warface-dma

KO | EN

gitlite — search

#javascript #typescript #go #android #linux #docker #nodejs #java #windows #awesome-list #security #pytorch #ios #openai

(★ 13)

A DMA-based external cheat framework written in C++20. PCILeech/MemProcFS for memory access, KmBox (Pro/Net/Makcu) for input emulation, ImGui UI with a custom widget system, self-registering JSON config, and remote keyboard reading via gafAsyncKeyState.

warface-dma Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# K7

A DMA-based external cheat framework written in C++20. Uses PCILeech/MemProcFS for direct memory access, supports multiple KmBox devices for input emulation, and provides a full ImGui-based UI with config serialization, remote keyboard reading, and a structured feature/widget system.

> ⚠️ **For educational and research purposes only.**

---

## Architecture

The project is split into several independent subsystems. Each layer has a single responsibility and does not depend on implementation details of other layers.

```
K7
├── vmm/                        # MemProcFS wrapper
│   ├── VMMContext               # Singleton handle + target process
│   ├── VMMProcess               # Per-process read/write/scatter/EAT
│   └── VMMScatter               # Batched scatter read/write
│
├── kmbox/                      # Input emulation
│   ├── IBasicKmBox              # Abstract interface: connect, move, click
│   ├── KmBoxPro                 # COM port (CH340, Lua commands)
│   ├── KmBoxMakcu               # KmBoxPro subclass, dual COM ID search
│   ├── KmBoxNet                 # UDP socket, packet-based protocol
│   └── KmBoxManager             # Singleton device registry
│
├── keyboard/                   # Remote keyboard state
│   └── RemoteKeyboard           # gafAsyncKeyState via EAT or SessionState
│
├── config/                     # Config system
│   ├── IJsonSerializable        # Base serialization interface
│   ├── BasicConfigVar<T>        # Typed value with OnChangeCallback
│   ├── BasicConfigEntity        # Named container for vars + options
│   ├── BasicConfigOption        # Entity with built-in `enabled` var
│   ├── BasicConfigCategory      # Top-level category
│   └── Config                   # Root: weapon/player/visuals/settings
│
├── graphics/                   # UI layer
│   ├── Graphics                 # Main loop, ImGui frame, vsync
│   ├── GraphicsPlatformContext  # DirectX11 + WinAPI window
│   ├── InterfaceContext         # FontsManager + ImagesManager
│   ├── BasicFrame               # Abstract frame base
│   ├── BasicContentFrame        # Content frame with header + scrollable body
│   ├── InnerContentFrame        # Smooth-scrolling inner panel
│   ├── BasicWidget<T>           # Typed widget with theme + disable condition
│   ├── WidgetBoard              # Label + main widget + tool widgets row
│   └── ContentFramesManager     # Frame registry by EContentFrame enum
│
└── features/                   # Game feature base
    ├── IBasicFeature            # Execute() interface
    └── BasicWeaponFeature       # Weapon feature with category + disable guard
```

---

## Subsystems

### VMM layer

`VMMProcess` wraps all MemProcFS calls behind a clean typed API:

```cpp
// Typed single read
auto health = process.ReadMemory<float>(address);

// Buffer read with flags
process.ReadBuffer(address, buffer, size, VMMDLL_FLAG_NOCACHE);

// Scatter — batch multiple reads in one DMA transaction
auto scatter = process.CreateMemoryScatter();
scatter.AddReadRequest<float>(addr1, &val1);
scatter.AddReadRequest<int>(addr2, &val2);
scatter.ExecuteReadRequests();
```

### Remote keyboard

`RemoteKeyboard` reads `gafAsyncKeyState` from kernel memory via DMA — no interaction with the target machine's input stack. It tries two methods to locate the bitmap:

**EAT scan** — reads `win32kbase.sys` export table from `winlogon.exe` context via `VMMDLL_Map_GetEATU`.

**SessionState walk** — reads `USER_SESSION_STATE` from `csrss.exe` via `gSessionGlobalSlots` offset in `win32ksgd.sys` or `win32k.sys` (Windows 11 aware).

