local http = require "gamesense/http"
local pretty_json = require "gamesense/pretty_json"
local ffi = require "ffi"
local bit = require "bit"
local external = {
path = { tab1 = "LUA", tab2 = "B" },
theme = {
accent = "\aFFB0CEFF",
header = { text = "»» [external.lua]", gradient = true }
},
auth = {
api_url = "http://localhost:3000/auth",
api_key = "lLNkU7FzB2w8BSlwrG2rk3bq7PsvwaLIro9EGEYEnCJ3j444QXRcrGFj9mXhiDADJDvCgrhKbhx8uIXyIl8BGWvCTi6T7KzrP04OvFt7anDx8kp8GjdNSbBRxYghL0BQ5HrRWfKFoTIc4Gw5PZkzZnG6Ox0aqOHnxDk1reNjAjLoIhJlrrvsKMz69Pd5TVtx2hOBz6JYN9uOU8QBdGMZOKbCZGOByuEY0DNdDoAbXyPAVsGhoAVOzc8C7xieVfandNvciyjANoPTSMj6olyYCXPbRt1DIL5kaIJTrndCeqsM80BduXWlLygCsxTF0Jm1lZ7YiEWBuXHOo47SpHVJKoj9vgfEa0lNuV5yTP2lPTELXmzf6p4FLPWZt7gvp5htgd13cAbTiFibEpBuHMQhW9La7HjfgGYznscyQkc88mvPaiqeXinGGbE5pKYgHSyn9XKcD11PMfNWpJn8DDohFInQYWgI1aKWGotBKtjGYjQYDhcoC6xPBlRPZF0uSK3Bpg6KKbyu4wOO6AOJbfddtxok7UnXZlWdwYRgyUTzb5IODrDQR9L3g3j1Z0EGpoZYrOYh9q1XWSiOyAHZqQjcLLJHl09XbqWW3pj8EDtyEC3CPGe9ibpbO1EheYU7rResnufxkXnZKDtaaQdVC39KwDnx74zNv4MlfTaYjm738sGmRYNkOaXK4EpLGogfaQ9dFolUeyaITkY6b4HVZoRygOzOJlFnu68SLFFTvuqkgVzKxi4lviX1D0eEy34ozJnHjpvc9x6KV3BDfhLWhDPfU7Gs9l4tW4xPVnMHO1xRr7AZ5Mc0kkPIp8lVzjI7ekRTBI2OZWQN0pY8UrqRiihl8NVv1LimYUi26ANB0lfXXThCtIypfQZnXAhvhUtli6D6JEGUjaJkhZDZ3E4dusNA0bIu8m7KxBgbvKw9YDXVXEWDtRVtu5a1tihfk7N4itEXuiXhQ4k3JTBeKC0shEOXzUHRaPczQGkBtykRXdhu6VRUAsTjYXBGa2yrtppHH4haaLS7D5N6DEW45ipGkcqlaqIRgIpBU2TXcKv1fRn2ubCM9jziM1FDbugDu1JcwE2E2pGEgdNn7ht5m4kzU9YnFg2B2Sfc4jYvmZxgSqqiUtd2qf99NGSNjDNakvefb07Bq8oMQ2VWiYuQiGReFQBcBgkw7bAnDmkhPuzpaCNc1W0Ge9q7ZSRUwezj9PL8smE6Vtja8zes3axIui5uSvaAVSUglE5SPWLEvJASYi7XgZTLok8qpejSbDTPOoxpcER1Apv9zCA47rxo5JYWbffE3JYbrjqAOmM8BAgM4iwUGr9ulDNdNRm459zFz4Gwo32TLOVRwHFWjoho9GKZHwReEDRMTpoAKaZoMlx7TYeWg9ElGuLmUfsCBjKuTGOIJOywHBEI6EeqRart11rIYpj1SNrvH24TjNZl8TvaSm4lH2Ufamscf62k6CENq8Xk0cB1wH9uHihdSWUwPTzTYKeaVIPwwvdEUXnZFQ5jsM6RBDwiwgxdP1GIWApIJHnqlwUs1TQ5rLyj54Y10GxOzT0eB21j1nj0dGbEfdT7mAK9du3TXz03Kfkj7EGJXqSsRBLe5iAvzQ5ULkYGKXkUNpaX0wlvKIOvIvdOzmMUilOWH5SWx5A5u9mXQDhgcEujqquGZ0KJlv67alYEjYn8pUjim7dmrPmIuavKThWwDNcVF3FMzi1KRdZMPklCDrawKRknY1zWgOFiAziI399SGND8A8uI7TDEGEAQPRckkaMDKVDJop3GXf6URXQCw9meIeRVGS7MCGHwv879NlNE9zZoFiPVPhoQwf3JUHVra3imf5y6s37deNZ7BGBVg3xmcsnqglF0RqSJVKNelBvAOA336tcnwtazMcmuwqHi23isC2xbSP5W7Yj2J1o1QUahosep89hHEiXFUEztLGJmEPKe5qtoXe7crqHYChD9JhvNlHbXuUPmAeBDdUiK2VU2T0K9zcTUd4nGojrZF7lgeedsredMwA7HrLgbeXJSVih8P4hu8n9rpZX3BEkxRMuxewXn",
session_token = nil,
hwid = nil,
authenticated = false,
check_interval = 30
},
tabs = {},
security = { last_check = 0 }
}
local MaterialAdapterInfo_t = ffi.typeof[[
struct {
char m_pDriverName[512];
unsigned int m_VendorID;
unsigned int m_DeviceID;
unsigned int m_SubSysID;
unsigned int m_Revision;
int m_nDXSupportLevel;
int m_nMinDXSupportLevel;
int m_nMaxDXSupportLevel;
unsigned int m_nDriverVersionHigh;
unsigned int m_nDriverVersionLow;
}
]]
local function substitute_encrypt(input, key)
local output = {}
local key_len = #key
for i = 1, #input do
local k = key:byte((i-1) % key_len + 1)
local shifted = (input:byte(i) + k) % 256
output[i] = string.char(shifted)
end
return table.concat(output)
end
local function substitute_decrypt(input, key)
local output = {}
local key_len = #key
for i = 1, #input do
local k = key:byte((i-1) % key_len + 1)
local shifted = (input:byte(i) - k) % 256
output[i] = string.char(shifted)
end
return table.concat(output)
end
local function transpose_encrypt(input)
return input:reverse()
end
local function transpose_decrypt(input)
return input:reverse()
end
local function simple_checksum(input)
local sum = 0
for i = 1, #input do
sum = (sum + input:byte(i)) % 0x10000
end
return string.format("%04x", sum)
end
function external.get_hwid()
local get_current_adapter = vtable_bind("materialsystem.dll", "VMaterialSystem080", 25, "int(__thiscall*)(void*)")
local get_adapter_info = vtable_bind("materialsystem.dll", "VMaterialSystem080", 26, "void(__thiscall*)(void*, int, void*)")
local current_adapter = get_current_adapter()
