Operation: Harsh Doorstop Internal

Overview

This project is an internal cheat the code is injected as a DLL and runs directly inside the game's own process, rather than reading memory from an external tool. It targets a game built on Unreal Engine 4, and adds ESP, a skeleton overlay, an aimbot, and a handful of gameplay modifiers (no recoil, infinite ammo, fly, godmode), all controlled through an in-game ImGui menu.

Hooking the Renderer

The first problem with drawing an overlay is that the game already owns its own window and rendering pipeline. Instead of creating a second window, the cheat hooks IDXGISwapChain::Present the DirectX function the engine calls once every frame to flip the back buffer to the screen. Kiero locates the swap chain's function table at runtime and MinHook does the actual low-level trampoline hooking to redirect that function pointer.

kiero::init(kiero::RenderType::D3D11);
kiero::bind(8, (void**)&oPresent, hkPresent); // index 8 = Present

Once hooked, hkPresent runs every frame with access to the game's own D3D11 device and swap chain. That's what lets ImGui draw directly on top of the game's frame before it reaches the screen, and it's also where the menu and all overlay drawing get called from.

Reading the Game State

Unreal Engine keeps a single global pointer, GWorld, that anchors the entire game state every actor, player, and game instance hangs off it. Its offset from the module's base address was found using Dumper-7, a tool that walks the engine's own reflection system at runtime to dump every class layout, struct, and offset the game uses.

auto world = *reinterpret_cast<SDK::UWorld**>(base_address + 0x43A52F8);
auto local_character = world->OwningGameInstance->LocalPlayers[0]->PlayerController->Character;

Because the dumped SDK structs line up byte-for-byte with the engine's real memory layout, casting a raw pointer to something like SDK::ADFBaseCharacter* and reading `->Health` reads the actual live value straight out of the game's memory, no separate memory-reading API required since the code is running inside the same process.

ESP and Skeleton Overlay

For each player in GameState->PlayerArray, the cheat projects their 3D head and foot position into 2D screen coordinates using the engine's own ProjectWorldLocationToScreen function, then draws a bounding box between them sized proportionally to the projected height. LineOfSightTo determines whether a target is actually visible, which drives the box color (green for visible, red for behind cover).

The skeleton overlay works the same way but per-bone: a predefined list of bone chains (arm, leg, and spine segments, referencing bone indices from the dumped skeleton) gets projected to screen space one bone at a time, drawing a line between each consecutive pair to form a wireframe stick figure.

Aimbot

On keypress, the aimbot loops every enemy, projects their head bone to screen space, and picks whichever target lands closest to screen-center within the configured FOV radius. To actually aim at that target, it computes the rotation from the camera to the target's world position using basic trigonometry, then sets the player controller's rotation directly.

float yaw = atan2f(delta.Y, delta.X) * (180.0f / 3.14159265f);
float pitch = atan2f(delta.Z, distXY) * (180.0f / 3.14159265f);

Other Modifiers

No-recoil, infinite ammo, fly, and godmode all follow the same pattern: locate the relevant object through the same pointer chain used for ESP, then overwrite a value or flag the engine itself reads every tick, like `bNoRecoil`, `MaxHealth`, or `MovementMode`. Since the code runs inside the process, these are direct writes to the game's own live state rather than simulated input or network packets.

Challenges

• Keeping the GWorld offset and dumped struct layouts in sync whenever the game updates, since a single shifted offset breaks every pointer chain downstream
• Reliably projecting bone positions to screen space without flicker when a bone falls off-screen or behind the camera
• Tuning aimbot target-selection so it picks the closest on-screen enemy within FOV without snapping between targets erratically