DrawGuessHelper: A DX11 Injection Cheat Framework for Draw & Guess

DrawGuessHelper is a DX11 injection helper I wrote for Draw & Guess on Steam. The game is built with Unity + Mono, so memory is basically wide open, which makes it a great target for practicing reverse engineering and injection. The approach is the usual playbook: inject a DLL into the process, use MinHook to hook DX11’s Present, and stack a Dear ImGui overlay on top of each frame after the game finishes rendering; Insert or Right Shift brings up the panel. Talking to game logic goes through Mono runtime reflection: once you attach to a thread you can read C# objects and call methods directly, so pulling out client-side local data like the answer for wall-hack purposes is trivial.

What I care about most is the framework, not the features. Auto-drawing, answer wall-hack, score spoofing, bypassing the rename cooldown, network-layer DoS – I could list a lot of these, but to me they’re all just “content,” one more each time I write one. The core is a minimal plugin framework: an IModule interface, a ModuleRegistry, plus a REGISTER_MODULE macro for static self-registration. To add something new you write a self-contained file, drop it into the CMake list, and touch nothing else; the UI panel grows the category automatically, and the command hooks itself onto the remote interface. The eighteen modules currently stacked up this way don’t know each other exists, and changing one doesn’t break another.

The RemoteBridge under bridges/ runs an in-process HTTP service listening on 127.0.0.1:9099; POST a string to control it.

curl -X POST http://127.0.0.1:9099 -d "STATUS"
curl -X POST http://127.0.0.1:9099 -d "ANSWER"

STATUS returns status JSON, ANSWER spits out the current answer, and DRAW/DRAW_STOP control auto-drawing. The wildest one is EVAL static <Class> <Method>, which exposes Mono reflection as a single remote command to call arbitrary static methods at runtime – effectively a backdoor. It saves a lot of hassle in reverse-engineering debugging: no recompile-and-inject, just tweak a curl line and test. The service binds to loopback only and has no auth; it’s purely for local debugging, so don’t expose it to the network.

The tech stack is C++17 + MSVC, a DX11 Present hook with MinHook, ImGui on the docking branch, a network layer over the Hazel/Photon protocol, and an economy system involving PlayFab’s CloudScript. The pitfall is on the Mono side: before any reflection call you must attachThread to attach the thread to the Mono runtime, or it crashes outright; and local cache changes need protection against the server pushing overwrites back, so I added cache locking.

This is purely a toy for studying Unity/Mono clients and practicing reverse engineering and injection, for security research and learning only. Code is here https://github.com/dwgx/DrawGuessHelper.