Advertisement
CybEl

Fixed ESP Buffer GDI

Feb 19th, 2020
18,624
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.57 KB | None | 0 0
  1. #include <Windows.h>
  2. #include <TlHelp32.h>
  3.  
  4. /* This fixed buffer was coded by SexOffenderSally, a long time friend! Give him a <3 on discord
  5. Make sure character set is 'Multi-Byte' in project settings! And game must be windowed fullscreen.
  6. Updated offsets: https://github.com/frk1/hazedumper/blob/master/csgo.cs */
  7.  
  8. #define dwEntityList 0x4D3C5FC
  9. #define dwViewMatrix 0x4D2E014
  10. #define m_iTeamNum 0xF4
  11. #define m_iHealth 0x100
  12. #define m_vecOrigin 0x138
  13.  
  14. uintptr_t moduleBase;
  15. HANDLE TargetProcess;
  16. HPEN BoxPen = CreatePen(PS_SOLID, 1, RGB(255, 0, 0));
  17. RECT WBounds;
  18. HWND EspHWND;
  19.  
  20. template<typename T> T RPM(SIZE_T address) {
  21. T buffer;
  22. ReadProcessMemory(TargetProcess, (LPCVOID)address, &buffer, sizeof(T), NULL);
  23. return buffer;
  24. }
  25.  
  26. uintptr_t GetModuleBaseAddress(DWORD dwPid, const char* moduleName) {
  27. uintptr_t dwBase = 0;
  28. do {
  29. HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, dwPid);
  30. if (hSnapshot == INVALID_HANDLE_VALUE) { continue; }
  31. MODULEENTRY32 ModuleEntry32;
  32. ModuleEntry32.dwSize = sizeof(MODULEENTRY32);
  33. if (Module32First(hSnapshot, &ModuleEntry32)) {
  34. do {
  35. if (!strcmp(ModuleEntry32.szModule, (LPSTR)moduleName)) {
  36. dwBase = (DWORD)ModuleEntry32.modBaseAddr;
  37. break;
  38. }
  39. } while (Module32Next(hSnapshot, &ModuleEntry32));
  40. }
  41. CloseHandle(hSnapshot);
  42. } while (!dwBase);
  43. return dwBase;
  44. }
  45.  
  46. struct Vector3 {
  47. float x, y, z;
  48. };
  49.  
  50. struct view_matrix_t {
  51. float matrix[16];
  52. };
  53.  
  54. struct Vector3 WorldToScreen(const struct Vector3 pos, struct view_matrix_t matrix) {
  55. struct Vector3 out;
  56. float _x = matrix.matrix[0] * pos.x + matrix.matrix[1] * pos.y + matrix.matrix[2] * pos.z + matrix.matrix[3];
  57. float _y = matrix.matrix[4] * pos.x + matrix.matrix[5] * pos.y + matrix.matrix[6] * pos.z + matrix.matrix[7];
  58. out.z = matrix.matrix[12] * pos.x + matrix.matrix[13] * pos.y + matrix.matrix[14] * pos.z + matrix.matrix[15];
  59.  
  60. _x *= 1.f / out.z;
  61. _y *= 1.f / out.z;
  62.  
  63. int width = WBounds.right - WBounds.left;
  64. int height = WBounds.bottom + WBounds.left;
  65.  
  66. out.x = width * .5f;
  67. out.y = height * .5f;
  68.  
  69. out.x += 0.5f * _x * width + 0.5f;
  70. out.y -= 0.5f * _y * height + 0.5f;
  71.  
  72. return out;
  73. }
  74.  
  75. void Draw(HDC hdc, Vector3 foot, Vector3 head) {
  76. float height = head.y - foot.y;
  77. float width = height / 2.4f;
  78. SelectObject(hdc, BoxPen);
  79. Rectangle(hdc, foot.x - (width / 2), foot.y, head.x + (width / 2), head.y);
  80. }
  81.  
  82. LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) {
  83. switch (msg) {
  84. case WM_PAINT: {
  85. PAINTSTRUCT ps;
  86. HDC Memhdc;
  87. HDC hdc;
  88. HBITMAP Membitmap;
  89.  
  90. int win_width = WBounds.right - WBounds.left;
  91. int win_height = WBounds.bottom + WBounds.left;
  92.  
  93. hdc = BeginPaint(hwnd, &ps);
  94. Memhdc = CreateCompatibleDC(hdc);
  95. Membitmap = CreateCompatibleBitmap(hdc, win_width, win_height);
  96. SelectObject(Memhdc, Membitmap);
  97. FillRect(Memhdc, &WBounds, WHITE_BRUSH);
  98.  
  99. view_matrix_t vm = RPM<view_matrix_t>(moduleBase + dwViewMatrix);
  100. int localteam = RPM<int>(RPM<DWORD>(moduleBase + dwEntityList) + m_iTeamNum);
  101.  
  102. for (int i = 1; i < 64; i++) {
  103. uintptr_t pEnt = RPM<DWORD>(moduleBase + dwEntityList + (i * 0x10));
  104. int team = RPM<int>(pEnt + m_iTeamNum);
  105.  
  106. if (team != localteam) {
  107. int health = RPM<int>(pEnt + m_iHealth);
  108. Vector3 pos = RPM<Vector3>(pEnt + m_vecOrigin);
  109. Vector3 head; head.x = pos.x; head.y = pos.y; head.z = pos.z + 72.f;
  110. Vector3 screenpos = WorldToScreen(pos, vm);
  111. Vector3 screenhead = WorldToScreen(head, vm);
  112. float height = screenhead.y - screenpos.y;
  113. float width = height / 2.4f;
  114.  
  115. if (screenpos.z >= 0.01f && health > 0 && health < 101) {
  116. Draw(Memhdc, screenpos, screenhead);
  117. }
  118. }
  119. }
  120. BitBlt(hdc, 0, 0, win_width, win_height, Memhdc, 0, 0, SRCCOPY);
  121. DeleteObject(Membitmap);
  122. DeleteDC(Memhdc);
  123. DeleteDC(hdc);
  124. EndPaint(hwnd, &ps);
  125. ValidateRect(hwnd, &WBounds);
  126. }
  127. case WM_ERASEBKGND:
  128. return 1;
  129. case WM_CLOSE:
  130. DestroyWindow(hwnd);
  131. break;
  132. case WM_DESTROY:
  133. PostQuitMessage(0);
  134. break;
  135. default:
  136. return DefWindowProc(hwnd, msg, wParam, lParam);
  137. }
  138. return 0;
  139. }
  140.  
  141. DWORD WorkLoop() {
  142. while (1) {
  143. InvalidateRect(EspHWND, &WBounds, true);
  144. Sleep(16); //16 ms * 60 fps ~ 1000 ms
  145. }
  146. }
  147.  
  148. int main() {
  149. HWND GameHWND = FindWindowA(0, "Counter-Strike: Global Offensive");
  150. GetClientRect(GameHWND, &WBounds);
  151. DWORD dwPid; GetWindowThreadProcessId(GameHWND, &dwPid);
  152. TargetProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, dwPid);
  153. moduleBase = GetModuleBaseAddress(dwPid, "client_panorama.dll");
  154.  
  155. WNDCLASSEX WClass;
  156. MSG Msg;
  157. WClass.cbSize = sizeof(WNDCLASSEX);
  158. WClass.style = NULL;
  159. WClass.lpfnWndProc = WndProc;
  160. WClass.cbClsExtra = NULL;
  161. WClass.cbWndExtra = NULL;
  162. WClass.hInstance = reinterpret_cast<HINSTANCE>(GetWindowLongA(GameHWND, GWL_HINSTANCE));
  163. WClass.hIcon = NULL;
  164. WClass.hCursor = NULL;
  165. WClass.hbrBackground = WHITE_BRUSH;
  166. WClass.lpszMenuName = " ";
  167. WClass.lpszClassName = " ";
  168. WClass.hIconSm = NULL;
  169. RegisterClassExA(&WClass);
  170.  
  171. HINSTANCE Hinstance = NULL;
  172. EspHWND = CreateWindowExA(WS_EX_TRANSPARENT | WS_EX_TOPMOST | WS_EX_LAYERED, " ", " ", WS_POPUP, WBounds.left, WBounds.top, WBounds.right - WBounds.left, WBounds.bottom + WBounds.left, NULL, NULL, Hinstance, NULL);
  173.  
  174. SetLayeredWindowAttributes(EspHWND, RGB(255, 255, 255), 255, LWA_COLORKEY);
  175. ShowWindow(EspHWND, 1);
  176. CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)&WorkLoop, NULL, NULL, NULL);
  177. while (GetMessageA(&Msg, NULL, NULL, NULL) > 0) {
  178. TranslateMessage(&Msg);
  179. DispatchMessageA(&Msg);
  180. Sleep(1);
  181. }
  182. ExitThread(0);
  183. return 0;
  184. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement