C++ Exploit Pixelsurf + Edgebug source

Boomzy said:

edgebug.cpp:

#include "edgebug.hpp"
#include <cstring>

namespace edgebug {

// ================================================================
// sub_19D7F0 — core edge bug detection
//
// checks if player is in the slipping velocity window while airborne.
// returns true if:
//   1. m_fFlags & FL_ONGROUND == 0 (airborne)
//   2. m_vecAbsVelocity.z < 0 (falling)
//   3. velocity.z ∈ [-8.293, -5.629] (slipping window)
// ================================================================
bool detect_edgebug(uint64_t pawn) {
    uint32_t flags = 0;
    if (!read_schema_field(pawn, "C_BaseEntity", "m_fFlags", &flags, sizeof(flags)))
        return false;
    if (flags & 1) // on ground → no edge bug
        return false;

    vec3_t vel = {};
    if (!read_schema_field(pawn, "C_BaseEntity", "m_vecAbsVelocity", &vel, sizeof(vel)))
        return false;
    if (vel.z >= 0.0f) // not falling
        return false;

    return (vel.z >= edgebug_constants::k_velocity_lower &&
            vel.z <= edgebug_constants::k_velocity_upper);
}

// ================================================================
// sub_19D680 — movement command runner
//
// resolves m_pMovementServices → C_BasePlayerPawn, sets button
// flags, clears movement, and runs one movement tick.
//
// pass 0: clears IN_DUCK
// pass 1: sets IN_DUCK
// ================================================================
static void run_movement_cmd(
    uint64_t local, uint64_t pawn,
    uint64_t cmd_buf, int pass)
{
    uint64_t svc = 0;
    if (!read_schema_field(pawn, "C_BasePlayerPawn",
            "m_pMovementServices", &svc, sizeof(svc)))
        return;
    if (!svc) return;

    // set up command flags
    user_cmd_t* cmd = reinterpret_cast<user_cmd_t*>(cmd_buf);
    cmd->hasbeenpredicted = 1;
    cmd->buttons &= ~(IN_JUMP | IN_ATTACK2 | IN_DUCK);

    if (pass == 0)
        cmd->buttons &= ~IN_DUCK; // clear duck
    else
        cmd->buttons |= IN_DUCK;  // hold duck

    cmd->forwardmove = 0.0f;
    cmd->sidemove = 0.0f;
    cmd->upmove = 0.0f;

    // run the movement service command (vtable+240 = RunCommand)
    using run_cmd_fn = void(__fastcall*)(uint64_t, uint64_t, uint64_t,
        uint64_t, uint64_t, uint64_t);
    run_cmd_fn run_cmd = *(run_cmd_fn*)(*(uint64_t*)svc + 240);
    run_cmd(cmd_buf, local, cmd_buf, svc, 0, 0);
}

// ================================================================
// sub_19CFB0 — main edge bug assist entry
//
// called per-frame when edge bug is enabled. runs two passes:
//   pass 0: look ahead up to `radius` ticks with IN_DUCK cleared
//   pass 1: if pass 0 missed, retry with IN_DUCK held
//
// at each tick in the lookahead:
//   1. check m_fFlags → if on ground, break (no longer falling)
//   2. check m_nActualMoveType → skip if ladder
//   3. read m_vecAbsVelocity.z → check [-8.293, -5.629] window
//   4. if in window → edge bug found, output true
//   5. if not, run a movement tick and advance one iteration
//
// the lookahead uses the engine's movement simulation to predict
// whether the player will enter the velocity window within the
// next N ticks (where N = radius, default 64 = ~1 second at 64 tick)
// ================================================================
bool apply_edgebug_assist(
    uint64_t local, uint64_t pawn,
    const edgebug_settings_t& settings,
    edgebug_state_t* state)
{
    // ---- setting check ----
    if (!settings.enabled) {
        state->active = false;
        return false;
    }

    // already active this frame or too soon since last activation
    if (state->active || state->tick_count > 0)
        return false;

    // ---- validation ----
    if (!local || !pawn)
        return false;

    // must be airborne
    uint32_t flags = 0;
    if (!read_schema_field(pawn, "C_BaseEntity", "m_fFlags", &flags, sizeof(flags)))
        return false;
    if (flags & 1) return false; // on ground

