v2.1.8 — feature recipes rebuilt: internal + external, verified

The Features tab on cs2-sdk.com is rebuilt: each feature is a recipe checked against a working implementation and against build 14184, with an Internal and an External version.

Recipes

Feature	Internal	External
Entity list	hook CGameEntitySystem::OnAddEntity / OnRemoveEntity (vtable slots 15/16)	walk the chunked identity list, with the handle check for reused slots
ESP	gather on FrameStageNotify, bones by name, draw from IDXGISwapChain::Present	same data through ReadProcessMemory; bone names read from the model itself
FOV changer	hook OverrideView, write CViewSetup::m_flFov	write the controller's m_iDesiredFOV
Aimbot	aim in CCSGOInput::CreateMove, recoil from C_CSPlayerPawn_GetAimPunch, steer with SetViewAngles	write dwViewAngles or move the mouse (sensitivity formula included)
Skin changer	client-side item identity, fallback paint + paint attributes, composite rebuild	not possible — needs game code to repaint
Knife changer	subclass token, model change, animation-graph rebind, paint	not possible — needs game code to load the model

Each recipe has numbered steps and the exact offsets, globals and functions — with this build's RVA and pattern — resolved from the dump, so they always match the current build. Copy as C++ turns a recipe into a header.

Corrections

• Entity tracking: the old recipe's "listener vector at CEntitySystem+0x30" was wrong (it is at +0x2150); the recipe now hooks the entity system's own add/remove virtuals.
• Bones: the head is bone 7 (head_0), not 6 (neck_0) — read from the live player model's bone names.
• FOV: follows the game's own resolver — camera m_iFOV, else controller m_iDesiredFOV, else 90 — instead of hooking the wrong function.
• Skin and knife changers: the flow that works on 14184, every game function mapped to a published signature.

Verified read-only against the live game: the external entity walk resolves every player, the head bone sits at head height, view angles and sensitivity read correctly.

Dumper

• verified_features.json is rendered after the signature pass and carries function RVAs and patterns; hand-verified values carry the build they were checked on.
• New verified_manual check; verified_fields now also covers globals. All 11 checks pass.

Database: 578 entries, 577 resolve, 0 ambiguous. Globals, buttons, interfaces and schema offsets identical to a2x's 14184 dump.

cs2-sdk.exe below. Run it as administrator with CS2 open.

v2.1.7 — exact feature offsets, verified hooks, new icon

Exactness and polish for CS2 build 14184. Every self-check passes on the published dump.

Fixed

• verified_features.json offsets were stale. 38 of the 67 field offsets had been typed in on an older build (m_iTeamNum 0x3EB, m_iClip1 0x16D8, m_iShotsFired 0x1C5C, …), and ten named the wrong class or path: m_iKills / m_iDeaths live inside m_matchStats (now 0xD8 / 0xDC), the fallback paint-kit fields are on C_EconEntity, m_iFOV is on CCSPlayerBase_CameraServices, the item definition index is under m_AttributeManager.m_Item (0x149A). Offsets are now resolved from the schema dumped in the same run, so they cannot go stale; only the two non-schema fields keep hand-verified values. The Features tab on cs2-sdk.com shows which is which.
• Knife changer hook: its UpdateSubclass pattern pointed 11 bytes into the function. New function-start signature C_BaseEntity_UpdateSubclass (IDA-verified: it looks up m_nSubclassID and writes the subclass-data pointer at +0x388).
• FOV changer hook named a signature that does not exist; it now names GetWorldFovResolver.
• CCSGOInput::m_FrameInput (+0x228) removed: nothing on 14184 confirms it. Every other engine-struct field and the three hand-typed interface slots were re-checked in IDA against the code that uses them.

New checks

verified_fields and verified_hooks fail the run if a feature field stops resolving from the schema or a feature hook names a signature that did not resolve. With the existing checks that is 11 per dump, all visible on the site's Status tab.

