immediate bytes poor signatures.
Import table: PE metadata naming DLLs and symbols an image expects the loader to resolve. The IAT is the corresponding live table of resolved addresses.
In-process tool: Code running inside the target process. It can use local pointers and call compatible functions directly, but a fault can also crash or corrupt the target.
Input edge Just pressed / Just released: The single frame on which a button goes from up to down (just pressed) or from down to up (just released), found by comparing this frame’s state with the previous one. It is not “down now”, which stays true while the button is held, and a fixed-step rule can miss an edge that lasts one frame.
Input method editor IME: The part of the system that lets a player type a language with thousands of characters: a word is composed in a pending buffer, a suggestion is chosen, and the final text is confirmed. While composing, the keys go to the IME rather than to the game as ordinary key events.
Instancing: Drawing many copies of one mesh in a single draw call, with a buffer holding each copy’s transform. It avoids the per-call cost of thousands of separate draws.
Instruction: One decoded machine operation. On x86, instructions have variable byte lengths, so the next instruction boundary must be found by decoding—not by assuming a fixed size.
Instruction boundary: The byte where one valid decoded instruction starts or ends. A detour must overwrite whole instructions; jumping into the middle changes how all following bytes decode.
Instruction pointer: The CPU register identifying the next instruction to execute—eip on 32-bit x86 and rip on x86-64.
Integrity: The property that data or code has not changed in an unauthorized or unexpected way. Integrity is different from confidentiality, which hides content.
Integrity check: A comparison intended to detect unwanted change, such as verifying a signed file, hash, authenticated tag, or protected invariant. Its strength depends on what is covered, when it is checked, and who controls the reference value.
Integrity level: A Windows label used to limit interaction from lower-integrity callers toward higher-integrity objects and processes. It is a security boundary label, not a trustworthiness score.
Interpolation Lerp: Finding a value some fraction t of the way between two others: start + (end − start) × t. Games use it to blend positions, colors, and angles, and to draw motion between simulation steps.
Interpreter: A program that carries out another program’s instructions, which may be source statements or virtual-machine bytecode. Lua first compiles source chunks to bytecode, then its virtual-machine interpreter executes them; the physical CPU runs the interpreter’s own native instructions.
Interrupt: A signal from hardware, such as a timer tick or a device with data ready, that makes the processor pause between two instructions and run the handler the kernel registered for it.
Interrupt descriptor table IDT: The table of up to 256 entries, filled in by the kernel at boot, that tells the processor which handler to run for each exception or interrupt vector. Vector 3 is the int3 breakpoint and vector 14 the page fault.
Interrupt service routine ISR: A driver’s first response to its device’s interrupt. It runs while other work on the core waits, so it only confirms the interrupt, acknowledges it, and queues a deferred procedure call.
Invariant: A fact that must remain true throughout a defined operation or state. Examples include “a parsed length never exceeds the buffer” and “a live pointer belongs to this snapshot.”
IPC Interprocess communication: Mechanisms by which separate processes exchange data or signals, including sockets, named pipes, shared memory, and operating-system messages.

J

JTAG IEEE 1149.1: A standard test port built into chips, using the signals TCK, TMS, TDI, and TDO. It was designed to test solder joints on assembled boards through boundary scan, and it is also the usual way to reach a chip’s on-chip debug logic.
Jump: A control-flow instruction that assigns a new instruction-pointer value. A conditional jump depends on status flags; an unconditional jump always transfers control.
Jump table: An array of branch targets used to implement a multi-way choice such as a dense switch. Bounds-checking code often appears just before the indexed indirect jump.

K

Kernel: The privileged core of the operating system that manages processes, virtual memory, devices, scheduling, and security boundaries.
Kernel mode: A CPU protection level where Windows and drivers can access system-wide resources. A bug here can compromise or crash the whole machine, unlike most user-mode failures.
Cryptographic key: A secret or public parameter that controls a cryptographic operation. A key is not the same as a password; passwords normally need a key-derivation step before becoming suitable key material.
Keyframe: A value stored at one moment of an animation. The engine fills in the moments between keyframes by interpolating.
Key lifecycle: The complete path of a key: generation, storage, loading, use, rotation, revocation, backup, and destruction. Strong encryption cannot repair careless key handling.

L

Lag compensation: A server technique that evaluates an action against an earlier world state chosen from bounded history, then restores the present state. It helps account for network delay; it does not make a client authoritative.
Layout: The byte positions, sizes, alignment, and interpretation of fields in a value or object. A recovered layout is versioned evidence, not a promise that later builds keep the same offsets.
Length-prefixed string: Text stored as a count followed by exactly that many bytes, with no end marker. Every field after it moves when the length changes, so a parser checks the count against the real data size before trusting it.
Library: Reusable code that a program calls when it needs something done, such as opening a window or reading the keyboard. The program stays in charge and the library waits to be asked, which is the opposite of an engine, where the engine runs the loop and calls the game’s code.
Lifetime: The period during which a value, pointer, reference, handle, or snapshot remains valid. A correct address can become stale when the object is destroyed or replaced.
Line of sight: Whether the straight segment between two points is free of solid geometry. Games test it with a ray cast against collision shapes.
Little-endian: A byte order that stores the least significant byte of a multi-byte integer at the lowest address. x86 and x86-64 use little-endian ordering for ordinary integer memory values.
Loader: The operating-system machinery that maps executable images, applies relocations, resolves imports, initializes loader-managed state, and transfers control to entry routines.
Local transform: An object’s position, turn, and scale relative to its parent, which game code edits. Compare world transform, the copy the engine derives from the local transforms once per frame.
Lua: A small embeddable programming language often used for game rules, configuration, and automation. The host decides which native capabilities a script can reach.

