Cheatron Core

A professional TypeScript toolkit for Windows x64 game hacking. Exposes native Win32 APIs through ergonomic TypeScript interfaces via FFI.

⚠️ Early stage — APIs may change. Contributions welcome.

Features

• Process & Memory — Read/write process memory, pattern scanning, virtual memory management
• Thread Hijacking — Non-invasive x64 thread hijacking without shellcode or CreateRemoteThread
• Assembly — Assemble (Keystone) and disassemble (Capstone) x86/x64 instructions at runtime
• Native Functions — Inject and call custom assembly functions in local/remote processes
• FFI Bindings — Type-safe kernel32, user32, psapi, msvcrt bindings via koffi

Requirements

• Node.js ≥ 20
• npm ≥ 10
• Windows x64 (or Linux with Wine for development)

Quick Start

npm install
npm run download-deps   # Download Capstone & Keystone DLLs
npm run build

Packages

Package	Description
@cheatron/core	Umbrella — single entry-point for the entire ecosystem
@cheatron/native	Ergonomic process, memory, thread, and scanner API
@cheatron/nthread	Thread hijacking library
@cheatron/native-bindings	Low-level Win32 DLL function signatures
@cheatron/win32-ext	Extended Win32 type definitions & FFI primitives
@cheatron/capstone	Capstone disassembler FFI bindings
@cheatron/keystone	Keystone assembler FFI bindings
@cheatron/utils	Logger & error classes
@cheatron/injector	DLL injector CLI & library

Example: DLL Injector

@cheatron/injector is a ready-to-use DLL injector included as a workspace package.

CLI:

npx cheatron-inject notepad.exe C:\path\to\my.dll
npx cheatron-inject "Untitled - Notepad" C:\path\to\my.dll

Library:

import { inject } from '@cheatron/injector';

const result = await inject({
  processName: 'notepad.exe',
  dllPath: 'C:\\path\\to\\my.dll',
});
console.log(`Loaded at ${result.hModule}`);

Under the hood it uses Target for process discovery and AdvancedNThread for thread hijacking — no CreateRemoteThread, no shellcode.

Scripts

npm run build           # Build all packages
npm run typecheck       # Type-check without emit
npm run test            # Run tests
npm run lint            # ESLint
npm run format          # Prettier

License

MIT