Simple internal C++ cheat for HL2 for GNU/Linux. https://git.2137697.xyz/hl2h/atom?h=master 2026-11-06T15:09:55Z 2026-11-06T15:09:55Z salmonik salmonik@tuta.io 2026-11-06T15:09:55Z urn:sha1:33f5ed9ef58f26c6b3b52cf605dd4311d658a60d Crash/UB: - gate every hook behind an init-stage flag until config/surface/input are ready - publish module maps as immutable atomic snapshots instead of reallocating shared vectors under unlocked readers - validate the %ebp walk in the RandomSeed/RandomFloat hooks against the stack - bounds-check every RecvTable/RecvProp/string dereference with module_range() - preserve the Itanium vtable header when cloning (client, CInput, model render, studio render) - reject negative usercmd sequence numbers; guard config_load against a null section target; cap the bone parent walk; check mprotect; drop PROT_EXEC on the GOT patch; absorb server.so .bss tail Correctness: - filter dormant entities across ESP, aimbot, triggerbot, melee, items and projectiles (slot self-tested against the local player) - reset the server-health latch per map and only latch on valid model indices - bone cache sized for the 128-target scan; set valid=false on every failure; head_position keeps searching past an invalid bone - vischeck steps past glass by probing until clear, and ignores entities owned by the target (held weapons, bone followers) - aimbot: maxs no longer disables it, AABB-aware FOV prefilter, lock hysteresis, lead point re-checked for FOV and visibility - spread: seed hook arms on the no-spread toggle alone; engine toggle only controls the RandomFloat zeroing - resolve m_hOwnerEntity/m_hOwner; NPC lead velocity from the server entity - vector_angles pitch range, point_ground normal test, underwater jump+duck no longer skips combat, semi-auto press/release edge for synthetic fire - item/projectile markers and blast rings refresh origin per frame while discovery stays at 10 Hz; trajectory uses the real m_DmgRadius and honours the blast-radius toggle Rendering/GUI: - one overlay draw per engine frame (FRAME_RENDER_START boundary), fixing alpha stacking and the speed-graph flicker - clipped lines/outlines and ellipsised text instead of drawing past the content pane or shifting over neighbours - dropdown dismissal consumes the click; hover ignores hidden controls - chams: reset AlphaModulate, reference shared materials once, restore prop tint colour; fonts created once per handle - projection uses Source's 4:3 aspect scaling and roll; screen size refreshed each frame; FOV circle gated on the aim toggles, not the bind Performance: - TTL caches for NPC relation, friendly/neutral and damage class - model names memoised per model index - entity pointer -> index cache for the triggerbot (was a 4096-slot walk/tick) Build: - real Makefile with -MMD dependency tracking, debug/release objects and an always-relink rule; build.sh kept as a thin wrapper 2026-11-05T17:09:43Z salmonik salmonik@tuta.io 2026-11-05T17:09:43Z urn:sha1:a5d732920bd56c96e85db1ce2073bebf53e6b1ea The health charger's candidate m_iJuice offset (0x3c8) read 0 on a full charger, so the empty-hide made health chargers disappear entirely. Restrict the hide to suit chargers (verified 0x47c) until the health offset is confirmed; health chargers stay visible. Classify with the server class name when the client class is generic, accept `healthcharger` in the health branch (maps use item_healthcharger / CNewWallHealth, not the func_healthcharger brush), and log up to eight `juice:` lines with the class and both candidate offsets/values. 2026-11-04T22:46:58Z salmonik salmonik@tuta.io 2026-11-04T22:46:58Z urn:sha1:a224cc451233a487a3d931954b125f6e1736e710 - Prefer the local player's thrown frag over the pre-throw estimate: resolve CBaseGrenade::m_hThrower from the server datamap (client owner handles as fallback), then seed the prediction from the live origin/velocity. The real frag is a spinning VPhysics box with a random Y angular impulse, so bounce points remain approximate; the doc now says so. - Keep 512 path points sampled every other 20 ms step (up to 24 s) instead of 127 points / ~2.5 s, so the line reaches the landing instead of stopping in mid-air. - Radius rings use 36 segments; a segment whose near-plane-clipped endpoint the engine overlay refuses falls back to the local projection, and that projection now uses the configured camera FOV instead of a hardcoded 75 degrees (the wide-FOV ring no longer kinks/drops pieces). 2026-11-04T22:32:00Z salmonik salmonik@tuta.io 2026-11-04T22:32:00Z urn:sha1:80a287910f3f77519c8243ba5f53d9c877fbddcb CWallHealth derives CBaseToggle and CNewRecharge derives CBaseAnimating, so m_iJuice is at different offsets (0x3c8 and 0x47c here). Collect every m_iJuice datamap match, derive the suit offset from m_iMaxJuice-20, and pick by the server class name. Also detect health brushes via wallhealth/recharge rather than the ESP label. Verified the offsets resolve distinctly on :99. 2026-11-04T22:26:53Z salmonik salmonik@tuta.io 2026-11-04T22:26:53Z urn:sha1:074e315c8550712dce0c7b530a90eee6aca29e63 - Projectiles gets a "Grenade trajectory" toggle. While a frag grenade is held, simulate the weapon_frag throw (1200 u/s forward + 120 z, player velocity, gravity 600) and trace each step with a new trace_solid_segment(); reflect on impact, stop on a slow upward-normal hit, and draw the path, landing cross and a 300-unit blast ring. Verified on :99 (arcs, bounces off the tunnel wall, lands). - With the RPG equipped, armoured NPCs (striders, gunships, dropships, hunter-choppers) sort before normal enemies during target acquisition. Added helicopter/chopper to the ARMORED model list. - Empty health/suit chargers are hidden: read m_iJuice from the server datamap (0 = depleted, -1 = unreadable/fail open). - The citadel supercharged gravity gun (d3_citadel_03, d3_citadel_04, d3_breen_01 via IVEngineClient::GetLevelName) is treated as a normal weapon, so the melee aimbot no longer restricts it to VULNERABLE NPCs. 2026-11-04T16:51:20Z salmonik salmonik@tuta.io 2026-11-04T16:51:20Z urn:sha1:49df428d95a7c443d418d5b7e2a93af599b54f76 - Hook IVModelRender::DrawModelExecute (VEngineModel016 slot 19) and force models/debug/debugwhite for NPC models, identified by ModelRenderInfo_t::entity_index. - Two passes: MATERIAL_VAR_IGNOREZ through walls, then normal depth, with IMaterial::ColorModulate for the configured colour; restore the shared material's flag/colour afterwards. - Material lookup via the IMaterialSystem list, FindMaterial fallback. - New Chams feature/card with Through walls and colour; [chams] config. - Remove the temporary ammo/projectile/fuse diagnostics. 2026-11-04T16:41:53Z salmonik salmonik@tuta.io 2026-11-04T16:41:53Z urn:sha1:f4616119c64ddcaa14cf10727e7aba4a3e64910f The datamap offset points at the array length header, so every ammo count was read one type early. That made the RPG slot read the buckshot count (30) and permanently exceed the 3-rocket cap, which is why RPG pickups never showed and grenades/AR2/weapon ammo never hid. Read the elements 4 bytes after the field offset. 2026-11-04T16:25:31Z salmonik salmonik@tuta.io 2026-11-04T16:25:31Z urn:sha1:710e8cc59557bc95ed74af8726ea13012fde50c3 The client m_iAmmo/m_hMyWeapons recv props still do not resolve, but the listen server has the same CBaseCombatCharacter arrays in its datamap. Resolve m_iAmmo and m_hMyWeapons there: - reserve ammo comes from server_player_ammo() when the client array is missing, so full-ammo filtering works (RPG rockets at 3); - the owned-weapon mask is filled from the server m_hMyWeapons[48] handles, so fallen weapons count as ammo before the player equips them. Widen the datamap field-size filter to 512 for the 192-byte handle array. 2026-11-04T14:55:08Z salmonik salmonik@tuta.io 2026-11-04T14:55:08Z urn:sha1:1267387f58d41d1421e3c2122a6930de0b279d12 - World weapons of a type already in the local player's inventory are retagged as ammo ("SMG ammo", ...). Inventory scan only counts weapons owned by the local player index, so NPC weapons do not trigger it. - Projectile fuse: log det/cur/base/raw server value, and fall back to a 3-second first-sighting countdown when m_flDetonateTime or engine time is unavailable. 2026-11-04T13:28:21Z salmonik salmonik@tuta.io 2026-11-04T13:28:21Z urn:sha1:714262bcf759a238daf906de16e7b204712a104f - Items: "Only if usable" hides health tags at full health and armor at full suit. Health ceiling is the server player's m_iMaxHealth; armor uses the server m_ArmorValue against HL2's 100 cap. Fails open when unreadable. - Projectiles: new Visuals feature/card for thrown grenades, RPG rockets, helicopter bombs and AR2 balls. Fuse from server m_flDetonateTime vs engine time; radius from m_DmgRadius with per-type fallback; optional 24-segment radius ring and FRAG timer label. - Melee: the killbot now handles the gravity gun as well; only VULNERABLE targets, 1200-unit range, primary attack to launch the held object, and no aim-punch compensation because the launch uses EyeVectors. - Server/netvars: m_ArmorValue, m_flDetonateTime, m_DmgRadius.