Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Permanent Feature] Wallhack Exploit: By corrupting the checksum of a vtx for a model, you can unload props on maps with packed props (de_cache, de_nuke, de_dust2, etc.). #1888

Closed
kkthxbye-code opened this issue Nov 18, 2018 · 150 comments

Comments

@kkthxbye-code
Copy link

kkthxbye-code commented Nov 18, 2018

Status: WONTFIX

Cheat maps - host them on a dedicated server, join the server, leave and join a real server. VAC safe, faceit detected, ESEA unknown.

Dust2: https://www.mediafire.com/file/ktwz2cj7ty1endy/de_d2shiz.bsp/file

New Cache: https://www.mediafire.com/file/c5kmbg47filv0vs/de_shiz_d.bsp/file

Old Cache (the sparkles version still works on old cache): https://www.mediafire.com/file/pwb95sugsonq6da/model_breaker.zip

Replication steps to do it yourself: https://github.com/kkthxbye-code/csgo_bugs/tree/master/model_bug

@wazerstar
Copy link

@davidw-valve @vitaliyvalve @kisak-valve

This getting some love?

@kkthxbye-code
Copy link
Author

kkthxbye-code commented Dec 8, 2018

I can confirm that the issue is still there after the battle royale updates:

20181208220756_1

@then4p
Copy link

then4p commented Dec 9, 2018

Just want to add that this has happened to me by accident. I played on a retakes server with a custom version of cache and had the "wallhack" on mid in a competitive match after. Could only fix it by restarting the game.

@kkthxbye-code
Copy link
Author

Still not fixed as of today's (12/11/2018) update.

@h3oCharles
Copy link

Sparkles was here https://www.youtube.com/watch?v=nlhvpefMr58

@MangoEvo

This comment has been minimized.

@midlow

This comment has been minimized.

@wazerstar

This comment has been minimized.

@EarsKilla

This comment has been minimized.

@midlow

This comment has been minimized.

@kkthxbye-code
Copy link
Author

To the last 6 comments. This is not a discussion forum. If you have information relevant to the reported issue, feel free to post it, otherwise discuss on hltv/reddit/whatever.

@kisak-valve Could you clean this up?

@Cyanidesnubben
Copy link

It seems to have been fixed during the weekends. (17/12-2018) It doesn't work for me at least.

@yansouf
Copy link

yansouf commented Dec 17, 2018

for me it just fucks up the textures making them a bit gray scaled on cache.
I'm on an intel graphic card, if that's relevant.

@Darnias
Copy link

Darnias commented Dec 17, 2018

It seems to have been fixed during the weekends. (17/12-2018) It doesn't work for me at least.

Still works for me (December 17th 2018 17:00GMT+1) https://i.imgur.com/GD61Bts.jpg

@Cyanidesnubben
Copy link

Did you guys join a offline session or an actual death match?

@Kirdow
Copy link

Kirdow commented Dec 17, 2018

Did you guys join a offline session or an actual death match?

It says in the Steps for reproducing this issue, I marked it with bold text so you can see it easier:

  • Host the map (doesn't work on a listen server).

and

  • Join a de_cache server (still doesn't work on listen server).

@TheoneRobstar
Copy link

Hey can you make the wood wall in b apps on mirage invisable?

@kkthxbye-code
Copy link
Author

@TheoneRobstar - Mirage doesn't have any packed props as far as I can recall. And you shouldn't cheat anyway, try a cheat forum.

Please don't write off-topic stuff though. There really is nothing to do or discuss in this issue anymore. Valve was notified on several occasions during the last two months, using several different channels, channels where they usually respond. So there are a couple of possibilities:

  • They legit didn't spot a single one of the attempts to contact them (very unlikely).
  • They have been prioritising getting Danger Zone out, and didn't care about the issue. Also seems kinda unlikely.
  • They don't know how to fix it for some reason, again unlikely, but wouldn't surprise me. They actually never fixed the custom server moly exploit, so this might actually be the most likely scenario.

In all cases, the dead silence when trying to contact them has been very weird, and I'm not sure what could be the explanation.

@1VarTen1
Copy link

1VarTen1 commented Dec 18, 2018

Why does it require a password? What is the password?

@rawsh
Copy link

rawsh commented Dec 18, 2018

How has valve not fixed this yet? I'm 100% sure some people in comp dust 2 were using this in lower tuns. Perfect peeks around the box. This exploit is at a ridiculous level of accessibility and it's impossible to detect. I think the priority of this is fairly high.

@kkthxbye-code
Copy link
Author

@rawsh - As I said, I don't have a good explanation. They most definitely know about the glitch, as they usually respond to the two valve mail addresses I tried. Also, I got the guy who ported de_cache to cs:go to write his valve contact, however he only knew a mapper at valve, not a developer (that was over a month ago too).

So it's all very weird, and I'm not sure what could be the reason other than they don't really know how to fix it without breaking something.

