Guide [Source] Play-CS Web-Based ESP — JS Box & Entity Scanner

[byte_corvus]

Spent an hour vibe-coding a functional box and name ESP for play-cs (the web-based CS clone). It’s raw, it’s a bit janky, and the projection could use some love, but the core logic for digging into the WASM heap is all there. If you're looking for a base to start reversing browser-based shooters that use Emscripten, this is it.

The script works by accessing the Module.HEAP8 buffer, scanning memory for player name signatures, and then tracking their coordinates relative to the local player. It's an external-style approach but running entirely in your browser console.

Main Features:

1. LocalPlayer Monitor: Tracks your own XYZ, angles, and health.
2. Entity Scanner: Scans the memory range

   0x400000

   to

   0x700000

   to locate other players.
3. Visuals: Primitive Box ESP, Name tags, and Distance markers.
4. Distance Calculation: Convert game units to meters for better awareness.

Technical Breakdown & Offsets:

Spoiler: Technical Details

- localBase: 0x4a43344
- hpAddr: 0x4a3fca4
- Scan Range: 0x660000 - 0x670000 (for name strings)
- Rendering: HTML5 Canvas overlay

Room for Improvement:
Since this was a quick draft, there’s plenty to optimize. If you want to take this to a "private" level, focus on:
- Implementing a proper EntityList instead of brute-force scanning.
- Fixing the WorldToScreen (W2S) logic and ViewMatrix addresses.
- Adding a Team Check to avoid targeting your own guys.
- Health check for isDead status so you don't track ghosts.

How to Use:
1. Open play-cs in your browser.
2. Open the dev console (F12).
3. Paste the code from the spoiler below and hit enter.
4. To kill the script, just run

_stopMonitor()

in the console.

Spoiler: Script Source

(function(){
// Cleanup
for(let i=1;i<9999;i++)clearInterval(i);
if(window._espCanvas)window._espCanvas.remove();
 
// Constants
const heap=window.Module?.HEAP8||window.HEAP8;
const view=new DataView(heap.buffer);
const bytes=new Uint8Array(heap.buffer);
const localBase=0x4a43344;
const hpAddr=0x4a3fca4;
const FOV=90;
const UNIT_TO_METER=0.025;
const SCAN_START=0x400000;
const SCAN_END=0x700000;
 
// Variables
let SW=window.innerWidth;
let SH=window.innerHeight;
let enemies=[];
let canvas, ctx;
 
// Screen update
function updateScreen(){
SW=window.innerWidth;
SH=window.innerHeight;
const dpr=window.devicePixelRatio||1;
canvas.width=SW*dpr;
canvas.height=SH*dpr;
canvas.style.width=SW+"px";
canvas.style.height=SH+"px";
ctx.setTransform(dpr,0,0,dpr,0,0);
}
 
// Get view matrix
function getViewMatrix(){
    // Using the viewmatrix addresses you found
    const addr = 0x8c; // Your discovered address
    let m = [];
    for(let i=0;i<16;i++){
        m[i] = view.getFloat32(addr + i*4, true);
    }
    return m;
}
 
// Simple WorldToScreen
function worldToScreen(pos3D, screenWidth, screenHeight){
    const m = getViewMatrix();
    
    const lx = view.getFloat32(localBase+8,true);
    const ly = view.getFloat32(localBase+12,true);
    const lz = view.getFloat32(localBase+16,true);
    
    const dx = pos3D.x - lx;
    const dy = pos3D.y - ly;
    const dz = pos3D.z - lz;
    
    let clip = [];
    clip[0] = dx*m[0] + dy*m[4] + dz*m[8] + m[12];
    clip[1] = dx*m[1] + dy*m[5] + dz*m[9] + m[13];
    clip[2] = dx*m[2] + dy*m[6] + dz*m[10] + m[14];
    clip[3] = dx*m[3] + dy*m[7] + dz*m[11] + m[15];
    
    if(clip[3] < 0.1) return null;
    
    const ndcX = clip[0]/clip[3];
    const ndcY = clip[1]/clip[3];
    
    return {
        x: (ndcX + 1.0) * 0.5 * screenWidth,
        y: (1.0 - ndcY) * 0.5 * screenHeight,
        z: clip[2]/clip[3]
    };
}
 
function worldToScreenOld(lx,ly,lz,pitch,yaw,wx,wy,wz){
let yawRad=yaw*Math.PI/180;
let pitchRad=pitch*Math.PI/180;
let dx=wx-lx;
let dy=wy-ly;
let dz=wz-lz;
let cosYaw=Math.cos(yawRad);
let sinYaw=Math.sin(yawRad);
let cosPitch=Math.cos(pitchRad);
let sinPitch=Math.sin(pitchRad);
let fx=cosPitch*cosYaw;
let fy=cosPitch*sinYaw;
let fz=-sinPitch;
let rx=-sinYaw;
let ry=cosYaw;
let rz=0;
let ux=sinPitch*cosYaw;
let uy=sinPitch*sinYaw;
let uz=cosPitch;
let camX=dx*rx+dy*ry+dz*rz;
let camY=dx*ux+dy*uy+dz*uz;
let camZ=dx*fx+dy*fy+dz*fz;
if(camZ<=0.01)return null;
let aspect=SW/SH;
let scaleY=(SH/2)/Math.tan(FOV*Math.PI/360);
let scaleX=scaleY*aspect;
let sx=SW/2-(camX/camZ)*scaleX;
let sy=SH/2-(camY/camZ)*scaleY;
return{x:sx,y:sy,depth:camZ};
}
 
// Find players (with timeout protection)
function findPlayers(){
const needle=[92,110,97,109,101,92];
const names=[];
 