Looks

New gold C icon for cs2-sdk.exe (and the site favicon), proper version details on the exe (Properties → Details), and a restyled terminal: logo banner, cleaner section headers, gold progress bar, one-line result at the end.

Database: 578 entries, 577 resolve (GameSystem_Think_CheckSteamBan remains), 0 ambiguous. Globals, buttons, interfaces and 9,251 schema field offsets identical to a2x's 14184 dump; generated headers compile under MSVC C++17/C++20.

cs2-sdk.exe below. Run it as administrator with CS2 open; dump in a match for the full weapons list.

v2.1.6 — self-checks (status.json + Status page), self-healing signatures

Dumper-quality release for CS2 build 14184. The dump is unchanged; the dumper now checks itself and repairs stale signatures.

Self-checks after every dump

The dumper runs a set of checks against the live process and writes include/status.json. A failed check makes it exit 1, so a broken dump cannot be published by accident. Four of the five defects fixed in v2.1.5 would have been caught by these:

• global_twins — every a2x-style dwXxx global must resolve to the same address as its signature twin (dwGameRules ↔ pGameRules, dwSensitivity ↔ pSensitivity, dwSoundSystem ↔ pSoundSystem, … 11 pairs).
• globals_in_data / globals_not_code — globals must land in a data section, never on code or a vtable.
• function_prologues — function targets must sit right after padding (deliberate patch sites are exempt).
• protobufs_vs_engine — the protobuf layouts read from the reflection tables must equal the hand-verified engine structs (CBaseUserCmdPB, CSubtickMoveStep, …).
• signatures_resolve, patterns_unique, patterns_healed, weapons_snapshot — coverage, uniqueness, re-anchoring, weapon-table coverage. The game's ClientVersion / PatchVersion from steam.inf are recorded too.

On the site: a new Status tab shows every check with its details, unresolved signatures by name, auto-healed entries and known issues; a banner appears on every page when a check failed. GET /api/status serves the same, and the Discord bot has /status.

Self-healing signatures

When a database pattern stops matching after a CS2 update but the function itself did not change, the dumper now re-anchors it on its own: the entry's 24 prologue bytes from the previous dump (--previous <dir>, default include) are searched in the new module; exactly one hit after padding means the function only moved, so a fresh pattern that is unique in .text is generated there and published in place of the stale one (flagged with healed_from). Verified by breaking CreateMove and FrameStageNotify on purpose: both came back at their correct addresses with new unique patterns.

py tools/verify/heal.py --apply copies healed patterns into src/patterns/database.rs. Globals and functions whose prologue really changed stay on the unresolved list until they are fixed by hand.

Tools

tools/verify/ carries the offline rescan (dbscan.py, runs against the DLLs on disk without the game), the deterministic pattern generator (genpat.py) and heal.py. All documented in the wiki page Status and Self-Healing.

cs2-sdk.exe below. Run it as administrator with CS2 open; dump in a match for the full weapons list.

v2.1.5 — CS2 build 14184: full verification pass (offsets, protobufs, headers, signature audit)

Full verification pass for CS2 build 14184 (client 2000917, patched 2026-09-24 22:53). Every module was re-analysed from scratch in IDA and the whole dump was checked against the binaries and against a2x's dump of the same build, not just re-scanned. Live at https://cs2-sdk.com.

