CSS CS:GO Bunny Hopper - Steve Andrew [Binary + Source]

Virus Scans:

CSGO Bunny Hopper - Steve Andrew.zip - Jotti's malware scan
CSGO Bunny Hopper - Steve Andrew.zip MD5:1a3a7336faef3c3dfed6f0913fd08110 - VirSCAN.org 3% Scanner(s) (1/37) found malware!
https://www.virustotal.com/en/file/9...e6de/analysis/

This is CSS CS:GO Bunny Hopper! xD

I originally had made this for CSS (Counter Strike Source) but never released it. Re-wrote it from scratch in Embarcadero RAD Studio XE3 C++ and finished it yesterday!

Disclaimer

Disclaimer: I will not be responsible for any banned accounts, it is completely up to you if you use hacks.
But if you do, always try to make sure it's undetected and do not use it after any new updates of the game.
In short, if you use hacks, use them cautiously.

Use at your own risk.

Although this will most likely never be detected, it isn't that it can't be. So the disclaimer is there for a reason!

Instructions

Instructions:
1.Run "CSGO Bunny Hopper.exe" by double clicking on it (It will automatically run as administrator so you don't have to right click and choose that option each time)
2.Run CSS CS:GO (the game itself) or already have it running doesn't matter
3.While in-game jump and press the middle mouse button to toggle auto-hopping on/off
4.Use the WASD keys and the gentle mouse movements to gain speed around the map (Find a bunny hopping tutorial if you are unsure how to do it, but this will make it much easier! You can focus on getting your movements right without also having to worry about timing your jumps)

5. Have fun bunny hopping! It does still work in CS:GO they haven't gotten rid of it (Thankfully, it's one of my favorite things about CS even back since the beggining CS1.5/CS1.6, it's what makes CS unique)! 100TICK servers still works best on though xD

It works by using a pointer I found, which is part of the client.dll which has a value of 1 if on the ground or 0 if in the air... It's basically an 'IsOnGround' boolean value.

This is the one I found and that it uses (perhaps I shouldn't make it hard coded, but for now it is):

[[["client.dll"]+92F0FC]+5C]

Extra Info

When 'Auto Bunny Hopping Enabled' checkbox on the GUI is checked, and you've toggled it on while in-game using the middle mouse button, it will automatically jump at the right time, each time you hit the ground. This is all it does, you still must make your movements properly to actually gain speed and hop properly

You can close the game, and re-run it while keeping this bunny hopper application open and it will work again, without having to restart it. There's a bug I haven't spotted yet but should be easy to fix where sometimes it doesn't find the client DLL if you run the game after running it. So for now the best way is to just run it after running the actual game, though it does work most of the time the opposite way (CS:GO)

I am working on making it into a PRO verison (also will be 100% free) which will actually modify the game's code to achieve the same effect but it will be flawless and no chance of slight delays of hitting jump when you are on the ground. Don't get me wrong it does work pretty well, but it depends upon that pointer being 1 before sending the keystroke (and sending the keystroke might be a slight delay in itself, very small delays but existant [some code injection which trains the game to not require precise jump button presses avoids having to send a keystroke]) I imagine holding down jump to work it rather than a certain button to toggle hopping, but it could actually be an option which way you wanted it.

Only problem is, I can't use find what accesses or debug anything (on win8 x64), as by looking at the games threads, all the debug registers are used up! I know steam games have a habit of doing this, but I have never figured out a way around it without crashing the game) They purposely use up all the debug registers don't they? So whats the trick to bypass it? All I need is just one free debug register! There must be a way as how are you guys hacking so easily? lol Some of you have almost certainly used debug registers in order to help them hack CSS CS:GO... help me out/figure it out? Thanks!

This is what I mean about a pro version: I found three old scripts for CS:Source, but since I can't use not even a single hardware breakpoint it makes it so tricky to try and find the new code (I'm certain the code has changed a bit as trying to search for some assembler instructions of the original codes from those scripts, yielded some results but after playing around they weren't the right addresses):

Old Bunny Hop Scripts for CSS

1.

Code:

2415D633: 
call newmem 
nop 

newmem: 
mov dword ptr eax,[243B51C4] // client.dll + 0x003B51C4 ; pointer to LocalPlayer 
mov eax,[eax+2B4] //0x2B4 - Flags 
test eax,01 //Check if on ground 
jne @Original..code //if not, Proceed with regular code 
and [ebp+20],FFFD  //if, negate cmd->buttons with 0x0002 (by doing and x,FFFD) 

originalcode: //regular code 
mov eax,[ebp+24] 
push ebx 
push x 
ret

2.

