RastProxy88/Vivid-R6-Cracked-2026

# 🎯 R6S-External-Cheat | 用于《彩虹六号：围攻》的高级外部内存分析工具 ## 📋 目录 - [概述](#-overview) - [功能](#-features) - [技术规格](#-technical-specifications) - [架构](#-architecture) - [快速开始](#-quick-start) - [安装](#-installation) - [使用](#-usage) - [API 参考](#-api-reference) - [偏移转储格式](#-offset-dump-format) - [贡献](#-contributing) - [发行说明](#-release-notes) - [许可证](#-license) ## 🔭 概述 **R6S-External-Cheat** 是一个专门为育碧《彩虹六号：围攻》设计的复杂外部内存操作框架。该工具包完全在用户模式下运行，不包含任何内核组件，利用高级 Windows API 调用和手工优化的汇编例程执行内存自省，具有最小的检测面。 ### 核心指标 | 参数 | 值 | |-----------|-------| | **目标应用** | `RainbowSix.exe` / `RainbowSix_BE.exe` (Steam, Uplay, Epic) | | **支持版本** | `Y8S4.2` — `Y9S2.1` | | **内存访问方法** | 通过直接系统调用存根调用 `NtReadVirtualMemory` / `NtWriteVirtualMemory` | | **系统调用号** | `NtReadVirtualMemory = 0x3F`, `NtWriteVirtualMemory = 0x3A` (Win10 22H2) | | **覆盖层技术** | DirectX 11 外部覆盖层 (`D3D11_CREATE_DEVICE_BGRA_SUPPORT`) | | **窗口模式** | 覆盖层使用 `WS_EX_LAYERED` + `WS_EX_TRANSPARENT` + `WS_EX_TOPMOST` | | **读取延迟** | `1.4 µs ± 0.3 µs` | | **写入延迟** | `2.1 µs ± 0.4 µs` | | **覆盖层帧率** | `144 Hz` (无上限，与 `DwmFlush` 同步) | | **检测向量** | 仅外部，不在目标中创建线程，无 DLL 注入 | | **二进制大小** | `~312 KB` (Release x64) | ## ✨ 功能 ### 🎯 核心功能 - **ESP (超感官知觉)** - 2D 方框渲染，厚度 `1.5 像素` - 角落方框模式 (角落长度 `8.0 像素`，厚度 `2.0 像素`) - 基于距离的透明度 (`alpha = max(0.3, 1.0 - distance / 50.0)`) - 通过骨骼位置插值进行骨骼渲染 (19 个骨骼，线性插值系数 `0.5`) - 生命值条，带颜色渐变 (`#00FF00` → `#FFFF00` → `#FF0000`) - **Aimbot 模块** - 通过 `SendInput` 模拟鼠标事件，使用 `MOUSEEVENTF_MOVE` + `MOUSEEVENTF_ABSOLUTE` - 使用点积进行视场角检查：`cos_angle = dot(view_direction, target_direction) / (|view| * |target|)` - 视场角半径：可调 `1.0°` — `15.0°`，默认 `5.0°` - 平滑系数：`0.5x` — `10.0x` (线性插值步数) - 骨骼瞄准：`Head(0)`, `Neck(1)`, `Chest(4)`, `Pelvis(15)` - 后坐力补偿表 (Y9S2 武器数据，47 种武器) - **内存操作** - 实体列表遍历：链式 `[[RainbowSix.exe + GameManager] + 0xF0] + EntityList] + index * 0x8` - 视图矩阵获取：`RainbowSix.exe + ViewMatrix` (偏移量针对每个构建版本验证) - NoWrite 模式：只读操作，在目标进程中零内存修改 - **安全特性** - 通过 `OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION)` 获取的外部句柄 - 系统调用存根在运行时生成，`syscall_number` 通过 `VirtualProtect` + `WriteProcessMemory` 对自身进行修补 - 窗口类名按会话随机化 (16 字节，基于 GUID 生成) - 无永久钩子，无 VTable 修改，无导入地址表修补 - 句柄加密存储在 `.bss` 段 (启动时从 `RDTSC` 获取 XOR 密钥) ## 📊 技术规格 ### 内存布局 (Y9S2 Build 24598765) | 偏移 (十六进制) | 大小 (字节) | 描述 | |-------------|-------------|-------------| | `0x08` | `8` | `DWORD64` — 填充 / 对齐 | | `0x18` | `4` | `DWORD` — 实体类型标志 (`0x02` = 干员) | | `0x48` | `4` | `INT32` — 队伍 ID (`1` = 进攻方, `2` = 防守方) | | `0x68` | `4` | `INT32` — 生命值 (0–145，取决于干员) | | `0x80` | `12` | `Vec3` — 头部位置 (X, Y, Z, 每个 `float` 4 字节) | | `0x90` | `12` | `Vec3` — 脚部位置 | | `0xE0` | `12` | `Vec3` — 速度向量 | | `0x110` | `4` | `FLOAT` — 视角 X (偏航角，弧度) | | `0x114` | `4` | `FLOAT` — 视角 Y (俯仰角，弧度) | | `0x148` | `4` | `BOOL32` — 是否开镜瞄准 | | `0x188` | `4` | `BOOL32` — 是否可见 (由游戏引擎计算) | ### 实体计数限制 - 最大玩家数：`10` (5v5) - 最大实体总数：`2048` (包括无人机、小工具、路障) - 观战者列表：偏移 `EntityList + 0x160`，大小 `4` 字节，观战者数量 ### 骨骼 ID ``` Head = 0 Neck = 1 LeftShoulder = 2 RightShoulder = 3 Chest = 4 Spine = 5 Pelvis = 15 LeftHand = 20 RightHand = 21 LeftFoot = 22 RightFoot = 23 ``` ## 🏗 架构 ``` R6S-External-Cheat/ ├── src/ │ ├── main.cpp # Entry point, window creation │ ├── memory/ │ │ ├── memory_manager.h # Memory read/write interface │ │ ├── memory_manager.cpp # NtReadVirtualMemory syscall implementation │ │ ├── offsets.h # Game offset definitions │ │ └── syscall_stub.asm # x64 syscall gate (mov r10, rcx; mov eax, #; syscall; ret) │ ├── overlay/ │ │ ├── d3d11_renderer.h # DirectX 11 overlay rendering │ │ ├── d3d11_renderer.cpp # Device, context, swapchain creation │ │ └── font.h # ImGui font atlas │ ├── features/ │ │ ├── esp.h # ESP logic (box, skeleton, health) │ │ ├── esp.cpp # World-to-screen transform + draw │ │ ├── aimbot.h # Aimbot module │ │ ├── aimbot.cpp # FOV check + smooth aim │ │ └── recoil_control.h # Recoil patterns table │ ├── math/ │ │ ├── vector3.h # Vec3 (x, y, z) │ │ ├── vector3.cpp # Dot product, cross product, distance │ │ ├── matrix4x4.h # 4x4 column-major matrix │ │ └── matrix4x4.cpp # World-to-screen projection │ ├── utils/ │ │ ├── config.h # Configuration (.json parsing via nlohmann) │ │ ├── logger.h # File logging (spdlog) │ │ └── xorstr.hpp # Compile-time string encryption │ └── sdk/ │ ├── rainbow6.h # Game structures │ └── win32.h # Windows API wrappers ├── offsets/ │ ├── y8s4_offsets.json # Y8S4.2 offset dump │ ├── y9s1_offsets.json # Y9S1.0 offset dump │ └── y9s2_offsets.json # Y9S2.1 offset dump (current) ├── deps/ │ ├── imgui/ # Dear ImGui v1.90.1 (docking branch) │ ├── nlohmann/ # JSON parser v3.11.2 │ └── spdlog/ # Logger v1.12.0 ├── scripts/ │ ├── build.bat # MSBuild compilation script │ ├── offset_dumper.ps1 # PowerShell offset scanner (IDA pattern matching) │ └── sign_binary.ps1 # Optional Authenticode signing ├── config/ │ ├── default_config.json # Default settings │ └── recoil_patterns.json # Recoil data for 47 weapons ├── CMakeLists.txt # CMake configuration (Visual Studio 2022) ├── LICENSE # MIT License └── README.md # This file ``` ### 系统调用存根实现 (x86-64 汇编) ``` ; syscall_stub.asm ; Build: ml64.exe /c syscall_stub.asm /Fo:syscall_stub.obj .CODE PUBLIC SyscallStub SyscallStub PROC mov r10, rcx ; Nt* functions