Enhance SKILL documentation with new sections on anti-cheat techniques, game engine workflows, and mobile security strategies. Added detailed descriptions for code protection, telemetry, and advanced hacking methods across various platforms, including Android and Windows. Updated existing skills to improve clarity and organization.

.claude/skills/anti-cheat/SKILL.md

@@ -13,9 +13,37 @@ This skill covers layered anti-cheat design across kernel drivers, privileged se
 
 - `Anti Cheat > Guide`
 - `Anti Cheat > Stress Testing`
+- `Anti Cheat > Driver Unit Test Framework`
 - `Anti Cheat > Anti Debugging`
+- `Anti Cheat > Page Protection`
+- `Anti Cheat > Binary Packer`
+- `Anti Cheat > CLR Protection`
+- `Anti Cheat > Anti Disassembly`
+- `Anti Cheat > Sample Unpacker`
+- `Anti Cheat > Dump Fix`
+- `Anti Cheat > Encrypt Variable`
+- `Anti Cheat > Lazy Importer`
+- `Anti Cheat > Anti-Cheat Programming`
+- `Anti Cheat > Compile Time`
+- `Anti Cheat > Shellcode Engine & Tricks`
+- `Anti Cheat > Obfuscation Engine`
+- `Anti Cheat > Screenshot`
+- `Anti Cheat > Game Engine Protection:*`
 - `Anti Cheat > Open Source Anti Cheat System`
+- `Anti Cheat > Analysis Framework`
 - `Anti Cheat > Detection:*`
+- `Anti Cheat > Signature Scanning`
+- `Anti Cheat > Information System & Forensics`
+- `Anti Cheat > Dynamic Script`
+- `Anti Cheat > Kernel Mode Winsock`
+- `Anti Cheat > Fuzzer`
+- `Anti Cheat > Windows Ring3 Callback`
+- `Anti Cheat > Windows Ring0 Callback`
+- `Anti Cheat > Winows User Dump Analysis`
+- `Anti Cheat > Winows Kernel Dump Analysis`
+- `Anti Cheat > Sign Tools`
+- `Anti Cheat > Backup File / Backup Drivers`
+- `Anti Cheat > Black Signature`
 - `Windows Security Features`
 
 ## Major Anti-Cheat Systems
@@ -215,6 +243,69 @@ Limitations:
 - DMA attacks bypass hypervisor memory protections (separate threat)
 ```
 
+## Code Protection Techniques
+
+### Page Protection
+```
+- Executable page guard pages and trap-based integrity monitoring
+- NX bit enforcement and DEP policy
+- PAGE_GUARD + single-step trap for code coverage without patching
+- VirtualProtect monitoring to detect runtime permission changes
+```
+
+### Binary Packing & Encryption
+```
+- PE packers: UPX, Themida, VMProtect, Enigma, MPRESS
+- CLR protection: .NET obfuscation (ConfuserEx, Dotfuscator, .NET Reactor)
+- Encrypt Variable: runtime value encryption to frustrate memory scanners
+- Lazy Importer: compile-time import hiding to avoid IAT-based detection
+- Compile-time techniques: string encryption, constexpr obfuscation, COFF obfuscation
+```
+
+### Shellcode & Obfuscation
+```
+- Shellcode engines: position-independent code generation, syscall stubs
+- Obfuscation engines: OLLVM-based, custom LLVM passes, MBA (Mixed Boolean-Arithmetic)
+- Anti-disassembly: opaque predicates, junk code insertion, control flow flattening
+```
+
+## Heartbeat & Screenshot
+
+### Heartbeat Mechanisms
+```
+- Periodic client-to-server health check packets
+- Encrypted challenge-response with server nonce
+- Timing-based integrity: detect suspended or debugged processes
+- Failure modes: silent disconnect, delayed ban, immediate kick
+```
+
+### Screenshot Capture
+```
+- AC-initiated screen capture for manual or automated review
+- BitBlt / PrintWindow / DXGI desktop duplication
+- Anti-screenshot evasion: overlay hiding, DWM composition bypass
+- Server-side ML classifiers for ESP/overlay detection in captured frames
+```
+
+## Telemetry Pipeline
+
+### Client-Side Collection
+```
+- Module list enumeration and hash reporting
+- Handle table snapshots for suspicious access patterns
+- Stack trace sampling at periodic intervals
+- Driver load events and callback registration state
+- Hardware fingerprint (disk serial, NIC MAC, SMBIOS, GPU)
+```
+
+### Transport & Server-Side
+```
+- Encrypted telemetry channel (TLS + custom encryption layer)
+- Server-side aggregation and anomaly scoring
+- ML-based behavioral clustering for ban waves
+- Replay system integration for suspicious session review
+```
+
 ## Ethical Considerations
 
 ### Research Guidelines

.claude/skills/dma-attack/SKILL.md

@@ -114,6 +114,30 @@ pcileech write -a 0x12345000 -v 0x41414141
 - Capability structure emulation
 ```
 
+### Firmware Mimicry Details
+```
+Intel I210 NIC Emulation (most common target):
+- Full PCI configuration space replication:
+  - Vendor ID: 0x8086, Device ID: 0x1533 (I210-AT)
+  - Subsystem Vendor/Device matching real OEM boards
+  - Capability list: PCIe cap, MSI-X cap, Power Management
+- BAR layout: 128KB MMIO BAR0, optional I/O BAR2
+- PHY register emulation: basic link status response
+- No actual network traffic needed (NIC appears "cable unplugged")
+
+Intel I226 NIC Emulation (newer boards):
+- Device ID: 0x125C (I226-V)
+- Updated capability structures (PCIe Gen3 vs Gen2)
+- Requires correct ASPM (Active State Power Management) config
+
+Detection vectors anti-cheat can inspect:
+- Device does not respond to real NIC operational commands
+- Missing DMA ring buffer activity (no Tx/Rx descriptors)
+- Power state never transitions (always D0)
+- PCIe link training characteristics differ from real silicon
+- Compare config space values against known-good database
+```
+
 ## Device Emulation
 
