Simple internal C++ cheat for HL2 for GNU/Linux. https://git.2137697.xyz/hl2h/atom?h=master 2026-11-06T15:09:55Z 2026-11-06T15:09:55Z salmonik salmonik@tuta.io 2026-11-06T15:09:55Z urn:sha1:33f5ed9ef58f26c6b3b52cf605dd4311d658a60d Crash/UB: - gate every hook behind an init-stage flag until config/surface/input are ready - publish module maps as immutable atomic snapshots instead of reallocating shared vectors under unlocked readers - validate the %ebp walk in the RandomSeed/RandomFloat hooks against the stack - bounds-check every RecvTable/RecvProp/string dereference with module_range() - preserve the Itanium vtable header when cloning (client, CInput, model render, studio render) - reject negative usercmd sequence numbers; guard config_load against a null section target; cap the bone parent walk; check mprotect; drop PROT_EXEC on the GOT patch; absorb server.so .bss tail Correctness: - filter dormant entities across ESP, aimbot, triggerbot, melee, items and projectiles (slot self-tested against the local player) - reset the server-health latch per map and only latch on valid model indices - bone cache sized for the 128-target scan; set valid=false on every failure; head_position keeps searching past an invalid bone - vischeck steps past glass by probing until clear, and ignores entities owned by the target (held weapons, bone followers) - aimbot: maxs no longer disables it, AABB-aware FOV prefilter, lock hysteresis, lead point re-checked for FOV and visibility - spread: seed hook arms on the no-spread toggle alone; engine toggle only controls the RandomFloat zeroing - resolve m_hOwnerEntity/m_hOwner; NPC lead velocity from the server entity - vector_angles pitch range, point_ground normal test, underwater jump+duck no longer skips combat, semi-auto press/release edge for synthetic fire - item/projectile markers and blast rings refresh origin per frame while discovery stays at 10 Hz; trajectory uses the real m_DmgRadius and honours the blast-radius toggle Rendering/GUI: - one overlay draw per engine frame (FRAME_RENDER_START boundary), fixing alpha stacking and the speed-graph flicker - clipped lines/outlines and ellipsised text instead of drawing past the content pane or shifting over neighbours - dropdown dismissal consumes the click; hover ignores hidden controls - chams: reset AlphaModulate, reference shared materials once, restore prop tint colour; fonts created once per handle - projection uses Source's 4:3 aspect scaling and roll; screen size refreshed each frame; FOV circle gated on the aim toggles, not the bind Performance: - TTL caches for NPC relation, friendly/neutral and damage class - model names memoised per model index - entity pointer -> index cache for the triggerbot (was a 4096-slot walk/tick) Build: - real Makefile with -MMD dependency tracking, debug/release objects and an always-relink rule; build.sh kept as a thin wrapper 2026-11-04T16:51:20Z salmonik salmonik@tuta.io 2026-11-04T16:51:20Z urn:sha1:49df428d95a7c443d418d5b7e2a93af599b54f76 - Hook IVModelRender::DrawModelExecute (VEngineModel016 slot 19) and force models/debug/debugwhite for NPC models, identified by ModelRenderInfo_t::entity_index. - Two passes: MATERIAL_VAR_IGNOREZ through walls, then normal depth, with IMaterial::ColorModulate for the configured colour; restore the shared material's flag/colour afterwards. - Material lookup via the IMaterialSystem list, FindMaterial fallback. - New Chams feature/card with Through walls and colour; [chams] config. - Remove the temporary ammo/projectile/fuse diagnostics. 2026-11-04T16:24:14Z salmonik salmonik@tuta.io 2026-11-04T16:24:14Z urn:sha1:e35f0dc0005139774533504965995da48a3dc90d - Match m_iAmmo/m_hMyWeapons by name prefix so element props such as m_iAmmo[0] are accepted. - Handle them before the nested-table recursion, since RecvPropArray3 may put the element descriptor in m_pDataTable. - Allow name strings outside client.so (engine/server too), and log the first 16 array props plus the first 8 unreadable prop names so the remaining resolution failure is visible in the normal log. 2026-11-04T15:18:21Z salmonik salmonik@tuta.io 2026-11-04T15:18:21Z urn:sha1:c803fd1f425e7ea8e78f83afd481e58326fb1610 m_iAmmo and m_hMyWeapons were not resolving (both -1). Array props keep their element descriptor in m_pArrayProp and its offset can hold the array base; the walker was also treating a non-null m_pDataTable on an array as a nested table and skipping the name match. Process array props by name, use the element offset when present, and log the first 16 array props under HL2H_DEBUG. 2026-11-04T15:11:28Z salmonik salmonik@tuta.io 2026-11-04T15:11:28Z urn:sha1:4019880cf113a2a13460ec8ea5bb30a5c8ed50f3 - Resolve m_iAmmo and m_hMyWeapons arrays from the client recv tables. - "Only if usable" now compares m_iAmmo[type] against sk_max_* (stock caps as fallback: RPG rockets 3, AR2 60, ...). Full ammo hides the pickup, including RPG rockets and fallen weapons converted to ammo. - Inventory now comes from m_hMyWeapons directly, so fallen weapons are ammo before the player equips the matching weapon. - Projection: fall back to local math when ScreenPosition claims "behind" for a point with positive view depth, and build NPC boxes from vertical samples so feet behind the near plane no longer drop the whole target. Log the first 8 near-target projection failures for diagnosis. 2026-11-04T13:28:21Z salmonik salmonik@tuta.io 2026-11-04T13:28:21Z urn:sha1:714262bcf759a238daf906de16e7b204712a104f - Items: "Only if usable" hides health tags at full health and armor at full suit. Health ceiling is the server player's m_iMaxHealth; armor uses the server m_ArmorValue against HL2's 100 cap. Fails open when unreadable. - Projectiles: new Visuals feature/card for thrown grenades, RPG rockets, helicopter bombs and AR2 balls. Fuse from server m_flDetonateTime vs engine time; radius from m_DmgRadius with per-type fallback; optional 24-segment radius ring and FRAG timer label. - Melee: the killbot now handles the gravity gun as well; only VULNERABLE targets, 1200-unit range, primary attack to launch the held object, and no aim-punch compensation because the launch uses EyeVectors. - Server/netvars: m_ArmorValue, m_flDetonateTime, m_DmgRadius. 2026-11-04T12:53:45Z salmonik salmonik@tuta.io 2026-11-04T12:53:45Z urn:sha1:12fde50efc7e1f1d123f9fc34ffef53d4387de2d - ESP: alert state (IDLE/ALERT/COMBAT/SCRIPT), enemy weapon labels, hostile/ neutral/friendly colour pickers, off-screen direction arrows, and trigger_changelevel volumes with next/previous map labels. - Aim: silent aim reuses the Aimbot FOV, vischeck and bone settings; add optional aim-punch compensation for aimbot, silent aim, triggerbot and melee (server bullets add m_vecPunchAngle to the usercmd angles). - View: always-on Camera / display card with camera FOV (writes the client m_iDefaultFOV netvar), viewmodel FOV and monitor gamma (client cvars). - Movement: Jump assist card with auto crouch-jump and edge jump (point ground probe 0.12 s ahead). - Spread: Engine spread override toggle gates the direct RandomFloat zeroing; off leaves only the seed search. - Server: entity count/base/classname helpers, trigger_changelevel map name and world bounds via IServerUnknown/ICollideable. - Netvars: m_vecPunchAngle and m_iDefaultFOV. 2026-11-04T10:39:18Z salmonik salmonik@tuta.io 2026-11-04T10:39:18Z urn:sha1:b287fc803c73d3ae076c49d726e17e13faa15050 Hooking IStudioRender's draw/setter slots made matched props render the error material and then crashed the material system ("debug/modelstats has bad reference count 0 when being bound"). Keep the hook code for reference but do not install it. Fix the m_clrRender netvar resolution: the walk picked an embedded table entry at offset 0, so the earlier entity writes stomped entity vtables. Only accept offsets inside C_BaseEntity (0x20..0x2000), then write the prop colour there for models/props entities. Restore white when disabled. 2026-11-04T00:13:09Z salmonik salmonik@tuta.io 2026-11-04T00:13:09Z urn:sha1:b9d5965c0366fd7777c3627b9fbf89c8526ac0ec Prop model materials (VertexLitGeneric) ignore IMaterial::ColorModulate: the engine feeds StudioRender the per-entity render colour (m_clrRender) on every draw, so the material-side tint never showed on crates and other props. Resolve m_clrRender from DT_BaseEntity and, every 10 ms while World tint and Props are enabled, write the prop colour into every entity whose model is under models/props. Restore white once when disabled. 2026-11-03T21:37:33Z salmonik salmonik@tuta.io 2026-11-03T21:37:33Z urn:sha1:e9a32c69ca2b8d85276c71a7880de0782b8bced7