// Your original name search range
for(let i=0x660000;i<0x670000;i++){
let ok=true;
for(let j=0;j<6;j++){
if(bytes[i+j]!==needle[j]){ok=false;break;}
}
if(!ok)continue;
let name="";
let addr=i+6;
for(let k=0;k<32;k++){
const c=bytes[addr+k];
if(c===0||c===92||c<32||c>126)break;
name+=String.fromCharCode(c);
}
if(name.length<2)continue;
names.push(name);
}
 
// Your original position search with timeout protection
const players=[];
const startTime=Date.now();
names.forEach(name=>{
const enc=[];
for(let i=0;i<name.length;i++)enc.push(name.charCodeAt(i));
// Limited position search (faster)
for(let i=SCAN_START;i<SCAN_END;i+=4){ // Use defined range instead of full memory
if(Date.now() - startTime > 500) return players; // Longer timeout
let ok=true;
for(let j=0;j<enc.length;j++){
if(bytes[i+j]!==enc[j]){ok=false;break;}
}
if(!ok)continue;
const x=view.getFloat32(i+132,true);
const y=view.getFloat32(i+136,true);
if(Math.abs(x)>50&&Math.abs(x)<8192&&Math.abs(y)>50&&Math.abs(y)<8192){
players.push({name:name,addr:i});
break;
}
}
});
return players;
}
 
// Refresh players - only update if changed
function refreshPlayers(){
const newEnemies=findPlayers();
// Only update if players changed (new player joined/left)
if(newEnemies.length !== enemies.length || 
   newEnemies.some((e,i)=> !enemies[i] || e.name !== enemies[i].name)){
enemies=newEnemies;
}
}
 
// One-time player search on startup
function initialPlayerSearch(){
enemies=findPlayers();
}
 
// Main loop
function loop(){
ctx.clearRect(0,0,SW,SH);
 
// Local player data
const lx=view.getFloat32(localBase+8,true);
const ly=view.getFloat32(localBase+12,true);
const lz=view.getFloat32(localBase+16,true);
const pitch=view.getFloat32(localBase+20,true);
const yaw=view.getFloat32(localBase+24,true);
const hp=view.getInt32(hpAddr,true);
 
// HP display
ctx.fillStyle="lime";
ctx.font="bold 14px Arial";
ctx.textAlign="left";
ctx.fillText("HP:"+hp+" | Enemies:"+enemies.length,10,20);
 
// Draw enemies
for(let i=0;i<enemies.length;i++){
const e=enemies[i];
const ex=view.getFloat32(e.addr+132,true);
const ey=view.getFloat32(e.addr+136,true);
const ez=view.getFloat32(e.addr+140,true);
 
// Skip invalid coords
if(!isFinite(ex)||!isFinite(ey)||!isFinite(ez))continue;
 
// Élő játékos ellenőrzése (a te scripted logikájával)
if(!(Math.abs(ex)<8192&&Math.abs(ey)<8192&&(Math.abs(ex)>10||Math.abs(ey)>10))){
continue; // Halott játékos
}
 
// Skip local player
const selfDist=Math.hypot(ex-lx,ey-ly,ez-lz);
if(selfDist<5)continue;
 
// World to screen (back to your working original function)
const head = worldToScreenOld(lx,ly,lz,pitch,yaw,ex,ey,ez+32);
const feet = worldToScreenOld(lx,ly,lz,pitch,yaw,ex,ey,ez-40);
 
if(!head || !feet) continue; // Skip if projection fails
 
// Calculate distance
const dx=ex-lx;
const dy=ey-ly;
const dz=ez-lz;
const dist=Math.sqrt(dx*dx+dy*dy+dz*dz);
const meters=dist*UNIT_TO_METER;
 
// Draw box
const h=Math.abs(feet.y-head.y);
const height=Math.max(25,Math.min(h,200));
const width=height*0.45;
const x=head.x;
const y=head.y;
 
ctx.strokeStyle="rgba(255,50,50,0.95)";
ctx.lineWidth=2;
ctx.strokeRect(x-width/2,y,width,height);
 
// Draw name
ctx.fillStyle="white";
ctx.font="bold 12px Arial";
ctx.textAlign="center";
ctx.fillText(e.name,x,y-6);
 
// Draw distance
ctx.fillStyle="yellow";
ctx.font="11px Arial";
ctx.fillText(meters.toFixed(1)+" m",x,y+height+12);
 
// Draw head dot
ctx.fillStyle="red";
ctx.beginPath();
ctx.arc(x,y,3,0,Math.PI*2);
ctx.fill();
}
 
requestAnimationFrame(loop);
}
 
// Setup canvas
canvas=document.createElement("canvas");
canvas.style.position="fixed";
canvas.style.top="0";
canvas.style.left="0";
canvas.style.pointerEvents="none";
canvas.style.zIndex="99999";
document.body.appendChild(canvas);
ctx=canvas.getContext("2d");
updateScreen();
window._espCanvas=canvas;
 
// Event listeners
window.addEventListener("resize",updateScreen);
 
// One-time player search with delay to avoid freeze
setTimeout(initialPlayerSearch, 1000); // Longer delay to be safe
 
// Optional: refresh every 30 seconds to catch new players
// setInterval(refreshPlayers, 30000);
 
// Start loop
loop();
 
// Stop function
window._stopMonitor=function(){
if(window._espCanvas)window._espCanvas.remove();
};
 
})();

While others are struggling to find offsets in modern AC-protected builds, experimenting with these web-clones is a great way to sharpen your memory-reading skills without the headache of kernel-level obstacles.

anyone found a cleaner way to grab the viewmatrix for this build?