    // not on ladder or noclip
    uint8_t move_type = 0;
    if (!read_schema_field(pawn, "C_BaseEntity", "m_nActualMoveType", &move_type, sizeof(move_type)))
        return false;
    if (move_type == 0 || move_type == edgebug_constants::k_move_type_noclip ||
        move_type == edgebug_constants::k_move_type_ladder)
        return false;

    state->active = false;

    // ---- pass 0: no duck ----
    setup_movement_services(local, pawn);

    run_movement_cmd(local, pawn, 0, 0);

    int radius = (settings.radius > 0) ? settings.radius : edgebug_constants::k_default_radius;
    for (int i = 1; i <= radius; i++) {
        // re-check ground
        uint32_t f = 0;
        read_schema_field(pawn, "C_BaseEntity", "m_fFlags", &f, sizeof(f));
        if (f & 1) break; // hit ground

        uint8_t mt = 0;
        read_schema_field(pawn, "C_BaseEntity", "m_nActualMoveType", &mt, sizeof(mt));
        if (mt == edgebug_constants::k_move_type_ladder) break;

        // read velocity and check slipping window
        vec3_t vel = {};
        read_schema_field(pawn, "C_BaseEntity", "m_vecAbsVelocity", &vel, sizeof(vel));
        if (vel.z < 0.0f &&
            vel.z >= edgebug_constants::k_velocity_lower &&
            vel.z <= edgebug_constants::k_velocity_upper)
        {
            state->active = true;
            state->tick_count += i;
            return true;
        }

        // run another tick of movement simulation
        run_movement_cmd(local, pawn, 0, 0);
    }

    // ---- pass 1: with IN_DUCK ----
    run_movement_cmd(local, pawn, 0, 1);

    for (int i = 1; i <= radius; i++) {
        uint32_t f = 0;
        read_schema_field(pawn, "C_BaseEntity", "m_fFlags", &f, sizeof(f));
        if (f & 1) break;

        uint8_t mt = 0;
        read_schema_field(pawn, "C_BaseEntity", "m_nActualMoveType", &mt, sizeof(mt));
        if (mt == edgebug_constants::k_move_type_ladder) break;

        vec3_t vel = {};
        read_schema_field(pawn, "C_BaseEntity", "m_vecAbsVelocity", &vel, sizeof(vel));
        if (vel.z < 0.0f &&
            vel.z >= edgebug_constants::k_velocity_lower &&
            vel.z <= edgebug_constants::k_velocity_upper)
        {
            state->active = true;
            state->tick_count += i;
            return true;
        }

        run_movement_cmd(local, pawn, 0, 1);
    }

    return false;
}

} // namespace edgebug

edgebug.hpp:

#pragma once
#include <cstdint>
#include <cmath>

// edge bug assist — velocity-window detection + duck input
// reversed from sub_19CFB0, sub_19D7F0, sub_19D680

#pragma pack(push, 1)
struct edgebug_state_t {
    int      active;             // [r14+0x00] edge bug active this frame
    int      tick_count;         // [r14+0x04] accumulative tick counter
    int      last_origin;        // [r14+0x08]
    int      weapon_type;        // [r14+0x0C] weapon class at detection time
};

struct edgebug_settings_t {
    bool     enabled;
    bool     key_held;
    uint8_t  key_type;           // 0 = hold, 1 = toggle
    int      radius;             // max iterations (default 64)
    bool     hit_sound;
    float    hit_sound_volume;   // default 1.0f
    int      sound_preset;       // 0-8
    bool     chat_log;
    bool     health_shot;
    float    health_shot_duration;
};
#pragma pack(pop)

// byte signatures
namespace edgebug_patterns {
    // sub_19CFB0 — main edge bug assist
    //   48 8B C4 48 89 58 ? 55 56 57 41 54 41 55 41 56 41 57 48 8D 68 ?
    //   48 81 EC B0 00 00 00
    inline const char* edgebug_assist =
        "\x48\x8B\xC4\x48\x89\x58\x00\x55\x56\x57\x41\x54\x41\x55\x41"
        "\x56\x41\x57\x48\x8D\x68\x00\x48\x81\xEC\xB0\x00\x00\x00";
    inline const char* edgebug_assist_mask =
        "xxxxxx?xxxxxxxxxxxxxxxx?xxxxxxx";

