Classify game-cheating threats across client memory, code injection, rendering, input, engines, kernels, DMA and remote transports. Use for repository-backed attack-surface maps, attacker prerequisites, state exposure, legitimate comparison baselines, and observable artifacts. Select engine source, capture or diagnostic resources that fit the evidence; separate source, transport, processing and server authority, and report benign counterexamples and limits without inferring a product or enforcement policy.