| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- ESP: alert state (IDLE/ALERT/COMBAT/SCRIPT), enemy weapon labels, hostile/
neutral/friendly colour pickers, off-screen direction arrows, and
trigger_changelevel volumes with next/previous map labels.
- Aim: silent aim reuses the Aimbot FOV, vischeck and bone settings; add
optional aim-punch compensation for aimbot, silent aim, triggerbot and
melee (server bullets add m_vecPunchAngle to the usercmd angles).
- View: always-on Camera / display card with camera FOV (writes the client
m_iDefaultFOV netvar), viewmodel FOV and monitor gamma (client cvars).
- Movement: Jump assist card with auto crouch-jump and edge jump (point
ground probe 0.12 s ahead).
- Spread: Engine spread override toggle gates the direct RandomFloat zeroing;
off leaves only the seed search.
- Server: entity count/base/classname helpers, trigger_changelevel map name
and world bounds via IServerUnknown/ICollideable.
- Netvars: m_vecPunchAngle and m_iDefaultFOV.
|
| |
|
|
|
|
|
|
|
| |
The ApplySpread random draws are not guaranteed to run in the player's frame
(the compiler can outline them), so the frame-based shooter check missed and
the shotgun kept its seed-minimised spread. The player's FireBullets
RandomSeed call now arms a short 8-draw window; the next RandomFloat draws
return 0. Keep the frame check as the other path. Remove the diagnostics used
to find this.
|
| |
|
|
|
|
|
|
|
| |
Picking the best of 256 pending seeds still leaves the shotgun's 8/12 pellets
a few degrees apart. CShotManipulator::ApplySpread is inlined into
CBaseEntity::FireBullets and draws x/y through the global
CUniformRandomStream; hook its RandomFloat slot and return 0 when the calling
frame's shooter is the local server player. This collapses every pellet onto
the shot direction while NPC fire and client prediction keep their randomness.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The server RandomSeed GOT slot was hardcoded to 0xce1348, measured on the
older bin/server.so. The anniversary branch loads hl2_complete/bin/server.so,
whose R_386_JMP_SLOT for RandomSeed is 0xce5348, so the patch hit unrelated
writable data and no spread silently did nothing.
- Read the relocation from the loaded module's ELF (module_jump_slot) instead
of hardcoding, with the two known offsets as fallback.
- Override whenever the RandomSeed caller's `this` is the local server player
(CBaseEntity::FireBullets) instead of matching a hardcoded return-address
range that also moved between builds.
- m_takedamage is a char (FIELD_CHARACTER) in the 2013 SDK; resolve it as such
and read a byte, so the IMMUNE damage tag actually works.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
- The material system rejects textures whose dimensions are not multiples of 4
("Image dimensions must be multiple of 4!"), so scale the decoded image to
the next power of two (bilinear). 798x798 -> 1024x1024. The invalid VTF also
crashed the renderer after the apply.
- Move skybox_update() out of the VGUI paint hook into the FRAME_RENDER_START
FrameStageNotify stage. ITexture::Download only regenerates bits when the
material system considers the frame render-safe; during paint it returned
early, the regenerator never ran (no pixels), and a later upload of the
empty VTF crashed.
- Log the regenerator entry so the log shows whether the upload path ran.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
New Visuals -> Skybox card with a runtime sv_skyname override using the same
mechanism as the stock skybox_swapper entity. The choice list is the HL2
skybox set extracted from the game VPKs.
The map's own sky is captured from loaded materials (SkyBox group, parsing
skybox/<name>... face names) before the first override, so turning the
feature off or picking "Map default" restores it; a level change restores it
implicitly. Sky changes invalidate the world tint so new sky materials are
tinted as well.
GUI: add a CK_CHOICE control (value box with < / > zones).
|
| |
|
|
|
|
|
|
|
|
| |
- World tint now also colours prop materials (models/props*) with their own
colour, covering static props and prop_physics while leaving NPC, player and
weapon materials untouched.
- New Fog card: fog_override colour/start/end via ClientCmd, optional skybox
fog, and a Remove fog mode. Restores the map fog (fog_override 0) when
disabled and re-applies after level changes.
- Config sections [worldtint] prop/colour keys and [fog].
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Port Amalgam's modulation approach: obtain IMaterialSystem from the already
loaded materialsystem.so (VMaterialSystem080) and walk materials with
FirstMaterial/NextMaterial/GetMaterial. ColorModulate the "World textures"
group (sky names excluded) and the "SkyBox textures"/sky-named group.
