AI
Game Cheats Are Malware Under a Different Name
Joe Aurelio draws a direct line between game cheats and malware. Internal cheats inject code into the game process, then the loader process exits. That is process migration, the same technique malware uses to hide inside a stable system process. External cheats keep a separate process running that reads and writes the game’s memory through standard Windows APIs. Mimikatz pulls passwords from LSASS using this exact method. Microsoft later blocked direct memory access to system processes, but game developers face the same arms race.
The Hardware Gap: DMA Devices Cheats Can’t See
A PCIe device called a Screaming Squirrel plugs into the computer’s expansion slot. A second computer attaches via USB-C to that card and reads game memory over DMA directly, bypassing the CPU and operating system entirely. The main computer only sees a Wi-Fi or Bluetooth device. A hardware fuser overlays the cheat’s ESP graphics onto the monitor output before it reaches the screen. Mouse input runs through an intermediary box that applies last-millisecond aim corrections. The computer sees a normal mouse. No kernel anti-cheat can detect any of this.
Anti-Cheat and EDR: The Same Losing Battle
Kernel-level anti-cheat is the only way to detect software-based cheats, but it grants full system access. Aurelio keeps a separate gaming computer and avoids personal data on it. Secure boot provides a chain of trust from BIOS to OS to anti-cheat, preventing load-order attacks. Cheat developers are profit-driven and global. The cheating industry is multi-billion dollar. One bypass built for one game transfers to the next. Game developers have fewer resources than the cheat sellers.
Red Teamers Should Read Cheat Forums
Cheat development forums contain well-structured code with comments, examples, and detailed threads. They cover process injection, API hooking, and anti-analysis techniques that overlap with malware development. Some techniques used by cheaters later appear in real malware. Aurelio says cheat hacking and offensive security are two sides of the same coin.
Q&A
Is kernel-level anti-cheat actually necessary? Yes, because without kernel access there is no realistic chance of detecting cheaters in competitive games, but users should decide whether they trust the software. ▶ 19:02
Who leads the arms race, offense or defense? Offense leads because defense always reacts to the latest techniques. ▶ 20:26
Can HDMI handshake data detect DMA cheat devices? Possibly, because the HDMI protocol reports device IDs, so a system could flag non-monitor displays. ▶ 21:39
Why do cheats ship faster than anti-cheat updates? Cheating is a multi-billion dollar industry with global profit incentive, while game developers operate with smaller teams and budgets. ▶ 23:25
Notable Quotes
cheaters are are usually bad at the game. It’s a skill issue. Get good. Joe “Juno” Aurelio · ▶ 0:37
the point is cheats use the same techniques as Mau and they have many of the same characteristics Joe “Juno” Aurelio · ▶ 6:48
they’re not so different after all. Um they use the same Windows APIs that uh malicious applications use uh cheats and malware. Joe “Juno” Aurelio · ▶ 9:32
they’re the just two different sides of the same coin Joe “Juno” Aurelio · ▶ 18:33
Key Takeaways
- Internal game cheats use process injection identical to malware.
- External cheats like Mimikatz read process memory via standard Windows APIs.
- Hardware DMA cheats are invisible to kernel anti-cheat and EDR.
- Cheat forums contain well-documented Windows API examples for red teamers.
- The cheating industry’s profit incentives outpace game developer defenses.
About the Speaker(s)
Joe Aurelio is a distinguished security researcher with over a decade of hands-on experience in vulnerability research, reverse engineering, and mobile security. He currently leads teams of researchers in the private sector securing large-scale technology platforms. His expertise spans both the private and defense sectors, with a track record of uncovering critical security vulnerabilities in mobile applications and complex infrastructure affecting millions of users. In addition to his work in traditional security domains, he channels his passion for cybersecurity education with a unique interest in exploring game hacking techniques. He is a lead of the Game Hacking Village, where he teaches security by turning game hacks into ethical and engaging educational tools. Joe has a broad background in security, underscored by the highly respected OSCP certification and a Master’s degree in computer science.