Lua API v2Public reference
Events, menu elements, drawing, HUD windows, game data, files, network and memory: one API in every product. Everything on this page is the live reference, with an example you can paste as is.
A script is one .lua file. Every example below is a complete v2 script: copy it, or start from the one below.
Open the Lua tab of the in-game menu, or write it in the Editor tab. Signed in on the panel, Run in game sends a script straight to your loader.
script.reload() picks up your edits. An error stays in the console with its line: it never takes the overlay or the other scripts down.
local key = ui.create("Demo"):group("Keys"):hotkey("Aim key", 0x02, "hold")
events.render:set(function()
if key:get() then render.text(nil, vector(20, 60), color(255, 200, 0), "s", "aiming") end
end)A short mental model before the reference.
There is no OnDraw / OnMenu / OnThread any more. A script subscribes to events: events.render:set(fn) draws every frame, events.update:set(fn) runs before drawing, events.key_down, events.esp_player… Several callbacks per event, :unset(fn) removes one.
ui.create("My script") gives a tab, tab:group("Aimbot") a box, group:checkbox("Enabled", false) an element. Each one is a real menu setting: saved in configs, editable on /live, with :get(), :set(), :set_callback(), :depend()… No per-frame rebuilding.
Positions and sizes are vectors (vector(x, y, z)), colors are colors (color(r, g, b, a)). render.rect(pos, size, col) - never packed integers or x, y, w, h lists.
Long calls (network, memory scans, device connects, os.execute…) take a callback as their last argument in a script and return at once. In a thread.spawn worker, call them without a callback: they block there, never the overlay.
Each script has its own Lua state, memory cap (256 MB by default) and time budget (1 s per callback). Network, files outside its data folder, memory, devices, os and configs need a --@permissions header and the user's approval once; "Allow unsafe scripts" stays the master switch.
Callbacks, timers, threads, menu elements, fonts, images, HUD windows, pending async calls and memory hooks belong to the script that made them and go away when it unloads. No callback of an unloaded script ever runs.
The API is the same in every product. What changes is the data: the players entity.* lists, the ESP elements, the hitbox names and the get_prop fields. A script can read elusive.product and game.name() to adapt.
Nothing matches.
Try a module name (render, ui, memory) or an old v1 name: the migration table maps it to the new one.
Open the v1 migration tableModule 01
What a script knows about itself and the runtime. elusive.api_version is 2: no breaking change without a new number.
Module 02
The entry points of a script. Each event object has :set(fn), :unset(fn); several callbacks per event run in the order they were set, each under its own script's time budget. Engine events cannot be fired by a script; events.custom(name) is the channel between scripts.
Module 03
Deferred and repeated callbacks on the render thread. At most 256 timers per script; a timer that runs out of its budget or raises 64 times in a row is cancelled.
Module 04
Background work in its own Lua state on its own OS thread. The function is self-contained: it sees none of the script's locals or globals (pass them as arguments; a function that captures a local is refused). Values cross as copies, like events.custom. At most 16 threads per script, 256 MB each; a loop that never calls thread.sleep / thread.recv is stopped after 300 million instructions; threads stop when the script unloads. A finished thread stays readable (recv) while it has unread messages, the last 16 of them only. A thread has its script's permissions; turning "Allow unsafe scripts" off or on reaches the running threads at once.
Module 05
The in-game menu. An element is made once (at the top level of the script) and becomes a real menu setting: drawn like the cheat's own under the Scripts category, saved in the configs, shown and editable on /live, listed in the keybinds HUD and the search. Stable ids: scripts.<script>.<tab>.<group>.<label>. Per script: 8 tabs, 64 groups, 1024 elements. Not available in a thread.
Module 06
The position / size / direction type. vector(x, y) is 2D (z = 0), vector(x, y, z) 3D. Fields x, y, z are writable. Operators: + - (vectors), * / (a number or a vector), unary -, ==, tostring.
Module 07
The color type, 0..255 per channel. Fields r, g, b, a are writable (clamped when drawn). == and tostring work.
Module 08
Drawing over the game. The drawing calls work inside events.render and events.esp_player only; measure_text, screen_size, world_to_screen, load_font and load_image work anywhere in the script. Positions and sizes are vectors, colors are colors. At most 100,000 shapes per script per frame; a NaN or infinite coordinate draws nothing.
Module 09
The script's own HUD windows, in the style of the keybinds / spectators lists: draggable while the menu is open, magnetic, their placement saved with the configs. 16 windows per script; 256 items per window; not available in a thread.
Module 10
The game data, from the snapshot the product already fills every frame: these calls never read the game themselves. What each game exposes (players listed, ESP elements, hitbox names, get_prop fields, entity kinds, world axes) is in the "Per game" section above; a value a game does not have is nil. Not available in a thread.
Module 11
Take part in the cheat's own player ESP: hide players, recolor them, rewrite their labels, add texts, bars and flags laid out with the ESP's own elements (same sides, same stacking, same order as in the ESP preview). events.esp_player gives one (player, e) per player the ESP draws; esp.flag adds a real ESP element. Nothing is read from the game for this. Not available in a thread.
Module 12
The game PC's keyboard and mouse, as the cheat reads them. Works in threads too. A vk outside 1..255 raises.
Module 13
Notifications, host information, and the configs (the cheat's saved settings). common works in threads; configs does not.
Module 14
The web radar (the Webradar tab: a live map of the game at elusive.is/r/<code>): its state, and marks your script puts on the viewers' map. Scripts only, not threads.
Module 15
Lua 5.4's standard library (base, coroutine, table, string, math, utf8, the safe part of os) with the functions that could loop in C replaced by bounded ones, plus these additions. Available in scripts and threads. Removed on every state: io, debug, package, dofile, loadfile, string.dump, bytecode loading (load takes text only), os.exit / remove / rename / tmpname / setlocale, warn, and __gc in setmetatable.
Module 16
Data libraries, available in scripts and threads, no permission needed.
Module 17
The script's files. A relative path is inside the script's own data folder, <scripts>\data\<slug>\ (made on first use; files.data_dir() gives it): no permission needed. Any other path (absolute, .., a drive) needs the files permission. Device names (CON, NUL, \\.\PhysicalDrive0…) are always refused. Works in threads too.
Module 18
HTTP and HTTPS requests. In a script they take a callback as the last argument and return at once; in a thread, call them without a callback and they return res | nil, err. 10 redirects, 64 MB body at most.
Module 19
The host's clipboard and shell. os.time, os.clock, os.date and os.difftime are always there; os.getenv and os.execute need the os permission.
Module 20
Direct reads and writes in the game's memory over the DMA link. Prefer entity.*: it is read once per frame in one scatter, while every call here goes to the device. Quick calls answer at once; the long ones (scans, listings) take a callback in a script and block in a thread. Sizes per call: 1 MB in a script, 16 MB in a thread.
Module 21
Code hooks in the game. Every patch saves the bytes it overwrites and they are written back when the script unloads (unload, reload, shutdown), newest first, so a reload hooks a clean game. A range another script patched is refused; a hook whose write fails is undone.
Module 22
MAKCU, KMBox B, Ferrum… over USB serial, on the same link as the Device settings. The long calls (open, connect, query) take a callback in a script and block in a thread. While a connect runs, the quick calls answer false / nil, "busy: the device is connecting" instead of blocking the overlay.
Module 23
KMBox Net over UDP. In a script, commands are queued and sent in order by the device's own thread: a call returns true at once (or false, err when there is no box or 256 commands are waiting). In a thread they wait for the box. The release of a click / key, and key_up / button(b, false) / release_keys, are always sent, even if the script unloads in between.