 ### Common Emulation Targets
@@ -225,6 +249,66 @@ PHYSICAL_ADDRESS TranslateVA(UINT64 cr3, UINT64 virtualAddr) {
 - Platform attestation and boot-state validation
 ```
 
+## Thunderbolt / USB4 DMA
+
+### Attack Surface
+```
+- Thunderbolt 1-4 / USB4 provide direct PCIe tunneling
+- Hot-plug capable: device can be attached at runtime
+- Pre-boot DMA: device has memory access before OS loads
+- Thunderbolt Security Levels:
+  - SL0 (None): no security, legacy mode
+  - SL1 (User Auth): user must approve new devices
+  - SL2 (Secure Connect): device must match a previously approved UUID
+  - SL3 (No PCIe tunneling): completely disables DMA
+```
+
+### Thunderbolt-Specific Attacks
+```
+- Thunderclap: malicious Thunderbolt peripherals bypass IOMMU
+- Device re-identification: change device UUID to bypass SL2
+- OS-level Thunderbolt driver vulnerabilities
+- PCIe tunneling through USB4 hubs
+```
+
+### Defensive Measures
+```
+- Kernel DMA Protection (Windows 10 1803+): automatic IOMMU for hot-plug
+- Thunderbolt firmware verification
+- Platform-level: BIOS setting to disable Thunderbolt PCIe tunneling
+- macOS: T2 chip enforces DMA restrictions on Thunderbolt ports
+```
+
+## Shadow CR3 / Split TLB
+
+### Page Table Manipulation
+```
+- Maintain two sets of page tables (two CR3 values):
+  - "Clean" CR3: points to legitimate page tables visible to anti-cheat
+  - "Shadow" CR3: modified page tables with cheat-accessible mappings
+- Swap CR3 before/after anti-cheat inspection windows
+- Combine with EPT manipulation for hypervisor-level split
+```
+
+### Split TLB Techniques
+```
+- Desync instruction TLB (iTLB) and data TLB (dTLB):
+  - Execute code from one physical page
+  - Read data from another physical page at same virtual address
+- Requires precise TLB invalidation control
+- Hypervisor can create EPT-based split: execute permission on page A,
+  read permission on page B, at same GPA
+- Anti-cheat mitigation: TLB flush + re-walk, serializing instructions
+```
+
+### Detection Challenges
+```
+- Legitimate CR3 value may pass all validation checks
+- Shadow mappings only active during cheat execution windows
+- Requires hypervisor or hardware-level inspection to detect
+- Timing anomalies from frequent CR3 switches may be measurable
+```
+
 ## Advanced Techniques
 
 ### Wireless DMA

.claude/skills/game-engine/SKILL.md

@@ -13,14 +13,19 @@ This skill covers game engine development resources from the awesome-game-securi
 
 - `Game Engine > Guide`
 - `Game Engine > Source`
-- `Game Engine Plugins:*`
+- `Game Engine Plugins:Unreal`
+- `Game Engine Plugins:Unity`
+- `Game Engine Plugins:Godot`
+- `Game Engine Plugins:Lumix`
 - `Game Engine Detector`
+- `Cheat > SDK CodeGen`
 - `Cheat > Game Engine Explorer:Unreal`
 - `Cheat > Game Engine Explorer:Unity`
 - `Cheat > Game Engine Explorer:Source`
 - `Anti Cheat > Game Engine Protection:Unreal`
 - `Anti Cheat > Game Engine Protection:Unity`
 - `Anti Cheat > Game Engine Protection:Source`
+- `Game Develop > MCP server`
 
 ## Major Engine Categories
 
@@ -99,6 +104,97 @@ When researching engines for security analysis or development:
 4. **Graphics API**: DirectX, OpenGL, Vulkan, Metal
 5. **Community**: Documentation and support quality
 
+## SDK Generation Workflows
+
+### Unreal Engine (Dumper-7)
+```
+1. Identify UE version from binary signatures
+2. Inject Dumper-7 into running game process
+3. SDK output: C++ headers with UObject hierarchy
+4. Key structures: UObject, FName, UClass, UFunction, UProperty
+5. Generated SDK enables: property access, function calls, blueprint hooks
+6. Alternative tools: UnrealDumper, UE4SS (live scripting + SDK dump)
+```
+
+### Unity (IL2CPPDumper)
+```
+1. Locate global-metadata.dat + GameAssembly.dll (or libil2cpp.so)
+2. Run IL2CPPDumper → outputs: dump.cs, il2cpp.h, script.json
+3. Load generated headers into IDA/Ghidra for symbol recovery
+4. Key structures: Il2CppClass, MethodInfo, FieldInfo, Il2CppType
+5. For Mono builds: directly decompile Assembly-CSharp.dll with dnSpy
+```
+
+### Source Engine (NetVar Parsing)
+```
+1. Walk ClientClass linked list from CHLClient
+2. For each class, enumerate RecvTable → RecvProp entries
+3. Build offset map: class name → property name → offset
+4. Example: CCSPlayer → m_iHealth → 0x100
+5. Tools: hazedumper, source2gen (Source 2)
+```
+
+## Engine Object Models
+
+### Unreal Engine
+```
+Core hierarchy:
+  UObject → UField → UStruct → UClass
+  UObject → AActor → APawn → ACharacter → APlayerCharacter
+
+Key globals:
+  GObjects (TUObjectArray): all live UObject instances
+  GNames (TNameEntryArray): FName string pool
+  GWorld (UWorld*): current world context
+  GEngine (UEngine*): engine singleton
+
+Memory layout:
+  UObject header: VTable, ObjectFlags, InternalIndex, ClassPrivate, NamePrivate, OuterPrivate
+  Properties follow at offsets defined in UClass::PropertySize
+```
+
+### Unity (IL2CPP)
+```
+Core structures:
+  Il2CppDomain → Il2CppAssembly → Il2CppImage → Il2CppClass
+  Il2CppClass: fields, methods, vtable, static_fields pointer
+
+Key patterns:
+  il2cpp_domain_get() → domain singleton
+  il2cpp_class_from_name() → class lookup by namespace + name
+  il2cpp_runtime_invoke() → call managed methods from native
+
+Metadata:
+  global-metadata.dat contains string pool, type definitions, method signatures
+  Encrypted metadata in some protected games (requires custom decryptor)
+```
+
+### Source Engine
+```
+Core systems:
+  Entity list: IClientEntityList → GetClientEntity(index)
+  ConVar system: ICvar → FindVar("sv_cheats")
+  NetVars: RecvTable hierarchy for network-replicated properties
+
+Key interfaces (accessed via CreateInterface export):
+  IVEngineClient, IClientEntityList, IEngineTrace
+  ISurface, IPanel (for overlay rendering in Source)
+```
+
+## MCP Servers for Game Development
+
+```
+The README's > MCP server subcategory includes servers relevant
+to game engine workflows:
+
+- Unreal Engine MCP: AI agent controls UE editor (spawn actors, modify properties, blueprints)
+- Unity MCP: AI agent interacts with Unity editor and C# scripting
+- Godot MCP: AI agent controls Godot editor and GDScript
+
+These complement the RE-focused MCP tools (see reverse-engineering skill)
+by enabling AI-assisted game development and rapid prototyping.
+```
+
 ## Security Research Focus
 
 For game security research, understanding engine internals helps with:

.claude/skills/game-hacking/SKILL.md

@@ -13,18 +13,47 @@ This skill covers game-hacking techniques documented in the awesome-game-securit
 
 - `Cheat > Debugging`
 - `Cheat > Packet Sniffer&Filter`
+- `Cheat > Packet Capture&Parse`
 - `Cheat > SpeedHack`
-- `Cheat > Injection:*`
+- `Cheat > Injection:Windows`
+- `Cheat > Injection:Linux`
+- `Cheat > Injection:Android`
+- `Cheat > Injection:IOS`
+- `Cheat > Injection:PlayStation`
+- `Cheat > DLL Hijack`
 - `Cheat > Hook`
+- `Cheat > Anti Signature Scanning`
 - `Cheat > RPM`
 - `Cheat > DMA`
 - `Cheat > W2S`
 - `Cheat > Overlay`
+- `Cheat > Render/Draw`
+- `Cheat > UI Interface`
+- `Cheat > Vulnerable Driver`
 - `Cheat > Driver Communication`
+- `Cheat > EFI Driver`
+- `Cheat > QEMU/KVM/PVE/VBOX`
+- `Cheat > Wine`
+- `Cheat > Anti Screenshot`
+- `Cheat > Spoof Stack`
+- `Cheat > Hide`
+- `Cheat > Anti Forensics`
+- `Cheat > Triggerbot & Aimbot`
+- `Cheat > WallHack`
 - `Cheat > HWID`
+- `Cheat > Bypass Page Protection`
+- `Cheat > SDK CodeGen`
 - `Cheat > Game Engine Explorer:*`
+- `Cheat > Explore UWP`
 - `Cheat > Explore AntiCheat System:*`
 - `Cheat > Game:*`
+- `Cheat > Launcher Abuser`
+- `Cheat > Linux Kernel Explorer`
+- `Cheat > Cheat Engine Plugins`
+- `Some Tricks > Windows Ring0`
+- `Some Tricks > Windows Ring3`
+- `Some Tricks > Linux`
+- `Some Tricks > Android`
 
 ## Escalation Model
 
@@ -145,21 +174,115 @@ This skill covers game-hacking techniques documented in the awesome-game-securit
 - Hardware-based (FPGA)
 ```
 