The bitmap is updated in a background thread every 50ms behind a `shared_mutex`, so all readers are non-blocking:

```cpp
if (RemoteKeyboard::GetInstance().IsKeyActive(keybind)) {
    // held or toggled, depending on keybind.mode
}
```

### KmBox abstraction

Three device types share a single interface:

```cpp
class IBasicKmBox {
    virtual bool Connect() = 0;
    virtual bool MoveMouse(int x, int y, int pollingTime) = 0;
    virtual bool ClickLeftMouseButton() = 0;
};
```

`KmBoxPro` sends Lua commands over COM port (`km.move(x,y,1)\r\n`). `KmBoxMakcu` inherits `KmBoxPro` and extends `Connect()` to search both CH340 and CH343 COM IDs. `KmBoxNet` communicates via UDP with a custom packet protocol — handshake, mac/rand/packetId header, response validation.

`KmBoxManager` is a singleton holding `unique_ptr<IBasicKmBox>` — swapping device type at runtime is one `RegisterPortable`/`RegisterNet` call.

### Config system

The config system is built on a self-registering hierarchy:

```
IJsonSerializable
└── BasicConfigEntity          (name, vars map, options map)
    ├── BasicConfigOption      (entity + enabled var)
    └── BasicConfigCategory    (entity, groups vars/options by domain)
        ├── WeaponConfigCategory
        ├── PlayerConfigCategory
        ├── VisualsConfigCategory
        └── SettingsConfigCategory
```

Each concrete category registers its own fields in `RegisterObjects()`:

```cpp
void WeaponConfigCategory::RegisterObjects()
{
    RegisterVar("noBolt",   &noBolt);
    RegisterVar("noRecoil", &noRecoil);
    RegisterOption(&aimbot);
    RegisterOption(&triggerbot);
}
```

`ToJson`/`FromJson` in `BasicConfigEntity` iterate the registered maps — no per-field serialization code needed in subclasses. `BasicConfigVar<T>` supports `OnChangeCallback` and `operator T()` for transparent use in feature code.

POD types serialize via `NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE`:

```cpp
NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(Color, r, g, b, a)
NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(Keybind, key, mode)
NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(KmBoxNetData, port, uuid, address)
```

### Widget system

`IBasicWidget` → `BasicWidget<T>` — every widget carries a typed theme struct (`T : BasicWidgetTheme`) and an optional `DisableCondition`.

`WidgetBoard` composes a label, a main widget, and optional tool widgets into a single right-aligned row:

```cpp
CREATE_WIDGET_BOARD(boards, "No Recoil", toggleWidget, keybindWidget);
```

`ContentFramesManager` maps `EContentFrame` enum values to `unique_ptr<BasicContentFrame>` — rendering the active tab is a single `Render(frameId)` call.

`InnerContentFrame` implements framerate-independent smooth scrolling with a configurable easing factor and clamped scroll target.

### Pointer decoding

`annotations.hpp` provides a `Decoder` class and macros for working with XOR/ADD/SUB-encoded pointers common in anti-cheat protected games:

```cpp
auto player = DECODE_PTR(CPlayer, 0x120, xorKey, DecodeOperator::XOR);
auto entity = DECODE_PTR_ABSOLUTE(CEntity, absoluteAddr, key, DecodeOperator::SUB);
```

Read/write macros use `VMMContext` directly with offset or absolute address:

```cpp
READ_OFFSET(float, 0x120)
WRITE_TO_ADDRESS(int, address, value)
```

---

## Requirements

- Windows 10/11 x64
- PCIe DMA card + PCILeech firmware
- MemProcFS / vmmdll
- DirectX 11
- ImGui, spdlog, nlohmann/json, imgui_freetype
- MSVC with C++20 (`/std:c++20`)

---

## Disclaimer

This project is intended for **educational and research purposes only**. Do not use on systems you do not own or have explicit permission to test.

warface-dma

warface-dma Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

warface-dma

warface-dma Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README