Skip to content

Commit 808bf76

Browse files
JulianOzelRoseJulianOzelRose
authored
Update offsets and info in README.md
1 parent 3b24194 commit 808bf76

File tree

1 file changed

+56
-54
lines changed

1 file changed

+56
-54
lines changed

‎README.md‎

Lines changed: 56 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,16 @@ details about reversing the game as well as offset tables.
1010

1111
## Installation and use
1212
To download this hack, navigate to the [build](https://github.com/JulianOzelRose/CSS-MultiHack-Internal/tree/master/CSS-MultiHack-Internal/build)
13-
folder, then download ```CSS-MultiHack-Internal.dll```. You will then need to use a DLL injector.
13+
folder, then download `CSS-MultiHack-Internal.dll`. You will then need to use a DLL injector.
1414
I recommend using [this one](https://guidedhacking.com/resources/guided-hacking-dll-injector.4/).
1515
Once you have the injector, select the process for Counter-Strike: Source, then open the DLL,
1616
then press inject. The multihack should then be running. From the menu, you can toggle the different
17-
features on or off. To run the aimbot, press the ```V``` key. To hide the menu, press the ```INSERT``` Key.
18-
To unload the hack, press the ```END``` key on your numpad.
17+
features on or off. To run the aimbot, press the `V` key. To hide the menu, press the `INSERT` Key.
18+
To unload the hack, press the `END` key on your numpad.
1919

2020
## Warning
2121
This program reads and modifies memory internally. If you use it on a VAC-secured server,
22-
you will be banned. To prevent this, be sure to add the ```-insecure``` flag to your
22+
you will be banned. To prevent this, be sure to add the `-insecure` flag to your
2323
game's launch options. You can find this menu by right-clicking on your game from Steam,
2424
then going to Properties. You can then safely play against bots without worrying
2525
about catching a VAC ban.
@@ -30,92 +30,95 @@ https://github.com/JulianOzelRose/CSS-MultiHack-Internal/assets/95890436/4f6940c
3030

3131
## Bunnyhop
3232
The bunnyhop hack is relatively straightforward. It works by first checking for ground flags. If the player
33-
is on the ground or crouching, it forces a jump by setting ```m_dwForceJump``` to 6. When in the air,
33+
is on the ground or crouching, it forces a jump by setting `m_dwForceJump` to 6. When in the air,
3434
the force jump variable resets. The result is perfectly timed jumps every time.
3535

3636
```
37+
const int FLAG_STANDING = 257;
38+
const int FLAG_ONGROUND = 263;
39+
const int JUMP_PRESS = 6;
40+
3741
void Bunnyhop(uintptr_t client, uintptr_t localPlayer)
3842
{
3943
if (GetAsyncKeyState(VK_SPACE))
4044
{
4145
int flag = *reinterpret_cast<std::uint32_t*>(localPlayer + offset::m_fFlags);
4246
43-
if (flag == 257 || flag == 263)
47+
if (flag == FLAG_STANDING || flag == FLAG_ONGROUND)
4448
{
45-
*reinterpret_cast<uint32_t*>(client + offset::m_dwForceJump) = 6;
49+
*reinterpret_cast<uint32_t*>(client + offset::m_dwForceJump) = JUMP_PRESS;
4650
}
4751
}
4852
}
4953
```
5054

5155
## Anti-flash
52-
For anti-flash, there are 2 relevant variables to be changed; ```m_flFlashMaxAlpha```
53-
determines how bright the flashbang's blinding effect is, and ```m_flFlashMaxDuration``` determines
54-
how long the flashbang's effect lasts. Setting them to 0 will nullify the flashbang's blinding effect.
55-
56+
For anti-flash, there are 2 relevant variables; `m_flFlashMaxAlpha`
57+
determines how bright the flashbang's blinding effect is, and `m_flFlashMaxDuration` determines
58+
how long the flashbang's effect lasts. Just setting `m_flFlashMaxAlpha` to 0 is sufficient to nullify the flashbang's blinding effect.
5659
```
5760
void AntiFlash(uintptr_t localPlayer)
5861
{
5962
float flashMaxAlpha = *reinterpret_cast<float*>(localPlayer + offset::m_flFlashMaxAlpha);
60-
float flashMaxDuration = *reinterpret_cast<float*>(localPlayer + offset::m_flFlashMaxDuration);
6163
6264
if (flashMaxAlpha > 0.0f)
6365
{
6466
*reinterpret_cast<float*>(localPlayer + offset::m_flFlashMaxAlpha) = 0.0f;
6567
}
66-
67-
if (flashMaxDuration > 0.0f)
68-
{
69-
*reinterpret_cast<float*>(localPlayer + offset::m_flFlashMaxDuration) = 0.0f;
70-
}
7168
}
7269
```
7370