+## EFI/UEFI Cheats
+
+### Boot-Time Loading
+```
+- EFI manual map: load unsigned driver payload during UEFI boot phase
+- ExitBootServices hook: intercept Windows boot to inject kernel code
+- Runtime DXE drivers: persist across OS boot via EFI runtime services
+- GetVariable/SetVariable: communicate between EFI and OS runtime
+```
+
+### EFI-Based Memory Access
+```
+- Map physical memory via EFI runtime services
+- Bypass DSE entirely (code runs before Windows kernel loads)
+- Survive Secure Boot if firmware is compromised or test-signed
+- Combine with DMA for maximum stealth
+```
+
+### Detection Challenges
+```
+- No driver load event (PsSetLoadImageNotifyRoutine never fires)
+- Not visible in MmUnloadedDrivers or PiDDBCacheTable
+- Secure Boot + TPM attestation is primary defense
+- Firmware integrity measurement (UEFI capsule verification)
+```
+
+## HWID Spoofing
+
+### Targets
+```
+- Disk serial: IOCTL_STORAGE_QUERY_PROPERTY, SMART data
+- NIC MAC address: NDIS OID_802_3_PERMANENT_ADDRESS
+- SMBIOS: motherboard serial, system UUID, BIOS vendor
+- GPU serial: registry-based or NVAPI/ADL queries
+- Monitor EDID: display serial number
+- Volume serial: NtQueryVolumeInformationFile
+- TPM EK: Endorsement Key fingerprint
+```
+
+### Techniques
+```
+- Disk filter driver: intercept IOCTL and replace serial in response
+- Registry value spoofing: modify cached hardware IDs
+- SMBIOS table patching: modify raw SMBIOS memory region
+- NIC driver hook: replace MAC in NDIS miniport response
+- Full HWID spoofer: coordinated spoofing across all identifiers
+```
+
+## Stack Spoofing
+
+### Return Address Spoofing
+```
+- Replace return address on stack before API call
+- Restore original after call returns
+- Evades stack-walk-based detection (RtlWalkFrameChain)
+- Techniques: JMP RBX gadget, synthetic frames, fiber-based
+```
+
+### Call Stack Reconstruction
+```
+- Build fake but plausible call stack frames
+- Match expected module return addresses (ntdll, kernel32)
+- Evade NtQueryInformationThread stack inspection
+- Tools: SpoofCallStack, Vulcan, CallStackSpoofer
+```
+
+### Detection & Evasion
+```
+- Anti-cheat walks thread stacks looking for non-module returns
+- Stack unwinding via .pdata / UNWIND_INFO validation
+- Spoofed stacks must pass RtlVirtualUnwind consistency checks
+```
+
 ## Driver Communication
 
-### Methods
-- IOCTL-based
-- Shared memory
-- Registry callbacks
-- Syscall hooks
-- Data pointer swaps
+### Full Taxonomy (40+ methods in README)
+```
+IOCTL-based:
+- Standard DeviceIoControl with custom control codes
+- Buffered I/O, Direct I/O, METHOD_NEITHER
 
