Beyond File Names: Finding Renamed Cheats With Content Rules, Windows Memory and Fingerprints

1. Motivation

Our false-positive audit (RN-2026-01) showed that name matching is both too loose (it hits legitimate software) and too easy to evade (a cheat called discord_update.exe matches nothing). We tightened name matching, and we needed evidence that does not depend on names at all. This note describes four such sources and how they work together.

2. Content rules

A cheat for a specific game must know that game. A CS2 or CS:GO cheat contains the names of the game's memory offsets and entity fields it reads, because cheats are built from public offset dumps that use those names. A CS 1.6 cheat contains the names of the engine and client functions it hooks, and the modules it hooks them in.

AACGUARD reads executable files (programs, libraries, drivers and .asi plugins) for these names in both ASCII and UTF-16. A file matches only if it contains several game-specific names together with the game itself; a single word is never enough. The strength of the finding depends on how complete the match is and whether typical cheat wording is present as well.

Safeguards:

• Where: running programs, files Windows recorded as run, and the user folders where cheats usually are (Downloads, Desktop, Documents, Temp, AppData). The Windows folder, Program Files and Steam's game folders are skipped.
• What: only unsigned files within a size range typical for cheats. Files signed by a trusted publisher are not judged.
• Budget: a scan reads at most 12,000 files and spends at most 60 seconds on this. On a typical PC it reads about 5,000 files in around 10 seconds.
• Privacy: only the path and the matched names are reported. File contents never leave the PC.
• No self-detection: the rule strings are stored reversed in AACGUARD's own binary, so the scanner never matches itself or leaves a matchable copy in memory.

3. Windows service memory

Some Windows components keep the paths of programs started since boot in their own memory: Explorer, and the services behind Program Compatibility Assistant, Diagnostic Policy, telemetry and SysMain. These paths survive deletion, renaming and removal of the USB stick a program ran from, until the PC restarts.

With administrator rights, AACGUARD reads the committed memory of those processes (up to a fixed limit per process), extracts executable paths in ASCII and UTF-16, and converts device paths such as \Device\HarddiskVolume3\… to normal drive letters, keeping paths on drives that are no longer connected. On our test PC Explorer alone yielded 349 paths in about one second.

Only paths that match cheat names are reported. Every path that still exists is passed to the content rules above, so a renamed cheat that ran today is read even if it sits in an unusual folder.

4. UserAssist

UserAssist is a registry record of programs started through the Windows shell (desktop, Start menu, taskbar), per user, with names encoded in ROT13 and, on current Windows versions, the last start time. AACGUARD reads it for every profile, including profiles that are not signed in (from a copy of their registry hive), and expands known-folder identifiers to normal paths. On our test PC: 199 programs, 101 with times, in 24 ms. Like service memory, its paths feed the content rules.

5. Fingerprints compatible with AmCache

When a cheat file is still present, the scan log records its SHA-256 and SHA-1 fingerprints. The SHA-1 is computed the way Windows' AmCache computes it, over the first 31,457,280 bytes (30 MiB) of the file. That matters: AmCache keeps this SHA-1 for programs that ran, even after they are deleted, so a fingerprint collected from one PC where the file still exists can recognise the same program on another PC where only the AmCache record is left, under any name.

The website collects fingerprints from scan logs into a database together with where they were seen. A person reviews each one before it can be used for detection; nothing is added automatically. The first 35 SHA-1 fingerprints came from AmCache records that appeared next to clear cheat findings in the October scan archive.

6. How the sources feed each other

The four sources are not independent lists. Service memory, UserAssist and the older execution records (Prefetch, BAM, AmCache, ShimCache, MUICache) produce path observations. The content rules read every observed file that still exists. A fingerprint links a present file to absent ones elsewhere. A renamed cheat therefore has to defeat several checks at once: its name, its content, the records of its execution and its fingerprint.

7. Keeping the scan fast

Adding sources made the scan slower, so 0.0.15 also reorganised it. Independent checks now run in five parallel lanes, grouped so that checks sharing a resource (such as a registry hive or a shadow copy) stay in the same lane. Checks that need the path observations of all lanes, including the content rules, run afterwards in sequence.

Parallel checks need care. The scan log is written under a lock so a finding and its date and fingerprint lines stay together; path observations are collected in a locked structure; and counters use atomic operations. Our first parallel build used a plain increment for the "checks run" counter and lost about a third of the counts (about 96,000 shown instead of about 155,000): every check was still done, but the number was wrong. It was fixed in 0.0.16.

A full scan without administrator rights on our test PC went from about 30 seconds to between 15 and 18 seconds.

8. Limitations

• Packed or encrypted programs hide their strings until they run. The in-game memory signatures and the connection check cover part of this gap.
• Service memory is volatile: a restart clears it, and reading it needs administrator rights, which the app requires.
• Signed cheats are not judged by content. Code-signing certificates are costly and traceable, which makes this rare, and signed files are still checked by name and fingerprint.
• Field results: these checks are new. We will publish how often each contributes to verdicts once enough scans from 0.0.15 and later have been uploaded.

For players, our guide Why renaming a cheat does not hide it explains the same checks without the technical detail.