A fully external CS2 cheat suite that doesn't cost $30/month, doesn't phone home, and doesn't need a driver.

I built this because every "premium" CS2 external on the market in 2026 is either a subscription-farming piece of malware disguised as a cheat, a DMA card setup that costs more than the GPU, or a 2024-era fork that still crashes on every CS2 update and leaks your HWID to someone's Discord webhook. You already know why. Overwolf overlays that get you VAC-flagged, "undetected" loaders that are detected within 48 hours, ESPs that draw through walls but also draw through smoke and lose you the round, spoofers that brick your NIC. I got tired of paying for it and tired of debugging other people's broken builds.

This repo is the free, source-visible, offline-first alternative. No subscription. No token auth. No webhook exfil. Just a single .exe, a config folder, and a memory-read overlay that runs entirely in userland.

• What This Actually Is
• How The Internals Work
• Comparison — Why Not Just Pay For One
• Key Features
• Module Catalog
  • 👁️ Visual ESP Modules
  • 🎯 Aim Assistance Modules
  • 🔧 Player & Economy Tweaks
  • 🎛️ Overlay & Interface Modules
  • 🛰️ Recon & Info Modules
• Usage Guidelines
• Hotkeys
• Tips For Best Results
• Known Issues
• Roadmap
• System Requirements
• The Solution
• FAQ
• Troubleshooting Flow

Why people actually use external builds like this:

• No injection vector for anti-cheat to scan for in-process.
• Crash-resistant — if the reader dies, the game keeps running.
• Debuggable. You can attach a debugger to your own cheat process without tripping anything.
• Configs are portable and human-readable.
• Single binary, no runtime install.

This is the section that paid alternatives don't give you, and it's the part you actually need to understand if you're going to modify this.

The suite boots into three cooperating threads inside one userland process. The first is the resolver: on launch it opens a handle to .exe with PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, walks the module list, locates client.dll, and applies a set of byte-pattern signatures to recover the offsets for the local player, the entity list, the view matrix, the radar base, and the bone matrix array. These signatures are the maintenance burden — when Valve restructures C_CSPlayerPawn or reorders the entity list freelist, the offsets shift and the signature needs a new wildcard. Everything downstream depends on the resolver succeeding within the first ~200ms of attach, so if you're seeing a black overlay with no boxes, the resolver is what failed, and the debug log will tell you which signature didn't match.

The second thread is the sampler. It runs a tight read loop at a configurable interval (default 8ms) pulling entity positions, health, team indices, weapon IDs, and bone matrices into a double-buffered snapshot. The snapshot swap is atomic so the renderer never draws a half-updated frame with an entity position from tick N and a health value from tick N-1 — that mismatch is what causes the famous "dead player still has a box" glitch in cheaper externals. The sampler deliberately reads slightly more than any single render pass needs, because ESP and aim-bot both pull from the same snapshot and you don't want to serialize two readers against the same handle.

The third thread is the presenter. It owns a layered topmost window sized to the game client rect (tracked via GetClientRect on the game's HWND, with SetWinEventHook catching move/resize). It renders with GDI+ into an offscreen bitmap, then UpdateLayeredWindow paints it in one shot — this is deliberately slower than D3D but keeps the cheat entirely out of the graphics driver path, which matters for detection surface. On top of the presenter sits the world-to-screen transform: it pulls the current view matrix, projects each entity origin and each bone origin into clip space, rejects anything behind the near plane, and converts to screen pixels. That projection is the whole ballgame — if boxes drift when you pan the camera, the view matrix read is stale, and the fix is almost always lowering the sampler interval or checking that the resolver picked up the right dwViewMatrix offset.

The aimbot thread is separate and off by default. It reads from the sampler's snapshot, picks a target using a priority tree (FOV distance × visibility × threat weighting), computes a delta in screen space, and moves the cursor via SendInput with MOUSEEVENTF_MOVE relative deltas — not SetCursorPos, which teleports and is both obvious to spectators and breaks on fullscreen. Smoothing is applied per-axis with a configurable humanization curve, and the whole loop can be gated behind an activation key so it only runs when you're holding the button.

Config, logging, and the hotkey listener all run on a fourth, lighter thread. The .exe is a single signed-agnostic build — no installer, no service, no scheduled task.

Framing is deliberate — the paid ones win on convenience (they maintain the offsets for you). This one wins on transparency and cost, and asks that you understand what a signature is.

25 modules across five domains. Every row is either ✅ Working or explicitly marked otherwise — no vaporware.

