# Game Hacking Academy · Systems Field Guide

> A beginner-friendly systems course for learning how games, memory, debuggers, graphics, networking, and reverse-engineering tools work.

Canonical book: https://mustcodeal.github.io/rust-game-hacking-book/
Sitemap: https://mustcodeal.github.io/rust-game-hacking-book/sitemap.xml
Source repository: https://github.com/MustCodeAl/rust-game-hacking-book
Full lesson text and code: https://mustcodeal.github.io/rust-game-hacking-book/llms-full.txt

## What this documentation is

Game Hacking Academy is a beginner-first course of 155 lessons about how games and Windows programs work internally. It starts with computer-science fundamentals, then applies them to debugging, reverse engineering, memory inspection, graphics, networking, file formats, Windows APIs, Lua, advanced object models, integrity analysis, robust hooks, and update-resistant layouts. Code blocks default to Rust; assembly and Lua are labeled when they are the subject.

The intended reader may have little or no programming experience. Explanations therefore define new vocabulary before using it, walk through concrete examples, derive every number they show, draw memory and control flow as figures, show complete code where practical, and finish with quizzes or interactive labs. When answering from this book, preserve that plain-English teaching style.

Lesson 1.1 describes one optional way to study technical material: asking questions checked against a source and retrying missed ideas. Later lessons do not depend on it.

## Course scope

Recurring examples include:

- The Battle for Wesnoth 1.14.9 for strategy-game state, gold, map data, files, and local protocol exercises.
- AssaultCube 1.2.0.2 for local bot-match memory, aiming math, recoil, radar, rendering, and overlay exercises.
- Urban Terror 4.3.4 for rendering and hook examples.
- Wyrmsun 5.0.1 for data-driven unit and asset modding.
- Purpose-built programs in `rust-labs` and `windows-labs` for memory, process, debugger, PE, IPC, and Windows API exercises.

## How lessons are written

Each lesson explains one mechanism directly: what the computer stores or does, why it works that way, and how to see it with a tool or a small program. Labs are deterministic Rust programs or offline fixtures, and examples that touch a real game use a version-pinned build in a local match.

When answering from the book, keep its technical cautions: an address found in one run is a location, not a stable identity, because the game can place the same object elsewhere next time; and results depend on the game version, the architecture (32-bit or 64-bit), and the permissions the tool runs with.

## Technical baseline

- Primary language: stable Rust, with `unsafe` isolated and explained when Windows or raw memory requires it.
- Verified course baseline on 2026-08-14: Rust 2024 edition, `windows` 0.62 (`0.62.2` in the lockfile), iced-x86 `1.21.0`, `eframe`/`egui` 0.36 for the menu lab, and `anyhow` 1.x.
- Primary operating system: Windows 10 or Windows 11.
- Main Windows binding: the Rust `windows` crate.
- Architectures discussed: x86 and x86-64, with explicit attention to pointer width and calling conventions.
- Supporting crates include `anyhow`, `thiserror`, `bytemuck`, `iced-x86`, and standard-library networking and synchronization types where appropriate.
- Common tools include WinDbg or x64dbg, Process Explorer, Cheat Engine, Wireshark, Cargo, and Visual Studio Build Tools.
- Code snippets favor named variables, checked sizes, typed wrappers, cleanup through `Drop`, visible safety comments, and actionable errors.

## Topic routing for retrieval

- Optional study advice, computer and game loops, programming logic, collections and paradigms, a substantial Rust primer, hacking fundamentals, Windows lab setup, RAM, bits, hexadecimal, byte order, pointers, stacks, heaps, and the first memory scan: Chapter 1.
- Debuggers, the build pipeline from source to process, compiled and interpreted execution, bytecode, REPLs, static and dynamic typing, assembly, registers, flags, breakpoints, call stacks, code caves, detours, ASLR, and pointer-path verification: Chapter 2.
- Safe memory boundaries, bit-by-bit decoding of powers of two, two's complement and IEEE 754 floats, pointer width and arithmetic, external reads, C++ objects, virtual dispatch, containers, lifetimes, encoded values, and strings: Chapter 3.
- Game engines and rule ownership, snapshots, fog of war, guarded actions, maps, coordinates, vectors, distance and alignment, feedback loops, target selection, pathfinding, events, sampling, and NPC perception and decision models: Chapter 4.
- PE files, RVA translation, export tables, byte-pattern scanning, memory scanning, disassembly, debugger loops, call logging, ETW observation, and optional parallel scanning over stable snapshots: Chapter 5.
- DLL ABI and ownership contracts, loading and injection, detours, import hooks, Windows input and messages, separate menus, feature architecture, commands, failure isolation, restoration, and live hook installation and removal: Chapter 6.
- Camera frames, cross products, yaw and pitch, matrices, homogeneous coordinates, perspective, OpenGL state, crosshair tests, aiming, recoil, radar, world-to-screen overlays, Direct3D dispatch, coherent render snapshots, graphics feature integration, and in-game menus: Chapter 7.
- Clients, servers, packets, TCP streams, message framing, parsing, Wesnoth chat, local proxies, shared memory, and named pipes: Chapter 8.
- Text and binary saves, hex editing, file offsets, magic and version fields, length-prefixed strings, checksums, textures, data-driven mods, archive extraction, manifests, hashes, digital signatures, authenticated encryption, and key lifecycles: Chapter 9.
- Embedded Lua, tables, host APIs, snapshots, script state machines and budgets, stored-program computers, Turing completeness, the halting problem, VM bytecode, values, garbage collection, call frames, and closures: Chapter 10.
- Processes and runtimes, build fingerprints, object layouts across updates, access rights and owned handles, virtual pages, threads, contexts, stacks, Win32 API layers, kernel scheduling, system calls and privilege checks, and crash dumps: Chapter 11.
- DLL identity and search order, loader lock, dynamic API resolution, device drivers and request stacks, IRPs, IOCTL fields, device registers, interrupts and deferred work, kernel trust, driver inventories and signing, DMA, IOMMUs, x86-64 page tables, and offline capture validation: Chapter 12.
- Advanced game-state invariants, correlation IDs and telemetry, integrity coverage, anti-debug responses, reversible value transforms, trust-boundary control gaps, and toy failures with runnable repairs: Chapter 13.
- Hypervisors, type 1 and type 2 virtual machines, VT-x and AMD-V, VM exits and two-stage translation, snapshots and virtualized security; console SoCs, unified memory, secure boot, rollback and attestation; JTAG boundary scan, TAP states, BYPASS, IDCODE, Cortex-M debug access and SWD; emulators, fetch/decode/execute, dynamic recompilation, mapped devices, cycle timing, save states and cheat codes: Chapter 14.
- Plain-English definitions and distinctions for terminology across the course: the glossary.

## Important vocabulary

- Address: a numbered location in one process's virtual address space.
- Pointer: a value interpreted as an address. Its own size is set by the process (4 bytes in 32-bit, 8 in 64-bit); its pointee type decides what is read at the destination and how far pointer arithmetic steps.
- Type: how many bytes a value occupies and what its bits mean. The same bytes can be a `u32`, an `i32`, or an `f32`.
- Offset: a distance from a known base address or object start.
- Module: a loaded executable or DLL with its own image base.
- RVA: a relative virtual address measured from a PE image base.
- ASLR: a Windows defense that moves module bases between runs.
- Register: a tiny, fast storage location inside the CPU.
- Instruction pointer: the register naming the next machine instruction.
- Stack: per-thread memory used for calls, return addresses, and many local values.
- Heap: process memory used for dynamically allocated objects whose lifetimes do not follow one function call.
- Calling convention: the agreement describing argument locations, return values, stack cleanup, and preserved registers.
- Breakpoint: a controlled pause used to inspect program state.
- Hook or detour: a reversible redirection from an original instruction path to owned code and back.
- Code cave: executable space used by a detour; safe examples in this course preserve displaced instructions and provide rollback.
- Pattern scan: finding a byte sequence with optional wildcards instead of trusting one absolute address.
- Protocol: the set of agreements that gives exchanged bytes meaning.
- Framing: the rule that separates messages inside a byte stream.
- ABI: the binary-level agreement that lets separately compiled code call each other.
- PE: the Portable Executable format used by Windows EXE and DLL files.
- RAII: tying cleanup to a value's lifetime so resources close automatically.

## Repository map

- `site/`: the Astro Starlight site that publishes the book.
- `site/src/content/docs/pages/<chapter>/<lesson>.mdx`: the source of every numbered lesson.
- `site/src/data/lesson-quizzes.json`: end-of-lesson quiz prompts, options, answers, and explanations.
- `site/src/components/`: memory figures, quizzes, interactive labs, and layout overrides.
- `site/public/scripts/`: the palette picker, glossary links, quiz engine, and Mermaid loader.
- `site/public/assets/images/`: lesson screenshots and other static media.
- `rust-labs/`: portable Rust exercises and tests.
- `windows-labs/`: Windows-specific Rust implementations and lab binaries.

## Suggested Context7 retrieval behavior

- Use the topic-routing section to choose a chapter, then retrieve the most specific lesson URL below.
- When a question spans concepts, retrieve the prerequisite lesson as well as the implementation lesson. For example, pair virtual memory from Chapter 1 with an external-memory implementation from Chapter 3.
- Prefer the exact version-pinned page over a generic answer when discussing a named game.
- Keep distinctions such as address versus identity, bytes versus meaning, TCP read versus message, and user mode versus kernel mode.
- Include the explanation around a code sample. The book intentionally explains why each Windows flag, pointer check, buffer size, register save, or cleanup step exists.
- Preserve the book's version, architecture, state-authority, and least-privilege assumptions when adapting an example.

## Representative code

These small examples establish the book's coding style. Retrieve the linked lesson or `llms-full.txt` for the surrounding explanation, complete implementations, Cargo features, safety invariants, and exercises.

### Checked address arithmetic

Never assume that adding an offset cannot overflow. Use a checked operation and make failure visible:

```rust
fn field_address(object_base: usize, field_offset: usize) -> Option<usize> {
    object_base.checked_add(field_offset)
}

fn main() {
    let player_base = 0x1234_0000usize;
    let health_offset = 0x30usize;

    match field_address(player_base, health_offset) {
        Some(address) => println!("health field: {address:#x}"),
        None => eprintln!("address calculation overflowed"),
    }
}
```

### A readable byte-pattern scanner

`Exact` bytes must match. `Any` bytes are wildcards used for addresses or displacements that may change between builds:

```rust
#[derive(Clone, Copy, Debug)]
enum PatternByte {
    Exact(u8),
    Any,
}

fn find_pattern(bytes: &[u8], pattern: &[PatternByte]) -> Option<usize> {
    if pattern.is_empty() || pattern.len() > bytes.len() {
        return None;
    }

    bytes.windows(pattern.len()).position(|window| {
        window.iter().zip(pattern).all(|(actual, expected)| match expected {
            PatternByte::Exact(wanted) => actual == wanted,
            PatternByte::Any => true,
        })
    })
}

fn main() {
    let code = [0x48, 0x8B, 0x45, 0x20, 0x89, 0x01];
    let pattern = [
        PatternByte::Exact(0x48),
        PatternByte::Exact(0x8B),
        PatternByte::Any,
        PatternByte::Any,
    ];

    assert_eq!(find_pattern(&code, &pattern), Some(0));
}
```

### Length-prefixed TCP messages

TCP is a stream, so one `read` is not guaranteed to contain one complete message. A frame header states the payload length, and `read_exact` gathers that many bytes:

```rust
use std::io::{self, Read, Write};

const MAX_FRAME_SIZE: usize = 1024 * 1024;

fn read_frame(reader: &mut impl Read) -> io::Result<Vec<u8>> {
    let mut length_bytes = [0u8; 4];
    reader.read_exact(&mut length_bytes)?;

    let length = u32::from_be_bytes(length_bytes) as usize;
    if length > MAX_FRAME_SIZE {
        return Err(io::Error::new(
            io::ErrorKind::InvalidData,
            "frame is larger than the configured limit",
        ));
    }

    let mut payload = vec![0u8; length];
    reader.read_exact(&mut payload)?;
    Ok(payload)
}

fn write_frame(writer: &mut impl Write, payload: &[u8]) -> io::Result<()> {
    let length = u32::try_from(payload.len())
        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "payload is too large"))?;

    writer.write_all(&length.to_be_bytes())?;
    writer.write_all(payload)
}
```

### A Windows handle that cleans itself up

The `windows` crate exposes Win32 handles directly. This wrapper makes ownership explicit and closes the handle when the Rust value leaves scope:

```rust
use windows::Win32::Foundation::{CloseHandle, HANDLE};

#[derive(Debug)]
struct OwnedHandle(HANDLE);

impl OwnedHandle {
    fn new(handle: HANDLE) -> Option<Self> {
        (!handle.is_invalid()).then_some(Self(handle))
    }

    fn raw(&self) -> HANDLE {
        self.0
    }
}

impl Drop for OwnedHandle {
    fn drop(&mut self) {
        if !self.0.is_invalid() {
            // SAFETY: this value uniquely owns one valid Win32 handle. 🛡️
            unsafe {
                let _ = CloseHandle(self.0);
            }
        }
    }
}
```

### Turning an RVA into a live address

ASLR can move a module, but an RVA remains a distance from that module's current base:

```rust
fn live_address(module_base: usize, rva: u32) -> Option<usize> {
    module_base.checked_add(rva as usize)
}

let current_image_base = 0x0000_7ff6_2000_0000usize;
let function_rva = 0x0001_42a0u32;
let function_address = live_address(current_image_base, function_rva)
    .expect("module base plus RVA must fit in usize");

assert_eq!(function_address, 0x0000_7ff6_2001_42a0);
```

## How to use this book

- Begin with Chapter 1 if the reader is new to computers, memory, programming, or reverse engineering.
- Explain unfamiliar terms in plain English before using them.
- Treat unlabeled code as the book's default language; assembly, PowerShell, and Lua are labeled explicitly.
- Preserve the technical scope stated on each page: exact builds, local test servers, bounded inputs, and reversible changes.
- Prefer the canonical chapter URLs below rather than guessing paths.

