KY-GamePlayer — KodYazar Client
Desktop Discord panel: Rich Presence, 24k-game catalog, quests, HypeSquad, science hours.
Rendered from the real UI with synthetic demo data.
Author : Batuhan (KodYazicam)
Project: KY-GamePlayer (KodYazar Client)
Source : https://github.com/KodYazicam/KY-GamePlayer
KYAL-1.0 — free to use and modify. Attribution is mandatory in LICENSE, this README, and any public product that ships this code. Example credit: Powered by KY-GamePlayer — KodYazicam.
Not on PyPI. Clone the repo. Discord Stable / Canary / PTB / Vesktop / Vencord on Linux, Windows, macOS.
This is a local user client. It reads the already-logged-in Discord token on this machine and talks to Discord IPC + API v9. It does not send credentials to KodYazicam. Unofficial user-token automation can violate Discord’s terms — you run it at your own risk. See SECURITY.md.
- What this is (and is not)
- Feature surface
- Requirements
- Install and first boot
- Windows EXE and antivirus
- Membership lock
- Tabs
- Games / Rich Presence
- Science farm
- Quests
- Account, badges, privacy
- Data on disk
- Keyboard
- Project layout
- Development plan
- Tests and CI
- Troubleshooting
- FAQ
- License
Long form:
- Install per OS →
docs/install.md - Every control →
docs/features.md - Boot / threads / IPC →
docs/architecture.md - REST + science events →
docs/discord.md - JSON schemas / paths →
docs/data.md - Failures →
docs/troubleshooting.md - Roadmap copy →
docs/roadmap.md
Is: a PySide6 desktop app named KodYazar Client. After you join the KodYazar Discord server, it can:
- Set Discord Rich Presence from Discord’s detectable game catalog (24 314 titles in
games.json) - Detect a running
.exe/ binary and push that game as Playing - Rotate games (random + weights), cycle details/state text, schedule hours, pin extra IPC slots
- Join/leave HypeSquad houses, set profile visibility, custom status, clan tag
- List and complete accepted Discord Quests (video ticks / play-stream heartbeats)
- POST Discord
/sciencelaunch + heartbeat events so “hours played” / “games played” counters can move
Is not: a Discord bot, a hosted SaaS, a game launcher, a cheat client, or a way to obtain Staff/Partner/Bug Hunter badges. Gift/Nitro milestone art is a catalog, not an unlocker.
| Area | What ships in 1.2.0 |
|---|---|
| Shell | Dark theme (design tokens + app-wide style sheet), tray, single instance, TR/EN, autostart (Linux/Windows/macOS) |
| Lock | Harvest token from Discord/Vesktop Local Storage; optional paste; guild membership required |
| Games | Search, theme/store/OS/icon/cover/overlay filters, favorites, playlist, exclude, weights |
| RPC | Playing/Streaming/Listening/Watching/Custom/Competing, assets, party, buttons xor secrets, flags |
| Detect | Process scan every 5 s; Proton/Wine exe tokens; PID fill |
| Responsiveness | REST, credential harvest and process scans run off the GUI thread (ui/tasks.py) |
| Secrets | Keyring (Secret Service / Keychain) on Linux/macOS; DPAPI on Windows |
| Random | Weighted pool, no-repeat N, countdown, Ctrl+R |
| Extras | Up to 8 extra IPC connections (Vesktop may stack; official Discord shows one Playing) |
| Cycle / schedule | Line-based frames; time window; idle clear; auto-reconnect |
| Science | Hours or “played 1 min”; batch/delay/jitter; pull credentials; DPAPI on Windows; dry-run; 2000-game hard cap with confirm |
| Quests | Scan, enroll, video 1 s, heartbeat ~20 s, claim |
| Badges | HypeSquad apply/leave; owned flags; gift/Nitro catalog |
| Privacy | Private / limited / public cards |
| Account | Custom status, clan/primary guild, entitlement count |
| Editor | Per-game templates, Spotify-style Listening helper, script hooks (.py returning ActivityConfig) |
| Settings | Help tab: log level, credential harvest on/off, membership lock timeout; window geometry persisted |
| Packaging | kurulum.bat / windows.bat; onedir + optional onefile PyInstaller; macOS .app; catalog_sync CLI |
- Python 3.11+
PySide6>=6.6,<7cryptography>=42(Chromium cookiev10/v11AES-GCM)keyring>=24on Linux/macOS (token storage;KODYAZAR_NO_KEYRING=1disables it)- Discord desktop (or Vesktop / Vencord) running for IPC
- Membership in KodYazar Client (
1549516395010854912)
Chrome App-Bound cookies (v20) are not decrypted. Paste cookie if harvest fails.