-### Common Patterns
-```cpp
-// Data pointer swap example
-NtUserGetObjectInformation
-NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
-Win32k syscall hooks
+Data pointer swaps (abusing legitimate syscalls):
+- NtUserGetObjectInformation
+- NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
+- NtUserRegisterRawInputDevices
+- NtGdiGetCOPPCompatibleOPMInformation
+- NtDxgkGetTrackedWorkloadStatistics
+- NtUserGetPointerInfoList
+- NtUserSetInformationThread
+- NtDCompositionSetChildRootVisual
+- Win32k syscall hooks
+
+Shared memory:
+- Named shared sections (ZwCreateSection + ZwMapViewOfSection)
+- Physical memory mapping
+- Shared event objects for signaling
+
+Callback-based:
+- Registry callbacks (CmRegisterCallbackEx)
+- Minifilter communication ports (FltCreateCommunicationPort)
+- Object callbacks with embedded data
+
+Unconventional channels:
+- Named pipes from kernel
+- Window messages (NtUserPostMessage)
+- ETW provider channels
+- Socket from kernel (Winsock Kernel / WSK)
+- File system filter callbacks
+- Debugging APIs (DbgPrint interception)
 ```
 
 ## World-to-Screen Calculation

.claude/skills/graphics-api/SKILL.md

@@ -13,12 +13,21 @@ This skill covers graphics API resources from the awesome-game-security collecti
 
 - `DirectX > Guide`
 - `DirectX > Hook`
+- `DirectX > Tools`
+- `DirectX > Emulation`
+- `DirectX > Compatibility`
 - `DirectX > Overlay`
+- `OpenGL > Guide`
+- `OpenGL > Source`
 - `OpenGL > Hook`
+- `Vulkan > Guide`
 - `Vulkan > API`
 - `Vulkan > Hook`
 - `Cheat > Overlay`
+- `Cheat > Render/Draw`
+- `Cheat > Anti Screenshot`
 - `Anti Cheat > Screenshot`
+- `Anti Cheat > Detection:Overlay`
 
 ## DirectX
 
@@ -246,6 +255,42 @@ D3DXVECTOR3 WorldToScreen(D3DXVECTOR3 pos, D3DXMATRIX viewProjection) {
 - Shader debugging
 - Frame profiling
 
+## Anti-Screenshot Techniques
+
+### How Anti-Cheat Captures Screenshots
+```
+- BitBlt from game window DC: captures visible content including overlays
+- DXGI Desktop Duplication API: captures composited desktop output
+- IDXGISwapChain::Present interception: grab backbuffer before present
+- PrintWindow: capture specific window contents
+- DirectX/Vulkan frame readback: copy render target to CPU-readable buffer
+- Scheduled captures: random intervals to catch intermittent overlays
+```
+
+### Overlay Evasion Against Screenshot
+```
+- Disable overlay rendering during screenshot frame:
+  - Detect screenshot by hooking BitBlt/PrintWindow in AC module
+  - Suppress ImGui rendering for captured frame
+- DWM composition tricks:
+  - Render to a separate window that DWM excludes from capture
+  - Use WDA_EXCLUDEFROMCAPTURE (SetWindowDisplayAffinity) on overlay window
+- Hardware overlay planes:
+  - Use IDXGIOutput::FindClosestMatchingMode + hardware overlay
+  - Content on hardware overlay plane may not appear in software capture
+- External rendering:
+  - Render on secondary display or capture card output
+  - OBS virtual camera trick: render to virtual camera feed
+```
+
+### Cheat-Side Anti-Screenshot (README > Anti Screenshot)
+```
+- Projects that detect and evade AC screenshot capture
+- Techniques: hook Present to suppress overlay on screenshot frames
+- DWM-based overlays that survive PrintWindow but not BitBlt
+- Kernel-level: suppress screenshot by blocking DC access
+```
+
 ## Anti-Detection Considerations
 
 ### Present Hook Detection

.claude/skills/mobile-security/SKILL.md

@@ -16,15 +16,32 @@ This skill covers mobile security resources from the awesome-game-security colle
 - `Cheat > Frida`
 - `Cheat > Hook ART(android)`
 - `Cheat > Hook syscall(android)`
+- `Cheat > Android Terminal Emulator`
 - `Cheat > Android File Explorer`
 - `Cheat > Android Memory Explorer`
+- `Cheat > Android Application CVE`
+- `Cheat > Android Kernel CVE`
+- `Cheat > Android Bootloader Bypass`
+- `Cheat > IoT / Smart devices`
+- `Cheat > Android ROM`
+- `Cheat > Android Device Trees`
+- `Cheat > Android Kernel Source`
+- `Cheat > Android Root`
 - `Cheat > Android Kernel driver development`
 - `Cheat > Android Kernel Explorer`
 - `Cheat > Android Kernel Driver`
+- `Cheat > Android Network Explorer`
+- `Cheat > Android memory loading`
 - `Cheat > IOS jailbreak`
+- `Cheat > IOS Memory Explorer`
+- `Cheat > IOS File Explorer`
+- `Cheat > IOS App Packaging`
+- `Cheat > Injection:Android`
+- `Cheat > Injection:IOS`
 - `Anti Cheat > Detection:Android root`
 - `Anti Cheat > Detection:Magisk`
 - `Anti Cheat > Detection:Frida`
+- `Some Tricks > Android`
 - `Android Emulator`
 - `IOS Emulator`
 
@@ -105,6 +122,34 @@ Interceptor.attach(Module.findExportByName("libgame.so", "function_name"), {
 - **xHook**: PLT hook library
 - **Dobby**: Multi-platform hook framework
 
+### Modern Root Solutions
+
+#### KernelSU
+```
+- Kernel-based root solution, works at kernel level (no /system modification)
+- Module system compatible with Magisk modules via KSU module API
+- Stealth advantage: no su binary on filesystem, harder to detect
+- Requires custom kernel or GKI (Generic Kernel Image) patching
+- APatch: newer alternative, patches boot.img with KernelPatch
+```
+
+#### APatch
+```
+- Patches Android kernel at boot via KernelPatch
+- No need for custom kernel source (works on stock GKI kernels)
+- Module support similar to Magisk/KernelSU
+- Root process runs within kernel context
+```
+
+#### Root Solution Comparison
+```
+| Solution  | Level       | Stealth | GKI Support | Module System |
+|-----------|-------------|---------|-------------|---------------|
+| Magisk    | User/Init   | Medium  | Yes         | Mature        |
+| KernelSU  | Kernel      | High    | Yes         | Growing       |
+| APatch    | Kernel      | High    | Yes         | Growing       |
+```
+
 ### Root Detection Bypass
 
 #### Common Checks
@@ -118,10 +163,11 @@ Interceptor.attach(Module.findExportByName("libgame.so", "function_name"), {
 ```
 
 #### Bypass Methods
-- **Magisk Hide**: Built-in root hiding
+- **Magisk DenyList / Shamiko**: Modern root hiding (replaces MagiskHide)
 - **LSPosed/EdXposed**: Xposed framework hooks
 - **Frida scripts**: Hook detection functions
 - **APK patching**: Remove detection code
+- **KernelSU SU isolation**: Process-level root visibility control
 
