+
+/*
+ * MouseClassServiceCallbackTrick
+ *
+ * initializing data, jmps at MouHid_ReadComplete ->
+ * MouHid_ReadComplete will call MouseClassServiceCallback, what does in the end spoof the _ReturnAddress.
+ *
+ * this method was used safely at many platforms since of May 2021 to this day.
+ *
+ * the method did get blocked by VGK.sys 19.08.2022, (asdf144) did use it there.
+ * from what i have heard, he didn't get banned.
+ *
+ * maybe they are checking: (PsGetCurrentThreadId() != 0) = block input
+ * since all mouse DPC is done by system KiIdleLoop, ThreadId (0).
+ *
+ * otherwise should be fine, until anti-cheats start to properly validate it.
+ *
+ *
+ * Pros: Anti-Cheat hook does get called, and if they do compare input data to game, it will match.
+ * Cons: Ballsy move, its about taking risk and hoping anti-cheat is not going to check anything else than _ReturnAddress.
+ *
+ */
+
+typedef int BOOL;
+typedef unsigned int DWORD;
+typedef ULONG_PTR QWORD;
+
+#pragma warning(disable : 4201)
+typedef struct _MOUSE_INPUT_DATA {
+ USHORT UnitId;
+ USHORT Flags;
+ union {
+ ULONG Buttons;
+ struct {
+ USHORT ButtonFlags;
+ USHORT ButtonData;
+ };
+ };
+ ULONG RawButtons;
+ LONG LastX;
+ LONG LastY;
+ ULONG ExtraInformation;
+} MOUSE_INPUT_DATA, *PMOUSE_INPUT_DATA;
+
+
+
+typedef struct _MOUSE_OBJECT
+{
+ PDEVICE_OBJECT mouse_device;
+ QWORD service_callback;
+ BOOL use_mouse;
+} MOUSE_OBJECT, * PMOUSE_OBJECT;
+
+
+BOOL mouse_open(void);
+MOUSE_OBJECT gMouseObject;
+
+
+
+NTSYSCALLAPI
+POBJECT_TYPE* IoDriverObjectType;
+
+NTSYSCALLAPI
+NTSTATUS
+ObReferenceObjectByName(
+ __in PUNICODE_STRING ObjectName,
+ __in ULONG Attributes,
+ __in_opt PACCESS_STATE AccessState,
+ __in_opt ACCESS_MASK DesiredAccess,
+ __in POBJECT_TYPE ObjectType,
+ __in KPROCESSOR_MODE AccessMode,
+ __inout_opt PVOID ParseContext,
+ __out PVOID *Object
+ );
+
+
+void NtSleep(DWORD milliseconds)
+{
+ QWORD ms = milliseconds;
+ ms = (ms * 1000) * 10;
+ ms = ms * -1;
+#ifdef _KERNEL_MODE
+ KeDelayExecutionThread(KernelMode, 0, (PLARGE_INTEGER)&ms);
+#else
+ NtDelayExecution(0, (PLARGE_INTEGER)&ms);
+#endif
+}
+
+void mouse_move(long x, long y, unsigned short button_flags);
+static QWORD GetSystemBaseAddress(PDRIVER_OBJECT DriverObject, const unsigned short* driver_name);
+static QWORD FindPattern(QWORD module, unsigned char *bMask, char *szMask, QWORD len);
+
+VOID
+DriverUnload(
+ _In_ struct _DRIVER_OBJECT* DriverObject
+)
+{
+ UNREFERENCED_PARAMETER(DriverObject);
+ DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] MouseClassServiceCallbackTrick.sys is closed\n");
+}
+
+QWORD g_target_routine = 0;
+
+NTSTATUS DriverEntry(
+ _In_ PDRIVER_OBJECT DriverObject,
+ _In_ PUNICODE_STRING RegistryPath
+)
+{
+ UNREFERENCED_PARAMETER(DriverObject);
+ UNREFERENCED_PARAMETER(RegistryPath);
+
+ if (!mouse_open())
+ {
+ return STATUS_DRIVER_ENTRYPOINT_NOT_FOUND;
+ }
+
+
+ QWORD base = GetSystemBaseAddress(DriverObject, L"mouhid.sys");
+ if (base == 0)
+ {
+ return STATUS_DRIVER_ENTRYPOINT_NOT_FOUND;
+ }
+
+ g_target_routine = FindPattern((QWORD)base, (unsigned char*)"\x74\x54", "xx", 2);
+ if (g_target_routine == 0)
+ {
+ return STATUS_DRIVER_ENTRYPOINT_NOT_FOUND;
+ }
+ g_target_routine += 0x56;
+
+
+ DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] MouseClassServiceCallbackTrick.sys is launched\n");
+ DriverObject->DriverUnload = DriverUnload;
+
+
+ for (int i = 0; i < 32; i++) {
+ NtSleep(100);
+ DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Moving mouse\n");
+
+ mouse_move(-10, -10, 0);
+ }
+
+
+ return STATUS_SUCCESS;
+}
+
+BOOL mouse_open(void)
+{
+ // https://github.com/nbqofficial/norsefire
+
+ if (gMouseObject.use_mouse == 0) {
+
+ UNICODE_STRING class_string;
+ RtlInitUnicodeString(&class_string, L"\\Driver\\MouClass");
+
+
+ PDRIVER_OBJECT class_driver_object = NULL;
+ NTSTATUS status = ObReferenceObjectByName(&class_string, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, (PVOID*)&class_driver_object);
+ if (!NT_SUCCESS(status)) {
+ gMouseObject.use_mouse = 0;
+ return 0;
+ }
+
+ UNICODE_STRING hid_string;
+ RtlInitUnicodeString(&hid_string, L"\\Driver\\MouHID");
+
+
+ PDRIVER_OBJECT hid_driver_object = NULL;
+
+ status = ObReferenceObjectByName(&hid_string, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, (PVOID*)&hid_driver_object);
+ if (!NT_SUCCESS(status))
+ {
+ if (class_driver_object) {
+ ObfDereferenceObject(class_driver_object);
+ }
+ gMouseObject.use_mouse = 0;
+ return 0;
+ }
+
+ PVOID class_driver_base = NULL;
+
+
+ PDEVICE_OBJECT hid_device_object = hid_driver_object->DeviceObject;
+ while (hid_device_object && !gMouseObject.service_callback)
+ {
+ PDEVICE_OBJECT class_device_object = class_driver_object->DeviceObject;
