CS2FOW

Server-side anti-wallhack for Counter-Strike 2 community servers

CS2FOW stops your server from sending an enemy's live position when walls or smoke completely hide them. A wallhack cannot draw a player your server never sent.

• It stays on your server: CS2FOW never runs on your players' computers.
• Players install nothing: they join and play normally. There is no client injection or extra download.
• When in doubt, show the player: if data is missing, too old, or unsafe, CS2FOW steps aside instead of hiding someone by mistake. This is called failing open.

Every map gets a lightweight 3D copy of its solid walls. CS2FOW uses that copy to check who can actually see whom.

Cache — A site	Dust II — B site
Dust II — Long	Mirage — A site

1. Install Metamod:Source on your CS2 server.
2. Install the Windows or Linux CS2FOW package into your server's game/csgo folder without rearranging its contents.
3. Start your server and load a map.
4. Type cs2fow_status in the server console.

The first time you load a map, cs2fow_status may say that an automatic bake is running. You can keep playing, and everyone stays visible until the bake finishes and passes its checks. The optional official-maps ZIP comes with ready-made data, so its included maps skip this first wait.

Your server needs an x86-64 CPU with AVX visible to the operating system. CS2FOW also checks that its private engine offsets, called gamedata, match the loaded CS2 server file by size and CRC32. If Valve ships an unknown update, CS2FOW stays off until matching gamedata is installed. That is much safer than guessing inside server memory.

CS2FOW keeps its hands off as much of the game as possible. It hides only this small visual group:

• the player pawn;
• active, last, and carried weapons, including carried C4;
• wearables;
• a currently carried hostage prop.

Everything that matters on its own stays on its own. A planted C4, dropped objective, dropped weapon, flying grenade, inferno, sound, or unknown entity does not disappear just because the player who once owned it is hidden. Your server still controls movement, collision, hit registration, damage, penetration, and game rules exactly as before.

CS2FOW does not filter HLTV, spectators, dead players, or your own player. Teammates stay visible by default. FFA is detected automatically through mp_teammates_are_enemies; when it is 1, every other living player is treated as an enemy. You can also set cs2fow_filter_teammates 1 to apply the same check to teammates in normal team modes, which can remove their client-side markers and radar information while hidden.

Live smoke can block those imaginary sight lines too. By default, an HE opens a 100-unit viewing channel through affected smoke for 2.5 seconds, but only if the smoke was already there when the HE exploded. A wall still wins, and another overlapping smoke can still block the view.

1. Load the map: CS2FOW finds the mounted VPK and the physics data inside it.
2. Bake the walls: the baker turns thousands of collision triangles into a compact, quick-to-search map called a BVH8.
3. Take a picture: on the game thread, CS2FOW asks CS2 for each player's current bones and safely copies Valve's nineteen animated hitbox capsules with the player's position, size, movement buttons, view direction, ping, and held weapon. This recent picture is the snapshot. If a complete trustworthy capsule pose is unavailable, that player is shown normally.
4. Test the whole body: a background worker looks from up to six viewing positions and compares the projected three-dimensional capsule silhouette with the baked walls. The held-weapon muzzle remains one separate visibility point.
5. Choose visible or hidden: if any sampled part of any capsule or the muzzle gets past both the baked walls and live smoke, the whole player stays visible. Sub-pixel or time-budget uncertainty also shows the player rather than risking an incorrect hide.
6. Control the outgoing update: CheckTransmit, the server's outgoing entity list, first marks the verified dont_transmit bit and then removes the matching primary send bit for each hidden visual entity.

The worker gets a copy of the numbers, never live CS2 objects. In other words, it reads a photograph instead of reaching back into the moving game.

The baker strips a map's static collision down to the walls CS2FOW needs for sight checks. Before using the result, the plugin checks the BVH8 structure, the source file's fingerprint (CRC and size), and the report details. Your server can bake mounted maps automatically. You can also prepare public Workshop maps through the CS2FOW Map Baker.

The plugin runs cfg/cs2fow.cfg when it loads and again whenever a map starts. Out of the box, wall and smoke filtering are on, teammate filtering is off, and Valve's sv_enable_donttransmit 0 compatibility mode is used. CS2FOW's paired send-list handling also supports mode 1.

Think of cs2fow_status as the dashboard. It tells you whether CS2FOW is active, why it stepped aside, which map bake is loaded, how long its work takes, how fresh the latest snapshot is, how many player pairs it checked, what smoke and HE handling are doing, whether teammates are filtered, and how an automatic bake is going. Worker wall is the real elapsed latency; active adds the pair-processing time across every worker, so it can be higher when several threads run together and is not a direct game-thread stall. The separate bones line measures the game-thread time spent asking CS2 for animated hitbox capsules; that time is already included in capture, so do not add the two numbers together.

If you need to see exactly which entity bits CS2FOW removed:

cs2fow_debug 1              start silent evidence collection
cs2fow_entity               list buffered records, newest first
cs2fow_entity <edict>       show records for one entity index
cs2fow_entity clear         clear the evidence buffer

The debug buffer records only primary bits CS2FOW truly removed. Turning debug off stops collecting new evidence, but keeps what is already there until a reset or you clear it.

• Baked walls and live smoke can block sight. Doors, breakable objects, moving props, particles, projectiles, and other moving things cannot.
• CS2FOW uses current W/A/S/D intent rather than guessing future player positions. A fast target peeking a stationary player may still appear late.
• More ping compensation reduces corner pop-in by moving shoulder and movement-intention checks farther around corners. Smoother peeks cost a little more information.
• The feet point can see through low gaps that the player's eyes cannot. It is intentionally included to reduce late reveals around low geometry.
• Sounds, bomb information, teammate information, last-known positions, and other clues that are not part of the player entity remain available.
• If CS2FOW does not recognize the CS2 server file, it disables itself instead of guessing private memory locations.
• Full-update snapshots are hands-off. CheckTransmit also leaves both send lists alone if either required pointer is missing.
• Builds and unit tests cannot imitate a real CS2 send list or promise that an engine entity-copy crash is impossible. That still needs testing on a live server.

chmod +x game/csgo/tools/cs2fow_baker
chmod +x game/csgo/tools/vrf/linux64/Source2Viewer-CLI

• Code tour: follow the architecture, threads, safety rules, and build and release steps in plain language.
• Visibility Studio: compare legacy LOS points with Valve capsules and simulate CS2FOW's maps, movement, smoke, HE, and visibility decisions locally.
• CS2FOW Map Baker: prepare visibility data from a public Workshop map.
• Bake Service source: inspect the public baking service itself.

Manual baker examples:

cs2fow_baker --game <cs2-root> --map de_dust2 --output de_dust2.bvh8
cs2fow_baker --list-maps --vpk <outer_dir.vpk>
cs2fow_baker --inspect-bvh8 <file>
cs2fow_baker --game <cs2-root> --map workshop/123/de_example --vpk <outer_dir.vpk> --output de_example.bvh8

Generated map files come from Counter-Strike 2 game data, so DATA_NOTICE covers them instead of the project's MIT code license. Core packages include the exact cgltf, ValveResourceFormat 19.2, native-library, and self-contained .NET notices under licenses/. The full legal details are in LICENSE, THIRD_PARTY_NOTICES, and DATA_NOTICE.