    // sub_19D7F0 — velocity window check (m_fFlags + m_vecAbsVelocity)
    //   48 89 5C 24 18 48 89 7C 24 20 48 89 54 24 10 55 48 8B EC 48 83
    //   EC 60 49 8B D8
    inline const char* edgebug_detector =
        "\x48\x89\x5C\x24\x18\x48\x89\x7C\x24\x20\x48\x89\x54\x24\x10"
        "\x55\x48\x8B\xEC\x48\x83\xEC\x60\x49\x8B\xD8";
    inline const char* edgebug_detector_mask =
        "xxxxxxxxxxxxxxxxxxxxxxxxxxx";

    // sub_19D680 — movement command runner (pass 0/1 + IN_DUCK)
    //   48 89 5C 24 18 48 89 6C 24 20 48 89 4C 24 08 56 57 41 54 41 56
    //   41 57 48 83 EC 60
    inline const char* edgebug_movement_cmd =
        "\x48\x89\x5C\x24\x18\x48\x89\x6C\x24\x20\x48\x89\x4C\x24\x08"
        "\x56\x57\x41\x54\x41\x56\x41\x57\x48\x83\xEC\x60";
    inline const char* edgebug_movement_cmd_mask =
        "xxxxxxxxxxxxxxxxxxxxxxxxxxxx";
}

namespace edgebug_funcs {
    using fn_edgebug_assist = void(__fastcall*)(
        uint64_t, uint64_t, int, void*, int, int,
        double, double, double, double, double, double,
        __m128, __m128);

    using fn_edgebug_detector = bool(__fastcall*)(
        uint64_t, uint64_t, uint64_t, uint64_t, uint64_t);
}

namespace edgebug_constants {
    inline constexpr float k_velocity_lower = -8.293333f;
    inline constexpr float k_velocity_upper = -5.628950f;
    inline constexpr int   k_default_radius = 64;     // dword_9C4BE8 = 0x40
    inline constexpr float k_default_volume = 1.0f;   // dword_9C4BE0 / 9C4BE4
    inline constexpr uint8_t k_move_type_ladder = 9;
    inline constexpr uint8_t k_move_type_noclip = 7;
}

pixelsurf.cpp:

#include "pixelsurf.hpp"
#include "prediction.hpp"
#include <cstring>
#include <cmath>

namespace pixelsurf {

static bool validate_assist_state(uint64_t local, uint64_t pawn) {
    return (local != 0 && pawn != 0);
}

static void handle_state_transition(
    pixelsurf_state_t* state, const prediction_state_t* pred)
{
    // byte_44 (on_surface) persists until velocity exits the window
    if (!pred->is_slipping && state->is_slipping) {
        if (state->vel_z < -8.293f || state->vel_z > -5.629f)
            state->is_slipping = false;
    }
}

static void apply_button_flags(
    uint64_t cmd_base, uint64_t local,
    pixelsurf_state_t* state, const prediction_state_t* pred,
    bool had_failure)
{
    user_cmd_t* cmd = reinterpret_cast<user_cmd_t*>(cmd_base);

    if (had_failure) {
        if (state->edge_type == 1) cmd->buttons &= ~IN_JUMP;
        else if (state->edge_type == 0) cmd->buttons &= ~IN_ATTACK2;
        state->edge_type = 0;
        state->edge_direction = 0;
        return;
    }

    uint8_t dir = pred->direction;
    uint8_t type = pred->type;
    state->edge_type = type;
    state->edge_direction = dir;

    if (!state->prediction_active) return;

    if (type != 0) cmd->buttons &= ~IN_JUMP;
    else cmd->buttons &= ~IN_ATTACK2;

    if (type == 1) cmd->buttons |= IN_ATTACK2;
    else cmd->buttons |= IN_JUMP;

    cmd->hasbeenpredicted = 1;
}

static void write_corrected_angles(
    uint64_t local, uint64_t pawn, uint64_t cmd_base,
    float target_yaw, float target_pitch,
    const pixelsurf_state_t* state)
{
    write_view_angles(local, pawn, cmd_base, target_pitch, target_yaw, 0, 0);
}

