gmh5225/cheat-engine-undetectableAcademic Research Edition - T1: User-mode evasion (obfuscation + syscall gateway), T2: BYOVD kernel bridge, T3: DMA hardware (future work).
Academic Research Edition — Modified Cheat Engine with multi-tiered anti-cheat evasion for cybersecurity education and university-level reverse engineering research.
Disclaimer: This project is exclusively for academic research, university coursework, and cybersecurity education. It must be destroyed upon completion of the academic term.
┌─────────────────────────────────────────────────────────┐
│ Cheat Engine 7.5 │
│ (Lazarus / FreePascal) │
├─────────────────────────────────────────────────────────┤
│ T1: User-Mode Evasion │
│ ├─ Window/process/registry name randomization (-daltname)│
│ ├─ PE metadata stripping & section renaming │
│ ├─ Rich Header removal & timestamp randomization │
│ ├─ Direct syscall stubs (bypass ntdll.dll hooks) │
│ └─ Dynamic syscall number extraction from disk │
├─────────────────────────────────────────────────────────┤
│ T2: Kernel Bridge (BYOVD — WinNotify.sys) │
│ ├─ Anti-cheat detection (10 engines) │
│ ├─ Microsoft-signed driver (WinNotify.sys / signeddrv.sys)│
│ ├─ Kernel virtual memory R/W via IOCTL (no phys mapping) │
│ ├─ CR3-based page table walking for any process │
│ ├─ KASLR defeat via kernel base disclosure IOCTL │
│ ├─ ObCallback bypass (kernel struct manipulation) │
│ └─ Process hiding (PsActiveProcessLinks unlinking) │
├─────────────────────────────────────────────────────────┤
│ T3: DMA Hardware [NOT IMPLEMENTED] │
│ └─ PCIe FPGA/device for hypervisor-level AC bypass │
└─────────────────────────────────────────────────────────┘
| Anti-Cheat | Type | Strategy | Status |
|---|---|---|---|
| Warden (Blizzard) | User-mode | T1 | Functional |
| VAC (Valve) | User-mode | T1 | Functional |
| XIGNCODE3 | User-mode driver | T1 | Functional |
| EasyAntiCheat | Kernel driver | T2 | Requires WinNotify.sys |
| BattlEye | Kernel driver | T2 | Requires WinNotify.sys |
| nProtect GameGuard | Kernel driver | T2 | Requires WinNotify.sys |
| Ricochet (CoD) | Kernel driver | T2 | Partial |
| Vanguard (Riot) | Hypervisor | T3 (DMA) | NOT IMPLEMENTED |
| Faceit / ESEA | Kernel + Hypervisor | T3 (DMA) | NOT IMPLEMENTED |
.
├── README.md
├── Build.ps1 # Automated build pipeline (clones CE, applies patches, builds)
├── .gitignore
├── src/
│ ├── cheatengine.lpi # Project: renamed metadata, -daltname define, output renamed
│ ├── cheatengine.lpr # Main: dynamic Application.Title
│ ├── NewKernelHandler.pas # Core: T1+T2 integration, function pointer swap
│ ├── SyscallGateway.pas # T1: Direct syscall stubs (Read/Write/Open/VQE)
│ ├── AntiCheatDetector.pas # T2: AC detection — processes, drivers, services
│ ├── PhysicalMemory.pas # T2: Driver loader + physical memory R/W via IOCTL
│ ├── KernelBridge.pas # T2: Kernel bypass orchestrator + ObCallback disable
│ ├── StealthHiding.pas # T2: Process hiding via PsActiveProcessLinks unlinking
│ ├── PEPatcher.ps1 # Post-build PE mutation
│ └── Build-Stealth.ps1 # Legacy standalone build script
└── cheat-engine/ # Upstream CE source (cloned by Build.ps1)
Surface Obfuscation — Uses CE's built-in {$ifdef altname} conditional compilation:
"Runtime Modifier" instead of "Cheat Engine 7.5"\Software\Runtime Modifier\ instead of \Software\Cheat Engine\sysdiag64.exe instead of cheatengine-x86_64.exeSyscall Gateway — CE's DBK kernel driver is disabled (its certificate hash is blacklisted by EAC/BE). Instead, all memory access functions (ReadProcessMemory, WriteProcessMemory, VirtualQueryEx, OpenProcess) are redirected through direct syscall instruction stubs:
ntdll.dll from disk before any anti-cheat hooks are activemov r10, rcx; mov eax, [syscall_num]; syscall; retntdll.dll installed by EAC/BEFor kernel-level anti-cheats that block handle creation via ObRegisterCallbacks:
EasyAntiCheat.sys, BEDaisy.sys) and servicesWinNotify.sys / signeddrv.sys (Microsoft Authenticode signed, 2026, 0 VT detections) via Windows Service Control Manager0x22200C): Reads ntoskrnl.exe base address directly from the kernel's loaded module list0x222040/0x222044): Reads/writes any kernel virtual address — no physical address translation neededActiveProcessLinks to locate target game process0x222050/0x222054): Uses the game's DirectoryTableBase to read/write its virtual memory through its own page tablesOpenProcess, no NtReadVirtualMemory — completely invisible to ObCallbacksPsActiveProcessLinksFor hypervisor-level anti-cheats (Vanguard, Faceit), a PCIe DMA device would be needed to read physical RAM from the bus, bypassing both kernel and hypervisor protections. Documented as future research extension.
0x222040)0x222044)0x222050/0x222054)C:\Windows\System32\drivers\ or alongside the compiled executablegit clone https://github.com/NulledNah/cheat-engine-undetectable.git
cd cheat-engine-undetectable
.\Build.ps1 -Clean
# If Lazarus is not in C:\lazarus:
.\Build.ps1 -Clean -LazarusPath "D:\lazarus"
The script:
lazbuild in Release 64-Bit modebin\sysdiag64.exeLaunch sysdiag64.exe
│
├─ DetectAntiCheat() → scans for running AC engines
│
├─ [No kernel AC detected]
│ └─ T1 active: syscall bypass for all operations
│
├─ [EAC/BE detected + WinNotify.sys available]
│ ├─ Load driver via SCM
│ ├─ IOCTL 0x22200C → leak kernel base (KASLR defeated)
│ ├─ IOCTL 0x222040 → read PsInitialSystemProcess → walk ActiveProcessLinks
│ ├─ Find game EPROCESS → extract DirectoryTableBase (CR3)
│ ├─ Hide own process from enumeration
│ └─ All memory ops via CR3 page table walk (zero handles, zero OpenProcess)
│
└─ [Vanguard/Faceit detected]
└─ Warning: hypervisor AC — requires T3 (DMA hardware, not implemented)
This project demonstrates the following cybersecurity concepts:
EPROCESS, ObCallbacks, and page table structuresAcademic Use Only — This project is part of a university thesis/research curriculum. It will be destroyed upon completion of the academic term per university policy.