Alibi

A read-only forensic kit for Windows that lets a gamer demonstrate to a third party that their machine isn't running cheats. The deliverable is two timestamped files on the user's Desktop — a plain-text report and a matching _visual.html companion. A reviewer reads those files. No system modifications, no installed software, no telemetry. Exactly one outbound network call — the opt-in LOLDrivers BYOVD cross-reference — is prompted before running and explicitly disclosed in every report; everything else stays on the machine.

Primarily built for Call of Duty. The kit was born out of the CoD cheating scene — its first preserved scan output dates from May 12, 2026 (under the project's original name "CheatChecks"), and the first external field test (May 22) was a self-confessed CoD cheater whose setup was correctly flagged and whose feedback drove the v3.3+ feature push. The deepest keyword coverage is still for CoD-side brands: EngineOwning, PhantomOverlay, Lavi/Sky/iWantCheats, X22, the rut.gg / RUAVT family, Two2nd / Tomware / Cynical (the Activision-C&D'd Feb-2025 brands), plus Ricochet- and HWID-spoofer-focused detection logic. CS2, Apex, Tarkov, Rust, R6, and Marvel Rivals brand arrays were added later because the same engine handled them for free — but if you're auditing a CoD rig, this is the kit that's been most actively shaped for that.

Two scan modes share one engine:

• PC mode — for PC gamers auditing their own gaming PC
• Console-rig mode — for console gamers auditing a PC connected to their console rig (capture-card host, streaming PC, MITM-aimbot setup)

Author: Bread — Activision ID Bread#3266221, GitHub @Sutaigne. Contributor: Drownmw.

The Activision ID is intentional: this kit was built by an active CoD player, and reviewers can verify that in-game. If you're auditing a CoD rig, you should be able to look up the kit's author the same way you'd look up the person whose machine you're scanning.

Reviewer? Someone handed you a report and is asking you to believe it? Read docs/for-reviewers.md first. It walks you through verifying the kit, reading the verdict, and what CLEAN does and does not rule out. The verification chain starts with HASHES.txt.

Quick start

Unzip the kit (alibi.zip), copy to a USB stick if you want portability, then right-click Run scan.bat → Run as administrator. That's it.

alibi/
├── Run scan.bat              ← right-click → Run as administrator
├── START HERE.txt            ← read this first if confused
├── HASHES.txt                ← verify the kit: sha256sum -c HASHES.txt
└── alibi-engine/             ← the machinery (you don't need to open it)
    ├── scanner/              ← the .ps1 scanner files (the engine)
    ├── docs/for-reviewers.md ← reviewer guide
    └── README.md / SECURITY.md / LICENSE

Two scans run back-to-back (PC mode + console-rig mode); two pairs of timestamped files land on the Desktop. Approve the UAC prompt when it appears — admin is required for full coverage. Total time: about 1–2 minutes on a typical machine; the first run pulls the LOLDrivers driver database (opt-in, ~50 KB).

If the download is blocked as a virus

alibi is an anti-cheat scanner, so by design it ships the very patterns antivirus hunts for: a plaintext list of cheat-brand names (aimbot, wallhack, pcileech, …) and the literal attack-command strings it looks for on a suspect machine (e.g. iex (new-object net.webclient). SmartScreen and some AV engines score those bytes — on a brand-new, unsigned, low-download-count file — as "suspicious," even though every file is plain, readable source. This is a known false positive, not a real infection. You can confirm that yourself: every shipped file's SHA256 is in HASHES.txt, and uploading the ZIP to VirusTotal shows it clean across ~70 engines.

Two separate things you may hit, and the fix for each:

1. "Virus detected" — the browser refuses to download. This is SmartScreen reputation, not a confirmed threat. In Edge/Chrome: open the browser's Downloads list → the blocked item → Keep (Edge: ⋯ → Keep → Keep anyway). Then verify against HASHES.txt.

2. "Access to the compressed (zipped) folder is denied" when extracting. This is the Mark of the Web — Windows tags every internet download, and the built-in extractor then refuses. It is unrelated to any virus, and affects clean downloads too. Remove the tag in one line:

Unblock-File .\alibi-main.zip       # strip the internet tag
Expand-Archive .\alibi-main.zip     # now extracts cleanly

Or: right-click the ZIP → Properties → tick Unblock → OK, then extract. (7-Zip ignores the tag entirely.)

The full explanation — why a defensive tool trips antivirus, how to report the false positive to Microsoft, and what we do (and deliberately don't do) to reduce it — is in SECURITY.md.

What it detects

• 22 scanners across Prefetch, BAM, MUICache, USB history, ShimCache, services, drivers, downloads, recent files, AppData, user-folder script content, lua scripts, obscured filenames, process modules, DLL injection event timeline, network attack tools, AI-vision aimbot constellation, known hashes, DMA build artifacts, application data dirs.
• 520+ research-confirmed keyword tokens across cheat brands (CoD, CS2, Apex, Tarkov, Rust, R6, Marvel Rivals), HWID spoofers, DMA hardware vendors, AI-vision aimbots, mouse-macro / anti-recoil patterns, input devices (XIM, Cronus, ReaSnow, KMBox, Titan, reWASD), and dual-use tools.
• LOLDrivers BYOVD detection — cross-references loaded drivers against the public loldrivers.io database. The only network call the kit ever makes, and it's opt-in.
• Recency decay — artifacts older than 180 days are logged in a separate Historical section but do not bump the verdict. A clean current machine should not be condemned for old, abandoned software.

Verdict tiers

Mode	Verdicts
PC	CHEATS DETECTED / INPUT DEVICES DETECTED / UNSURE / CLEAN
Console-rig	MITM CHEAT STACK DETECTED / CAPTURE STACK PRESENT / UNSURE / CLEAN

Example outputs

Every scan writes a fully self-contained _visual.html alongside the .txt report — inline CSS + JS, no external assets, works offline. It renders the verdict, a finding timeline, a category signal map, and severity-grouped finding cards.

Live preview: rendered example reports for each visual state (red / amber / green), served from GitHub Pages, are hosted by the parity port at sutaigne.github.io/crossover — full interactivity, no download required. The markup is bit-identical to what a real scan produces.

Auditability

This kit's whole value is being readable by a reviewer who has no reason to trust the author. Therefore:

• All source is plain .ps1 / .css / .js / .html. Nothing is minified, compiled, or obfuscated.
• No binaries are shipped, and no opaque archives — version history lives in git, not in committed ZIPs.
• No external dependencies at runtime beyond the PowerShell that ships with Windows.
• No telemetry, no analytics, no tracking.
• Exactly one outbound network call (LOLDrivers BYOVD cross-reference) exists, prompts the user with Y/N before running, skipped by default with -SkipLOLDrivers / --skip-loldrivers, and is explicitly disclosed in every report.
• Every shipped file has its SHA256 published in HASHES.txt so a reviewer can confirm the kit they received matches this repo.
• The reviewer-side workflow is documented in docs/for-reviewers.md.
• Security disclosure policy: SECURITY.md. Private vulnerability reporting is enabled — use it for bypass reports or false-positive contributions.

Project history

See docs/handoff.md for the full PowerShell-side history (v3.2 through v3.8, 2026-05-25), the design rationale for each scanner, the recency-decay architecture, and the dev workflow.

See docs/design-handoff-2026-05/ for the visual design's source-of-truth bundle (reference HTMLs, design canvas, design tokens spec).

License

MIT — see LICENSE. Free to read, run, fork, redistribute.