claude-game-re-plugin cover: the four slash commands /game-re:attach, /game-re:scan, /game-re:sig and /game-re:report, with scan in orange

claude-game-re-plugin logoclaude-game-re-plugin

Game reversing plugin for Claude Code
Price
Free
Version
1.0.0
Platform
Claude Code
License
MIT
Free & Open Source Claude Code Plugin Skills & Commands Write Guard Windows
Install the plugin and attach Pointer Lab to a program you own. Then ask Claude to find a value, find the code that writes it, walk its pointer chain or sign the instruction. The plugin gives Claude the procedure for each job, the exact tool calls and the dead ends to watch for. Each of its eight skills follows a chapter of The Game Hacker’s Handbook. Four commands run the common jobs in one line, and an agent runs a longer investigation on its own. Reads and scans run freely. Anything that would change the target’s memory or code is blocked by a hook until you opt in. The plugin also starts pe-mcp, so Claude can read the .exe or .dll on disk.
Free
A Claude Code plugin for Windows. Two claude plugin commands install it
Install as a Claude Code Plugin View Source on GitHub
Developer
Game Reversal Club
Open Source Software

See all software from this developer

What You Get

This is the write guard. It was given the call Claude would make to set the health value in the tutorial that ships with Pointer Lab. This is real output. Exit code 2 blocks the call, and Claude reads the message.

$ echo '{"hook_event_name":"PreToolUse","tool_name":"mcp__pointerlab__write","tool_input":{"address":"pointerlabtutorial.exe+2DBC8","type":"f32","value":"1000"}}' | powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File hooks/guard-writes.ps1; echo "exit $?"
game-re blocked mcp__pointerlab__write: it writes a value into the target's memory.

Pointer Lab's write, patch, allocate, inject and thread tools are off until the user opts in. This is the game-re plugin's safety default, not a Pointer Lab error. Do not retry the call or look for another way to make the change. Tell the user what was blocked and how to opt in.

To opt in, and only for software they own or the Pointer Lab tutorial, the user closes Claude Code and starts it again with GRC_ALLOW_WRITES set to 1:
  PowerShell:  $env:GRC_ALLOW_WRITES = "1"; claude
  cmd:         set "GRC_ALLOW_WRITES=1" then claude
  Git Bash:    GRC_ALLOW_WRITES=1 claude

Reads, scans, pointer scans, the access watch and hardware breakpoints work without it. Undo is never blocked: patch_restore_all, patch_remove, set_frozen with frozen false, and aa_disable_all.
exit 2

Claude reads the message and relays it to you. It tells Claude not to retry the call or look for another way to make the change. It tells you how to opt in, and what still works without it.

How It Works

Skills from the Handbook
Each skill is a procedure with real tool calls, a table of dead ends, and the Handbook chapter it teaches. Most also name the tutorial step to practice on. Claude loads a skill when your request matches it.
A guard on every write
Pointer Lab’s MCP server does what it is asked without a prompt. So a PreToolUse hook runs before the 15 tools that write memory, patch code, allocate, inject, start threads, change the clock, set software breakpoints or load a table with frozen entries. It blocks them unless Claude Code was started with GRC_ALLOW_WRITES=1.
Undo always passes
The hook reads each call’s arguments. Releasing a freeze, restoring a patch and turning a script off go through. So do reads, scans, pointer scans, the access watch and hardware breakpoints.
Live and on disk
Pointer Lab works on the running program, and the plugin starts pe-mcp to read the file. /game-re:sig proves a signature unique in both. Pointer Lab’s token changes every time its server starts, so you register it yourself each session.
Safety in the prompt
The safety skill tells Claude to refuse online and multiplayer games, other people’s servers and anything protected by anti-cheat, before it attaches. The re-analyst agent carries the same rules. Even with writes on, the skills tell Claude to say what it will change and how to undo it.
Tested with real runs
The eval suite has 11 cases, run three times each. The last full run, 33 agent runs with Claude Code 2.1.283 on 2026-09-26, passed every grader. A checker also checks every Pointer Lab and pe-mcp call in the docs against the tools’ real schemas.

Item Specifics

Name
claude-game-re-plugin (plugin name game-re)
Author
Heath Howren (“Cyborg Elf”)
Version
1.0.0 (2026)
Type
Claude Code plugin: skills, commands, an agent and a hook
Platform
Claude Code on Windows
License
MIT License
Price
Free
Language
Markdown skills, a Windows PowerShell hook, Node.js checks
Contents
8 skills, 4 commands, 1 agent, 1 PreToolUse hook, and pe-mcp as a bundled MCP server
Distribution
Claude Code plugin marketplace game-reversal-club: claude plugin marketplace add HeathHowren/claude-game-re-plugin, then claude plugin install game-re@game-reversal-club
Requirements
Claude Code on Windows with Windows PowerShell. Pointer Lab 3.2 or later for most skills and all commands. pe-mcp on your PATH for work on files
Also uses
Signature Lab, sigscan, iretable-tools, procpcap, hookscan and debug-bench. Only Pointer Lab and pe-mcp are called over MCP
Evals
11 cases, 33 agent runs; all passed with Claude Code 2.1.283 on 2026-09-26
Tests
30 Node tests for the hook and the checker; CI runs the hook tests in Windows PowerShell 5.1 and PowerShell 7
Source Code

Features

Eight skills tied to Handbook chapters
Value scans narrowed to one address
Find what writes an address
Pointer chains saved to .iretable
Signatures proven unique live and on disk
Trainers from a found chain
Static recon with pe-mcp
Netcode first look with procpcap
Safety skill that refuses online games
/game-re:attach, scan, sig, report
Findings file from the session
re-analyst agent for longer jobs
PreToolUse write guard
15 Pointer Lab tools gated
Opt in with GRC_ALLOW_WRITES=1
Undo and hardware breakpoints always pass
pe-mcp bundled as an MCP server
Works with Pointer Lab 3.2 or later
11 eval cases, 33 runs, all passed
Checker for every documented tool call
Hook tested in PowerShell 5.1 and 7

Before You Download

Intended use. The plugin is for studying software you own or are authorized to analyze: your own programs, CTF binaries, the Handbook’s labs and the Pointer Lab tutorial. Its safety skill tells Claude to refuse online and multiplayer games, other people’s servers and anything protected by anti-cheat. Using a memory tool against online or competitive games will very likely trip anti-cheat software and get the account banned, and modifying software you do not have permission to modify may be illegal where you live. This is a research tool.

A seatbelt, not a sandbox. The hook stops Claude’s calls to Pointer Lab’s MCP tools. It does not stop changes you make in Pointer Lab’s window. It cannot see a program that talks to Pointer Lab’s port directly with the token.

Windows only. The hook runs powershell.exe. On a machine without it the hook cannot run and does not block, so writes would go through. Under WSL, Claude Code runs Linux, so use it from Windows instead. The opt-in is read when Claude Code starts, and it cannot be turned on from inside a session.

Pointer Lab is registered each session. Its MCP token changes every time the server starts, so the plugin cannot ship it. Start the server under Tools > MCP Server in Pointer Lab, paste its copied claude mcp add command into a terminal, and restart Claude Code. /game-re:attach walks you through it. Never save the token in a file.