The walk runs only when the enabled groups or colours change, restores white
when disabled, and re-applies after level changes. Before touching materials,
GetNumMaterials() and the first material's name/group are sanity-checked so a
wrong vtable slot logs and aborts instead of walking garbage.
GUI: "World tint" card with world/sky toggles and RGB sliders; config section
[worldtint].
|
| | |
|
| |
|
|
| |
stage markers
|
| |
|
|
|
|
|
|
|
| |
- Poking VEngineCvar004/ConVar vtables directly crashed before the main menu
(ConVar uses a secondary IConVar vtable). Use the stable IVEngineClient
ClientCmd slot 7 for mat_fullbright instead.
- Reject out-of-range m_hOwnerEntity/m_hOwner offsets: the resolver found a
bogus negative owner offset (-136296061), which could make item-ESP weapon
ownership read wild memory.
|
| |
|
|
|
|
|
|
|
|
| |
- New Visuals card with the usual Active + Bind; default off. Unbound+Active
is always-on, a bind makes it hold-to-brighten.
- Resolve VEngineCvar004 and set mat_fullbright 1/0 through FindVar (slot 12)
and ConVar::SetValue(int) (slot 11), bypassing the console cheat gate.
Fall back to ClientCmd if the cvar interface is unavailable.
- Reapply after map loads/respawns and persist [fullbright] active/bind.
- Log on/off; show an error toast if the cvar cannot be applied.
|
| |
|
|
|
|
|
|
|
|
|
| |
- Map transitions often leave a non-crowbar weapon active, so the killbot
silently does nothing. Log every active-weapon change as a normal
`melee: active ... crowbar=0/1` line and toast once suggesting the crowbar.
- Recover the crowbar model from the server entity when the client weapon
model index is missing/0 after a map change.
- Clear the bone cache and aim/silent locks when the local player entity
changes (map load/respawn) so stale entity/model data cannot poison melee
target selection.
|
| |
|
|
|
|
|
|
|
|
| |
- Silent aim and triggerbot set IN_ATTACK after CInput::CreateMove, so the
minimal-spread seed was never applied to their shots. Re-apply
spread_control_apply after setting the attack button, then update the CRC.
- Crossbow bolts and RPG rockets are not hitscan. Lead the selected hitbox by
target velocity * travel time; the crossbow bolt also gets its 0.05 gravity
drop (30 u/s^2). Apply the same correction to the smooth aimbot.
- Document both paths in CONTEXT.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Open /tmp/hl2hake.log once in the library constructor with "w" so each
session starts clean, use line buffering, flush each line, and close it via
atexit. No more fopen/fclose per message.
- Add logd() for verbose diagnostics, enabled only with HL2H_DEBUG=1.
- Move ESP/NPC scans, item-prop/item-classification logs, aimbot/silent-aim/
melee/triggerbot/spread details, jumpbug tracking, bone dumps, netvar dumps,
cmd-modified and ground-trace noise to logd().
- Keep logf() for lifecycle, config, warnings/errors, GUI open/close, item
category/tagging summaries and item-crate detections so crate debugging
works without the ESP stream.
- Supply crates now respect the max-distance slider (user change), with the
stale comment and CONTEXT updated.
- Document HL2H_DEBUG=1 in play.sh and CONTEXT.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Drop the stucklaunch feature, its settings, diagnostics and
m_hGroundEntity resolution.
- Add a Visuals feature that scans the client entity list for valuable
pickups: health/medkits/chargers, ammo boxes/crates/grenades, batteries,
HEV suit modules/chargers, supply crates and generic items.
- Model-first classification with class fallbacks; category toggles, distance
labels and a max-distance slider.
- Draw colored marker/label tags through walls, independent of the hostile NPC
ESP.
- Persist [items] active/bind/health/ammo/armor/crates/distance/max_dist;
Reset restores defaults; GUI card and CONTEXT updated.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
- Client physics props are CPhysicsProp/CPhysBox, not the server class
prop_physics; the old case-sensitive class check never matched. Detect
MOVETYPE_VPHYSICS first (the reliable signal), then case-insensitive
class/model patterns.
- Log the first few prop checks with index, movetype, class and model so a
failed ground lookup is diagnosable.
- Log once when Stucklaunch is active (with run state, bind and ground
offset), when it engages, and when the ground is not a prop.