M

Machine code: The instruction bytes a physical CPU decodes and executes. Assembly is a textual representation of those instructions.
Macro: A rule that expands one compact form into other code or actions. In game automation, “macro” can also mean a fixed input sequence, so context matters.
Magic number File signature: A fixed byte pattern at the start of a file that identifies its format, such as 47 53 41 56 (GSAV) or the eight-byte PNG signature. A loader checks it before trusting any other field.
Manifest: A structured list describing files, versions, hashes, actions, or dependencies. A reversible mod manifest records both what to change and how to restore the original state.
Mask: A value marking which bits or pattern positions matter. In a byte signature, a mask can require stable bytes while ignoring relocation-sensitive positions with wildcards.
Material: The description of how a surface looks: its base color, textures, response to light, and treatment of transparency. A mesh says where the surface is; its material says how it appears.
Matrix: A rectangular grid of numbers used to transform vectors. In graphics, matrix order, row/column convention, coordinate handedness, and storage layout must all be identified.
Memory integrity HVCI: The VBS feature that runs kernel code-integrity checks in VTL1 and uses second-stage page permissions, so kernel pages become executable only after passing those checks and are never writable while executable.
Memory map: The table of what answers at each address: RAM, ROM, or a device’s registers. On a console it is the same on every unit and every run.
Memory-mapped file: A file whose bytes are exposed through virtual-memory pages. Mapping changes how bytes are accessed; synchronization and validation rules still apply.
Memory page: A fixed-size unit used by virtual-memory mapping and protection. A region can span many pages that share allocation or protection properties.
Memory protection: Operating-system rules controlling whether a page may be read, written, or executed. Protection describes allowed access, not the semantic type of the bytes.
Memory region: A contiguous range of virtual pages reported with common state, protection, and backing type. Scanners walk regions and read only bounded, readable ranges.
Memory-mapped I/O MMIO: Reaching a device through addresses: loads and stores to those addresses go to the device’s registers instead of RAM. The kernel maps such ranges as uncacheable, and an emulator’s bus function imitates the same routing in software.
Mesh: The shape of a 3D object: a collection of vertices and the indices that join them into triangles. A mesh is geometry only; a material and textures give it appearance.
Metatable: A Lua table that defines how another value responds to operations such as indexing, arithmetic, or calls. It changes behavior through named metamethods; it is not inheritance by itself.
Microcontroller: A chip combining a processor core, memory, and peripherals such as timers and I/O pins. A CPU architecture alone does not identify a microcontroller’s memory map or a board’s wiring.
Mipmap: A precomputed chain of half-size copies of a texture, used for distant surfaces. The copies add about a third to the texture’s memory.
Module: One loaded EXE or DLL, as it exists in memory: the address Windows placed it at, its sections, and the functions it imports and exports. Beware that the same word also means a source-code unit in most languages; context separates the two.
Morph target Blend shape: Stored alternative positions for a mesh’s vertices, as offsets from the base shape, mixed by weights to pose faces and soft shapes.
Mutex: A synchronization object that allows one holder at a time into a critical section. It protects a shared invariant; it does not automatically make every operation on the object thread-safe.

N

Named pipe: A Windows IPC channel addressed by name. Byte-mode pipes behave like streams and need framing; message-mode pipes preserve writes as messages, but the application still validates their contents.
Native API: A lower-level Windows interface, commonly exported by ntdll.dll, beneath many Win32 functions. It is not identical to a direct system call, and undocumented details can change between Windows builds.
Navigation mesh navmesh: A set of polygons covering the floor an NPC can walk on. Pathfinding such as A* runs over it to plan routes around obstacles.
NDC Normalized Device Coordinates: The coordinate space after perspective division. Visible x and y are usually in a small standardized interval, while the exact depth interval depends on the graphics API.
Network byte order: The conventional big-endian byte order used for many network-protocol integers. A protocol can explicitly choose another order, so read its contract rather than guessing.
Nine-slice 9-patch: Drawing a picture cut into a 3 × 3 grid so the corners keep their size while the edges and the center stretch, which lets one image serve buttons and panels of any size.
Non-player character NPC: A character the game controls rather than a person, such as a guard, a shopkeeper, or an enemy. The code that picks what it does next is usually called its AI.
Normalization: Replacing unstable details with a common representation so structure can be compared—for example, mapping run-specific addresses to module-relative names before comparing traces.
Nonce: A value intended for one-time use in a cryptographic construction. Many AEAD modes require a unique nonce for every message under one key; reuse can destroy their guarantees.
NTSTATUS: The 32-bit status code returned by native Windows functions and drivers. Its top two bits give the severity (00 success, 01 information, 10 warning, 11 error), so 0xC0000022, access denied, is an error.
Null pointer: A distinguished pointer value meaning “points to no object.” It must be checked before dereferencing, but non-null alone still does not prove validity or lifetime.