+ while (class_device_object && !gMouseObject.service_callback)
+ {
+ if (!class_device_object->NextDevice && !gMouseObject.mouse_device)
+ {
+ gMouseObject.mouse_device = class_device_object;
+ }
+
+ PULONG_PTR device_extension = (PULONG_PTR)hid_device_object->DeviceExtension;
+ ULONG_PTR device_ext_size = ((ULONG_PTR)hid_device_object->DeviceObjectExtension - (ULONG_PTR)hid_device_object->DeviceExtension) / 4;
+ class_driver_base = class_driver_object->DriverStart;
+ for (ULONG_PTR i = 0; i < device_ext_size; i++)
+ {
+ if (device_extension[i] == (ULONG_PTR)class_device_object && device_extension[i + 1] > (ULONG_PTR)class_driver_object)
+ {
+ gMouseObject.service_callback = (QWORD)(device_extension[i + 1]);
+
+ break;
+ }
+ }
+ class_device_object = class_device_object->NextDevice;
+ }
+ hid_device_object = hid_device_object->AttachedDevice;
+ }
+
+ if (!gMouseObject.mouse_device)
+ {
+ PDEVICE_OBJECT target_device_object = class_driver_object->DeviceObject;
+ while (target_device_object)
+ {
+ if (!target_device_object->NextDevice)
+ {
+ gMouseObject.mouse_device = target_device_object;
+ break;
+ }
+ target_device_object = target_device_object->NextDevice;
+ }
+ }
+
+ ObfDereferenceObject(class_driver_object);
+ ObfDereferenceObject(hid_driver_object);
+
+ if (gMouseObject.mouse_device && gMouseObject.service_callback) {
+ gMouseObject.use_mouse = 1;
+ }
+
+ }
+
+ return gMouseObject.mouse_device && gMouseObject.service_callback;
+}
+
+VOID MouseClassServiceCallbackTrick(QWORD rdi_buffer, QWORD rbp_buffer, QWORD target_address);
+void mouse_move(long x, long y, unsigned short button_flags)
+{
+ char rdi_buffer[0x500];
+ char rbp_buffer[0x100];
+
+ for (QWORD i = 0; i < 0x500; i++)
+ rdi_buffer[i] = 0;
+
+ for (QWORD i = 0; i < 0x100; i++)
+ rbp_buffer[i] = 0;
+
+ MOUSE_INPUT_DATA *mid = (MOUSE_INPUT_DATA*)&rdi_buffer[0x160];
+ *(QWORD*)&rdi_buffer[0x178] = (QWORD)(PMOUSE_INPUT_DATA)mid + 1;
+
+ mid->LastX = x;
+ mid->LastY = y;
+ mid->ButtonFlags = button_flags;
+ mid->UnitId = 1;
+
+ *(QWORD*)&rdi_buffer[0xE0] = (QWORD)gMouseObject.mouse_device;
+ *(QWORD*)&rdi_buffer[0xE8] = (QWORD)gMouseObject.service_callback;
+ MouseClassServiceCallbackTrick( (QWORD)rdi_buffer, (QWORD)rbp_buffer, (QWORD)g_target_routine );
+}
+
+#pragma warning(disable : 4201)
+typedef struct _LDR_DATA_TABLE_ENTRY
+{
+ LIST_ENTRY InLoadOrderLinks;
+ LIST_ENTRY InMemoryOrderLinks;
+ LIST_ENTRY InInitializationOrderLinks;
+ PVOID DllBase;
+ PVOID EntryPoint;
+ ULONG SizeOfImage;
+ UNICODE_STRING FullDllName;
+ UNICODE_STRING BaseDllName;
+ ULONG Flags;
+ short LoadCount;
+ short TlsIndex;
+ union
+ {
+ LIST_ENTRY HashLinks;
+ struct
+ {
+ PVOID SectionPointer;
+ ULONG CheckSum;
+ };
+ };
+ union
+ {
+ ULONG TimeDateStamp;
+ PVOID LoadedImports;
+ };
+ PVOID* EntryPointActivationContext;
+ PVOID PatchInformation;
+ LIST_ENTRY ForwarderLinks;
+ LIST_ENTRY ServiceTagLinks;
+ LIST_ENTRY StaticLinks;
+} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
+
+static QWORD GetSystemBaseAddress(PDRIVER_OBJECT DriverObject, const unsigned short* driver_name)
+{
+ PLDR_DATA_TABLE_ENTRY ldr = (PLDR_DATA_TABLE_ENTRY)DriverObject->DriverSection;
+ for (PLIST_ENTRY pListEntry = ldr->InLoadOrderLinks.Flink; pListEntry != &ldr->InLoadOrderLinks; pListEntry = pListEntry->Flink)
+ {
+ PLDR_DATA_TABLE_ENTRY pEntry = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
+ if (pEntry->BaseDllName.Buffer && wcscmp(pEntry->BaseDllName.Buffer, driver_name) == 0) {
+
+ return (QWORD)pEntry->DllBase;
+ }
+ }
+ return 0;
+}
+
+typedef unsigned char BYTE;
+
+static BOOLEAN bDataCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
+{
+ for (; *szMask; ++szMask, ++pData, ++bMask)
+ if ((*szMask == 1 || *szMask == 'x') && *pData != *bMask)
+ return 0;
+ return (*szMask) == 0;
+}
+
+static QWORD FindPatternEx(UINT64 dwAddress, QWORD dwLen, BYTE *bMask, char * szMask)
+{
+ if (dwLen <= 0)
+ return 0;
+ for (QWORD i = 0; i < dwLen; i++)
+ if (bDataCompare((BYTE*)(dwAddress + i), bMask, szMask))
+ return (QWORD)(dwAddress + i);
+ return 0;
+}
+
+
+#ifdef _KERNEL_MODE
+typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
+ unsigned short e_magic; // Magic number
+ unsigned short e_cblp; // Bytes on last page of file
+ unsigned short e_cp; // Pages in file
+ unsigned short e_crlc; // Relocations
+ unsigned short e_cparhdr; // Size of header in paragraphs
+ unsigned short e_minalloc; // Minimum extra paragraphs needed
+ unsigned short e_maxalloc; // Maximum extra paragraphs needed
+ unsigned short e_ss; // Initial (relative) SS value
+ unsigned short e_sp; // Initial SP value
+ unsigned short e_csum; // Checksum
+ unsigned short e_ip; // Initial IP value
+ unsigned short e_cs; // Initial (relative) CS value
