Pesquisar na Comunidade

E que tal a lista completa dos personagens :) São 530 ao total Alguns dos personagens que estão ai: Easter Egg no Z? Só para seu conhecimento eu não fiz um por um, fiz um script para montar isso porque não sou um sádico. ENUM STD::ARRAY Créditos CModelButeMgr

Em anos, ninguém descobriu como burlar a verificação de caracteres especiais ao criar a conta ou mudar de nick, mesmo sabendo que era client-side ( o pessoal provava isso bugando com macro ).. Já postei a DLL e aqui vai a função para vocês. //55 8B 6C 24 08 85 ED 75 04 //Função: bool __cdecl `anonymous namespace'::VerifyNameString( const wchar_t *s, bool allow_space, bool allow_hypen, bool allow_dot, bool allow_ru, bool allow_kr ) //Função revertida //Se quiser impedir a verificação de caracteres, faça uma hook e retorne true. bool verify_name_string( const wchar_t *str, bool allow_space, bool allow_hypen, bool allow_dot, bool allow_ru, bool alloow_kr ) { static constexpr auto KEY_a{ 0x61u }; static constexpr auto KEY_z{ 0x7Au }; static constexpr auto KEY_A{ 0x41u }; static constexpr auto KEY_Z{ 0x5Au }; static constexpr auto NUM_0{ 0x30u }; static constexpr auto NUM_9{ 0x39u }; static constexpr auto UNLN{ 0x5Fu }; static constexpr auto HYPEN{ 0x2Du }; static constexpr auto DOT{ 0x2Eu }; static constexpr auto HANGUL_START{ 0xAC00u }; static constexpr auto HANGUL_END{ 0xD7A3u }; static constexpr auto RUSSIAN{ 0x401 }; static constexpr auto KOMI{ 0x501 }; static constexpr auto RUSSIAN_A{ 0x410 }; static constexpr auto SPACE{ 0x20 }; if ( !str ) return false; const auto len{ wcslen( str ) }; if ( ( len - 1u ) > 0x3Eu ) return false; auto chr_space{ 0x20 }; for ( auto idx{ 0 }; idx < len; ++idx ) { const auto chr{ str[ idx ] }; if ( ( chr < KEY_a || chr > KEY_z ) && ( chr < KEY_A || chr > KEY_Z ) && ( chr < NUM_0 || chr > NUM_9 ) && ( chr != UNLN ) && ( !allow_hypen || chr != HYPEN ) && ( !allow_dot || chr != DOT ) && ( !alloow_kr || chr < HANGUL_START || chr > HANGUL_END ) && ( !allow_ru || chr != RUSSIAN && chr != KOMI && ( chr - RUSSIAN_A ) > 0x3Fu ) && ( !allow_space || chr != SPACE || chr_space == SPACE ) ) { return false; } chr_space = chr; } return str[ len - 1 ] != SPACE; }

Bom, para quem quer dançar no meio da partida, além do modo hunted e do lone combat que lançou essa semana. Logger: [23:32:21] [info] Packet: int32_t write_uint8(248) - 00000008 // MID_EMOTION [23:32:21] [info] Packet: int32_t write_uint8(2) - 00000008 // eEmotionType::Emotion_Surrender Utilize a enum abaixo para escolher qual emotion utilizar: // Enum do PDB vazado em 2018 enum eEmotionType { Emotion_None = 0xFFFFFFFF, Emotion_Death = 0x0, Emotion_Insult = 0x1, Emotion_Surrender = 0x2, Emotion_Dance = 0x3, Emotion_Salute = 0x4, Emotion_Max = 0x5, }; Como utilizar: clt_message_write_client *send{}; if ( lt_client->get_common()->create_message( send ) == LT_OK ) { send->write_uint8( MID_EMOTION ); send->write_uint8( eEmotionType::Emotion_Dance ); lt_client->send_to_server( send->read(), 1 ) : } Qual função dentro da cshell chama a send to server com esse ID? // Symbol do PDB vazado em 2018: CCBAPlayerMgr::ActiveEmotion Address of signature = cshell.dll + 0x0012F2C0 "\x6A\x00\x68\x00\x00\x00\x00\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x53\x55\x56\x57\xA1\x00\x00\x00\x00\x00\x00\x00\x00\x44\x24\x00\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x24\x00\x3A\x9F", "x?x????x?????????xxxxx????????xx?x?????????x?xx" "6A ? 68 ? ? ? ? 64 ? ? ? ? ? ? ? ? ? 53 55 56 57 A1 ? ? ? ? ? ? ? ? 44 24 ? 64 ? ? ? ? ? ? ? ? ? 24 ? 3A 9F"