git clone https://github.com/KodYazicam/KY-GamePlayer.git
cd KY-GamePlayer
python3 -m pip install -r requirements.txt
python3 run.pyWindows:
- Release zip: Releases → unzip the whole folder →
KodYazar\KodYazar.exe(leave_internalnext to it). SmartScreen may warn; that is expected — see Windows EXE and antivirus. - From source:
kurulum.batonce, thenwindows.bat. - Local EXE:
packaging\windows\build.bat→dist\KodYazar\KodYazar.exe.
macOS: same pip + run.py. Token/IPC under Application Support / tmp.
First boot:
- Open Discord and log in.
- Join https://discord.gg/rS42FCPfKZ
- Start this app. Lock harvests the token. Paste if files are locked.
- Main UI unlocks only when the account is in the guild.
Ctrl+C / SIGTERM quit. Close-to-tray when a tray icon exists.
Full OS notes: docs/install.md.
The GitHub Release is an unsigned PyInstaller folder, not a signed installer from Microsoft Store. Windows has never seen this publisher, so SmartScreen / Defender often say “Windows protected your PC” or quarantine the file. That is normal for this kind of build. It is not a signature from us that the file is malware, and it is not a signature that it is perfectly clean either.
If you do not want to trust a packed exe, skip the zip. Clone this repo and run python run.py (or kurulum.bat / windows.bat). Same program, no packer.
We uploaded both the zip and KodYazar.exe. They are scored separately:
| What you download | Score | Link |
|---|---|---|
| The zip | 0 / 66 | analysis |
KodYazar.exe inside it |
3 / 65 | detection · behavior |
0/66 on the zip does not mean the exe is clean. VirusTotal looked at the container. Windows looks at the PE. Use the exe row.
The three flags on the exe:
- Microsoft —
Trojan:Win32/Wacatac.B!ml
The!mlmeans machine learning, not a hand-written signature. Microsoft uses this label a lot on unsigned, packed programs. It is a generic bucket, not “we identified KodYazar as Wacatac.” - Arctic Wolf —
Unsafe(no family name) - SecureAge —
Malicious(no family name)
Kaspersky, ESET, Bitdefender, Malwarebytes, CrowdStrike, ClamAV, Avast, Sophos, Symantec did not flag it. VirusTotal’s headline “trojan” is just those three rows rolled into a word.
Then the sandboxes ran it (CAPE and Zenbox). That report is the useful one:
- no extra files dropped
- no network connections
- no IDS / Sigma hits
- the only process was
KodYazar.exeitself
What did look “weird” to static engines is the overlay: about 1.8 MB of high-entropy bytes stuck on the end of the PE (entropy ~8.0). That is how PyInstaller ships the Python payload. Heuristics read “packed / obfuscated” and stop there. The compile time on the PE is 17 Sep 2026 19:26 UTC — the same minute GitHub Actions built it.
Hashes so you can check the bytes yourself: docs/HASHES-v1.0.0.md.
- Prefer source (
python run.py) if you can. - If you use the zip: keep
_internalbeside the exe. Copying onlyKodYazar.exeto the Desktop is how the sandbox looked — the app cannot find Qt orgames.json. - SmartScreen: More info → Run anyway. Defender: restore from quarantine if you decided to trust this repo.