Educational use only. Do not use this on official Valve matchmaking. This is a technical study of userland memory reading, world-to-screen projection, and layered overlays — the kind of work that shows up in every game-hacking research paper and RE write-up.

• Run the .exe after CS2 has reached the main menu. Attaching before the game fully loads means the resolver picks the wrong module base — reload with F5.
• Play in borderless windowed. Fullscreen exclusive breaks layered overlays on some NVIDIA drivers.
• Keep the sampler interval at 8ms unless you're fighting low FPS on a laptop. Lower is smoother but burns more CPU.
• Turn off depth-occluded skeleton in comp — it stops drawing through smoke and looks less obvious in demos.
• If aim assist feels like it's dragging, your humanization factor is too high — drop it to 0.4 before touching anything else.
• Store configs in the same folder as the .exe so profile cycling doesn't cross drives.
• Don't chase "undetected" claims. Anything external is detectable by behavioral analysis — play accordingly.

1. Visit the project page — read the known issues and the signature note first.
2. Download the release archive.
3. Extract to a folder you control (not Program Files, not Desktop — Defender heuristics dislike temporary paths).
4. Launch CS2 to the main menu.
5. Run the .exe from the extract folder, then press INSERT in-game.

Q: Is this actually undetected? A: External memory readers do not inject into the game process, so traditional signature scanning of in-process modules won't catch the cheat. That said, behavioral detection and analytics exist — treat "undetected" as a temporary state, not a guarantee. Use on private offline servers.

Q: Why did my ESP work yesterday and not today? A: Valve patched the game. Your client.dll offsets shifted. Pull the latest signature file from sigs/, drop it in the extract folder, and press F5 in-game. If signatures still don't resolve, the pattern needs a wildcard update — file an issue with the debug log.

Q: Do I need a driver or a kernel component? A: No. This is fully userland. ReadProcessMemory, SendInput, UpdateLayeredWindow. If a fork tells you it needs a driver for the same features, they're either doing something they don't need to, or something else.

Q: Can I use this on Valve matchmaking? A: No. It's an educational build studied on offline/private servers. Running it on VAC-secured servers is out of scope and is not the use case this repository is written for.

Q: Where do I configure aim smoothing? A: config/aim.json. Keys are documented inline in the file. If the hotkey menu is open, the same values map to it — but the JSON is the source of truth.

Q: My antivirus flags the .exe. What do I do? A: Expected — userland process-read + layered topmost overlay triggers generic heuristic signatures. Add an exclusion for the extracted folder. If you don't trust the binary, build it from source; the build script is in build/.

Q: Will this work with Faceit / ESEA? A: Absolute no. Client-side anti-cheats will terminate your session and ban your account. Do not attempt.

Q: Why is the sampler interval 8ms by default? A: It's the sweet spot between responsive boxes and CPU load. On a laptop with thermal throttling you may want 12ms — the aim assist path will feel slightly worse but the game will hold FPS.

Q: Does the overlay capture the mouse? A: No. It's WS_EX_TRANSPARENT so clicks pass through. The hotkey menu temporarily disables that flag while open.

If the overlay launches but you see no boxes → check debug.log first. If it says sig_mismatch: client.dll::dwEntityList, your signature file is stale → replace sigs/client.json with the current release version and press F5. If it says attach_failed: PROCESS_VM_READ, another process is holding the handle — close any opened debugger and retry. If it says attach_ok with no further error but the overlay still renders empty, your view matrix projection is likely returning a stale frame → confirm the game is in borderless windowed and not fullscreen exclusive.

If aim assist fires but misses consistently, verify visibility check settings: on some builds the trace-ray returns a hit on a teammate's body and cancels the lock. Turn off AimAssist.VisCheck briefly to confirm the behavior. If it locks on the wrong bone, cycle AimAssist.BoneSelect — the head/chest chain can fall through to pelvis if the head bone index shifted with a model update.

If performance drops below your frame target, drop skeleton and offscreen ESP first — they're the two heaviest presenter modules. Then raise the sampler interval. Do not lower the presenter's redraw rate; it causes tearing rather than smoothness.

The whole pipeline is designed to be debuggable end-to-end from debug.log alone. If something is broken and the log doesn't tell you why, that's a bug worth filing.

This project exists because a small group of us got tired of paying subscriptions for tools we could read. The code isn't magic — it's a reader, a sampler, a projector, and a painter, stitched together so that the failure mode is visible instead of silent. Fork it, fix the signature when Valve breaks it, and if you learn something about how userland memory reading actually works in the process, that was the point all along.