Forza Horizon 6 Luna

A Windows trainer / save-editing tool for Forza Horizon 6. Luna attaches to the running game process, reads and edits the live in-memory SQLite database, and installs runtime hooks to modify gameplay values such as Credits, Wheelspins and Drift Score.

Note: This repository contains C# source recovered by decompiling the Forza Horizon 6 Luna Version 1.3.3 executable. It is provided for transparency, educational, and research purposes.

Overview

Luna is a single-file .NET WinForms desktop application. It does not modify any game files on disk until you attach to the process and explicitly press an action button. All edits are performed against the game's live database through the game's own SQLite query function, and backup tables (_backup_*) are created before destructive changes.

Features

• Smart Auto Attach — automatically locates the FH6 process and game folder.
• Runtime Hooks — live detours for Credits, Wheelspins, Super Wheelspins, Skill Points, Drift Score Multiplier, Sell Factor and No Skill Break.
• Autoshow Unlocker — makes cars visible/purchasable and supports browsing and granting cars from the in-game Autoshow.
• Database Tools — guarded fixes such as Barn Find unlocker, remove duplicate cars, thumbnail repair, and profile stat editing.
• Profile Editable Stats — read and bulk-edit supported profile-wide stat columns.
• Console / Log — full activity log of every operation performed.

Project structure

File	Description
Program.cs	Application entry point; requests administrator rights and enables SeDebugPrivilege.
MainForm.cs	Main UI and all feature logic.
RemoteDatabase.cs	Process memory access and the remote SQLite query executor.
Native.cs	P/Invoke declarations for Windows memory/process APIs.
Pattern.cs	Array-of-bytes (AOB) pattern scanning.
RuntimeProfileFeature.cs	Enum of the supported runtime hook features.
ModernButton.cs, ModernPanel.cs, BetaBadge.cs, LunaWordmark.cs, SidebarLogoBanner.cs, StatusDotToggle.cs	Custom UI controls.

How it works

1. Luna relaunches itself elevated (administrator) so it can open the game process.
2. It scans the FH6 main module with byte patterns to resolve the in-memory CDatabase object and its ExecuteQuery function.
3. SQL is written into the target process with VirtualAllocEx / WriteProcessMemory, and a small thunk is executed via CreateRemoteThread so the game's own SQLite engine runs the query against its live database.
4. Runtime hooks (detours) are installed only when you press Apply.

Requirements

• Windows 10 / 11 (x64)
• .NET runtime to run the build; .NET SDK to compile from source
• Administrator privileges (required to attach to the game process)

Building

dotnet build "Forza Horizon 6 Luna Version 1.3.3.csproj" -c Release

Security Analysis

Because trainers are a common disguise for malware, the Forza Horizon 6 Luna Version 1.3.3 executable was reviewed both by static binary analysis and by reading the full decompiled C# source. The conclusion of that review: this is a game trainer and nothing else — it is not a RAT, stealer, dropper, or backdoor.

Analyzed file

• SHA-256: a667ee14eda319d1d6e90d8bde6b74f9370d00de1fda4a0a7d183744ac36668a
• Type: PE32+ .NET (WinForms) assembly, ~686 KB, not digitally signed

What it does NOT do (verified)

• ❌ No networking of any kind — no System.Net, no WebClient / HttpClient / Socket. It cannot exfiltrate data or download a second-stage payload.
• ❌ No persistence — it does not touch the registry Run keys, the Startup folder, or scheduled tasks.
• ❌ No shell execution — it never spawns cmd.exe or powershell.
• ❌ No external code loading — no Assembly.Load, no LoadLibrary of a foreign DLL, no shellcode fetched from disk or the network.
• ❌ No obfuscation or packing — all strings and logic are in cleartext and match the stated functionality.

What it does (expected trainer behavior)

• ✅ Requests administrator rights and enables SeDebugPrivilege — required to open the game process.
• ✅ Reads/writes the game's process memory and uses CreateRemoteThread to run SQL. This injection calls the game's own SQLite function; it does not inject foreign code. These APIs are normal for a trainer but are also flagged by antivirus software, so detections/heuristic warnings are expected and not by themselves proof of malice.
• ✅ The only outbound URL in the program is a Ko-fi donation page.

Remaining risks (not malware-related)

• ⚠️ The executable is unsigned, so its publisher cannot be cryptographically verified.
• ⚠️ Cheating in Forza Horizon may result in an account ban.
• ⚠️ Editing the profile database can corrupt save data (backup tables mitigate this but are not a guarantee).

Static analysis cannot prove behavior with 100% certainty. Always scan any build you download (e.g. on VirusTotal) and verify its hash.

Disclaimer

This software is not affiliated with, endorsed by, or associated with Playground Games, Turn 10 Studios, Xbox Game Studios or Microsoft. "Forza Horizon" is a trademark of its respective owners.

Using trainers or modifying game data may violate the game's Terms of Service and can result in account bans or save-data corruption. Use it only on offline / secondary profiles, entirely at your own risk. The authors accept no liability for any damage, data loss, or account action resulting from use of this software.