Code:

[ENABLE] 
alloc(newmem,64) 
label(returnhere) 
label(originalcode) 
label(exit) 
2415D633: 
jmp newmem 
nop 
returnhere: 

    newmem: 
    mov eax,[243B51C4] 
    mov eax,[eax+2B4] 
    test eax,01 
    jne originalcode 
    and [ebp+24],FFFD  

    originalcode: 
    mov eax,[ebp+24] 
    push ebx 
    push 20 

    exit: 
    jmp returnhere 

[DISABLE] 
2415D633: 
mov eax,[ebp+24] 
push ebx 
push 20

3.

Code:

/*
Bunnyhop - in ASM
Credits:
SDK
supex0
 
esi+24 = cmd->buttons
p_Ent+2E4 = flags
"test" wird verwendet um aus den addierten Bits einzelne herauszufiltern
Zuerst wird überprüft, ob +jump ausgeführt wird, wenn ja dann ob man sich auf dem Boden befindet.
Wenn dies zutrifft, wird, solange man sich auf dem Boden aufhält, +jump/-jump "gespamt", in der Regel nur höchstens 2 ticks lang, in der Luft dann "stille".
*/
//test
aobscan(p_Ent, ?? ?? ?? ?? 0f 94 C0 C3 CC CC CC CC A1)
/*
label(p_Ent)
client.dll+5AA488:
p_Ent:*/
 
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
 
aobscan(hookscene, 8B C8 89 4E 24 8B 15)
 
/*client.dll+E4876:*/
hookscene:
jmp newmem
returnhere:
 
newmem:
mov ecx,eax //ursprünglicher code,
mov [esi+24],ecx //einfach ignorieren.
pushall
mov ecx,[p_Ent]                 // wir benötigen den Entitypointer um Checks durchzuführen
mov ecx,[ecx]                   // aobscan, man muss den Pointer im Pointer nehmen!
test byte ptr [esi+24],02       // Überprüfung ob +jump ausgeführt wird
je originalcode
test byte ptr [ecx+2E4],01      // Überprüfung, ob man sich auf dem Boden befindet
jne originalcode
//Immernoch hier, also ist es BHOP-Time!
and [esi+24],0FFFD //~&in_jump; 0x0002, inversiert ergibt das 0xFFFD
originalcode:
popall
 
exit:
jmp returnhere

The game still appears to use these flags / at least some of them:

Code:

#define IN_ATTACK (1<<0)
#define IN_JUMP (1<<1)
#define IN_DUCK (1<<2)
#define IN_FORWARD (1<<3)
#define IN_BACK (1<<4)
#define IN_USE (1<<5)
#define IN_CANCEL (1<<6)
#define IN_LEFT (1<<7)
#define IN_RIGHT (1<<8)
#define IN_MOVELEFT (1<<9)
#define IN_MOVERIGHT (1<<10)
#define IN_ATTACK2 (1<<11)
#define IN_RUN (1<<12)
#define IN_RELOAD (1<<13)
#define IN_ALT1 (1<<14)
#define IN_SCORE (1<<15)

In CS:GO By searching for a value of 4 while ducking + pausing the game, and searching for a value of 2 while being in the air + pausing, and repeating... I found a good 8 or 10 addresses... But only 1 seemed to effect anything...

When using a test script I wrote up /or freezing that 1 address [at most values besides 2] (It's for CE, obviously):

Code:

[enable]
alloc(ProBunnyHop,64)
label(ExitHopping)
label(StopHopping)
createthread(ProBunnyHop)
registersymbol(StopHopping)

ProBunnyHop:
push 0a
call Sleep
cmp [StopHopping],1
je ExitHopping
//mov eax,[client.dll+92F0FC]
//mov eax,[eax+5c]
//test eax,eax //if not on ground
//je ProBunnyHop //then don't do anything

mov eax,044F7C74 //this was a dynamic address, you'll have to find it again to see what I mean
and [eax],fffd //and negated IN_JUMP
jmp ProBunnyHop

ExitHopping:
ret

StopHopping:
dd 0

[disable]

StopHopping:
dd 1

I noticed something weird and I felt like I almost had it! When that script is active (with the correct address that seems to do something) When holding down the jump button you'll jump once and when you hit the ground, it stutters like it wants to let you jump again, but doesn't. It looks like your bouncing up and down, no idea if others will see anything different though (tested with bots only).

I suspect that this in fact might actually be the right address of the cmd->buttons / CUserCmd / whatever it's called, but since I don't have the right place to hook it [CL_CreateMove or something like that] (I just created a thread as a test) the game is probably doing its thing like normally and it does it so fast, that it won't let you jump again.
It's kind of like in a game where you made a health cheat by finding a your health address... If you freeze the health address most games this will be just fine, but some games (especially ones where you can be one hit killed) this isn't enough to always prevent you from dying. As the game is still writing to that address and sometimes faster than you, or regardless if its faster than you are writing to it, it's still changing it like normally you are just changing it as well... Instead you find the code which actually writes to your health address, and modify it's code so it does not... No need to 'freeze'/constantly re-write your health value, you let the game set your health to full whenever it was going to decrease it :P

So any experienced bunny hop hackers out there? Where do I need to hook and how can I find it if I can't use not even a single debug register? Is it CL_CreateMove still like previous versions of CS?