 ### Zygisk Modules
 
@@ -284,6 +330,80 @@ Java.perform(function() {
 5. Clean environment emulation
 ```
 
+## eBPF-Based Tools
+
+### Tracing & Hooking
+```
+- stackplz: eBPF-based stack trace tool for Android
+- eDBG: eBPF-powered debugger for Android processes
+- tracee: Aqua Security's eBPF runtime security tool (Linux/Android)
+- eBPF hooking: attach to tracepoints, kprobes, uprobes without kernel module
+```
+
+### Advantages Over Traditional Approaches
+```
+- No kernel module compilation required (runs in eBPF VM)
+- Works on stock GKI kernels with BTF support
+- Lower detection surface than kernel driver injection
+- CO-RE (Compile Once, Run Everywhere) portability
+- Safe: eBPF verifier prevents kernel crashes
+```
+
+## Android Kernel Driver Development
+
+### Development Patterns
+```
+- Loadable kernel module (LKM) for older kernels
+- GKI-compatible modules via vendor_dlkm partition
+- Kernel build scripts: build from AOSP source or vendor BSP
+- Device Trees: hardware description for board-specific drivers
+```
+
+### Common Use Cases in Game Security
+```
+- Process memory access: /dev/custom_mem → read/write target process
+- Syscall hooking: __NR_read, __NR_write interception
+- Binder hooking: intercept IPC transactions
+- GPU memory inspection: access GPU buffers directly
+```
+
+### Android Kernel Source
+```
+- AOSP Common Kernel (ACK): google/common branch
+- GKI: Generic Kernel Image for Android 12+
+- Vendor-specific: Qualcomm (CodeAurora), MediaTek, Samsung Exynos
+- Build system: build/build.sh or Bazel-based (newer)
+```
+
+## HarmonyOS / OpenHarmony
+
+```
+- HarmonyOS (Huawei): abc file format for compiled apps
+- arkdecompiler: decompile HarmonyOS abc bytecode
+- OpenHarmony: open-source base, growing ecosystem
+- Security model differs from Android: distributed capabilities
+- Reverse engineering challenges: new bytecode VM, different IPC
+```
+
+## Android CVE Research
+
+### Application-Level CVEs
+```
+- WebView RCE (CVE-based exploit chains)
+- Intent redirection / deep link abuse
+- Content provider data leaks
+- Serialization vulnerabilities (Parcel, Bundle)
+```
+
+### Kernel-Level CVEs
+```
+- Use-after-free in Binder driver
+- Privilege escalation via ion/DMA-BUF
+- GPU driver vulnerabilities (Adreno, Mali, PowerVR)
+- SELinux policy bypass chains
+- Reference: Android Security Bulletins (monthly)
+```
+
 ## Emulator Considerations
 
 ### Android Emulators

.claude/skills/overview/SKILL.md

@@ -16,6 +16,10 @@ This is a curated collection of resources related to game security, covering bot
 - Defensive research: `Anti Cheat`
 - Platform hardening: `Windows Security Features`
 - Platform-specific ecosystems: `Android Emulator`, `IOS Emulator`, `Windows Emulator`, `Linux Emulator`
+- Supporting infrastructure: `Mathematics`, `3D Graphics`, `AI`, `Image Codec`, `Wavefront Obj`, `Task Scheduler`, `Game Network`, `PhysX SDK`, `Game Develop`, `Game Assets`, `Game Hot Patch`, `Game Testing`, `Game Tools`, `Game Manager`, `Game CI`
+- Platform subsystems: `WSL`, `WSA`
+- Console emulation: `Game Boy`, `Nintendo Switch`, `Xbox`, `PlayStation`
+- Tips and tricks: `Some Tricks`
 
 ## Project Structure
 
@@ -44,7 +48,8 @@ Each category follows this format:
 
 ### Link Format
 
-- Always use full GitHub URLs
+- Always use full GitHub URLs for repositories
+- Non-GitHub links are also supported (blog posts, articles, documentation sites)
 - Add brief descriptions in square brackets `[description]`
 - Use consistent spacing and formatting
 - Group related resources under subcategories with `>`
@@ -60,16 +65,48 @@ Each category follows this format:
 - https://github.com/example/engine [Open source game engine]
 ```
 
+## Skill Routing Guide
+
+When an AI agent receives a query, use this table to select the best skill:
+
+| Query topic | Primary skill | Related skills |
+|---|---|---|
+| EAC, BattlEye, Vanguard, detection, heartbeat, screenshot | anti-cheat | windows-kernel |
+| pcileech, FPGA, DMA, IOMMU, Thunderbolt | dma-attack | anti-cheat |
+| Unreal SDK, Unity IL2CPP, engine structs, Godot, Lumix | game-engine | game-hacking |
+| Memory hacking, injection, overlays, driver comm, HWID spoof | game-hacking | graphics-api |
+| D3D/Vulkan/OpenGL hooks, Present hook, shader interception | graphics-api | game-hacking |
+| Android root, Frida, iOS jailbreak, KernelSU, APatch | mobile-security | game-hacking |
+| IDA, Ghidra, DBI, deobfuscation, binary diffing, MCP RE tools, trap-and-emulate CFT, WHP tracing | reverse-engineering | anti-cheat, windows-kernel |
+| Drivers, callbacks, PatchGuard, HVCI, ETW, pool forensics, WHP API | windows-kernel | anti-cheat, reverse-engineering |
+| Adding resources, README format, link validation | overview | (any) |
+
 ## Main Categories
 
-1. **Game Development**: Engines, renderers, networking, physics
-2. **Graphics APIs**: DirectX, OpenGL, Vulkan hooks and tools
-3. **Cheat/Hacking**: Memory manipulation, injection, bypasses
-4. **Anti-Cheat**: Protection systems, detection methods
-5. **Reverse Engineering**: Debuggers, disassemblers, analysis tools
-6. **Windows Kernel**: Drivers, callbacks, security features
-7. **Web3 Security**: Blockchain, smart contracts, DeFi
-8. **Emulators**: Windows, Linux, Android, iOS, consoles
+All 27 top-level `##` sections in README.md:
+
+1. **Game Engine**: Engines, source code, plugins (Unreal/Unity/Godot/Lumix), detectors
+2. **Mathematics**: Linear algebra, physics libraries
+3. **Renderer**: Software renderers, ray tracing
+4. **3D Graphics**: 3D modeling and graphics resources
+5. **AI**: Machine learning for games
+6. **Image Codec**: Image processing libraries
+7. **Wavefront Obj**: OBJ file parsers
+8. **Task Scheduler**: Job/task scheduling systems
+9. **Game Network**: Networking, KCP, JWT, geolocation
+10. **PhysX SDK**: NVIDIA PhysX resources
+11. **Game Develop**: Development guides, source code, MCP servers, AI agents
+12. **Game Assets / Hot Patch / Testing / Tools / Manager / CI**: Supporting infrastructure
+13. **DirectX**: Guides, hooks, tools, emulation, overlays
+14. **OpenGL**: Guides, source, hooks
+15. **Vulkan**: API, guides, hooks
+16. **Cheat**: Offensive research (debugging, injection, hooking, DMA, overlays, driver comm, EFI, anti-forensics, game-specific)
+17. **Anti Cheat**: Defensive research (protection, detection, callbacks, forensics, signature scanning)
+18. **Some Tricks**: Ring0/Ring3/Linux/Android tricks and techniques
+19. **Windows Security Features**: DSE, PatchGuard, VBS, HVCI, Secure Boot
+20. **WSL / WSA**: Windows Subsystem for Linux/Android
+21. **Windows / Linux / Android / IOS Emulator**: Platform emulators
+22. **Game Boy / Nintendo Switch / Xbox / PlayStation**: Console emulators and research
 
