From 33f5ed9ef58f26c6b3b52cf605dd4311d658a60d Mon Sep 17 00:00:00 2001 From: salmonik Date: Fri, 6 Nov 2026 16:09:55 +0100 Subject: Fix audit findings: crash safety, correctness, rendering, performance Crash/UB: - gate every hook behind an init-stage flag until config/surface/input are ready - publish module maps as immutable atomic snapshots instead of reallocating shared vectors under unlocked readers - validate the %ebp walk in the RandomSeed/RandomFloat hooks against the stack - bounds-check every RecvTable/RecvProp/string dereference with module_range() - preserve the Itanium vtable header when cloning (client, CInput, model render, studio render) - reject negative usercmd sequence numbers; guard config_load against a null section target; cap the bone parent walk; check mprotect; drop PROT_EXEC on the GOT patch; absorb server.so .bss tail Correctness: - filter dormant entities across ESP, aimbot, triggerbot, melee, items and projectiles (slot self-tested against the local player) - reset the server-health latch per map and only latch on valid model indices - bone cache sized for the 128-target scan; set valid=false on every failure; head_position keeps searching past an invalid bone - vischeck steps past glass by probing until clear, and ignores entities owned by the target (held weapons, bone followers) - aimbot: maxs no longer disables it, AABB-aware FOV prefilter, lock hysteresis, lead point re-checked for FOV and visibility - spread: seed hook arms on the no-spread toggle alone; engine toggle only controls the RandomFloat zeroing - resolve m_hOwnerEntity/m_hOwner; NPC lead velocity from the server entity - vector_angles pitch range, point_ground normal test, underwater jump+duck no longer skips combat, semi-auto press/release edge for synthetic fire - item/projectile markers and blast rings refresh origin per frame while discovery stays at 10 Hz; trajectory uses the real m_DmgRadius and honours the blast-radius toggle Rendering/GUI: - one overlay draw per engine frame (FRAME_RENDER_START boundary), fixing alpha stacking and the speed-graph flicker - clipped lines/outlines and ellipsised text instead of drawing past the content pane or shifting over neighbours - dropdown dismissal consumes the click; hover ignores hidden controls - chams: reset AlphaModulate, reference shared materials once, restore prop tint colour; fonts created once per handle - projection uses Source's 4:3 aspect scaling and roll; screen size refreshed each frame; FOV circle gated on the aim toggles, not the bind Performance: - TTL caches for NPC relation, friendly/neutral and damage class - model names memoised per model index - entity pointer -> index cache for the triggerbot (was a 4096-slot walk/tick) Build: - real Makefile with -MMD dependency tracking, debug/release objects and an always-relink rule; build.sh kept as a thin wrapper --- src/menu.cpp | 99 ++++++++++++++++++++++++------------------------------------ 1 file changed, 40 insertions(+), 59 deletions(-) (limited to 'src/menu.cpp') diff --git a/src/menu.cpp b/src/menu.cpp index 1064365..f3a9bb9 100644 --- a/src/menu.cpp +++ b/src/menu.cpp @@ -19,10 +19,10 @@ void init_conmsg() { if (g_conmsg) return; // fallback: dlopen libtier0.so from the engine directory - size_t slash = g_engine.path.find_last_of('/'); + size_t slash = mod_engine().path.find_last_of('/'); if (slash == std::string::npos) return; - std::string tier0 = g_engine.path.substr(0, slash + 1) + "libtier0.so"; + std::string tier0 = mod_engine().path.substr(0, slash + 1) + "libtier0.so"; void *h = dlopen(tier0.c_str(), RTLD_NOLOAD | RTLD_LAZY | RTLD_GLOBAL); if (!h) h = dlopen(tier0.c_str(), RTLD_LAZY | RTLD_GLOBAL); @@ -640,6 +640,11 @@ static bool config_load() { g_esp_col_friendly[key[1] == 'r' ? 0 : key[1] == 'g' ? 1 : 2] = v; } } + // Scalar-only sections ([view], [movement], [chams_*]) intentionally + // leave cur == nullptr. A stray active=/bind= line in one of them must + // not be dereferenced (hand-edited or corrupt config). + if (!cur) + continue; if (strcmp(key, "active") == 0) cur->active = atoi(val) != 0; else if (strcmp(key, "bind") == 0) @@ -867,6 +872,11 @@ bool feature_active(int feature) { return f->bind == 0 || key_held(f->bind); } +bool feature_enabled(int feature) { + FeatureState *f = feature_state(feature); + return f && f->active; +} + bool feature_has_bind(int feature) { FeatureState *f = feature_state(feature); return f && f->bind != 0; @@ -924,81 +934,39 @@ bool aimbot_fov_circle() { return g_aim_fov_circle; } struct ISurface; using HFont = unsigned long; -ISurface *g_surface = nullptr; static HFont g_font = 0; static HFont g_font_small = 0; -// VGUI_Surface030 vtable slots (confirmed via binary disassembly of vguimatsurface.so): -// 8 = PushMakeCurrent(VPANEL, bool useInsets) — reads args at 0xc/0x10(%ebp) -// 9 = PopMakeCurrent(VPANEL) — pops the make-current stack at this+0x264/0x270 -// 10 = DrawSetColor(int r, int g, int b, int a) — stores rgba at this+0x24 -// 12 = DrawFilledRect(int x0, int y0, int x1, int y1) — alpha check at