## Chapters and lessons

### 1. Computer, Game, and Code Foundations

- [1.1 — Reasoning from Evidence](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/01/): Ask precise questions, judge evidence, test assumptions, correct mistakes, and build understanding through practice. Estimated reading time: 20 minutes.
- [1.2 — How a Computer Runs a Game](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/02/): Build a game from CPU instructions, a small program, stored values, and the services that make it interactive. Estimated reading time: 16 minutes.
- [1.3 — Game Fundamentals](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/03/): Follow actions through a game's entities, checks, space, and time; distinguish live state, display copies, server decisions, saves, and bytes. Estimated reading time: 39 minutes.
- [1.4 — Programming Fundamentals](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/04/): Build a guarded gold-purchase function and use it to understand variables, branches, test cases, collections, and ways to organize code. Estimated reading time: 40 minutes.
- [1.5 — Rust Primer: Logic in Code](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/05/): Express programming logic in Rust: name state, choose a path, repeat work, group values, borrow safely, and handle missing or failed results. Estimated reading time: 55 minutes.
- [1.6 — Hacking Fundamentals](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/06/): Turn observed game behavior into repeatable experiments, test a small tool, and record the evidence needed to reproduce its results. Estimated reading time: 27 minutes.
- [1.7 — A Windows Lab You Can Reset](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/07/): Set up a Windows virtual machine with the compiler, debugger, memory scanner, course code, and recovery snapshots. Estimated reading time: 20 minutes.
- [1.8 — How Memory Actually Works](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/08/): Trace one game value through bytes, types, addresses, pointers, and offsets, then see why a found address can change. Estimated reading time: 25 minutes.
- [1.9 — What a Memory Scan Really Finds](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/09/): Find, test, and change one gold value in Wesnoth, and see what each scan does and does not prove. Estimated reading time: 18 minutes.
- [1.10 — Bits, Masks, Shifts, and Rotations](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/17/): Read a byte by its bit positions, select flags with masks, and distinguish discarded shift bits from wrapped rotation bits. Estimated reading time: 22 minutes.

### 2. Following Instructions and Addresses

- [2.1 — What a Debugger Can Reveal](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/01/): Learn what a debugger actually does and why pausing one instruction can answer a big question. Estimated reading time: 9 minutes.
- [2.2 — How Source Becomes a Running Process](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/10/): Compare native compilation, bytecode interpretation, REPLs, and type checking; then follow a native program through linking and loading. Estimated reading time: 28 minutes.
- [2.3 — How Assembly Describes a Running Game](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/02/): Understand what assembly is, how the CPU executes it, and how registers, memory, flags, stacks, and calls fit together. Estimated reading time: 30 minutes.
- [2.4 — Breakpoints: One Moment of Program State](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/03/): Pause on an instruction or memory access, inspect registers, memory, and the call stack, and continue without losing the thread. Estimated reading time: 12 minutes.
- [2.5 — From a Game Value to the Code That Changes It](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/04/): Follow a known gold address backward to the exact instruction that changes it. Estimated reading time: 20 minutes.
- [2.6 — Tracing an Action Through Its Callers](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/05/): Follow callers and dependencies from one gold-changing instruction to the menu decision that caused it. Estimated reading time: 28 minutes.
- [2.7 — Why Addresses Move](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/08/): Understand dynamic allocation, module bases, ASLR, and why a pointer path survives when one raw address does not. Estimated reading time: 18 minutes.
- [2.8 — How Pointer Paths Survive Restarts](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/09/): Trace the player object back to a verified starting point and prove the pointer path across restarts. Estimated reading time: 20 minutes.
- [2.9 — How Detours Change Control Flow](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/06/): Understand how a small detour can run extra instructions and still return the game to its original path. Estimated reading time: 14 minutes.
- [2.10 — What a Working Detour Must Preserve](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/07/): Build a temporary debugger-only detour, prove every hop, and restore the target. Estimated reading time: 17 minutes.

### 3. Typed Memory, Ownership, and Object Layouts

- [3.1 — Safe Boundaries for Game Memory](https://mustcodeal.github.io/rust-game-hacking-book/pages/3/01/): Learn the ownership, address, byte-buffer, error, and operating-system boundaries used by every memory tool. Estimated reading time: 28 minutes.
- [3.2 — Rust: Missing Values, Failures, and States](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/13/): Follow Option and Result through closures, early returns, and pattern matching, then represent game states with enums. Estimated reading time: 22 minutes.
- [3.3 — Rust: Collections, Bounds, and Bytes](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/14/): Read iterator chains, overlapping windows, complete records, explicit byte conversion, integer limits, and C layout. Estimated reading time: 24 minutes.
- [3.4 — Rust: Borrowed Views and Useful Interfaces](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/15/): Connect lifetimes, typed offsets, From and Into, Display, derived traits, generic capabilities, and validated builders. Estimated reading time: 24 minutes.
- [3.5 — Rust: Cleanup and Helpful Errors](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/16/): Use scope-bound cleanup, Drop, structured library errors, and application context without hiding failures. Estimated reading time: 22 minutes.
- [3.6 — How Bytes Become Numbers and Pointers](https://mustcodeal.github.io/rust-game-hacking-book/pages/3/09/): Work out by hand how whole numbers, negative numbers, and f32 floats are stored, and exactly what a pointer's type controls. Estimated reading time: 24 minutes.
- [3.7 — How External Tools Read Game Memory](https://mustcodeal.github.io/rust-game-hacking-book/pages/3/02/): Open the target, read a verified address, and write through a small checked process-memory wrapper. Estimated reading time: 24 minutes.
- [3.8 — How C++ Objects Appear in Memory](https://mustcodeal.github.io/rust-game-hacking-book/pages/3/03/): Turn repeated reads, member-function calls, and virtual dispatch into a tested object layout, then inspect it through typed snapshots. Estimated reading time: 35 minutes.
- [3.9 — Object-Oriented Clues in Machine Code](https://mustcodeal.github.io/rust-game-hacking-book/pages/3/04/): Recognize the shapes that factories, states, observers, singletons, and component systems leave in compiled code: repeated pointers, virtual calls, constructors, and update loops. Estimated reading time: 42 minutes.
- [3.10 — How Collections Live and Die in Memory](https://mustcodeal.github.io/rust-game-hacking-book/pages/3/05/): Identify vectors, strings, handles, component pools, reference counts, and destruction paths without assuming one compiler's private layout. Estimated reading time: 40 minutes.
- [3.11 — How Text Becomes Bytes in a Game](https://mustcodeal.github.io/rust-game-hacking-book/pages/3/07/): Trace visible text to bytes, understand encodings and terminators, and build checked strings at FFI boundaries. Estimated reading time: 16 minutes.