Module 24
What a script declares in its first 64 lines. "Allow unsafe scripts" (Configs & scripts > Lua) gives every script the permissions it declares, nothing to allow per script; when it is off, no permission applies. A call without its permission raises a message that says what to declare, or to turn the switch on.
Module 25
What keeps one script from taking the overlay or the other scripts down. Over a limit, the call raises a clean Lua error (or the script is unloaded with a clear message); nothing crashes.
Module 26
API v2 is a clean break: OnDraw, OnMenu, OnThread and the immediate-mode menu are gone. Search the old name here to find its replacement. Behaviour that changed too: errors in a callback no longer stop other scripts; blocking calls (HTTP, serial queries, device connects, memory scans, os.execute) take a callback; memory hooks are undone when the script unloads; "Allow unsafe scripts" now gives a script only the permissions it declares (--@permissions).
elusive.product == "counter-strike-2"game.name() == "Counter-Strike 2"Player ESP hook| game.get_map() | the current map ("de_mirage"…), nil at the menu |
|---|---|
| entity.get_players() | the players (CT and T, dead included, the local player too) |
| World axes | Z up (Source engine) |
| is_enemy() | a different team; in deathmatch everyone but you |
| get_weapon() | the weapon name without "weapon_" ("awp", "ak47") |
| entity.get_entities() | "weapon": the weapons on the ground (name "ak47", item "weapon_ak47", clip / max_clip, angles) |
ESP elements esp.elements()
Hitboxes p:get_hitbox_position(name)
Fields p:get_prop(name), any other name gives nil
local box = ui.create("CS2 Demo", "Crosshair"):group("Snipers")
local on = box:checkbox("Scoped AWP warning", true)
esp.flag("SCOPED AWP", color(0, 200, 255), function(p)
if not on:get() or not p:is_enemy() or not p:is_alive() then return false end
local w = p:get_weapon() or ""
return w:find("awp") ~= nil and p:get_prop("m_bIsScoped") == true
end)
events.esp_player:set(function(p, e)
if not on:get() or not p:is_enemy() then return end
if p:get_prop("m_bHiddenBySmoke") then e:set_color(color(140, 140, 140)) end
local clip, reserve = p:get_prop("m_iClip1"), p:get_prop("m_pReserveAmmo")
if clip and reserve then e:set_text("ammo", string.format("%d / %d", clip, reserve)) end
end)elusive.product == "deadlock"game.name() == "Deadlock"Player ESP hook| game.get_map() | the current map, nil at the menu |
|---|---|
| entity.get_players() | the heroes (NPCs not included) |
| World axes | Z up (Source engine) |
| is_enemy() | a different team |
| get_weapon() | the ESP's weapon label (the hero's name for the generic weapon); get_prop("hero") is always the hero |
| entity.get_entities() | "trooper", "neutral", "boss": the NPCs (type, health, max_health, team 2 Amber / 3 Sapphire, alive, enemy, designer_name, model); your team's and dead ones included |
ESP elements esp.elements()
Hitboxes p:get_hitbox_position(name)
Fields p:get_prop(name), any other name gives nil
local box = ui.create("Deadlock Demo", "Users"):group("Teammates")
local on = box:checkbox("Lane + ult cooldown", true)
events.esp_player:set(function(p, e)
if not on:get() or p:is_enemy() then return end
local lane = p:get_prop("m_nAssignedLane")
if lane then e:add_text("top", "L" .. lane, color(120, 220, 160)) end
if p:get_prop("ultimate_ready") then
e:add_text("bottom", "ULT READY", color(255, 140, 0))
else
local cd = p:get_prop("ultimate_cooldown") or 0
if cd > 0 then e:add_text("bottom", string.format("ult %ds", math.ceil(cd)), color(200, 200, 200)) end
end
end)elusive.product == "overwatch"game.name() == "Overwatch 2"Player ESP hook| game.get_map() | nil (not read) |
|---|---|
| entity.get_players() | every hero in the snapshot (bots included) |
| World axes | Y is up: x / z is the ground plane |
| is_enemy() | not local and not a teammate (m_bTeammate) |
| get_weapon() | the hero name (Overwatch has no weapon data) |
| get_health() / get_max_health() | the whole bar: HP + armor + shield; get_armor() is the armor part |
| entity.get_entities() | "deployable": turrets, barriers, domes… (owner, teammate, mine, health, max_health, barrier, dome, radius, blocks_all); "pack": health / ult packs (large, ult) |
ESP elements esp.elements()
Hitboxes p:get_hitbox_position(name)
Fields p:get_prop(name), any other name gives nil
local box = ui.create("OW Demo", "Zap"):group("Ult warning")
local on = box:checkbox("On", true)
local at = box:slider("Threshold", 50, 100, 85, { unit = "%" })
esp.flag("ULT", color(255, 140, 0), function(p)
local u = p:get_prop("m_flUltCharge")
return on:get() and p:is_enemy() and u ~= nil and u >= at:get()
end)
events.esp_player:set(function(p, e)
if not p:is_enemy() or not p:is_alive() then return end
e:add_text("bottom", p:get_prop("m_szHeroName") or "?", color(255, 255, 255))
local head = p:get_hitbox_position("head")
local s = head and head:to_screen()
if s then
local top = (head + vector(0, 0.15, 0)):to_screen() -- Y is up in OW
local r = top and math.clamp((s - top):length(), 2, 40) or 6
render.circle(s, r, color(255, 255, 255, 220), 1.5, 24)
end
end)elusive.product == "wardogs"game.name() == "Wardogs"Player ESP hook| game.get_map() | nil (not read) |
|---|---|
| entity.get_players() | the players |
| World axes | Z up |
| is_enemy() | not local and not a teammate |
| entity.get_entities() | "vehicle" (type 0 helicopter, 1 airplane, 2 tracked, 3 wheeled; health, fuel 0..1, teammate), "loot" (type 0 other, 1 weapon, 2 bag, 3 medical, 4 ammo), "point" (type 0 equipment vendor, 1 vehicle vendor, 2 garage, 3 fuel refill, 4 control zone) |
ESP elements esp.elements()
Hitboxes p:get_hitbox_position(name)
Fields p:get_prop(name), any other name gives nil
esp.flag("SNIPER", color(0, 200, 255), function(p)
local t = p:get_prop("m_szWeaponType") or ""
return p:is_enemy() and t:lower():find("sniper") ~= nil
end)
events.esp_player:set(function(p, e)
local lvl = p:get_prop("m_iLevel") or 0
if p:is_enemy() and lvl > 0 and lvl < 10 then
e:add_text("right", "NEW", color(200, 200, 200))
end
end)elusive.product == "arc-raiders"game.name() == "Arc Raiders"Player ESP hook| game.get_map() | nil (not read) |
|---|---|
| entity.get_players() | the raiders of the game state (ARC machines are entities, not players) |
| World axes | Z up, meters |
| is_enemy() | not local and not in the local player's squad |
| get_weapon() | the held item: the game's English name, weapons upper case with their tier ("RATTLER III") |
| get_health() | 0 while downed (m_bDowned, m_flDownedSeconds) |
| entity.get_entities() | "machine" (threat, velocity, weak_points + weak_point_1..8, target "you" / "teammate" / "other", alertness, combat_phase), "projectile" (grenades, missiles, ARC shells: velocity, impact, friendly, arc, radius), "loot" (category container / plant / item / cargo / activity, opened, tier, value, rarity 0 Common .. 4 Legendary, 5 ascension module, asset_id, item_category as in entity.get_catalog(), note "breaching" / "dropped"), "trap" (friendly, radius in m), "extraction" (hatch, state, can_extract, enabled, state_seconds, shutdown_at_raid_left), "quest" (objective markers), "ping" (the squad's pings while they last: name = the game's words, pinger, mine), "place" (the map's named places and threat zones: name in the game's language, english, region, size "major" / "medium" / "minor", threat 0 none, 2 high, 3 extreme), "raid" (time_left, event = the raid's event when there is one, raiders, up, downed, extracted, dead, squads) |