+ unsigned short e_lfarlc; // File address of relocation table
+ unsigned short e_ovno; // Overlay number
+ unsigned short e_res[4]; // Reserved words
+ unsigned short e_oemid; // OEM identifier (for e_oeminfo)
+ unsigned short e_oeminfo; // OEM information; e_oemid specific
+ unsigned short e_res2[10]; // Reserved words
+ LONG e_lfanew; // File address of new exe header
+ } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
+
+typedef struct _IMAGE_FILE_HEADER {
+ unsigned short Machine;
+ unsigned short NumberOfSections;
+ DWORD TimeDateStamp;
+ DWORD PointerToSymbolTable;
+ DWORD NumberOfSymbols;
+ unsigned short SizeOfOptionalHeader;
+ unsigned short Characteristics;
+} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
+
+typedef struct _IMAGE_DATA_DIRECTORY {
+ DWORD VirtualAddress;
+ DWORD Size;
+} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
+
+typedef struct _IMAGE_OPTIONAL_HEADER64 {
+ short Magic;
+ BYTE MajorLinkerVersion;
+ BYTE MinorLinkerVersion;
+ DWORD SizeOfCode;
+ DWORD SizeOfInitializedData;
+ DWORD SizeOfUninitializedData;
+ DWORD AddressOfEntryPoint;
+ DWORD BaseOfCode;
+ ULONGLONG ImageBase;
+ DWORD SectionAlignment;
+ DWORD FileAlignment;
+ unsigned short MajorOperatingSystemVersion;
+ unsigned short MinorOperatingSystemVersion;
+ unsigned short MajorImageVersion;
+ unsigned short MinorImageVersion;
+ unsigned short MajorSubsystemVersion;
+ unsigned short MinorSubsystemVersion;
+ DWORD Win32VersionValue;
+ DWORD SizeOfImage;
+ DWORD SizeOfHeaders;
+ DWORD CheckSum;
+ unsigned short Subsystem;
+ unsigned short DllCharacteristics;
+ ULONGLONG SizeOfStackReserve;
+ ULONGLONG SizeOfStackCommit;
+ ULONGLONG SizeOfHeapReserve;
+ ULONGLONG SizeOfHeapCommit;
+ DWORD LoaderFlags;
+ DWORD NumberOfRvaAndSizes;
+ IMAGE_DATA_DIRECTORY DataDirectory[16];
+} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
+
+typedef struct _IMAGE_NT_HEADERS64 {
+ DWORD Signature;
+ IMAGE_FILE_HEADER FileHeader;
+ IMAGE_OPTIONAL_HEADER64 OptionalHeader;
+} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
+
+typedef struct _IMAGE_SECTION_HEADER {
+ BYTE Name[8];
+ union {
+ DWORD PhysicalAddress;
+ DWORD VirtualSize;
+ } Misc;
+ DWORD VirtualAddress;
+ DWORD SizeOfRawData;
+ DWORD PointerToRawData;
+ DWORD PointerToRelocations;
+ DWORD PointerToLinenumbers;
+ unsigned short NumberOfRelocations;
+ unsigned short NumberOfLinenumbers;
+ DWORD Characteristics;
+} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
+#endif
+
+static QWORD FindPattern(QWORD module, unsigned char *bMask, char *szMask, QWORD len)
+{
+ ULONG_PTR ret = 0;
+ PIMAGE_DOS_HEADER pidh = (PIMAGE_DOS_HEADER)module;
+ PIMAGE_NT_HEADERS pinh = (PIMAGE_NT_HEADERS)((BYTE*)pidh + pidh->e_lfanew);
+ PIMAGE_SECTION_HEADER pish = (PIMAGE_SECTION_HEADER)((BYTE*)pinh + sizeof(IMAGE_NT_HEADERS64));
+
+ for (USHORT sec = 0; sec < pinh->FileHeader.NumberOfSections; sec++)
+ {
+
+ if ((pish[sec].Characteristics & 0x00000020))
+ {
+ QWORD address = FindPatternEx(pish[sec].VirtualAddress + (ULONG_PTR)(module),
+ pish[sec].Misc.VirtualSize - len, bMask, szMask);
+
+ if (address) {
+ ret = address;
+
+ break;
+ }
+ }
+
+ }
+ return ret;
+}
+
+
+```
+
+`mouse.asm`:
+
+```asm
+.code
+
+MouseClassServiceCallbackTrick proc
+
+ push rbp
+ push rbx
+ push rsi
+ push rdi
+ push r12
+ push r13
+ push r14
+ push r15
+
+ mov rbp, rdx
+ sub rsp, 58h
+ mov rdi, rcx
+
+ jmp r8
+MouseClassServiceCallbackTrick endp
+
+end
+
+
+```
\ No newline at end of file
diff --git a/archive/gmh5225/AI-FPS-b00m-h3adsh0t.txt b/archive/gmh5225/AI-FPS-b00m-h3adsh0t.txt
new file mode 100644
index 00000000..c2d189b9
--- /dev/null
+++ b/archive/gmh5225/AI-FPS-b00m-h3adsh0t.txt
@@ -0,0 +1,948 @@
+Project Path: arc_gmh5225_AI-FPS-b00m-h3adsh0t_db6tbh1x
+
+Source Tree:
+
+```txt
+arc_gmh5225_AI-FPS-b00m-h3adsh0t_db6tbh1x
+├── CODE_OF_CONDUCT.md
+├── README.md
+├── _config.yml
+├── azure-pipelines.yml
+├── b00m-h3adsh0t
+├── b00m-h3adsh0t.cfg
+├── calcangle.h
+├── gitchbox.cpp
+├── glitchbox.h
+├── main.cpp
+├── memory_searcher.cpp
+├── playerdata.h
+├── readme-images
+│ ├── boom headshot header.png
+│ ├── gameplay1.png
+│ ├── gameplay2.png
+│ ├── logo1.png
+│ └── logo2.png
+├── test
+└── train_game
+ ├── GAME.cfg
+ ├── GAME.names
+ ├── GAME.screenshots
+ ├── GAME.weights
+ └── GAME_last.weights
+
+```
+
+`CODE_OF_CONDUCT.md`:
+
+```md
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+ advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+ address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+ professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at low.lucyy@gmail.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq
+
+```
+
+`README.md`:
+
+```md
+
+# b00m-h3adsh0t! 🔷