### 4. Game State and Bounded Decisions

- [4.1 — Game Engines: Input, Simulation, and Rendering](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/11/): Follow input, movement, collisions, timers, and drawing through an engine; distinguish live state from the code and files that produce it. Estimated reading time: 35 minutes.
- [4.2 — From One Player to a Game-State Snapshot](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/01/): See how one verified player layout becomes a bounded, typed snapshot of every side in a local match. Estimated reading time: 18 minutes.
- [4.3 — Why Snapshots Need Guarded Actions](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/02/): Learn why live reads go stale and how snapshots, separate observation, and verified writes protect a game-state tool. Estimated reading time: 26 minutes.
- [4.4 — Coordinates, Vectors, and Directions](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/11/): Build distance and direction from positions, use normalization and dot products to express spatial decisions, then blend values and test contact with simple shapes. Estimated reading time: 26 minutes.
- [4.5 — Maps as Grids of Game State](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/03/): Understand a map as indexed game state, then trace and visualize one tile's visibility in an offline lab. Estimated reading time: 16 minutes.
- [4.6 — Automation as a Feedback Loop](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/04/): Use a recruitment loop to see why feedback, named states, confirmation, and a safe stop make automation reliable. Estimated reading time: 22 minutes.
- [4.7 — From Coordinates to Target Selection](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/05/): Trace player and enemy positions in offline Flare, then choose actions from validated coordinates rather than fixed timings. Estimated reading time: 21 minutes.
- [4.8 — Pathfinding on a Game Map](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/06/): Turn a verified tile grid into routes with BFS or A-Star, keeping map observation separate from game input. Estimated reading time: 36 minutes.
- [4.9 — When Changed State Becomes an Event](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/07/): Turn repeated polls into meaningful events with snapshot differences, debouncing, confirmation, and cooldowns. Estimated reading time: 25 minutes.
- [4.10 — How NPCs Sense and Decide](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/09/): Follow a guard through sensing, delayed reactions, and state changes to understand how games choose an NPC's next action. Estimated reading time: 17 minutes.

### 5. Executable Maps, Instruction References, and Scans

- [5.1 — What a Windows Executable Contains](https://mustcodeal.github.io/rust-game-hacking-book/pages/7/01/): Use the PE header and section map to understand where a Windows executable keeps code, data, imports, and addresses. Estimated reading time: 24 minutes.
- [5.2 — File Offsets, RVAs, and Live Addresses](https://mustcodeal.github.io/rust-game-hacking-book/pages/7/02/): Connect positions in a PE file to relative virtual addresses and the addresses Windows gives its loaded modules. Estimated reading time: 28 minutes.
- [5.3 — DLL Exports and Forwarded Names](https://mustcodeal.github.io/rust-game-hacking-book/pages/7/03/): Understand how a DLL publishes functions through data directories, names, ordinals, addresses, and forwarded exports. Estimated reading time: 42 minutes.
- [5.4 — Instruction Reference: Values and Integer Arithmetic](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/10/): Look up common x86 value operations, then explore each one with a worked trace. Estimated reading time: 28 minutes.
- [5.5 — Instruction Reference: Decisions, Stack, and Bits](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/11/): Explore comparisons, branches, call stacks, masks, shifts, and debugger stops one instruction at a time. Estimated reading time: 35 minutes.
- [5.6 — Instruction Reference: Scalar Floating-Point Values](https://mustcodeal.github.io/rust-game-hacking-book/pages/2/12/): Trace speed, position, numeric conversions, and NaN comparisons using the SSE instructions common in game code. Estimated reading time: 20 minutes.
- [5.7 — Byte Signatures and Pattern Scanning](https://mustcodeal.github.io/rust-game-hacking-book/pages/7/04/): See how byte patterns locate candidate instructions across known builds, and why wildcards and semantic checks matter. Estimated reading time: 35 minutes.
- [5.8 — Memory Regions and Value Scanning](https://mustcodeal.github.io/rust-game-hacking-book/pages/7/05/): Understand region permissions, copied snapshots, candidate filtering, and guarded writes in a value scanner. Estimated reading time: 35 minutes.
- [5.9 — Instruction Decoding and Disassembly](https://mustcodeal.github.io/rust-game-hacking-book/pages/7/06/): See how a disassembler finds boundaries and meanings in variable-length x86 byte streams. Estimated reading time: 22 minutes.
- [5.10 — Event Tracing for Windows](https://mustcodeal.github.io/rust-game-hacking-book/pages/7/09/): Understand how ETW records time-stamped events around a running game and how to read a short performance trace. Estimated reading time: 28 minutes.
- [5.11 — Parallel Scanning and Stable Snapshots](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/05/): Use immutable memory snapshots, bounded workers, cancellation, and sorted results to make scanning faster without losing reproducibility. Estimated reading time: 32 minutes.

