From 33f5ed9ef58f26c6b3b52cf605dd4311d658a60d Mon Sep 17 00:00:00 2001 From: salmonik Date: Fri, 6 Nov 2026 16:09:55 +0100 Subject: Fix audit findings: crash safety, correctness, rendering, performance Crash/UB: - gate every hook behind an init-stage flag until config/surface/input are ready - publish module maps as immutable atomic snapshots instead of reallocating shared vectors under unlocked readers - validate the %ebp walk in the RandomSeed/RandomFloat hooks against the stack - bounds-check every RecvTable/RecvProp/string dereference with module_range() - preserve the Itanium vtable header when cloning (client, CInput, model render, studio render) - reject negative usercmd sequence numbers; guard config_load against a null section target; cap the bone parent walk; check mprotect; drop PROT_EXEC on the GOT patch; absorb server.so .bss tail Correctness: - filter dormant entities across ESP, aimbot, triggerbot, melee, items and projectiles (slot self-tested against the local player) - reset the server-health latch per map and only latch on valid model indices - bone cache sized for the 128-target scan; set valid=false on every failure; head_position keeps searching past an invalid bone - vischeck steps past glass by probing until clear, and ignores entities owned by the target (held weapons, bone followers) - aimbot: maxs no longer disables it, AABB-aware FOV prefilter, lock hysteresis, lead point re-checked for FOV and visibility - spread: seed hook arms on the no-spread toggle alone; engine toggle only controls the RandomFloat zeroing - resolve m_hOwnerEntity/m_hOwner; NPC lead velocity from the server entity - vector_angles pitch range, point_ground normal test, underwater jump+duck no longer skips combat, semi-auto press/release edge for synthetic fire - item/projectile markers and blast rings refresh origin per frame while discovery stays at 10 Hz; trajectory uses the real m_DmgRadius and honours the blast-radius toggle Rendering/GUI: - one overlay draw per engine frame (FRAME_RENDER_START boundary), fixing alpha stacking and the speed-graph flicker - clipped lines/outlines and ellipsised text instead of drawing past the content pane or shifting over neighbours - dropdown dismissal consumes the click; hover ignores hidden controls - chams: reset AlphaModulate, reference shared materials once, restore prop tint colour; fonts created once per handle - projection uses Source's 4:3 aspect scaling and roll; screen size refreshed each frame; FOV circle gated on the aim toggles, not the bind Performance: - TTL caches for NPC relation, friendly/neutral and damage class - model names memoised per model index - entity pointer -> index cache for the triggerbot (was a 4096-slot walk/tick) Build: - real Makefile with -MMD dependency tracking, debug/release objects and an always-relink rule; build.sh kept as a thin wrapper --- src/overlay.h | 62 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 src/overlay.h (limited to 'src/overlay.h') diff --git a/src/overlay.h b/src/overlay.h new file mode 100644 index 0000000..6cf86c9 --- /dev/null +++ b/src/overlay.h @@ -0,0 +1,62 @@ +#ifndef HL2H_OVERLAY_H +#define HL2H_OVERLAY_H + +#include + +// VGUI_Surface030 vtable slots, confirmed against the shipped +// vguimatsurface.so. This header is the only place that knows them; every +// consumer goes through the functions below. +enum SurfaceSlot { + SURF_GetEmbeddedPanel = 6, + SURF_PushMakeCurrent = 8, + SURF_PopMakeCurrent = 9, + SURF_DrawSetColor = 10, + SURF_DrawFilledRect = 12, + SURF_DrawOutlinedRect = 14, + SURF_DrawLine = 15, + SURF_DrawSetTextFont = 17, + SURF_DrawSetTextColor = 18, + SURF_DrawSetTextPos = 20, + SURF_DrawPrintText = 22, + SURF_GetScreenSize = 38, + SURF_CreateFont = 66, + SURF_AddGlyphSetToFont = 67, + SURF_GetTextSize = 75 +}; + +using HFont = unsigned long; + +struct ISurface; + +// Set once by install_menu(); every wrapper below is a no-op while it is null. +extern ISurface *g_surface; + +void overlay_color(int r, int g, int b, int a); +void overlay_fill(int x0, int y0, int x1, int y1); +void overlay_outline_rect(int x0, int y0, int x1, int y1); +void overlay_line(int x0, int y0, int x1, int y1); +void overlay_text_font(HFont f); +void overlay_text_color(int r, int g, int b, int a); +void overlay_text_pos(int x, int y); +void overlay_print_text(const wchar_t *text, int count, int draw_type = 0); +HFont overlay_create_font(); +bool overlay_add_glyph_set(HFont f, const char *name, int tall, int weight, + int blur, int scanlines, int flags, int range_min, + int range_max); +void overlay_screen_size(int &w, int &h); +void overlay_text_size(HFont f, const wchar_t *text, int &w, int &h); +int overlay_embedded_panel(); +void overlay_push_make_current(int panel, bool use_insets); +void overlay_pop_make_current(int panel); + +// Per-frame draw budget. The engine calls PaintTraverseEx for every panel, and +// DrawPrintText for every text draw, so the overlay must be collapsed to one +// draw per frame. A timer cannot do that: panels spaced a few ms apart in the +// same frame would draw twice and double the alpha of translucent elements. +// overlay_frame_mark() is called from FRAME_RENDER_START, which is the real +// frame boundary; if that stops arriving (menu/pause) a 10 ms fallback keeps +// the GUI repainting. +void overlay_frame_mark(); +bool overlay_should_draw(); + +#endif -- cgit v1.2.3