How to make esp for any game?

To start a new ESP web application or web site, first create a new directory named for the application, then run esp init.

This will prepare your application to run ESP by generating two configuration files and creating a dist directory to hold your rendered application.

You can now create web pages to be served by ESP. Create a test ESP page under the dist directory called dist/index.esp with the contents:

If a directory named dist is not present, esp will serve web content from the current directory. It is more secure to have only the public web documents being visible in a dist directory.

To run your application, run esp serve to serve browser requests.

You can also just run a plain esp command without arguments. It is the same as esp serve.

You can now browse to http://localhost:4000/index.esp to see the new page. The first time, there will be a brief pause as the page is compiled and saved in the cache directory. Next time, the page will be served from memory. If you modify the page, it will be transparently re-compiled. If you restart esp the cached module will be loaded and the page will not be re-compiled.

There is another way to create ESP applications and that is by installing ESP skeletons. Skeletons are integrated starter packages for ESP applications. Skeletons typically include default web pages, layouts, partial pages, stylesheets, scripts and required dependent packages for an easy, one-step launch of your web application.

Installing skeletons is easy via the Pak utility. For example, to install esp-html-skeleton.

This installs the esp-html-skeleton and all dependent packages. The skeleton includes:

Files with a .html.exp extension are files that may contain server-side Javascript that Expansive will run at development render-time. To render and server pages, run expansive.

Read more about skeletons in Application Skeletons.

The three configuration files esp.json, pak.json and expansive.json play a central role in configuring and managing the evolution of your application. Read more about these files in Configuring ESP.

The esp init and pak commands will make directories when creating an application or installing packages and generating components.

This is a guide to creating an Internal ESP for any Unity Engine game. (Source included in the Universal-Unity-ESP folder, video guide here)

If you plan to just use the source, make sure you change the DLLs (Project References), and change to your gameobject :)

NOTICE: If you have not created a Unity Internal before, I suggest you watch my tutorial that will introduce you to the basics, and give you knowledge that will be needed for this guide (ex: creating a class library, reversing gameobjects, adding references, setting up loader, etc.)

Unity Engine is one of the worlds most popular game engines, supporting a large array of platforms including Mobile, Desktop, and Console. Due to its success, many of the games you play are made in Unity, examples including Rust, Escape from Tarkov, Totally Accurate Battlegrounds, and Muck just to name a few.

Unity Engine is built on GameObjects and Components. To understand the basics of how the engine works, please refer to this slideshow

In a regular memory based ESP, the first step is to find the Entity List. The Entity List contains information on each player in the game, such as positional data, health, ammo, and more.

In our case since we are making an Internal ESP we have access to the game's GameObjects, and we can find the player GameObject and manipulate its Components directly, creating an entity loop by finding every gameobject of a type in the game scene. To find the player gameobject we need to use the software dnSpy, which will allow us to view Unity Assemblies. We simply drag in our Assembly-CSharp and Assembly-CSharp-firstpass DLLs and we can view the games classes. Then trial-and-error your way through finding the right Player class (usually it will be called something along the lines of player), as pictured below I found it for Muck. All we need is the name of the class, so once you have found it you are ready for the next step.

Instead of having to find pointers in memory to the entitylist and then getting the entity position from there, we can simply use the Transform component to get the position of the gameobject as a Vector3.

Now that we know how to get a GameObject's position, and what GameObject is our player, we can start writing our ESP. Inside of the OnGui() function we are putting our Entity Loop, which is a foreach loop that finds loaded objects of the type OnlinePlayer in the scene.

From here we can implement the player position, but before we do so we need to distinguish the difference between the pivot point of a gameObject and the origin point.

In Unity, when you are getting the transform.position of a gameObject, you are getting the location of the pivot point, not the location of the origin point. What is the difference, and why does this matter?

As you can see above to the left, the pivot point is in the middle of the player gameObject on the Y (up/down) axis; with the player model being 2 Units tall, the pivot point is at Y:1. This causes issues once we start rendering our ESP, because we want the ESP box to start at the bottom of the player and end at the head. So to fix this we need to offset the player position on the Y axis to get it to be at where the origin point should be. Some games will fix their pivot points and make them set to the feet of the player, but more often than not, you will find that the pivot point is in the center of the player, not at the origin.

Now that you understand the pivot point dilemma, we can add onto our entity loop.

In the pivotPos Vector3 we are setting it to the pivot position (gameObject.transform.position), and using that to get the playerFootPos / origin position by offsetting the pivotPos by -2f on the Y Axis (this WILL vary depending on the height of the player model in YOUR game, but for Muck, 2 works for me.) We are then doing the same for the playerHeadPos but instead of subtracting to get the feet, we are adding to the pivot position to get the head position. The Image below should visualize what is being offset, with the total height being roughly 4 Units, and from the pivot point down or up is 2 units.

A WorldToScreen function is used for converting in-game coordinates (X,Y,Z) to screen coordinates (X,Y). In memory based ESPs, you need to get the viewmatrix, and use that in the WorldToScreen function. Fortunately, Unity has a WorldToScreenPoint function that allows you to get the screenpoint of a Vector3 from a Camera component.

