rollraw/qo0-csgo

Engine prediction not working correctly

kluskaa opened this issue · 11 comments

kluskaa commented

So i have made a basic little aimbot to test the engine prediction from this base and it seems like it isn't predicting at all. Here is a clip of the issue https://www.youtube.com/watch?v=iKwfi7XRsSA

Here is the code of the aimbot:

bool FASTCALL H::hkCreateMove( IClientModeShared* thisptr, int edx, float flInputSampleTime, CUserCmd* pCmd )
{
	static auto oCreateMove = DTR::CreateMove.GetOriginal<decltype( &hkCreateMove )>( );

	/*
	 * get global localplayer pointer
	 * @note: dont forget check global localplayer for nullptr when using not in createmove
	 * also not recommended use so far
	 */
	CBaseEntity* pLocal = CBaseEntity::GetLocalPlayer( );

	// is called from CInput::ExtraMouseSample
	if ( pCmd->iCommandNumber == 0 )
		return oCreateMove( thisptr, edx, flInputSampleTime, pCmd );

	/*
	 * check is called from CInput::CreateMove
	 * and SetLocalViewAngles for engine/prediction at the same time
	 * cuz SetViewAngles isn't called if return false and can cause frame stuttering
	 */
	if ( oCreateMove( thisptr, edx, flInputSampleTime, pCmd ) )
		I::Prediction->SetLocalViewAngles( pCmd->angViewPoint );

	// save global cmd pointer
	G::pCmd = pCmd;

	if ( I::ClientState == nullptr || I::Engine->IsPlayingDemo( ) )
		return oCreateMove( thisptr, edx, flInputSampleTime, pCmd );

	// netchannel pointer
	INetChannel* pNetChannel = I::ClientState->pNetChannel;

	// get stack frame without asm inlines
	// safe and will not break if you omitting frame pointer
	const volatile auto vlBaseAddress = *reinterpret_cast< std::uintptr_t* >( reinterpret_cast< std::uintptr_t >( _AddressOfReturnAddress( ) ) - sizeof( std::uintptr_t ) );

	/*
	 * get sendpacket pointer from stack frame
	 * if use global sendpacket value then sendpacket applies only on next tick
	 * im not recommend use globals anywhere
	 */
	bool& bSendPacket = *reinterpret_cast< bool* >( vlBaseAddress - 0x1C );

	// save previous view angles for movement correction
	QAngle angOldViewPoint = pCmd->angViewPoint;

	SEH_START

	// @note: need do bunnyhop and other movements before prediction
	CMiscellaneous::Get( ).Run( pCmd, pLocal, bSendPacket );

	/*
	 * CL_RunPrediction
	 * correct prediction when framerate is lower than tickrate
	 * https://github.com/VSES/SourceEngine2007/blob/master/se2007/engine/cl_pred.cpp#L41
	 */
	if ( I::ClientState->iDeltaTick > 0 )
		I::Prediction->Update( I::ClientState->iDeltaTick, I::ClientState->iDeltaTick > 0, I::ClientState->iLastCommandAck, I::ClientState->iLastOutgoingCommand + I::ClientState->nChokedCommands );

	CPrediction::Get( ).Start( pCmd, pLocal );
	{
#pragma region aimbot

		for ( const auto& EntityObj : U::EntityListener.vecEntities )
		{
			CBaseEntity* pEntity = EntityObj.pEntity;

			if ( pEntity == nullptr || pEntity->IsDormant( ) || !pEntity->IsAlive( ) )
				continue;

			QAngle angAimAngle = M::CalcAngle( pLocal->GetEyePosition( ), pEntity->GetHitboxPosition( HITBOX_HEAD ).value( ) );

			if ( pCmd->iButtons & IN_ATTACK )
				pCmd->angViewPoint = angAimAngle;
		}

#pragma endregion
	}
	CPrediction::Get( ).End( pCmd, pLocal );

	if ( pLocal->IsAlive( ) )
		CMiscellaneous::Get( ).MovementCorrection( pCmd, angOldViewPoint );

	// clamp & normalize view angles
	if ( C::Get<bool>( Vars.bMiscAntiUntrusted ) )
	{
		pCmd->angViewPoint.Normalize( );
		pCmd->angViewPoint.Clamp( );
	}

	// save next global sendpacket state
	G::bSendPacket = bSendPacket;

	// @note: i seen many times this mistake and please do not set/clamp angles here cuz u get confused with psilent aimbot later!

