Your Lives are in Another Struct Breaking Memory Hacks with Field Relocation

The talk presents a build-time anti-cheat for Unity games built on the DOTS entity-component stack. The speaker starts with how cheaters work: runtime memory scans, array-of-bytes signatures, pointer chains, and static patching. Existing defenses such as kernel watchdogs, bytecode VMs, and control-flow flattening are weighed against those attacks. The central idea is to find components with identical lifetimes and relocate sensitive fields like lives or score into a peer component.

The implementation runs as a post-processing pass over Common Intermediate Language. It builds its own basic blocks, performs lifetime analysis over initialization and destruction sites, and checks each candidate move against eligibility rules. Field accesses are then rewritten, with component lookups injected where the target is out of scope. Much of the rewriter code was produced by coding agents steered by build output and CIL dumps. In a demo on an open-source breakout game, a memory-scan cheat that set lives worked before the change and found no matches after it. The pass added roughly 400 to 500 milliseconds to a build that takes about a minute, and five trials showed no measurable frame-time change.

The speaker is candid about limits. Runtime scans still succeed for an attacker willing to rescan after each patch, and networking, renderer, and physics data are out of scope. Agent-written code quality was uneven. The takeaway is that relocation raises attacker cost and downtime rather than stopping cheating, and the work is a proof of concept shared as a Unity pass.