commit 0968b3144440986bd0ea39907c6037eabde2dbc2 Author: ALittlePatate Date: Sat Dec 18 13:02:24 2021 +0100 feat: Initial commit of project structure, IDA database, the Tools, readme and license diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..a24dac3 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +.vs +Debug +Ezfrags/Debug diff --git a/Ezfrags.sln b/Ezfrags.sln new file mode 100644 index 0000000..8bfdf6e --- /dev/null +++ b/Ezfrags.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.31729.503 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Ezfrags", "Ezfrags\Ezfrags.vcxproj", "{A5502949-41D2-47BC-9AD3-0BDF34E83300}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {A5502949-41D2-47BC-9AD3-0BDF34E83300}.Debug|x64.ActiveCfg = Debug|x64 + {A5502949-41D2-47BC-9AD3-0BDF34E83300}.Debug|x64.Build.0 = Debug|x64 + {A5502949-41D2-47BC-9AD3-0BDF34E83300}.Debug|x86.ActiveCfg = Debug|Win32 + {A5502949-41D2-47BC-9AD3-0BDF34E83300}.Debug|x86.Build.0 = Debug|Win32 + {A5502949-41D2-47BC-9AD3-0BDF34E83300}.Release|x64.ActiveCfg = Release|x64 + {A5502949-41D2-47BC-9AD3-0BDF34E83300}.Release|x64.Build.0 = Release|x64 + {A5502949-41D2-47BC-9AD3-0BDF34E83300}.Release|x86.ActiveCfg = Release|Win32 + {A5502949-41D2-47BC-9AD3-0BDF34E83300}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {182C1B8B-3A39-4D63-A976-D0317374C0BF} + EndGlobalSection +EndGlobal diff --git a/Ezfrags/AimAssist.cpp b/Ezfrags/AimAssist.cpp new file mode 100644 index 0000000..ef26058 --- /dev/null +++ b/Ezfrags/AimAssist.cpp @@ -0,0 +1,6 @@ +#include "Settings.hpp" +#include "AimAssist.h" + +void aim_assist_thread() { + cheat_thread_state::aim_assist_thread_status = 1; +} \ No newline at end of file diff --git a/Ezfrags/AimAssist.h b/Ezfrags/AimAssist.h new file mode 100644 index 0000000..ae1be91 --- /dev/null +++ b/Ezfrags/AimAssist.h @@ -0,0 +1,3 @@ +#pragma once + +void aim_assist_thread(); \ No newline at end of file diff --git a/Ezfrags/Aimlock.cpp b/Ezfrags/Aimlock.cpp new file mode 100644 index 0000000..921708a --- /dev/null +++ b/Ezfrags/Aimlock.cpp @@ -0,0 +1,6 @@ +#include "Settings.hpp" +#include "Aimlock.h" + +void aimlock_thread() { + cheat_thread_state::aimlock_thread_status = 1; +} \ No newline at end of file diff --git a/Ezfrags/Aimlock.h b/Ezfrags/Aimlock.h new file mode 100644 index 0000000..1e10c17 --- /dev/null +++ b/Ezfrags/Aimlock.h @@ -0,0 +1,3 @@ +#pragma once + +void aimlock_thread(); \ No newline at end of file diff --git a/Ezfrags/BunnyHop.cpp b/Ezfrags/BunnyHop.cpp new file mode 100644 index 0000000..88540af --- /dev/null +++ b/Ezfrags/BunnyHop.cpp @@ -0,0 +1,40 @@ +#include "Settings.hpp" +#include "MemManager.h" +#include "Signatures.h" +#include "BunnyHop.h" +#include "Signatures.h" + +#include +#include + +//This function is about 80% decompiled +void bunnyhop_thread() { + cheat_thread_state::bunnyhop_thread_status = 1; + while (1) { + while (!settings::bunnyhop_bool || !Mem::csgo_found || !Mem::client_dll_found) { + Sleep(5u); + } + + //Mem::RPM(Mem::client + get_sigs::dwLocalPlayer) + bool player_alive = true; + if (player_alive && GetAsyncKeyState(32) < 0)// If we're alive and we're pressing space + { + Mem::WPM(Mem::client + Signatures::dwForceJump, 5);// force jump + Sleep(10u); + Mem::WPM(Mem::client + Signatures::dwForceJump, 4);// unjump + } + Sleep(1u); + + /* + while ( !bunnyhop_bool || !csgo_module || !client_module_found || !byte_4FBF0C || LocalPlayer_notsure == 1 ) + Sleep(5u); + if ( ReadProcessMemory_2(player, v2, v3, v4, v5) && GetAsyncKeyState(32) < 0 )// If we're alive and we're pressing space + { + write_memory((LPVOID)(client + dwForceJump), 5);// force jump + Sleep(10u); + write_memory((LPVOID)(client + dwForceJump), 4);// unjump + } + Sleep(1u); + */ + } +} \ No newline at end of file diff --git a/Ezfrags/BunnyHop.h b/Ezfrags/BunnyHop.h new file mode 100644 index 0000000..9e255be --- /dev/null +++ b/Ezfrags/BunnyHop.h @@ -0,0 +1,3 @@ +#pragma once + +void bunnyhop_thread(); \ No newline at end of file diff --git a/Ezfrags/Ezfrags.cpp b/Ezfrags/Ezfrags.cpp new file mode 100644 index 0000000..cff4016 --- /dev/null +++ b/Ezfrags/Ezfrags.cpp @@ -0,0 +1,140 @@ +#include +#include + +#include "MemManager.cpp" +#include "Signatures.cpp" +#include "ShowFeatures.cpp" +#include "WaitForKeys.cpp" + +#include "AimAssist.cpp" +#include "Aimlock.cpp" +#include "BunnyHop.cpp" +#include "GlowESP.cpp" +#include "KillMessage.cpp" +#include "NoFlash.cpp" +#include "Radar.cpp" +#include "Triggerbot.cpp" + +#include "Settings.hpp" +#include "Ezfrags.h" + +time_t TimeUpdate; + +int main() +{ + SetConsoleTitleA("EZfrags CS:GO multihack v9.65 public [www.EZfrags.co.uk]"); //Ezfrag premium ++ spinbout edition + std::cout << "EZfrags CS:GO multihack v9.65 public [www.EZfrags.co.uk]" << "\n"; + + time(&TimeUpdate); + if (TimeUpdate - 1591304279 > 864000) // If our version is older than 10 days + { + std::cout << '\n' << "!!! WARNING !!!: This version is more than 10 days old."; + std::cout << '\n' << "You should go and download a new build from www.EZfrags.co.uk" << std::endl; + } + + std::cout << '\n' << "The hack will start loading once CS:GO is started." << std::endl; + + std::cout << "\n" << "Loading csgo.exe"; + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)Mem::get_csgo, 0, 0, 0); + + bool instant_csgo = true; + while (!Mem::csgo_found) + { + Sleep(250); + + if (Mem::csgo_found) + { + break; + } + + std::cout << "."; + + instant_csgo = false; + } + + if (instant_csgo) { + std::cout << "...."; + } + + std::cout << std::endl; + + std::cout << "Loading client.dll"; + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)Mem::get_client_base_address, 0, 0, 0); + + bool instant_client = true; + while (!Mem::client_dll_found) + { + Sleep(250); + + if (Mem::client_dll_found) + { + break; + } + + std::cout << "."; + + instant_client = false; + } + + if (instant_client) { + std::cout << "...."; + } + + std::cout << std::endl; + + + std::cout << "Loading engine.dll"; + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)Mem::get_engine_base_address, 0, 0, 0); + + bool instant_engine = true; + while (!Mem::engine_dll_found) + { + + Sleep(250); + + if (Mem::engine_dll_found) + { + break; + } + std::cout << "."; + + instant_engine = false; + } + + if (instant_engine) { + std::cout << "...."; + } + + std::cout << std::endl; + + std::cout << "\n" << "Scanning for offsets..."; + + get_sigs::start(); + + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)radar_thread, 0, 0, 0);// radar_thread + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)aim_assist_thread, 0, 0, 0);// aim_assist_thread + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)no_flash_thread, 0, 0, 0);// no_flash_thread + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)bunnyhop_thread, 0, 0, 0);// bunnyhop_thread + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)aimlock_thread, 0, 0, 0);// aimlock_thread + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)glow_esp_thread, 0, 0, 0);// glow_esp_thread + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)kill_message_thread, 0, 0, 0);// kill_message_thread + CreateThread(0, 0, (LPTHREAD_START_ROUTINE)trigger_thread, 0, 0, 0);// trigger_thread + while (!cheat_thread_state::aim_assist_thread_status + || !cheat_thread_state::aimlock_thread_status + || !cheat_thread_state::no_flash_thread_status + || !cheat_thread_state::glow_esp_thread_status + || !cheat_thread_state::radar_thread_status + || !cheat_thread_state::bunnyhop_thread_status + || !cheat_thread_state::trigger_thread_status + || !cheat_thread_state::kill_message_thread_status) + Sleep(100u); + + update(); + + while (WaitForSingleObject(Mem::process_handle, 0)) { + wait_for_keys(); + } + CloseHandle(Mem::process_handle); + exit(0); +} + diff --git a/Ezfrags/Ezfrags.h b/Ezfrags/Ezfrags.h new file mode 100644 index 0000000..d291b4a --- /dev/null +++ b/Ezfrags/Ezfrags.h @@ -0,0 +1,3 @@ +#pragma once + +int main(); \ No newline at end of file diff --git a/Ezfrags/Ezfrags.vcxproj b/Ezfrags/Ezfrags.vcxproj new file mode 100644 index 0000000..15a6e25 --- /dev/null +++ b/Ezfrags/Ezfrags.vcxproj @@ -0,0 +1,179 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {a5502949-41d2-47bc-9ad3-0bdf34e83300} + Ezfrags + 10.0 + + + + Application + true + v142 + MultiByte + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + Default + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Ezfrags/Ezfrags.vcxproj.filters b/Ezfrags/Ezfrags.vcxproj.filters new file mode 100644 index 0000000..44eda7c --- /dev/null +++ b/Ezfrags/Ezfrags.vcxproj.filters @@ -0,0 +1,120 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + {22c8e2bf-5511-4a73-baf5-ff24109b3af1} + + + {252e8f23-1acb-462d-b403-e33b980580de} + + + {93ecdca2-1ebf-408b-b23c-89a0bdb5cbc1} + + + + + Fichiers sources + + + Memory + + + Memory + + + + + Memory + + + Memory + + + Console + + + Fichiers sources + + + Console + + + Hacks + + + Hacks + + + Hacks + + + Hacks + + + Hacks + + + Hacks + + + Hacks + + + Hacks + + + Console + + + Console + + + Memory + + + Memory + + + Hacks + + + Hacks + + + Hacks + + + Hacks + + + Hacks + + + Hacks + + + Hacks + + + Hacks + + + Fichiers sources + + + Memory + + + \ No newline at end of file diff --git a/Ezfrags/Ezfrags.vcxproj.user b/Ezfrags/Ezfrags.vcxproj.user new file mode 100644 index 0000000..0f14913 --- /dev/null +++ b/Ezfrags/Ezfrags.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/Ezfrags/Get.cpp b/Ezfrags/Get.cpp new file mode 100644 index 0000000..b7ee13f --- /dev/null +++ b/Ezfrags/Get.cpp @@ -0,0 +1,9 @@ +#include "MemManager.h" +#include "Signatures.h" +#include "Get.h" + +namespace Get { + INT32 LocalPlayer() { + return Mem::RPM(Mem::client + Signatures::dwLocalPlayer); + } +} diff --git a/Ezfrags/Get.h b/Ezfrags/Get.h new file mode 100644 index 0000000..e13a2de --- /dev/null +++ b/Ezfrags/Get.h @@ -0,0 +1,6 @@ +#pragma once +#include + +namespace Get { + INT32 LocalPlayer(); +} \ No newline at end of file diff --git a/Ezfrags/GlowESP.cpp b/Ezfrags/GlowESP.cpp new file mode 100644 index 0000000..a4980cd --- /dev/null +++ b/Ezfrags/GlowESP.cpp @@ -0,0 +1,6 @@ +#include "Settings.hpp" +#include "GlowESP.h" + +void glow_esp_thread() { + cheat_thread_state::glow_esp_thread_status = 1; +} \ No newline at end of file diff --git a/Ezfrags/GlowESP.h b/Ezfrags/GlowESP.h new file mode 100644 index 0000000..fe7e5c8 --- /dev/null +++ b/Ezfrags/GlowESP.h @@ -0,0 +1,3 @@ +#pragma once + +void glow_esp_thread(); \ No newline at end of file diff --git a/Ezfrags/KillMessage.cpp b/Ezfrags/KillMessage.cpp new file mode 100644 index 0000000..e059273 --- /dev/null +++ b/Ezfrags/KillMessage.cpp @@ -0,0 +1,6 @@ +#include "Settings.hpp" +#include "KillMessage.h" + +void kill_message_thread() { + cheat_thread_state::kill_message_thread_status = 1; +} \ No newline at end of file diff --git a/Ezfrags/KillMessage.h b/Ezfrags/KillMessage.h new file mode 100644 index 0000000..9f8ef2d --- /dev/null +++ b/Ezfrags/KillMessage.h @@ -0,0 +1,3 @@ +#pragma once + +void kill_message_thread(); \ No newline at end of file diff --git a/Ezfrags/MemManager.cpp b/Ezfrags/MemManager.cpp new file mode 100644 index 0000000..f3002c1 --- /dev/null +++ b/Ezfrags/MemManager.cpp @@ -0,0 +1,165 @@ +#include +#include +#include +#include +#include "MemManager.h" + +namespace Mem { + inline MODULEENTRY32 get_module(const char* modName, DWORD proc_id) { + HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, proc_id); + if (hSnap != INVALID_HANDLE_VALUE) { + MODULEENTRY32 modEntry; + modEntry.dwSize = sizeof(modEntry); + if (Module32First(hSnap, &modEntry)) { + do { + if (!strcmp(modEntry.szModule, modName)) { + CloseHandle(hSnap); + return modEntry; + } + } while (Module32Next(hSnap, &modEntry)); + } + } + MODULEENTRY32 module = { (DWORD)-1 }; + return module; + } + + inline void get_csgo() { + while (1) { + //Get a window handle to csgo + HWND hw_csgo = FindWindowA(NULL, "Counter-Strike: Global Offensive - Direct3D 9"); + + if (hw_csgo) { + csgo_found = true; + //Get csgo's process ID using the handle (No need to make some big function for procid like every other paster does) + GetWindowThreadProcessId(hw_csgo, &dw_process_id); + Mem::process_handle = OpenProcess(PROCESS_VM_READ | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, false, dw_process_id); + break; + } + } + + } + + inline void get_client_base_address() { + while (1) { + Mem::dw_client_address = get_module("client.dll", dw_process_id); + Mem::client_bytes = new uint8_t[Mem::dw_client_address.modBaseSize]; //making a variable size of the module + + Mem::client = (uintptr_t)dw_client_address.modBaseAddr; + + if (Mem::client_bytes) { + client_dll_found = true; + break; + } + + DWORD bytes_read; + ReadProcessMemory(process_handle, Mem::dw_client_address.modBaseAddr, Mem::client_bytes, Mem::dw_client_address.modBaseSize, &bytes_read); //reading the module and storing as bytes_read + if (bytes_read != Mem::dw_client_address.modBaseSize) throw; //checking that the size of bytes read is = to size of bytes in the module + delete[] Mem::client_bytes; + } + } + + inline void get_engine_base_address() { + while (1) { + MODULEENTRY32 dw_engine_address = get_module("engine.dll", dw_process_id); + engine_bytes = new uint8_t[dw_engine_address.modBaseSize]; //making a variable size of the module + + Mem::engine = (uintptr_t)dw_engine_address.modBaseAddr; + + if (engine_bytes) { + engine_dll_found = true; + break; + } + + DWORD bytes_read; + ReadProcessMemory(process_handle, dw_engine_address.modBaseAddr, engine_bytes, dw_engine_address.modBaseSize, &bytes_read); //reading the module and storing as bytes_read + if (bytes_read != dw_engine_address.modBaseSize) throw; //checking that the size of bytes read is = to size of bytes in the module + delete[] Mem::engine_bytes; + } + } + + //https://github.com/Made0x0000000a/nyfox/blob/main/csgoCheat/patternscan.cpp + DWORD FindAddress(const wchar_t* moduleName, const char* pattern, const char* mask, const int offset=0, const int extra=0) { + const MODULEENTRY32 moduleEntry = Mem::dw_client_address; + const HANDLE hProcess = Mem::process_handle; + + // No Module Entry found + if (!moduleEntry.th32ModuleID) { + return NULL; + } + + // Module base address = scan starting point + uintptr_t base = (uintptr_t)moduleEntry.modBaseAddr; + // Size of Module = scan end point + uintptr_t size = base + moduleEntry.modBaseSize; + + uintptr_t curChunk = base; + SIZE_T bytesRead; + DWORD res; + int res_plus_offset = 0; + + while (curChunk < size) { + // Area to scan + char buffer[4096]; + + // Change read protection, raed memory and change read protection back to the original + DWORD oProtect; + VirtualProtectEx(hProcess, (LPVOID)curChunk, sizeof(buffer), PAGE_EXECUTE_READWRITE, &oProtect); + ReadProcessMemory(hProcess, (LPVOID)curChunk, &buffer, sizeof(buffer), &bytesRead); + VirtualProtectEx(hProcess, (LPVOID)curChunk, sizeof(buffer), oProtect, &oProtect); + + // No bytes read + if (bytesRead == 0) { + return NULL; + } + + DWORD internalAddr = Mem::FindPattern((char*)&buffer, bytesRead, pattern, mask); + + if (internalAddr != NULL) { + // Calculate real address + uintptr_t offsetFromBuffer = (uintptr_t)internalAddr - (uintptr_t)&buffer; + res = (DWORD)(curChunk + offsetFromBuffer); + res_plus_offset = Mem::RPM(res + offset); //Adding the offset + return res_plus_offset - (DWORD)Mem::dw_client_address.modBaseAddr + extra; //adding the extra + } + else { + // Next chunk + curChunk += bytesRead; + } + } + return NULL; + } + + // Find matching pattern + DWORD FindPattern(char* base, size_t size, const char* pattern, const char* mask) { + size_t patternLen = strlen(mask); + + for (DWORD i = 0; i < size - patternLen; i++) { + bool found = true; + + for (DWORD j = 0; j < patternLen; j++) { + + if (mask[j] != '?' && pattern[j] != *(base + i + j)) { + found = false; + break; + } + } + + if (found) { + return (DWORD)(base + i); + } + } + + return NULL; + } + + template T RPM(SIZE_T address) { + T buffer; + ReadProcessMemory(process_handle, (LPCVOID)address, &buffer, sizeof(T), NULL); + return buffer; + } + + template void WPM(SIZE_T address, T buffer) { + WriteProcessMemory(process_handle, (LPVOID)address, &buffer, sizeof(buffer), NULL); + } + +} \ No newline at end of file diff --git a/Ezfrags/MemManager.h b/Ezfrags/MemManager.h new file mode 100644 index 0000000..d045905 --- /dev/null +++ b/Ezfrags/MemManager.h @@ -0,0 +1,29 @@ +#pragma once +#include +#include +#include +#include + +namespace Mem { + static bool csgo_found = false; + static bool client_dll_found = false; + static bool engine_dll_found = false; + static uintptr_t client; + static uintptr_t engine; + static DWORD dw_process_id; + static MODULEENTRY32 dw_client_address; + static MODULEENTRY32 dw_engine_address; + static HANDLE process_handle; + static uint8_t* client_bytes; + static uint8_t* engine_bytes; + + inline MODULEENTRY32 get_module(const char* modName, DWORD proc_id); + inline void get_csgo(); + inline void get_client_base_address(); + inline void get_engine_base_address(); + DWORD FindAddress(const wchar_t* moduleName, const char* pattern, const char* mask, const int offset, const int extra); + DWORD FindPattern(char* base, size_t size, const char* pattern, const char* mask); + + template T RPM(SIZE_T address); + template void WPM(SIZE_T address, T buffer); +} diff --git a/Ezfrags/NoFlash.cpp b/Ezfrags/NoFlash.cpp new file mode 100644 index 0000000..9c124f2 --- /dev/null +++ b/Ezfrags/NoFlash.cpp @@ -0,0 +1,49 @@ +#include "Settings.hpp" +#include "MemManager.h" +#include "Signatures.h" +#include "Get.h" +#include "NoFlash.h" + +//This function has been 100% decompiled ! +//Not actually, still remains : +/* + while ( !csgo_module || !client_module_found || !byte_4FBF0C ) + Sleep(5u); +*/ +//But i simplified it here +//No idea what byte_4FBF0C is, seems used in the GetEngine function of Ezfrags, it's yet to be decompiled + +void no_flash_thread() { + cheat_thread_state::no_flash_thread_status = 1; + + while (1) + { + while (!Mem::csgo_found || !Mem::client_dll_found) + Sleep(5u); + + if (settings::no_flash_bool) + { + /* + if (ReadProcessMemory_0((char*)player + m_flFlashMaxAlpha) > 0.0)// If flash value is > 0 + WriteProcessMemory_0((char*)player + m_flFlashMaxAlpha, (float)0.0);// We put anti flash + */ + if (Mem::RPM(Get::LocalPlayer() + Netvars::m_flFlashMaxAlpha) > 0.0f) + Mem::WPM(Get::LocalPlayer() + Netvars::m_flFlashMaxAlpha, 0.0f); + } + + /* + else if (0.0 == ReadProcessMemory_0((char*)player + m_flFlashMaxAlpha))// We need to reset the flash value to 255 + { + WriteProcessMemory_0((char*)player + m_flFlashMaxAlpha, (float)255.0);// Yop + } + */ + + else if (Mem::RPM(Get::LocalPlayer() + Netvars::m_flFlashMaxAlpha) == 0.0f) { + Mem::WPM(Get::LocalPlayer() + Netvars::m_flFlashMaxAlpha, 255.0f); + } + + //std::cout << Mem::RPM(Signatures::dwLocalPlayer + Netvars::m_flFlashMaxAlpha) << std::endl; + //Sleep(300); + Sleep(1u); + } +} \ No newline at end of file diff --git a/Ezfrags/NoFlash.h b/Ezfrags/NoFlash.h new file mode 100644 index 0000000..dbe757f --- /dev/null +++ b/Ezfrags/NoFlash.h @@ -0,0 +1,3 @@ +#pragma once + +void no_flash_thread(); \ No newline at end of file diff --git a/Ezfrags/Radar.cpp b/Ezfrags/Radar.cpp new file mode 100644 index 0000000..b8a46f6 --- /dev/null +++ b/Ezfrags/Radar.cpp @@ -0,0 +1,6 @@ +#include "Settings.hpp" +#include "Radar.h" + +void radar_thread() { + cheat_thread_state::radar_thread_status = 1; +} \ No newline at end of file diff --git a/Ezfrags/Radar.h b/Ezfrags/Radar.h new file mode 100644 index 0000000..19adb2e --- /dev/null +++ b/Ezfrags/Radar.h @@ -0,0 +1,3 @@ +#pragma once + +void radar_thread(); \ No newline at end of file diff --git a/Ezfrags/Settings.hpp b/Ezfrags/Settings.hpp new file mode 100644 index 0000000..87a6fa7 --- /dev/null +++ b/Ezfrags/Settings.hpp @@ -0,0 +1,28 @@ +#pragma once + +namespace settings { + bool glow_esp_bool = 1; + int trigger_mode_switch_1 = 0; + int trigger_mode_switch_2 = 0; + int trigger_delay = 30; + bool aimlock_bool = 1; + int aimlock_bone = 6; //8 : chest, 6 : head + bool radar_bool = 1; + bool aim_assist_bool = 1; + int aim_assist_bone = 6; //8 : chest, 6 : head + float aim_fov = 25.0; + bool bunnyhop_bool = 1; + bool kill_message_bool = 1; + bool no_flash_bool = 1; +}; + +namespace cheat_thread_state { + bool aim_assist_thread_status = 0; + bool aimlock_thread_status = 0; + bool no_flash_thread_status = 0; + bool glow_esp_thread_status = 0; + bool radar_thread_status = 0; + bool bunnyhop_thread_status = 0; + bool trigger_thread_status = 0; + bool kill_message_thread_status = 0; +} \ No newline at end of file diff --git a/Ezfrags/ShowFeatures.cpp b/Ezfrags/ShowFeatures.cpp new file mode 100644 index 0000000..e0076a7 --- /dev/null +++ b/Ezfrags/ShowFeatures.cpp @@ -0,0 +1,65 @@ +#include +#include +#include "ShowFeatures.h" +#include "Settings.hpp" + +time_t Time; + +void update() { + system("cls"); + + std::cout << "EZfrags CS:GO multihack v9.65 public [www.EZfrags.co.uk]" << "\n"; + + time(&Time); + if (Time - 1591304279 > 864000) // If our version is older than 10 days + { + std::cout << '\n' << "!!! WARNING !!!: This version is more than 10 days old."; + std::cout << '\n' << "You should go and download a new build from www.EZfrags.co.uk" << std::endl; + } + + std::cout << '\n' << "The hack has been loaded. Have fun!" << std::endl; + + std::cout << "\n" << "TRIGGERBOT "; + if (settings::trigger_mode_switch_2 && settings::trigger_mode_switch_1 != 1) + { + std::cout << "AUTO"; + } + else if (settings::trigger_mode_switch_2 != 1 && settings::trigger_mode_switch_1) + { + std::cout << "HOLD"; + } + else if (settings::trigger_mode_switch_2 != 1 && settings::trigger_mode_switch_1 != 1) + { + std::cout << "OFF"; + } + + std::cout << " @ " << settings::trigger_delay << " MS"; + + std::cout << std::endl; + + std::cout << "AIM ASSIST " << settings::aim_assist_bool << " @ "; + if (settings::aim_assist_bone == 8) { + std::cout << "CHEST" << std::endl; + } + else { + std::cout << "HEAD" << std::endl; + } + + std::cout << "AIMLOCK " << settings::aimlock_bool << " @ "; + if (settings::aimlock_bone == 8) { + std::cout << "CHEST" << std::endl; + } + else { + std::cout << "HEAD" << std::endl; + } + + std::cout << "GLOW ESP " << settings::glow_esp_bool << std::endl; + + std::cout << "RADAR HACK " << settings::radar_bool << std::endl; + + std::cout << "NO FLASH HACK " << settings::no_flash_bool << std::endl; + + std::cout << "BUNNY HOP " << settings::bunnyhop_bool << std::endl; + + std::cout << "KILL MESSAGE " << settings::kill_message_bool; +} \ No newline at end of file diff --git a/Ezfrags/ShowFeatures.h b/Ezfrags/ShowFeatures.h new file mode 100644 index 0000000..98e9d94 --- /dev/null +++ b/Ezfrags/ShowFeatures.h @@ -0,0 +1,3 @@ +#pragma once + +void update(); \ No newline at end of file diff --git a/Ezfrags/Signatures.cpp b/Ezfrags/Signatures.cpp new file mode 100644 index 0000000..21b4622 --- /dev/null +++ b/Ezfrags/Signatures.cpp @@ -0,0 +1,24 @@ +#include "MemManager.h" +#include "netvars.h" +#include "Signatures.h" +#include +#include + +namespace get_sigs { + //https://github.com/HeathHowren/Pattern-Scanning/blob/master/patternscanexternal/Source.cpp + + void start() { + //Netvars + DWORD dwGetAllClasses = Mem::FindAddress(L"client.dll", "\xA1\x00\x00\x00\x00\xC3\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xA1\x00\x00\x00\x00\xB9","x????xxxxxxxxxxxx????x", 1, 0) + (uintptr_t)Mem::dw_client_address.modBaseAddr; + DWORD dwGetAllClasses_deref = Mem::RPM(dwGetAllClasses); + DWORD dwGetAllClasses_offset = dwGetAllClasses_deref - (uintptr_t)Mem::dw_client_address.modBaseAddr; + + std::unique_ptr NetvarManager(new NetvarsClass((uintptr_t)Mem::dw_client_address.modBaseAddr + dwGetAllClasses_offset)); + Netvars::m_fFlags = NetvarManager->NETVAR("DT_CSPlayer", "m_fFlags"); + Netvars::m_flFlashMaxAlpha = NetvarManager->NETVAR("DT_CSPlayer", "m_flFlashMaxAlpha"); + + //Signatures + Signatures::dwLocalPlayer = Mem::FindAddress(L"client.dll", "\x8D\x34\x85\x00\x00\x00\x00\x89\x15\x00\x00\x00\x00\x8B\x41\x08\x8B\x48\x04\x83\xF9\xFF", "xxx????xx????xxxxxxxxx", 3, 4); + Signatures::dwForceJump = Mem::FindAddress(L"client.dll", "\x8B\x0D\x00\x00\x00\x00\x8B\xD6\x8B\xC1\x83\xCA\x02", "xx????xxxxxxx", 2, 0); + } +} diff --git a/Ezfrags/Signatures.h b/Ezfrags/Signatures.h new file mode 100644 index 0000000..0968d3b --- /dev/null +++ b/Ezfrags/Signatures.h @@ -0,0 +1,16 @@ +#pragma once +#include + +namespace get_sigs { + void start(); +} + +namespace Signatures { + static DWORD dwForceJump; + static DWORD dwLocalPlayer; +} + +namespace Netvars { + static int m_fFlags; + static int m_flFlashMaxAlpha; +} \ No newline at end of file diff --git a/Ezfrags/Triggerbot.cpp b/Ezfrags/Triggerbot.cpp new file mode 100644 index 0000000..a9e0a11 --- /dev/null +++ b/Ezfrags/Triggerbot.cpp @@ -0,0 +1,6 @@ +#include "Settings.hpp" +#include "Triggerbot.h" + +void trigger_thread() { + cheat_thread_state::trigger_thread_status = 1; +} \ No newline at end of file diff --git a/Ezfrags/Triggerbot.h b/Ezfrags/Triggerbot.h new file mode 100644 index 0000000..19d8d54 --- /dev/null +++ b/Ezfrags/Triggerbot.h @@ -0,0 +1,3 @@ +#pragma once + +void trigger_thread(); \ No newline at end of file diff --git a/Ezfrags/WaitForKeys.cpp b/Ezfrags/WaitForKeys.cpp new file mode 100644 index 0000000..f4f460c --- /dev/null +++ b/Ezfrags/WaitForKeys.cpp @@ -0,0 +1,135 @@ +#include +#include +#include "WaitForKeys.h" +#include "ShowFeatures.h" +#include "Settings.hpp" + +void wait_for_keys() +{ + if (GetAsyncKeyState(16) >= 0 && GetAsyncKeyState(117) < 0)// + // F6 - cycle through triggerbot modes (autofire, hold key, disabled - default) + // SHIFT+F6 - cycle through triggerbot delays (10, 30 - default, 50, 80, 110, 140) + { + while (GetAsyncKeyState(16) >= 0 && GetAsyncKeyState(117) < 0) + Sleep(75u); + if (settings::trigger_mode_switch_2 && settings::trigger_mode_switch_1 != 1)// mode switching (f6) + { + settings::trigger_mode_switch_2 = 0; + settings::trigger_mode_switch_1 = 1; + } + else if (settings::trigger_mode_switch_2 != 1 && settings::trigger_mode_switch_1) + { + settings::trigger_mode_switch_2 = 0; + settings::trigger_mode_switch_1 = 0; + } + else if (settings::trigger_mode_switch_2 != 1 && settings::trigger_mode_switch_1 != 1) + { + settings::trigger_mode_switch_2 = 1; + settings::trigger_mode_switch_1 = 0; + } + update(); + } + if (GetAsyncKeyState(16) < 0 && GetAsyncKeyState(117) < 0) + { + while (GetAsyncKeyState(16) < 0 && GetAsyncKeyState(117) < 0) + Sleep(75u); + if (settings::trigger_delay == 140) // Delay switching (shift + f6) + { + settings::trigger_delay = 10; + } + else if (settings::trigger_delay == 10 || settings::trigger_delay == 30) + { + settings::trigger_delay += 20; + } + else + { + settings::trigger_delay += 30; + } + update(); + } + if (GetAsyncKeyState(16) >= 0 && GetAsyncKeyState(118) < 0)// + // F7 - toggle aim assist + // SHIFT+F7 - toggle aim assist mode (rage/legit) + { + while (GetAsyncKeyState(16) >= 0 && GetAsyncKeyState(118) < 0) + Sleep(75u); + settings::aim_assist_bool = settings::aim_assist_bool == 0; + update(); + } + if (GetAsyncKeyState(16) < 0 && GetAsyncKeyState(118) < 0) + { + while (GetAsyncKeyState(16) < 0 && GetAsyncKeyState(118) < 0) + Sleep(75u); + if (settings::aim_assist_bone == 8) // mode switching (shift + f7) + { + settings::aim_assist_bone = 6; // switching between bones, head and chest + settings::aim_fov = 25.0; // switching between 25.0 and 100.0 fov + } + else + { + settings::aim_assist_bone = 8; + settings::aim_fov = 100.0; + } + update(); + } + if (GetAsyncKeyState(16) >= 0 && GetAsyncKeyState(119) < 0)// + // F8 - toggle aimlock 119 + // SHIFT+F8 - toggle aimlock target (head/chest) + { + while (GetAsyncKeyState(16) >= 0 && GetAsyncKeyState(119) < 0) + Sleep(75u); + settings::aimlock_bool = settings::aimlock_bool == 0; + update(); + } + if (GetAsyncKeyState(16) < 0 && GetAsyncKeyState(119) < 0) + { + while (GetAsyncKeyState(16) < 0 && GetAsyncKeyState(119) < 0) + Sleep(75u); + if (settings::aimlock_bone == 8) // switching between bones, head and chest + settings::aimlock_bone = 6; + else + settings::aimlock_bone = 8; + update(); + } + if (GetAsyncKeyState(16) >= 0 && GetAsyncKeyState(120) < 0)// + // F9 - toggle GlowESP 120 + // SHIFT+F9 - toggle radar hack + { + while (GetAsyncKeyState(16) >= 0 && GetAsyncKeyState(120) < 0) + Sleep(75u); + settings::glow_esp_bool = settings::glow_esp_bool == 0; + update(); + } + if (GetAsyncKeyState(16) < 0 && GetAsyncKeyState(120) < 0) + { + while (GetAsyncKeyState(16) < 0 && GetAsyncKeyState(120) < 0) + Sleep(75u); + settings::radar_bool = settings::radar_bool == 0; + update(); + } + if (GetAsyncKeyState(121) < 0) // + // F10 - toggle no flash hack + { + while (GetAsyncKeyState(121) < 0) + Sleep(75u); + settings::no_flash_bool = settings::no_flash_bool == 0; + update(); + } + if (GetAsyncKeyState(16) >= 0 && GetAsyncKeyState(122) < 0)// + // F11 - toggle bunny hop 122 + // SHIFT+F11 - toggle kill message + { + while (GetAsyncKeyState(16) >= 0 && GetAsyncKeyState(122) < 0) + Sleep(75u); + settings::bunnyhop_bool = settings::bunnyhop_bool == 0; + update(); + } + if (GetAsyncKeyState(16) < 0 && GetAsyncKeyState(122) < 0) + { + while (GetAsyncKeyState(16) < 0 && GetAsyncKeyState(122) < 0) + Sleep(75u); + settings::kill_message_bool = settings::kill_message_bool == 0; + update(); + } + Sleep(25u); +} \ No newline at end of file diff --git a/Ezfrags/WaitForKeys.h b/Ezfrags/WaitForKeys.h new file mode 100644 index 0000000..03fd958 --- /dev/null +++ b/Ezfrags/WaitForKeys.h @@ -0,0 +1,3 @@ +#pragma once + +void wait_for_keys(); \ No newline at end of file diff --git a/Ezfrags/netvars.h b/Ezfrags/netvars.h new file mode 100644 index 0000000..f6b5d0d --- /dev/null +++ b/Ezfrags/netvars.h @@ -0,0 +1,72 @@ +#pragma once +#include +#include +#include + +#include "MemManager.h" + +class NetvarsClass { +private: + class RecvTable { + public: + std::string GetTableName() { + DWORD offset = Mem::RPM((DWORD)this + 0xC); + char tableName[128]; + ReadProcessMemory(Mem::process_handle, (LPCVOID)offset, &tableName, sizeof(tableName), 0); + return std::string(tableName); + } + void* GetProperty(int i) { // RecvProp* + return (void*)(Mem::RPM((DWORD)this) + 0x3C * i); + } + int GetMaxProp() { + return Mem::RPM((DWORD)this + 0x4); + } + }; + class ClientClass { + public: + void* GetTable() { // RecvTable* + return Mem::RPM((DWORD)this + 0xC); + } + void* GetNextClass() { // ClientClass* + return Mem::RPM((DWORD)this + 0x10); + } + }; + class RecvProp { + public: + std::string GetVarName() { + DWORD offset = Mem::RPM((DWORD)this); + char vName[128]; + ReadProcessMemory(Mem::process_handle, (LPCVOID)offset, &vName, sizeof(vName), 0); + return std::string(vName); + } + int GetOffset() { + return Mem::RPM((DWORD)this + 0x2C); + } + void* GetDataTable() { // RecvTable* + return Mem::RPM((DWORD)this + 0x28); + } + }; + DWORD CheckProps(RecvTable* DataTable, std::string NetVarName) { + for (int i = 0; i < DataTable->GetMaxProp(); i++) { + auto pRecvProp = reinterpret_cast(DataTable->GetProperty(i)); + auto VarName = pRecvProp->GetVarName(); + if (isdigit(VarName[0])) continue; + if (NetVarName.compare(VarName) == 0) return pRecvProp->GetOffset(); + if (auto DataTable2 = reinterpret_cast(pRecvProp->GetDataTable())) + if (auto Offset = CheckProps(DataTable2, NetVarName)) return Offset; + } + return NULL; + } + DWORD dwGetAllClasses; + +public: + NetvarsClass(DWORD Base) : dwGetAllClasses(Base) {} + DWORD NETVAR(std::string ClassName, std::string NetVarName) { + if (auto pClass = reinterpret_cast(dwGetAllClasses)) + for (; pClass != NULL; pClass = reinterpret_cast(pClass->GetNextClass())) + if (auto Table = reinterpret_cast(pClass->GetTable())) + if (Table->GetTableName().compare(ClassName) == 0) + if (auto Offset = CheckProps(Table, NetVarName)) return Offset; + return NULL; + } +}; \ No newline at end of file diff --git a/LICENSE.txt b/LICENSE.txt new file mode 100644 index 0000000..e69de29 diff --git a/README.md b/README.md new file mode 100644 index 0000000..e69de29 diff --git a/Reversing/ezfrags.exe.idb b/Reversing/ezfrags.exe.idb new file mode 100644 index 0000000..ab3de58 Binary files /dev/null and b/Reversing/ezfrags.exe.idb differ diff --git a/Tools/convert_pattern.py b/Tools/convert_pattern.py new file mode 100644 index 0000000..39d8ac8 --- /dev/null +++ b/Tools/convert_pattern.py @@ -0,0 +1,28 @@ +import sys + +""" +Basically converting a given pattern in this form : +8D 34 85 ? ? ? ? 89 15 ? ? ? ? 8B 41 08 8B 48 04 83 F9 FF +to this : +\x8D\x34\x85\x00\x00\x00\x00\x89\x15\x00\x00\x00\x00\x8B\x41\x08\x8B\x48\x04\x83\xF9\xFF +xxx????xx????xxxxxxxxx + +It also generates the mask for the signature. +The code isn't optimized because idc +""" + +sig = sys.argv[1] +sig = "\\x" + sig +temp = sig.replace(" ","\\x") +res = temp.replace("?","00") +print(res) + +res_list = sig.split(" ") +res_mask = "" +for charac in res_list : + if charac == "?" : + res_mask += "?" + else : + res_mask += "x" + +print(res_mask) \ No newline at end of file diff --git a/how to use.txt b/how to use.txt new file mode 100644 index 0000000..3313670 --- /dev/null +++ b/how to use.txt @@ -0,0 +1,20 @@ +The hack will start loading once CS:GO is started. +If the hack doesn't work, try clicking the 'Unblock' button in the .exe's properties. +Running the hack with administrator rights might sort it out, too. + +Keys: +- Left ALT - hold LALT to lock onto an enemy +- SPACE - hold SPACE to use bunny hop +- MOUSE5 and Middle Mouse Button - triggerbot hold keys + +- F6 - cycle through triggerbot modes (autofire, hold key, disabled - default) +- SHIFT+F6 - cycle through triggerbot delays (10, 30 - default, 50, 80, 110, 140) +- F7 - toggle aim assist +- SHIFT+F7 - toggle aim assist mode (rage/legit) +- F8 - toggle aimlock +- SHIFT+F8 - toggle aimlock target (head/chest) +- F9 - toggle GlowESP +- SHIFT+F9 - toggle radar hack +- F10 - toggle no flash hack +- F11 - toggle bunny hop +- SHIFT+F11 - toggle kill message \ No newline at end of file