- Toast a warning when binding a feature that is not Active yet.
|
| |
|
|
|
|
|
|
| |
- Gravity-gun spam now alternates +attack (grab) and +use (drop) instead of
pressing both together, which would punt the prop.
- Add a Spam rate slider (1..16 ticks, default 2) so the pickup/drop cycle can
be tuned; it persists as spam_ticks in [stucklaunch].
- Log the prop index the first few times a stucklaunch engages to aid testing.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Tooltips: text_in() shifted the x position to fit the full string before
truncating, which drew the tooltip text outside its box. Truncate to the
available width first, then clamp inside the clip.
Stucklaunch (Movement):
- opt-in feature (Active off by default) with its own bind;
- holds jump, alternates +use every 2 ticks to regrab a physics prop,
optionally +attack while the gravity gun is active, and air-strafes;
- engagement uses m_hGroundEntity (client netvar) latched for ~0.5 s so the
prop stays active while airborne; falls back to running whenever active if
the netvar is unavailable, with a startup warning to bind it;
- does not spawn or place props; the player supplies the prop and initial
speed.
Config gets [stucklaunch] active/bind/use_spam/gravspam/autostrafe; Reset
restores those defaults. CONTEXT documents the assist and its limits.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Toast queue drawn in the top-right by the overlay, independent of the GUI
being open. Info/warn/error colors and 6/9/12 s lifetimes; timers start on
the first painted frame so startup messages are not missed.
- Queue a load toast after install_menu, plus warnings/errors for missing
modules/interfaces/netvars, input hooks, fonts, ISurface, server datamap,
and spread seed support.
- Toast on config reload, reset, bind/unbind and config save failure.
- Config saves now write `config.tmp`, flush, then rename it over the real
file; failures leave the previous config intact.
- config_load reports whether a file was found so Reload can distinguish a
successful reload from a missing file.
- Update CONTEXT and ISURFACE_STATUS for the single GUI, toasts and atomic
config writes.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Feedback pass:
- Insert now toggles the GUI; the old text tree moved to F1.
- Remove the title-bar X. Insert is the only close path; Esc only cancels
bind capture.
- Discard accumulated mouse deltas in CInput::CreateMove before the game can
apply them (CInput::ClearStates), so the camera no longer moves for a frame
and snaps back. Also skip ExtraMouseSample and zero relative mouse state
while the GUI is open.
- Strip attack/use/impulse/weapon selection from the command while open;
keep jump, duck and walk. Skip combat command edits (spread seed) too.
- Widen System page buttons so "Reload config" and "Reset defaults" fit.
- Update CONTEXT/ADR for the Insert-only close behavior.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Feedback pass on the preview shell:
- Freeze the rendered view explicitly in CreateMove and again at
FRAME_RENDER_START; CInput was still letting mouse look move the camera.
- Allow normal WASD/jump/duck movement while the GUI is open; strip
attack/use/impulse/weapon selection so GUI clicks do not fire.
- While bind capture is active, block all game input.
- Esc no longer closes the GUI; it only cancels bind capture. F2 or the
title-bar X close the preview.
- Interpose SDL_ShowCursor / SDL_SetRelativeMouseMode / warp / window grab so
the game cannot re-capture or hide the native cursor while the GUI is open.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
First vertical slice for the custom ISurface GUI:
- window/sidebar/content shell with Movement, Combat, Visuals, Weapons and
System categories;
- cards with dummy Active/Bind, collapsible settings, toggles, sliders,
buttons, bind capture, scrolling and tooltips;
- native OS cursor by releasing SDL relative mode; reasserted while open;
- F2 toggles the preview; Insert still opens the old text tree;
- while the GUI is open, do_move freezes movement/buttons/impulses/view and
skips combat features; ESP and the speed graph keep drawing.
Dummy controls do not touch the real config yet. The text menu is removed
after feature parity in the next pass.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
The installed 2024 server ignores the client usercmd random_seed and uses its
own shot seed. Force the server's CBaseEntity::FireBullets RandomSeed call for
the local player only:
- hook the server.so RandomSeed GOT slot (R_386_JUMP_SLOT at 0xce1348);
- read the FireBullets `this` from the caller frame and compare it with the
local server player base;
- replace the seed with the precomputed best single/shotgun window and step it
per pellet; NPC shots and everything else pass through.