+**Neural Network Configurable Aimbot for First-Person-Shooter Games in C/C++** *Note: Aimbots are cheats and illegal in gaming leagues. This repo is solely for educational purposes only.*
+
+> **┬┴┬┴┬┴┤ (҂ ` ﾛ ´)︻デ═一____________________＼(º □ º )/ ├┬┴┬┴┬┴┬┴┬┴┬┴┬┴┬┴┬┴┬┴┬┴**
+
+
+
+ []()
+ [](https://github.com/lucylow/Mrs.Robot/issues)
+ [](https://github.com/lucylow/b00m-h3adsh0t/pulls)
+ []()
+
+
+
+## Table of Contents 🔷
+
+* [Motivation](https://github.com/lucylow/b00m-h3adsh0t#motivation)
+* [Aimbot Neural Network](https://github.com/lucylow/b00m-h3adsh0t#aimbot-neural-network-)
+* [Neural Network Model Training Recognition](https://github.com/lucylow/b00m-h3adsh0t#neural-network-model-training-recognition-)
+* [How a normal aimbot works](https://github.com/lucylow/b00m-h3adsh0t#how-a-normal-aimbot-works-)
+* [How b00m-h3adsh0t works](https://github.com/lucylow/b00m-h3adsh0t#how-b00m-h3adsh0t-works-)
+* [Client-Server Backend Implementation](https://github.com/lucylow/b00m-h3adsh0t#client-server-backend-implementation-)
+* [Security and Efficiency Game Server](https://github.com/lucylow/b00m-h3adsh0t#security-and-efficiency-game-server-)
+* [Player Behavior Statistics](https://github.com/lucylow/b00m-h3adsh0t#player-behavior-statistics-)
+* [User Privacy](https://github.com/lucylow/b00m-h3adsh0t#user-privacy-)
+* [Player Attacks](https://github.com/lucylow/b00m-h3adsh0t#player-attacks-)
+* [Glitches and Modifications](https://github.com/lucylow/b00m-h3adsh0t#glitches-and-modifications-)
+* [Conclusion](https://github.com/lucylow/b00m-h3adsh0t#conclusion-)
+* [References](https://github.com/lucylow/b00m-h3adsh0t#references-)
+
+## Motivation
+* **B00m-h3adsh0t is a game bot software for first-person shooting (FPS) games** where players need to constantly move, think, strategize, and shoot enemies all at once. **Aimbot uses game data to automatically shoot at the heads of energy targets.**
+
+* **Personal motivation to learn C++ compiler programming language, object oriented programing, and how a FPS game executes on an operating system**. B00m-H3adsh0t is 100% written in C++ with Visual Studio compiler providing a very fast, and efficient framework with scripting support such that the framework uses a consistent object-oriented design
+
+ 
+
+ *Image. “Turn off Lucy's b00m-h3adsh0t aimbot you noob K/D ratio hacker!"*
+
+
+
+
+## Aimbot Neural Network 🔷
+
+* **Trained by neural network (NN) with customizable predictions and dynamic speed settings**
+* Select which FPS game you will use
+* **Engine-Aim with colored models:**
+ * Hook into the FPS game engine to use actual game data to auto-aim without altering gaming files
+ * Code won't work by itself because we need a handle to the game
+ * Modifies memory of RAM half-life runs on
+ * Gathers information from current game and pixel location
+
+ 
+
+ *Image. Custom training mode on the aimbot with a range of functionalities*
+
+* **Custom training mode**
+ * Leverage neural network to detect objects for object recognition using computer vision algorithms
+ * Train with range of distances, lights, and angles for best possible recognition
+
+## Neural Network Model Training Recognition 🔷
+
+**Deep Reinforcement Learning**
+ * Allows bot to learn how to aim by interacting with its unknown 3D environment
+ * Bot receives a reward if it correctly kills an enemy, hence the name b00m-h3adsh0. If the bot dies, it gets a penalty.
+ * For each step, bot observes the current states Ot of the environment and decides of an action
+ * Observes reward signal where the goal of the agent is to find a policy that maximizes the expected sum of discounted rewards
+ * Game states are partially observable
+
+**Q-Learning Adaptation**
+ * Used a Q-Learning adaptation for Deep Learning to train the autonomous agent
+ * Inputs are screenshots of the fps game (pixels)
+ * Deep reinforcement learning allows bot to learn game features simultaneously along with minimizing a Q-learning objective
+
+**Dynamic Bayesian Network**
+ * Common for aimbot detections in FPS games
+ * Used for probabilistic modeling and inference in discrete-time
+ * Implementation options:
+ * libDAI - A free and open source C++ library for Discrete Approximate Inference in graphical models (C++)
+ * Mocapy++ (C++) - A toolkit for inference and learning in dynamic Bayesian networks
+
+
+## How a normal aimbot works 🔷
+
+* **Aimbot can be easily toggled on and off using the mouse or keyboard**
+* Recognizes game objects in a certain range, then aims at the objects using game physics
+
+* **Memory Searcher with Cheat Engine**
+ * Understand the memory storage structures within a game
+ * Searching memory to find the values of the player classes such as player coordinates, health, mouse x,y coordinates, etc.