O

Object: A region of state treated as one value with a lifetime and behavior. In recovered C++ layouts, fields, a vptr, construction patterns, and call sites provide evidence for an object boundary.
Object space model space / local space: Coordinates relative to one model’s own origin and axes. A model transform moves them into world space.
Obfuscation: A transformation intended to make representation or control flow harder to understand while preserving behavior. It raises analysis cost; unlike encryption, it does not necessarily depend on a secret key.
Offset: A distance from a named base. The base is part of the meaning: field offset, file offset, stack offset, and module-relative offset are not interchangeable.
Opaque predicate: A condition whose result is known to the code’s author but deliberately difficult for an analyst to prove. It can add misleading branches without changing the real outcome.
Opcode: The part of a machine instruction encoding which operation to perform. Prefixes and operand fields also affect decoding, so an instruction is more than one opcode byte.
OpenGL: A graphics API built around commands and persistent context state. Many calls change state that later draw calls consume, so one intercepted draw rarely explains the full pipeline.
Oracle: A dependable way to tell whether a result is correct. A test fixture, known game state, protocol implementation, or independent debugger observation can serve as an oracle.
Overlay: A 2D presentation layer drawn over the game image. A world-space label first needs a valid world-to-screen projection and visibility policy.
Ownership: The rule identifying which component is responsible for a resource’s lifetime and cleanup. Ownership is different from merely holding an address, reference, or handle to the resource.

P

Packet: A bounded unit of data at some network layer. One application message can span packets, and one packet can contain more than one framed application message.
Padding: Unused bytes inserted to satisfy alignment or layout rules. Padding bytes are not reliable fields and may contain unspecified values.
Page frame: A page-sized block of physical memory. A page-table entry maps one virtual page to one frame.
Page table: A hierarchy of translation entries used by the CPU and operating system to map virtual pages to physical frames and attach access properties.
Paravirtualization: Changing a guest operating system or its drivers so that they ask the hypervisor directly instead of running instructions or touching devices that would have to be trapped.
Parser: Code that turns raw bytes or text into a structured meaning. Safe parsers validate length, arithmetic, nesting, and semantic constraints before trusting fields.
Path traversal: A path such as ../ that escapes an intended directory. Archive extractors must normalize and validate each destination before writing.
Pattern scanner signature scanner: A search that finds a byte sequence with optional wildcards. A useful pattern anchors stable instruction structure and then validates the surrounding code; it is not proof of function identity by itself.
PE Portable Executable: The Windows executable-image format used by EXEs and DLLs. Its headers and section table connect file layout to the image Windows maps into memory.
PE32 / PE32+: The PE optional-header formats used for 32-bit and 64-bit images respectively. “PE32+” is the 64-bit format name; its fields and pointer-sized values differ from PE32.
Persistence: A mechanism that causes software or configuration to survive a process exit, logout, or reboot. Defensive review inventories intentional startup paths and treats unowned changes as evidence to investigate.
Physical address: A location in the machine’s physical memory address space. Ordinary process pointers are virtual addresses and require page-table translation before they can be related to a physical capture.
Picking: Finding which object is under the cursor, by casting a ray from the cursor into the world, or by reading the ID color of the pixel. The nearest hit wins.
Pipelined rendering: Drawing frame N on a render thread while the game simulates frame N + 1, working from a copy made by an extract step. The frame rate rises to that of the slower stage, and the price is that what is drawn is one frame behind the simulation. See render world.
Place value: What a digit is worth because of its position. In binary each position is worth twice the one to its right, so the positions of a byte are worth 128, 64, 32, 16, 8, 4, 2, and 1; position n is worth 2ⁿ.
Plain value: The value before an encoding, obfuscation, compression, or encryption transform. “Plain” describes the representation stage, not whether the value is safe or trustworthy.
Plugin: A module of an engine that registers what it needs with the application at startup. A plugin group adds several at once, such as the window, the input, and the renderer.
Pointee type: The type of the data a pointer leads to, such as f32 in *const f32. It decides how many bytes are read at the destination, how they are interpreted, and how far pointer arithmetic steps. It does not change the pointer’s own size, which the process fixes at 4 or 8 bytes.
Pointer: A value whose meaning is the address of something else. Reading the pointer gives you an address; reading again at that address gives you the data. Nothing in the bytes marks a value as a pointer — the code that uses it decides. Valid use also requires the right process, mapping, protection, type, alignment, and lifetime.
Pointer chain: A sequence of “add an offset, read the pointer stored there” steps leading from a repeatable base to a dynamic object. Every dereference is a new validity check.
Polling: Checking a value repeatedly on your own schedule to see whether it changed, instead of waiting to be told. An external tool polls a game’s memory because the game sends it no event when a value changes.
Post-processing: Effects applied to a finished picture by drawing a full-screen rectangle with a shader that reads it, such as bloom, color grading, tone mapping, and motion blur.
Postcondition: A fact a function promises after successful completion. Tests should check the postcondition rather than only whether the function returned.
Precondition: A fact that must be true before an operation is valid—for example, that a range is readable and large enough for the requested type.
Prediction: Applying local input before the server reply arrives. The client later corrects to the server state and can replay input the server has not acknowledged yet.
Privilege: A named operating-system authority associated with a security token. Being an administrator and having a particular privilege enabled are related but not identical facts.
Privilege escalation: A transition from a lower-authority security context to a higher-authority one outside the intended policy. Defensive analysis asks which trust boundary was crossed and which validation, isolation, or patch would prevent the transition.
Process: One running program. Windows gives it private memory that other programs cannot reach directly, plus the resources it has opened. Formally: a protected execution container with an address space, handles, security token, loaded modules, and one or more threads.
Program counter PC: The register holding the address of the next instruction to fetch. x86 calls it the instruction pointer, EIP or RIP.
Projection: The transformation that maps view-space geometry toward clip space. Perspective projection makes apparent size depend on depth; orthographic projection does not.
Protection ring Ring, privilege level: One of the processor’s privilege levels, numbered 0 to 3 on x86. Windows runs the kernel and drivers in ring 0 and ordinary programs in ring 3; the current level is the lowest two bits of the cs register.
Protocol: A shared agreement about message boundaries, field meaning, order, state, and error handling. A byte layout is only one layer of the protocol.
Provenance: The recorded origin of information, including the event, system, version, and method that produced an observation.
Proxy: An intermediary that receives traffic and forwards it to another endpoint, optionally recording or transforming it. Correct proxies preserve framing, backpressure, errors, and connection lifecycle.