| entity.get_catalog() | every item of the game by its English name (weapons once per tier: "Rattler III"), category "Weapons", "Weapon mods", "Shields", "Augments", "Consumables", "Deployables", "Gadgets", "Grenades", "Materials", "Quest items", "Blueprints", "Ascended upgrades" or "Other" |
ESP elements esp.elements()
Hitboxes p:get_hitbox_position(name)
Fields p:get_prop(name), any other name gives nil
esp.flag("ON YOU", color(255, 40, 40), function(p)
return p:is_enemy() and p:get_prop("m_bAimingAtYou") == true
end)
events.esp_player:set(function(p, e)
if p:is_enemy() and p:get_prop("m_bDowned") then e:set_color(color(255, 140, 50)) end
end)
events.render:set(function()
for _, m in ipairs(entity.get_entities("machine", 80)) do
if m.target == "you" then
local s = m.origin and m.origin:to_screen()
if s then render.text(nil, s, color(255, 60, 60), "cs", m.name .. " is after you") end
end
end
end)elusive.product == "grand-theft-auto-v-enhanced"game.name() == "Grand Theft Auto V Enhanced"Player ESP hook| game.get_map() | nil (no map in GTA) |
|---|---|
| entity.get_players() | every ped of the ESP's snapshot, drawn or not: players and NPCs |
| World axes | Z up |
| is_enemy() | not you (there are no teams) |
| entity.get_entities() | "vehicle": occupants, has_player, has_local, velocity; an occupied vehicle has its first occupant's position (a meter or two off), an empty one none |
ESP elements esp.elements()
Hitboxes p:get_hitbox_position(name)
Fields p:get_prop(name), any other name gives nil
local box = ui.create("GTA Demo", "Users"):group("ESP")
local showNpc = box:checkbox("Keep NPCs on screen", true)
events.esp_player:set(function(p, e)
if not p:get_prop("IsPlayer") then
if not showNpc:get() then return e:hide() end
e:set_color(color(140, 140, 140)) -- grey out NPCs
else
e:set_color(color(255, 100, 100)) -- red for players
end
end)elusive.product == "grand-theft-auto-v-legacy"game.name() == "Grand Theft Auto V Legacy"Player ESP hook| game.get_map() | nil (no map in GTA) |
|---|---|
| entity.get_players() | every ped of the ESP's snapshot, drawn or not: players and NPCs |
| World axes | Z up |
| is_enemy() | not you (there are no teams) |
| game.view_matrix() | the clip-z row is zeros (not read); x / y projection is unaffected |
| entity.get_entities() | "vehicle": occupants, has_player, has_local, velocity; an occupied vehicle has its first occupant's position (a meter or two off), an empty one none |
ESP elements esp.elements()
Hitboxes p:get_hitbox_position(name)
Fields p:get_prop(name), any other name gives nil
local box = ui.create("GTA Demo", "Users"):group("ESP")
local showNpc = box:checkbox("Keep NPCs on screen", true)
events.esp_player:set(function(p, e)
if not p:get_prop("IsPlayer") then
if not showNpc:get() then return e:hide() end
e:set_color(color(140, 140, 140)) -- grey out NPCs
else
e:set_color(color(255, 100, 100)) -- red for players
end
end)elusive.product == "red-dead-redemption-2"game.name() == "Red Dead Redemption 2"Player ESP hook| game.get_map() | nil (no map label) |
|---|---|
| entity.get_players() | every ped of the ESP's snapshot: players, NPCs, animals (get_prop("IsPlayer") / "IsAnimal") |
| World axes | Z up |
| is_enemy() | not you (there are no teams) |
| get_name() | only on RedM; nil on single-player |
| get_weapon() | nil when the ped is unarmed |
| entity.get_entities() | none ({}): every ped, animal and horse is in get_players() |
ESP elements esp.elements()
Hitboxes p:get_hitbox_position(name)
Fields p:get_prop(name), any other name gives nil
local g = ui.create("RDR2 Demo", "Target"):group("Filters")
local showAnimals = g:checkbox("Animals", false)
events.esp_player:set(function(p, e)
if p:get_prop("IsAnimal") then
if not showAnimals:get() then return e:hide() end
e:set_color(color(120, 220, 120))
elseif not p:get_prop("IsPlayer") then
e:set_color(color(160, 160, 160)) -- NPCs
end
end)
esp.flag("LOW HP", color(255, 70, 70), function(p)
local hp = p:get_health()
return p:is_enemy() and hp ~= nil and hp > 0 and hp < 25
end)elusive.product == "halloween"game.name() == "Halloween"Player ESP hook| game.get_map() | nil (not read) |
|---|---|
| entity.get_players() | every character the ESP draws: players, bots, NPCs (get_prop("m_kind")) |
| World axes | Z up |
| is_enemy() | not local and not a teammate |
| get_weapon() | nil: the characters carry items instead (get_prop("items")) |
| entity.get_entities() | one kind per map object: "gun", "ammo", "melee", "healing", "throwable", "tool", "objective", "escape", "escape_lock", "phone", "vehicle", "hiding_spot", "container"; items have carried, carrier (a player index), in_container; escapes active, open, locks_left, locks_total; locks unlocked |
ESP elements esp.elements()
Hitboxes p:get_hitbox_position(name)
Fields p:get_prop(name), any other name gives nil
local box = ui.create("Halloween Demo", "Users"):group("Marks")
local on = box:checkbox("Items column", true)
esp.flag("KILLER", color(255, 60, 60), function(p)
return p:is_enemy() and p:get_prop("m_bKillerClass") == true
end)
events.esp_player:set(function(p, e)
if not on:get() then return end
local items = p:get_prop("items")
if items and #items > 0 then e:set_text("items", items) end
end)elusive.product == "fortnite"game.name() == "Fortnite"Player ESP hook| game.get_map() | nil (not read) |
|---|---|
| entity.get_players() | every player state of the match with a pawn: players and bots (m_bIsABot) |
| World axes | Z up, meters |
| is_enemy() | not local and not on the local player's team (same TeamIndex) |
| get_team() | the player state's TeamIndex (nil when unknown or 0) |
| get_health() | the local player only: the game does not send the others' health (nil). get_armor() is nil (the local player's shield is m_iShield) |
| get_weapon() | the held item's English name ("Assault Rifle"), nil when unknown |
| entity.get_entities() | "loot" (the loot of every level of the island the game has loaded: category "container" / "item" / "supply_drop" / "llama"; containers: already_searched, start_already_searched, loot_tier; items: rarity 0 Common, 1 Uncommon, 2 Rare, 3 Epic, 4 Legendary, 5 Mythic, 6 Exotic, stack_size, level, item_kind, item_category as in entity.get_catalog(), and when the item catalog knows the definition: definition, name_local, tier, tags), "vehicle" (cars, boats and the other vehicles: the name only) |
| entity.get_catalog() | every item the loot pages list by its English name, once per name (the rarities share it), category "Weapons", "Ammo", "Materials", "Consumables", "Traps" or "Gadgets"; {} until the item catalog is read |
ESP elements esp.elements()
Hitboxes p:get_hitbox_position(name)
Fields p:get_prop(name), any other name gives nil
esp.flag("5+ KILLS", color(255, 200, 80), function(p)
local k = p:get_prop("m_iKillScore")
return p:is_enemy() and k ~= nil and k >= 5
end)
events.esp_player:set(function(p, e)
if p:is_enemy() and p:get_prop("m_bDowned") then
e:set_color(color(255, 140, 50))
elseif p:get_prop("m_bIsABot") then
e:set_color(color(160, 160, 160))
end
end)
-- legendary and better items within 50 m
events.render:set(function()
for _, it in ipairs(entity.get_entities("loot", 50)) do
if it.category == "item" and (it.rarity or 0) >= 4 and it.origin then
local s = it.origin:to_screen()
if s then render.text(nil, s, color(255, 150, 40), "co", it.name or "item") end
end
end
end)The API version (2), the product slug ("counter-strike-2", "overwatch"…) and the build date of the cheat.
