CS2 External Kernel Driver Hack

Dependencies

• ImGui (already included)
• ImGui Freetype (easiest way through vcpkg (example))
• reversing-commons header-only lib

Project Overview

This solution contains 2 projects:

• km-xd
  • The IOCTL Kernel Mode driver project. It builds a simple IOCTL driver that is used to proxy read/write mem calls
  • Produces km-xd.sys
• um-xd
  • The Client Mode application that interacts with the driver and has the actual cheat implementation.
  • /sdk folder contains dumps from this awesome dumper
  • Produces um-xd.exe

COMPILE IN RELEASE MODE FOR SIGNIFICANT PERFORMANCE DIFFERENCE

I will not show you how to build/run, this is for educational purposes. It's pretty simple if you are not a cheating paster.

I don't support cheating, I support educational curiosity.

Concept

The client mode application will read/write memory from a foreign process (cs2.exe) through an IOCTL driver using control codes.

DeviceIoControl(handle_, control_codes::read, &driver_request, sizeof(driver_request), &driver_request, sizeof(driver_request), nullptr, nullptr);

This approach makes the client app invisible to the target of your memory reads, since the target does not know that it's memory has been compromised. The target app has no way to find out since the manipulation is done from Kernel space to Usermode.

Examples

Loading with kdmapper

The client will always maintain a valid state depending on where you are (in-game/minimized/loading)

Cheat menu in-game (press INSERT)

box ESP toggled

box ESP is blue when the enemy is radar-visible to you (safe to aim lock)