@jasoryeh
Copy link

jasoryeh commented Dec 19, 2018

Still works after latest Christmas update :/

Tested on one game on a community server, and there's no change. What's weird is that the first time I checked on practice it didn't work, but it does on community servers.

My guess is that they are still working on a fix? Either that or this bug is really hard to fix.

EDIT:
Nope. It looks like most of the glitches are gone from the map being updated. Looks like on cache almost everything but the door is fixed.

Maybe they are fixing it by updating the maps?

@rawsh
Copy link

rawsh commented Dec 19, 2018

@jasoryeh From what I've tested dust 2 is still broken, but mirage and cache are mostly fixed?

@kkthxbye-code
Copy link
Author

@jasoryeh @rawsh

No idea what you two are talking about. They didn't fix anything, and the maps in question have not received updates.

It still works as of right now:

20181219110150_1

@t8er8
Copy link

t8er8 commented Dec 19, 2018

Couldn't get anything to bug out anymore as of now

@windhamwong
Copy link

Technically this doesn't work for Quick Match/Competitive/Community servers as listen server calculates and checks the model checksum when you join the server. This invalidates your model caches and forces your client to reload the model from file. Even you have compiled/modified map in your folder, it also runs a checksum with your model, which might trigger VAC checking too (VAC2/3). I don't have technical specs or details to show in here

@hey132
Copy link

hey132 commented Dec 20, 2018

Hey, is it just me or does only the blue door on cache work? No other spots on the map seems to be working for me.

@kkthxbye-code
Copy link
Author

Sigh, I tested again because of you guys. As of 20-12-2018 it still works exactly as it always has. If you have no idea what you are doing, please. stop. posting...

@t8er8 - Then you are doing it wrong. Please stop posting.

@windhamwong - I have no idea what you are talking about. It works fine in all those game modes. As said in the issue, the only place it doesn't work is on listen servers. Quick Match, competitive and community servers are not your own listen server. Please stop posting.

@hey132 - Then you are doing it wrong. Please stop posting.

@NobodyyA
Copy link

Is there any chance I'll get vac banned for this?

@ml-
Copy link

ml- commented Dec 20, 2018

Is there any chance I'll get vac banned for this?

No. As long as you don't use any third party application to abuse this exploit you won't get VAC banned.
Once this issue is fixed you won't be able to join any server until you verify file integrity.

And honestly, you shouldn't abuse this anyway.

@kkthxbye-code
Copy link
Author

kkthxbye-code commented Apr 19, 2020

@BehindUu

No problem, it was mostly in jest. It has been a while since I last tested, so it was due anyways :)

@ValveSoftware ValveSoftware deleted a comment from babadookp Apr 21, 2020
@babadookp
Copy link

@ValveSoftware maybe make SDK available for free users and then you wouldn't have to delete my comment

@theFreeWall
Copy link

fixed?
https://blog.counter-strike.net/index.php/category/updates/
– sv_pure servers will now kick clients that have loaded asset files into game memory from files not present on game server filesystem.

@kkthxbye-code
Copy link
Author

@theFreeWall

Probably not, as it isn't really an sv_pure issue, but an issue with props not being evicted from the cache properly on map change. The update was probably supposed to fix my sv_pure bypasses:

https://github.com/kkthxbye-code/csgo_bugs/tree/master/sv_pure_bypass

https://github.com/kkthxbye-code/csgo_bugs/tree/master/sv_pure_bypass_2-electric_boogaloo

@bonna97
Copy link

bonna97 commented May 12, 2020

So, has this possibly been fixed (in some form) as of the latest update considering you'll have to restart your game now to be able to join official servers after playing on a community server?

@kkthxbye-code
Copy link
Author

kkthxbye-code commented May 13, 2020

@bonna97 - Ahh, the bi-monthly "has this been fixed" shitpost.

So, has this possibly been fixed

Nope

(in some form)

Nope nope

as of the latest update

Nope nope nope

considering you'll have to restart your game now to be able to join official servers after playing on a community server?

That is not even true.

Tested it, the exploit has not been fixed, still not rendering props. I can queue fine for competitive with it. It might kick you when you join a game but 99% sure it wont, someone else will have to test that, as I don't use the exploit and I'm not about to ruin a mm game for other players.

The sv_pure changes were a response to these exploits:

https://github.com/kkthxbye-code/csgo_bugs/tree/master/sv_pure_bypass

https://github.com/kkthxbye-code/csgo_bugs/tree/master/sv_pure_bypass_2-electric_boogaloo

@HackerPide
Copy link

I can queue fine for competitive with it.

@kkthxbye-code how did you queue? I get this when testing:
sv_pure

@kkthxbye-code
Copy link
Author

@HackerPide

  • Join my own server with my own cache model breaker map
  • Leave game
  • Queue for solo matchmaking until the queue popped

I assume you get that message before the queue pops, so maybe your server uses third party models or materials. I really don't think maps can flag you as dirty, but I can very well be wrong.