expect first param in r10 mov eax, 3Fh ; syscall number (patched at runtime) syscall ; transition to kernel mode ret ; return to caller (ntdll-style) SyscallStub ENDP END ``` ### 内存读取函数 ``` // memory_manager.cpp template T read_memory(uintptr_t address) { T buffer{}; SIZE_T bytes_read = 0; // Direct syscall to NtReadVirtualMemory (0x3F) NTSTATUS status = syscall_stub( process_handle, // HANDLE (rcx → r10) reinterpret_cast(address), // PVOID (rdx) &buffer, // PVOID (r8) sizeof(T), // SIZE_T (r9) &bytes_read // PSIZE_T (stack) ); if (!NT_SUCCESS(status) || bytes_read != sizeof(T)) { return T{}; // zero-initialized on failure } return buffer; } ``` ## 🚀 快速开始 ### 前置条件 - **操作系统：** Windows 10 21H2+ / Windows 11 22H2+ (仅 x64) - **GPU：** 兼容 DirectX 11 (功能级别 11_0) - **构建工具：** Visual Studio 2022 (v143 工具集)，支持 C++17 - **SDK：** Windows 10 SDK 10.0.22621.0 - **游戏：** 《彩虹六号：围攻》 (Steam, Uplay 或 Epic Games Store) ### 启动 (3 步) ``` # so they might be in a technical document. git clone --recursive https://github.com/R6S-External/R6S-External-Cheat.git cd R6S-External-Cheat # - I'll check the instruction again: "Keep all professional terms, proper nouns, tool/library/framework names, and technical jargon in their original English form." So for "Clone repository", both "Clone" and "repository" are technical terms in Git, so keep them in English. .\scripts\build.bat Release x64 # - Therefore, "Step 1: Clone repository" -> "第1步：Clone repository" .\build\Release\R6S-External.exe ``` **预期输出：** ``` [R6S-External v2.8.3] Initializing... [Memory] Acquired handle to RainbowSix.exe (PID: 8724, HANDLE: 0x1A4) [Overlay] DirectX 11 device created (1920x1080, 144Hz) [Renderer] ImGui initialized (D3D11 backend) [ESP] Ready — 10 players detected [Aimbot] FOV: 5.0°, Target bone: Head, Smooth: 3.5x [CONFIG] Loaded from config/default_config.json [READY] Overlay active — press INSERT to toggle menu ``` ## 📦 安装 ### 从预构建版本安装 从 [Releases](#-release-notes) 下载 `R6S-External-v2.8.3-stable.zip` (2.4 MB) ``` # 2. "Step 2: Build Release binary" Expand-Archive R6S-External-v2.8.3-stable.zip -DestinationPath C:\R6S-External\ # - "Step 2" -> "第2步" C:\R6S-External\R6S-External.exe ``` ### 从源代码安装 ``` git clone --recurse-submodules https://github.com/R6S-External/R6S-External-Cheat.git cd R6S-External-Cheat cmake -B build -G "Visual Studio 17 2022" -A x64 -DCMAKE_BUILD_TYPE=Release cmake --build build --config Release .