Auto Recoil: Automatically reduces recoil for each gun individually or sets it to the best pre-designated value.
Auto Wall: Automatically shows when a person can be shot through a wall using piercing ammunition.
AVDraw: Draws a dot, like an extended crosshair, to show you where your weapon will hit.
Box ESP: Draws a box around player models. (Configure to be both teams, enemy team or friendly team.)
Barrel/FM Laser: Draws lasers which point out from players to show where they are aiming/looking. (Configure to be both teams, enemy team or friendly team.)
OCG Crosshairs: Customizable crosshairs which have much greater potential than the ones provided by the game.
Distance ESP: Draws text on each player model with customizable information.
Entity ESP: Like regular ESP it also draws information for things like dropped weapons, the bomb and hostages.
Flash Removal/Anti-Flash: Prevents flashbangs from effecting the player.
Font Style: Customizable text font for many of the games aspects.
Auto Bunnyhop: Automatically produces the Bunnyhop motion for a player to greatly increase their movement speed.
General Speed hacks:Speedhacks change the computer’s perception of time and lets the cheater act extraordinarily fast. Most of the time they are found in combination with other cheats. Speedhacks can offer high time rates to clean out maps within seconds, or very slightly increased time rates to subtly improve the performance of an aimbot. Any client with a speed hack installed will find that their in-game movement and weapon rate-of-fire are far faster than other players. Like no-recoil, a timehack (or speedhack) is most often used in combination with an aimbot. Depending on the rate of time acceleration, a timehack can be used to rush to the enemy team’s spawn point and kill all enemy players within the first seconds of a round, or it can be used with a very low time acceleration (e.g. a rate of 1.1 or 1.2) to improve total damage over time of weapons. A timehack with a low time acceleration can also be used to reduce the time required to reload weapons.
Knife Speed: Produces speed hack like speed when a knife attack launched.
Auto Speed: Automatically produces instant movement speed when a pre-designated key is pressed (usually the fire button).
Manual Speed: Produces instant movement speed while a pre-designated key is pressed and held.
Lock Target: Will lock the crosshair onto an enemy target until he is dead. Targets can be altered with a pre-designated key and the switch between targets usually takes less than 20 milliseconds.
Low Ammo Warning: Displays an on screen warning when a person is below a pre-designated %%percentage%% of ammunition.
Lambert: Removes all shadow and dark spots from game play.
Name ESP: Draws text on player model which shows the player name. (Can be configured to show other information as well, such as HP.)
No Sky: Removes the sky from game play.(reallly useful!!!)
No Spread/No recoil: Essentially the same thing, no-recoil and no-spread attempt to reduce the inaccuracy of weapons when firing. No recoil describes the automated compensation of recoil on the vertical axis, while no spread tries to compensate the horizontal spread of the weapon. As the recoil and spread of gunfire in Counter-Strike is pseudo-random, it can be reverse-engineered and predicted, allowing a cheat to compensate for inaccuracy.
The different names for no recoil and no-spread are mostly historical. No-recoil is much older and could be performed by protohacks - all that was necessary was to move the aiming reticle downwards in a distinctive way to accommodate for the vertical recoil of the weapons. No spread is by comparison, a relatively recent invention that can accurately predict the deviation and compensate for any inaccuracy, making all bullets hit exactly the same spot.
While both variants can be used independently, some older, slaving aimbots make the use of at least a no-recoil cheat a necessity, thus effectively making them part of the aimbot itself. Even with modern, punctual/charged aimbots it is very common to utilize no-spread if stealth isn't as important as performance. More stealthy, chargeable aimbots usually link the spread-suppressing factor to the charge and state of the aimbot. This prevents any stray, unaimed shots at a wall from giving away the presence of a no-spread cheat. They may also only remove the spread from the first 3-5 shots, or even only the first two bullets fired from a gun. However, they can eventually be detected by observers from subtle, rapid movements of the crosshair and are thus often disabled completely when stealth is paramount, like at LAN parties.
Overview Radar: Draws the overview map in place of the radar, as if the person were in spectator mode.
No Fog: Removes all fog from game play.
Smoke Removal/Anti-Smoke: Removes all smoke from game play (disables smoke grenades against player view).