Wrong, now fixed

• dwGameRules pointed at a vtable pointer in .rdata, not at g_pGameRules. Same read-site anchor as a2x now; it resolves to the global the pGameRules signature already found (651 references).
• dwSensitivity was the cl_leveloverview ConVar, not sensitivity — both go through the same ConVarRef helper, the registration sites name them. Re-anchored on the sensitivity * zoom_sensitivity_ratio site, with dwSensitivity_sensitivity = 0x58 (the value offset inside ConVarInfo_t). pSensitivity resolves to the same slot.
• dwSoundSystem_engineViewData was 0x7C, read from a stack store in an unrelated function. The view block is at 0x6C. dwSoundSystem and dwNetworkGameClient_isBackgroundMap had silently stopped resolving; both are back. The classic globals are now the same 32 a2x publishes, and every value matches a2x's for this build.
• CBaseUserCmdPB in protobufs.json / protobufs.hpp was wrong. The reader sorted fields by number while libprotobuf's offset table is in declaration order, which shifted viewangles, forwardmove, leftmove, … by one slot. Fixed at the source; the layout now agrees with CBaseUserCmdPB::_InternalParse and with the hand-verified engine struct.
• The generated headers did not compile under MSVC (CUtlStringTokenNoRegistration was never declared; std::unique_ptr without <memory>). Fixed; cs2.hpp compiles with cl /std:c++17 and /std:c++20 /permissive-.

Signatures, verified entry by entry

Each function target was checked in fresh IDA analysis of 14184: is it a function start, does the Hex-Rays prototype match, does the name describe what the code does (strings, callers, vtable).

• Two patterns started one byte into their function and published an RVA one byte late (BulkRegenIterator, SDL_EventHandler).
• CreateEntityByClassName had drifted onto a flex-controller warning; re-anchored on the client's networked entity creator.
• Renamed to what the function does: SetupCmd → GetUserCmdSequence, DrawOverHead → IsRenderingEnabledForSlot, UnlockInventory → IsInventoryUnlocked, DrawViewPunch2 → CalcLocalPlayerView, DrawCrosshair → ShouldDrawCrosshair, DynamicLight_SetDieTime → GetGameTimeOrCurrent, CreateParticleEffect → Particles_SetControlPointPosition, AutowallInit → C_BaseModelEntity_UpdateOnRemove, PrepareSceneMaterial → CMaterial2_GetFloatParam, UtlBuffer → CBufferString_Purge, LoadKeyValues → LoadKV3.
• Removed because the name described a different function: ReportHit (a CCLCMsg_HltvReplay destructor), SetupMove (the quick-buy radial), SetupMovementMoves (a call site in a schema helper), AutowallTracePos (C_GlobalLight skybox slots), CCSGOInput_HandleViewAngles (an input-state reset), UpdatePostProcessing (watch-menu match selection), DrawLightScene (a struct copy), and the placeholders UnknownParticleFunction and SomeTimingFromPawn.
• 162 prototypes filled in or refreshed from the current build.

577 entries, 576 resolve, 0 ambiguous. Schema field offsets (9,251 compared), buttons and all interface instances match a2x's 14184 dump exactly.

cs2-sdk.exe below. Run it as administrator with CS2 open; dump in a match for the full weapons list.

v2.1.4 — strict-JSON patterns.json, wiki + docs, Discord bot source

Housekeeping release for CS2 build 14183 (client 2000915). The dump itself is unchanged: 586 entries, 585 resolve, 0 ambiguous.

Fixed

• patterns/patterns.json is now strict JSON. va and rva were written as bare hex literals ("rva": 0xB64A10), which standard JSON parsers reject; they are now hex strings ("rva": "0xB64A10"), the same convention as offsets.json and every other file. The one-entry-per-line, column-aligned layout is unchanged. The committed dump was converted in place; the writer emits the same from now on.
• /api/pattern/<name> on cs2-sdk.com resolves aliases, class-stripped display names and module/Name exactly like /api/query (/api/pattern/GetInaccuracy now returns C_CSWeaponBaseGun_GetInaccuracy with a resolved note instead of a 404), and both endpoints report a folded-alias hit as match: "alias".