print("API v" .. elusive.api_version .. " on " .. elusive.product .. " (" .. elusive.build .. ")")Everything this state exposes, found by walking it rather than from a list kept by hand: { [name] = { kind, fields, functions, operators } }. kind is "module" (render, ui, string...), "type" (vector, color: their constructor statics and methods), "object" (player, ui_element, font...: methods and operators) or "global" (the entry "functions": print, pairs, require...). With a name, that one entry, or nil. Plain tables, safe to walk. A thread sees its own, smaller API.
Returnstable | nil
local api = elusive.list()
for name, e in pairs(api) do
if e.kind == "module" then print(name, #e.functions .. " functions") end
end
print(table.concat(elusive.list("player").functions, ", "))The same, printed to the console: one line per module without a name (fields, functions, operators), one line per function with a name (player:get_health()...). The quickest way to see what exists in the product you are on. An unknown name raises, with a hint.
elusive.dump() -- every module on one line each
elusive.dump("render") -- one function per line
elusive.dump("player") -- the methods and operators of an objectThe script's file name ("esp.lua"), its key ("local:esp.lua"), its path, and where it came from: "local", "cloud", "panel" or "autorun".
Bytes used by this script's Lua state and its cap (the "Memory per script" setting, 256 MB by default).
Returnsinteger, integer
Unloads the script once the current callback returns. Takes no argument: a script can only unload itself.
Loads the script again from its file (or the code it was loaded with) once the callback returns. A syntax error keeps the running version and is logged.
Seconds since the runtime started, the last frame's duration in seconds, the frame number, and the FPS. In a thread only globals.realtime exists.
events.render:set(function()
render.text(nil, vector(20, 20), color(255, 255, 255), "s", string.format("%d fps %.1f ms", globals.fps, globals.frametime * 1000))
end)Lines to the in-game console (Configs & scripts > Lua) and the /dashboard/live console, under the script's name. __tostring aware; a line is cut at 16 KB.
print("hello from", script.name)
log.warn("something to look at")Loads a library once per script: <scripts>\libs\name.lua, then <scripts>\name.lua ("a.b" becomes a\b.lua; a name ending in .lua is used as is), then a script followed on the site by its title (any case, libraries first). The chunk gets the name as "..."; a library that returns nothing gives true.
| Parameter | Type | Description |
|---|---|---|
| name | string | Letters, digits, "_ - . /" and spaces, 128 characters at most, no "..". |
A require loop raises. Each script has its own require cache: a library runs once per script, in that script's state.
-- <scripts>\libs\utils.lua returns { pct = function(a, b) return math.round(a / b * 100) .. "%" end }
local utils = require("utils")
print(utils.pct(1, 3)) -- 33%fn() every frame, inside the ImGui frame: the place to draw. The drawing calls of render only work here (and in events.esp_player).
events.render:set(function()
local s = render.screen_size()
render.circle(vector(s.x / 2, s.y / 2), 90, color(80, 220, 120), 1.5, 64)
end)fn(dt) every frame before drawing, with the frame duration in seconds. Logic goes here, drawing in events.render.
local t = 0
events.update:set(function(dt) t = t + dt end)
events.render:set(function()
render.text(nil, vector(20, 40), color(255, 255, 255), "s", string.format("up %.1f s", t))
end)fn() when this script unloads (unload, reload, shutdown). The last thing it runs.
events.unload:set(function() print("bye") end)fn(vk) when a key goes down / up on the game PC's keyboard (as the cheat reads it). vk is the Windows virtual-key code; see input.vk.
events.key_down:set(function(vk)
if vk == input.vk.F6 then print("F6 pressed") end
end)fn(delta) while the overlay takes the mouse (menu open).
fn() when the in-game menu opens / closes.
fn(name) after a config was loaded (name as configs.list() gives it, without .json). The menu elements' callbacks run too.
fn() when the cheat is closing.
fn(player, e) for every player the product's ESP draws, every frame, while it draws him. See the esp module for the e object.
Removes that callback from the event. Setting the same function twice does nothing; at most 256 callbacks per script across every event.
A named channel between scripts. :call(...) runs every subscriber of that name, in every script (the caller's own too), with copies of the arguments: numbers, strings, booleans, plain tables, vector and color. Functions, API objects and cyclic tables are refused. An error in a subscriber never reaches the caller.
| Parameter | Type | Description |
|---|---|---|
| name | string | 1 to 128 characters. |
| ... | values | Up to 16 arguments; 32 levels, 200,000 values, 64 MB at most. |
Custom events nest 16 deep at most. The time another script spends in its handler is not charged to the caller, up to twice the caller's budget in all.
-- script A
events.custom("kills"):set(function(n) print("A got", n) end)
-- script B
events.custom("kills"):call(12)Calls fn once after that many seconds.
Returnsa timer object: t:cancel(), t:active() -> boolean.
timer.after(2, function() print("2 s later") end)Calls fn every that many seconds (0 = every frame) until cancelled.
Returnsa timer object: t:cancel(), t:active() -> boolean.
local n = 0
local t = timer.every(0.5, function()
n = n + 1
print("tick", n)
if n >= 5 then t:cancel() end
end)Stops the timer / tells whether it still runs.
Starts fn(...) on a new thread (up to 16 arguments). A string is run as code. Inside: thread.recv, thread.send, thread.sleep, thread.stopping, thread.id, print, log, require, json, vector / color, input, common, clipboard, os, files, the libraries, and the blocking forms of network / memory / shellcode / serial / kmbox / os.execute the script's permissions allow. No render, ui, hud, events, timer, game / entity / esp or configs.
Returnsa thread object.
local t = thread.spawn(function(prefix, n)
while not thread.stopping() do
local msg = thread.recv(1)
if msg then thread.send(prefix .. msg .. " x" .. n) end
end
end, "echo: ", 3)
t:set_callback(function(v) print(v) end)
t:send("hello")Sends a value to the thread / takes one the thread sent, without waiting. send returns false when the queue is full (1024 values / 32 MB each way) or the thread has ended.
fn(value) on the render thread for each value the thread sends, before the next frame. t:set_callback(nil) removes it.
Is it still running; ask it to stop (thread.stopping() turns true); wait for it to end (0.25 s at most: the frame waits); its id.
