search

kkthxbye-code / csgo_bugs

Random CSGO stuff
216 stars 272 forks source link

sv_pure_bypass 7_2 #62

Closed Billar42 closed 3 years ago

Billar42 commented 3 years ago

sv_pure bypass #7_2 (Windows only) Fixed on FaceIt and on Esea

Official Valve servers, and most community servers, run with sv_pure 1. This causes the client to send CRC32 & MD5 hashes of the files defined in pure_server_whitelist.txt to the server. The server then matches the hashes and kicks the player if there is a mismatch.

It seems that this is still! implemented poorly and for some pak01_###.vpk files it's possible to bypass this check.

Prerequisites

  1. Dokany (necessary for mirroring the VPK files) | Download from GitHub
  2. Download this pak01_007.vpk.wh or generate it using the instructions below.
  3. Place inside the csgo folder.
  4. Run prepare.cmd
  5. Place video.txt inside C:\Program Files (x86)\Steam\Steam\userdata\[steam_id]\730\local\cfg.

Compile mirror.exe (optional)

If you don't trust our modified mirror.exe (a Dokany example), you can compile one by yourself:

Replace

https://github.com/dokan-dev/dokany/blob/6ae6188e61df3f7a1448591a3675c130c4d22bc7/samples/dokan_mirror/mirror.c#L396

with

        CreateFile(filePath, genericDesiredAccess, 3,

then recompile with Visual Studio.

Before you launch CS:GO

  1. Rename the csgo directory to csgo_bak.
  2. Create an empty csgo directory.
  3. Run this with with administrator privileges:
mirror.exe /r "C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo_bak" /l "C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo

Don't worry, this does NOT copy the files. This just mirrors the csgo_bak directory to csgo. The patch above is needed, so the .vpk files won't be locked when csgo.exe is running.

Note: If the mirror fails, make sure to close all Explorer windows!

Steps (I method)

Note: You can get kicked while being in-game, although there is a chance that you can keep playing indefinitely.

  1. Run disable_wallhack.cmd
  2. Switch shader settings to high / low.
  3. Join any server.
  4. Run enable_wallhack.cmd.
  5. Switch shader settings to high / low.
  6. Profit! VAC-proof wallhack.

Steps (II method)

Note: If you rejoin the server and aren't kicked immediately, you can keep playing indefinitely.

  1. Run disable_wallhack.cmd
  2. Switch shader settings to high / low.
  3. Join any server.
  4. Disconnect.
  5. Run enable_wallhack.cmd.
  6. Switch shader settings to high / low.
  7. Reconnect.
  8. Profit! VAC-proof wallhack.

Maps

Generating the pak01_007.vpk.wh with wallhacks

It's pretty simple. You just need Node.js to be able to run the script. It will generate pak01_007.vpk.wh. It replaces VMT keys like $ambientreflectionboost with $ignorez 1 and keeps the file size the same.

  1. Copy the generateWallhack.js file to ~/.local/share/Steam/steamapps/common/Counter-Strike Global Offensive/csgo.
  2. Run node generateWallhack.js.

SkinChanger

Buy the following skins on the marketplace:

How to install

  1. Dowload Dokany (necessary for mirroring the VPK files) | Download from GitHub
  2. Download this Skinchanger.zip.
  3. Unpack the archive using the following path ~/.local/share/Steam/steamapps/common/Counter-Strike Global Offensive.
  4. Rename the csgo directory to csgo_bak
  5. Go to the control folder at this path ~/.local/share/Steam/steamapps/common/Counter-Strike Global Offensive/control/.
  6. Change the path to the csgo and csgo_bak folders in mirror.cmd 
    mirror.exe /r "C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo_bak" /l "C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo"
  7. Change the path to csgo_bak in onskinchanger.cmd and offskinchanger.cmd

Launch

  1. Open the control folder and run mirror.cmd as an administrator
  2. Launch Cs:Go
  3. Join any server.
  4. Run onskinchanger.cmd.
  5. Switch shader settings to high / low.
  6. Open the console and write the command mat_updateconvars
  7. For the next round, re-purchase this weapon
  8. Profit! VAC-proof SkinChanger.

New Skins

After a successful replacement, you should have the following skins :

Anti-Door-Dust2

  1. Dowload Dokany (necessary for mirroring the VPK files) | Download from GitHub
  2. Download this Anti-Door.
  3. Unpack the archive using the following path ~/.local/share/Steam/steamapps/common/Counter-Strike Global Offensive.
  4. Rename the csgo directory to csgo_bak
  5. Go to the control folder at this path ~/.local/share/Steam/steamapps/common/Counter-Strike Global Offensive/control/.
  6. Change the path to the csgo and csgo_bak folders in mirror.cmd 
    mirror.exe /r "C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo_bak" /l "C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo"
  7. Change the path to csgo_bak in anti-door_dust2.cmd and anti-door_dust2_off.cmd

What else can you do with this exploit?

Credits

Billar42 commented 3 years ago

how long to wait a week or two to check the information?

kkthxbye-code commented 3 years ago

I have no interest in confirming that any of this work, as I don't really see hooking kernel functions (dokany etc.) as in the spirit of what I wanted to do with this repo. The repo is pretty inactive, but I chose to merge it as you seem to have put in some effort. In the future I wont be merging any more pull requests unless they contain new exploits of interest.

Thanks for the PR though, feel free to just fork it in the future if you want to add other stuff.

Billar42 commented 3 years ago

Thank you very much I can't post large exploits as they work on FaceIt and on esea I can do a lot more in the future I have a plan to change the structures of the models and the new exploits are more like physical replacements Thanks again

HackerPide commented 3 years ago

Thank you very much I can't post large exploits as they work on FaceIt and on esea I can do a lot more in the future I have a plan to change the structures of the models and the new exploits are more like physical replacements Thanks again

I think you should post large exploits if they aren't straight up cheats.

Billar42 commented 3 years ago

image Sorry, I sell them for large sums, and even there are large exploits, then you already need to buy additional details like intel video cards

Billar42 commented 3 years ago

Anything that can remove the cheat in this game I can do, any effect in this game can be changed, I don't think it will switch to source 2, there are a lot of old things in the files