How modern anti-cheats detect unauthorized function calls by walking the thread stack:

1. Anti-cheat hooks internal game functions or analyzes stack frames during exception handlers (RtlCaptureStackBackTrace).
2. If the return address points to unbacked memory or an unknown non-game module, it flags anomalous call origin.

Return Address Spoofing:
By pushing a legitimate jmp rbx or jmp rax gadget from a signed DLL (e.g. client.dll or ntdll.dll) onto the stack before jumping to the target function, stack walkers see a valid return address pointing inside a signed game module!

Look for gadget signatures FF 23 (jmp [rbx]) inside legitimate game modules. Clean technique.

Great overview of call stack spoofing principles.