Recent content by Reev

Define your definition of legit

TB is not currenly enabled, it is under work.

I advise you to report your issue or add it as suggestion in the discord server so I can review it later.

Does it work for weapon cases?

What is the issue?

7am, it's about time

Nice, that's actually the cleaner fix, second VirtualAllocEx region for the shellcode to write the full HMODULE into, then ReadProcessMemory it back. It is more reliable than the Module32First route since you skip the snapshot race and get the exact handle instead of matching by module name. Nice!!

I get it, not everyone is going to be a fan of the design, and I’m aware of the flaws you mentioned. Some users have complained about it, but I never gave it much priority since the project is still in Beta. It’s also possible that they’re more familiar with designs like Plague’s, Bank’s, or...

First one is indeed a bug, you're right. GetExitCodeThread stores into a DWORD and the LoadLibraryA thread returns HMODULE which is 64bit on x64, so any DLL that loads at an address where the low 32 bits are zero gets reported as a failure even though it injected fine. Real false negative path...

Most of what you're flagging is msvc compiler emitted code, not my code. The repeated block with 0x7fffffff / 0x7ffffffe and a non returning helper is a CRT internal sentinel pattern the compiler emits inline at every call site, which is why it shows up +20 times identical, nobody writes the...

Decompilation isn't source and I'm sure you know that. Compiled code restructured by ghidra always looks weird, that's not evidence of your claim. Point at a specific function and we can start from there.

The small embedded PE is a kernel driver (no longer using it - same excuse too lazy to clean it), bundled so the loader drops and loads it at runtime. The bigger one (~163KB) is bass.dll for radio and yt audio (no longer relying on it). bass uses an ancient toolchain with custom section names so...

I had VMProtect on the loader earlier in development and dropped it later, the SDK header stayed in the source so the imports still resolve at link time, but the calls are dead (IsProtected returns false on an unpacked binary, IsValidImageCRC returns true). No actual protection logic running...

I appreciate the reports, I’ll add them to my ‘easy to‑do list’ once I finish the things that matter most.

You're mixing up two things that have nothing to do with each other. UI polish and the actual engineering behind a cheat are completely different skillsets. I spend my time on what actually matters for the users and I'm sure you know Kobalt is in BETA. You also dodged what I asked. Show me your...