7471
## Triggerbot
75-
The triggerbot uses ```m_iCrosshairId``` to determine what entity is in the player's
72+
The triggerbot uses `m_iCrosshairId` to determine what entity is in the player's
7673
crosshairs. A value of 0 means no entity. A non-zero value could mean another player,
77-
or it could mean a barrel. To prevent the triggerbot from firing at barrels, the
74+
or it could mean a physics object. To prevent the triggerbot from firing at physics objects, the
7875
crosshair ID condition should be capped at 64. Once an entity is detected in the crosshairs,
7976
a check is performed to ensure the entity is on the opposing team. Then, an attack is forced
80-
by setting ```m_dwForceAttack``` to 5. After a delay, this variable needs to be set back to
77+
by setting `m_dwForceAttack` to 5. After a delay, this variable needs to be set back to
8178
its default value of 4, or only 1 shot will be fired.
8279
```
80+
const int MAX_PLAYERS = 64;
81+
const int ATTACK_PRESS = 5;
82+
const int ATTACK_RELEASE = 4;
83+
8384
void Triggerbot(uintptr_t client, uintptr_t localPlayer)
8485
{
85-
int crosshairId = *reinterpret_cast<uint32_t*>(localPlayer + offset::m_iCrosshairId);
86+
uint32_t crosshairId = *reinterpret_cast<uint32_t*>(localPlayer + offset::m_iCrosshairId);
8687
87-
if (crosshairId != 0 && crosshairId <= 64)
88+
if (crosshairId == 0 || crosshairId > MAX_PLAYERS)
8889
{
89-
uintptr_t targetEntity = *reinterpret_cast<std::uintptr_t*>(client + (offset::m_dwEntityList + (crosshairId - 1) * 0x10));
90+
return;
91+
}
92+
93+
uintptr_t targetEntity = *reinterpret_cast<std::uintptr_t*>(client + (offset::m_dwEntityList + (crosshairId - 1) * 0x20));
9094
91-
if (targetEntity)
95+
if (targetEntity)
96+
{
97+
uint32_t targetTeam = *reinterpret_cast<uint32_t*>(targetEntity + offset::m_iTeamNum);
98+
uint32_t playerTeam = *reinterpret_cast<uint32_t*>(localPlayer + offset::m_iTeamNum);
99+
100+
if (playerTeam != targetTeam)
92101
{
93-
int targetTeam = *reinterpret_cast<uint32_t*>(targetEntity + offset::m_iTeamNum);
94-
int playerTeam = *reinterpret_cast<uint32_t*>(localPlayer + offset::m_iTeamNum);
102+
uint32_t attackFlag = *reinterpret_cast<uint32_t*>(client + offset::m_dwForceAttack);
95103
96-
if (playerTeam != targetTeam)
104+
if (attackFlag == ATTACK_RELEASE)
97105
{
98-
int attackFlag = *reinterpret_cast<uint32_t*>(client + offset::m_dwForceAttack);
99-
100-
if (attackFlag == 4)
101-
{
102-
*reinterpret_cast<uint32_t*>(client + offset::m_dwForceAttack) = 5;
103-
std::this_thread::sleep_for(std::chrono::milliseconds(1));
106+
*reinterpret_cast<uint32_t*>(client + offset::m_dwForceAttack) = ATTACK_PRESS;
107+
std::this_thread::sleep_for(std::chrono::milliseconds(1));
104108
105-
*reinterpret_cast<uint32_t*>(client + offset::m_dwForceAttack) = 4;
106-
std::this_thread::sleep_for(std::chrono::milliseconds(1));
107-
}
109+
*reinterpret_cast<uint32_t*>(client + offset::m_dwForceAttack) = ATTACK_RELEASE;
110+
std::this_thread::sleep_for(std::chrono::milliseconds(1));
108111
}
109112
}
110113
}
111114
}
112115
```
113116

