External aim assists

[Baker]

I stumbled upon a very active place on the internet that does nothing but make cheats for games. Sigh.

Most of them were OpenGL and DirectX cheats, with some other category of cheats that I guess somehow hooks into games and other weirdness.

Quake isn't exactly a popular game anymore, so I imagine most of these cheats are rotting on vine and the slightest twist would make them useless.

My guess is that these OpenGL cheats generally work like this:

1. The cheat gets called at rendering time via the OpenGL api calls that aren't exactly the real ones.
2. The cheat dll determines where a model or enemy is nearest the crosshair.
3. Makes a calculation of the correct angle/roll/pitch for that position to be dead-center.

Now here is where I am lost ...

How are these cheats writing the angle?

Do they have to be pre-programmed with the memory address offset to overwrite the existing angle and alter the game's memory?
Or ... are they overriding outbound network data? (The latter seems like too much work).

I'm assuming this is where the client's memory is being altered, right? If so, wouldn't the slightest difference in version or the mildest change in the data structure or network protocol disable existing cheats?

Or am I wrong?

[r00k]

Could it be the dll is mimicing a clc_move to the server?
this reads input (movement and aim) from the client.

[Spike]

[Baker]

[r00k]

mostly that single function loops a trace against SV_ClipMoveToEntity before any entities are sent to the client. Costly in cpu but i didnt have to work much against existing code..
MH has written a nifty z-buffer method that works client-side to boot.

[mh]

I'd guess these cheats are looking out for a pointer being used somewhere, and intercepting & overwriting that. Difficult to see why anyone would pass a live aim vector pointer to a rendering API, but I suppose there have been enough bad coding practices in the past, and I can't really see any other way.

It would be interesting to see if changing the render to always send a copy of data (rather than actual live data) to the API would break the cheats, but I for one would be terrified of what other filth I might install on my PC if I was to test it out.

Oddly, I didn't find r00k's anti-wallhack to be CPU expensive at all; in a reasonably well-balanced system (which I figure I must have ) what you lose in CPU you tend to gain back from not having to render the extra ents (if you're GPU bound the gain will be even more).