We will not paste a fake “0/70” badge. Those numbers change every reanalyze.
brand.py constants:
| Guild | KodYazar Client |
| Id | 1549516395010854912 |
| Invite | https://discord.gg/rS42FCPfKZ |
Check: GET /users/@me then paginated /users/@me/guilds, fallback guild member routes. Timeout 20 s. Changing the guild means changing brand.py and this README together.
Order in the window:
- Rozet kontrol / Badge control — Bravery / Brilliance / Balance
- Tüm rozetler / All badges — catalog + owned flags
- Oyun menüsü / Games — catalog + RPC editor (the large tab)
- Profil gizliliği / Profile privacy
- Görevler / Quests
- Hesap / Account
- Yardım / Help
Every widget: docs/features.md.
games.json is Discord’s detectable list (24 314 games, ~12.7 MB). Each row is an application id you handshake as client_id.
The Games tab keeps the common path short: search, scope chips and the list, with filters and technical details folded away. The editor on the right is split into Yayın / Presence, Gelişmiş / Advanced, Otomasyon / Automation, Bilim / Science and Günlük / Log sub-tabs, so the presence basics are not buried in a 12-group form.
Connect talks Discord RPC:
- Windows
\\.\pipe\discord-ipc-0…-9 - Linux
$XDG_RUNTIME_DIR/discord-ipc-Nplus Flatpak/Snap/Vesktop subdirs - macOS tmp + Application Support
SET_ACTIVITY payload is built in activity.ActivityConfig (type, details/state + URLs, timestamps, assets, party, buttons or secrets, flags, emoji, instance). Preview paints a Discord-like card.
Detect maps running process names to executables[] (launchers skipped).
Not Rich Presence. POST https://discord.com/api/v9/science with launch_game + running_game_heartbeat events, using analytics_token from GET /users/@me?with_analytics_token=true.
| Mode | Effect |
|---|---|
| Saat ekle / Add hours | duration_tracked_ms = hours × 3600 × 1000 |
| Oynandı / Played | 60 s duration; successful ids stored in profiles.json played |
Needs token + cookie. Fingerprint (executable_fingerprint) from Discord’s own detect improves counters. Autonomous checkboxes fire on RPC update / random / detect. Do not blast all 24k games without reading docs/discord.md and Discord’s terms.
Safety rails: dry-run builds and logs events without POSTing, and sources larger than 2000 games (e.g. “all”) require a confirm dialog — the engine itself refuses to exceed the cap without explicit confirmation. The identity-tab fingerprint capture button copies the value from Discord’s own disk state.
Credentials: science_state.json (Windows DPAPI KY1\x00 prefix; on Linux/macOS the secrets live in the OS keyring, the file keeps mode 0600).
GET /quests/@me. Supported tasks: WATCH_VIDEO, WATCH_VIDEO_ON_MOBILE, PLAY_ON_DESKTOP, STREAM_ON_DESKTOP, PLAY_ACTIVITY. Video ≈ 1 s ticks. Play/stream ≈ 20 s heartbeats with stream_key from a DM. Then claim-reward fallbacks. Accept the quest in Discord Quest Home first.
- HypeSquad:
POST/DELETE /hypesquad/online - Privacy cards: profile_visibility + friend_source_flags
- Custom status + clan / primary guild
- Entitlements length (Orbs balance stays in Discord’s wallet)
- Badge tab explains Staff/Partner/etc. — this app cannot grant them
| Config | Cache / log | |
|---|---|---|
| Windows | %APPDATA%\kodyazar |
%LOCALAPPDATA%\kodyazar |
| Linux | ~/.config/kodyazar |
~/.cache/kodyazar |
| macOS | ~/Library/Application Support/kodyazar |
~/Library/Caches/kodyazar |
| File | Sensitivity |
|---|---|
science_state.json |
High — token, cookie, analytics in the OS keyring; fingerprint in the file |
profiles.json |
RPC presets, favorites, settings (no token) |
logs/kodyazar-YYYYMMDD.log |
IPC / quest / science status |
cdn/ |
Downloaded PNG icons |
Schemas: docs/data.md.
| Shortcut | Action |
|---|---|
| Ctrl+R | Random game now |
| Ctrl+U | Update RPC |
| Ctrl+L | Clear activity |
| Ctrl+P | Pin extra IPC slot |
| Ctrl+D | Scan processes |
| Ctrl+F | Toggle favorite |
| Ctrl+Shift+S | Fill store button from SKU |
KY-GamePlayer/
run.py CLI entry
games.json Discord detectables (~24k)
requirements.txt
pyproject.toml name kodyazar-client, script kodyazar
kurulum.bat / windows.bat
kodyazar.desktop.in
ky_gameplayer/ package — see ky_gameplayer/README.md
ui/ window mixins, theme, async TaskRunner
assets/ app icons
packaging/windows/ PyInstaller
tests/ Qt-free unittest
docs/ manuals
Full checklist: docs/roadmap.md. Short version:
| Stage | Goal |
|---|---|
| 1.1.0 | Catalog sync CLI, Linux desktop install without rewriting git files, macOS .app, optional one-file EXE, settings block (log level / harvest / lock timeout), persisted window geometry, per-game templates, Listening helper, script hooks, science dry-run + 2000-game confirm cap, fingerprint capture button, rate-limit dashboard, social preview. |
| 1.2.0 now | MainWindow split into ky_gameplayer/ui/, blocking REST/harvest moved off the GUI thread, modern theme, keyring on Linux/macOS, per-game search cache, CI on 3.14 + lint + offscreen Qt + Windows. |
| 1.3 | Asset browser UI (REST call landed), image upload helper, extra-slot UX when official Discord cannot stack, quest types beyond video/play/stream |
| 2.0 | Multi-account identity files, signed binaries. No telemetry unless opt-in |
Out of scope: v20 cookie decrypt, hosting tokens, bot-token mode, fake Staff badges.
python -m compileall -q ky_gameplayer run.py tests
python -m unittest discover -s tests -vGitHub Actions: unit tests on Python 3.11 / 3.12 / 3.13 / 3.14, ruff, an offscreen PySide6 job (TaskRunner + window smoke test) and a Windows job. Tests cover activity JSON, catalog load/sync and search, science helpers and dry-run, quest parse, profiles and game templates, detect matching, script hooks, rate-limit counters, translations and keyring storage.
IPC missing, cookie v20, membership fail, science 401, quest stuck: docs/troubleshooting.md.
Quick hits:
- Discord must be open before Bağlan
- Join the guild on the same account as the harvested token
- WSL cannot see Windows named pipes — run on Windows
- Copy the whole
dist\KodYazarfolder, not only the exe - SmartScreen on the release zip: unsigned PyInstaller — Windows EXE and antivirus
Why harvest a user token? So HypeSquad, quests, science, and membership work as the logged-in desktop user. The token never leaves this machine except toward discord.com.
Why a guild lock? Product gate for KodYazar Client. Forks can change brand.py.
Can I use a custom Application ID? Yes — type it in Identity. Verified catalog games ignore custom name.
Does extra pin show two games? Official Discord: no. Vesktop/arRPC: maybe.
Is games.json complete? It is Discord’s detectable dump at ship time. Nothing updates in the background. Open Games → Kataloğu güncelle / Update catalog to download the official list, review the added/removed/changed preview and confirm. The update is written to your user config (config_dir()/games.json), never over the packaged file, and the previous catalog is kept as games.json.bak; Yedeğe dön / Restore switches back.
The same flow is available without opening the window:
python -m ky_gameplayer.catalog_sync --check # compare, no write
python -m ky_gameplayer.catalog_sync # download + atomic write to user config (`.bak` kept)
python -m ky_gameplayer.catalog_sync --restore # restore games.json.bakVirusTotal says 3 vendors flagged the exe. Is it malware? We are not going to say “no” as a slogan. We will say what the report actually contains: three generic ML/heuristic labels, no family name, and a sandbox that did not drop files or open the network. If you do not want a packed binary, run python run.py from this tree.
See LICENSE. Keep the attribution block above in forks and public binaries.