crossover — Python parity of the alibi detection engine

Read-only Windows forensic kit. A gamer runs it, hands the resulting .txt (and matching _visual.html) to a third party, and the third party reads it to decide whether the machine shows signs of cheat software, HWID spoofers, DMA-cheat build artifacts, or commercial input adapters (XIM, Cronus, ReaSnow, KMBox, Titan, reWASD).

This is a Python parity port of the alibi PowerShell kit, which remains the canonical implementation. crossover shares no shipped artifacts with alibi — the detection rules are mirrored manually from the alibi PowerShell source, which serves as the upstream spec. This Python version exists for reviewers who would rather read Python source, and for cross-platform development.

The internal Python package is still named alibi (it is the alibi engine, in Python); only the repository is named crossover.

What it does

• 22 scanners across Prefetch, BAM, MUICache, USB history, ShimCache, services, drivers, downloads, recent files, AppData, user-folder script content, lua scripts, obscured filenames, process modules, DLL injection event timeline, network attack tools, AI-vision aimbot constellation, known hashes, DMA build artifacts, application data dirs.
• BYOVD detection by cross-referencing loaded drivers against the public loldrivers.io database (opt-in network call, the only network call the kit ever makes).
• Recency decay: artifacts older than 180 days are logged in a separate Historical section and do not bump the verdict — a clean current machine should not be condemned for old, abandoned software.
• Verdict tiers:
  • PC mode: CHEATS DETECTED / INPUT DEVICES DETECTED / UNSURE / CLEAN
  • Console-rig mode: MITM CHEAT STACK DETECTED / CAPTURE STACK PRESENT / UNSURE / CLEAN
• HTML companion auto-generated alongside the text report.

Requirements

• Windows 10 / 11
• Python 3.10 or newer (Windows installer from python.org or the Microsoft Store both work)
• Run as Administrator for full coverage (BAM, USB property keys, ShimCache, driver enumeration). The scan still runs without admin but will emit WARN for inaccessible sources.

No pip install is required to inspect the source — every file is plain .py and the kit uses only the Python standard library.

Usage

PC mode (default — for a gamer auditing their own gaming PC):

python -m alibi
# or, if installed:
alibi

Console-rig mode (for a console gamer auditing a PC connected to their console rig):

python -m alibi.console_rig_audit
# or, if installed:
alibi-rig

Unified launcher (runs both back-to-back, like the PowerShell Run scan.bat):

scripts\run-scan.bat

Options:

• --output PATH — override the auto-resolved Desktop output path.
• --skip-loldrivers — disable the optional LOLDrivers BYOVD cross-reference (the only outbound network call).
• --no-html — skip the HTML companion.

Output

Two files on the user's Desktop, both timestamped:

• AlibiReport_YYYYMMDD_HHMMSS.txt (or AlibiRigReport_*.txt)
• AlibiReport_YYYYMMDD_HHMMSS_visual.html

The .txt opens with a QUICK READ block stating the verdict and the named items that drove it. The HTML is a colour-coded version of the same data plus a finding timeline.

Architecture

• src/alibi/keywords.py — all keyword arrays, allowlists, hash database. Add a new cheat-brand token here and every scanner picks it up.
• src/alibi/utils.py — match_keyword, classify_path_risk, score_item, score_and_add, admin check, FileTime conversion.
• src/alibi/scanners.py — the 21 scan functions and invoke_all_scans.
• src/alibi/snapshots.py — process + service snapshots.
• src/alibi/recency.py — apply_recency_decay and the 180-day rule.
• src/alibi/loldrivers.py — resolve_loldrivers_db (opt-in CSV fetch + 1h cache).
• src/alibi/reports.py — text report builder, shared by both drivers.
• src/alibi/visual_companion.py — HTML companion, shared by both drivers (unified from day one).
• src/alibi/forensic_scan.py — PC driver.
• src/alibi/console_rig_audit.py — console-rig driver.

Authorship

Author: Bread. Contributor: Drownmw.

See the canonical alibi repo for the full PowerShell-kit history and the project's design rationale. crossover tracks alibi's detection rules as its upstream spec.