ch4ncellor / csgo-p2c-dumper

process dumper targeting CS:GO internal cheats

CSGO-P2C-Dumper - Dirty Implementation

Want to analyze your favorite CS:GO pay(ste) to cheat?! Look no further!

CSGO-P2C-Dumper is a process memory dumper aimed to target CS:GO internal cheats, while offering additional reversing aid.

Features:

• Signature Based Dumping

  - Dumps a section of memory based on a set of popular signatures. This isn't ideal for smaller cheats.
  

• Hook Based Dumping

  - Finding direct JMP's to the cheat module by checking the first couple bytes of commonly hooked functions.
  - Logging the displacement of the handler function (in cheat module) relative to the address started the memory dump.
  - Logging pre&post injection buffer, aswell and post injection decoded assembly.
  

• Allocation Based Dumping

  - Compares allocated memory regions, and dumps the differences.
  

Images

Credits:

• zydis (Disassembler)
• chdr (Memory Library)

csgo-p2c-dumper's Issues

cool stuff

There’s many ways to dump p2cs from the games process.

1. Hooking a CRT function if they use MSVC then you can hook or place a hardware breakpoint on GetSystemTimeAsFileTime and go to the return address which leads to the cheats entry point.

2. Hook HeapAlloc or VirtualAlloc and print the return address. (Most likely used for hooking libraries unless if they use vmt or another way to hook.)

Then after you look up these addresses in memory map on x32dbg or cheat engine then just dump the memory region.