Valthrun Documentation

The Valthrun overlay for Counter-Strike 2 provides several gameplay enhancements:

• External Radar: Ability to publish game state to radar.valth.run.
• Player ESP: Configurable visuals including Skeletons, 3D Boxes, and 2D Boxes. Includes player health, health bars, and weapon info with configurable colors for enemies and teammates.
• Bomb Info: Displays time until detonation, defuse timers, and the bomb site location.
• Trigger Bot: Automatically shoots enemies or teammates when they enter the crosshair.
• Spectator Info: Lists players currently watching the user or the observer target.
• Stream Proof: The overlay is hidden by default during screen shares.

Valthrun is an open-source, external, read-only, kernel-level gameplay enhancer for Counter-Strike 2. It is designed for maximum stealth and invisibility by adhering to the following principles:

• External: No DLLs are injected into the target process.
• Read-Only: It does not write to the CS2 process memory, making it undetectable by process memory scanning.
• Kernel-Level: It avoids user-level WinAPIs to retrieve information from the CS2 process.

Note: Valthrun is not a 'plug and play' solution and requires specific setup steps found in the 'Getting Started' documentation.

To maintain transparency and prevent detection by the operating system or external software, the Zenith Driver does not expose a fixed or predictable communication interface. Instead, it uses a unique authentication mechanism based on the Valthrun Portal account.

When the Zenith Driver and User Mode Interface are downloaded, a unique 'magic token' is generated and embedded into both. For any communication to be successful, the user-mode application must include this magic token in its request parameters. If the token is missing or incorrect, the driver remains completely silent and does not respond, ensuring the driver remains undetectable to unauthorized probes.

The Valthrun Usermode Driver is a memory driver designed specifically for development purposes. It utilizes NtReadVirtualMemory and NtWriteVirtualMemory to read from and write to the memory of other processes.

Critical Constraints:

• Security/Stealth: It does not provide the security or stealth capabilities found in the Kernel or Zenith Drivers.
• Usage: It should only be used for development or with unprotected processes.
• Distribution: The driver is not distributed as a pre-compiled binary; users must compile it from the source code.

Valthrun uses offsets (integer displacements from the start of a data structure) to retrieve CS2 gameplay data. Because CS2 updates can change variable positions, offsets must be updated. Valthrun employs three methods for resolving offsets:

1. Schema System: Used for variables shared between server and client (formerly netvars). These are the most frequent targets for updates.
2. Pattern Scanning: Used for local client data (e.g., player bone states). This is generally reliable across versions but can break.
3. Hard-coded Offsets: Used when patterns are infeasible. These are the least likely to change but require manual updates if they do.

Valthrun is a suite of tools for enhancing gaming experiences by extracting and displaying game-related data from another application's memory. To function, any Valthrun enhancer requires three core components:

1. The Enhancer: The user-mode application providing game-specific features (e.g., overlays or radar clients).
2. The Driver: A component that enables reading the memory of other processes. Implementations vary by stealth level, including kernel-mapped drivers and Hyper-V VMM-based drivers (e.g., Zenith).
3. The Driver Interface: A dynamic-link library (DLL) that abstracts the driver's implementation and provides a unified API for the enhancer application.