Q

Quantization: Mapping a range of values onto a finite set of encodable levels. Fewer levels reduce the number of transmitted bits but increase the possible rounding error.
Quaternion: A four-component representation commonly used for 3D rotation. Unit quaternions compose smoothly and avoid the gimbal-lock singularity of Euler-angle coordinates, though they are less intuitive to inspect directly.
Query: A description of the components a system needs. The engine hands the system exactly the entities that have all of them, and a query can add filters such as with, without, optional, changed, and added.

R

Race condition: A bug in which correctness depends on uncontrolled timing or ordering between concurrent operations. A mutex is one possible fix, but the right solution begins by stating the shared invariant.
Radar: A 2D view derived from world positions relative to a player or camera. A robust transform translates to the observer, rotates into local axes, scales, and clips to the widget.
RAM Random-Access Memory: Physical working memory used while the computer runs. Programs normally see virtual memory; the operating system and hardware translate those addresses to RAM or other backing.
Rasterization: The graphics-pipeline stage that turns transformed primitives into candidate fragments for screen samples.
Ray: A half-line defined by an origin and direction. In game math it can represent the path from a camera or weapon into the scene.
Ray cast: A query that intersects a ray or segment with scene geometry and returns hit information. It answers geometric visibility under the queried collision rules, not necessarily what was rendered.
Re-entry: A hooked or callback path being entered again before an earlier call has returned. The implementation must deliberately allow, bypass, or reject nested entry.
Reason code: A stable bounded value explaining why a decision was made. Reason codes are easier to test and compare than free-form log sentences.
RecvTable: A Source client description of network properties and how received values update its entity representation. It pairs with the server-side SendTable; the two processes need not have identical memory layouts.
Register: A small named storage location inside the CPU. Registers hold operands, addresses, results, flags, stack position, and control state while instructions execute.
Regression test: A test kept after a bug is fixed so the same failure is detected if it returns. Good tests preserve the smallest input and invariant that reproduced the problem.
Regression trace: A minimal saved event sequence that reproduces a control-flow or state contradiction. A repair is retested against both the failing trace and a valid behavior trace.
Relocation: Metadata and loader work that adjusts address-dependent values when an image is mapped away from its preferred base. Relocated bytes are unstable choices for exact signatures.
Remote attestation: A device proving to a remote service what software it booted. A key that software cannot read signs the service’s nonce together with hashes recorded by each boot stage, and the service compares them with known-good values.
Render layer: One bit of a mask that an object and a camera each carry. A camera draws an object only if the two masks share a set bit, which is how a first-person weapon is drawn by one camera and a minimap icon by another.
Render pass: One sweep of drawing for one purpose, such as shadows, solid objects, see-through objects, post-processing, or the interface. A frame is usually several passes.
Render state: Persistent graphics settings and bound resources that affect later draws: shaders, buffers, textures, blend rules, depth rules, and more.
Render to texture: Drawing into an off-screen texture instead of the screen, so the result can be used as a mirror, a monitor, a minimap, or a screen inside the 3D world.
Render world Main world: In an engine that splits the game in two, the world holding what drawing needs: meshes, materials, lights, and final transforms. An extract step fills it every frame from the main world, which holds the game’s own state, so editing the render copy changes the picture only until the next extract.
REPL Read-eval-print loop: An interactive way to use a language tool: read an input, evaluate it, print the result, then wait for another input. A REPL does not by itself determine whether code is compiled or interpreted, or whether its types are static or dynamic.
Reserved memory: Virtual address ranges set aside so other mappings cannot use them. Reserved pages have no committed backing yet.
Resident memory: Pages currently present in physical RAM. A committed page can be nonresident and faulted back in when accessed.
Resource: A value that exists once for the whole world, such as the clock, the score, or the keyboard state. A system asks for it by kind instead of by entity, so a scan for it finds a single record rather than one per object.
Response: The behavior chosen after an assessment, such as recording a diagnostic event or refusing one invalid command. Keep it separate from the signal that triggered the assessment.
Rising edge: A transition from zero to one. Input code can count fresh presses by separating these transitions from held button levels.
Root of trust: The first link of a chain of trust, trusted without being checked because it cannot be changed, such as a boot ROM with a key hash in fuses. A flaw in it cannot be fixed on devices already sold.
Round trip: Applying a transform and its inverse and recovering the original value. Round-trip tests prove invertibility for tested inputs, not secrecy or authenticity.
Return address: The instruction address where execution should continue after a called function returns. A call normally places it on the stack or in an architecture-defined link register.
Run condition: A yes-or-no check the engine makes before a system runs, such as “is the game in the playing state?”. When the answer is no the system is skipped and what it would have changed stays as it was, which is why a value can freeze in a menu.
RVA Relative Virtual Address: A virtual offset from an image base. At runtime, live address = loaded image base + RVA. An RVA is not a file offset.