### 6. Windows Processes and Callable Interfaces

- [6.1 — The Running Game as a Process](https://mustcodeal.github.io/rust-game-hacking-book/pages/10/01/): An executable becomes a process with threads, modules, handles, and Windows-managed state; the PEB and TEB reveal useful structure without being a safe API. Estimated reading time: 24 minutes.
- [6.2 — Game Runtimes and Object Lifetimes](https://mustcodeal.github.io/rust-game-hacking-book/pages/10/09/): Native code, Mono, IL2CPP, .NET, and Java expose different evidence about objects and their lifetimes; classify a build before trusting an offset. Estimated reading time: 26 minutes.
- [6.3 — Process Access Rights](https://mustcodeal.github.io/rust-game-hacking-book/pages/10/03/): A process ID names a target; tokens, integrity levels, DACLs, and access masks decide which operations Windows permits. Estimated reading time: 26 minutes.
- [6.4 — Handle Ownership and Lifetimes](https://mustcodeal.github.io/rust-game-hacking-book/pages/10/04/): Windows handles are capabilities with lifetimes. Rust ownership and RAII make leaks and double closes easier to prevent. Estimated reading time: 25 minutes.
- [6.5 — Virtual Address Spaces and Page Protections](https://mustcodeal.github.io/rust-game-hacking-book/pages/10/05/): Pages, regions, and R/W/X permissions explain why a game address can exist, fail, or change meaning. Estimated reading time: 33 minutes.
- [6.6 — Threads, Contexts, and Stacks](https://mustcodeal.github.io/rust-game-hacking-book/pages/10/06/): A game's threads share process resources while retaining separate execution contexts and call stacks; scheduling and races shape what an observer sees. Estimated reading time: 33 minutes.
- [6.7 — What a DLL Function Promises Its Caller](https://mustcodeal.github.io/rust-game-hacking-book/pages/3/08/): Infer an exported function's parameters, calling convention, result, and responsibility for memory cleanup before wrapping it in a small typed API. Estimated reading time: 28 minutes.
- [6.8 — How an Engine Orders and Shares Its Work](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/12/): See how an engine's systems share data through components, resources, and events, how one frame's work is ordered and run in parallel, and how the engine notices only what changed. Estimated reading time: 32 minutes.
- [6.9 — Windows Input: Polling, Events, and Messages](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/06/): Compare hotkey polling, synthetic input, and window messages so a local game tool chooses the right input boundary, and see how the window's client area, scale, and several windows change the coordinates it works with. Estimated reading time: 36 minutes.
- [6.10 — Debug Events and Software Breakpoints](https://mustcodeal.github.io/rust-game-hacking-book/pages/7/07/): Understand how Windows debug events, breakpoint bytes, and thread state let a debugger pause and resume a real instruction. Estimated reading time: 24 minutes.
- [6.11 — Sampling Game State Under Load](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/08/): Record changing game state without delaying observation, hiding dropped samples, or losing the log's meaning. Estimated reading time: 35 minutes.

### 7. Camera Geometry and Rendering APIs

- [7.1 — Camera Frames and Projection](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/01/): Follow a world-space point through engine axis conventions, camera axes, object transforms and their local and world copies, quaternions, homogeneous coordinates, orthographic projection, and texture coordinates. Estimated reading time: 40 minutes.
- [7.2 — The Rendering Pipeline and Its State](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/02/): See how objects become pixels through meshes, materials, light, shaders, rasterization, depth testing, transparency, visibility flags and layers, culling, render passes, HDR and anti-aliasing, the renderer's own copy of the world, and the 2D case, and the state that gives each draw its meaning. Estimated reading time: 55 minutes.
- [7.3 — OpenGL Draw Calls and State](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/03/): Understand what indexed OpenGL draws request, how bound state, depth settings and shader inputs change their meaning, and why observation must keep the render thread moving. Estimated reading time: 40 minutes.
- [7.4 — Render Categories and Color Probes](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/04/): Use temporary color to distinguish render categories while accounting for materials, lighting, blending, color space, and the several passes that draw one frame. Estimated reading time: 20 minutes.
- [7.5 — Camera Rays, Collisions, and Crosshairs](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/05/): See how a camera ray, collision query, and occlusion test become a game's crosshair target, and how the same ray from a mouse cursor picks what is under it. Estimated reading time: 34 minutes.
- [7.6 — Aim Geometry and Target Selection](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/06/): Connect vectors to yaw, pitch, angular error, target ranking, how animation poses a skeleton, target points, timing, and projectile motion. Estimated reading time: 44 minutes.
- [7.7 — Recoil, Spread, and Camera Motion](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/07/): Separate input, weapon kick, random spread, camera shake and other camera motion, and recovery to understand why the view moves after a shot. Estimated reading time: 32 minutes.
- [7.8 — Radar Coordinates and Marker Filtering](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/08/): Follow team and alive filters, local coordinate transforms, radar scale, range clipping, and elevation markers. Estimated reading time: 23 minutes.
- [7.9 — World-to-Screen Projection and Overlays](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/09/): Follow a 3D point through world, view, clip, normalized, and screen coordinates, with the field of view, aspect ratio, and each camera's viewport, to place stable overlays. Estimated reading time: 44 minutes.
- [7.10 — Direct3D Interfaces and Vtables](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/10/): Understand how COM vtables expose Direct3D methods, why export lookup differs from OpenGL, and how a reversible swap-chain hook works. Estimated reading time: 34 minutes.
- [7.11 — Direct3D Draw Calls and Bound State](https://mustcodeal.github.io/rust-game-hacking-book/pages/5/11/): Read Direct3D draw calls in the context of their bound state, compare what the same arguments mean in Direct3D 9 and 11, and see how shader variants, instancing, and many small draws change a frame's cost. Estimated reading time: 32 minutes.

### 8. In-Process Tools, Input, and Integration

- [8.1 — In-Process DLLs and Loader Boundaries](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/01/): Understand what changes when Rust code runs inside a game process and how DLL loading constrains initialization. Estimated reading time: 20 minutes.
- [8.2 — DLL Loading Across Process Boundaries](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/02/): Follow the module path, process handle, remote memory, and loader call involved in loading a DLL into a controlled game process. Estimated reading time: 20 minutes.
- [8.3 — Detours and Reversible Patches](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/03/): Understand how a detour redirects execution, preserves displaced instructions, verifies target bytes, and restores the original path. Estimated reading time: 44 minutes.
- [8.4 — Import Table Hooks](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/04/): See how an imported function pointer can be redirected inside a controlled process and safely restored. Estimated reading time: 28 minutes.
- [8.5 — How a Game Reads Input](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/11/): Follow a key press, a stick movement, and a mouse move from the device to a game action, and see why buttons have edges, sticks have dead zones, and typed text is not the same as keys. Estimated reading time: 28 minutes.
- [8.6 — Menus as State and Command Interfaces](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/07/): See how a settings menu expresses feature state, sends commands to a worker, and shuts down without leaving stale changes. Estimated reading time: 38 minutes.
- [8.7 — In-Game Menus and Text Rendering](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/09/): Understand what a game's interface is made of, how its text function can draw a small menu, and why input edges, frame timing, and string lifetimes matter. Estimated reading time: 36 minutes.
- [8.8 — Render Snapshots and Feature Integration](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/08/): Combine camera and player observations, graphics features, versioned profiles, and reversible hooks, including two exact-build Urban Terror wallhacks, without mixing frames or losing game state. Estimated reading time: 24 minutes.
- [8.9 — Tool Architecture, Commands, and Cleanup](https://mustcodeal.github.io/rust-game-hacking-book/pages/8/10/): Organize a local tool around owned snapshots, typed commands, feature lifecycles, version checks, and dependable cleanup. Estimated reading time: 26 minutes.
- [8.10 — Hooks as Live Control-Flow Changes](https://mustcodeal.github.io/rust-game-hacking-book/pages/13/05/): A hook changes live control flow under threads, ABI rules, and versioned bytes; safe installation and removal preserve those contracts. Estimated reading time: 52 minutes.