\build\Release\R6S-External.exe ``` ### 配置 编辑 `config/default_config.json`： ``` { "esp": { "box_type": "corner", "box_thickness": 2.0, "skeleton_enabled": true, "health_bar": true, "max_distance_m": 150.0 }, "aimbot": { "enabled": false, "fov_degrees": 5.0, "smooth_factor": 3.5, "target_bone": 0, "aim_key": "VK_RBUTTON" }, "overlay": { "vsync": true, "target_fps": 144 } } ``` ## 💻 使用 ### 游戏内命令 | 按键 | 操作 | |-----|--------| | `INSERT` | 切换覆盖层菜单 | | `DELETE` | 卸载覆盖层 (干净退出) | | `END` | 紧急终止 | | `F1` | 切换 ESP | | `F2` | 切换骨骼显示 | | `F3` | 切换 Aimbot | | `F4` | 循环切换瞄准骨骼 (头部 → 颈部 → 胸部) | | `F5` | 增加视场角 (+1°) | | `F6` | 减少视场角 (-1°) | ### 示例：读取实体数据 ``` #include "memory/memory_manager.h" #include "sdk/rainbow6.h" int main() { auto mem = MemoryManager(); // Attach to game mem.attach(L"RainbowSix.exe"); // Read GameManager uintptr_t game_manager = mem.read( mem.base_address() + OFFSET_GAME_MANAGER ); // Read EntityList uintptr_t entity_list = mem.read( game_manager + OFFSET_ENTITY_LIST ); // Iterate entities for (int i = 0; i < 10; i++) { uintptr_t entity = mem.read(entity_list + (i * 0x8)); if (!entity) continue; // Read health int health = mem.read(entity + OFFSET_HEALTH); // Read position Vec3 head_pos = mem.read(entity + OFFSET_HEAD_POS); // World-to-screen Vec2 screen_pos; if (world_to_screen(head_pos, screen_pos, view_matrix)) { printf("Player %d: HP=%d, Screen=(%.1f, %.1f)\n", i, health, screen_pos.x, screen_pos.y); } } return 0; } ``` ## 📚 API 参考 ### 内存管理器 ``` class MemoryManager { public: // Attach to game process by name bool attach(const wchar_t* process_name); // Get process base address uintptr_t base_address() const; // Template read method template T read(uintptr_t address); // Template write method (disabled by default, config override required) template void write(uintptr_t address, T value); // Read raw bytes bool read_bytes(uintptr_t address, void* buffer, size_t size); // Get module base address uintptr_t get_module_base(const wchar_t* module_name); }; ``` ### 数学库 ``` struct Vec3 { float x, y, z; float dot(const Vec3& other) const; float length() const; float distance_to(const Vec3& other) const; Vec3 normalized() const; }; struct Vec2 { float x, y; }; struct Matrix4x4 { float m[4][4]; // column-major Vec3 transform(const Vec3& v) const; }; bool world_to_screen(const Vec3& world_pos, Vec2& screen_pos, const Matrix4x4& view_matrix, int screen_w, int screen_h); ``` ### Aimbot 模块 ``` class Aimbot { public: // Configure FOV void set_fov(float degrees); // Configure smoothing void set_smooth(float factor); // Set target bone void set_target_bone(int bone_id); // Calculate aim angle to target Vec2 calculate_aim_angle(const Vec3& source, const Vec3& target); // Execute aim (call every frame) void execute(); }; ``` ## 📁 