Research note · RN-2026-02
Checking CS 1.6 Game Files Against Valve's Own Depot Manifests
Raul-Daniel Pelea, The AACGUARD Project · · 4 min read · Applies to: Client 0.0.15 and later
Abstract
Counter-Strike 1.6 can be cheated without any running program: a transparent wall texture or a bright player model is enough. We describe how AACGUARD compares about two thousand CS 1.6 and Half-Life files with the fingerprints Valve publishes in Steam's depot manifests, how findings are weighted by file type, the guards that keep custom builds and cosmetic changes from being punished, and the limits of the approach.
1. The problem
GoldSrc, the engine behind CS 1.6, loads textures, models and sprites from plain files in the game folder. Three classic cheats need nothing more than a replaced file:
- Wallhack textures: a
.wadtexture file with transparent or see-through wall textures. - Bright or enlarged player models: replaced
.mdlfiles that make enemies glow or appear larger. - No smoke: an emptied or transparent smoke sprite.
These leave no running process, no injected module and no network connection. Process- and memory-based checks cannot see them. The files themselves are the evidence.
2. A reference that does not depend on us
Steam describes every file of every game build in a depot manifest: path, size and SHA-1 fingerprint. A Steam client keeps the manifests of installed games locally. That gives us a reference published by Valve, not assembled by hand.
We read the manifests of the Half-Life engine and Counter-Strike depots for the current Steam build of CS 1.6 (build 12934623) and kept every file type that can change what a player sees or how the game runs: textures (.wad), models (.mdl), sprites (.spr), images (.tga, .bmp), maps (.bsp) and binaries (.dll, .exe). The result is a list of 2,048 files, each with its path, size, SHA-1 and depot, and the build id. The list is embedded in the client, so the check works offline and nothing is downloaded during a scan.
To validate the list we compared it with an unmodified Steam installation of the game: all 2,048 files were identical. The only files that differed in the folder were configuration files (.cfg), which are not part of the comparison.
3. The check
- Find the CS 1.6 installations on the PC, through Steam's library records and the known locations of non-Steam builds, and decide for each whether it is a Steam copy.
- For every file in the list that exists in the installation, compare the size first and the SHA-1 only when the size matches. Most files are rejected or accepted without reading them in full.
- Classify every differing file by type and location, and apply the guards described below.
- Report the differing files with their type, so the scan page can explain what each change does.
4. Weighting by file type
| Changed file (Steam copy, reference build) | Weight | Reason |
|---|---|---|
Wall textures (.wad) | Strong | The classic see-through wall cheat. |
| Core engine and game DLLs | Strong | A modified game binary has no legitimate purpose on a Steam copy. |
| Player models, smoke sprite | Medium | Used for bright models and no smoke, but also by some model packs. |
| Other DLLs | Light | Less directly tied to an advantage. |
| Cosmetic files (weapon and hand models, most sprites) | Information only | Skins are common and give no advantage; listed once. |
The engine also loads custom content from a separate folder that overrides the originals without replacing them. Changes found there count less than overwritten originals, because they are easier to add by accident (for example with a content pack) and easier to remove.
File-check findings use their own classification and are not subject to the cap on name-based guesses: a changed file is a fact, not a guess about a name.
5. Guards against unfair results
- Different build: if the installation is a different Steam build than the reference (for example just after a Steam update), nothing is scored. Comparing against the wrong build would flag every updated file.
- Mass changes: if a large share of the files differ, the installation is treated as a different build or a repack, and nothing is scored. Targeted cheats change a few files; repacks change many.
- Non-Steam builds: they ship with their own versions of many files, so only wall textures and player models are compared, at a low weight, and if more than half of the textures differ the build is treated as a repack.
The guards trade some sensitivity for fairness. A cheater who replaces a large part of the game files at once avoids this particular check, but then plays on what is effectively a different build, which other checks and the server can notice.
6. Relation to other checks
The file check complements two other CS 1.6 checks. The OpenGL hook check finds wallhacks that change how the game draws without changing files. The Steam or non-Steam copy record tells admins which build was actually running, so information about a non-Steam install is not shown when the player used Steam's copy. Configuration files are covered by a separate check for cheat-only commands.
7. Maintenance
When Valve updates CS 1.6, the manifests change. Rebuilding the list takes a few minutes: read the new manifests from Steam, regenerate the list and update the build id. Until a client with the new list is released, scans of updated installations score nothing from this check, by design.
8. Limitations
- The check only sees files on disk. Textures changed in memory are the job of the OpenGL and memory checks.
- Non-Steam builds vary so much that we can only check them coarsely.
- A changed file does not tell us who changed it or when it was last used; the scan shows the file's dates so admins can judge.
For players, our guide The CS 1.6 file check explains how to restore original files with Steam's integrity check.