local adapter_struct = ffi.new(MaterialAdapterInfo_t)
get_adapter_info(current_adapter, adapter_struct)
local components = {
tostring(adapter_struct.m_VendorID),
tostring(adapter_struct.m_DeviceID)
}
local hwid_raw = table.concat(components, "|")
return simple_checksum(hwid_raw) .. transpose_encrypt(hwid_raw)
end
function external.secure_request(url, data, callback)
local json_data = json.stringify(data)
print("[DEBUG] Original JSON:", json_data)
local encrypted = substitute_encrypt(json_data, external.auth.api_key)
encrypted = transpose_encrypt(encrypted)
print("[DEBUG] Encrypted data:", encrypted)
http.post(url, {
headers = {
["X-Secured"] = "v4",
["X-Integrity"] = simple_checksum(json_data),
["Content-Type"] = "application/octet-stream"
},
body = encrypted,
require_ssl = false
}, function(success, response)
if success and response.status == 200 then
local decrypted = transpose_decrypt(response.body)
decrypted = substitute_decrypt(decrypted, external.auth.api_key)
print("[DEBUG] Decrypted response:", decrypted)
local server_checksum = response.headers["X-Integrity"]
local local_checksum = simple_checksum(decrypted)
if server_checksum ~= local_checksum then
return callback(false, "Data tampered")
end
local ok, parsed = pcall(json.parse, decrypted)
if ok then
callback(true, parsed)
else
callback(false, "Invalid JSON")
end
else
callback(false, "Connection failed")
end
end)
end
function external.authenticate()
external.auth.hwid = external.get_hwid()
external.secure_request(external.auth.api_url, {
timestamp = client.unix_time(),
hwid = external.auth.hwid
}, function(success, data)
if not success or not data then
return external.show_auth_error("Initial auth failed")
end
local hwid_hash = simple_checksum(table.concat(data.allowed_hwids, "|"))
if hwid_hash ~= data.hwid_hash then
return external.show_auth_error("HWID list tampered")
end
local valid_hwid = false
for _, allowed in ipairs(data.allowed_hwids) do
if external.auth.hwid == allowed then
valid_hwid = true
break
end
end
if not valid_hwid then
return external.show_auth_error("HWID not authorized")
end
local response_hash = transpose_encrypt(data.challenge .. external.auth.hwid)
external.secure_request(external.auth.api_url, {
action = "challenge_response",
response = response_hash
}, function(success, data)
if not success or not data or not data.token then
return external.show_auth_error("Final verification failed")
end
external.auth.session_token = data.token
external.auth.authenticated = true
external.create_ui()
end)
end)
end
external.Element = {
new = function(self, element, config)
return setmetatable({ element = element, config = config or {} }, { __index = self })
end,
set_visible = function(self, state) ui.set_visible(self.element, state) end
}
external.Tab = {
new = function(self, name)
return setmetatable({ name = name, parent = nil, elements = {}, children = {} }, { __index = self })
end,
add_element = function(self, element, is_child)
local elem = external.Element:new(element)
table.insert(is_child and self.children or self.elements, elem)
return elem
end,
set_parent = function(self, parent) self.parent = parent end,
update_visibility = function(self, is_tab_active)
local parent_state = self.parent and ui.get(self.parent.element) or true
local should_show = is_tab_active and parent_state
for _, elem in ipairs(self.elements) do elem:set_visible(should_show) end
if self.parent then
self.parent:set_visible(is_tab_active)
for _, child in ipairs(self.children) do
child:set_visible(should_show and ui.get(self.parent.element))
end
end
end
}
function external.create_ui()
external.header = external.Element:new(
ui.new_label(external.path.tab1, external.path.tab2, external.theme.header.text)
)
external.tab_selector = external.Element:new(
ui.new_combobox(external.path.tab1, external.path.tab2, " Active Category",
{"rage", "aa", "visuals", "misc", "cfg"})
)
local tab_config = {
rage = {
parent = {type = "checkbox", label = "▪ Enable Ragebot"},