Smooth: Smoothly lock onto a target or move crosshair towards target, causing less suspicious action.
Spin Hack: Play appears to be spinning to everyone else in the game. A multi-hack which can be configured.
Team Recognition: Part of the customizable aspect of other hacks to allow selected aiming of players.
Third Person: Changes the player view to 3rd person as if they were in spectator mode.
Time: Draws an on-screen display of the players local time.
XQZ Wallhack/Wallhack: Shows just the enemy through walls or makes walls almost invisible (adjustable opacity level).
YHAM: Is an older multihack which causes a player to change their name over and over very quickly.
Weapon ESP: Draws text on players models of what weapon they are carrying and can also dis
Spiked modules:Long 'spikes', visible through walls, announce the presence of another player on the computer of a cheater. These are the simplest to implement since a few changes, or sometimes even bugs in the graphics cards drivers, can lead to the ability of a player to see other players through walls.
Ball hack:A ball floating above all players that was visible through walls, even if the players themselves were hidden. But this so called "ballhack" gave the players less information, especially about the armament or the heading of enemies, and thus was not very popular.
Data file hacks:Replacing player skins with brighter colored ones which are easier to spot at a distance or in darker areas of the maps.
Replacing sounds of silenced weapons by their normal counterparts, making them more audible.
Currently, the Half-Life engine and the Source engine both prevent those sensitive data files from being altered in such ways. This means it is only possible to use maliciously altered data files online when combined with an executable cheat that suppresses the engine’s own integrity check.
Methods of creating hacks:Replacing client.dll and datafiles
One of the first type of cheats that appeared for Counter-Strike were the so called headshot scripts. They utilized an altered client.dll that offered additional functions to scripts, therefore a script written in extended CS script replaced the more common mouse/keyboard bindings for attacks.
Similarly, data file cheats exchanged data like sound files, but mostly models for variations that imposed some sort of drawback for the enemies of the cheater, like, louder silenced weapons or player models that were visible through walls and doors due to spikes, or in the dark due to luminous / brightly colored textures.
Neither of the two types of cheats are considered effective at this time. Regular aimbots prove to be far more powerful than headshot scripts, and client.dll, like player models / sound file changes are restricted as servers are provided checksums by clients and can choose to disconnect them if they differ from the checksum values on the server. Although theoretically a new generation of hacks could fake checksums or filesystem calls.
Hooks
Client Hooks make use of the fact that any system that employs Dynamically Linked Libraries allows the relatively easy replacement and/or redirection of function calls within those libraries. These systems include Linux, FreeBSD, Mac OSX, Windows, and just about every other modern operating system.
The reason why Counter-Strike is considered to be vulnerable to this attack is, because the mod is itself a separate entity from the Half-Life engine, and the two parties communicate to each other with easily-intercepted DLL calls. Most people consider this a special weakness of the Counter-Strike architecture that is not directly applicable to all games. However, few contemporary games are one monolithic executable, and almost all of them are utilizing DLL calls for various purposes - if not just driver calls.
The source of the loaddll library, written by the author of the original OGC was eventually released into open source, and lead to a multitude of OGC-like cheats that utilized the same facility to wedge itself between the game’s engine and the mod’s game logic.
The same thing may also have lead to the relative hook-proofness of current anti-cheats. VAC appears, and C-D even claims to be able to detect client hooks reliably, although there has been a history of hooks which managed to work without being detected by either one or both.
Amongst the first aimbots were color based aimbots, known to exist only for relatively early versions of Counter-Strike. They colored either team in its distinctive color (e.g. bright green or bright red) and would automatically fire on any pixel with this color. Since they could sometimes been foiled by using multi-colored logos, they did not have much success. A key was pressed to switch from auto-aiming at one team to the other.
Driver manipulation
Beginning with XQZ, Counter-Strike has had a long tradition of being susceptive to altered drivers. As any modern computer game, Counter-Strike makes heavy use of Win32 infrastructure - Windows API, DirectXfor input, networking and sound, and the ability to use either Direct3D or OpenGL for the graphics. Theoretically, each one of these components could be manipulated to gain an unfair advantage. Although almost all drivers could be used, in practice, almost exclusively OpenGL and DirectX infrastructure, and more rarely, mouse drivers are manipulated.
