How modern anti-cheat modules detect injected DLL function calls:

They walk the call stack (RtlVirtualUnwind) from inside native functions. If the return address points to unbacked / dynamically allocated memory outside valid PE module bounds, the thread is flagged.

Return Address Spoofing Strategy:

1. Locate a jmp rbx or jmp [rsp] gadget inside a legitimate signed Windows system DLL (kernel32.dll or ntdll.dll).
2. Overwrite the stack return address with the gadget address.
3. Restore registers upon function completion.

The unwinder sees the call originating 100% from a signed Microsoft system binary!

Return address spoofing is essential when calling internal game engine methods from an injected DLL. Great breakdown of stack unwinding.

Masterclass in x64 calling conventions.