Muitos usam "DIP Engine - Mid function hook " como maneira de renderizar o chams sem usar strides. Mas vai renderizar algumas minas, turrets, hornets etc, junto. Outros fazem hook na DIP do DX e verificam o return address para não usar strides. Mas vai renderizar algumas minas, turrets, hornets etc, junto. Uma alternativa perfeita é você dar backtrace na função, algo que nunca foi feito. Usavam mid function hook em tudo, e isso polui e deixa difícil de ler. Basicamente o local onde vocês fazem o DIP Engine - Mid function hook é na função: void VertexBufferController::Render( std::uint32_t min_vertex_index, std::uint32_t start_index, std::uint32_t vert_count, std::uint32_t tri_count, std::uint32_t vert_offset ); Só se olhar os argumentos não tem nada para distinguir um objeto então ela ainda não é responsável por renderizar especificamente o personagem, ela já recebe as informações do objeto a ser renderizado, então aqui vai entrar turrets etc.. Dando backtrace mais um pouco a função que chama ela é a seguinte: void CD3DSkelMesh::Render( ModelInstance *instance, _D3DMATRIX *d3d_transforms, CD3DRenderStyle *render_styles, std::uint32_t render_pass ); Agora sim temos um argumento interessante: ModelInstance *instance Para quem não sabe, ModelInstance é a classe que guarda informações de um objeto. Informações como: // class world_tree_obj // LTVector m_min_box; LTVector m_max_box; // class lt_object : public world_tree_obj // LTVector m_scale; LTVector m_dims; LTRotation m_rotation; LTVector m_velocity; LTVector m_global_force_override; float m_friction_coefficient; LTVector m_acceleration; // class model_instance : public lt_object // // Não existe algo realmente interessante na própria model_instance Então aqui entra um ponto chave, algumas classes tem um membro do tipo ModelInstance* que guarda esse tipo de informação e uma delas é o character_fx, vamos usar dela para criar o wallhack / chams perfeito, tal como engine chams. Vamos criar dois helpers para ficar melhor. A função find procura em um vetor ( utilizando std::find ) um valor e retorna true caso tenha encontrado. A função insert chama a find para verificar se o valor já está dentro do vetor, caso não, então insere. template< typename T > bool find( const std::vector< T > &in, const T& value ) { return std::find( in.begin(), in.end(), value ) != in.end(); } template< typename T > void insert( std::vector< T > &in, const T& value ) { if ( !find( in, value ) ) in.push_back( value ); } Faça a hook na função, use MinHook é extremamente bom. // Presumindo que você trate como um void* apenas // using fn_render = void( __thiscall * )( void *, void*, void *, void*, std::uint32_t ); fn_render o_render{ nullptr }; void __fastcall hk_render( void *pthis, void*/*edx*/, void *instance, void *d3d_transforms, void *render_style, std::uint32_t render_pass ) { std::vector< void * > entity{}; { // Loop de entidades // // character_fx* object // ModelInstance *server_obj = 0x0010 // insert( entity, object->server_obj ); } // Procure dentro do vetor o ponteiro atual // Se encontrar é porque é um player // if ( find( entity, instance ) ) device_ptr->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE ); o_render( pthis, instance, d3d_transforms, render_style, render_pass ); if ( find( entity, instance ) ) device_ptr->SetRenderState( D3DRS_ZENABLE, D3DZB_TRUE ); } E assim temos o wallhack/chams perfeito. DIP mid function hook or DIP return address Meu método com filtro de entidade Antes que eu esqueça, para encontrar essa função é simples: IDA -> Strings -> "BoneCount" -> xrefs ( É usado somente nessa função ) Ou caso preferir: Address of signature = Engine.exe + 0x0012D4B0 "\x83\xEC\x00\x53\x55\x56\x8B\xF1\x8B\x86", "xx?xxxxxxx" "83 EC ? 53 55 56 8B F1 8B 86" Outra maneira: Encontre a vtable da CD3DSkelMesh A quarta função é a que procura. Créditos qqshutup#9762