S

Sample rate Audio sample: The number of audio samples per second for each channel; CD quality is 44,100. A sample is one measurement of the sound wave.
Save state: A copy of an emulated machine’s entire state, including registers, RAM, I/O registers, and timing position, that can be loaded to resume from exactly that instant. Unlike a game’s own save file, it works for any game at any moment.
Scan chain: Several chips’ JTAG ports wired in series, each chip’s TDO feeding the next chip’s TDI, so a debugger sees one long shift register. With every chip in BYPASS, each adds exactly one bit.
Scan code: A number that identifies a physical key position rather than the character it produces. Windows uses set-1 scan codes, in which the A key is 0x1E.
Scene: A group of entities with their components that an engine can create together, such as a level or a menu screen, often as a hierarchy in which children are positioned relative to their parents.
Schedule: A named phase of the frame, such as startup, input, fixed steps, update, or the engine’s own bookkeeping, that the engine runs in a fixed sequence. Every system belongs to one, and the engine decides the order inside it from what each system reads and writes.
Scheduler: The part of the kernel that decides which ready thread runs on each processor core, using timer interrupts to take the processor back.
Second-level address translation SLAT, EPT, NPT: Hardware two-stage translation: the guest’s page tables turn guest virtual addresses into guest physical addresses, and tables owned by the hypervisor turn those into host physical addresses.
Secure boot Secure Boot: A start-up process in which each stage checks the digital signature of the next stage before running it, and refuses anything that fails. On PCs, UEFI Secure Boot lets only signed boot loaders start; consoles build the same chain from a boot ROM.
Secure debug authentication: Keeping a debug port locked until the debugger returns a signature, made with a key only the maker holds, over a fresh nonce and the chip’s unique ID. Authorised engineers can debug a returned unit without that answer opening any other device.
Security processor: A small separate processor on a console or PC chip that starts before the main cores, holds the device’s keys, and performs boot checks and decryption. The main cores and their software never see the keys.
Semihosting: A mechanism for target code to request host operations from a supporting debugger or emulator. The firmware lab uses it for terminal output and QEMU termination; it is neither a UART nor a guest OS service.
SendTable: A Source server description of entity properties that may be sent to clients. Each property describes a value and its encoding, such as an integer width or a bounded float range.
Serialization: Turning structured values into bytes or text that can be stored or transmitted. Deserialization reverses the representation and must validate untrusted lengths and values.
Server authority Authoritative server: A design in which the server’s record is the authoritative state and every client request is checked against it, because anything a client computed can be changed before it is sent.
Shader: A program executed by the GPU for many vertices, fragments, or other work items. A vertex shader transforms geometry; a fragment shader computes candidate output values.
Shadow map: A texture holding the scene’s depth as seen from a light. A pixel is in shadow if the map holds something nearer to the light than the pixel is.
Shared memory: Pages mapped into more than one process. Sharing removes copying but not synchronization, framing, versioning, or access-control requirements.
Shape check: Validation that bytes have a plausible structure, such as finite coordinates and an expected vtable region. It does not by itself prove the object has the intended identity.
Shift register: A row of one-bit storage cells that all move one place along on each clock tick: a new bit enters at one end and the bit at the other end leaves. It turns many bits into a stream on a single wire.
Signature / pattern: A sequence of stable bytes and wildcards used to locate code or data in a known build family. This differs from a cryptographic digital signature, which authenticates bytes through a key.
Signal: One observable measurement used as evidence, such as a timing outlier, flag, exception, or value change. A signal is not the same as the conclusion drawn from it.
Significand Mantissa: The digits of a floating-point number with the hidden leading 1 put back. For 10.0 = 1.25 × 2³ the significand is 1.25; the stored fraction field holds only the .25 part.
Skeletal animation Skinning, Bone: Animating a mesh by moving a hierarchy of bones. Each vertex follows a weighted blend of the bones it is attached to, so joints bend smoothly.
Slerp Spherical linear interpolation: Blending two orientations at a steady turning speed along the shortest way round. It is the interpolation used for quaternions.
Snapshot: A copy of chosen values from a known build, so later reasoning works from fixed data instead of a moving target. Capturing the fields takes time, so values gathered at slightly different moments can describe a state that never existed all at once unless the capture is coordinated.
SourceMod: A supported server plugin platform for Source games. Plugins observe game events and commands through its extension interfaces.
Sparse-set storage: A way of storing one kind of component in its own pool, with an index from entity to position. Adding or removing the component is cheap, but every read costs an extra lookup. Compare table storage.
Spatial audio: Playing a sound as if it came from a place: the engine puts two ears on the listener, works out each ear’s volume from its own distance to the sound, and applies a falloff curve, such as inverse distance or a linear fade to a limit.
Spiral of death: A fixed-timestep failure in which each step takes longer to compute than the game time it covers, so every frame owes more steps than the last. Engines break it by limiting the delta time, so the game runs in slow motion instead of freezing.
Sprite: A picture drawn as a flat rectangle of two triangles with a texture on it, usually through an orthographic camera and in layer order. Two-dimensional games are made mostly of sprites.
Sprite sheet Texture atlas, Atlas: One large image holding many small pictures, so a single texture serves many sprites. A frame is chosen by giving the rectangle’s texture coordinates.
Stack: The memory a thread uses for function calls. Calling a function claims a block for its local values and return address; returning releases it again, so the space is reused constantly. Each thread has its own. It behaves like the last-in-first-out data structure of the same name, but it is a concrete memory region, not that abstract structure.
State: Information that can make future behavior differ. A game’s state includes world values, current mode, timers, and pending events—not just visible variables.
State machine: A model that names valid states and transitions. It is especially useful when the same input should mean different things in different modes.
Static typing: Each expression has a type checked before the program runs. Rust may infer a type without an explicit annotation, but a later assignment still has to fit the variable’s established type.
Stored-program computer: A computer that represents program instructions in addressable storage alongside data. In the x86 labs, this lets a disassembler read code bytes and a software breakpoint replace an instruction byte; page protections govern which memory may execute.
Stream processing: Processing an ongoing sequence of events, such as accepted match actions, as they become available. This describes a data-processing strategy, rather than TCP’s byte-stream transport; event order, duplicates, and lateness still need rules.
String: A sequence representing text under an encoding. In memory it may be length-prefixed, zero-terminated, inline, heap-backed, UTF-8, UTF-16, or something engine-specific.
Structure struct: A composite layout containing fields. Source order does not alone prove binary layout because representation rules, alignment, and padding also matter.
SWD Serial Wire Debug: Arm’s two-wire alternative to JTAG, using the clock SWCLK and the shared data wire SWDIO. It sends 8-bit request packets instead of stepping through a state machine, and reaches the same debug port.
Symbol: A name associated with code or data. Debug symbols can add function names, types, line mappings, and unwind data that stripped machine code does not preserve directly.
Synchronization: Coordination that constrains how concurrent operations observe and modify shared state. Locks, atomics, events, and message passing provide different guarantees.
System call: A controlled transition through which user-mode code asks the kernel to perform an operation. A Win32 API may do substantial user-mode work before eventually reaching a system call.
System on a chip SoC: A single chip that holds most of a computer: CPU cores, a GPU, memory controllers, and often a security processor. Consoles and phones are built around one.
System service number: The number an ntdll.dll stub places in eax before syscall to choose which kernel routine runs. The numbers are internal to Windows and change between builds.

T

Table storage: A way of storing components in which entities with the same set of components share a table and each component has one column. A system reads a column straight through, but adding a component to one entity moves its whole row to another table. Compare sparse-set storage.
TAP controller Test Access Port controller: The 16-state machine inside every JTAG chip. At each rising edge of TCK the level of TMS picks one of two next states, and five clocks with TMS at 1 reach Test-Logic-Reset from any state.
TCP: A reliable, ordered byte-stream transport. It retransmits lost data but does not preserve application-message boundaries.
Telemetry: Structured observations recorded over time, such as frame duration, state transitions, calls, or counters. Useful telemetry names units, clock, build, and capture boundaries.
Temporal coherence: The tendency for nearby moments to have related state. It can help tracking and validation, but it is not a guarantee: loading screens, respawns, and scene changes can invalidate yesterday’s assumptions instantly.
Texture: An indexed image or general data resource sampled by GPU programs. A texture’s bytes need a format, dimensions, channel order, and sampling rules to have meaning.
Thread: One line of execution running inside a process. A process can have several, all sharing the same memory but each keeping its own place in the code. Formally: an independently scheduled path of execution with its own registers, instruction pointer, and stack, sharing the rest of the process’s resources.
Thread context: The register state needed to describe or resume a thread at a moment. Capturing or changing it safely normally requires controlled thread state.
Thread pool Worker thread: A fixed set of threads that wait for small jobs in a queue and run them as they arrive, so slow work leaves the main thread alone. A common size is one fewer than the number of cores.
Tick: One fixed step of a game’s simulation. Every tick advances the world by the same slice of time, so behavior counted in ticks does not depend on the frame rate.
Tilemap: A grid of tile numbers drawn as one rectangle per tile, taken from a sprite sheet, usually in a single draw call.
Time scale: A multiplier on game time: 1 is normal, 0.5 is slow motion, 2 is fast forward, and 0 is a pause. Every timer that counts game time stretches with it.
Timing check: A comparison of elapsed time against an expectation. Debugging, scheduling, power management, virtualization, and ordinary load all affect timing, so timing alone is a noisy signal.
TOCTOU time of check to time of use: A race in which state changes after it is checked but before the guarded operation uses it. The repair connects identity and freshness at the consuming boundary.
TLS: Usually Transport Layer Security in networking: encryption and peer authentication layered over a transport. In PE and loader discussions, TLS can instead mean thread-local storage; context is essential.
Tone mapping: Compressing high-dynamic-range colors, which can exceed 1.0, into the 0 to 1 range a display can show. A simple rule, c ÷ (1 + c), squeezes bright values more than dim ones.
Trampoline: A small executable bridge that copies displaced instructions and jumps back after a detour site. PC-relative operands may need relocation when copied to the trampoline.
Transform: An operation that changes representation, position, orientation, or scale. Graphics transforms move coordinates between spaces; byte transforms may encode, compress, encrypt, or obfuscate data.
Translation lookaside buffer TLB: A small processor cache of recent address translations, so repeated accesses to the same pages skip the page-table walk.
Trap and emulate: Running a guest kernel without privilege and letting the hypervisor catch and imitate each sensitive instruction. It needs every sensitive instruction to fault, which older x86 processors did not guarantee.
Trust boundary: A point where data or control crosses between components with different authority or assumptions. Validate at the boundary rather than relying on the sender to have done so.
Turing complete: Able to compute anything a Turing machine can in an idealized setting with enough time and memory. General-purpose languages such as Rust and Lua have that expressive power, although real runs have finite resources. A mod that ships a script is shipping a program whose effects also depend on what its host exposes.
Turing machine: An idealized model of computing: an unbounded tape of symbols, a head that reads and writes one cell, a current state, and a rule table saying what to write, where to move, and which state comes next. Real computers have finite memory, so they can carry out only the computations that fit their resources.
Two’s complement: The usual way to store signed whole numbers: the leftmost bit’s place value is negative (−128 in a byte), and every other bit keeps its normal value. So 0xFF is −1 as an i8 and 255 as a u8, and the CPU adds both with the same circuit.
Type: How many bytes a value occupies, what its bits mean, and which operations are allowed on it. Raw bytes do not reveal their type; the instructions that read and use them do.
Type 1 hypervisor: A hypervisor that runs directly on the hardware, with every operating system above it, such as Hyper-V, Xen, or VMware ESXi.
Type 2 hypervisor: A hypervisor that runs as an application on a host operating system and relies on it for devices and scheduling, such as VirtualBox or VMware Workstation.

U

UDP: A message-oriented transport with no built-in delivery, ordering, or duplicate suppression. Applications choose how to handle loss and reordering.
Undecidable: Describes a question about programs that no single method answers correctly for every possible program, such as whether a program halts. Specific programs can often still be analyzed; the limit is on one method that works for all of them.
Unicode: A standard assigning code points to text characters and symbols. UTF-8 and UTF-16 are encodings of those code points, not two different character sets.
Unified memory: One pool of memory shared by the CPU and the GPU, so both use the same bytes without copying data between separate memories. Consoles use it; most gaming PCs give the GPU its own video RAM.
Unit vector: A vector of length 1, used to store a direction. Dividing a vector by its own length produces one.
Universal Turing machine: A Turing machine that reads another machine’s rule table from its tape and carries it out. It is the idea behind stored programs, interpreters, virtual machines, and emulators: change the data, not the machine.
Unsafe boundary: A small region where code accepts responsibility for facts the compiler cannot prove, such as raw-pointer validity or a foreign ABI. The boundary should state and check its preconditions, then expose a safer interface.
Upvalue: Lua’s representation of a local variable captured by a closure. It lets the value outlive the stack frame that originally created it.
User command: A sequenced sample of a player’s requested input, such as buttons, viewing direction, and movement intent. The server processes it under game rules; it is not a trusted claim about the final world state.
User mode: The restricted CPU protection level where ordinary games and tools run. User-mode code accesses protected system resources through operating-system interfaces instead of directly controlling the kernel.
Utility AI utility scoring: A way of choosing an action by giving every option a score computed from the current situation and running the highest-scoring one.
UV coordinates UV: Two numbers from 0 to 1, called u and v, that name a point on a texture whatever its size in pixels. Direct3D, Vulkan, Metal, WebGPU, and glTF put v = 0 at the top row, and classic OpenGL puts it at the bottom, so a texture can arrive upside down.