Modifying the game's code to negate IN_JUMP rather than checking if your on the ground and sending a keystroke, is much preferred and works 100% perfect, while this method isn't 100% solid but close...

Enjoy, and look forward to the PRO release version soon

Thanks!

- Steve

CSGO Bunny Hopper - Steve Andrew_mpgh.net.zip3.6 MB · 319 downloads Clean

Download & Thanks

approved .

can i use this on esea ? lol will it get detected?

Congratulations on your release .

Doesn't work.

Originally Posted by Daelso

Doesn't work.

That's unhelpful, why doesn't it work.
You get any errors, any more information at all?

Like saying, I don't like this sandwich, why don't you like it?

Originally Posted by Daelso

Doesn't work.

Hi! Well don't fret, it can work for you to and I'm going to help with that!

First of all, what does the user interface say when you're trying to work it? Did you try running it after csgo is fully loaded rather than before? It's best to run it after right now as in that release version there was a bug where it would fail getting the clientDLL address, I have fixed it already just haven't updated it yet [am making it more configurable, and letting you use you're own pointer])

It should look something like this [if its going to work]: (numbers will be different almost guaranteed[unless purely by coincidence], but they just can't be 0 [ZERO])

'Wnd', 'Handle', and 'ClientDLL' should all contain a value that isn't zero. Also when in game jump at least once normally to make sure it will be getting a reading, and check the 'Is On Ground' value on the GUI (as also circled in red) if it contains 1 [when on the ground], then it is reading the value properly... You may have to put cs into windowed mode and move the cs window a little offscreen to have space for bunny hopper GUI to be seen as well... The 'Is On Ground' value on the GUI updates way slower then it's actually reading it, I promise you lol, but just jump a few times to see it change as you are on and off the ground...

Currently all three, the window handle, the process handle, and the client DLL base address are required for it to work, and being able to read that pointer properly, and it actually being a right pointer for you...

Double check that pointer with CE if you aren't trusting the bunny hopper's read of it... add this pointer while attached to csgo.exe: [[["client.dll"]+92F0FC]+5C]

Also one thing I totally forgot which will be corrected in my update when I update it... Right now this wont work on Windows XP at all... On XP you had to request SE_DEBUG_NAME token privileges before you can call OpenProcess (since there was no 'Run as administrator' back then {everything ran with administrator privs), this was all there was in place instead) It's a simple fix that I will add when I update, so if anyone is still using XP it will work on that as well...

Originally Posted by igotthis

can i use this on esea ? lol will it get detected?

lol I had to look that up! Well I suppose it will be undetected for now (until they find this thread, download it, and detect something about it, lol) but don't take my word for it... That is pretty slick though, as a hack maker doesn't want to pay just to see if its / work on making it / undetectable

) I don't have ESEA or else I would try it for you. If you do decide to try it let others know of whether it is or not! lol xD

Originally Posted by Gray

Congratulations on your release .

Thanks! Yea and I looked into Brinkz's bunny hop code, he uses this almost this same method! lol, except SendMessage/PostMessage API rather than SendInput, and he checks a different pointer then me, when I do update this, I can right? [It'll just have to be re-approved or something?] I will make it configurable whether to use SendInput or PostMessage or SendMessage, and configurable jump button though most people probably only use space anyway (like my GUI kind of fakes right now lol) and you can choose between holding down the jump button to work it, or a toggle button (also configurable) lol Also configurable pointer to read!

Essentially it will be the totally configurable version of this, with nothing hard coded

I've attempted both and started the game multiple ways. Through steam at first, and then through the local files. My jump button is my space bar and I set it at as so. Neither the auto nor the manual jump is working for me. Windows 7 OS.

Originally Posted by Daelso

I've attempted both and started the game multiple ways. Through steam at first, and then through the local files. My jump button is my space bar and I set it at as so. Neither the auto nor the manual jump is working for me. Windows 7 OS.

Well it doesn't have a manual jump option! lol it's only auto... but try the new version when it gets approved! I made it totally customizable and more troubleshoot friendly... Also improved the speed, it bunny hops so quick now, I almost don't care to find the 'pro' version!

Windows 7? 64bit or 32bit? (yes it does matter lol) I built and tested the application on Windows 8 64-bit (though it should work on any windows machine even XP now with the new version, 64-bit or 32-bit may make a difference...)