### 9. Network Messages, Authority, and IPC

- [9.1 — Messages, Streams, and Multiplayer](https://mustcodeal.github.io/rust-game-hacking-book/pages/6/01/): See how a client and server turn a move into framed bytes, and why TCP transport does not define a game's message boundaries. Estimated reading time: 25 minutes.
- [9.2 — What the Server Can See](https://mustcodeal.github.io/rust-game-hacking-book/pages/15/02/): Validate commands against server-owned state, withhold hidden information, and use replays carefully. Estimated reading time: 8 minutes.
- [9.3 — Protocol Capture and Message Framing](https://mustcodeal.github.io/rust-game-hacking-book/pages/6/02/): Learn how a short local capture reveals message direction, boundaries, and the bytes associated with one game action. Estimated reading time: 17 minutes.
- [9.4 — Message Parsing and Serialization](https://mustcodeal.github.io/rust-game-hacking-book/pages/6/03/): Connect raw chat frames to typed messages through bounded parsing, serialization, and round-trip checks. Estimated reading time: 30 minutes.
- [9.5 — Protocol State Machines and Replay](https://mustcodeal.github.io/rust-game-hacking-book/pages/6/04/): Understand legal message order through session states, replay, real-time ticks, snapshots, and sequence numbers. Estimated reading time: 39 minutes.
- [9.6 — Clients, Handshakes, and Chat Automation](https://mustcodeal.github.io/rust-game-hacking-book/pages/6/05/): See a complete protocol client perform Wesnoth's local handshake, read framed messages, and respond to one chat command. Estimated reading time: 24 minutes.
- [9.7 — Local Proxies and Bidirectional Streams](https://mustcodeal.github.io/rust-game-hacking-book/pages/6/06/): Understand how a local proxy relays two byte streams while preserving direction, framing, and the original messages. Estimated reading time: 20 minutes.
- [9.8 — Shared Memory Between Processes](https://mustcodeal.github.io/rust-game-hacking-book/pages/6/07/): See how two processes communicate through named shared memory, with explicit layouts, permissions, synchronization, and cleanup. Estimated reading time: 34 minutes.
- [9.9 — Named Pipes and Local Message Framing](https://mustcodeal.github.io/rust-game-hacking-book/pages/6/08/): Compare byte and message modes in Windows named pipes, then account for framing, bounded reads, connection races, and handle ownership. Estimated reading time: 38 minutes.
- [9.10 — How the Source Engine Works](https://mustcodeal.github.io/rust-game-hacking-book/pages/6/09/): Follow a player's command through Source's modules, prediction, server simulation, and snapshots, then connect those boundaries to settings and game files. Estimated reading time: 18 minutes.

### 10. Game Files, Mods, and Artifact Trust

- [10.1 — Game Files and Live Memory](https://mustcodeal.github.io/rust-game-hacking-book/pages/9/01/): See how saves, configuration, textures, maps, and archives preserve game state outside a running process, how a game turns an asset file into something it can draw or play, and how long that asset stays loaded, changes, or reloads. Estimated reading time: 32 minutes.
- [10.2 — Save Formats and Safe Editing](https://mustcodeal.github.io/rust-game-hacking-book/pages/9/02/): See how text saves encode state, how controlled comparisons reveal fields, and why writes must be atomic. Estimated reading time: 24 minutes.
- [10.3 — Binary Saves and Hex Editing](https://mustcodeal.github.io/rust-game-hacking-book/pages/9/09/): Read offsets and bytes in a hex editor, decode a small binary save, compare two files, and update a checksum. Estimated reading time: 32 minutes.
- [10.4 — Textures and Asset Replacement](https://mustcodeal.github.io/rust-game-hacking-book/pages/9/03/): Connect a visible game surface to its texture file, preserve the expected format, and package a reversible replacement, then read the same ideas in a 3D model (glTF) and a sound, including how a sound is placed between two ears and fades with distance. Estimated reading time: 34 minutes.
- [10.5 — Data-Driven Game Mods](https://mustcodeal.github.io/rust-game-hacking-book/pages/9/04/): Understand how a game turns editable unit definitions into behavior and how small changes can be validated. Estimated reading time: 18 minutes.
- [10.6 — Mod Archives and Safe Extraction](https://mustcodeal.github.io/rust-game-hacking-book/pages/9/05/): Learn why archive entry names require path, size, and file-type checks before a mod is installed. Estimated reading time: 27 minutes.
- [10.7 — Reversible Mods and Manifests](https://mustcodeal.github.io/rust-game-hacking-book/pages/9/06/): Use a manifest to record installed files, hashes, and restore actions so a mod can be checked and removed. Estimated reading time: 24 minutes.
- [10.8 — File Hashes and Digital Signatures](https://mustcodeal.github.io/rust-game-hacking-book/pages/9/07/): Separate byte integrity from publisher identity through hashes, signatures, certificates, and Windows trust checks. Estimated reading time: 37 minutes.
- [10.9 — Build Identity and Versioned Evidence](https://mustcodeal.github.io/rust-game-hacking-book/pages/10/02/): Learn why a version label is not enough and how a verified SHA-256 manifest ties addresses, patterns, mods, and patches to exact files. Estimated reading time: 30 minutes.
- [10.10 — Encryption and Key Lifecycles](https://mustcodeal.github.io/rust-game-hacking-book/pages/9/08/): Compare encoding, hashing, MACs, and encryption, then follow the keys and metadata needed to protect a save. Estimated reading time: 46 minutes.

