Nimbus vs the alternatives.
Nine categories, three loaders, one honest scoring rubric. Every row cites the intel doc we used to score the competitor — and where we could not verify a feature live, we mark it Unknown instead of guessing.
Each cell is either Yes, Partial, No, or Unknown. We rate Nimbus on what ships today. We rate competitors on what we have observed in our own intel captures — listed at the bottom. We do not claim Nimbus is undetected forever, and we do not call competitors broken when they are not.
| Category | NimbusOurs | Competitor A | Competitor B |
|---|---|---|---|
| Aim engine | |||
Hero-aware behaviour Marvel Rivals has projectile heroes (Hawkeye, Hela, Black Widow, Winter Soldier) and hitscan heroes. One smoothing curve does not fit both. | Per-hero smoothing curves and per-weapon recoil compensation. | Single FOV with manual smoothing slider, not per-hero.[1] | Per-hero smoothing + per-ability exploits (SilentAim, PSilent, BulletTP).[2] |
Gravity-correct projectile lead Marvel Rivals projectiles travel at finite speeds and drop in Z. Lead must solve a quartic for an intercept, not assume a straight line. | Quartic gravity intercept at 980 cm/s² with 4-iter re-solve. | Linear lead only; misses Hawkeye arc shots at range.[1] | Quartic intercept with auto-detect projectile speed (5-sample avg).[5] |
Per-weapon recoil compensation Recoil profiles are weapon-specific. A single global multiplier produces visible snap on burst-fire heroes. | Per-weapon vertical + horizontal compensation curves. | Global no-recoil toggle only.[1] | Pattern-based exploit toggle, not curve-fitted.[2] |
Silent aim True silent aim writes target into the fire context without moving the camera. Anything else is just snap aim with a different name. | Available, off by default and gated behind a risk dialog. | Pattern-based silent aim toggle.[1] | bUseCustomTargetInfo + bSimulateIndependent; correct implementation.[2] |
| ESP | |||
Boxes and skeleton Table-stakes feature. Every overlay has it; we list it so the row reads complete. | Per-bone skeleton plus AABB box, healthbar, distance, name. | Boxes, skeleton, healthbar.[1] | Boxes, skeleton, with weight-based targeting.[2] |
Ultimate-charge percent Knowing the enemy is at 87% ult lets you peek now or hold. Marvel Rivals exposes this through the engine's threat-value admin. | Pulled live from GameStateBase + 0x6F0 threat-value admin. | Charge percent not exposed in menu.[1] | Tracked internally but not always rendered.[2] |
Ability cooldown arcs Visualising Shift / E / F cooldowns as progress arcs under each enemy lets you decide when to engage without crosshair-watching. | Progress-arc renderer per-input-key via GetGameplayAbilitiesByInputKey. | No cooldown rendering.[1] | AbilityStateTracker reads RMB/E/Shift/F cooldowns.[2] |
World-object labels (summons, deployables) Jeff bubble, Groot wall, Strange portal, Punisher turret — these decide teamfights. An ESP that only shows player models misses half the game. | Class-id LUT for Jeff/Namor/MK/Peni/Groot/Rocket/Strange/Punisher/Mantis/Loki/SG/Elsa.[10] | Players only.[1] | PersistentLevel walk with owner-side ally check.[10] |
| Patch turnaround | |||
Time from game-patch to working build Marvel Rivals ships patches every 2-3 weeks. The overlay you bought is worth nothing on patch night. | Minutes — Resolver v2 string-anchored xref pipeline. | Hours — manual SDK regenerate from Dumper-7.[1] | Hours — manual pattern fix-up.[2] |
Auto-update on launch If you have to manually re-download the loader after every patch, half the customers fail to. | Loader self-updates from /api/version on launch. | Vendor panel pulls latest build on launch.[9] | Build pipeline not publicly observable. |
| Anti-cheat handling | |||
NEP killer (NetEase Anti-cheat) NEP installs a per-session driver with a random suffix. Without a killer it logs everything you do. | ReadDirectoryChangesW watcher + 4-stage aggressive delete. | 32-command cleaner cascade + temp-watcher.[4] | Killer thread plus anti-cheat compatibility patterns.[7] |