Não é algo lá tão útil, tem como brincar no delta e também estou postando porque tenho spoofer para o bravo / alfa sem nem encostar na S2S então não me serve de mais nada. O bom é que as pessoas podem parar de fazer essa merda aqui: Obtido pelo logger ( Bravo / Canal: 1 / Sala: ? / Mapa: Junk Flea / Modo: Quarentena ) Um adendo: Uma maneira de usar é assim ( adicione as verificações de clan, item upgrade e daily info, é só checar o bool e ler o que está acima, muito simples ): if ( mid == MID_INIT_MULTIPLAYER ) { clt_message_write_client *send{}; // lt_common = lt_client->get_common(); // if ( lt_common->create_message( send ) == LT_OK ) { send->write_uint8( mid ); send->write_uint32( read->read_uint32() ); send->write_uint32( read->read_uint32() ); send->write_uint16( read->read_uint16() ); send->write_uint32( read->read_uint32() ); send->write_float( read->read_float() ); send->write_float( read->read_float() ); send->write_int8( read->read_int8() ); // Converta o valor para a enum ModelId que contém cada id do personagem // Altere o model_id para qual quiser e envie em seguida // Alterar qualquer coisa dentro da pchar_model_info_mgr no alfa/bravo você cairá em server-side checks, exceto m_overidable_model // auto model_id{ static_cast< ModelId >( read->read_int16() ) }; send->write_int16( static_cast< std::int16_t >( model_id ) ); send->write_int16( read->read_int16() ); send->write_int8( read->read_int8() ); send->write_int8( read->read_int8() ); send->write_int8( read->read_int8() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_bool( read->read_bool() ); send->write_int8( read->read_int8() ); send->write_int8( read->read_int8() ); send->write_int8( read->read_int8() ); char buf1[ 256 ]{}; char buf2[ 256 ]{}; read->read_string( buf1, 256 ); read->read_string( buf2, 256 ); send->write_string( buf1 ); send->write_string( buf2 ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int8( read->read_int8() ); send->write_int8( read->read_int8() ); send->write_int8( read->read_int8() ); send->write_int8( read->read_int8() ); send->write_int16( read->read_int16() ); send->write_int8( read->read_int8() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_uint32( read->read_uint32() ); send->write_int8( read->read_int8() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_int16( read->read_int16() ); send->write_float( read->read_float() ); send->write_uint32( read->read_uint32() ); send->write_uint8( read->read_uint8() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_uint16( read->read_uint16() ); send->write_bool( read->read_bool() ); send->write_uint32( read->read_uint32() ); send->write_uint32( read->read_uint32() ); send->write_bool( read->read_bool() ); send->write_bool( read->read_bool() ); send->write_bool( read->read_bool() ); send->write_bool( read->read_bool() ); send->write_int32( read->read_int32() ); send->write_int32( read->read_int32() ); send->write_int32( read->read_int32() ); send->write_int32( read->read_int32() ); send->write_int32( read->read_int32() ); send->write_int32( read->read_int32() ); return o_send_to_server( send->read(), flags ); } } Seja feliz com seu spoofer.