Inside the thread: waits up to that many seconds (0 by default, 60 max) for a value from the script; sends one back.
Inside the thread: pauses (60 s max; also resets the instruction counter), tells whether the script asked it to stop, gives its id.
--@permissions memory
local result = "…"
local t = thread.spawn(function(module)
while not thread.stopping() do
local addr = memory.pattern(module, "48 8B 05 ? ? ? ? 48 85 C0", 7, 3) -- blocking: we are in a thread
thread.send(addr and string.format("0x%X", addr) or "not found")
thread.sleep(5)
end
end, "client.dll")
t:set_callback(function(v) result = v end)
events.render:set(function()
render.text(nil, vector(20, 80), color(120, 220, 120), "s", "pattern: " .. result)
end)A tab under "Scripts" in the sidebar. icon is a lucide name ("Crosshair", "Eye", "Zap"…; "Code" by default). Names are cut at 32 bytes.
Returnsa tab: tab:group(name), tab:name().
local tab = ui.create("My script", "Crosshair")
local group = tab:group("Settings")
local enabled = group:checkbox("Enabled", true)A box in that tab (name cut at 48 bytes). group:name(), group:set_visible(b) (every element of the group).
A toggle. A checkbox can take companions on the same row: enabled:color(default) and enabled:hotkey(vk, mode).
local g = ui.create("Demo"):group("Box")
local enabled = g:checkbox("Enabled", false)
local col = enabled:color(color(255, 255, 255))
local key = enabled:hotkey(0x05, "toggle") -- mouse 4, "hold" | "toggle" | "always"A slider. Integer when min, max and default are integers (unless opts.float = true), else a float. opts: { unit = "°", step = 0.05, float = true }. The default is min when omitted.
local g = ui.create("Demo"):group("Sliders")
local fov = g:slider("FOV", 1, 180, 30, { unit = "°" })
local smooth = g:slider("Smooth", 0.0, 1.0, 0.35, { step = 0.05 })A dropdown. options: 1 to 128 names; default: a name or a 1-based index. :get() gives the name, :get_index() the index.
local mode = ui.create("Demo"):group("Aim"):combo("Target", { "Closest", "Lowest health" }, 1)
print(mode:get(), mode:get_index())A multi-select. defaults: a table of names. :get() gives a table of the selected names, :get("Head") a boolean, :set("Head", true) one option.
local bones = ui.create("Demo"):group("Aim"):multi("Bones", { "Head", "Chest", "Pelvis" }, { "Head" })
if bones:get("Head") then print("head on") endA color picker (with alpha). :get() gives a color.
A keybind row: left click binds a key, right click picks the mode ("hold" | "toggle" | "always"). Listed in the keybinds HUD. :get() tells whether it is active; :key(), :mode(); :set(vk [, mode]).
local key = ui.create("Demo"):group("Keys"):hotkey("Aim key", 0x02, "hold")
events.render:set(function()
if key:get() then render.text(nil, vector(20, 60), color(255, 200, 0), "s", "aiming") end
end)A text field. opts: { hint = "placeholder" }. Text is cut at 255 bytes.
A button; fn(el) on click (in game or from /dashboard/live). Buttons have no value.
A line of text (el:set(text) changes it; cut at 255 bytes) and a rule across the box.
The value: boolean for a checkbox, number for a slider, the option's name for a combo, a table of names for a multi, a color, active? for a hotkey, its text for a label / input; nil for a button or a separator.
Changes the value: combo a name or a 1-based index, slider clamped to its range, multi a table of names or set(name, on), hotkey set(vk [, mode]), label its text. Chainable. A wrong type, a button or a separator raises.
fn(el) when the value changes (in game, from /dashboard/live or when a config loads); a button calls it on click. now = true also calls it right away. 16 per element; the same function twice is ignored; removed after running out of the time budget or raising 64 times in a row.
local fov = ui.create("Demo"):group("Aim"):slider("FOV", 1, 180, 30)
fov:set_callback(function(el) print("FOV is now", el:get()) end, true)Shown only while every condition holds: no value = truthy; checkbox true / false; combo a name or an index; multi that option selected; slider that number; input that text. 32 conditions at most.
local g = ui.create("Demo"):group("Aim")
local on = g:checkbox("Enabled", false)
local fov = g:slider("FOV", 1, 180, 30)
fov:depend(on, true) -- hidden while the box is untickedHide / show the row; grey it out while still shown. is_visible tells what is shown now (set_visible, its group, depend).
New options (1 to 128) for a combo / multi; the current choice is kept by name, else the first option. Raises on any other element.
A help bubble on the row (cut at 512 bytes); the label; the stable setting id.
One of the cheat's own settings ("aimbot.enabled"…) as the same kind of object: get, set, set_callback. Another script's element or an unknown key raises; the runtime's keys (lua.*) and menu.key are read-only.
local box = ui.find("visuals.players.box")
box:set_callback(function(el) print("box ESP:", el:get()) end, true)The menu's state, position and size (nil before the menu window exists).
A new vector. Missing components are 0.
local a = vector(10, 20)
local b = a + vector(5, 5) * 2
print(b.x, b.y, tostring(b))Lengths and distances (2d ignores z; sqr skips the square root).
Returnsnumber
The unit vector, dot and cross products, the interpolation at t (0..1), and the pitch / yaw angles the vector points at.
A world position projected with the game's camera: a screen vector, or nil off screen (always nil in a thread).
events.render:set(function()
for _, p in ipairs(entity.get_players(true)) do
local head = p:get_hitbox_position("head")
local s = head and head:to_screen()
if s then render.circle(s, 6, color(255, 255, 255), 1.5, 24) end
end
end)A copy; the three components.
A new color: a is 255 by default; a hex string (the # is optional); color(v) is a grey; color() is white.
local red = color(255, 80, 80)
local half = color("#FF505080")
print(tostring(red), half.a)From hue (0..360), saturation and value (0..1). The v1 rainbow: color.hsv(globals.realtime * 60 % 360, 1, 1).
events.render:set(function()
render.rect_filled(vector(20, 100), vector(120, 24), color.hsv(globals.realtime * 60 % 360, 1, 1), 4)
end)A copy with another alpha; the interpolation at t; "#RRGGBBAA"; the four channels; a copy.
A line between two screen vectors.
A rectangle outline / a filled rectangle. Note the order: rounding before thickness.
events.render:set(function()
render.rect_filled(vector(20, 140), vector(160, 40), color(0, 0, 0, 160), 6)
render.rect(vector(20, 140), vector(160, 40), color(255, 255, 255, 60), 6, 1)
end)A rectangle with one color per corner.
A circle outline / disc.
An arc, 0° = right, clockwise.
A triangle outline / filled.
A filled convex polygon (3 to 4096 vectors) / a line through points (2 to 4096).
Text in a font (nil: the Appearance font, the ESP's). flags: "c" centered, "r" right-aligned, "m" vertically centered, "o" outline, "s" shadow (combine them: "cs"). 64 KB of text at most.
events.render:set(function()
local s = render.screen_size()
render.text(nil, vector(s.x / 2, 20), color(255, 255, 255), "cs", "centered with a shadow")
end)The size the text would take.
An image loaded with render.load_image.
Clips what follows to a rectangle (intersect defaults to true). Balanced automatically at the end of each callback; 64 levels at most.
The overlay size. Works anywhere (0, 0 before the very first frame).
The same as v:to_screen().