// ================================================================
// sub_1A29A0 — main pixel surf assist
// applies prediction results as button inputs + angle writes
// ================================================================
bool apply_pixelsurf_assist(
    uint64_t                local,
    uint64_t                pawn,
    uint64_t                cmd_base,
    const view_angles_t&    angles,
    const prediction_state_t* pred,
    pixelsurf_state_t*      state)
{
    if (!validate_assist_state(local, pawn))
        return false;

    // fresh activation: clear residual state
    if (state->prediction_age == 0) {
        if (state->edge_type != 0) {
            user_cmd_t* cmd = reinterpret_cast<user_cmd_t*>(cmd_base);
            if (state->edge_type == 1) cmd->buttons &= ~IN_JUMP;
            else cmd->buttons &= ~IN_ATTACK2;
        }
        state->edge_type = 0;
        state->edge_direction = 0;
        state->is_slipping = false;
        state->prediction_active = 0;
    }

    handle_state_transition(state, pred);
    state->prediction_active = 1;

    // slipping → latch edge bug type
    if (pred->is_slipping && !state->is_slipping) {
        state->is_slipping = true;
    } else if (state->is_slipping && !pred->is_slipping) {
        state->is_slipping = false;
    }

    bool had_failure = !pred->active;
    apply_button_flags(cmd_base, local, state, pred, had_failure);

    write_corrected_angles(local, pawn, cmd_base,
        pred->target_yaw, pred->target_pitch, state);

    // persist the correction if still active
    if (pred->active) return true;

    user_cmd_t* cmd = reinterpret_cast<user_cmd_t*>(cmd_base);
    cmd->hasbeenpredicted = 1;
    if (state->edge_type == 1) cmd->buttons |= IN_ATTACK2;
    else cmd->buttons |= IN_JUMP;
    cmd->forwardmove = 0.0f;
    cmd->sidemove = 0.0f;
    cmd->upmove = 0.0f;
    return true;
}

// ================================================================
// sub_1A2180 — movement flag handler
// reads m_fFlags, sets IN_JUMP or IN_ATTACK2 based on type
// ================================================================
void handle_movement_flags(
    uint64_t local, uint64_t pawn,
    uint64_t cmd_base, pixelsurf_state_t* state)
{
    uint32_t flags = 0;
    if (!read_schema_field(pawn, "C_BaseEntity", "m_fFlags", &flags, sizeof(flags)))
        return;
    if (!validate_assist_state(local, pawn))
        return;

    user_cmd_t* cmd = reinterpret_cast<user_cmd_t*>(cmd_base);
    cmd->buttons &= ~(IN_JUMP | IN_ATTACK2);

    if (state->edge_type == 1) cmd->buttons |= IN_ATTACK2;
    else cmd->buttons |= IN_JUMP;
    cmd->hasbeenpredicted = 1;
}

// ================================================================
// sub_3A24B0 — view angle writer
// clamps pitch to ±89, yaw to ±180, writes to command
// ================================================================
void write_view_angles(
    uint64_t local, uint64_t pawn, uint64_t cmd_base,
    float pitch, float yaw,
    uint64_t additional_cmds, int num_additional)
{
    float* angle_ptr = get_command_angle_ptr(cmd_base);
    if (!angle_ptr) return;

    if (pitch > 89.0f) pitch = 89.0f;
    if (pitch < -89.0f) pitch = -89.0f;
    if (yaw > 180.0f) yaw = 180.0f;
    if (yaw < -180.0f) yaw = -180.0f;

    angle_ptr[0] = pitch;
    angle_ptr[1] = yaw;
    angle_ptr[2] = 0.0f;

    user_cmd_t* cmd = reinterpret_cast<user_cmd_t*>(cmd_base);
    cmd->hasbeenpredicted = 1;

    for (int i = 0; i < num_additional; i++) {
        float* sub = get_sub_command_angle(additional_cmds, i);
        if (sub) {
            sub[0] = pitch; sub[1] = yaw; sub[2] = 0.0f;
        }
    }
}

} // namespace pixelsurf

pixelsurf.hpp:

#pragma once
#include <cstdint>
#include <cstddef>

// pixel surf assist — detects pixel-walk surfaces and applies corrections
// reversed from sub_1A29A0, sub_1A2180, sub_3A24B0

#pragma pack(push, 1)
struct pixelsurf_state_t {
    uint8_t  pad_00[0x0C];
    uint64_t packed_angles;       // +0x0C: pitch float + sentinel byte
    uint8_t  pad_14[0x14];
    uint8_t  edge_type;           // +0x28: 0=IN_JUMP, 1=IN_ATTACK2
    uint8_t  edge_direction;      // +0x29: 0=left, 1=right
    uint8_t  pad_2A[6];
    bool     prediction_active;   // +0x30
    float    target_pitch;        // +0x34
    float    target_yaw;          // +0x38
    float    target_pitch_extra;  // +0x3C
    float    target_yaw_extra;    // +0x40
    bool     is_slipping;         // +0x44
    uint16_t encoded_buttons;     // +0x45
    float    speed;               // +0x48
    float    eye_x, eye_y, eye_z; // +0x4C
    float    vel_x, vel_y, vel_z; // +0x58
};

struct user_cmd_t {
    int     command_number;
    int     tick_count;
    float   viewangles_pitch, viewangles_yaw, viewangles_roll;
    float   forwardmove, sidemove, upmove;
    uint32_t buttons;
    uint8_t  impulse;
    int      weaponselect, weaponsubtype;
    int      random_seed;
    int16_t  mousedx, mousedy;
    bool     hasbeenpredicted;
};
#pragma pack(pop)

constexpr uint32_t IN_ATTACK  = (1 << 0);
constexpr uint32_t IN_JUMP    = (1 << 1);
constexpr uint32_t IN_DUCK    = (1 << 2);
constexpr uint32_t IN_ATTACK2 = (1 << 11);

// byte signatures
namespace pixelsurf_patterns {
    inline const char* pixelsurf_assist =
        "\x48\x89\x5C\x24\x00\x48\x89\x6C\x24\x00\x56\x57\x41\x56\x48"
        "\x81\xEC\xA0\x00\x00\x00\x48\x8B\x05\x00\x00\x00\x00\x48\x33"
        "\xC4\x48\x89\x84\x24\x00\x00\x00\x00\x4D\x8B\xF0";
    inline const char* pixelsurf_assist_mask =
        "xxxx?xxxx?xxxxxxxxxxxxxx????xxxxxxx????xxx";

    inline const char* button_flag_handler =
        "\x48\x89\x5C\x24\x00\x66\x44\x89\x44\x24";
    inline const char* button_flag_handler_mask =
        "xxxx?xxxxx";

    inline const char* angle_writer =
        "\x40\x55\x41\x57\x48\x83\xEC\x68";
    inline const char* angle_writer_mask =
        "xxxxxxxx";

    inline const char* player_validator =
        "\x48\x89\x5C\x24\x00\x48\x89\x6C\x24\x00\x48\x89\x74\x24\x00"
        "\x57\x41\x56\x41\x57\x48\x83";
    inline const char* player_validator_mask =
        "xxxx?xxxx?xxxx?xxxxxxxxx";
}

namespace pixelsurf_funcs {
    using fn_pixelsurf_assist = uint64_t(__fastcall*)(
        uint64_t, uint64_t, uint64_t, uint64_t, uint32_t*, int);
    using fn_button_handler = void(__fastcall*)(
        uint32_t, int, uint64_t, uint64_t, int, int);
    using fn_angle_writer = uint64_t(__fastcall*)(
        uint64_t, uint64_t, uint64_t, uint32_t, uint32_t,
        uint64_t, uint64_t, int, int, uint64_t, uint8_t, uint8_t);
}

Click to expand...

swd said:

atleast give shoutout to 3k when he spent time to actually do a good pixel surf

Click to expand...

encrypted said:

lol this is some bullshit anyway

Click to expand...

xsad2123123 said:

doesnt working bro bad

Click to expand...

swd said:

maybe cuz you pasted this badly bud...

Click to expand...

sergey1 said:

i'm a coding noob and want to make an internal edgebug cheat for CS2, could u provide instructions on how to create something like 'edgebug.dll' or share links to guides? i don't just need edgebug.dll, i'd like to understand how it all works.

sry about me

Click to expand...

swd said:

maybe cuz you pasted this badly bud...

Click to expand...

swd said:

maybe cuz you pasted this badly bud...

Click to expand...