V

VA Virtual address: An address interpreted through one process’s current virtual-memory mappings. A live module VA is often its base plus an RVA.
Vector: In math, an ordered set of components representing a direction, displacement, or point under a convention. In programming, “vector” can instead mean a growable contiguous sequence.
Vector table: A target-specific table of startup values and handler addresses. On the Cortex-M system in the firmware lesson, its first entry gives the initial stack pointer and its second the reset-handler address; it is not the first sequence of application instructions.
Vertex: One input point of a graphics primitive together with attributes such as position, normal, color, and texture coordinates.
Vertical sync VSync: Making the present step wait for the display’s next refresh. The frame rate is capped at the refresh rate and the picture does not tear.
View cone: The range of directions an NPC can see: every direction within a set angle of its facing. Code usually tests it by comparing a dot product with the cosine of that angle.
View matrix: The transform that expresses world coordinates relative to the camera. It is effectively the inverse of the camera’s world transform under the chosen convention.
Viewport: The rectangle of a render target that a camera draws into. A split screen has one for each player, and projection has to use the viewport’s own size and origin, not the window’s.
Virtual machine VM: A software execution engine with its own instruction set and runtime state. Lua’s VM executes Lua bytecode; a hardware virtual machine instead emulates or partitions an entire computer. A system virtual machine, run by a hypervisor, instead presents a whole computer with the host’s own instruction set, so a guest operating system can run on it unmodified.
Virtual memory: The address abstraction that gives each process its own map of pages. The operating system can map pages to files, RAM, shared regions, or no backing at all.
Virtual-key code: The number Windows gives a key in window messages and key-state functions, produced from the scan code by the active keyboard layout. VK_A is 0x41.
Virtualization-based security VBS: The Windows feature that runs Windows above its own hypervisor in two virtual trust levels, so a secure world in VTL1 can protect memory and secrets from the normal kernel in VTL0.
VM escape: A hypervisor bug that lets code in a guest run on the host, outside the guest’s isolation and beyond any snapshot’s reach.
VM exit: The processor stopping a guest, saving its state, and running the hypervisor’s handler with a reason code, for example after cpuid or an access to a guest physical page with no second-stage mapping.
VM snapshot: A saved state of a whole virtual machine: its disk, frozen with later writes going to a delta file, and for a running machine its memory, processor registers, and device state.
VPK Valve PacK: An asset archive format used by Source games. Its directory identifies files and the location of their stored data, which may be in the directory archive or companion archives. A VPK does not define the server’s movement rules.
vptr: A compiler-generated pointer stored in many polymorphic C++ objects that points to a vtable. The exact placement and even existence are ABI and compiler details, not a language-level guarantee.
vtable: A compiler-generated table of virtual-function pointers and sometimes related metadata. One plausible table is evidence for a dynamic type, not complete proof of the original class hierarchy.
Vulnerable driver blocklist: Microsoft’s list of signed drivers with known exploitable bugs, which Windows refuses to load. It is on by default since the Windows 11 2022 update and enforced whenever memory integrity is on.

W

Watchdog: A hardware timer that can reset a stalled device unless software services it as required. Its timeout and recovery policy must fit the device; logging or debugger pauses can affect its behaviour.
Watchpoint: A debugger stop condition triggered when an address is read, written, or executed. Hardware supports only a small number and has size/alignment limits.
Weighted average: An average in which observations contribute different amounts. Repeated weighting can preserve older history without a fixed window boundary.
Wildcard: A pattern position allowed to match any byte. Wildcards exclude unstable operands from a signature, but too many make the pattern ambiguous.
Win32: The long-standing Windows application API family used by both 32-bit and 64-bit desktop programs. The name no longer means “32-bit applications only.”
Window message: A structured notification delivered to a Windows window procedure, such as input, paint, sizing, or lifecycle events. Posted messages are queued; sent messages may invoke the receiver synchronously.
Window procedure: The function a Windows program registers for a window, which the message loop calls with each message — a key press, a resize, a close request. It must return quickly, or the window stops responding.
World space: The shared coordinate system in which scene objects are placed. An object’s model transform converts its local coordinates into world coordinates.
World transform: An object’s position, turn, and scale in the world, derived once per frame by combining its local transform with its parents’. Writing to it changes nothing that lasts, because the next rebuild overwrites it from the local transform.
World-to-screen: The full conversion from a 3D world point through view and projection transforms, clipping, perspective division, and viewport mapping to a 2D screen location.
Wrapping arithmetic: Fixed-width arithmetic reduced modulo 2^N. Overflow wraps through the bit range, so recovering a transform must preserve the original width and operation order.

X

x86: The variable-length instruction-set family descended from Intel’s 8086. In this book, “x86” often means 32-bit mode, while x86-64 names the 64-bit extension.
x86-64: The 64-bit x86 architecture, also called AMD64. It expands registers, uses eight-byte pointers, and has different calling conventions and address rules from 32-bit x86.
XOR exclusive OR: A bit operation that produces 1 when its two input bits differ. Applying the same XOR mask twice restores the original value; that reversibility alone does not make it secure encryption.

Z

Zero-terminated string null-terminated string: A string whose end is marked by a zero code unit rather than a stored length. Readers need a maximum bound in case the terminator is missing.

This book grew out of the original Game Hacking Academy by attilathedud and has been rewritten as a beginner-first course. Like the original repository, its source is published under the Apache License 2.0.