Manual map (no DLL on disk) A DLL on disk is forensic evidence. Manual mapping keeps the payload in memory only. | Manual-map injector; payload never touches disk after load. | libogg_64.dll hijack with self-delete post-inject.[8] | Manual-map via libogg overlay.[2] |
Anti-debug / anti-dump If a researcher (or anti-cheat) can attach a debugger and dump your code, the day-key economy ends. | Themida-style packer + integrity checks on critical paths. | Themida-packed; blocks external OpenProcess.[8] | CounterDetection suspends non-known-module threads.[7] |
| Loader stealth | |||
Process hiding (PEB unlink) Anti-cheats enumerate loaded modules. PEB unlinking keeps the loader off that list. | Unlinks from 3 PEB module lists post-inject. | PEB unlink in libogg overlay.[1] | Unlinks 3 lists + NtSetInformationThread 9 spoof.[2] |
Self-delete after inject Leaving the loader on disk after launching the payload is the easiest way for anti-cheat to fingerprint your customers. | Loader exits and removes its own file; payload runs orphaned. | DeleteFileW post-inject; section refcount keeps in-mem alive.[8] | MoveToTemp + cached path cleanup.[2] |
In-process cleaner (no spawned cmd.exe) A flashing cmd.exe window at launch is a tell, and child-process trees show up in telemetry. | In-process Win32 (MoveFileEx, RegDeleteTreeW, EvtClearLog). | 32 silent cmd.exe children for delete/wevtutil cascade.[6] | Hybrid — some in-proc, some scripted.[2] |
| Spoofer | |||
HWID rotation depth A partial spoofer just hides MachineGuid. Real HWID bans look at 6-8 registry keys plus disk and SMBIOS. | 8 HKLM keys: MachineGuid + HwProfileGuid + 6 derived IDs. | 8 HKLM keys via svchost path (no SMBIOS).[1] | MachineGuid + a handful of derived keys.[2] |
Cleaner cascade depth A spoofer that does not also wipe Marvel logs, NEP service install, and Steam cache leaves a forensic trail. | 32-cmd-equivalent in-process cascade; matches the reference loader's coverage without cmd.exe. | 32 deterministic commands targeting game, vendor SDK, NetEase, consent, crash-report dirs.[4] | Cleaner present, scope smaller than Competitor A.[2] |
Kernel-level spoof option User-mode spoof handles most account bans. Hardware bans need a kernel hook or SMBIOS rewrite. | Optional KDU subprocess backend for kernel-level path. | User-mode only.[1] | Not publicly observed in source. |
| Customer support | |||
Discord response time When your build breaks at 11pm on patch night you need a human, not a 24-hour email queue. | Live channel staffed during peak hours; median minutes. | Dev replies on his own schedule; can be hours.[9] | Operator availability not publicly listed. |
Issue resolution When a key gets eaten or a patch day eats your sub time, you need a clear path to a fix — not a one-line FAQ saying "no refunds". | Live Discord ticket — replacement keys + time extensions handled by humans. | Case-by-case via Discord DM.[9] | Policy not published. |
| Pricing | |||
Day pass A trial costs nothing. A $5 day pass at full feature parity is the honest version of the same idea. | $5 / 24h, full feature parity. | $5 / 24h (third-party day-key economy).[9] | Pricing not publicly listed. |
Week / Month / Lifetime Different play patterns want different commitments. A two-SKU catalog forces overpaying. | $5 / $15 / $30 / $120 (Day / Week / Month / Lifetime). | Week and Month available; lifetime not advertised.[9] | SKU structure not publicly listed. |
| Account-binding | |||
Per-machine HWID lock Without a HWID lock one paid key gets shared, and the seller bakes the loss into the price for everyone. | Salted hashed HWID, bound on first launch. | Third-party HWID bind on activation.[9] | HWID-locked per build.[2] |
Self-service HWID reset Bought a new PC, RMA'd a board, or just want to move between rigs? You should not need to email anyone. | Dashboard reset with 24-hour cooldown. | Reset via vendor storefront auth; 15h cooldown.[9] | Reset flow not publicly documented. |
Aim engine
Marvel Rivals has projectile heroes (Hawkeye, Hela, Black Widow, Winter Soldier) and hitscan heroes. One smoothing curve does not fit both.