A system font ("Verdana") or a .ttf / .otf / .ttc path (relative: the cheat's fonts folder; 16 MB at most). flags: "b" bold, "i" italic, "m" no antialiasing. Size 1 to 256 px. Usable from the next frame (font:ready()); the default font is drawn until then. font:size(), font:name(). 8 per script.
local font = render.load_font("Verdana", 18, "b")
events.render:set(function()
render.text(font, vector(20, 200), color(255, 255, 255), "s", "bold Verdana 18")
end)PNG / JPG / BMP / GIF, from bytes or a path (inside the script's data folder, or anywhere with the files permission). image:size() -> vector, image:unload(). 8192 x 8192 px and 64 MB encoded at most; 64 per script, counted in its memory.
Makes the window (or gives the same one again, with the new options). opts: title, icon, width (2000 max), header (false: no title bar), anchor 0-8 (0 top-left, 4 centre, 8 bottom-right), x, y.
local w = hud.window("stats", { title = "Stats", icon = "target", width = 220, anchor = 0, x = 20, y = 200 })
events.render:set(function()
w:clear()
w:row("Kills", "12", { right_color = color(120, 220, 120) })
w:bar("Health", 0.66, { text = "66" })
w:text("centered", { center = true, color = color(255, 200, 0) })
end)Items, filled again every frame after w:clear(). row opts: active, color, right_color; text opts: active, center, color; bar opts (value 0..1): text, active, color, label_color. Texts go through tostring and are cut at 256 bytes.
Retitle; change the icon (no name removes it; eye, eye_off, keyboard, users, user, list, target, clock, alert, info, star, heart, map, lock, bell, trophy, flag, zap, home, settings, code); show / hide (no argument shows); remove it (hud.window(name) again brings it back). The methods return the window, except remove.
The game's name ("Counter-Strike 2", "Overwatch 2"…), whether a match / session is running, the map when the product reads it.
The camera, row-major, the same convention in every product: clip = M * [x, y, z, 1]. vector:to_screen() already applies it.
You; every player of the snapshot (true: enemies only); the player with that index (as player:get_index() and the ESP hook give it). At most 1024 players per frame.
events.render:set(function()
if not game.is_in_game() then return end
for _, p in ipairs(entity.get_players(true)) do
local pos, size = p:get_bbox()
if pos and p:is_alive() then
render.text(nil, vector(pos.x + size.x / 2, pos.y - 14), color(255, 255, 255), "co", p:get_name() or "?")
end
end
end)The world's other things (vehicles, loot, NPCs, objectives, ARC machines…) as plain tables, copied from the lists the product already keeps, only when a script asks (once per frame). Each has kind (one of get_entity_kinds()), id (an integer, stable while it exists), name, origin (vector), distance (from the local player) and the kind's own fields (see "Per game"); a value that is not known is nil. kind keeps one category (1 to 64 bytes); max_distance keeps the ones within it. At most 16384 per frame. The tables are copies: changing one changes nothing.
A game without such lists gives {} for both (Red Dead Redemption 2: every ped is already in get_players()).
events.render:set(function()
if not game.is_in_game() then return end
for _, e in ipairs(entity.get_entities(nil, 60)) do
local s = e.origin and e.origin:to_screen()
if s then
render.text(nil, s, color(255, 220, 120), "cs", string.format("%s %s %.0fm", e.kind, e.name or "?", e.distance or 0))
end
end
end)Everything the game has of the kind the product lists, on the map or not (Rust: every item of the game, one per name, skins under their base item; category as in the menu: "Weapons", "Ammo", "Medical"…; Arc Raiders: every item of the game, category "Weapons", "Materials", "Shields"…). A fresh copy at each call: call it once, not every frame.
{} when the game has none or has not loaded it yet.
local items = entity.get_catalog()
print(#items .. " items")
for i = 1, math.min(5, #items) do
print(items[i].name, items[i].category)
endIdentity and pool. A player object stays valid while that player is in the snapshot; after that its getters return nil. Two objects for the same player are equal (==).
Booleans (false when the product has no such value).
The weapon label, the feet position in the world, the distance from the local player (nil without one).
The box the product's ESP drew him in last frame (vectors); nil when it did not: off screen, ESP off. Inside events.esp_player, e:box() is this frame's.
A bone in the world: "head", "neck", "chest", "pelvis"… The names depend on the product (see its page).
A field of the product's snapshot by its name (CS2 "m_iHealth", "m_bIsScoped"; Overwatch "m_flUltCharge"…): number, boolean, string or vector. Any other name gives nil; a name of 1 to 128 bytes.
events.render:set(function()
for _, p in ipairs(entity.get_players(true)) do
local s = p:get_origin() and p:get_origin():to_screen()
if s and p:get_prop("m_bIsScoped") then render.text(nil, s, color(0, 200, 255), "cs", "SCOPED") end
end
end)For each player the ESP draws, every frame, inside the frame: p is the player (as entity.get_player gives it), e this player's ESP for this frame. render.* works in the callback (drawn under the ESP's labels). Several scripts and callbacks can edit the same player, in order, seeing each other's changes.
e only works inside the callback it was given to: kept for later, any method raises. Texts are cut at 128 bytes; 32 texts / bars added per player per script.
events.esp_player:set(function(p, e)
local hp = p:get_health() or 0
if not p:is_enemy() or hp < 20 or hp > 50 then return e:hide() end
e:set_color(color(255, 200, 0))
e:set_weapon(string.upper(p:get_weapon() or ""))
e:add_text("right", "TARGET", color(255, 60, 60))
e:add_bar("right", hp / 100, color(255, 60, 60), 3)
end)The ESP does not draw this player this frame.
The box / skeleton / snapline color; color() gives the current one (the product's, or what an earlier callback set).
The box on screen this frame, as vectors.
events.esp_player:set(function(p, e)
local pos, size = e:box()
render.circle_filled(pos + vector(size.x / 2, -30), 4, color(255, 60, 60))
end)Replaces the text of one of the ESP's elements; id is one of esp.elements() ("name", "weapon", "health", "distance"…). An id the product does not have does nothing. set_name / set_weapon are shortcuts.
Recolors / hides one element for this player.
A label / a bar (value 0..1, width 1..10, 2 by default) on a side: "left", "right", "bottom", "top" (or 0..3). White by default.
The label name on every player for which fn(player) returns true. A real ESP element: the script gets an "ESP flags" tab with a toggle, a color and a position per flag, saved in the configs and movable in the ESP preview. opts: { side = "right", enabled = true }. 32 flags per script; names up to 64 bytes, unique in a script.
A flag whose function raises 64 times in a row is removed; when a script's flags run out of the time budget, all of them are removed.
esp.flag("LOW HP", color(255, 80, 80), function(p) return (p:get_health() or 100) < 30 end)
esp.flag("SNIPER", color(0, 200, 255), function(p) return (p:get_weapon() or ""):find("awp") ~= nil end, { side = "bottom" })The label; removes the flag (its settings are hidden, their values stay in the config; esp.flag with the same name brings it back).
The ids of the product's ESP elements ({ "health", "armor", "weapon", "ammo", "name", "distance" } in CS2…), for set_text / set_element_color / hide_element.
Held now; pressed since the last frame (does not consume the press); flips on each press.
events.update:set(function()
if input.was_pressed(input.vk.F7) then print("F7") end
end)The cursor position (0, 0 when unknown); whether it is known; whether the input source is up.
"M1", "F5", "A", "INS", "ENTER"…
The Windows virtual-key codes by name without the VK_ prefix: LBUTTON, RBUTTON, RETURN, ESCAPE, SPACE, SHIFT, CONTROL, MENU, PRIOR, NEXT, INSERT, DELETE, F1..F12, NUMPAD0..9, OEM_1… Letters and digits are their ASCII codes. Read-only.