Documentation

• The project now has a wiki: https://github.com/scros22/cs2-universal-offsets/wiki — getting started, every output file, signatures (resolve kinds, naming, aliases, scanning at runtime), offsets, schemas and CHandle<T>::Get(), interfaces and vtables, protobufs, engine structs, catalogues, the site, the full API reference, the Discord bot, contributing, changelog and FAQ.
• docs/ in the repository mirrors the wiki and replaces the June-era guides, which described a layout and source tree that no longer exist. The VFX/VCS research note is kept under docs/research/.
• The Discord bot's source is in discord-bot/ (status embed, new-dump announcements, 12 slash commands over the site API), with a generic pm2 file and a config.example.json.

cs2-sdk.exe below. Run it as administrator with CS2 open; dump in a match for the full weapons list.

v2.1.3 — CSwapChainDx11 create signature + struct (m_pSwapChain +0x170)

Small follow-up for CS2 build 14183 (client 2000915), by request from the Discord.

New

• CSwapChainDx11_CreateSwapChain (rendersystemdx11.dll) — the engine's swap-chain creation: bool (this, IDXGIFactory*, device, flags). It calls IDXGIFactory::CreateSwapChain (factory vtable slot 10) with &this->m_pSwapChain as the out pointer and logs Successfully created dx11 swap chain %s. Verified in IDA.
• CSwapChainDx11 engine struct — m_pSwapChain at +0x170 (IDXGISwapChain*), with the DXGI vtable slots hook authors need: 8 Present, 9 GetBuffer, 10 SetFullscreenState, 12 GetDesc, 13 ResizeBuffers, 14 ResizeTarget. Ships as engine/cswapchaindx11.h and on the site's Engine tab.

There is no single swap-chain global in this engine (swap chains are per-window objects on the render device), so the create function plus the member offset is the right handle: catch the instance in CreateSwapChain, read +0x170 after it returns.

Database: 586 entries, 585 resolve, 0 ambiguous. Everything else is unchanged from v2.1.2.

cs2-sdk.exe below. Run it as administrator with CS2 open.

v2.1.2 — signature audit: 16 wrong names removed, aliases folded, 584/585

Signature-database audit for CS2 build 14183 (client 2000915). Live at https://cs2-sdk.com.

Every duplicate audited against the decompiled function

57 functions were listed under two or three names. Each group's shared target was decompiled in IDA and every name checked against what the function actually does. Result:

• 41 groups are genuine aliases (two community names for one function, e.g. TraceShape / CGameTrace_TraceShape_Client, GetInaccuracy / C_CSWeaponBaseGun_GetInaccuracy). The dump now publishes each of these once, under its most descriptive name, with the other names in an aliases field. Every alias still resolves in the site search, Ctrl+K and /api/query.
• 16 names were wrong or noise and are removed from the database:
  • GetLocalControllerById — the function resolves and returns the local pawn (GetLocalPawn stays)
  • GetBonePositionByName — returns a bone index (C_BaseEntity_GetBoneIdByName stays)
  • CGameTraceManager_TraceRay — the function is CGamePhysicsQueryInterface::TraceShape (its own log string)
  • SendChatMessage — HudChatPrintf formats a line into the local HUD chat, it sends nothing
  • DrawTeamIntro — fires the team_intro_start / team_intro_end events, draws nothing
  • RemoveLegs — the first-person legs render pass (DrawLegs); "remove" describes a hook use, not the function
  • TraceToExit — same function as CreateTrace; the exit-trace name was unverified
  • pVPhys2World — the global is the game trace manager (pGameTraceManager)
  • pGetBBox — the global is g_pGameRules (pGameRules)
  • CCSPlayerController_SwitchTeam — the warning string names CCSPlayerPawnBase::SwitchTeam
  • plus a duplicated CSkeletonInstance_SetMeshGroupMask, a SetBodyGroup case-duplicate, CreateSOSubclassEconItem, and two redundant NetSystem_ copies
• One entry was misnamed under both names: CalculateInterpolation / GetCUserCmdTick is CEntityInstance::GetEntityIndex (takes the identity at +0x10, walks the entity-list chunks, writes the index or -1). Published as CEntityInstance_GetEntityIndex.

Database: 585 entries, 584 resolve (only GameSystem_Think_CheckSteamBan remains), 0 ambiguous matches.