elements = {
{type = "slider", label = " ↳ Minimum Damage", min = 0, max = 100, default = 25},
{type = "checkbox", label = " ↳ Override when lethal"}
}
},
aa = {
parent = {type = "checkbox", label = "▪ Enable Anti-Aim"},
elements = {
{type = "combobox", label = " ↳ AA Presets", items = {"Default", "Safe", "Aggressive"}},
{type = "hotkey", label = " ↳ Inverter Key", default = 0}
}
},
visuals = {
parent = {type = "checkbox", label = "▪ Enable Visuals"},
elements = {
{type = "checkbox", label = " ↳ Player ESP"},
{type = "color_picker", label = " ↳ ESP Color", r = 255, g = 255, b = 255, a = 255},
{type = "checkbox", label = " ↳ Weapon ESP"}
}
},
misc = {
parent = {type = "checkbox", label = "▪ Enable Misc"},
elements = {
{type = "checkbox", label = " ↳ Bhop"},
{type = "checkbox", label = " ↳ Auto Strafe"},
{type = "slider", label = " ↳ FOV Changer", min = 70, max = 120, default = 90}
}
},
cfg = {
parent = {type = "checkbox", label = "▪ Enable Configs"},
elements = {
{type = "combobox", label = " ↳ Presets", items = {"Default", "Legit", "Rage"}},
{type = "button", label = " ↳ Load Config", callback = function() end},
{type = "button", label = " ↳ Save Config", callback = function() end}
}
}
}
for tab_name, config in pairs(tab_config) do
local tab = external.Tab:new(tab_name)
local parent = tab:add_element(ui.new_checkbox(
external.path.tab1, external.path.tab2,
external.theme.accent .. config.parent.label
))
tab:set_parent(parent)
for _, elem_config in ipairs(config.elements) do
local elem
if elem_config.type == "slider" then
elem = ui.new_slider(
external.path.tab1, external.path.tab2,
elem_config.label,
elem_config.min,
elem_config.max,
elem_config.default
)
elseif elem_config.type == "combobox" then
elem = ui.new_combobox(
external.path.tab1, external.path.tab2,
elem_config.label,
elem_config.items
)
elseif elem_config.type == "hotkey" then
elem = ui.new_hotkey(
external.path.tab1, external.path.tab2,
elem_config.label,
elem_config.default
)
elseif elem_config.type == "checkbox" then
elem = ui.new_checkbox(
external.path.tab1, external.path.tab2,
elem_config.label
)
elseif elem_config.type == "button" then
element = ui.new_button(
external.path.tab1, external.path.tab2,
elem_config.label,
elem_config.callback
)
elseif elem_config.type == "color_picker" then
elem = ui.new_color_picker(
external.path.tab1, external.path.tab2,
elem_config.label,
elem_config.r,
elem_config.g,
elem_config.b,
elem_config.a
)
end
if elem then
tab:add_element(elem, true)
end
end
external.tabs[tab_name] = tab
end
end
function external.self_destruct()
external.auth.authenticated = false
client.delay_call(2, function() error("SECURITY VIOLATION DETECTED") end)
end
function external.show_auth_error(message)
client.color_log(255, 0, 0, "[SECURITY] " .. message)
external.self_destruct()
end
client.set_event_callback("paint", function()
if external.auth.authenticated then
if globals.curtime() - external.security.last_check > external.auth.check_interval then
external.security.last_check = globals.curtime()
external.secure_request(external.auth.api_url, {
action = "session_check",
token = external.auth.session_token
}, function(success, data)
if not success or not data.valid then
external.self_destruct()
end
end)
end
local wave = math.abs(math.sin(globals.realtime() * 2)) * 255
local r, g = math.floor(wave), math.floor(206 - wave/3)
ui.set(external.header.element, string.format("\aFF%02X%02XFF", r, g) .. external.theme.header.text)
if external.theme.header.gradient then
local x, y = ui.menu_position()
local w, h = ui.menu_size()
renderer.gradient(x, y, w, 3, r, g, 255, 255, 100, 150, 200, 255, true)
end
end
end)
client.set_event_callback("paint_ui", function()
if external.auth.authenticated then
local selected_tab = ui.get(external.tab_selector.element):lower()
for tab_name, tab in pairs(external.tabs) do
tab:update_visibility(tab_name == selected_tab)
end
end
end)
external.auth.hwid = external.get_hwid()
external.authenticate()