shinebypass

Win32 + Direct3D 11 launcher for FiveM cheat payloads. Ships an ImGui-based UI that authenticates the user against a remote endpoint, selects a target payload (Gosth External or Skript.gg), injects it into the running FiveM game process via a manual-mapping routine, and offers a "cleaner" pass that scrubs matching strings out of process memory, registry, and disk.

The repo is built on top of a full Dear ImGui checkout (imgui.cpp, backends, misc). The actual loader code lives at examples/example_win32_directx11/. The rest of the tree is stock ImGui.

Feature Set

• ImGui + DX11 launcher UI (login, subscription state, action buttons).
• Remote auth (auth() in auth.cpp), success token 0xCAFE, three subscription types: TYPE_GOSTH, TYPE_SKRIPT, TYPE_BOTH.
• Payload switch by subscription:
  • cur_game == 0 -> gosthinject() -> Gosth External payload
  • cur_game == 1 -> modules->inject_skript() -> Skript.gg payload
• Manual-mapping injector (inject.cpp, ManualMap(HANDLE, unsigned char[220672])):
  • VirtualAllocEx in the target.
  • Writes PE headers + sections directly.
  • Shellcode fixes relocations, resolves imports (LoadLibraryA, GetProcAddress), calls _DllMain.
  • Scrubs the shellcode after run.
• Environment gate (soft anti-analysis): refuses to run while AnyDesk, TeamViewer, or Everything windows are present, or when vgk.sys (Vanguard) is loaded.
• Stream-proof toggle: SetWindowDisplayAffinity(WDA_EXCLUDEFROMCAPTURE) on the launcher window.
• Cleaner (cleaner.cpp):
  • Walks target process memory (ANSI + Unicode), matches configured strings, overwrites them in place.
  • Optional DPS pass for extra rewrites.
  • Deletes registry keys under HKEY_CURRENT_USER matching the configured pattern.
  • Deletes files matching the configured filename pattern under the target directory.

Repository Layout

Top of tree is upstream Dear ImGui. Loader-specific code is under examples/example_win32_directx11/.

shinebypass/
├── imgui.cpp / imgui.h / imgui_internal.h    # ImGui core (unmodified)
├── imgui_demo.cpp / imgui_draw.cpp / ...     # ImGui core
├── imstb_*.h                                 # ImGui stb deps
├── backends/                                 # ImGui platform + renderer backends
├── misc/                                     # ImGui misc modules (freetype, fonts, cpp)
└── examples/
    ├── libs/
    └── example_win32_directx11/              # the actual loader project
        ├── example_win32_directx11.vcxproj
        ├── main.cpp                          # WinMain, UI loop, target selection
        ├── auth.cpp                          # remote auth, subscription check
        ├── inject.cpp                        # manual map (ManualMap)
        ├── injection.h
        ├── loader.h
        ├── wrapper.h
        ├── cleaner.cpp / cleaner.hpp         # memory/registry/file scrubber
        ├── custom.cpp / custom.hpp           # ImGui custom widgets
        ├── memory.cpp / memory.hpp           # memory helpers
        ├── modules.cpp / modules.hpp         # payload dispatch (inject_skript, ...)
        ├── bytes.hpp                         # embedded payload bytes
        ├── ConsoleApplication2.hpp
        ├── dependencies.h
        ├── stdafx.hpp / stdafx.cpp
        ├── utils.hpp
        └── imgui.ini

Requirements

• Visual Studio 2019 or newer, Desktop C++ workload.
• Windows 10/11 SDK.
• DirectX 11 headers (Windows SDK ships them).
• Additional link input: D3DX11.lib (legacy, from the old DirectX SDK).
• libcurl (used by auth.cpp for the remote auth call).
• Administrator on the host (manual mapping into a live FiveM process needs PROCESS_ALL_ACCESS).

Optional (only if you want to build the ImGui demo/samples too): the other examples under examples/ require their own toolchains; the loader project does not depend on them.

Build

Visual Studio:

1. Open examples/example_win32_directx11/example_win32_directx11.vcxproj (or the parent .sln if you have one committed locally).
2. Set configuration to Release | x64.
3. Make sure the include and library search paths cover:
   • The Windows SDK.
   • The legacy DirectX SDK (D3DX11.lib, d3dx11tex.h).
   • libcurl headers and import lib.
4. Build.
5. Output: examples/example_win32_directx11/x64/Release/example_win32_directx11.exe.

Command line (Developer Command Prompt for VS):

msbuild examples\example_win32_directx11\example_win32_directx11.vcxproj /p:Configuration=Release /p:Platform=x64

If D3DX11.lib is missing, install the legacy Microsoft DirectX SDK (June 2010) and add its Include and Lib\x64 directories to the project.

Usage

1. Launch FiveM and reach the state where the game module you want to inject into is running.
2. Run the loader as administrator.
3. Log in with valid credentials in the ImGui window.
4. On successful auth, the subscription state gates which payloads are visible:
   • TYPE_GOSTH shows the Gosth External button.
   • TYPE_SKRIPT shows the Skript.gg button.
   • TYPE_BOTH shows both.
5. Optional: toggle StreamProof to hide the launcher window from screen capture.
6. Click Inject. The loader picks up the FiveM game process handle and manual-maps the selected payload.
7. Click Cleaner after a session to run the memory/registry/file scrub pass.

Auth failure or a missing subscription for the selected payload aborts the injection path.

Configuration

Everything is compiled in. To change targets, endpoints, or scrub lists, edit and rebuild.

• Remote auth endpoint: inside auth.cpp. Change the URL, headers, and response parsing here.
• Subscription mapping: TYPE_GOSTH / TYPE_SKRIPT / TYPE_BOTH in the same file.
• Payload bytes: bytes.hpp holds the embedded DLL(s) that the manual-mapper consumes. Regenerate this file when the payload changes (any bin2c-style tool works).
• Target process: whichever FiveM game process handle is resolved by the modules layer. Rework modules.cpp to redirect the injector at a different image.
• Environment gate: strings for AnyDesk, TeamViewer, Everything, and vgk.sys are inline. Comment them out for a lab run where those tools are present.
• Cleaner target lists: strings to overwrite in memory, registry keys to nuke, and filename patterns to delete are inline in cleaner.cpp. Tune per campaign.

Notes and Limits

• Manual map only. No LoadLibrary fallback. If the target's imports cannot be resolved from userland LoadLibraryA / GetProcAddress, the payload will not run.
• No syscall indirection. All API calls go through kernel32 / ntdll normally. Any hooked EDR or anti-cheat with in-process hooks on VirtualAllocEx, WriteProcessMemory, or CreateRemoteThread will see the injection.
• The Vanguard check is a driver presence check only. Everything else in the anti-cheat space (BattlEye, EAC, Ricochet, VAC, Shine) is not detected or gated at launcher level.
• Cleaner is a substring scrub. Anything more sophisticated than plain ANSI/UTF-16 embedded strings in the target will bleed through.
• Legacy D3DX11.lib dependency ties the build to the old DirectX SDK. Modern replacements exist if you want to lift that dependency.