Valthrun an open source external Counter-Strike 2 read only kernel gameplay enhancer.
That's a lot of descriptive words, but what does each of them mean?

• Valthrun The name of this project
• Open Source This application is open source and for everbody to study
• external We do not inject any ddls into the target process
• Counter-Strike 2 The game we're enhancing
• read only We do not write to the CS2 process in any way, therefore being impossible to detect by scanning the process memory.
• kernel We do not use any user level WinAPIs in order to get information from the CS2 process

This project is mainly a fun example for exploring the Windows Kernel with Rust and exploring the world of game enhancements :)

Valthrun is currently not a pnp (plug 'n play) application.
Please read How to use carefully and try troubleshooting issues on your own.
The goal is to reach maximum stelth to avoid anti cheat detection.

Valthrun provides a variety of external tools to enchant your gameplay experience.
As of now, Valthrun only reads memory and never writes anything. This implies some limitations as which features could be provided.
An example would be a skin changer which is not be possible without actively modifying the CS2 game state (e.g. writing into it's memory).

Regardless of this limitation, Valthrun supports the following features:

• Player ESP Two modes are supported: Skeleton and Boxes
  • Configurable colors to distinguish between enemy and team players
• Bomb Info
  • Time until the bomb detonation
  • Defuser info such as how long until the defuse has succeeded
  • Bomb site where the bomb is located
• Trigger Bot

To access Valthruns settings overlay press PAUSE.

• Aim Bot
• Spectator info
  • List of player currently watching you / the observer target
• Player competitive ranks / wins (I don't have access to the closed beta... so this has to wait a little)

Mess around:

• KeUserModeCallback https://www.unknowncheats.me/forum/anti-cheat-bypass/347320-communication-via-callbacks.html
• Invoking Shellcode within CS (send text message, change player name etc.)

Valthrun does not need to be installed.
In order to run Valthrun you only need the kernel driver (valthrun-driver.sys) and the controller (controller.exe).

Both can be accquired by downloading the precompiled release from GitHub.
Click here to view all releases.

Once downloaded read How to use to get started!

The following steps need to be done for starting/activating the overlay.

1. Load the kernel driver
   The overlay requires the kernel driver for all memory reads and writes. Therefore we need to load the driver before we can start the overlay. It's not strictly required to load the driver before starting CS2 but logically it makes sense to start with the driver.

   There are two common options to load the kernel driver:

   1. Manually map the driver using a vulnerable driver The Valthrun kernel driver fully supports manual driver mapping using a any vulnerable driver. In order to detect the manual mapping the second driver entry argument (the registry patch) must be a null ptr.
      The kernel driver will automatically allocate a new driver for io communication.

      In order to manually map the Valthrun driver you can use tools like

      • KDU
      • kdmapper

   2. Setting Windows into test-signing mode
      TODO: Explain how to set Windows into test signing Helpfull guide: https://github.com/dretax/GarHal_CSGO#starting-driver

2. Start Counter-Strike 2
   After loading the driver you can start Counter-Strike 2 as usual.

3. Start Overlay
   With an open instance of Counter-Strike 2 you can start the overlay.
   Attention: You must start the overlay as administrator!

To explore all command line options of the controller, start the controller from the terminal and pass -h to display the command line interface:

.\controller.exe -h

When you want extra/verbose output, start the overlay from the terminal and previously set the RUST_LOG environment variable.
Example for executing the overlay with trace output:

$env:RUST_LOG="trace"
.\controller.exe

If you are having issues mapping the kernel driver or starting the controller, please take a look here:
https://github.com/WolverinDEV/Valthrun/tree/master/doc/troubleshooting

The issue you encounter is most likely covered. If you still have any questions or need assistens, feel free to checkout the official Valthrun Discord server (click to join).

The same considerations as mentioned in this link have been taken into account.
With these precautions and some minor improvements, such as omitting the valthrun identifier and using xor-ing for strings, the driver/overlay should avoid VAC detection. However, I must clarify that I haven't extensively studied VAC, so my conclusion is speculative. Personally, I have been using a C based driver/overlay like this with CSGO for several years without ever getting VAC banned. But be aware of overwatch!
Unfortunately, since I'm not part of the closed CS2 beta,
I haven't had the opportunity to test the overlay with VAC live,
but I assume it should work similarly well.

All recent windows versions should be supported as all functions / struct offsets are resolved dynamically.
If you encounter an issue, please submit an issue containing your Windows version and detailing the error you encounter.

You can find help on the official Valthrun Discord server: