The Swiss Army Knife. Essential helpers for data conversion, symbol recovery, and analysis.
The easiest way to find out which function a game uses to save your data or talk to the server. Instead of digging through a debugger, you just watch the log for live Win32 calls.
Pro Tip: It is a huge time-saver for finding where the 'real' logic is hiding. Look for calls like 'WriteFile' or 'send'.
Task Manager replacement (formerly Process Hacker). Useful for digging into processes, services, handles, and loaded modules during debugging and analysis. Optional driver support for deeper visibility. Note: it does not include the old Process Hacker 2 DLL injection feature.
Sysinternals monitor for file, registry, and process activity. Handy for answering practical questions like what files or registry keys an anti-cheat touches on launch.
Pro Tip: Use filters early or the log turns into noise fast.
The easiest way to decode the weird garbage you find in memory. If you find a string that looks like a scramble of Base64 or Hex, just paste it here and it will usually figure out what it is for you.
Pro Tip: The 'Magic' tool is great. If you have no clue what a string is, it'll try its best to guess for you.
The first thing you use when you find a cheat loader or a game written in Python. It pulls the guts out of a Windows .exe and gives you back the original Python bytecode files.
Pro Tip: It often leaves the files without 'magic bytes' in the header. You'll need to copy the header from the 'struct' file it generates before a decompiler will recognize them.
The best way to turn Python bytecode back into code you can actually read. It handles the newer versions of Python that older tools usually choke on.
Pro Tip: Mandatory if you're dealing with anything Ren'Py or Python-based. It's much more reliable than uncompyle6 on modern releases.
The 'Secret Weapon' for game updates. It is a diffing tool for IDA and Ghidra that compares an old version of a game to a new one. It shows you exactly which functions changed so you can update your offsets in minutes instead of days.
Pro Tip: This is how the big cheat providers update their products so fast after a 10GB game patch.
The time machine for game updates. When a new patch breaks your offsets and you aren't ready to update your code yet, use this to download the old version of the game and keep working.
Pro Tip: You need the 'Manifest ID' from SteamDB to tell it exactly which historical version you want to grab.
Mandatory if you're looking at a game loader or tool written in Go. Go binaries are a nightmare to reverse because they strip everything, but this tool recovers the function names and types so it actually makes sense in IDA or Ghidra.
Pro Tip: If you open an executable and see thousands of functions named 'sub_XXXX' and strings that look like one giant blob, it's probably Go. Run this first.
The 'Skeleton Key' for installers. If you've got a suspicious cheat or game installer and you want to see what files it's actually dropping without actually running the damn thing, use this to pull the guts out.