A toast in game: kind "info" (default), "success", "warn" or "error"; seconds 4 by default (under 60); text cut at 512 bytes.
common.notify("Script loaded", "success", 3)The account name; the Unix time in seconds, with milliseconds.
The monitors of the host; the serial devices plugged in.
The saved configs (no permission) and the one loaded now (without .json).
Need the configs permission. true, or nil plus "invalid config name" / "config not found" / "not a config file" / "cannot write the file". Names: 1 to 64 bytes, no path characters, .json optional. Loading fires events.config_loaded(name) from the next frame and the menu elements' callbacks.
--@permissions configs
local ok, err = configs.load("rage")
print(ok, err)enabled: the Webradar switch; live: the server gave a link (link is set only then); viewers: how many watch now.
local s = radar.status()
print(s.live and ("Radar: " .. s.link .. ", " .. s.viewers .. " watching") or "Radar not live")A mark on the viewers' map at world x / y (the players' coordinates: an origin works). Marking the same id again moves / restyles it. opts: label (32 characters), color (a color, orange by default), shape ("pin" default, "dot", "square", "diamond", "triangle", "ring"), size (0.5 to 3), pulse (a ring keeps growing around it). Sent with every radar frame while someone watches; the viewers can hide them (World > Script marks).
64 marks per script, 256 in all (a new one past that raises); a script's marks go when it unloads. A bad id, position, shape or color raises.
local me = entity.get_local_player()
local at = me and me:get_origin()
if at then
radar.mark("here", at, { label = "Here", color = color(255, 90, 90), pulse = true })
radar.mark("north", at.x, at.y + 50, { label = "50 m north", shape = "triangle" })
endRemoves one of the script's marks (true when it had it) / all of them.
Split on a plain separator ("" = bytes; 1,000,000 pieces at most), trim, plain-text tests (not patterns), padding.
for i, part in ipairs(string.split("a,b,c", ",")) do print(i, part) endThe stock functions with a step budget per call: a catastrophic backtracking pattern raises "too slow" instead of freezing; a string.rep that is too large raises.
Lookups over the whole table (sequence and hash part); count counts every key.
A new table with a then b (b wins); fn(v, i) over 1..#t (filter gives a compacted array); a recursive copy (cycles handled, 200 levels).
local doubled = table.map({ 1, 2, 3 }, function(v) return v * 2 end)
print(table.concat(doubled, ", ")) -- 2, 4, 6The stock functions, bounded: raw length and raw reads (a lying __len has no effect), table.move 4,194,304 elements at most, table.sort 500,000 at most and safe with any comparator.
Additions to math.
64-bit integer operations (band / bor / bxor take any number of arguments). tohex: 1 to 16 digits, 8 by default, a negative count gives uppercase.
Random numbers (reversed bounds accepted), a coin with probability p, an element of a sequence, an in-place shuffle, a UUID string.
parse: null becomes nil; nesting over 500 levels raises. stringify: a 1..n table becomes an array, else an object ({} for an empty table); raises on a function / userdata, a key that is not a string or a number, keys 1 and "1" in one table, a cycle, over 200 levels, 1,000,000 values or 64 MB.
local t = json.parse('{"a": 1, "b": [1, 2, 3]}')
print(t.b[2], json.stringify({ x = 1, list = { 1, 2 } }))decode skips what is not base64 and takes the URL-safe - _ alphabet too.
Hashes: hex strings (hash is BLAKE2b-256), integers for crc32 / fnv1a.
print(crypto.sha256("hello"))Hex conversions (invalid hex gives nil); n random bytes / hex characters (1 to 4096; random_hex 32 by default); a hex key of 32 bytes.
XSalsa20-Poly1305. key: 32 bytes or 64 hex; nonce and cipher come back as hex; 256 MB at most.
Ed25519 signatures.
ECMAScript syntax: classes, \d \w \s \b, groups, (?:), |, greedy and lazy * + ? {n,m}, \xHH, \uHHHH as UTF-8; no backreferences, lookarounds or named groups (an error says so). A linear engine: any pattern answers in time proportional to the subject and never freezes. groups gives {} without a match and "" for an unused group; replace takes $1…$99, $&, $`, $', $$.
64 KiB subject and replacement, 512-byte pattern, 32 groups, {n,m} up to 1000, find_all 10,000 matches, replace result 4 MB; a step budget raises past about 0.1 s.
print(regex.find("abc123def", "[0-9]+")) -- 123
print(regex.replace("john smith", "(\\w+) (\\w+)", "$2, $1")) -- smith, johnThe file's bytes (64 MB at most). With a callback (scripts only) it returns true and cb(data | nil, err) runs later, off the render thread.
files.write("notes.txt", "hello")
print(files.read("notes.txt"))Writes (folders made, 64 MB at most) / appends.
Tests and size.
Files and folders (10,000 at most); a new folder; a file or an empty folder.
The data folder, absolute.
cb(res, err): res = { status, body, headers } or nil plus a reason. options: headers (a map or { "Name: value", ... }, 64 at most), body, timeout (1 to 60 s, 30 by default); request also takes url and method (GET, POST, PUT, PATCH, DELETE, HEAD). url: http:// or https://, 8192 bytes at most.
--@permissions network
local status = "loading…"
network.get("https://api.github.com/zen", { timeout = 10 }, function(res, err)
status = res and res.body or ("error: " .. err)
end)
events.render:set(function()
render.text(nil, vector(20, 60), color(255, 255, 255), "s", status)
end)Percent-encoding. No permission needed.
Read / write the clipboard (16 MB at most). clipboard permission.
An environment variable. os permission.
Runs cmd /c command without a window (under 8000 bytes); cb(code, output) with stdout + stderr (1 MB kept), or cb(nil, err). After 60 s the command and every process it started are stopped. In a thread, without a callback: code, output | nil, err. os permission.
--@permissions os
os.execute("echo hello", function(code, output) print(code, output) end)Whether the cheat is attached to the game. No permission needed.
The attached process (nil when not attached).
One value; nil when the address cannot be read.
--@permissions memory
local base = memory.module_base("client.dll")
if base then print(string.format("client.dll at 0x%X, first bytes 0x%X", base, memory.read_u32(base) or 0)) endThree floats as a vector; raw bytes; a string up to the first NUL (256 bytes by default, 65,536 at most).
Follows every offset but the last as a pointer (64 at most, negative ones allowed); nil on a null pointer.
Many reads in one scatter round trip (4096 entries; 4 MB in a script, 64 MB in a thread). false for an invalid or oversized entry; unreadable bytes come back as zeros; nil when not attached.
Writes.
Modules and exports of the attached process.
A scan in a module / a range (512 MB at most): cb(address | nil). "48 8B 05 ? ? ? ?" with ? wildcards; instr_len / disp resolve a RIP-relative operand. The first scan of a module reads it once and keeps a copy (memory.release_images() frees them).
--@permissions memory
memory.pattern("client.dll", "48 8B 05 ? ? ? ? 48 85 C0", 7, 3, function(addr)
print(addr and string.format("found 0x%X", addr) or "not found")
end)Listings, to the callback as arrays of tables: processes { pid, ppid, name, peb, eprocess, dtb, wow64 }; modules { name, base, entry, size, wow64 }; threads { tid, teb, start_address, win32_start_address, rip, rsp, stack_base, stack_limit, running, priority }; handles { handle, object, granted_access, handle_count, pointer_count, type, name }; sections { name, virtual_address, virtual_size, raw_size, characteristics }; imports { module, function, address }; vad { start, end, size, protection, image, file, stack, heap, priv, text }.
