DylanHook Rage & Rapid Fire Reversal Documentation
Overview
Target File: `d:\dylan\dylanhook_rage.asm`
File Size: ~5.18 MB (95,104 lines)
Total Procedures: 554 fully disassembled subroutines (`proc` / `endp` pairs)
Binary Source: `dylanhook.bin` (CS2 Dynamic Module)
Reversal Tooling: IDA Pro 9.5 via local IDA-MCP socket bridge (`localhost:5000`)
---
Architecture & Code Structure
The unified assembly source file is partitioned into logical subsystems:
1. CreateMove Entry Points & Hook Dispatchers
Primary Routines: `createmove_hook_1` (`0x413670`), `createmove_hook_2` (`0x413760`), `createmove_hook_3` (`0x413850`), `createmove_hook_4` (`0x413FF0`)
Role: Intercepts engine tick loops and game user command processing. Prepares command buffer snapshots and triggers rage pipeline execution before sending movement packets.
2. Core 4-Stage Ragebot Engine
Master Pipeline: `ragebot_pipeline_root` (`0x242B90`)
Execution Flow:
`ragebot_stage1_scan` (`0x244350`): Traverses entity list, checks pawn dormancy, team flags, and player visibility.
`ragebot_stage2_config` (`0x245510`): Evaluates weapon configuration profiles and convar limits.
`ragebot_stage3_fire` (`0x245230`): Firing decision gate, hitchance calculation, and view angle calculation.
`ragebot_stage4_cleanup` (`0x246230`): State restoration and telemetry packet logging.
3. Rapid Fire & Weapon Timing Subsystem
Core Execution Engine: `rapid_fire_execution_engine` (`sub_1EBC60`, 5,332 bytes)
Configuration Binding: `rapid_fire_config_registration` (`0x29F63`), `rapid_fire_weapon_binding` (`0x228BBE`)
Support Routines: 53 auxiliary functions (`sub_64B0`, `sub_AE3F0`, `sub_D6010`, `sub_1ED140`, `sub_1EF1D0`, etc.)
Mechanism: Controls `m_flNextPrimaryAttack` and sub-tick usercmd sequence timing to dispatch multiple fire ticks within rapid command bursts.
4. Target Scanning, Sorting & Ray-Tracing
Primary Routines: `ragebot_target_scan` (`0x23D9C0`), `ragebot_selection_eval` (`0x233580`), `ragebot_angle_sync` (`0x238CA0`), `ragebot_sort_candidates` (`0x233310`)
Role: Computes angular distance (FOV), crosshair distance, and historical backtrack viability to pick highest-priority target hitboxes.
5. Multipoint Generation & Hitbox Matrices
Primary Routines: `ragebot_hitscan_multipoint` (`0x23F960`), `multipoint_point_gen` (`0x23FD00`), `multipoint_scale_eval` (`0x23FFA0`), `multipoint_hitscan_runner` (`0x240190`)
Role: Generates center and outer offset points across target hitbox bone matrix capsules to maximize penetration line-of-sight.
6. Autowall & Bullet Penetration Solver
Primary Routines: `ragebot_autowall_penetration` (`0x2634D0`), `autowall_trace_ray` (`0x264660`), `autowall_surface_eval` (`0x2646F0`), `autowall_damage_calc` (`0x265280`), `autowall_layer_iter` (`0x2656F0`), `autowall_penetrate_step` (`0x266030`), `autowall_exit_trace` (`0x267050`)
Role: 12-stage nested ray tracer evaluating penetration power, surface materials, and damage falloff per barrier.
7. Hitchance & Spread Simulation
Primary Routines: `hitchance_simulation_1` (`0x225C90`), `hitchance_simulation_2` (`0x228430`), `hitchance_simulation_3` (`0x421210`), `ragebot_hitchance_eval` (`0x2629B0`), `hitchance_seed_calc` (`0x261020`)
Role: Monte Carlo seed iterations modeling weapon spread cone and inaccuracy circles against target bounding boxes.
8. Backtrack & Lag Compensation Records
Primary Routines: `backtrack_align` (`0x25B5F0`), `backtrack_tick_iter` (`0x25C5A0`), `backtrack_state_save` (`0x25A6B0`), `backtrack_latency_calc` (`0x25ABC0`), `backtrack_record_push` (`0x25AE00`), `backtrack_lag_comp` (`0x25DD50`), `backtrack_restore` (`0x25DFA0`)
Role: Manages a sliding circular buffer of networked player tick states to manipulate target bone positions for past ticks within the max unlag window.
9. Resolved Callee & Engine SDK Support Layer
Callee Count: 251 functions (`sub_56A0` to `sub_503040`)
Role: Utility routines covering memory block allocation, vector math, string cloning, virtual function wrappers, and telemetry serialization.
---
Feature Confidence Levels
The confidence score reflects the degree of confirmation based on embedded strings, xrefs, and instruction semantics:
Feature / Subsystem Primary RVAs Confidence Level Evidence & Verification Basis
Config & ConVar Dispatch `0x27A80`, `0x28CD0`, `0x228AB0` High (98%) Direct loading of ASCII convar keys (`RapidFire`, `NoSpread`, `NoRecoil`, `RefineShot`, `AutoStop`, `SvMaxunlag`, `ClInterpRatio`).
Rapid Fire Execution Engine `0x1EBC60`, `0x29F63`, `0x228BBE` High (95%) Direct linkage between configuration bindings (`0x29F63`) and weapon attack timer / command sequence logic (`0x1EBC60`) + 53 callee subroutines.
Telemetry & Verdict Logging `0x48F80`, `0x491A0`, `0x495E0` High (95%) Explicit string loads for `ShotVerdicts`, `MissLog`, `ShotLog`, `ScriptsShots`.
Hitchance / Spread Modeling `0x225C90`, `0x228430`, `0x2629B0` High (90%) Referenced by parameter keys (`Fov`, `Hitboxes`, `Hitchance`, `PointScale`, `Speed`) and Monte Carlo seed loops.
Core 4-Stage Rage Engine `0x242B90`, `0x244350`, `0x245230` Medium-High (85%) Topological master dispatch from CreateMove hooks; structured in 4 distinct operational stages.
Autowall Penetration Chain `0x2634D0` - `0x267AE0` Medium-High (85%) Continuous 12-function cluster implementing ray traversal, exit-point traces, and damage dampening.
Multipoint & Hitbox Generation `0x23F960`, `0x23FD00`, `0x240190` Medium (80%) Capsule bone matrix calculation called directly before autowall penetration checks.
Backtrack Lag Compensation `0x25B5F0` - `0x2601C0` Medium (80%) Circular buffer manipulations checking interpolation ratios, tick records, and state restoration.
SDK Helpers & Low-Level Math Various `sub_XXXXXX` (251 procs) Medium (75%) Inferred via argument register conventions (RCX/RDX/R8/R9) and standard CRT/Vector operation signatures.
---
File Verification
Total Procs: 554
Total Endps: 554
Procedure/Endp Symmetry: 100% matched
Master Assembly: `d:\dylan\dylanhook_rage.asm`
Overview
Target File: `d:\dylan\dylanhook_rage.asm`
File Size: ~5.18 MB (95,104 lines)
Total Procedures: 554 fully disassembled subroutines (`proc` / `endp` pairs)
Binary Source: `dylanhook.bin` (CS2 Dynamic Module)
Reversal Tooling: IDA Pro 9.5 via local IDA-MCP socket bridge (`localhost:5000`)
---
Architecture & Code Structure
The unified assembly source file is partitioned into logical subsystems:
1. CreateMove Entry Points & Hook Dispatchers
Primary Routines: `createmove_hook_1` (`0x413670`), `createmove_hook_2` (`0x413760`), `createmove_hook_3` (`0x413850`), `createmove_hook_4` (`0x413FF0`)
Role: Intercepts engine tick loops and game user command processing. Prepares command buffer snapshots and triggers rage pipeline execution before sending movement packets.
2. Core 4-Stage Ragebot Engine
Master Pipeline: `ragebot_pipeline_root` (`0x242B90`)
Execution Flow:
`ragebot_stage1_scan` (`0x244350`): Traverses entity list, checks pawn dormancy, team flags, and player visibility.
`ragebot_stage2_config` (`0x245510`): Evaluates weapon configuration profiles and convar limits.
`ragebot_stage3_fire` (`0x245230`): Firing decision gate, hitchance calculation, and view angle calculation.
`ragebot_stage4_cleanup` (`0x246230`): State restoration and telemetry packet logging.
3. Rapid Fire & Weapon Timing Subsystem
Core Execution Engine: `rapid_fire_execution_engine` (`sub_1EBC60`, 5,332 bytes)
Configuration Binding: `rapid_fire_config_registration` (`0x29F63`), `rapid_fire_weapon_binding` (`0x228BBE`)
Support Routines: 53 auxiliary functions (`sub_64B0`, `sub_AE3F0`, `sub_D6010`, `sub_1ED140`, `sub_1EF1D0`, etc.)
Mechanism: Controls `m_flNextPrimaryAttack` and sub-tick usercmd sequence timing to dispatch multiple fire ticks within rapid command bursts.
4. Target Scanning, Sorting & Ray-Tracing
Primary Routines: `ragebot_target_scan` (`0x23D9C0`), `ragebot_selection_eval` (`0x233580`), `ragebot_angle_sync` (`0x238CA0`), `ragebot_sort_candidates` (`0x233310`)
Role: Computes angular distance (FOV), crosshair distance, and historical backtrack viability to pick highest-priority target hitboxes.
5. Multipoint Generation & Hitbox Matrices
Primary Routines: `ragebot_hitscan_multipoint` (`0x23F960`), `multipoint_point_gen` (`0x23FD00`), `multipoint_scale_eval` (`0x23FFA0`), `multipoint_hitscan_runner` (`0x240190`)
Role: Generates center and outer offset points across target hitbox bone matrix capsules to maximize penetration line-of-sight.
6. Autowall & Bullet Penetration Solver
Primary Routines: `ragebot_autowall_penetration` (`0x2634D0`), `autowall_trace_ray` (`0x264660`), `autowall_surface_eval` (`0x2646F0`), `autowall_damage_calc` (`0x265280`), `autowall_layer_iter` (`0x2656F0`), `autowall_penetrate_step` (`0x266030`), `autowall_exit_trace` (`0x267050`)
Role: 12-stage nested ray tracer evaluating penetration power, surface materials, and damage falloff per barrier.
7. Hitchance & Spread Simulation
Primary Routines: `hitchance_simulation_1` (`0x225C90`), `hitchance_simulation_2` (`0x228430`), `hitchance_simulation_3` (`0x421210`), `ragebot_hitchance_eval` (`0x2629B0`), `hitchance_seed_calc` (`0x261020`)
Role: Monte Carlo seed iterations modeling weapon spread cone and inaccuracy circles against target bounding boxes.
8. Backtrack & Lag Compensation Records
Primary Routines: `backtrack_align` (`0x25B5F0`), `backtrack_tick_iter` (`0x25C5A0`), `backtrack_state_save` (`0x25A6B0`), `backtrack_latency_calc` (`0x25ABC0`), `backtrack_record_push` (`0x25AE00`), `backtrack_lag_comp` (`0x25DD50`), `backtrack_restore` (`0x25DFA0`)
Role: Manages a sliding circular buffer of networked player tick states to manipulate target bone positions for past ticks within the max unlag window.
9. Resolved Callee & Engine SDK Support Layer
Callee Count: 251 functions (`sub_56A0` to `sub_503040`)
Role: Utility routines covering memory block allocation, vector math, string cloning, virtual function wrappers, and telemetry serialization.
---
Feature Confidence Levels
The confidence score reflects the degree of confirmation based on embedded strings, xrefs, and instruction semantics:
Feature / Subsystem Primary RVAs Confidence Level Evidence & Verification Basis
Config & ConVar Dispatch `0x27A80`, `0x28CD0`, `0x228AB0` High (98%) Direct loading of ASCII convar keys (`RapidFire`, `NoSpread`, `NoRecoil`, `RefineShot`, `AutoStop`, `SvMaxunlag`, `ClInterpRatio`).
Rapid Fire Execution Engine `0x1EBC60`, `0x29F63`, `0x228BBE` High (95%) Direct linkage between configuration bindings (`0x29F63`) and weapon attack timer / command sequence logic (`0x1EBC60`) + 53 callee subroutines.
Telemetry & Verdict Logging `0x48F80`, `0x491A0`, `0x495E0` High (95%) Explicit string loads for `ShotVerdicts`, `MissLog`, `ShotLog`, `ScriptsShots`.
Hitchance / Spread Modeling `0x225C90`, `0x228430`, `0x2629B0` High (90%) Referenced by parameter keys (`Fov`, `Hitboxes`, `Hitchance`, `PointScale`, `Speed`) and Monte Carlo seed loops.
Core 4-Stage Rage Engine `0x242B90`, `0x244350`, `0x245230` Medium-High (85%) Topological master dispatch from CreateMove hooks; structured in 4 distinct operational stages.
Autowall Penetration Chain `0x2634D0` - `0x267AE0` Medium-High (85%) Continuous 12-function cluster implementing ray traversal, exit-point traces, and damage dampening.
Multipoint & Hitbox Generation `0x23F960`, `0x23FD00`, `0x240190` Medium (80%) Capsule bone matrix calculation called directly before autowall penetration checks.
Backtrack Lag Compensation `0x25B5F0` - `0x2601C0` Medium (80%) Circular buffer manipulations checking interpolation ratios, tick records, and state restoration.
SDK Helpers & Low-Level Math Various `sub_XXXXXX` (251 procs) Medium (75%) Inferred via argument register conventions (RCX/RDX/R8/R9) and standard CRT/Vector operation signatures.
---
File Verification
Total Procs: 554
Total Endps: 554
Procedure/Endp Symmetry: 100% matched
Master Assembly: `d:\dylan\dylanhook_rage.asm`
