awesome-game-security

Analyze layered game integrity defenses and select repository resources for process-memory reports, acquired-memory forensics, callback scope, behavioral measurement and driver-policy evidence. Use for DMA versus host-mediated acquisition, input provenance, replay fidelity, collector health, detector rollout/recovery, device/account restrictions, network association and false-positive review. Map prerequisites and observation points, distinguish detection from enforcement, and produce versioned findings with corroboration and limits.

Find, select and maintain resources in awesome-game-security using its actual README taxonomy, skill catalog, compiled wiki, generated descriptions and source archives. Use for repository-specific discovery, category placement, duplicate or identity review, missing/case-mismatched local paths, and choosing the right domain skill. Return a focused selection with provenance and limitations; route technical conclusions to the matching domain rather than treating collection membership as proof.

Classify hardware DMA threats, host-driver memory acquisition and network or USB transport in game-security research. Use for PCIe/FPGA, IOMMU/VT-d, Thunderbolt/USB4, LeechCore, WinPmem, bridge-cable claims, device identity and acquisition forensics; select repository resources for architecture, remapping concepts and existing images. Identify the memory initiator and required access, then map observable artifacts, mitigation scope, benign uses and unresolved architecture claims.

Analyze Unreal, Unity, Source, Godot, and custom engine trust boundaries and select matching repository resources. Use for engine/build identification, full source versus C# reference subsets, version-matched demos, editor versus shipped plugins, reflection and object lifecycles, Mono/IL2CPP, asset schemas, and replication ownership. Produce a versioned artifact and boundary map; route transport authority, release trust, and graphics measurements to their dedicated skills.

Classify game-cheating threats across client memory, code injection, rendering, input, engines, kernels, DMA and remote transports. Use for repository-backed attack-surface maps, attacker prerequisites, state exposure, legitimate comparison baselines, and observable artifacts. Select engine source, capture or diagnostic resources that fit the evidence; separate source, transport, processing and server authority, and report benign counterexamples and limits without inferring a product or enforcement policy.

Verify game-security claims through primary-source checks, explicit trust boundaries, claim ledgers, reproducible evidence, and calibrated uncertainty. Use for attack/defense comparisons, community reports, enforcement-scope claims, telemetry quality, detector evaluation, owned-game-build diagnostics and sanitizer limits, untrusted instructions in retrieved sources, conflicting citations, or disagreement across README/wiki/description/archive layers. Separate observation, finding, attribution, and action; assess confounders, base rates, false positives, temporal validity, and source limitations before drawing consequential conclusions.

Review multiplayer authority and backend trust across RPCs, sessions, object authorization, inventory, economy, and purchases. Use when choosing or assessing KCP, GameNetworkingSockets, Steam networking interfaces, server frameworks, or token-validation resources; distinguish delivery reliability, transport identity, game permission, and durable state. Cover retries, provider contracts, clock domains, replication order, prediction, and replay, producing operation maps and evidence-based invariants.

Assess game build, launcher, update, distribution, and mod/plugin trust. Use to connect repository CI resources, editor acquisition, hot-patch runtimes, asset specifications, and parsers to release credentials, isolation, provenance, SBOMs, update freshness, ingestion boundaries, and recovery. Distinguish a build tool or script bridge from release authorization, and format acceptance from safe loading; report exact artifact, dependency version, channel, publisher, and verification policy.

Analyze Direct3D/DXGI, OpenGL, and Vulkan rendering, presentation, composition, and capture evidence. Use to distinguish API samples, PresentMon event metrics, Tracy instrumentation, compatibility translation, frame images, and validation diagnostics; review swap chains, overlays, resource lifetime, and synchronization. Select repository tools by the observation required and report API/backend, driver, compositor, tool version, measurement coverage, and benign alternatives.

Analyze native Linux, SteamOS, Steam Deck and Proton game-security boundaries. Use for compatibility-versus-policy triage, ELF/process evidence, credentials and capabilities, namespaces, seccomp, LSMs and Linux memory forensics; select repository resources across Wine, kernel, WSL and forensic categories. Record the actual kernel, distribution, runtime and active policy; distinguish platform mismatch, observation gaps and suspicious behavior with explicit privilege prerequisites and benign comparisons.

Assess Android and iOS game-security trust boundaries and select repository resources for APK/AAB/IPA inspection, DEX/native or IL2CPP analysis, device-kernel provenance, authorized network observations and signing review. Use for controlled instrumentation, root/jailbreak or emulator evidence, SELinux, Play Integrity and App Attest. Separate package, runtime, platform integrity and server authorization; record device/build/ABI, signer, entitlements, required privilege and collection limits before drawing conclusions.

Investigate supplied game binaries, protection components, drivers, dumps, and traces through reproducible binary analysis. Use for repository resource selection, PE/symbol inspection, disassembly and decompilation, control/data-flow reconstruction, build comparison, obfuscation classification, and interface evidence with IDA, Ghidra or debuggers. Match tool scope to the artifact and produce versioned findings with addresses, provenance, uncertainty and defensive implications.

Analyze Windows driver trust boundaries and kernel evidence for game-security research. Use for IOCTL authorization, callbacks and IRQL, driver provenance, DSE/PatchGuard, VBS/HVCI, build-specific internals, and crash or memory forensics; select repository resources for symbol comparison, ETW metadata, driver-unit coverage and offline dumps. Distinguish documented contracts, observed host state and inferred internals; report privilege prerequisites, mitigation scope, missing coverage and benign alternatives.