Also you still haven't mentioned whether it shows all three values for 'Wnd', 'Handle', and 'ClientDLL' I know the font is small but none of them are 0's right? If they are then there's where the problem lies, new version should hopefully solve that, and even if not you can change the configuration so it does find all three...

Also haven't mentioned whether its reading that pointer properly... If it isn't then that could be it as well! In any case, the point is, since I made it fully configurable it can work for anyone given the right settings...

76 downloads, 10 thanks, and only one person said it didn't work for them, so I'd say it is working for most people... But yes I would like to have my code work for everyone no matter their computer or setup, so I'll continue to help you or anyone else who may have issues to get it working for them! (but with the new version only from here on out... I'm dropping support for this release)

http://www.mpgh.net/forum/526-counte...ml#post7653615

Originally Posted by stevextc

Well it doesn't have a manual jump option! lol it's only auto... but try the new version when it gets approved! I made it totally customizable and more troubleshoot friendly... Also improved the speed, it bunny hops so quick now, I almost don't care to find the 'pro' version!

Windows 7? 64bit or 32bit? (yes it does matter lol) I built and tested the application on Windows 8 64-bit (though it should work on any windows machine even XP now with the new version, 64-bit or 32-bit may make a difference...)

Also you still haven't mentioned whether it shows all three values for 'Wnd', 'Handle', and 'ClientDLL' I know the font is small but none of them are 0's right? If they are then there's where the problem lies, new version should hopefully solve that, and even if not you can change the configuration so it does find all three...

Also haven't mentioned whether its reading that pointer properly... If it isn't then that could be it as well! In any case, the point is, since I made it fully configurable it can work for anyone given the right settings...

76 downloads, 10 thanks, and only one person said it didn't work for them, so I'd say it is working for most people... But yes I would like to have my code work for everyone no matter their computer or setup, so I'll continue to help you or anyone else who may have issues to get it working for them! (but with the new version only from here on out... I'm dropping support for this release)

http://www.mpgh.net/forum/526-counte...ml#post7653615

64 bit. And yes there are no 0's.

Alright good there are no 0's so that means it at least has almost everything required to jump in game... It has a handle to the game to be able to read it's memory, it has the CS:GO window handle so it can know whether your currently in the game, and it has the ClientDLL base address so it knows where to read the memory from...

So I think the problem is that pointer that's hard coded in this release, doesn't work for you... In other words you have to use a different pointer, which isn't possible in this release because it's hard coded...

So try the new version posted here with a new / different pointer to read:
http://www.mpgh.net/forum/526-counte...ry-source.html

Try this pointer [[client.dll+8d5c48]+100] use 'On Ground Value:' of 257

or if you're not sure how to add that pointer to the settings window, copy and paste this into notepad and save to your desktop or wherever as 'Whatever.xml'... Then on the main window click 'Load From' button and browse to that 'WhateverYouCalledIt.xml' to load this pointer for you!

Code:

<CSGOBunnyHopperConfigFile EngineeredBy="Steve Andrew">
    <JumpButtonIndex>12</JumpButtonIndex>
    <ToggleButtonIndex>0</ToggleButtonIndex>
    <CSGOEXEName>csgo.exe</CSGOEXEName>
    <CSGOWindowTitleContains>Global Offensive</CSGOWindowTitleContains>
    <ModuleName>client.dll</ModuleName>
    <OnGroundProperValue>257</OnGroundProperValue>
    <CheckBoxes>
        <MapAandDkeysAlso>0</MapAandDkeysAlso>
        <UseToggleButton>0</UseToggleButton>
        <CheckForeground>1</CheckForeground>
        <CheckGround>1</CheckGround>
    </CheckBoxes>
    <OffsetsForPointerToRead>
        <Offset>8d5c48</Offset>
        <Offset>100</Offset>
    </OffsetsForPointerToRead>
    <ArtificialInputMethod>0</ArtificialInputMethod>
</CSGOBunnyHopperConfigFile>

If that still doesn't work, to confirm the pointer is the problem, uncheck the box in the settings window "Make sure you're on the ground before sending jump key!"

if your in-game and jump and hold the space bar it SHOULD work to send the jump keystroke, although it will be a crappy bhopper, because it doesn't actually know when your on the ground and just spams the jump key!

Make sure your not on toggle mode if your trying to use the jump button hold mode... If "Use toggle button rather than holding jump" is checked on the settings window, then this is the case... (toggle button mode works by pressing the toggle button in game to toggle on/off hopping rather than requiring you to hold down the jump button [you have to be in game before the toggle button will work, and it automatically toggles off if you aren't {default toggle button is middle mouse})

OutdatedCSS CS:GO Bunny Hopper - Steve Andrew [Binary + Source]

Similar Threads

Tags for this Thread