Writes the module to a file (in the data folder, or anywhere with the files permission): cb(boolean).
Looks for size bytes (1 B to 1 MB) of fill (0..255, 0 by default) in the module, after an address: cb(address | nil).
A jmp at from to to, over length bytes (5 to 256).
Writes code (5 B to 64 KB, ending with E9 00 00 00 00: the jump back to from + stolen) into the cave (5 B to 1 MB, at least #code) and a jmp to it at from over stolen bytes (5 to 256).
Writes back everything this script patched now; returns how many patches.
Every port / the ports that look like a device.
open: cb(true | nil, err); baud 300 to 12,000,000, 115200 by default. connect: tries the port (or the first of find_ports()), sends the probe ("km.version()" by default, "" for none): cb({ port, baud, reply [, warning] } | nil, err).
--@permissions device
serial.connect({ baud = 115200 }, function(info, err)
print(info and (info.port .. " -> " .. tostring(info.reply)) or ("no device: " .. err))
end)State of the link.
A line (CRLF appended) / raw bytes, sent without waiting; 64 KB at most.
--@permissions device
serial.command("km.move(10,0)")Sends a line and waits for the reply (100 ms by default, 5000 max): cb(reply | nil, err).
The link (timeout 1 to 2000 ms, 300 by default): cb(true | nil, err).
--@permissions device
kmbox.connect("192.168.2.188", 8808, "1234ABCD", function(ok, err)
print(ok and "kmbox ready" or ("kmbox: " .. err))
end)Mouse moves: at once, over ms, along a curve. x / y -32768..32767, ms 0..60000.
Buttons: "left", "right", "middle", "side1" / "mouse4", "side2" / "mouse5" or 0..4. hold_ms 0 to 1000 (30 by default).
Keys: a HID code (0..255) or a name, any case ("w", "space", "lctrl", "f5"…).
Blocks the physical mouse / keyboard for an axis or a key.
Monitoring of the physical inputs (port 1024..65535); the states are nil without a box.
Box management. lcd_color 0..65535; lcd_picture 20480 bytes (128 x 80) or 40960 (128 x 160) of RGB565.
The header line: a comma-separated list of files, network, clipboard, memory, device, os, configs. Without any permission a script already has the menu, drawing, the HUD, the game, input, the standard library, json / crypto / regex, files.* in its own data folder, configs.list / current, network.url_encode / url_decode, threads and events.
--@permissions network
network.get("https://api.github.com/zen", function(res, err)
print(res and res.body or err)
end)files.* outside the script's data folder, render.load_image of a path outside it, memory.dump_module outside it.
network.get / post / request.
clipboard.get / set.
memory.* (except memory.is_attached) and shellcode.*.
serial.* and kmbox.*.
os.execute and os.getenv.
configs.save / load / delete / reset.
256 MB per script by default (16 to 2048 MB setting), decoded images included. Over it: "not enough memory", and the script keeps running.
1 s per callback, 5 s for the top level. A callback that runs over is removed (even inside a pcall, or in a coroutine); 3 overruns in a minute unload the script. 64 errors in a row remove a callback or a timer.
256 event callbacks per script; custom events: names 128 bytes, 16 arguments, 16 nested; values copied between states: 32 levels, 200,000 values, 64 MB; 256 timers.
16 threads (300 M instructions without sleep / recv; 256 MB each; 1024 values / 32 MB queued each way); 64 async calls waiting, 3 running.
1024 elements, 8 tabs, 64 groups, 128 options; 16 HUD windows (64 in all), 256 items each.
100,000 shapes per frame; 4096 polygon points; 64 nested clip rects; 64 KB of text per call; fonts 256 px, 8 per script; 64 images.
Files and HTTP bodies 64 MB; JSON 1,000,000 values; regex 64 KiB subject, 512-byte pattern, about 0.1 s; console lines 16 KB.
1024 players per frame; 32 ESP flags; 32 texts / bars added per player; memory reads 1 MB (script) / 16 MB (thread), batches 4 MB / 64 MB and 4096 entries; 256 queued KMBox commands.
events.render:set(fn).
events.render:set(function()
render.text(nil, vector(20, 20), color(255, 255, 255), "s", "every frame")
end)Elements made once: ui.create(...), tab:group(...), group:checkbox(...)… read with el:get().
local group = ui.create("Aimbot"):group("Aimbot")
local enabled = group:checkbox("Enabled", false)
local fov = group:slider("FOV", 1, 180, 30)
events.render:set(function()
if enabled:get() then
local s = render.screen_size()
render.text(nil, vector(s.x / 2, 20), color(255, 255, 255), "c", "FOV " .. fov:get())
end
end)thread.spawn(fn, ...) or a long call with a callback (network.get(url, cb)…).
events.custom(name):set(fn) / events.custom(name):call(...).
timer.after(s, fn) / timer.every(s, fn) give an object: t:cancel().
events.key_down:set(fn) / events.key_up:set(fn), fn(vk).
group:checkbox / slider / combo / multi / color / hotkey / input / button / label: objects made once.
Two group:slider elements.
ui.create(name, icon) is a tab, tab:group(name) a box, group:separator() a rule.
el:tooltip(text).
el:get() / el:set(value) on the element.
ui.find("setting.key") then :get(), :set(), :set_callback().
color(r, g, b, a).
a:lerp(b, t) / c:alpha(a) / c:unpack() / color.hsv(globals.realtime * 60 * speed % 360, 1, 1).
render.line(vector(x1, y1), vector(x2, y2), col, t) / render.rect(pos, size, col, rounding, thickness) (rounding now comes before thickness) / render.circle(vector(x, y), r, ...).
render.text(font, pos, col, flags, text) (the size is the font's) / render.measure_text(font, flags, text) -> vector.
render.screen_size() -> vector.
render.poly(points, col) with vectors / render.texture(image, pos, size, tint).
render.load_font(name_or_path, size, flags) gives an object passed to render.text; font:ready(). set_esp was not carried over.
render.load_image(bytes_or_path) -> image:size(), image:unload().
vector(x, y [, z]); v:dist(w) / v:length_sqr() / v:normalized().
json.stringify / parse; crypto.to_hex / from_hex; bit.lshift / rshift.
network.get / post / request with a callback; network.url_encode / url_decode.
files.read / write / append / exists / is_dir / list / create_dir / delete. The path helpers were not carried over: use string functions.
configs.list / load / save / delete / reset / current.
common.notify(text, kind, seconds).
common.screens() / common.serial_devices() / elusive.product; globals.realtime / frametime / fps, common.unix_time().
input.is_key_down(vk) / input.was_pressed(vk) (no longer consumes the press) / input.cursor() -> vector. set_toggle and info were not carried over.
memory.* (same names); pattern, signature, modules, processes, sections, imports, threads, vad, handles, dump_module take a callback in a script; read_vec3 gives a vector and write_vec3 takes one; read_batch gives false for an invalid entry.
shellcode.* (plus shellcode.restore()); find_cave takes a callback.
serial.query(text, ms, cb) (script) or without cb (thread); serial.open(port, baud, cb) / serial.connect({ port, baud, probe }, cb).
kmbox.* (same commands; connect takes a callback; a script's commands are queued).
Removed / the switch plus --@permissions per script.