Alex S.

UltimateAntiCheat. UltimateAnticheat is an open source usermode anti-cheat system made to detect and prevent common attack vectors in game cheating (C++, Windows)

ObfuscateThis. Templated Obfuscation example in C++ for protecting/hiding values in memory

UltimateDRM. DRM Library for Windows (x64) in C++

HideStaticReferences. Research into removing strings & API call references at compile-time (Anti-Analysis)

NCShark. Pcap Driver Packet Analyzer for Night Crows

OKPOE. Automation & scripting tool for Path of Exile.

DetectionEngine. A generic detection engine (.lib) for Windows which uses downloadable custom rulesets to detect & block processes. Can be used in anti-virus, anti-cheat, anti-crypto mining, etc.

ModifyExports. Research of modifying exported function names at runtime (C/C++, Windows)

LLVMOpaquePass. LLVM Pass which inserts an opaque predicate at the end of a function, filled with junk bytes to cause IDA analysis to fail (x86_64)

StealthAPCDispatcher. Function scheduling stealth method using APC with encrypted shellcode

RemapProtectedClass. Maps view of a section pointing to a class/struct object with SEC_NO_CHANGE & PAGE_EXECUTE_READ, protecting it from page protection modifications and memory writes

SimpleCodeVirtualizer. A simple compile-time code virtualization class in C++

Mir4-ClientEmulator. Network-based Client Emulator for Mir4 Global, written in C#

NobPacker. PE Sections Packer + Loader for Windows - Packs a DLL/EXE file and maps it into the loader (C/C++)

ModifyTLSCallbacks. Edit the program's TLS callbacks at runtime

APC-PE-Injector. APC Injection is a code injection technique which bypasses TLS callback protections (Windows OS)

Mir4-PacketEncryption. Packet Encryption for Mir4.

PE-Injection. Injection Technique: Inserts current process into target process

MirM-PacketEditor. Packet Editor with LUA scripting functionality for Mir:M

EasyHandles. Driver + DLL which allows us to open handles to callback-protected processes

PAGE_NOACCESS-Hooker. An interesting technique on Windows (x64) to "hook" memory via VEH and PAGE_NOACCESS page permissions

TreeOfSaviorPE. Packet editor for Tree Of Savior with embedded LUA scripting

EPT-Hook-Examples. Examples of EPT hooking & tracepoints using the `hv` hypervisor project

LLVM-ObfuscateDynamicImports. LLVM Pass Plugin for obfuscating imported/resolved functions using `GetProcAddress` (x64)

WatchpointObfuscation. An experiment to make reverse engineering of game structures more difficult, by using shared mapped views

StealthDLLProxy. Example of natural/unassisted DLL injection via proxying using various stealth techniques

ProcessInternals. Reference point for enumerating assets of Windows processes

HoH-PacketEditor. Packet editor for Honor of Heirs

DragonClient. Headless client / network emulator for DragonNest MMORPG

LockFree-CircularBuffer. Lock-free circular buffer in C++ for fast & thread-safe telemetry

ChangeModuleName. MITRE ATT&CK Submission - Changing Module names at runtime

DragonCrypto. Encryption module in C for DragonNest MMORPG

helpervisor. Intel VT-x Hypervisor with custom packet logging logic

The-X.ploit.-Files. A detailed documentation of all high & critical severity online game exploits discovered by the author throughout the past 15 years, primarily focused on outbound packet crafting/manipulation. Includes descriptions, categories, data examples, impacts, and potential root causes with remediations

imcCrypt. IMC Games packet encryption methods for Granado Espada