 ## Contributing Guidelines
 

.claude/skills/reverse-engineering/SKILL.md

@@ -13,12 +13,29 @@ This skill covers reverse engineering workflows for game security research, incl
 
 - `Cheat > Debugging`
 - `Cheat > RE Tools`
+- `Cheat > Mixed boolean-arithmetic`
 - `Cheat > Dynamic Binary Instrumentation`
 - `Cheat > Fix VMP`
 - `Cheat > Fix Themida`
 - `Cheat > Fix OLLVM`
+- `Cheat > Virtual Environments`
+- `Cheat > Decompiler`
+- `Cheat > IDA themes`
+- `Cheat > IDA Plugins`
+- `Cheat > IDA Signature Database`
+- `Cheat > Binary Ninja Plugins`
+- `Cheat > Ghidra Plugins`
+- `Cheat > Radare Plugins`
+- `Cheat > Windbg Plugins`
+- `Cheat > X64DBG Plugins`
+- `Cheat > Cheat Engine Plugins`
+- `Cheat > ROP Finder`
+- `Cheat > ROP Generation`
 - `Anti Cheat > Anti Debugging`
+- `Anti Cheat > Anti Disassembly`
 - `Anti Cheat > Dump Fix`
+- `Anti Cheat > Sample Unpacker`
+- `Anti Cheat > Obfuscation Engine`
 - `Anti Cheat > Winows User Dump Analysis`
 - `Anti Cheat > Winows Kernel Dump Analysis`
 
@@ -89,6 +106,96 @@ This skill covers reverse engineering workflows for game security research, incl
 4. Behavioral analysis
 5. Driver IOCTL and callback tracing
 
+### Exception-Driven Lightweight DBI (Trap-and-Emulate)
+```
+Concept:
+- Replace branch instructions with fault-generating sentinel opcodes
+- Catch the resulting exception → emulate the original branch → log → resume
+- Full cycle: patch → fault → capture → emulate → record → restore → continue
+
+Sentinel Selection:
+- HLT (0xF4) for ret → triggers STATUS_PRIVILEGED_INSTRUCTION
+- SALC (0xD6) for jmp/jcc/call → triggers STATUS_ILLEGAL_INSTRUCTION
+- Avoids INT3 (0xCC) which anti-debug/integrity checks commonly scan for
+- Different sentinels can multiplex branch types
+
+Exception Capture:
+- Hook KiUserExceptionDispatcher (not VEH/SEH) for lowest-latency interception
+- Assembly stub tail-calls into RtlDispatchException
+- Handler dispatches by exception code to custom emulation logic
+
+Branch Emulation Engine:
+- Disassemble original (pre-patch) instruction at fault RIP
+- jcc: 16-condition lookup table (ZF, SF, CF, OF, PF combinations)
+- Direct call: push return address, update RIP
+- Indirect branch: resolve effective address (register, memory, SIB, RIP-relative)
+- ret: pop return address from stack, handle ret imm16 (extra pop)
+- loop/jrcxz: decrement RCX, conditional branch
+
+Instrumentation Strategies:
+- Bounded Bulk Patching: scan a window from seed address, patch all branches
+  → Simple but detectable by integrity checks
+- Branch Chasing: patch only current branch, re-instrument at target on fault
+  → Minimal memory footprint, highest stealth, best for unknown binaries
+- CFG-Guided Patching: recursive-descent static CFG + chasing for unreached edges
+  → Best coverage/safety balance
+
+Integrity Check Evasion:
+- PAGE_GUARD + Trap Flag (single-step) instead of direct code patching
+- Trigger guard page exception → set TF → single-step through original instruction
+- Avoids modifying .text section (defeats hash-based integrity checks)
+```
+
+### Control Flow Tracing (CFT) Applications
+```
+- Runtime call graph generation with register context at each edge
+- Divergence testing: compare traces across different inputs/environments
+  → Quickly locates input validation, anti-debug, anti-tamper trigger points
+- Deobfuscation: resolve all indirect branches in virtualized code
+- Hot path analysis, branch coverage measurement
+- Performance: ~600x slowdown (exception per branch), not suitable for
+  timing-sensitive targets (rdtsc checks, session timeouts)
+- Portable to other architectures: ARM (UDF), RISC-V (illegal instruction)
+```
+
+### User-Mode Hypervisor-Assisted Tracing
+```
+Concept:
+- Use Windows Hypervisor Platform (WHP) API to run guest code in user mode
+- No kernel driver required — standard user-mode process hosts the hypervisor
+- Map host memory pages into guest address space
+- Configure page-level traps (read/write/execute permissions per page)
+- Guest execution triggers VM exits on configured events
+
+Trap-Driven Execution:
+- Page fault traps: set per-page R/W/X permissions via EPT-equivalent API
+  → Execute fault = code coverage, Write fault = memory write monitoring
+  → Read fault = data access tracking
+- CPUID interception: guest executes CPUID → VM exit → host decides response
+  → Useful for fingerprinting guest environment queries
+- Syscall interception: guest executes syscall → VM exit → host emulates
+  → Controlled experiments without real kernel interaction
+
+Workflow:
+1. Prepare initial CPU state (registers, segments, control registers)
+2. Map target code + data pages with desired permissions
+3. Enter guest execution loop
+4. On VM exit: inspect reason, handle trap, optionally modify state
+5. Resume or terminate guest
+
+Advantages:
+- Pure user-mode: no driver signing, no PatchGuard concerns
+- Deterministic: full control over guest memory and execution
+- Composable: combine with disassemblers/emulators for hybrid analysis
+- Debuggable: host process can be debugged normally
+
+Limitations:
+- Requires hardware virtualization support (VT-x/AMD-V)
+- Windows-specific (WHP API is Windows 10+)
+- Cannot run full OS — suited for code snippets and function-level analysis
+- Nested virtualization considerations when host is already a VM
+```
+
 ## Anti-Analysis Bypass
 