@HackerPide
Copy link

HackerPide commented May 17, 2020

@kkthxbye-code

#1888 (comment)

New Cache: mediafire.com/file/c5kmbg47filv0vs/de_shiz_d.bsp/file

I'm hosting this map on my vanilla dedicated server and connecting to it from my client. I have the map downloaded on my client and manually placed in the csgo/maps folder. The server only has the model breaker map(de_shiz_d.bsp), everything else is default.

@kkthxbye-code
Copy link
Author

@hackerpride - Just tested again. Unless you get the Third Party Files Loaded message after accepting the queue, I just don't get the same result as you. It was my understanding that the message pops up when you queue, and not after you press the accept button.

@HackerPide
Copy link

@kkthxbye-code I get the message as soon as I leave the server hosting the model breaker map. I also get it if I try to queue for an official server.

@kkthxbye-code
Copy link
Author

@hackerpride - No idea then, works perfectly here with the same map. You can try to delete materials and models in the csgo folder and verify integrity of game files. Then join your server with cl_allowdownload 0 or whatever the command is. My best guess is that you have third party files that for some reason gets loaded on community servers.

You might also be able to set:

sv_pure_allow_loose_file_loads 0
sv_pure_allow_missing_files 0
sv_pure 1

On your server after you have loaded the model breaker. Then switch map, and join again. It should(?) kick you then and tell you which file.

@HackerPide
Copy link

HackerPide commented May 17, 2020

@kkthxbye-code Removing and redownloading my client materials and models folders made this work again. There was definitely something in those folders which were loaded, I really don't know why though.

@GreenSwede
Copy link

This issue is not exclusive to CSGO and will in fact also work just fine on Team Fortress 2. I think all Source engine titles are affected by this.
20200620001043_1

@AnAkkk
Copy link

AnAkkk commented Jul 12, 2020

This can be fixed by calling CStaticPropMgr::LevelShutdown before calling LevelInit while loading the map. This is what it actually does while creating a listen server, which is why the exploit doesn't work there.

@kkthxbye-code
Copy link
Author

@AnAkkk - Nice find. Probably still not going to be fixed now, as that would be an admittance that they actually didn't know how to before.

@bonna97
Copy link

bonna97 commented Jul 12, 2020

@kkthxbye-code Never say never, showcasing that it actually fixes the exploit would more than likely be enough to convince them to add the fix.

@kkthxbye-code
Copy link
Author

kkthxbye-code commented Jul 15, 2020

@kkthxbye-code Never say never, showcasing that it actually fixes the exploit would more than likely be enough to convince them to add the fix.

I have written the CSGO devs on twitter, 5 times on their feedback mail, made the issue here, sparkles have had two videos, one with 1 million+ views. I have had fmpone reach out to his contacts about it. I have had donhaci reach out in DM to the csgo twitter (he got a response). They are very aware of the issue. It's been almost two years, I'm not really in a position to believe that they will ever fix it.

image

@bonna97
Copy link

bonna97 commented Jul 15, 2020

But did you message them after testing that @AnAkkk's solution fixes it? @kkthxbye-code

@kkthxbye-code
Copy link
Author

kkthxbye-code commented Jul 15, 2020

But did you message them after testing that @AnAkkk's solution fixes it? @kkthxbye-code

How would I test it? Do you want me to compile leaked source code to help fix a bug for a billion dollar company's game to help them fix a mistake in their "triple-a" game engine? You give them too much credit. However you solve it, it was never a hard fix. The engine spews errors, so there is no doubt about where the issue lies.

@wazerstar
Copy link

Hopefully thank god fixed now, if I read the latest change log correct.

@yash1441
Copy link

Fixed bsp-embedded models caching rules to allow for reloading the correct model when transitioning to a different map.

Source: https://blog.counter-strike.net/index.php/2020/07/30991/

@GreenSwede
Copy link

Now I hope that Valve knows that every other Source game is still affected.

@yash1441
Copy link

I accidentally got this bug after the update but I am not able to replicate how. As far as I can recall, I was in a community server with the dust2 model map while being in a lobby for competitive. I changed the community server's map to mirage and after playing some time there found a match in the lobby and joined the competitive dust2 game. That's all that I can recall and I'm somewhat sure that this is all what I did and got this bug after the update that supposedly patched this.

@AnAkkk
Copy link

AnAkkk commented Jul 26, 2020

There does seem to be another way to trigger this bug after the update, someone has shown me a screenshot which looks similar to the original bug (missing props). Unfortunately, he isn't saying how, and haven't found a way to replicate it.

@bonna97
Copy link

bonna97 commented Sep 7, 2020

@kkthxbye-code Not to bother you or anything, but did Valve seriously break their fix? Seems like people are starting to report that certain props like Cache's door, etc. are becoming invisible when using playmaster[dot]gg for instance.

@ValveSoftware ValveSoftware deleted a comment from anmogg Sep 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests