| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Crash/UB:
- gate every hook behind an init-stage flag until config/surface/input are ready
- publish module maps as immutable atomic snapshots instead of reallocating
shared vectors under unlocked readers
- validate the %ebp walk in the RandomSeed/RandomFloat hooks against the stack
- bounds-check every RecvTable/RecvProp/string dereference with module_range()
- preserve the Itanium vtable header when cloning (client, CInput, model render,
studio render)
- reject negative usercmd sequence numbers; guard config_load against a null
section target; cap the bone parent walk; check mprotect; drop PROT_EXEC on
the GOT patch; absorb server.so .bss tail
Correctness:
- filter dormant entities across ESP, aimbot, triggerbot, melee, items and
projectiles (slot self-tested against the local player)
- reset the server-health latch per map and only latch on valid model indices
- bone cache sized for the 128-target scan; set valid=false on every failure;
head_position keeps searching past an invalid bone
- vischeck steps past glass by probing until clear, and ignores entities owned
by the target (held weapons, bone followers)
- aimbot: maxs no longer disables it, AABB-aware FOV prefilter, lock hysteresis,
lead point re-checked for FOV and visibility
- spread: seed hook arms on the no-spread toggle alone; engine toggle only
controls the RandomFloat zeroing
- resolve m_hOwnerEntity/m_hOwner; NPC lead velocity from the server entity
- vector_angles pitch range, point_ground normal test, underwater jump+duck no
longer skips combat, semi-auto press/release edge for synthetic fire
- item/projectile markers and blast rings refresh origin per frame while
discovery stays at 10 Hz; trajectory uses the real m_DmgRadius and honours
the blast-radius toggle
Rendering/GUI:
- one overlay draw per engine frame (FRAME_RENDER_START boundary), fixing
alpha stacking and the speed-graph flicker
- clipped lines/outlines and ellipsised text instead of drawing past the
content pane or shifting over neighbours
- dropdown dismissal consumes the click; hover ignores hidden controls
- chams: reset AlphaModulate, reference shared materials once, restore prop
tint colour; fonts created once per handle
- projection uses Source's 4:3 aspect scaling and roll; screen size refreshed
each frame; FOV circle gated on the aim toggles, not the bind
Performance:
- TTL caches for NPC relation, friendly/neutral and damage class
- model names memoised per model index
- entity pointer -> index cache for the triggerbot (was a 4096-slot walk/tick)
Build:
- real Makefile with -MMD dependency tracking, debug/release objects and an
always-relink rule; build.sh kept as a thin wrapper
|
| |
|
|
|
|
|
|
|
|
|
|
| |
The health charger's candidate m_iJuice offset (0x3c8) read 0 on a full
charger, so the empty-hide made health chargers disappear entirely. Restrict
the hide to suit chargers (verified 0x47c) until the health offset is
confirmed; health chargers stay visible.
Classify with the server class name when the client class is generic, accept
`healthcharger` in the health branch (maps use item_healthcharger /
CNewWallHealth, not the func_healthcharger brush), and log up to eight
`juice:` lines with the class and both candidate offsets/values.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Prefer the local player's thrown frag over the pre-throw estimate: resolve
CBaseGrenade::m_hThrower from the server datamap (client owner handles as
fallback), then seed the prediction from the live origin/velocity. The real
frag is a spinning VPhysics box with a random Y angular impulse, so bounce
points remain approximate; the doc now says so.
- Keep 512 path points sampled every other 20 ms step (up to 24 s) instead of
127 points / ~2.5 s, so the line reaches the landing instead of stopping in
mid-air.
- Radius rings use 36 segments; a segment whose near-plane-clipped endpoint
the engine overlay refuses falls back to the local projection, and that
projection now uses the configured camera FOV instead of a hardcoded 75
degrees (the wide-FOV ring no longer kinks/drops pieces).
|
| |
|
|
|
|
|
|
| |
CWallHealth derives CBaseToggle and CNewRecharge derives CBaseAnimating, so
m_iJuice is at different offsets (0x3c8 and 0x47c here). Collect every
m_iJuice datamap match, derive the suit offset from m_iMaxJuice-20, and pick
by the server class name. Also detect health brushes via wallhealth/recharge
rather than the ESP label. Verified the offsets resolve distinctly on :99.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Projectiles gets a "Grenade trajectory" toggle. While a frag grenade is
held, simulate the weapon_frag throw (1200 u/s forward + 120 z, player
velocity, gravity 600) and trace each step with a new
trace_solid_segment(); reflect on impact, stop on a slow upward-normal hit,
and draw the path, landing cross and a 300-unit blast ring. Verified on :99
(arcs, bounces off the tunnel wall, lands).
- With the RPG equipped, armoured NPCs (striders, gunships, dropships,
hunter-choppers) sort before normal enemies during target acquisition.
Added helicopter/chopper to the ARMORED model list.
- Empty health/suit chargers are hidden: read m_iJuice from the server
datamap (0 = depleted, -1 = unreadable/fail open).
- The citadel supercharged gravity gun (d3_citadel_03, d3_citadel_04,
d3_breen_01 via IVEngineClient::GetLevelName) is treated as a normal
weapon, so the melee aimbot no longer restricts it to VULNERABLE NPCs.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
- Hook IVModelRender::DrawModelExecute (VEngineModel016 slot 19) and force
models/debug/debugwhite for NPC models, identified by
ModelRenderInfo_t::entity_index.
- Two passes: MATERIAL_VAR_IGNOREZ through walls, then normal depth, with
IMaterial::ColorModulate for the configured colour; restore the shared
material's flag/colour afterwards.
- Material lookup via the IMaterialSystem list, FindMaterial fallback.
- New Chams feature/card with Through walls and colour; [chams] config.
- Remove the temporary ammo/projectile/fuse diagnostics.
|
| |
|
|
|
|
|
|
| |
The datamap offset points at the array length header, so every ammo count was
read one type early. That made the RPG slot read the buckshot count (30) and
permanently exceed the 3-rocket cap, which is why RPG pickups never showed and
grenades/AR2/weapon ammo never hid. Read the elements 4 bytes after the field
offset.
|
| |
|
|
|
|
|
|
|
|
|
| |
The client m_iAmmo/m_hMyWeapons recv props still do not resolve, but the
listen server has the same CBaseCombatCharacter arrays in its datamap. Resolve
m_iAmmo and m_hMyWeapons there:
- reserve ammo comes from server_player_ammo() when the client array is
missing, so full-ammo filtering works (RPG rockets at 3);
- the owned-weapon mask is filled from the server m_hMyWeapons[48] handles,
so fallen weapons count as ammo before the player equips them.
Widen the datamap field-size filter to 512 for the 192-byte handle array.
|
| |
|
|
|
|
|
|
|
| |
- World weapons of a type already in the local player's inventory are retagged
as ammo ("SMG ammo", ...). Inventory scan only counts weapons owned by the
local player index, so NPC weapons do not trigger it.
- Projectile fuse: log det/cur/base/raw server value, and fall back to a
3-second first-sighting countdown when m_flDetonateTime or engine time is
unavailable.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Items: "Only if usable" hides health tags at full health and armor at full
suit. Health ceiling is the server player's m_iMaxHealth; armor uses the
server m_ArmorValue against HL2's 100 cap. Fails open when unreadable.
- Projectiles: new Visuals feature/card for thrown grenades, RPG rockets,
helicopter bombs and AR2 balls. Fuse from server m_flDetonateTime vs engine
time; radius from m_DmgRadius with per-type fallback; optional 24-segment
radius ring and FRAG timer label.
- Melee: the killbot now handles the gravity gun as well; only VULNERABLE
targets, 1200-unit range, primary attack to launch the held object, and no
aim-punch compensation because the launch uses EyeVectors.
- Server/netvars: m_ArmorValue, m_flDetonateTime, m_DmgRadius.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- ESP: alert state (IDLE/ALERT/COMBAT/SCRIPT), enemy weapon labels, hostile/
neutral/friendly colour pickers, off-screen direction arrows, and
trigger_changelevel volumes with next/previous map labels.
- Aim: silent aim reuses the Aimbot FOV, vischeck and bone settings; add
optional aim-punch compensation for aimbot, silent aim, triggerbot and
melee (server bullets add m_vecPunchAngle to the usercmd angles).
- View: always-on Camera / display card with camera FOV (writes the client
m_iDefaultFOV netvar), viewmodel FOV and monitor gamma (client cvars).
- Movement: Jump assist card with auto crouch-jump and edge jump (point
ground probe 0.12 s ahead).
- Spread: Engine spread override toggle gates the direct RandomFloat zeroing;
off leaves only the seed search.
- Server: entity count/base/classname helpers, trigger_changelevel map name
and world bounds via IServerUnknown/ICollideable.
- Netvars: m_vecPunchAngle and m_iDefaultFOV.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The server RandomSeed GOT slot was hardcoded to 0xce1348, measured on the
older bin/server.so. The anniversary branch loads hl2_complete/bin/server.so,
whose R_386_JMP_SLOT for RandomSeed is 0xce5348, so the patch hit unrelated
writable data and no spread silently did nothing.
- Read the relocation from the loaded module's ELF (module_jump_slot) instead
of hardcoding, with the two known offsets as fallback.
- Override whenever the RandomSeed caller's `this` is the local server player
(CBaseEntity::FireBullets) instead of matching a hardcoded return-address
range that also moved between builds.
- m_takedamage is a char (FIELD_CHARACTER) in the 2013 SDK; resolve it as such
and read a byte, so the IMMUNE damage tag actually works.
|
| |
|
|
|
|
|
|
|
|
|
| |
- Resolve server m_takedamage (DAMAGE_NO/DAMAGE_EVENTS_ONLY = immune).
- Classify gunship/strider/dropship as ARMORED (OnTakeDamage only accepts
DMG_BLAST; only the RPG passes), and headcrab/antlion/manhack as VULN
(gravity gun / physics impact).
- ESP draws ARMORED/VULN/IMMUNE tags above the name (new "Damage tags"
toggle, [esp] dmg).
- Aimbot, silent aim, triggerbot and melee skip immune targets and armoured
targets unless the active weapon is the RPG.
|
| |
|
|
|
|
|
|
|
|
| |
Read the server m_NPCState and mark NPC_STATE_SCRIPT actors neutral so
cutscene NPCs and scripted pets are not aimbot targets and draw in the
neutral colour. Add Lamarr (Kleiner's pet headcrab) to the neutral model
list as requested.
Also log state changes in the NPC debug line and resolve/log m_NPCState in
the server datamap summary.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
m_Relationship is DEFINE_UTLVECTOR (FIELD_CUSTOM), not FIELD_EMBEDDED, so the
datamap scan always returned -1 and every NPC fell back to the model
heuristic. Resolve it as FIELD_CUSTOM with an embedded fallback.
Floor turrets never add relationship rows when friendly: CNPC_FloorTurret
overrides Classify() to CLASS_PLAYER_ALLY for citizen-built
(SF_FLOOR_TURRET_CITIZEN) and Alyx-hacked turrets. Read m_spawnflags and
m_bHackedByAlyx from the server instead.
Widen the datamap offset window (0x4..0x4000) for derived-class fields and
log the new offsets plus turret state in the NPC debug line.
|
| |
|
|
|
|
|
|
|
|
|
| |
- Read the server NPC's m_Relationship CUtlVector (entity row for the local
player first, then the CLASS_PLAYER row): D_LI friendly, D_NU neutral,
D_HT/D_FR hostile.
- Use it for ESP colours and aimbot/silent-aim/melee target filtering, with
the existing model heuristic as a fallback.
- Treat bugbait-controlled antlions as friendly when their server
m_hFollowTarget is set.
- Resolve m_Relationship/m_hFollowTarget datamap offsets and log them.
|
| |
|
|
|
|
|
|
|
| |
The client m_hActiveWeapon is a networked EHANDLE: low 11 bits are the
entity index and the rest is the serial. Masking with 0xFFFF included serial
bits, so on later maps the weapon index became garbage (e.g. 49184/12319)
and melee killbot could not recognize the crowbar. Use 0x7FF for client and
server active-weapon handles, weapon owner checks and item-ESP weapon skips.