 ### Techniques
@@ -140,6 +247,178 @@ This skill covers reverse engineering workflows for game security research, incl
 4. Correlate IOCTLs, callbacks, and runtime checks
 ```
 
+## Obfuscation Taxonomy
+
+### Mixed Boolean-Arithmetic (MBA)
+```
+- Linear MBA: e.g., x + y = (x ^ y) + 2*(x & y)
+- Polynomial MBA: higher-degree expressions over boolean/arithmetic mix
+- Tools: SSPAM, MBA-Blast, SiMBA for simplification
+- Common in: VMProtect, Themida, custom LLVM passes
+```
+
+### Control Flow Flattening (CFF)
+```
+- OLLVM-style: all basic blocks behind a dispatcher switch
+- Recovery: symbolic execution, pattern matching, deobfuscation passes
+- Tools: D-810 (IDA), de-ollvm scripts, SATURN
+- Variants: nested dispatchers, encrypted state variables
+```
+
+### Opaque Predicates
+```
+- Invariant conditions injected to confuse static analysis
+- Number-theoretic (x² mod 4 ∈ {0,1}), pointer-aliasing based
+- Detection: abstract interpretation, SMT solvers (Z3)
+```
+
+### Virtualization-Based Obfuscation
+```
+VMProtect / Themida / Code Virtualizer:
+- Custom bytecode VM with randomized opcode set per build
+- Handler table dispatch loop: fetch → decode → execute
+- Devirtualization approaches:
+  - Trace-based: record handler execution, lift to IR
+  - Pattern-based: identify handler semantics by structure
+  - Symbolic: concolic execution through VM dispatch
+- Tools: VMPAttack, NoVmp, Oreans UnVirtualizer, vtil
+```
+
+### Binary Lifting
+```
+- Lift machine code to compiler IR (LLVM IR, VEX, ESIL)
+- Enables compiler-level optimization passes for deobfuscation
+- Tools: McSema, remill, RetDec, Binary Ninja MLIL/HLIL
+```
+
+## Disassembler Plugin Ecosystem
+
+### IDA Pro Plugins
+```
+Categories found in README (> IDA Plugins, 150+ entries):
+- Decompiler enhancers: HexRaysPyTools, HRDevHelper
+- Type recovery: ClassInformer, auto_struct
+- Signature: FLIRT, Lumina, IDA Signature Database
+- Scripting: IDAPython, IDC, LazyIDA
+- Visualization: IDAGraph, Lighthouse (coverage)
+- Anti-obfuscation: D-810 (MBA), de-ollvm, Patfinder
+- Game-specific: SDK loaders, structure importers
+```
+
+### Binary Ninja Plugins
+```
+- Sidekick, snippets, type libraries
+- HLIL-based analysis scripts
+- Custom architectures and loaders
+- Headless analysis for batch processing
+```
+
+### Ghidra Plugins
+```
+- GhidraScript (Java/Python), Ghidra extensions
+- Ghidraaas (Ghidra-as-a-Service)
+- Type importers, signature matchers
+- Firmware analysis (SVD loader, embedded)
+```
+
+### Radare2 / iaito Plugins
+```
+- r2pipe scripting (Python, JS, Rust)
+- iaito: official radare2 Qt GUI
+- r2ghidra: Ghidra decompiler integration
+- r2dec: lightweight decompiler
+```
+
+### WinDbg Plugins
+```
+- SwishDbgExt, WinDbgX
+- Time Travel Debugging (TTD) extensions
+- !analyze extensions, custom formatters
+- Kernel debugging helpers
+```
+
+### x64dbg Plugins
+```
+- ScyllaHide (anti-anti-debug)
+- TitanEngine, x64dbgpy
+- Trace plugins, pattern scanners
+- Conditional breakpoint scripts
+```
+
+### Cheat Engine Plugins
+```
+- Mono/IL2CPP helpers
+- Auto-assembler templates
+- Structure dissectors
+- Pointer scanner extensions
+```
+
+## MCP-Based RE Tools
+
+```
+The README's MCP server section and RE tool ecosystem now include
+AI-assisted reverse engineering through Model Context Protocol:
+
+- IDA MCP: AI agent controls IDA Pro (rename, annotate, navigate)
+- Ghidra MCP: AI agent queries Ghidra decompilation and PCODE
+- Binary Ninja MCP: AI agent interacts with Binary Ninja API
+- radare2 MCP: AI agent drives r2 sessions via r2pipe
+- x64dbg MCP: AI agent controls live debugging sessions
+
+Workflow: LLM ↔ MCP server ↔ RE tool, enabling natural-language
+queries like "find all functions calling CreateRemoteThread" or
+"rename this function based on its decompiled logic"
+```
+
+## Binary Diffing
+
+```
+Tools for comparing binary versions (patch analysis, vulnerability research):
+- BinDiff (Google): graph-based structural comparison
+- Diaphora: IDA plugin, best open-source binary diff
+- ghidriff: Ghidra-based diffing, command-line and scriptable
+- DarunGrim: patch analysis focused differ
+- turbodiff: lightweight IDA diffing plugin
+
+Use cases in game security:
+- Tracking anti-cheat driver updates between versions
+- Identifying patched vulnerabilities in game clients
+- Comparing obfuscated builds to isolate logic changes
+```
+
+## Anti-Debug Techniques Catalog
+
+### User-Mode Anti-Debug
+```
+- IsDebuggerPresent / CheckRemoteDebuggerPresent
+- NtQueryInformationProcess (ProcessDebugPort, ProcessDebugFlags, ProcessDebugObjectHandle)
+- NtSetInformationThread (ThreadHideFromDebugger)
+- PEB.BeingDebugged, PEB.NtGlobalFlag, heap flags
+- INT 2D, INT 3 scanning, OutputDebugString tricks
+- Timing checks: rdtsc, QueryPerformanceCounter, GetTickCount64
+- TLS callbacks for early detection
+- Exception-based: unhandled exception filter, VEH chain inspection
+- Parent process checks (csrss.exe verification)
+- Self-debugging: NtCreateDebugObject
+```
+
+### Kernel-Mode Anti-Debug
+```
+- KdDebuggerEnabled / KdDebuggerNotPresent
+- Debug register (DR0-DR7) monitoring and clearing
+- KPROCESS.DebugPort zeroing
+- NMI callbacks for debugger detection
+- Hardware breakpoint detection via context inspection
+```
+
+### Anti-Debug Bypass Tools
+```
+- ScyllaHide: comprehensive anti-anti-debug (x64dbg/IDA/standalone)
+- TitanHide: kernel-mode debugger hiding
+- HyperHide: hypervisor-based anti-debug bypass
+- SharpOD: OllyDbg anti-anti-debug plugin
+```
+
 ## VMProtect/Themida Analysis
 
 ### Resources

.claude/skills/windows-kernel/SKILL.md

@@ -14,10 +14,16 @@ This skill covers Windows kernel internals that matter for game security researc
 - `Cheat > PatchGuard-related`
 - `Cheat > Driver Signature enforcement`
 - `Cheat > Windows Kernel Explorer`
+- `Cheat > EFI Driver` (cross-reference with game-hacking skill)
+- `Cheat > Vulnerable Driver`
 - `Anti Cheat > Detection:Attach`
 - `Anti Cheat > Detection:Hide`
 - `Anti Cheat > Detection:Vulnerable Driver`
+- `Anti Cheat > Detection:Spoof Stack`
+- `Anti Cheat > Windows Ring3 Callback`
 - `Anti Cheat > Windows Ring0 Callback`
+- `Anti Cheat > Information System & Forensics`
+- `Some Tricks > Windows Ring0`
 - `Windows Security Features`
 
 ## Core Kernel Concepts
@@ -215,6 +221,72 @@ NTSTATUS DriverEntry(
 - System call tracing
 ```
 