Marvel Rivals projectiles travel at finite speeds and drop in Z. Lead must solve a quartic for an intercept, not assume a straight line.
Recoil profiles are weapon-specific. A single global multiplier produces visible snap on burst-fire heroes.
True silent aim writes target into the fire context without moving the camera. Anything else is just snap aim with a different name.
ESP
Table-stakes feature. Every overlay has it; we list it so the row reads complete.
Knowing the enemy is at 87% ult lets you peek now or hold. Marvel Rivals exposes this through the engine's threat-value admin.
Visualising Shift / E / F cooldowns as progress arcs under each enemy lets you decide when to engage without crosshair-watching.
Jeff bubble, Groot wall, Strange portal, Punisher turret — these decide teamfights. An ESP that only shows player models misses half the game.
Patch turnaround
Marvel Rivals ships patches every 2-3 weeks. The overlay you bought is worth nothing on patch night.
If you have to manually re-download the loader after every patch, half the customers fail to.
Anti-cheat handling
NEP installs a per-session driver with a random suffix. Without a killer it logs everything you do.
A DLL on disk is forensic evidence. Manual mapping keeps the payload in memory only.
If a researcher (or anti-cheat) can attach a debugger and dump your code, the day-key economy ends.
Loader stealth
Anti-cheats enumerate loaded modules. PEB unlinking keeps the loader off that list.
Leaving the loader on disk after launching the payload is the easiest way for anti-cheat to fingerprint your customers.
A flashing cmd.exe window at launch is a tell, and child-process trees show up in telemetry.
Spoofer
A partial spoofer just hides MachineGuid. Real HWID bans look at 6-8 registry keys plus disk and SMBIOS.
A spoofer that does not also wipe Marvel logs, NEP service install, and Steam cache leaves a forensic trail.
User-mode spoof handles most account bans. Hardware bans need a kernel hook or SMBIOS rewrite.
Customer support
When your build breaks at 11pm on patch night you need a human, not a 24-hour email queue.
When a key gets eaten or a patch day eats your sub time, you need a clear path to a fix — not a one-line FAQ saying "no refunds".
Pricing
A trial costs nothing. A $5 day pass at full feature parity is the honest version of the same idea.
Different play patterns want different commitments. A two-SKU catalog forces overpaying.
Account-binding
Without a HWID lock one paid key gets shared, and the seller bakes the loss into the price for everyone.
Bought a new PC, RMA'd a board, or just want to move between rigs? You should not need to email anyone.
Sources
- [1] Competitor A complete intel inventory (2026-05-26) — internal_intel_doc_A_2026_05_26
- [2] Competitor B global feature inventory (2026-05-29) — internal_intel_doc_B_2026_05_29
- [3] Foreign loader inventory (2026-05-25) — internal_loader_inventory_2026_05_25
- [4] Competitor A live cleaner intel — 32 commands (2026-05-29) — internal_intel_cleaner_round3_2026_05_29
- [5] Competitor B projectile prediction + hitbox feature (2026-05-29) — internal_intel_projectile_2026_05_29
- [6] Competitor A cleaner cmd cascade full (2026-05-29) — internal_intel_cleaner_full_2026_05_29
- [7] Competitor B anti-cheat compatibility patterns (2026-05-29) — internal_intel_ac_offsets_2026_05_29
- [8] Competitor A live inject capture (2026-05-29) — internal_intel_live_inject_2026_05_29
- [9] Competitor A licensing + checkout intel (2026-05-28) — internal_intel_licensing_2026_05_28
- [10] World-object ESP class IDs (2026-05-29) — internal_intel_worldobjects_2026_05_29
We are transparent because we believe customer trust beats misleading claims. Every row above cites the internal intel document we used to score the competitor — and if we could not verify a feature live, we mark it Unknown rather than guessing.