# Anti-Cheat Evasion & Stealth Tools

Your invisibility cloak for debugging. Without this, almost any game with even basic protection will see your debugger and shut down instantly. It hides your presence from the OS so you can work in peace.

Pro Tip: This only works for User Mode (Ring 3). If the game has a kernel-level anti-cheat like Vanguard or BattlEye, this won't be enough—you'll need to go deeper into the kernel.

A kernel driver for hiding debuggers in Ring 0. You'll need to disable PatchGuard and driver signing to use it, so it's strictly for a dedicated bench or VM, not your main PC.

The industry standard for hiding your imports. Instead of letting the Windows Loader do the work (and leave a paper trail for researchers), lazy_importer finds the functions in memory itself. It basically deletes your Import Address Table so static tools can't see what APIs you're using.

Pro Tip: Legendary library. Almost every serious cheat dev uses this or a custom version of it. It won't protect you from dynamic analysis (debuggers), but it makes static RE a lot more annoying.

An evolution of the famous 'Hell's Gate'. It uses hardware breakpoints and thread hijacking to resolve and execute syscalls without being spotted. It is designed to be invisible to monitoring tools that try to watch how your application talks to the Windows kernel.

Pro Tip: Requires administrative privileges because it manipulates threads. Use it for your internal high-privilege modules where stealth is everything.

A specialized tool for masking your internal function calls. It uses ROR13 hashing and hardware breakpoints to redirect execution flow. It basically 'lies' to anyone watching your threads about what code is actually running.

Pro Tip: It has high heuristic footprint, so advanced anti-cheats might flag the behavior if you don't use it carefully. Great for learning how to manipulate thread contexts.

The current meta for indirect syscalls. It uses a combination of hardware breakpoints and legitimate 'trampolines' found in kernel32.dll to hide your syscalls. To an anti-cheat, it looks like a perfectly normal Windows function call, even though you're bypassing their hooks.

Pro Tip: Since it uses hardware breakpoints, it is extremely stealthy but also risky. If another part of your code (or another cheat) tries to use those same registers, everything will crash.

The ultimate encyclopedia of anti-analysis. This project packs over 50 different ways to detect debuggers, virtual machines, and sandboxes. It is the gold standard for anyone trying to build an application that refuses to run if it is being watched.

Pro Tip: It is a massive collection. Don't just copy-paste everything, or your cheat will have a huge footprint. Pick the checks that make sense for your specific target.

A hyper-specialized tool for one thing: spotting virtual machines. It uses around 90 different techniques to identify over 70 types of VMs. It is header-only and works across platforms, making it one of the most flexible detection tools for keeping your software out of sandboxes.

Pro Tip: It uses a scoring system, which is way better than a simple yes/no. It tells you exactly how suspicious the environment looks so you can decide whether to shut down or just serve fake data.

A light, fast, and hook-resistant anti-debugging library for x64. It uses direct syscalls to perform over 30 checks, so it can't be easily neutralized by simple toolkits like ScyllaHide. If you want a solid 'debugger-go-away' script without much overhead, this is it.

Pro Tip: It is optimized for speed, so it won't tank your game's FPS while it's scanning in the background. Highly recommended for internal cheats.

The hunter becomes the hunted. This utility is designed specifically to find the presence of ScyllaHide (the tool usually used to hide debuggers). It looks for the subtle hooks and traces that ScyllaHide leaves behind, letting you know if someone is trying to sneak a debugger past your checks.

Pro Tip: Use this alongside your standard anti-debug checks. Knowing that someone is actively trying to hide their debugger from you is a huge red flag.

A standalone CLI version of the famous ScyllaHide injector. It's built for stealthy, debugger-independent injection and uses low-level hooking to hide the fact that a remote thread was even created.

Pro Tip: Perfect for automation or when you don't want a full debugger attached. It uses the same battle-tested logic as the ScyllaHide plugin but in a clean, standalone package.