+ * Use **Cheat engine** to find addresses (programs that scans memory depending on the search details you give it and returns the memory addresses)
+ * Base address of "client.dll" (int or DWORD)
+ * Read and write to the game memory
+ * Call the functions **ReadProcessMemory (RPM)** and **WriteProcessMemory (WPM)**
+ * Use multi-level pointers to access information to playerObjectAddress
+* **CalcAngle**
+ * Needed to calculate angle functions for aimbot since everything is based on game coordinates
+ * Takes two 3D positions in source and distance, and outputs the angle to distance in angles
+ * Pass in the local player's eye position into src, the target's head in dst, and then set the view angles from angles
+* **Call Game Functions**
+ * For internal hacks where we need to inject DLL
+ * C++ programs call funtion by address via function pointers
+ * **Traceline and RayTrace** commonly used in aimbots:
+ * Draws a line between your player and another player
+ * Checks if there are objects in the way
+ * If there are no collisions between you and your target your aimbot should aim and shoot at that target
+* **Game Player Detection**
+ * FPS game memory contains the **(X,Y,Z) coordinates of each player for rendering**
+ * Aimbot scans memory locations for this information
+ * **Gain access to two key positions** - the player and enemies coordinates
+ * Subtracting the two positions as vectors == the vector between the two
+ * Calculate the **angle from the player's current vector to the desired angle vector**
+
+* **Aim Automatically**
+ * Inject information directly to the game
+ * DLL injection
+ * **Overwriting current FPS game aim functions**
+ * Patching in-place the Direct3D or OpenGL DLL
+ * Examining the **functions calls to draw geometry**
+ * Insert own geometry functions (for things like wall-hacks or glitches)
+ * Fine-tune with constants adjusting for any **dynamic data structure moving players** around on you
+
+
+## How b00m-h3adsh0t works 🔷
+
+* **Neural Network**
+
+ * Program takes **multiple screenshots** to recognize objects
+ * Different distances, lights, angles for best possible recognition
+ * Output - program writes in **cfg file**
+ * Batch = 1
+ * Subdivision = 1 for testing
+ * Graph of **Training/Validation Set**
+ * Graph x vs y
+ * Error Rate vs Number of Iterations in Training Set
+
+* **Training Depenencies - Trained Files for Games**
+
+ * Use **b00m-h3adsh0t.cfg file** to change the resolution range for object recognition
+ * Train Files Folder
+ * Darknet folder/subfolders
+ * Data or back up
+ * GAME.names
+ * GAME.cfg
+ * GAME_last.weights
+ * GAME.weights
+## Client-Server Backend Implementation 🔷
+
+* Computer has to display the gameplay to the user by rendering the whole map and every player in it
+
+* **Client–Server Model Method**
+
+ * Model instantaneously calculating/sending game results
+ * **Client sessions run synchronously with aimbot server with user input data**
+ * Run aimbot purely on game server
+ * Run server mirrors client gameplay and continuously validates each game state
+
+* **Modifying Game Rules World Method**
+
+ * Aimbot targets servers with no rule enforcement or data integrity
+ * **Synchronize all client data with information about all of the other clients**
+ * Reveals where all the players in the game are via (X,Y,Z) coordinates
+ * Reveals user game states with information on player names, position, clip ammo, ammo count, health, class, weapons, frame rate and more.
+ * Data from client will allow player to break game rules, manipulate server, or manipulate other clients
+
+## Security and Efficiency Game Server 🔷
+
+* Server responsible for information security and enforcing game rules
+
+* **Sending Game World State needed for Immediate Display**
+ * Results in client lag under bandwidth constraints
+
+* **Sending the Player the Entire World State**
+ * Results in faster display for player under the same bandwidth constraints
+ * Exposes data to interception or manipulation
+ * Trade-off between security and efficiency
+
+## Player Behavior Statistics 🔷
+Refer to playerdata.h file
+
+* **Aimbot Evaluation Metrics**
+ * Compare human player with b00m-h3eadsh0t agent
+ * K/D Ratio to compare ratio of kills to deaths
+ * Single player vs multi-player games
+
+* **Pattern Detection Systems**
+ * Scan player's hard drives for known cheat code or programs
+ * Scan player's system memory for known cheat code or programs
+ * Labor-intensive to constantly track down cheats and update detection patterns
+
+* **Anti–Cheat Method**
+ * Guaranteed to work on all end–user system configurations
+ * Reduce the amount of false positives
+
+* **Player Behavior Anomalie Detection**
+ * Detected by statistically analyzing game events
+ * Data sent by client to server by statistical detection systems
+ * Add human element of supervision system (community/admin team looks over player statistics)
+
+ 
+
+ *Image. Unusual player behavior leads to clientside creating then uploading a gamer report*
+
+## User Privacy 🔷
+
+* **End–users concerned with privacy issues and "Never trust the client" is common saying with game developers**
+* VAC (Valve Anti-Cheat) accessing browsing history
+* User privacy compromised with packet interception/manipulation
+* **Man-in-the-Middle Attack**
+ * Reverse engineer the network packet formatting
+ * Security of game circumvented by intercepting or manipulating data in real-time while transit from the client to the server or vice versa
+ * Performed on client machine itself or via external communication proxy
+ * Can provide player positions and other useful related information
+ * Forged packets sent to server to move the player, shoot, or other game actions
+
+## Player Attacks 🔷
+
+* **Select button to attack and enable/disable training mode**
+* Custom zooming control with scroll wheel
+* Custom crosshairs
+* Laser sight
+* Trigger bot
+* Move speed
+* Ammo count
+* Player radar
+* Name-tag display to detect players
+* Auto shoot/rapid fire
+ * Most fps games limit the rate weapons are fired regardless of how fast a player presses buttons
+ * Binding the firing button to the scroll wheel of a mouse
+ * Macro setting that will simulate rapid key presses automatically
+ * Set aiming speed and shooting delay
+* Auto clicker for semi automatic weapons
+* Dynamic recoil control
+ * Remove gun revoil game element
+ * Control bullet spread
+ * Correcting for bullet drop
+
+## Glitches and Modifications 🔷
+
+* Wall hacks
+ * Glitches with game surfaces
+ * Graphics driver modifications that ignore depth checking
+ * Draw all objects on the screen
+* Reduced flash
+* Correcting for ping/lag
+* Resolution range
+* Pixel memory hack
+* Transparent buildings, ceilings, obstacles, and trees
+ * Remove visual elements of the game
+ * Ex Replace opengl32.dll with one that would render polygons transparent
+
+* Display enemy lines
+* Extrasensory perception (ESP)
+ * Display all the enemy positions on the map
+ * Glowing or lighted players, weapons, and loot.
+ * See all players at all times and plan ahead before making a kill
+ * Show all information ex: player names, position, clip ammo, ammo count, health, class, weapons, frame rate and more
+## Conclusion 🔷
+
+B00m-h3adsh0t! is a single architecture neural network configurable aimbot for first-person shooting (FPS) games. We introduced a method to augment a deep reinforcement q-learning model with high-level game information, and feature implementation. We showed that b00m-h3adsh0t! model is able to outperform built-in bots as well as human players and demonstrated the generalizability of our model to do game glitches and modifications.
