Runtime inspection. Tools for stepping through code and monitoring execution flow in real-time.
The tool you use when your code is crashing and you don't know why. It's the successor to OllyDbg and the standard for analyzing runtime behavior.
Pro Tip: Vanilla x64dbg is useless against basic anti-debug tricks. You MUST use it with ScyllaHide if you want to attach to anything modern.
The best way to test ideas without having to compile a single line of C++. It is like 'inspect element' for a running game. You write a little JavaScript, inject it, and see if your hook works instantly.
Pro Tip: It is perfect for seeing what a function does before you commit to writing a real internal cheat.
The only reliable way to debug kernel-level anti-cheats or drivers without instantly blue-screening. Essential for anyone going lower than Ring 3.
The ultimate 'safe space' for testing suspicious binaries. Instead of running a shady loader on your real PC and risking a disk wipe, you run it inside Qiling. It emulates the whole OS so you can see every system call without it touching your real files.
Pro Tip: Perfect for cold analysis. If you have a suspicious loader and don't want to risk your dev machine, emulate it in Qiling, hook every syscall with Python, and watch how it tries to unpack itself.
A graphics debugger that's perfect for 'ripping' 3D models or textures from a game. It's also how people figure out how to draw chams or ESP by seeing exactly how the game renders players.
Pro Tip: The king of chams research. Use Mesh Viewer to identify vertex buffer IDs and Texture Viewer to find character shaders you can later hook in your D3D or Vulkan internal project.
A 'ghost' debugger that uses hardware virtualization to hide from anti-cheats. Instead of attaching a regular debugger that everyone can see, HyperDbg sits under the OS and lets you poke around without the game even knowing you're there.
Pro Tip: Perfect for digging into anti-cheat internals or debugging code that usually crashes when it detects a normal debugger.