Windows binary and process exploitation - game security, anti-cheat, kernel debugging, DLL injection, memory scanning, network interception. Trigger AGGRESSIVELY when any target involves game clients, Windows apps, anti-cheat, or binary-level attack surface.
Read this skill inline. The reference files below exist for deep dives only - read them if and when a step below says to.
| Reference File | Read when |
|---|---|
binary-analysis.md | Step 1-3 need PE internals |
network-interception.md | Step 7 needs protocol details |
memory-scanning.md | Step 5 needs AOB patterns |
process-manipulation.md | Step 6 needs VirtualProtect specifics |
dll-injection.md | Step 8 needs injection technique selection |
anticheat-bypass.md | Anti-cheat detected in Step 1 |
kernel-debugging.md | Kernel driver found in Step 1 |
Time limit: 90 minutes per binary. If nothing by then, move on.
# Security checks
checksec --file=target.exe # or DIE, CFF Explorer
strings target.exe | grep -iE "api[_-]?key|secret|token|password|debug|admin"
python -c "import pefile; pe=pefile.PE('target.exe'); print([s.Name.decode().strip(chr(0)) for s in pe.sections])"
Decision gate:
anticheat-bypass.md before proceeding.recv, send, WSARecv, InternetOpenUrl, HttpSendRequest, CreateFile, RegOpenKeyCryptEncrypt, CryptDecrypt, BCryptEncryptDecision gate:
Decision gate:
import pymem
pm = pymem.Pymem("target.exe")
base = pm.process_base.lpBaseOfDll
print(f"Base: {hex(base)}")
Decision gate:
Decision gate:
# Capture game traffic
wireshark -i any -f "host game-server.com" -w capture.pcap
# Or for HTTP(S)
mitmproxy --mode transparent --ssl-insecure
Decision gate:
Decision gate:
anticheat-bypass.md. If expert-level kernel work needed, note it and move on unless bounty justifies the effort.Test each. Check it off or skip with reason.
Every finding needs: