hl2h/src/world.cpp, branch masterSimple internal C++ cheat for HL2 for GNU/Linux.
https://git.2137697.xyz/hl2h/atom?h=master2026-11-06T15:09:55ZFix audit findings: crash safety, correctness, rendering, performance2026-11-06T15:09:55Zsalmoniksalmonik@tuta.io2026-11-06T15:09:55Zurn:sha1:33f5ed9ef58f26c6b3b52cf605dd4311d658a60d
Crash/UB:
- gate every hook behind an init-stage flag until config/surface/input are ready
- publish module maps as immutable atomic snapshots instead of reallocating
shared vectors under unlocked readers
- validate the %ebp walk in the RandomSeed/RandomFloat hooks against the stack
- bounds-check every RecvTable/RecvProp/string dereference with module_range()
- preserve the Itanium vtable header when cloning (client, CInput, model render,
studio render)
- reject negative usercmd sequence numbers; guard config_load against a null
section target; cap the bone parent walk; check mprotect; drop PROT_EXEC on
the GOT patch; absorb server.so .bss tail
Correctness:
- filter dormant entities across ESP, aimbot, triggerbot, melee, items and
projectiles (slot self-tested against the local player)
- reset the server-health latch per map and only latch on valid model indices
- bone cache sized for the 128-target scan; set valid=false on every failure;
head_position keeps searching past an invalid bone
- vischeck steps past glass by probing until clear, and ignores entities owned
by the target (held weapons, bone followers)
- aimbot: maxs no longer disables it, AABB-aware FOV prefilter, lock hysteresis,
lead point re-checked for FOV and visibility
- spread: seed hook arms on the no-spread toggle alone; engine toggle only
controls the RandomFloat zeroing
- resolve m_hOwnerEntity/m_hOwner; NPC lead velocity from the server entity
- vector_angles pitch range, point_ground normal test, underwater jump+duck no
longer skips combat, semi-auto press/release edge for synthetic fire
- item/projectile markers and blast rings refresh origin per frame while
discovery stays at 10 Hz; trajectory uses the real m_DmgRadius and honours
the blast-radius toggle
Rendering/GUI:
- one overlay draw per engine frame (FRAME_RENDER_START boundary), fixing
alpha stacking and the speed-graph flicker
- clipped lines/outlines and ellipsised text instead of drawing past the
content pane or shifting over neighbours
- dropdown dismissal consumes the click; hover ignores hidden controls
- chams: reset AlphaModulate, reference shared materials once, restore prop
tint colour; fonts created once per handle
- projection uses Source's 4:3 aspect scaling and roll; screen size refreshed
each frame; FOV circle gated on the aim toggles, not the bind
Performance:
- TTL caches for NPC relation, friendly/neutral and damage class
- model names memoised per model index
- entity pointer -> index cache for the triggerbot (was a 4096-slot walk/tick)
Build:
- real Makefile with -MMD dependency tracking, debug/release objects and an
always-relink rule; build.sh kept as a thin wrapper
Chams: preload style materials outside the model draw2026-11-04T17:43:28Zsalmoniksalmonik@tuta.io2026-11-04T17:43:28Zurn:sha1:d7201a987ba6cc56fda3d3ea69275307385f7c3e
FindMaterial inside DrawModelExecute did not load the style VMTs, so every
style fell back to the solid material. Preload the six style materials from
outer_draw (throttled) and have the render hook use the cached pointers only.
world_find_material now returns only the exact requested material; the caller
falls back to the solid style. Add a vgui/white probe and per-style preload
logs.
Chams: model-safe styles and a dedicated viewmodel material2026-11-04T17:17:55Zsalmoniksalmonik@tuta.io2026-11-04T17:17:55Zurn:sha1:892329ec78acf4d4d63749e8c248227aabc2aded
VGUI/white materials do not draw skinned models, so every viewmodel style
except the model debug one made the hands/weapon disappear. Use model debug
materials for all styles: wireframe, additive vertex colour, translucent
single colour, translucent vertex colour, MRM fullbright. The viewmodel
always uses debug/debugtranslucentsinglecolor. A missing style now falls back
to that material instead of vgui/white.
Chams: exact material styles, GUI dropdown, viewmodel hookup2026-11-04T17:15:18Zsalmoniksalmonik@tuta.io2026-11-04T17:15:18Zurn:sha1:83b36aaaf146325af2d93dfbaf21eccba91a5d74
- world_find_material now tries the exact requested style first (resident,
then FindMaterial) before falling back to debugwhite/vgui white. The old
candidate scan returned vgui/white for every style, so all materials looked
flat.
- Add a real CK_DROPDOWN control (overlay list, outside-click close, config
save) and use it for the Chams material selector.
- Chams viewmodel toggle included in config/UI.
Chams: quiet material lookup, accept any fallback by name2026-11-04T17:05:29Zsalmoniksalmonik@tuta.io2026-11-04T17:05:29Zurn:sha1:b0551912a4d31c1f92e2a86509aad0f9e1510f8f
FindMaterial diagnostics are no longer logged per attempt; the chosen material
is logged once. Accept any candidate name returned by FindMaterial, not just
debugwhite.
Chams: tint through $color/$color2 and log the chosen material2026-11-04T17:03:09Zsalmoniksalmonik@tuta.io2026-11-04T17:03:09Zurn:sha1:ccd5256bfacf27ed81fbf13087ba04978d6913f8
ColorModulate alone left the forced material white. Also set the shader's
$color and $color2 vars (IMaterialVar SetVecValue 3-float) and restore them to
white after the draw. Log which fallback material was selected.
Chams: material fallbacks and FindMaterial diagnostics2026-11-04T16:59:49Zsalmoniksalmonik@tuta.io2026-11-04T16:59:49Zurn:sha1:7cb73865108a9b18430df4c21e94246c159c2ffc
models/debug/debugwhite is not resident and FindMaterial did not return it.
Log each FindMaterial attempt and fall back to debugwhite2/3, vgui/white,
debug/debugtranslucentsinglecolor and the ignorez debug wireframe material so
chams can still render.
Add chams2026-11-04T16:51:20Zsalmoniksalmonik@tuta.io2026-11-04T16:51:20Zurn:sha1:49df428d95a7c443d418d5b7e2a93af599b54f76
- Hook IVModelRender::DrawModelExecute (VEngineModel016 slot 19) and force
models/debug/debugwhite for NPC models, identified by
ModelRenderInfo_t::entity_index.
- Two passes: MATERIAL_VAR_IGNOREZ through walls, then normal depth, with
IMaterial::ColorModulate for the configured colour; restore the shared
material's flag/colour afterwards.
- Material lookup via the IMaterialSystem list, FindMaterial fallback.
- New Chams feature/card with Through walls and colour; [chams] config.
- Remove the temporary ammo/projectile/fuse diagnostics.
Props: force colour inside prop DrawModel; no prop material tint2026-11-04T10:46:40Zsalmoniksalmonik@tuta.io2026-11-04T10:46:40Zurn:sha1:0adb4eba090dfa5684b661a01ea9d67244fede75
The engine calls SetColorModulation(1,1,1) immediately before DrawModel, so
the in-draw flag never sees it. Set the prop colour at the start of the prop
DrawModel hook instead (colour only, not alpha), and stop applying
ColorModulate to prop materials so only one mechanism touches props.
Diagnose prop tinting: log prop materials and studio draw model names2026-11-04T10:30:56Zsalmoniksalmonik@tuta.io2026-11-04T10:30:56Zurn:sha1:33c6bf853e1292816882ca4df9ba2a79f8a7288a
Log the first crate materials the tint pass modifies and the first DrawModel/
DrawModelArray calls with their model names, to see whether the crates are
brush materials that were never reached, materials loaded after the tint was
applied, or a studio draw path that is still missed.