Reference

Signatures reference

Signature types, match modes and validation rules for global and custom signatures.

A signature is an indicator the scanner looks for: a file hash, a file name, a path, a window title, a memory string, a domain, and so on. Signatures are data, never code. DUXAC maintains a global database; workspaces whose plan includes custom signatures can add their own.

The tables on this page are generated from SIGNATURE_TYPES and SIGNATURE_LIMITS in packages/shared.

Fields#

Field	Description
`name`	3 to 80 characters, shown on findings.
`description`	Optional, up to 500 characters.
`category`	The check category the signature belongs to.
`type`	One of the types below.
`match`	`exact`, `contains` or `glob`, restricted per type.
`pattern`	The value to look for.
`severity`	`info` to `critical`; capped at the check's highest severity when evaluated.
`confidence`	1 to 100: how strongly a match indicates cheating.
`tags`	Up to 10 free tags (cheat family, vendor).

Types#

Type	Label	Match modes	Example	Applies to	Checks
`file_hash`	File SHA-256	`exact`	64 hex characters	files hashed by PRC/FIV/FS/DRV checks	`PRC-001`, `PRC-003`, `FIV-001`, `FIV-002`, `FIV-003`, `FS-001`, `FS-003`, `FS-004`, `DRV-001`
`file_name`	File name	`exact`, `glob`, `contains`	e.g. loader*.exe	files, Prefetch, BAM, USN journal, recycle bin	`SYS-005`, `FIV-001`, `FIV-002`, `FS-001`, `FS-003`, `FS-004`, `EXE-001`, `EXE-002`, `EXE-003`, `EXE-004`, `EXE-005`, `AF-003`
`file_path`	File path	`glob`, `contains`	e.g. %APPDATA%*\menu.dll	files, processes, execution history	`SYS-005`, `PRC-001`, `PRC-003`, `FIV-001`, `FIV-003`, `FS-001`, `EXE-001`, `EXE-002`, `EXE-003`, `EXE-005`, `DRV-002`
`process_name`	Process name	`exact`, `glob`	e.g. injector.exe	running processes	`PRC-001`, `HW-002`, `AF-003`
`module_name`	Module name	`exact`, `glob`	e.g. hook.dll	DLLs loaded in FiveM, FiveM logs	`PRC-003`, `FIV-004`
`window_title`	Window title	`exact`, `glob`, `contains`	e.g. Menu v	visible and hidden top-level windows	`PRC-001`
`memory_string`	Memory string	`contains`	at least 6 characters	memory of selected processes (MEM-001)	`MEM-001`
`file_string`	File string	`contains`	at least 6 characters	contents of candidate executables and FiveM logs	`FIV-004`, `FS-001`
`certificate_subject`	Code-signing subject	`exact`, `contains`	publisher name	signed executables and drivers	`PRC-001`, `FS-001`, `DRV-001`
`driver_name`	Driver name	`exact`, `glob`	e.g. iqvw64e.sys	loaded kernel drivers	`DRV-001`
`service_name`	Service name	`exact`, `glob`	service key name	installed services	`DRV-002`
`registry_key`	Registry key	`exact`, `glob`	e.g. HKCU\Software\Cheat*	autoruns and known registry locations	`EXE-005`
`pci_device`	PCI/USB device id	`exact`, `glob`	e.g. PCI\VEN_10EE&DEV_*	PCI and USB device ids	`HW-001`, `HW-002`
`domain`	Domain	`exact`, `glob`	e.g. *.cheatseller.example	DNS cache, browser history	`NET-001`, `NET-002`
`filename`	Browser download filename	`exact`, `glob`, `contains`	e.g. cheat.zip	browser download history (NET-002)	—

Matching rules#

Every comparison is case-insensitive. file_hash compares lower-case hexadecimal.
exact: the whole value equals the pattern.
contains: the pattern occurs anywhere in the value.
glob: * matches any run of characters (including none), ? exactly one character, and the whole value must match.
There are no regular expressions. This rules out catastrophic backtracking and guarantees that the scanner's C# matcher behaves exactly like the TypeScript reference; both are pinned by shared test vectors.
Paths are normalised before matching: / becomes \, and the user profile, %LOCALAPPDATA%, %APPDATA% and %TEMP% prefixes are replaced by those placeholders. Write path patterns with the placeholders, for example %APPDATA%\*\loader*.exe.
memory_string and file_string patterns are searched as ASCII and as UTF-16LE.

Validation#

A signature is rejected (never stored or sent to a scanner) unless it respects these rules:

Pattern length: at most 256 characters, no leading/trailing whitespace, no control characters.
memory_string and file_string: at least 6 characters.
contains: at least 3 characters.
glob: at most 4 * wildcards and at least 3 literal characters.
file_hash: exactly 64 hexadecimal characters (SHA-256).
At most 2000 signatures per workspace (your plan may allow fewer).
Severity is one of info, low, medium, high, critical; confidence is an integer from 1 to 100.

Lifecycle#

Every save creates a new version. You publish a version to make it active, can roll back to an earlier one, and can disable a signature without deleting it. The dashboard lets you validate a definition and test it against sample values before publishing. Each signature records how often it matched and how often staff marked its findings as false positives, so weak indicators are easy to spot.

Writing good signatures#

Prefer hashes and specific paths over short names: loader.exe on its own is a common file name.
Use glob with enough literal text; very short patterns are refused for a reason.
Set confidence honestly. A name match on a popular tool is low confidence; the hash of a known cheat build is high.
Watch the false-positive count and retire signatures that only produce noise.