- client prediction still uses the same chosen usercmd seed, so both sides
agree on the spread pattern.
|
| | |
|
| |
|
|
|
|
|
|
|
| |
CInput::CreateMove overwrites cmd->random_seed with MD5_PseudoRandom after
CHLClient::CreateMove returns, so the seed set from the client-mode hook was
being discarded. Hook the IInput vtable slot 3 (CInput::CreateMove), call the
original, then apply the spread seed and update the verified command copy and
CRC. This also keeps all aim/movement edits since the original copies the
command into the verified table.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
HL2's CBaseEntity::FireBullets seeds its RNG from the usercmd random_seed
(m_bUseServerRandomSeed is false for HL2 weapons), so the client can select the
8-bit seed that puts CShotManipulator::ApplySpread closest to the center.
- New feature Spread control -> Active / No spread (both default on).
- Precompute the best seed for a single shot and for the shotgun's 8-shot
primary (first pellet accurate) and 12-shot secondary windows using the
engine's own RandomSeed/RandomFloat from libvstdlib.
- Set cmd->random_seed on attack commands; note_modified repairs the CRC.
- The random cone offset is neutralized, but the cone size, the pistol
accuracy penalty, server view punch and any damage falloff remain
server-side; stock HL2 has no distance damage falloff.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- New feature (default on): while the local player's active weapon is the
crowbar, pick the nearest visible hostile NPC within the 75-unit crowbar
range, sorted by distance to its collision AABB, and attack it through the
normal silent-aim path (usercmd view + IN_ATTACK, movement preserved,
rendered view restored at FRAME_RENDER_START).
- Prefer the nearest visible hitbox center; fall back to the AABB center /
closest point when bones are unavailable. Reuses the existing friendly /
neutral and life-state filters and the world-only vischeck.
- Detect the active weapon from the client m_hActiveWeapon handle, with the
authoritative server m_hActiveWeapon handle as a fallback (client entity
index from the low 16 bits).
- While the crowbar is active and this feature is on, skip the gun aimbot,
triggerbot and silent aim so they do not fight over the usercmd view.
- Menu: Melee killbot -> Active; config [melee] active=...
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The unduck window is only 2 units, while a 625-ups fall moves ~9.3 units per
66.7 Hz movement command, so pure jumpbug is ~20% reliable at that speed.
- Add Jumpbug -> Assist timing (default off). When the natural next command
would skip [36,38], pin the post-command ducked distance to 37 by writing
the vertical velocity for that command. Pure jumpbug remains available with
the option off.
- Resolve the client local m_vecAbsVelocity (0x11C) via the client datamap
and the server m_vecAbsVelocity (0x228) via the server datamap.
- Write both the authoritative server velocity (what SetupMove reads through
GetAbsVelocity) and the local prediction fields, so the next CreateMove sees
the assisted origin on both sides.
- Do not write the server m_vecVelocity directly: the datamap scan finds two
same-named entries (0x1C and 0x29C); SetAbsVelocity syncs it after movement.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Predict the landing speed from the current vertical velocity and a swept
standing-hull ground trace; engage only when it exceeds
PLAYER_MAX_SAFE_FALL_SPEED.
- Press duck one command before the unduck window so FinishDuck's 36-unit
origin raise places the feet ~37 units above the floor.
- On the next command release duck and press jump: PlayerMove runs Duck()
before CheckJumpButton, so FinishUnDuck sets ground, the jump executes, and
CheckFalling never sees ground for the fall-damage check.
- Measure the per-command fall from consecutive airborne origins instead of a
fixed tick interval; clear IN_JUMP while waiting so the pogo latch is clear.
- New Movement -> Jumpbug -> Active toggle (default on), config [jumpbug].
|
| |
|
|
|
|
|
|
|
|
|
| |
- Aimbot -> FOV and Silent aim -> FOV values (1..180 deg from the crosshair)
- Aimbot -> Show FOV circle: projects the FOV cone through the engine's
world->screen transform (hidden for >=89 deg since the boundary is behind
the eye)
- target lock: while a feature has a bind and the key is held, the acquired
target is kept while it is alive and has a visible selected hitbox point;
it only re-acquires when the target dies/leaves visibility or the key is
released. With bind = None both features keep selecting the nearest target.
|
| |
|
|
|
|
| |
- move PI_F into hl2h.h as constexpr 3.14159265f and remove the duplicated
long-double-style literals from hl2h.cpp/esp.cpp
- extra digits are compile-time only; float operations cost the same
|
| |
|
|
|
|
|
|
|
|
| |
- on landing with jump held, face opposite the horizontal velocity and zero
forward/side movement for that tick; the HL2 jump speed-bound subtraction
then accelerates along the velocity (the classic no-input ABH exploit)
- works standalone or with bhop; bhop's auto-strafe still applies in air
when enabled
- rendered view is restored at FRAME_RENDER_START via the existing hook, so
the camera does not flip around
|
| |
|
|
|
|
|
|
|
| |
- hook CHLClient::FrameStageNotify (vtable slot 35) and at FRAME_RENDER_START
re-apply the player's original view angles after the engine has consumed the
aimed usercmd; this fixes the slow pull with high-RPM weapons and the
revolver leaving the view on the target
- silent aim also rewrites forwardmove/sidemove so the world-space movement
wish vector is unchanged by the temporary aim angles
|
| |
|
|
|
|
|
|
|
|
|
|
| |
- new top-level Silent aim feature (Active + Bind, default Mouse3)
- reuses the shared aim-target selection (bone checklist, nearest selected
point, world-only MASK_VISIBLE vischeck)
- writes the exact target angle into cmd->viewangles, sets IN_ATTACK for the
shot, then immediately restores engine view angles to the player's input
view (g_cam_view) so the camera stays where it was
- shares the vischeck/bone selection with the aimbot; independent of the
aimbot/triggerbot binds
- config [silentaim] active/bind
|
| |
|
|
|
|
|
|
|
| |
- top-level Triggerbot feature (Active + Bind, default Mouse4, rebindable)
- trace the crosshair ray from the eye with MASK_SHOT and TRACE_EVERYTHING;
the filter ignores the local player
- if the first entity hit is a live hostile NPC, press IN_ATTACK and fix the
usercmd CRC; walls/props/friendly/neutral/corpses do not trigger
- independent of Aimbot; config [triggerbot] active/bind
|
| |
|
|
|
|
|
|
|
|
| |
- resolve EngineTraceClient003; TraceRay (slot 4) from the eye to the exact
selected hitbox/bone point with MASK_VISIBLE
- TRACE_WORLD_ONLY filter as requested (static props are not tested, per SDK)
- Aimbot -> Vischeck toggle, persisted as vischeck=1; when on, blocked targets
are skipped and the next-nearest candidate is tried
- target candidates are ranked by angle; on each target the nearest visible
selected hitbox point wins
|
| |
|
|
|
|
|
|
| |
- g_cam_eye was adding the X component of m_vecViewOffset to Z, leaving the
eye ~64 units too low; the aimbot consequently aimed above heads
- head_position now prefers the HITGROUP_HEAD hitbox center before falling
back to bone names (zombie: headcrab body hitbox)
- log the exact head and desired angles for the first few aim ticks
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
- select the hostile NPC whose (approximate) head is closest in angle to the
crosshair, then refine to its actual head hitbox/bone
- aimbot menu feature (Active + Bind, default Mouse5, rebindable via the
existing bind chooser); config [aimbot] active/bind
- never snap: move at most 5 degrees per tick toward the target, shortest-path
yaw, pitch clamped to +/-89, 0.05 degree deadzone; no overshoot/oscillation
- fixes the usercmd CRC after modifying viewangles
- skip when dead; ignores friendly/neutral entities (crows, citizens, ...)
|
| |
|
|
|
|
|
|
| |
- derive the desired air direction from the raw W/S/A/D input (view-relative)
- pick the velocity perpendicular that rotates toward that target, so S/A/D
work instead of only forward and A/D no longer spin in circles
- no keys: accelerate along the crosshair
- menu label now "Uni-directional auto-strafe"; state column moved to x=270
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
- entitylist slot 6 (GetHighestEntityIndex); class name via
GetClientNetworkable -> GetClientClass (replaces the unsafe slot-2 call)
- HL2 SP NPCs: class CAI_BaseNPC + m_lifeState, since NPC m_iHealth is not
networked; model names from VModelInfoClient006 for labels/friend-foe
- real HP/HP-max from the listen-server entity (IVEngineServer021 ->
PEntityOfEntIndex -> edict->m_pUnk -> GetBaseEntity) using offsets scanned
from server.so's datamap; validated against the client model index
- world_to_screen via IVDebugOverlay003::ScreenPosition (fixes box drift)
- maxs sanity clamp, NPC-only debug logging, neutral colour for wildlife
- build.sh: restore -o libhl2hake.so and add server.cpp
|
| | |
|
| | |
|
| |
|
|
| |
features
|
| |
|