+
+
+-------
+
+## References 🔷
+
+* Machine Learning Paper. Aimbot Detection in Online FPS Games Using a Heuristic Method Based on Distribution Comparison Matrix: https://link.springer.com/chapter/10.1007/978-3-642-34500-5_77
+* Exploting supervised learning techniques on game server collecting game data with decision trees, Naive Bayes, random forest, neural networks, and support vector machines. https://ieeexplore.ieee.org/abstract/document/6032016
+* Multiple classificatoin system for neural networks http://ceur-ws.org/Vol-1659/paper7.pdf
+* Bayesian Imitation Learning the ROute to Belivable Gamebots. https://www.researchgate.net/profile/Christian_Bauckhage/publication/258510478_Is_Bayesian_imitation_learning_the_route_to_believable_gamebots/links/0c960539de8012b04e000000/Is-Bayesian-imitation-learning-the-route-to-believable-gamebots.pdf
+* Towards a Fair n Square Aimbot. Machine Learning techniques for spatio-temporal improvements to aimbots. http://vampire-project.de/files/papers/Bauckhage2004-TAF.pdf
+* Server side machine learning classifiers for anti-cheating in games using game logs https://ieeexplore.ieee.org/abstract/document/6633617
+* Bayesian network paper on aimbot behavior detection. http://www.cs.cuhk.edu.hk/~cslui/PUBLICATION/detect_cheat.pdf
+* Classifier systems for controlling NPCs in games. https://pdfs.semanticscholar.org/68cf/3f5b16c452b004d986dcbdefa6fc28fa1c9b.pdf
+* Game bot detection. Detecting user injections https://dl.acm.org/citation.cfm?id=1653694
+* C++ code for applications of Dynamic Bayesian Network https://github.com/wengjn/MatlabDBN
+* DBN++ Data Structures and Algorithms in C++ for Dynamic Bayesian Networks https://github.com/thiagopbueno/dbn-pp
+* Paper Dynamic Bayesian Neytworks https://www.cs.ubc.ca/~murphyk/Papers/dbnchapter.pdf
+* Paper A Bayesian Model for Plan Recognition in RTS (Real Time Strategy) Games https://www.aaai.org/ocs/index.php/AIIDE/AIIDE11/paper/viewFile/4062/4416
+* Learning to Shoot in First Person Shooter Games by Stabilizing Actions and Clustering Rewards for Reinforcement Learning. https://arxiv.org/pdf/1806.05117.pdf
+* CS:GO external hack base https://github.com/NullTerminatorr/NullBase
+* FastML. Solve the cheaters problem in Counter Strike, with or without machine learning
+http://fastml.com/how-to-solve-the-cheaters-problem-in-counter-strike-with-or-without-machine-learning/
+
+```
+
+`_config.yml`:
+
+```yml
+theme: jekyll-theme-hacker
+```
+
+`azure-pipelines.yml`:
+
+```yml
+# Starter pipeline
+# Start with a minimal pipeline that you can customize to build and deploy your code.
+# Add steps that build, run tests, deploy, and more:
+# https://aka.ms/yaml
+
+trigger:
+- master
+
+pool:
+ vmImage: 'ubuntu-latest'
+
+steps:
+- script: echo Hello, world!
+ displayName: 'Run a one-line script'
+
+- script: |
+ echo Add other tasks to build, test, and deploy your project.
+ echo See https://aka.ms/yaml
+ displayName: 'Run a multi-line script'
+
+```
+
+`b00m-h3adsh0t.cfg`:
+
+```cfg
+// b00m-h3adsh0t.cfg Config File
+// Web: https://github.com/lucylow/b00m-h3adsh0t
+
+
+// Autoassign # bots (defaults to 0)
+set b00m-h3adsh0t "0"
+
+// Add # bots to allies (defaults to 0)
+set b00m-h3adsh0t_allies "0"
+
+// Add # bots to axis (defaults to 0)
+set b00m-h3adsh0t_axis "0"
+
+// Bot skill level, value from 0.1 to 1.0 (defaults to 1.0)
+set b00m-h3adsh0t_skill "1.0"
+
+// Set to 0 - Original (slower speed and more walking) or 1 - Faster (Run & Gun) or 2 - Both (defaults to 2)
+set b00m-h3adsh0t_playstyle "2"
+
+// Set to 0 to disable bots choosing a random perk upon spawn.
+set b00m-h3adsh0t_useperks "1"
+
+// Set to 1 to enable bots to use the additional character models such as Capt. Price. (defaults to 0)
+b00m-h3adsh0t_modelchoice "0"
+
+// Set to 0 to stop bots using battlechatter (talking during game) (defaults to 1)
+set b00m-h3adsh0t_chatter "1"
+
+// Set to 1 to disable bots using UAV, Airstrike and Helicopter (defaults to 0)
+set b00m-h3adsh0t_dewards "0"
+
+// Set to 1 and bots will drop grenades/RPGs for the player to pick up and restock their grenade/RPG ammunition (defaults to 0)
+set b00m-h3adsh0t_grenadepickup "0"
+
+// Set to 1 to be instant level 55 and have all weapons unlocked (defaults to 0)
+set b00m-h3adsh0t_XPcheat "0"
+
+// Restarts the listen server after (defaults to 2)
+set b00m-h3adsh0t_roundCount "2"
+
+
+// Required to fix bug with UAV, Airstrike and Helicopter. Leave this here.
+set b00m-h3adsh0t_mode "normal"
+
+```
+
+`calcangle.h`:
+
+```h
+Vector CAimbot::CalcAngle( Vector& src, Vector& dst )
+{
+Vector vAngle;
+Vector delta( (src.X-dst.X), (src.Y-dst.Y), (src.Z-dst.Z) );
+double hyp = sqrt( delta.X*delta.X + delta.Y*delta.Y );
+
+vAngle.X = (float)(asinf( (delta.Z + 64.06f) / hyp ) * 57.295779513082f);
+vAngle.Y = (float)(atanf( delta.Y / delta.X ) * 57.295779513082f);
+vAngle.Z = 0.0f;
+
+if(delta.X >= 0.0)
+vAngle.Y += 180.0f;
+
+return vAngle;
+}
+
+
+```
+
+`gitchbox.cpp`:
+
+```cpp
+#include "Drawing.h"
+
+
+void Drawing::DrawBorderBox( int x, int y, int w, int h, int thickness, D3DCOLOR Colour, IDirect3DDevice9 *pDevice)
+{
+ //Top horiz line
+ DrawFilledRect( x, y, w, thickness, Colour, pDevice );
+ //Left vertical line
+ DrawFilledRect( x, y, thickness, h, Colour, pDevice );
+ //right vertical line
+ DrawFilledRect( (x + w), y, thickness, h, Colour, pDevice );