Time to implement it!

Inside our Entity Loop, under the player position code we wrote previously, we will create two Vector3's, that will be getting the screen position of the head and foot positions.

To render our ESP, we need to add the Render.cs class to our project, provided in the source. This will allow us to simply draw lines, boxes, and text on the screen (the functions simplify Unity's GUI functions).

We will now create a new function called DrawBoxESP() that we can call to draw the box esp from the OnGUI() function. We need to input our screen position Vector3s for our head and foot, and we will also include a Color.

Inside our newly created function we will create three floats. Height is for the height of our player, width offset is the width of our player, and width is the width of the esp box.

Now we can call DrawBox() and DrawLine() from our Render class to draw our ESP Box, and (optional) Snapline.

To change the snapline from snapping from the center of the screen to the bottom, you can change (float)(Screen.height / 2)) to (float)(Screen.height - 1)). Other than that, you can change the thickness of the Box and Line by changing the last variable which is currently at 2f.

Now we are finished with our Drawing function! Time to call it in the entity loop and we will be done!

Returning to our Entity Loop, below the w2s_footpos and w2s_headpos Vector3s, we will check that the esp box is not being drawn off screen, and then calling the DrawBoxESP() function.

In this writeup i will be showing you how to make an esp on any unity games that is il2cpp compiled. This writeup is inspired by https://github.com/ethanedits/Universal-Unity-ESP . Unity can be compiled with either il2cpp or mono. In mono, we can do mono injection for making our hacks, however, you cant do the same on il2cpp games. Instead, we will be treating il2cpp games as native applications. Lets get start

Before we start, we need to setup some things first. For this example, i will be using a slightly modified FPS Microgame by unity. By slightly modified, i added a static variable in the EnemyTurret class that points to the instance of an EnemyTurret making it easier for us to get its address. You can download my modified game here https://noobexploiter.itch.io/slightly-modified

Next, we need to dump our il2cpp game. For that we will be using il2cppdumper. After dumping the GameAssembly.dll, it will provide multiple dll’s. We will open these dll’s in dnspy.

Next, for making our esp lines, we will be using, imgui, there is already a template for hooking directx11 with imgui implementation, which we will use in this tutorial. https://github.com/rdbo/ImGui-DirectX-11-Kiero-Hook. We can now start

Inside the main.cpp, we will be making a new function called MainHack. We will put all our code in there. Then, we will call MainHack between ImGui::Begin(“ImGui Window”); and ImGui::End();

Like i said, i added a static variable in EnemyTurret class that points to the EnemyTurret Object. You can follow this tutorial to get the static variable. https://guidedhacking.com/threads/how-to-get-the-address-of-a-static-variable-in-unity-games.16246/

Just a note, instead of using 0x5C, use 0xB8 since my game is 64 bit(i forgot to compile it as 32 bit) so it is twice as big.

The EnemyTurret class Inherits from MonoBehaviour and MonoBehaviour inherits Behaviour and Behaviour inherits Component and the Component class has a function called transform which will return the Transform object of our EnemyTurret Object

The tranform class holds the position of a gameobject. We will first make our transform function and call transform to our EnemyTurret object. If you dont know how to call functions, follow this guide https://www.unknowncheats.me/wiki/Calling_Functions_From_Injected_Library_Using_Function_Pointers_in_C%2B%2B.

For the address of the function, we will be using the RVA, the RVA is the offset of the function from the GameAssembly.dll

Now we have the transform object of our turret. The Transform class in unity has a property called position which is a vector 3 that holds the position of a game object. Properties on C# can be called just like a normal function call.

But first, we need to make our own Vector3 struct. Vector 3 is just 3 float, called x,y and z.

Now we can write our own position function and call it with the transform of our turret.

In making esp, WorldToScreen is a function that transform the position of an object in a 3d world to screen coordinates. Hopefully for us, Unity has a built in worldtoscreen function in the Camera class called WorldToScreenPoint.

We need to get the current camera first. In unity, the camera class has a static property called current that returns the current camera in use.

We can call this, like a normal function call.

Now that we have camera object. We can now call the WorldToScreenPoint

WorldToScreenPoint accept a Vector3 as an argument which is the position of our target EnemyTurret Object.

This is what our code looks like now.

Now that we know where to draw, we will now begin to draw. We will be using the function AddLine of ImGui to draw a line from the bottom of the screen, to the position of the Enemy turret

In ImGui, it only accepts ImVec2 for its coordinate so we will make our ImVec2 variables first. Then we will call the AddLine Function

So lets build it, compile it, and………

Its not working. The x position of the esp line is correct. However, the y position is wrong. After some googling, i found this https://forum.unity.com/threads/worldtoscreenpoint-doesnt-work-on-y-screen-axis.34161/. Here, he said to subtract the Screen height to the y position. So lets do the same.

Build it again, inject it, and now its working fine.