Naming

Class prefixes are still stripped for readability (CCSGOInput_CreateMove → CreateMove), but never down to a bare word: CCSInventoryManager_Get and CInButtonStatePB_New keep their class instead of appearing as Get and New.

Files

• patterns/patterns.json gains unique_functions and a per-entry aliases list; patterns/patterns.hpp notes aliases as comments.
• offsets/offsets_all.json (from v2.1.1): every resolved global, tagged by kind.
• CHandle<T>::Get() (from v2.1.1) in macros.hpp + impl/entity_system.hpp.

cs2-sdk.exe below. Run it as administrator with CS2 open; dump in a match for the full weapons list.

v2.1.1 — 600/601 sigs, entity I/O back, all 208 offsets on the site, CHandle::Get()

Follow-up to v2.1.0 for CS2 build 14183 (client 2000915). Browse it live at https://cs2-sdk.com.

Signatures

• 600 / 601 resolve. The four entity I/O functions that were still missing are back and verified in IDA: CEntityInstance_AcceptInput, CEntityIdentity_AcceptInput, CEntitySystem_AddEntityIOEvent, CEntityIOOutput_FireOutputInternal. Only GameSystem_Think_CheckSteamBan (server.dll) remains unresolved: nothing unique is left to anchor it on this build.
• No more ambiguous patterns. Every signature now matches exactly once in its module. CAM_ThinkReturn, NoClipOnChange, CBaseModelEntity_SetModel, PostProcessQuery, CBaseEntity_SetGravityScale, CTakeDamageInfo and CS2ItemEditor_BuildTemplateMaterialFromFile previously matched several places and were published on the first hit.
• Duplicates folded on the site. 57 functions were listed under two or three community names (TraceShape / TraceShape_Client / TraceRay, GetInaccuracy / C_CSWeaponBaseGun_GetInaccuracy, ...). Each function is now one row with the other names shown as aliases. Every name still works in search and in the API, and /api/signatures?raw=1 returns the unfolded list.

Offsets

• All 208 resolved globals are on the site (it showed only the 29 classic dwXxx ones before): the a2x globals, the globals resolved by signature, and every registered interface instance, with a kind filter and a per-module picker. New offsets/offsets_all.json in the dump carries the same list; /api/offsets?detail=1 serves it and /api/offsets keeps its old {module: {name: rva}} shape as a superset.

SDK headers

• CHandle<T>::Get() (the accessor people asked for): resolves the handle through CGameEntitySystem and returns nullptr for an invalid handle, an empty slot, or a reused slot (the identity's serial must match). Also GetSerial() and == / !=. Include impl/entity_system.hpp. Compile-tested with clang.
• CCSCustomPlayerCamera (the renamed CSPlayerCamera) is in the schema dump with its current fields, on both client and server.

Site

• Transient load errors (a Cloudflare 52x, a brief 502 during a restart) are retried automatically before anything is shown, with a Retry button if they persist.
• Malformed scanner requests get a 400 instead of a stack trace; unknown hostnames pointed at the server are dropped instead of being routed to the site.

cs2-sdk.exe below. Run it as administrator with CS2 open; dump in a match for the full weapons list.

v2.1.0 — CS2 build 14183: 598/601 sigs, user-command structs, 44 weapons, batch API

Fresh dump for the current CS2 build 14183 (Steam client 2000915, Sep 23 2026). Browse it live at https://cs2-sdk.com.

Highlights

• 598 / 601 signatures resolve on the current build. Every broken one from the last few updates was recovered, and 98 new ones were added, each verified in IDA with a Hex-Rays prototype. New ones include:
  • HudVoiceStatus_SetVoiceData (the "set_voice" chat-print everyone asked for)
  • CCSGOInput_AddInputHistoryEntry, HandleViewAngles, ReadFrameInput, ProcessInputEvent
  • C_CSPlayerPawn_GetAimPunch / GetAimPunchAtTick / GetInterpolatedShootPosition
  • CGlowProperty_GetGlowColor / IsGlowing
  • weapon recoil / viewmodel / accuracy, econ item view, inventory, loot list and item schema functions
  • prediction helpers, trace functions, render hooks (RenderView, SetupFog, smoke, inferno)
  • globals: pCSGOInputInstance, pDynamicLightManager, pPredictionPlayer, pMaterialManager, pEconItemSystem, pCSInventoryManager, ...
• User-command structs (engine/): CUserCmd (150-entry ring, 0x98 stride, sequence at +0x5910), CCSGOUserCmdPB, CBaseUserCmdPB, CSubtickMoveStep, CInButtonStatePB, CCSGOInputHistoryEntryPB, CSGOInterpolationInfoPB, CMsgQAngle, CMsgVector, plus CCSGOInput and CViewSetup. Every field has its offset and protobuf has-bit, and every struct ships as a drop-in .h.
• All 44 weapons in weapons.json, including the R8, M4A1-S, USP-S and MP5-SD variants.
• 4,110 convars + 1,185 commands, 273 game events, full schemas, offsets, interfaces + vtables, protobufs.

Fixes

• Several signatures that still matched but pointed at the wrong function (pEntitySystem, FindHudElement, LevelShutdown, GetEconItemSystem, GetRemovedAimpunch, CheckJumpButton, ...) now resolve to the right one.
• Raw patterns with an extra_off now publish the correct RVA (ConvarGet was a few bytes off).
• Signatures whose short names collide keep their full class-qualified names instead of showing up twice under one name.
• The weapon and entity walkers read their field offsets from the schema dumped in the same run, so they don't go stale after an update.
• Engine-struct function addresses come from the signature pass instead of being hardcoded.
• patterns/ output folder is lowercase on every platform.

cs2-sdk.com

• Batch API: POST /api/query with {"signatures": {"CreateMove": true}, "offsets": ["dwEntityList"]} returns everything in one response. Names match exactly, case-insensitively, without the class prefix, or by method name alone (SetVoiceData).
• Bookmarks + collections: star signatures, offsets and classes, group them, and export as .hpp / .json / .txt. Collections have share links, a "copy as API query" button, and show each item's current value after every update.
• New API page, Offsets tab, and a searchable Engine structs panel.

Still unresolved on this build: CEntityInstance_AcceptInput, CEntitySystem_AddEntityIOEvent, GameSystem_Think_CheckSteamBan (server.dll).

cs2-sdk.exe below. Run it as administrator with CS2 open; dump in a match for the full weapons list.

v1.24.0 — build 14175 resync + 2 sig recoveries

v1.24.0 — build 14175 resync + 2 sig recoveries

Build target: CS2 game build 14175

Signature count: 503 / 503 resolved

Recovered signatures (2)

Both broke after the game update; recompiled bytes traced and re-anchored against a live 14175 process.

• GloveApply_PerTick (client.dll) — the field it reads shifted from +0xA8 to +0xB0 (a class layout change added a field ahead of it). Same compiled function, moved 0xBFA550 → 0xBFBBD0. The new needle wildcards that offset byte so a future layout shift won't break it again.
• Engine_MountAddon (engine2.dll) — register allocation changed inside the function body (push r12 → push r13), which shifted a nearby branch/frame displacement along with it. Moved 0x193440 → 0x193270; the volatile bytes are now wildcarded.

Removed (3)

Confirmed anchorless / fully inlined as of the 14172 update — no stable byte sequence to pattern-match:

• GetGlowColor
• CalcViewmodelTransform_v2
• CCSGameRules_sm_mapGcBanInformation

Total pattern count: 506 → 503.

Dump refresh

Full fresh dump from a live build-14175 session — schemas, offsets, interfaces, convars, weapons, game events, entities, engine structs, protobufs, patterns all regenerated.

Run

cs2-sdk.exe --output include

Requires CS2 (cs2.exe) running on Windows.

Full Changelog: v1.23.0...v1.24.0