偏移转储格式 文件：`offsets/y9s2_offsets.json` ``` { "build_id": "24598765", "version": "Y9S2.1", "date": "2024-07-10", "offsets": { "GameManager": "0x4D3A100", "EntityList": "0xF0", "ViewMatrix": "0x4C8B2D0", "Entity": { "Health": "0x68", "TeamID": "0x48", "HeadPosition": "0x80", "FeetPosition": "0x90", "ViewAngleX": "0x110", "ViewAngleY": "0x114", "IsADS": "0x148", "IsVisible": "0x188" }, "BoneList": { "Head": "0x20", "Neck": "0x50", "Chest": "0x60", "Pelvis": "0x90", "LeftHand": "0xC0", "RightHand": "0xD0" } } } ``` ## 📝 发行说明 ### 版本 `v2.8.3-stable` — **“水晶卫士”** **日期：** 2024-07-10 **类型：** 稳定版 **代号：** `crystal-guard` **SHA256:** `d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3` **大小：** `2.4 MB (.zip)` #### 🚀 新功能 - 支持 Y9S2.1 (Build `24598765`) - Deimos 干员轮廓 ESP (颜色：`#FF6B00`) - 声誉系统集成显示 (积分榜标签页钩子) - `Skopós` V10-Panthera 瞄准镜视场角覆盖 (固定 2.5x → 1.0x，可切换) - 武器皮肤稀有度发光 (基于偏移 `0x1A4` 处的 `item_rarity` 字节的颜色) #### 🛠 修复 - 修复了玩家数量超过 10 时实体闪烁的问题 (容器大小增加) - 修复了 GPU 设备丢失时覆盖层崩溃的问题 (`DXGI_ERROR_DEVICE_REMOVED`，现在处理 `OnDeviceLost`) - 修复了 Aimbot 瞄准已销毁无人机的问题 (增加了队伍检查 + 实体类型检查 `0x02`) - 修复了无边框窗口模式下视图矩阵反转的问题 (宽高比重新计算) - 修复了观战者列表显示负数的问题 (无符号类型转换修复) #### ⚡ 性能 - 覆盖层绘制调用减少 35% (批量实体渲染，单次 `DrawIndexed`) - 内存读取缓存，TTL 16ms (静态值的系统调用次数减少 60%) - 字符串操作切换为栈分配 (移除了每帧 12 次堆分配) #### 🏷 标签 ``` v2.8.3-stable, crystal-guard, y9s2, deimos, external, esp, aimbot, r6s ```

📦 下载资产

| 文件 | 大小 | SHA256 | |------|------|--------| | `R6S-External-v2.8.3-stable.zip` | `2.4 MB` | `d4e5f6a7...` | | `R6S-External-v2.8.3-stable.sig` | `566 bytes` | `b2c4d6e8...` | | `源代码 (zip)` | `1.8 MB` | `f1a3b5c7...` | | `源代码 (tar.gz)` | `1.6 MB` | `d9e1f3a5...` | | `offsets_y9s2.json` | `1.2 KB` | `c7d9e1f3...` |

### 以前的版本 #### `v2.8.2-stable` — **“冰雾”** **日期：** 2024-06-01 | **类型：** 稳定版 | **代号：** `frozen-mist` - 支持 Y9S1.3 (Build `24321890`) - 新增 Tubarão 小工具 ESP - 修复了 Kapkan EDD 检测范围 (现在遵守 `trap_activation_radius = 2.5m`) #### `v2.8.1-beta` — **“刺骨寒霜”** **日期：** 2024-05-15 | **类型：** Beta 版 | **代号：** `biting-frost` - Fenrir 地雷 ESP (5 个地雷，激活半径可视化) - 已知问题：Windows 11 23H2 上的覆盖层透明度 (解决方法：禁用 `transparency_effects`) #### `v2.8.0-legacy` — **“太阳突袭”** **日期：** 2024-03-01 | **类型：** 旧版 | **代号：** `solar-raid` - 最终支持 Y8S4.2 - **生命周期结束：2024-05-01** ## 📄 许可证 ``` MIT License Copyright (c) 2024 R6S-External Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ```

**[⬆ 返回顶部](#-r6s-external-cheat--advanced-external-memory-analysis-tool-for-rainbow-six-siege)**

标签：C++17, DirectX 11, DirectX覆盖层, ESP功能, Hpfeeds, HTTP头分析, R6S外部作弊, x64架构, 内存读取, 反作弊分析, 只读操作, 外部内存分析, 彩虹六号：围攻, 游戏作弊, 游戏外挂, 游戏辅助工具, 瞄准机器人, 端点可见性, 系统调用, 覆盖层渲染, 骨骼渲染, 高危端口监控