Document the layout in CONTEXT.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Open /tmp/hl2hake.log once in the library constructor with "w" so each
session starts clean, use line buffering, flush each line, and close it via
atexit. No more fopen/fclose per message.
- Add logd() for verbose diagnostics, enabled only with HL2H_DEBUG=1.
- Move ESP/NPC scans, item-prop/item-classification logs, aimbot/silent-aim/
melee/triggerbot/spread details, jumpbug tracking, bone dumps, netvar dumps,
cmd-modified and ground-trace noise to logd().
- Keep logf() for lifecycle, config, warnings/errors, GUI open/close, item
category/tagging summaries and item-crate detections so crate debugging
works without the ESP stream.
- Supply crates now respect the max-distance slider (user change), with the
stale comment and CONTEXT updated.
- Document HL2H_DEBUG=1 in play.sh and CONTEXT.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Toast queue drawn in the top-right by the overlay, independent of the GUI
being open. Info/warn/error colors and 6/9/12 s lifetimes; timers start on
the first painted frame so startup messages are not missed.
- Queue a load toast after install_menu, plus warnings/errors for missing
modules/interfaces/netvars, input hooks, fonts, ISurface, server datamap,
and spread seed support.
- Toast on config reload, reset, bind/unbind and config save failure.
- Config saves now write `config.tmp`, flush, then rename it over the real
file; failures leave the previous config intact.
- config_load reports whether a file was found so Reload can distinguish a
successful reload from a missing file.
- Update CONTEXT and ISURFACE_STATUS for the single GUI, toasts and atomic
config writes.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- New feature (default on): while the local player's active weapon is the
crowbar, pick the nearest visible hostile NPC within the 75-unit crowbar
range, sorted by distance to its collision AABB, and attack it through the
normal silent-aim path (usercmd view + IN_ATTACK, movement preserved,
rendered view restored at FRAME_RENDER_START).
- Prefer the nearest visible hitbox center; fall back to the AABB center /
closest point when bones are unavailable. Reuses the existing friendly /
neutral and life-state filters and the world-only vischeck.
- Detect the active weapon from the client m_hActiveWeapon handle, with the
authoritative server m_hActiveWeapon handle as a fallback (client entity
index from the low 16 bits).
- While the crowbar is active and this feature is on, skip the gun aimbot,
triggerbot and silent aim so they do not fight over the usercmd view.
- Menu: Melee killbot -> Active; config [melee] active=...
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The unduck window is only 2 units, while a 625-ups fall moves ~9.3 units per
66.7 Hz movement command, so pure jumpbug is ~20% reliable at that speed.
- Add Jumpbug -> Assist timing (default off). When the natural next command
would skip [36,38], pin the post-command ducked distance to 37 by writing
the vertical velocity for that command. Pure jumpbug remains available with
the option off.
- Resolve the client local m_vecAbsVelocity (0x11C) via the client datamap
and the server m_vecAbsVelocity (0x228) via the server datamap.
- Write both the authoritative server velocity (what SetupMove reads through
GetAbsVelocity) and the local prediction fields, so the next CreateMove sees
the assisted origin on both sides.
- Do not write the server m_vecVelocity directly: the datamap scan finds two
same-named entries (0x1C and 0x29C); SetAbsVelocity syncs it after movement.
|
|
|
- entitylist slot 6 (GetHighestEntityIndex); class name via
GetClientNetworkable -> GetClientClass (replaces the unsafe slot-2 call)
- HL2 SP NPCs: class CAI_BaseNPC + m_lifeState, since NPC m_iHealth is not
networked; model names from VModelInfoClient006 for labels/friend-foe
- real HP/HP-max from the listen-server entity (IVEngineServer021 ->
PEntityOfEntIndex -> edict->m_pUnk -> GetBaseEntity) using offsets scanned
from server.so's datamap; validated against the client model index
- world_to_screen via IVDebugOverlay003::ScreenPosition (fixes box drift)
- maxs sanity clamp, NPC-only debug logging, neutral colour for wildlife
- build.sh: restore -o libhl2hake.so and add server.cpp
|