	SEH_END

	return false;
}

Note for the reader nothing has been changed in the sdk nor prediction itself.

rollraw commented

lock on target instead of locking when attack pressed
also probably u should check it with high speed and not with noclip (no reference, just guessing). i've never expirienced any issues with it, and local data seems to be predicted (because predicted flags is just fine)

kluskaa commented

lock on target instead of locking when attack pressed also probably u should check it with high speed and not with noclip (no reference, just guessing). i've never expirienced any issues with it, and local data seems to be predicted (because predicted flags is just fine)

i tried locking on target, bunny hopping at high speeds, but none seem to work.

edit: the missing starts at aprox 500 velocity

rollraw commented

tested that shit rn, everything fine, litterally same code as yours

for (int i = 1; i < I::Globals->nMaxClients; i++)
{
	CBaseEntity* pEntity = I::ClientEntityList->Get<CBaseEntity>(i);

	if (pEntity == nullptr || pEntity == pLocal || pEntity->IsDormant() || !pEntity->IsAlive())
		continue;

	QAngle angAimAngle = M::CalcAngle(pLocal->GetEyePosition(), pEntity->GetHitboxPosition(HITBOX_HEAD).value());

	if (pCmd->iButtons & IN_RELOAD)
	{
		pCmd->angViewPoint = angAimAngle;
		I::Engine->SetViewAngles(pCmd->angViewPoint);
	}
}

i also recorded a highlight for you where at 960vel it hitted (sadly that i forgot to set 60fps), and during 2mins test it had always hitting perfect, make sure u use latest commit of base and had disabled all spread/recoil related shit with commands

kluskaa commented

tested that shit rn, everything fine, litterally same code as yours

for (int i = 1; i < I::Globals->nMaxClients; i++)
{
	CBaseEntity* pEntity = I::ClientEntityList->Get<CBaseEntity>(i);

	if (pEntity == nullptr || pEntity == pLocal || pEntity->IsDormant() || !pEntity->IsAlive())
		continue;

	QAngle angAimAngle = M::CalcAngle(pLocal->GetEyePosition(), pEntity->GetHitboxPosition(HITBOX_HEAD).value());

	if (pCmd->iButtons & IN_RELOAD)
	{
		pCmd->angViewPoint = angAimAngle;
		I::Engine->SetViewAngles(pCmd->angViewPoint);
	}
}

i also recorded a highlight for you where at 960vel it hitted (sadly that i forgot to set 60fps), and during 2mins test it had always hitting perfect, make sure u use latest commit of base and had disabled all spread/recoil related shit with commands

i do use the latest commit and i did disable all spread and recoil stuff

kluskaa commented

seems like another user had an issue similar to that one in #14

rollraw commented

whole prediction was re-reversed since this issue and now it's fully done and actual, so i even showed you that's it just fine. closed

kluskaa commented

here yet again another clip featuring the same exact code as you clip

rollraw commented

i literally see the recoil/spread
used commands:

sv_enablebunnyhopping 1;
sv_maxvelocity 7000;
sv_staminamax 0;
sv_staminalandcost 0;
sv_staminajumpcost 0;
sv_accelerate_use_weapon_speed 0;
sv_staminarecoveryrate 0;
sv_airaccelerate 2000;
weapon_accuracy_nospread "1";
weapon_debug_spread_gap "1";
weapon_recoil_cooldown "0";
weapon_recoil_decay1_exp "99999";
weapon_recoil_decay2_exp "99999";
weapon_recoil_decay2_lin "99999";
weapon_recoil_scale "0";
weapon_recoil_suppression_shots "500";
weapon_recoil_view_punch_extra "0";```
kluskaa commented

i literally see the recoil/spread used commands:

sv_enablebunnyhopping 1;
sv_maxvelocity 7000;
sv_staminamax 0;
sv_staminalandcost 0;
sv_staminajumpcost 0;
sv_accelerate_use_weapon_speed 0;
sv_staminarecoveryrate 0;
sv_airaccelerate 2000;
weapon_accuracy_nospread "1";
weapon_debug_spread_gap "1";
weapon_recoil_cooldown "0";
weapon_recoil_decay1_exp "99999";
weapon_recoil_decay2_exp "99999";
weapon_recoil_decay2_lin "99999";
weapon_recoil_scale "0";
weapon_recoil_suppression_shots "500";
weapon_recoil_view_punch_extra "0";```

issue resolved

edit: wasn't related to these commads

rollraw commented

well then what is was?

kluskaa commented

well than what is was?

i am a fucking retard and i unhooked runcommand but i forgot that runcommand is related to prediction.

add a note in prediction or runcommand hook since if people try to clean out SDK they will delete crucial elements so they don't end up confused like me appreciate for help thanks.