+ //bottom horiz line
+ DrawFilledRect( x, y + h, w+thickness, thickness, Colour, pDevice );
+}
+
+
+//We receive the 2-D Coordinates the color and the device we want to use to draw those colors with
+void Drawing::DrawFilledRect(int x, int y, int w, int h, D3DCOLOR color, IDirect3DDevice9* dev)
+{
+ //We create our rectangle to draw on screen
+ D3DRECT BarRect = { x, y, x + w, y + h };
+ //We clear that portion of the screen and display our rectangle
+ dev->Clear(1, &BarRect, D3DCLEAR_TARGET | D3DCLEAR_TARGET, color, 0, 0);
+}
+
+
+void Drawing::Draw_Text(LPCSTR TextToDraw, int x, int y, D3DCOLOR Colour, LPD3DXFONT m_font)
+{
+ // Create a rectangle to indicate where on the screen it should be drawn
+ RECT rct = {x- 120, y, x+ 120, y + 15};
+
+ // Draw some text
+ m_font->DrawText(NULL, TextToDraw, -1, &rct, DT_NOCLIP, Colour );
+}
+
+
+
+```
+
+`glitchbox.h`:
+
+```h
+#pragma once
+
+#include "d3d9.h"
+
+static class Drawing
+{
+public:
+ static void Draw_Text(LPCSTR TextToDraw, int x, int y, D3DCOLOR Colour, LPD3DXFONT m_font);
+ static void DrawFilledRect(int x, int y, int w, int h, D3DCOLOR color, IDirect3DDevice9* d3dDevice);
+ static void DrawBorderBox( int x, int y, int w, int h, int thickness, D3DCOLOR Colour, IDirect3DDevice9 *d3dDevice);
+};
+
+
+```
+
+`main.cpp`:
+
+```cpp
+#include
+#include
+#include "main.h"
+#include
+#include
+using namespace std;
+
+
+CHackProcess fProcess;
+using namespace std;
+
+#define F6_Key 0x75
+#define RIGHT_MOUSE 0x02
+
+int NumOfPlayers = 32;
+
+//Relative offsets:
+const DWORD dw_PlayerCountOffs = 0x5EF6BC;//Engine.dll
+const DWORD Player_Base = 0x4C6708;
+const DWORD dw_m_angRotation = 0x47F1B4; //ViewAngles - find by moving our mouse around, look for changed/unchanged value, or use cl_pdump 1
+
+// Entity offsets
+const DWORD dw_mTeamOffset = 0x9C;
+const DWORD dw_Health = 0x94;
+const DWORD dw_Pos = 0x260;
+
+const DWORD EntityPlayer_Base = 0x4D3904;//Entitylist relative offset
+const DWORD EntityLoopDistance = 0x10; //Distance in bytes between each ent
+
+struct MyPlayer_t
+{
+ DWORD CLocalPlayer; //Address of our ent
+ int Team;
+ int Health;
+ float Position[3];
+ void ReadInformation()
+ {
+ //Get address of entity
+ ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(fProcess.__dwordClient + Player_Base), &CLocalPlayer, sizeof(CLocalPlayer), 0);
+ ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CLocalPlayer + dw_mTeamOffset), &Team, sizeof(Team), 0);
+ ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CLocalPlayer + dw_Health), &Health, sizeof(Health), 0);
+ ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CLocalPlayer + dw_Pos), &Position, sizeof(float[3]), 0);
+ //Get Number of players
+ ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(fProcess.__dwordEngine + dw_PlayerCountOffs), &NumOfPlayers, sizeof(int), 0);
+ }
+}MyPlayer;
+
+//struct for targets
+struct TargetList_t
+{
+ float Distance;
+ float AimbotAngle[3];
+
+ TargetList_t() {} //default contructor
+
+ TargetList_t(float aimbotAngle[], float myCoords[], float enemyCoords[])
+ {
+ Distance = Get3dDistance(myCoords[0], myCoords[1], myCoords[2],
+ enemyCoords[0], enemyCoords[1], enemyCoords[2]);
+
+ //set aimbot angles for the ent
+ AimbotAngle[0] = aimbotAngle[0];
+ AimbotAngle[1] = aimbotAngle[1];
+ AimbotAngle[2] = aimbotAngle[2];
+ }
+
+ float Get3dDistance(float myCoordsX, float myCoordsZ, float myCoordsY,
+ float eNx, float eNz, float eNy)
+ {
+ return (float)sqrt(
+ pow(double(eNx - myCoordsX), 2.0) +
+ pow(double(eNy - myCoordsY), 2.0) +
+ pow(double(eNz - myCoordsZ), 2.0));
+ }
+};
+
+//Struct for other players
+struct PlayerList_t
+{
+ DWORD CBaseEntity;
+ int Team;
+ int Health;
+ float Position[3];
+ float AimbotAngle[3];
+ char Name[39];
+
+ void ReadInformation(int Player)
+ {
+ //Get Address of Entity
+ ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(fProcess.__dwordClient + EntityPlayer_Base + (Player * EntityLoopDistance)), &CBaseEntity, sizeof(DWORD), 0);
+ ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CBaseEntity + dw_mTeamOffset), &Team, sizeof(int), 0);
+ ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CBaseEntity + dw_Health), &Health, sizeof(int), 0);
+ ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CBaseEntity + dw_Pos), &Position, sizeof(float[3]), 0);
+ }
+}PlayerList[32];
+
+// Compare distance when sorting the array of Target Enemies "sort predicate"
+struct CompareTargetEnArray
+{
+ bool operator() (TargetList_t & lhs, TargetList_t & rhs)
+ {
+ return lhs.Distance < rhs.Distance;
+ }
+};
+
+void CalcAngle(float *src, float *dst, float *angles)
+{
+ double delta[3] = { (src[0] - dst[0]), (src[1] - dst[1]), (src[2] - dst[2]) };
+ double hyp = sqrt(delta[0] * delta[0] + delta[1] * delta[1]);
+ angles[0] = (float)(asinf(delta[2] / hyp) * 57.295779513082f);
+ angles[1] = (float)(atanf(delta[1] / delta[0]) * 57.295779513082f);
+ angles[2] = 0.0f;
+
+ // Normalize angle
+ if (delta[0] >= 0.0)
+ {
+ angles[1] += 180.0f;
+ }
+}
+
+void Aimbot()
+{
+ // Declare our target list to define our victims through a dynamic array
+ TargetList_t* TargetList = new TargetList_t[NumOfPlayers];
+
+ // Loop through all our players and retrieve their information
+ int targetLoop = 0;
+ for (int i = 0; i < NumOfPlayers; i++)
+ {
+ PlayerList[i].ReadInformation(i);
+
+ // Skip if they're my teammates.