### 11. NPC Policy, Lua, and Script Execution

- [11.1 — How an NPC Sees, Chooses, and Remembers](https://mustcodeal.github.io/rust-game-hacking-book/pages/4/10/): Work through the arithmetic inside Lesson 4.12's toy guard: the distance and dot product behind its view cone, stepped line-of-sight checks, utility scores and their switch points, and behavior trees. Estimated reading time: 22 minutes.
- [11.2 — Why Games Use Lua](https://mustcodeal.github.io/rust-game-hacking-book/pages/12/01/): See why a game hosts Lua, run a small observer script, and learn the values and host boundary that later lessons build on. Estimated reading time: 20 minutes.
- [11.3 — Lua Tables, Functions, and Metatables](https://mustcodeal.github.io/rust-game-hacking-book/pages/12/02/): Lua's flexible tables and first-class functions express records, sequences, callbacks, methods, and lookup behavior. Estimated reading time: 30 minutes.
- [11.4 — The Host–Script Boundary](https://mustcodeal.github.io/rust-game-hacking-book/pages/12/03/): An embedded Lua VM can act only through the host functions and libraries the game exposes; typed contracts and error context keep that boundary clear. Estimated reading time: 35 minutes.
- [11.5 — Snapshots as a Script Interface](https://mustcodeal.github.io/rust-game-hacking-book/pages/12/04/): Immutable, versioned observations and bounded action requests connect Lua to game state without exposing arbitrary pointers. Estimated reading time: 33 minutes.
- [11.6 — State Machines for Lua Automation](https://mustcodeal.github.io/rust-game-hacking-book/pages/12/05/): Named states, guarded transitions, timeouts, and a stop path make a scripted game observer predictable. Estimated reading time: 31 minutes.
- [11.7 — Script Budgets, Errors, and Recovery](https://mustcodeal.github.io/rust-game-hacking-book/pages/12/06/): Memory and instruction limits, tracebacks, and failure handling keep useful scripts from overrunning their host. Estimated reading time: 30 minutes.
- [11.8 — What Any Computer Can Compute](https://mustcodeal.github.io/rust-game-hacking-book/pages/1/12/): Build a Turing machine by hand, see why one computer can run every program, and learn which questions about programs no tool can always answer. Estimated reading time: 22 minutes.
- [11.9 — From Lua Source to a Tiny Virtual Machine](https://mustcodeal.github.io/rust-game-hacking-book/pages/12/07/): Tokens, syntax, bytecode, and a bounded interpreter loop turn a short Lua-like expression into machine behavior. Estimated reading time: 42 minutes.
- [11.10 — Values, Tables, Strings, and Garbage Collection](https://mustcodeal.github.io/rust-game-hacking-book/pages/12/08/): See how a dynamic language represents values, why tables combine array and map behavior, and why automatic memory management must understand shared references and cycles. Estimated reading time: 38 minutes.
- [11.11 — Call Frames, Closures, and Upvalues](https://mustcodeal.github.io/rust-game-hacking-book/pages/12/09/): Understand VM call frames, multiple returns, captured locals, open and closed upvalues, and the host boundary where native functions enter Lua. Estimated reading time: 40 minutes.

### 12. Loaders, Kernel Services, and Trust Boundaries

- [12.1 — DLL Identity and Search Order](https://mustcodeal.github.io/rust-game-hacking-book/pages/11/01/): A loaded module has a path, bytes, signer, and dependency context; names alone cannot prove which code entered a game. Estimated reading time: 30 minutes.
- [12.2 — DLL Loading and the Loader Lock](https://mustcodeal.github.io/rust-game-hacking-book/pages/11/02/): Mapping imports and running DllMain require careful ordering; a tiny entry point avoids work that can deadlock the loader. Estimated reading time: 27 minutes.
- [12.3 — Dynamic Windows API Resolution](https://mustcodeal.github.io/rust-game-hacking-book/pages/11/03/): Runtime export lookup turns an optional Windows API into a checked capability with an explicit ABI and fallback. Estimated reading time: 29 minutes.
- [12.4 — What an Operating System Kernel Does](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/01/): The processor separates user and kernel authority. System calls, scheduling, memory, interrupts, and drivers show what the kernel does for a running game. Estimated reading time: 18 minutes.
- [12.5 — From Win32 Calls to Kernel Services](https://mustcodeal.github.io/rust-game-hacking-book/pages/10/07/): A Windows API call crosses layers of exports, native APIs, and system calls before a kernel service acts on a request. Estimated reading time: 28 minutes.
- [12.6 — System Calls and Privilege Checks](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/07/): Privilege bits, page permissions, API stubs, handle checks, and NTSTATUS together explain one request's route through the kernel. Estimated reading time: 13 minutes.
- [12.7 — How Device Drivers Work](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/02/): Drivers translate operating-system requests into hardware work through I/O packets, registers, interrupts, and DMA, including the path from key press to game input. Estimated reading time: 18 minutes.
- [12.8 — Driver Requests and Device Registers](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/08/): Control-code fields, device registers, interrupt work, and USB reports reveal how a driver turns a request or key press into an observable result. Estimated reading time: 18 minutes.
- [12.9 — The Kernel Trust Boundary](https://mustcodeal.github.io/rust-game-hacking-book/pages/11/05/): Kernel drivers have authority beyond a game process; driver inventories and narrow privileges make that boundary visible. Estimated reading time: 22 minutes.
- [12.10 — Failure Modes at Trust Boundaries](https://mustcodeal.github.io/rust-game-hacking-book/pages/13/09/): Eight further failure modes, from wrapping arithmetic to partial commits, show where an invariant must be enforced. Estimated reading time: 55 minutes.

### 13. Physical Memory, Machines, and Hardware

- [13.1 — DMA and Physical Memory](https://mustcodeal.github.io/rust-game-hacking-book/pages/11/06/): DMA gives devices a path to memory, while page tables and IOMMUs determine which physical bytes correspond to an address. Estimated reading time: 40 minutes.
- [13.2 — Virtual-to-Physical Address Translation](https://mustcodeal.github.io/rust-game-hacking-book/pages/11/07/): An offline page-table walk maps one process address to bounded offsets in a RAM capture, including reads that cross pages. Estimated reading time: 48 minutes.
- [13.3 — Hypervisors and Virtual Machines](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/03/): A hypervisor gives guest machines controlled access to processors and memory through VM exits, two-stage translation, and snapshots. Estimated reading time: 18 minutes.
- [13.4 — Guest Execution and Address Translation](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/09/): A guest relies on virtualization support and two-stage address translation; walking one address shows both the isolation and its cost. Estimated reading time: 10 minutes.
- [13.5 — Firmware and Bare-Metal Rust](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/12/): Follow a microcontroller from reset to Rust, build a working firmware image, and understand what changes when you program a physical board. Estimated reading time: 28 minutes.
- [13.6 — How Game Consoles Are Built](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/05/): Consoles combine familiar computer parts with secure boot, signing, and platform rules that shape how games can run and be modified. Estimated reading time: 20 minutes.
- [13.7 — Hardware Debugging with JTAG](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/04/): JTAG began as a board-test port and became a hardware debugging path through scan chains, the TAP controller, and SWD. Estimated reading time: 18 minutes.
- [13.8 — JTAG Scan Chains and Debug Access](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/10/): Shift registers, TAP states, IDCODE, and SWD packets show how a hardware debugger discovers and controls a chip. Estimated reading time: 23 minutes.
- [13.9 — How Emulators Work](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/06/): An emulator recreates a console in software through instruction execution, memory-mapped I/O, timing, graphics, audio, and save states. Estimated reading time: 18 minutes.
- [13.10 — Emulator Timing and State](https://mustcodeal.github.io/rust-game-hacking-book/pages/14/11/): A toy console makes instruction costs, frame timing, save states, and register races concrete inside a Rust emulator. Estimated reading time: 20 minutes.

