wpfigfszroxn/pubg-external-esp

Two years of duct-taped overlay code, a patched driver here, a broken offset there — that's what the old build was. January 2026 is the ground-up rewrite: every module pulled out of the monolith, offsets externalized to a config, and the renderer moved off the DirectX hook entirely. If you've been chasing a stable external ESP that doesn't need recompiling every Tuesday patch, this is what that looks like.

Educational purposes only. This repository documents external read-only memory inspection techniques for reverse-engineering study. Use at your own risk; the author assumes no responsibility for account actions resulting from misuse.

• System Requirements
• The Solution — Problem | Solution Mirror
• Comparison — Aspect | Alternative | This Tool
• Compatibility / Platform Support
• All Modules Status — 31 Modules
• How the Internals Actually Work
• Hotkeys Reference
• Tips for Best Results
• Usage Guidelines — Allowed | Not Allowed
• Performance Benchmarks

• 

Additional requirements as a bullet list:

• Windows must be fully updated — the memory-inspection layer relies on recent NtQueryVirtualMemory behavior.
• Secure Boot may block the optional kernel-assisted read path; the user-mode path works regardless.
• Antivirus exclusions recommended for the working directory (false positives on the injector stub are common).
• A second monitor is strongly recommended — overlay window is borderless and position-persistent.
• DirectX June 2010 redistributable for the legacy overlay fallback path.

The whole thing hinges on a single design decision made in January 2026: nothing runs inside the game process. The previous build injected a DLL and hooked the swapchain — which worked, until it didn't, and debugging a crash inside someone else's address space at 3 a.m. is a special kind of hell. The rewrite moved every read to an external handle opened with PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, then layered a page-table walker on top of NtQueryVirtualMemory to resolve virtual addresses without touching the target's working set in a way that trips the more obvious integrity checks. The offset resolver runs first on launch: it takes a build signature hash, looks it up in the bundled offset database, and falls back to a signature scan if no exact match exists. From there, the entity-list walker iterates the actor array on a fixed interval (default 16 ms), decodes each actor's transform and bone matrix into a flat render struct, and pushes the batch across a shared-memory ring to the overlay process. The overlay is a completely separate composited window using desktop duplication for the background layer — no DX hook, no swapchain tampering, which is why frame pacing stays flat even with 31 modules enabled. The renderer draws the batch in one pass with a batched sprite renderer, and the panic key tears the shared-memory ring down before the overlay window even finishes its fade-out. Everything else — recoil profiles, aim-assist smoothing curves, filter lists — is just config parsed at startup and re-parsed on file change.

• Run the .exe as Administrator — the user-mode read path works without it, but the driver-assisted path needs elevation.
• Launch the game first, then the .exe. The offset resolver needs a live process to scan against.
• Use borderless windowed mode, not fullscreen exclusive — the overlay compositor behaves far better.
• Keep config.json under version control in your own fork — it's the only file that changes between builds.
• If a module shows ⚠️ Degraded, check the read-audit log before assuming it's broken — usually it's a stale offset, not a code fault.
• Set a panic key you can hit without looking. End is the default, but pick something you won't fat-finger in a firefight.
• Exclude the working directory from real-time AV scanning — the injector stub trips heuristics on first run.
• Don't stack the overlay on top of a recording tool that hooks DXGI — Stream-Proof Mode helps but isn't magic.

The 2026 rewrite isn't about adding features — it's about making the thing auditable, patch-resilient, and honest about what it's doing. If you're here to study external memory inspection, the read-audit log and offset resolver are the two files worth reading first. Fork it, break it, learn from it.