Valthrun Style Stack

Valthrun-style read stack

Architecture pattern seen in external/HV game tooling releases:

Components

Design lessons

• Split trust (loader/driver) from features (overlay)
• Version stamp every artifact (_0157087 style hashes)
• Prefer read-only features for longevity (cheat-longevity-engineering)
• UEFI loaders interact with measured boot / TPM stories

Local path

Desktop/Valthrun/Release/*

Reference architecture walkthrough (CS2-class)

Usermode layer

• Overlay window: WS_EX_LAYERED|WS_EX_TRANSPARENT|WS_EX_NOACTIVATE + SetLayeredWindowAttributes; fullscreen-exclusive targets force borderless or Present-hook rendering (imgui-overlay).
• Read abstraction: batched multi-read — collect all offsets for a frame into one read_multiple request; 1 syscall-ish transition per frame instead of hundreds. Latency budget: 16.6ms frame, keep read+draw < 3ms.
• Offset provider: consume schema (schema.json for CS2) → typed views; auto-refresh on game build stamp change; hard-fail (stop reading) on stale build to avoid garbage-driven bans.

Driver interface

• No named device object (unnamed + direct-IPC via section object or flipped IOCtl on a hidden interface); see driver-comm for ring-buffer + event design.
• Process attach by PID → CR3 cache; handle PID reuse (cache invalidation on process teardown — check EPROCESS exit flag or re-resolve on access violation).
• Provide: read_process_memory (GVA via CR3 page-walk), read_multiple, optional get_module_base (walk guest PEB/LDR via CR3 — needs two-level: read PEB, walk InLoadOrderModuleList).

Kernel read engine

• CR3 → PML4 self-walk translation (or use MmGetVirtualForPhysical on host side after resolving HPA):

HPA translate(CR3, GVA):
  for level in PML4..PT: phys = readphys(table + (idx*8)); apply mask; next
  PTE.Large -> huge page arithmetic

• Physical reads via MmMapIoSpace temp-map or direct __cpuid-checked map; batch contiguous PTEs when GVA range is 2MB-aligned.
• Keep driver read-only (no writes): removes a whole detection/telemetry class and most ban-stack exposure.

Loader story

• Service-based load leaves HKLM\SYSTEM\CurrentControlSet\Services traces + event-log 7045. Alternatives: UEFI-stage load (pre-OS, no service record; interacts with measured boot — pair tpm-attestation-research), or kdmapper-style vulnerable-driver map (adds BYOVD ban surface — byovd).
• Version-stamp every artifact; mismatched driver/DLL versions = crash reports you can't reproduce.

Detection surfaces (and counters) for external stacks

CS2-specific notes

• Schema fields (m_iHealth, m_pGameSceneNode) resolve via schema.json per build; entity list via CEntityIdentity singly-linked list.
• Valthrun-family reads: controller pawn link m_hControllerPawn, view via C_CSPlayerPawn + camera services; spread/recoil via weapon m_flRecoilIndex — server authoritative on fire, client-side ESP tier 1 (cheat-longevity-engineering).

Pair with

hypervisor-memory-introspection, driver-comm, game-hacking, tpm-attestation-research.