114117
## Aimbot
115-
The aimbot works by first iterating through the entity list. Each entity is 0x10 bytes apart,
116-
so you must use 0x10 as the iterator. Then, the aimbot checks to ensure that the entity
118+
The aimbot works by first iterating through the entity list. Each entity is 0x20 bytes apart,
119+
so you must use 0x20 as the iterator. Then, the aimbot checks to ensure that the entity
117120
is on the opposing team and is alive. Lastly, it performs calculations using trigonometry
118-
to get the ideal angles, and updates the player's view angles, ```m_angRotation```, to focus on the
121+
to get the ideal angles, and updates the player's view angles, `m_angRotation`, to focus on the
119122
closest enemy's head. Credit goes to [Guided Hacking](https://guidedhacking.com/) for the aimbot formula.
120123
```
121124
void CalcAngle(float* src, float* dst, float* angles)
@@ -141,33 +144,32 @@ void CalcAngle(float* src, float* dst, float* angles)
141144
Unfortunately, there is no offset dumper for CS:S that I am aware of. However, it
142145
is possible to configure [hazedumper](https://github.com/frk1/hazedumper) with CS:S
143146
offset signatures and get it to dump offsets that way. Below are the offsets I used
144-
for this trainer. Note that the offsets for ```CBaseEntity``` are located on ```client.dll```.
147+
for this trainer. Note that the offsets for `CBasePlayer` are located on `client.dll`.
145148

146149
### CBasePlayer ###
147150
| Offset | Type | Variable |
148151
| --------------- | --------------- | -------------------- |
149-
| 0x0094 | Integer | m_iHealth |
150-
| 0x009C | Integer | m_iTeamNum |
151-
| 0x0290 | Float | m_vecOrigin |
152-
| 0x0350 | Float | m_fFlags |
153-
| 0x0D80 | Integer | m_hActiveWeapon |
154-
| 0x0E48 | Float | m_vecPunchAngle |
155-
| 0x144C | Float | m_flFlashMaxAlpha |
156-
| 0x1450 | Float | m_flFlashMaxDuration |
157-
| 0x14F0 | Integer | m_iCrosshairId |
152+
| 0x00D0 | Int32 | m_iHealth |
153+
| 0x00D8 | Int32 | m_iTeamNum |
154+
| 0x0320 | Float32 | m_vecOrigin |
155+
| 0x0440 | Float32 | m_fFlags |
156+
| 0x1A54 | Float32 | m_flFlashMaxAlpha |
157+
| 0x1A4C | Float32 | m_flFlashMaxDuration |
158+
| 0x1B20 | Int32 | m_iCrosshairId |
158159

159160
### client.dll ###
160161
| Offset | Type | Variable |
161162
| --------------- | --------------- | -------------------- |
162-
| 0x4C88E8 | Pointer | m_dwLocalPlayer |
163-
| 0x4F5D24 | DWORD | m_dwForceJump |
164-
| 0x4F5D30 | DWORD | m_dwForceAttack |
163+
| 0x5F4B68 | Pointer | m_dwLocalPlayer |
164+
| 0x6098C8 | Pointer | m_dwEntityList |
165+
| 0x677300 | DWORD | m_dwForceJump |
166+
| 0x677310 | DWORD | m_dwForceAttack |
165167

166168
### engine.dll ###
167169
| Offset | Type | Variable |
168170
| --------------- | --------------- | -------------------- |
169-
| 0x47C33C | Float | m_angRotation |
170-
| 0x5EC82C | Integer | m_iNumPlayers |
171+
| 0x53E4E4 | Float32 | m_angRotation |
172+
| 0x6DA960 | Int32 | m_iNumPlayers |
171173

172174
## Sources
173175
I used the following sources to guide me through the creation of this trainer. The

0 commit comments

Comments
 (0)