+ if (PlayerList[i].Team == MyPlayer.Team) continue;
+
+ // Skip players without health such as bad ents
+ if (PlayerList[i].Health < 2) continue;
+
+ // PlayerList[i].Position[2] -= 10;
+ CalcAngle(MyPlayer.Position, PlayerList[i].Position, PlayerList[i].AimbotAngle);
+
+ // Populate array of targets with only good targets
+ TargetList[targetLoop] = TargetList_t(PlayerList[i].AimbotAngle, MyPlayer.Position, PlayerList[i].Position);
+
+ // Increment to advance the array for the next iteration
+ targetLoop++;
+ }
+
+ //Aim only if we have any enemies
+ if (targetLoop > 0)
+ {
+ //SORT ENEMIES ARRAY BY DISTANCE by using our sort predicate
+ std::sort(TargetList, TargetList + targetLoop, CompareTargetEnArray());
+
+ //AIM at the closest ent, by default aim at ALL times, if you right click hold it switches it off
+ if (!GetAsyncKeyState(0x2))
+ {
+ WriteProcessMemory(fProcess.__HandleProcess, (BYTE*)(fProcess.__dwordEngine + dw_m_angRotation), TargetList[0].AimbotAngle, 12, 0);
+ }
+
+ }
+ // Reset the loop counter
+ targetLoop = 0;
+
+ delete[] TargetList; //DELETE OUR ARRAY and clear memory
+}
+
+int main()
+{
+ fProcess.RunProcess(); // Waiting for CSS......
+ cout << "Game found! Running b00m h3adsh0t aimbot." << endl;
+
+ //Exit if the F6 key is pressed
+ while (!GetAsyncKeyState(F6_Key))
+ {
+ MyPlayer.ReadInformation();
+ Aimbot();
+ }
+}
+
+```
+
+`memory_searcher.cpp`:
+
+```cpp
+DWORD pLocalPlayer = { 0x509B74 };
+DWORD playerObjectAddress = 0;
+
+// Base address of "client.dll" (int or DWORD)
+int ClientDLL = (int)GetModuleHandleA("client.dll");
+
+// Find actual EntityBase address
+EntityBase = *(int*)(ClientDLL + 0x9D3C6C);
+
+// Read the memory address of the EntityBase+0x23C4 to find the ID of the entity in the crosshair
+int in_cross = *(int*)(EntityBase + 0x23C4);
+
+// ReadProcessMemory reads memory from a given process
+ReadProcessMemory(handleToGame, (LPCVOID)addressToRead, &variableToStoreReadInformation, sizeof(variableToStoreReadInformation), NULL);
+
+// WriteProcessMemory writes memory to a given process
+WriteProcessMemory(handleToGame, (LPVOID)addressToWriteTo, &variableContainingValueToWrite, sizeof(variableContainingValueToWrite), NULL);
+
+
+```
+
+`playerdata.h`:
+
+```h
+#pragma once
+#include
+
+// 3D data for each player
+// Memory addresses within "PlayerData"
+
+ class Vect3d
+ {
+ public:
+ float x;
+ float y;
+ float z;
+
+ Vect3d(float _x, float _y, float _z)
+ {
+ x = _x;
+ y = _y;
+ z = _z;
+ }
+
+ Vect3d()
+ {
+ }
+
+ float length()
+ {
+ return (float)sqrt(x * x + y * y + z * z);
+ }
+
+ float dotproduct(Vect3d dot)
+ {
+ return (x * dot.x + y * dot.y + z * dot.z);
+ }
+
+ };
+
+ struct Color
+ {
+ public:
+ short R;
+ short G;
+ short B;
+
+ Color()
+ {
+
+ }
+ Color(short r, short g, short b)
+ {
+ R = r;
+ G = g;
+ B = b;
+ }
+
+ };
+
+ class PlayerDataVec
+ {
+ public:
+ float xMouse;
+ float yMouse;
+ int isValid;
+ float xPos;
+ float yPos;
+ float zPos;
+ int isAlive;
+ int clientNum;
+ Color color;
+ char name[16];
+ int pose;
+ int team;
+ bool visible;
+ int isInGame;
+ int health;
+
+ Vect3d VecCoords()
+ {
+ Vect3d vec(xPos, zPos, yPos);
+ return vec;
+ }
+ };
+
+```
+
+`train_game/GAME.cfg`:
+
+```cfg
+GAME.cfg
+
+Output - program writes in cfg file
+
+ Batch = 1
+ Subdivision = 1 for testing
+
+```
+
+`train_game/GAME.names`:
+
+```names
+GAME.names
+
+```
+
+`train_game/GAME.screenshots`:
+
+```screenshots
+void GetScreenShot(void)
+{
+ int x1, y1, x2, y2, w, h;
+
+ // get screen dimensions
+ x1 = GetSystemMetrics(SM_XVIRTUALSCREEN);
+ y1 = GetSystemMetrics(SM_YVIRTUALSCREEN);
+ x2 = GetSystemMetrics(SM_CXVIRTUALSCREEN);
+ y2 = GetSystemMetrics(SM_CYVIRTUALSCREEN);
+ w = x2 - x1;
+ h = y2 - y1;
+
+ // copy screen to bitmap
+ HDC hScreen = GetDC(NULL);
+ HDC hDC = CreateCompatibleDC(hScreen);
+ HBITMAP hBitmap = CreateCompatibleBitmap(hScreen, w, h);
+ HGDIOBJ old_obj = SelectObject(hDC, hBitmap);
+ BOOL bRet = BitBlt(hDC, 0, 0, w, h, hScreen, x1, y1, SRCCOPY);
+
+ // save bitmap to clipboard
+ OpenClipboard(NULL);
+ EmptyClipboard();
+ SetClipboardData(CF_BITMAP, hBitmap);
+ CloseClipboard();
+
+ // clean up
+ SelectObject(hDC, old_obj);
+ DeleteDC(hDC);
+ ReleaseDC(NULL, hScreen);
+ DeleteObject(hBitmap);
+
+ // screenshot to jpg and save to stream
+ image.Attach(hBitmap);
+ image.Save(stream, Gdiplus::ImageFormatJPEG);
+ IStream_Size(stream, &liSize);
+ DWORD len = liSize.LowPart;
+ IStream_Reset(stream);
+ buf.resize(len);
+ IStream_Read(stream, &buf[0], len);
+ stream->Release();
+
+ // put image in the file
+ std::fstream fi;
+ fi.open(path, std::fstream::binary | std::fstream::out);
+ fi.write(reinterpret_cast(&buf[0]), buf.size() * sizeof(BYTE));
+ fi.close();
+}
+
+```
+
+`train_game/GAME.weights`:
+
+```weights
+GAME.weights
+
+```
+
+`train_game/GAME_last.weights`:
+
+```weights
+GAME_last.weights
+
+```
\ No newline at end of file