this+0x27 -// 17 = DrawSetTextFont(HFont), 18 = DrawSetTextColor(int r,g,b,a) -// 20 = DrawSetTextPos(int x, int y), 22 = DrawPrintText(wchar_t*, len, drawType) -// 66 = CreateFont(), 67 = AddGlyphSetToFont(font, name, tall, weight, -// blur, scanlines, flags, rangeMin, rangeMax) -static constexpr int SURF_GetEmbeddedPanel = 6; -static constexpr int SURF_PushMakeCurrent = 8; -static constexpr int SURF_PopMakeCurrent = 9; -static constexpr int SURF_DrawSetColor = 10; -static constexpr int SURF_DrawFilledRect = 12; -static constexpr int SURF_DrawSetTextFont = 17; -static constexpr int SURF_DrawSetTextColor = 18; -static constexpr int SURF_DrawSetTextPos = 20; -static constexpr int SURF_DrawPrintText = 22; -static constexpr int SURF_CreateFont = 66; -static constexpr int SURF_AddGlyphSetToFont = 67; - -static int surf_get_embedded_panel() { - using Fn = int (*)(void *); - return vfunc(g_surface, SURF_GetEmbeddedPanel)(g_surface); -} +// ISurface access lives in overlay.cpp; these wrappers keep the call sites in +// this file unchanged. +static int surf_get_embedded_panel() { return overlay_embedded_panel(); } static void surf_push_make_current(int panel, bool use_insets) { - using Fn = void (*)(void *, int, bool); - vfunc(g_surface, SURF_PushMakeCurrent)(g_surface, panel, use_insets); + overlay_push_make_current(panel, use_insets); } static void surf_pop_make_current(int panel) { - using Fn = void (*)(void *, int); - vfunc(g_surface, SURF_PopMakeCurrent)(g_surface, panel); + overlay_pop_make_current(panel); } static void surf_draw_set_color(int r, int g, int b, int a) { - using Fn = void (*)(void *, int, int, int, int); - vfunc(g_surface, SURF_DrawSetColor)(g_surface, r, g, b, a); + overlay_color(r, g, b, a); } static void surf_draw_filled_rect(int x0, int y0, int x1, int y1) { - using Fn = void (*)(void *, int, int, int, int); - vfunc(g_surface, SURF_DrawFilledRect)(g_surface, x0, y0, x1, y1); + overlay_fill(x0, y0, x1, y1); } static void surf_draw_set_text_color(int r, int g, int b, int a) { - using Fn = void (*)(void *, int, int, int, int); - vfunc(g_surface, SURF_DrawSetTextColor)(g_surface, r, g, b, a); -} -static void surf_draw_set_text_font(HFont f) { - using Fn = void (*)(void *, HFont); - vfunc(g_surface, SURF_DrawSetTextFont)(g_surface, f); -} -static void surf_draw_set_text_pos(int x, int y) { - using Fn = void (*)(void *, int, int); - vfunc(g_surface, SURF_DrawSetTextPos)(g_surface, x, y); + overlay_text_color(r, g, b, a); } +static void surf_draw_set_text_font(HFont f) { overlay_text_font(f); } +static void surf_draw_set_text_pos(int x, int y) { overlay_text_pos(x, y); } static void surf_draw_print_text(const wchar_t *text, int count) { - using Fn = void (*)(void *, const wchar_t *, int, int); - vfunc(g_surface, SURF_DrawPrintText)(g_surface, text, count, 0); // 0 = FONT_DRAW_DEFAULT -} -static HFont surf_create_font() { - using Fn = HFont (*)(void *); - return vfunc(g_surface, SURF_CreateFont)(g_surface); + overlay_print_text(text, count); } +static HFont surf_create_font() { return overlay_create_font(); } static bool surf_set_font_glyph_set(HFont f, const char *name, int tall, int weight, int blur, int scanlines, int flags, int range_min = 0, int range_max = 0) { - using Fn = bool (*)(void *, HFont, const char *, int, int, int, int, int, int, - int); - return vfunc(g_surface, SURF_AddGlyphSetToFont)(g_surface, f, name, tall, - weight, blur, scanlines, - flags, range_min, - range_max); + return overlay_add_glyph_set(f, name, tall, weight, blur, scanlines, flags, + range_min, range_max); } // wide string conversion for DrawPrintText @@ -1071,6 +1039,11 @@ void fullbright_update() { // (see hkdDrawPrintText hook in hl2h.cpp): we wrap our draws in // PushMakeCurrent/PopMakeCurrent so they are submitted with a clean clip. void outer_draw() { + // PaintTraverseEx runs for every VGUI panel and DrawPrintText for every text + // draw, so collapse them to one draw per engine frame (see overlay.h). + if (!overlay_should_draw()) + return; + poll_keyboard(); fullbright_update(); world_tint_update(); @@ -1083,10 +1056,16 @@ void outer_draw() { bool esp_on = feature_active(FEAT_ESP); bool items_on = feature_active(FEAT_ITEM_ESP); bool projs_on = feature_active(FEAT_PROJECTILES); + // The FOV circle belongs to the aim features, not to ESP, and it is a visual + // aid: use the enable toggle rather than the bind, otherwise it only appears + // while the aim key is held (default bind is mouse5). + bool aim_on = (feature_enabled(FEAT_AIMBOT) || + feature_enabled(FEAT_SILENTAIM)) && + aimbot_fov_circle(); bool toasts = gui_toasts_active(); if (!g_surface || (!gui_is_open() && !draw_test && !esp_on && !items_on && !projs_on && - !toasts)) + !aim_on && !toasts)) return; // Level/menu -> game transitions can invalidate the VGUI font handle. @@ -1147,6 +1126,8 @@ void outer_draw() { if (!panel) return; surf_push_make_current(panel, false); + if (aim_on && overlay_font) + esp_draw_fov_circle(); if (esp_on && overlay_font) esp_draw(); if (items_on && overlay_font) -- cgit v1.2.3