+## ETW Internals
+
+### Provider / Consumer Model
+```
+Architecture:
+- Providers: kernel or user-mode components that emit events
+  - Manifest-based providers (registered via wevtutil)
+  - TraceLogging providers (self-describing, no manifest)
+  - MOF providers (legacy WMI-based)
+- Consumers: tools that subscribe to and process events
+  - Real-time consumers (ETW sessions)
+  - Log file consumers (.etl files)
+- Controllers: manage sessions (xperf, tracelog, logman)
+
+Key kernel providers:
+  Microsoft-Windows-Kernel-Process (process/thread lifecycle)
+  Microsoft-Windows-Kernel-File (file I/O)
+  Microsoft-Windows-Kernel-Audit-API-Calls (security-sensitive APIs)
+```
+
+### ThreatIntel ETW Provider
+```
+- Microsoft-Windows-Threat-Intelligence
+- Available to PPL (Protected Process Light) and above
+- Events: NtReadVirtualMemory, NtWriteVirtualMemory, NtMapViewOfSection on protected processes
+- Used by EDR and anti-cheat for detecting memory access to protected processes
+- Attackers target: patch EtwThreatIntProvRegHandle or EtwpEventWriteFull
+```
+
+### Common ETW Bypass Patterns
+```
+- Patch EtwEventWrite in ntdll.dll (user-mode ETW silencing)
+- Patch nt!EtwpEventWriteFull in kernel (kernel-mode ETW silencing)
+- NtSetInformationThread(ThreadHideFromDebugger) — hides thread from ETW
+- Remove provider registration by walking EtwRegistration list
+- EPT-based protection can defend ETW structures from tampering
+```
+
+## Pool Allocation & Forensics
+
+### Pool Forensics Artifacts
+```
+PiDDBCacheTable:
+- Tracks historically loaded drivers by hash + timestamp
+- Anti-cheat inspects this to detect BYOVD or test-signed driver loads
+- Attackers attempt to remove entries post-load
+
+MmUnloadedDrivers:
+- Circular buffer of recently unloaded drivers (name + address range)
+- Cannot be cleared from user mode
+- Anti-cheat uses to detect load-unload-reload patterns
+
+PoolBigPageTable:
+- Maps large pool allocations (>= PAGE_SIZE) to owning driver tag
+- Used for: identifying hidden drivers, finding leaked pool allocations
+- Anti-cheat walks this to detect manually mapped driver memory
+```
+
+### Pool Tag Forensics
+```
+- ExAllocatePoolWithTag / ExAllocatePool2: every allocation carries a 4-byte tag
+- Pool tag scanning: identify driver presence by known tags
+- Tool: pooltag.txt (Microsoft), PoolMon, WinDbg !poolfind
+- Anti-cheat technique: scan pool tags for known cheat driver signatures
+```
+
 ### SSDT Hooking (Legacy)
 ```
 - Modify service table entries
@@ -271,20 +343,33 @@ MmMapLockedPagesSpecifyCache
 - API Monitor
 - ETW consumers
 
-## EFI/UEFI Integration
+## EFI/Boot-Time Threats
+
+### EFI Driver Cross-Reference
+```
+The README's > EFI Driver subcategory (under Cheat) contains 30+ projects:
+- EFI bootkit frameworks: UEFI DXE drivers that persist across boots
+- Boot-time memory mappers: inject code before Windows kernel initializes
+- ExitBootServices hooks: intercept Windows boot handoff
+- EFI runtime service abuse: GetVariable/SetVariable for kernel ↔ EFI comm
+
+See also: game-hacking skill for EFI cheat workflows
+```
 
 ### Boot-Time Access
 ```
-- EFI runtime services
-- Boot driver loading
-- Pre-OS execution
+- EFI runtime services persist after ExitBootServices
+- DXE (Driver Execution Environment) phase: full hardware access
+- Pre-kernel execution: no DSE, no PatchGuard, no HVCI enforcement
+- Secure Boot is the primary mitigation (firmware signature verification)
 ```
 
 ### Memory Access
 ```
-- GetVariable/SetVariable
-- Runtime memory mapping
-- Physical memory access
+- GetVariable/SetVariable: pass data between EFI and OS runtime
+- Runtime memory mapping via EFI memory map
+- Physical memory access before Windows memory manager initializes
+- ACPI table injection for persistent low-level modifications
 ```
 
 ## Hypervisor Development
@@ -410,6 +495,30 @@ VMCALL:
 - Anti-cheat evasion
 - EPT-based memory protection and introspection
 
+### Windows Hypervisor Platform (WHP) API
+```
+User-mode hypervisor interface (Windows 10+):
+- WHvCreatePartition / WHvSetupPartition: create VM partition
+- WHvCreateVirtualProcessor: add vCPU
+- WHvMapGpaRange: map host memory into guest physical address space
+- WHvRunVirtualProcessor: enter guest execution, blocks until VM exit
+- WHvGetVirtualProcessorRegisters / Set: read/write guest CPU state
+
+Key capability:
+- Enables hypervisor-assisted analysis from user mode (no kernel driver)
+- Page-level trap handling: set R/W/X permissions per guest page
+- VM exit reasons: memory access violation, CPUID, MSR access, I/O port, syscall
+- Deterministic execution: host controls all guest state and memory
+
+Prerequisites:
+- Enable Windows features: Microsoft-Hyper-V-Hypervisor + HypervisorPlatform
+- Hardware: VT-x or AMD-V support
+- Note: WHP coexists with Hyper-V but conflicts with some third-party hypervisors
+
+See also: reverse-engineering skill → User-Mode Hypervisor-Assisted Tracing
+for analysis workflows built on WHP
+```
+
 ## Hypervisor-Based Defense
 
 ### Concept