The Web Game Hacking Encyclopedia

A) Visual ESP Overlays

Not all overlays are stream-safe. An in-browser canvas or DOM overlay inside the captured browser window will still be visible to display capture. A separate overlay process is safer.

• Window capture vs display capture: Window capture can isolate a single application window, while display capture records the entire monitor.
• Canvas is not streamproof: Any canvas rendered inside the captured window is still captured if that window or monitor is part of the stream.
• Separate overlay process: Use a second browser window, Electron helper, or native overlay to keep sensitive visuals outside the captured game surface.
• DirectX / OpenGL overlay injection: Native overlays can render above the game and may be ignored by some capture sources when the source is limited to the game process.
• Overlay placement: Put the private overlay on a secondary monitor or off-screen window for maximum safety.

Detection Risk: Lower when the cheat UI is kept separate from the captured game surface. If the stream captures the whole desktop, separate windows are still visible unless excluded by the capture source.

B) Capture protection across Windows, macOS, and Linux

On Windows, display affinity APIs can mark a window as excluded from capture by supported capture implementations. On macOS and Linux, the same goal is usually achieved with separate windows, private overlay processes, OBS/XSplit scene filters, or capture-source restrictions, because the Windows-only affinity API is not available there.

// Pseudo-code for user32 SetWindowDisplayAffinity
HWND hwnd = FindWindow(NULL, L"Private Overlay");
SetWindowDisplayAffinity(hwnd, WDA_EXCLUDEFROMCAPTURE);

Use SetWindowDisplayAffinity with WDA_EXCLUDEFROMCAPTURE to hint that the window should not be captured. This is useful for native helper windows and overlays but not a universal guarantee.

• WDA_EXCLUDEFROMCAPTURE is available on recent Windows versions and is honored by many Windows capture APIs.
• It does not protect browser canvas content rendered in the same process.
• It is best used for separate native windows that host private UI.

C) OBS / XSplit capture considerations

Understand the capture mode your streamer is using.

• Window capture: captures one application window.
• Display capture: captures the whole monitor.
• Game capture: captures a specific process or graphics surface.

If you are using window capture, keep the game and cheat windows separate. If you are using game capture, use a helper overlay that is outside the captured process.

D) Audio Bypasses

Keep cheat audio private by routing it to a different device or a local-only channel.

• Use a dedicated headset or virtual audio device not included in the stream.
• Generate local-only audio with the Web Audio API.
• Use vibration or status LEDs for silent feedback.

E) Input Methods

Use hidden triggers and controls that are unlikely to appear in the stream.

• Choose complex hotkeys and avoid on-screen prompts.
• Use the Web Speech API for private voice commands.
• Keep cheat dashboards on a second monitor or external display.

F) Stream-safe visual architecture

• Run cheat UI in a separate window or process, not inside the game canvas.
• Use hidden windows, secondary displays, or overlay processes to keep the capture clean.
• Log debug output to a private console window or file.

More advanced setups use a native helper process or Electron overlay so the browser game remains unchanged and the stream source can be limited to the game itself. This is the most reliable stream-proof approach.