### 14. Versioned Evidence, State, and Integrity

- [14.1 — Object Layouts Across Game Updates](https://mustcodeal.github.io/rust-game-hacking-book/pages/13/06/): Object identity, field offsets, and layouts must be recovered for each build through several independent access patterns, starting from a toy guard whose padded layout is known. Estimated reading time: 50 minutes.
- [14.2 — Call Tracing and Bounded Logs](https://mustcodeal.github.io/rust-game-hacking-book/pages/7/08/): Connect scanning, decoding, breakpoints, and bounded logging to a trace of calls made by a running game. Estimated reading time: 35 minutes.
- [14.3 — Crash Dumps as Process Snapshots](https://mustcodeal.github.io/rust-game-hacking-book/pages/10/08/): A small dump preserves selected threads, modules, registers, and stacks for later inspection without a running process. Estimated reading time: 24 minutes.
- [14.4 — Capture Provenance and Validation](https://mustcodeal.github.io/rust-game-hacking-book/pages/11/08/): A plausible translation can still describe the wrong process, build, or moment; provenance and independent checks give offline bytes meaning. Estimated reading time: 34 minutes.
- [14.5 — Game State and Invariants](https://mustcodeal.github.io/rust-game-hacking-book/pages/13/01/): A game's state changes through transitions. Invariants describe which states remain valid, while controls and detectors answer different parts of that promise. Estimated reading time: 30 minutes.
- [14.6 — Telemetry as Evidence of Game Behavior](https://mustcodeal.github.io/rust-game-hacking-book/pages/13/07/): Bounded event traces connect inputs, decisions, and effects so a suspected control gap becomes a testable claim. Estimated reading time: 47 minutes.
- [14.7 — Integrity Checks and Their Boundaries](https://mustcodeal.github.io/rust-game-hacking-book/pages/13/02/): An integrity check is meaningful only when its inputs, timing, and decision path cover the state it promises to protect. Estimated reading time: 50 minutes.
- [14.8 — Anti-Debug Signals and Responses](https://mustcodeal.github.io/rust-game-hacking-book/pages/13/03/): Anti-debug behavior is a sequence of signals, interpretations, and responses; explicit states expose false positives and weak assumptions. Estimated reading time: 45 minutes.
- [14.9 — When Game Values Are Encoded](https://mustcodeal.github.io/rust-game-hacking-book/pages/3/06/): Learn the difference between representation and security, trace small encode/decode paths, and implement a reversible value plus integrity check. Estimated reading time: 38 minutes.
- [14.10 — Obfuscated Values and Reversible Transforms](https://mustcodeal.github.io/rust-game-hacking-book/pages/13/04/): Reversible transforms can hide a value in memory without providing encryption; round trips and controlled changes reveal the rule. Estimated reading time: 55 minutes.

### 15. Defensive Design and Anti-Cheat

- [15.1 — Why Games Need Anti-Cheat](https://mustcodeal.github.io/rust-game-hacking-book/pages/15/01/): Separate a player's requests from the game's decisions, and connect prevention, detection, and fair enforcement. Estimated reading time: 7 minutes.
- [15.2 — Server Plugins, Counters, and False Flags](https://mustcodeal.github.io/rust-game-hacking-book/pages/15/03/): Read Macrodox and other SourceMod designs as measurement systems, separating button edges, weighted history, and enforcement. Estimated reading time: 10 minutes.
- [15.3 — What Client Protection Can See](https://mustcodeal.github.io/rust-game-hacking-book/pages/15/04/): Connect local integrity checks and kernel protection to boot trust, driver risk, privacy, and reliability. Estimated reading time: 8 minutes.
- [15.4 — How Detections Work](https://mustcodeal.github.io/rust-game-hacking-book/pages/15/05/): Compare detector signals and count the real people behind a false-positive rate. Estimated reading time: 8 minutes.
- [15.5 — Layers, Trust, and Review](https://mustcodeal.github.io/rust-game-hacking-book/pages/15/06/): Combine game, platform, league, and server observations without treating duplicated reports as independent proof. Estimated reading time: 7 minutes.
- [15.6 — Cheat Categories from the Defender's Side](https://mustcodeal.github.io/rust-game-hacking-book/pages/15/07/): Connect different locations of unauthorized code and automation to the observations and boundaries a defender can use. Estimated reading time: 8 minutes.
- [15.7 — Control Gaps in Toy Defenses](https://mustcodeal.github.io/rust-game-hacking-book/pages/11/04/): Three small defenses show how an apparently valid check can miss the path that produces an effect, and how to repair its invariant. Estimated reading time: 32 minutes.
- [15.8 — Control Gaps in Game Logic](https://mustcodeal.github.io/rust-game-hacking-book/pages/13/08/): Three toy game controls reveal a recurring mismatch between the checked proxy and the effect that actually changes state. Estimated reading time: 58 minutes.
- [15.9 — Anti-Cheat in Modern Games](https://mustcodeal.github.io/rust-game-hacking-book/pages/15/08/): Compare documented protection boundaries and lifetimes without treating product names as proof of effectiveness. Estimated reading time: 8 minutes.
- [15.10 — Designing a Game That Is Hard to Cheat In](https://mustcodeal.github.io/rust-game-hacking-book/pages/15/09/): Place authority, disclosure, retries, evidence, and permissions into the game's design from the beginning. Estimated reading time: 8 minutes.

## Additional resources

- [About and learning path](https://mustcodeal.github.io/rust-game-hacking-book/)
- [Glossary](https://mustcodeal.github.io/rust-game-hacking-book/glossary/)
- [Repository README](https://github.com/MustCodeAl/rust-game-hacking-book#readme)
- [Portable Rust exercises](https://github.com/MustCodeAl/rust-game-hacking-book/tree/rustgamehackingreimagined/rust-labs)
- [Windows exercises](https://github.com/MustCodeAl/rust-game-hacking-book/tree/rustgamehackingreimagined/windows-labs)
- [Lua host and scripts](https://github.com/MustCodeAl/rust-game-hacking-book/tree/rustgamehackingreimagined/lua-labs)
- [Advanced memory, cryptography, and offline capture labs](https://github.com/MustCodeAl/rust-game-hacking-book/tree/rustgamehackingreimagined/advanced-memory-labs)
- [Full book text and code for retrieval](https://mustcodeal.github.io/rust-game-hacking-book/llms-full.txt)