Descobri a algum tempo já.. bom, você pode fazer algumas coisas com isso. Como renderizar um SPRAY na cara de alguém para que ele não veja nada, isso é muito troll, e o cara não vê nada e não sabe quem está fazendo isso. Usei meu logger para obter isso, foi fácil. [13:59:12] [info] Packet: int32_t write_uint8(250) - 00000008 // ID_SPRAY [13:59:12] [info] Packet: int32_t write_ltvector((-45.21,0.00,-1730.29)) - 00000096 // Pos [13:59:12] [info] Packet: int32_t write_ltvector((0.00,1.00,0.00)) - 00000096 // ? [13:59:12] [info] Packet: int32_t write_ltrotation((0.61,0.36,-0.36,0.61)) - 00000000 // Rotation [13:59:12] [info] Packet: int32_t write_object(0x29204dc) - 00000016 // WorldModelInstance Como utilizar: #define ID_SPRAY 250 clt_message_write_client *send{}; if ( lt_client->get_common()->create_message( send ) == LT_OK ) { ltvector pos{}; ltvector dum{}; ltrotation rot{}; auto world_model_instance{ *reinterpret_cast< void ** >( 0x0078643C ) }; // Ponteiro para WorldModelInstance send->write_uint8 ( ID_SPRAY ); send->write_ltvector ( pos ); send->write_ltvector ( dum ); send->write_ltrotation( rot ); send->write_object ( world_model_instance ); lt_client->send_to_server( send->read(), 1 ); } // write_object apenas envia a seguinte informação para o servidor: "object->m_object_id" que vem da classe world_model_instance : ltobject Como obter um ponteiro para WorldModelInstance Engine.exe+4D990 - 8B 0D 48647800 - mov ecx,[Engine.exe+326448] { (0019EBAC) } Engine.exe+4D996 - 8B 41 2C - mov eax,[ecx+2C] Engine.exe+4D999 - 56 - push esi Engine.exe+4D99A - 8B 74 24 08 - mov esi,[esp+08] Engine.exe+4D99E - 85 C0 - test eax,eax Engine.exe+4D9A0 - 74 10 - je Engine.exe+4D9B2 Engine.exe+4D9A2 - 8B 49 38 - mov ecx,[ecx+38] Engine.exe+4D9A5 - 51 - push ecx Engine.exe+4D9A6 - 56 - push esi Engine.exe+4D9A7 - FF D0 - call eax Engine.exe+4D9A9 - 83 C4 08 - add esp,08 { 8 } Engine.exe+4D9AC - 84 C0 - test al,al Engine.exe+4D9AE - 75 02 - jne Engine.exe+4D9B2 Engine.exe+4D9B0 - 5E - pop esi Engine.exe+4D9B1 - C3 - ret Engine.exe+4D9B2 - 8B 44 24 10 - mov eax,[esp+10] Engine.exe+4D9B6 - D9 44 24 0C - fld dword ptr [esp+0C] Engine.exe+4D9BA - D9 1D 38647800 - fstp dword ptr [Engine.exe+326438] { (0.00) } Engine.exe+4D9C0 - 89 35 3C647800 - mov [Engine.exe+32643C],esi { (027E9220) } // Engine.exe+32643C ou 0x0078643C = Ponteiro para WorldModelInstance // Address of signature = Engine.exe + 0x0004D9C0 "\x89\x35\x00\x00\x00\x00\xD9\x00", "xx????xx" "89 35 ? ? ? ? D9 00" Qual função dentro da cshell envia o spray para a S2S? Address of signature = cshell.dll + 0x0015EC60 "\x6A\x00\x68\x00\x00\x00\x00\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\xA1\x00\x00\x00\x00\x33\xC4\x89\x84\x00\x00\x00\x00\x00\x53\x56\x57\xA1\x00\x00\x00\x00\x00\x00\x00\x00\x84\x24\x00\x01\x00\x00\x64\x00\x00\x00\x00\x00\xD9", "x?x????x?????????xxxx????xxxx?????xxxx????????xx?xxxx??xxxx" "6A ? 68 ? ? ? ? 64 ? ? ? ? ? ? ? ? ? 01 00 00 A1 ? ? ? ? 33 C4 89 84 ? ? ? ? ? 53 56 57 A1 ? ? ? ? ? ? ? ? 84 24 ? 01 00 00 64 ? ? 00 00 00 D9"

Se você já usou a WorldToScreen que utiliza somente DirectX para calcular, sabe que ela vai piscar em alguns momentos. Ela se parece com isso: bool world_to_screen_dx( IDirect3DDevice9 *p_device, LTVector *object, LTVector *screen_pos ) { D3DXVECTOR3 object_pos( object->x, object->y, object->z ); D3DXMATRIX world{}; D3DXMATRIX view{}; D3DXMATRIX projection{}; p_device->GetTransform( D3DTS_WORLD, &world ); p_device->GetTransform( D3DTS_VIEW, &view ); p_device->GetTransform( D3DTS_PROJECTION, &projection ); D3DVIEWPORT9 viewport{}; p_device->GetViewport( &viewport ); D3DXVECTOR3 screen{}; D3DXVec3Project( &screen, &object_pos, &viewport, &projection, &view, &world ); screen_pos->x = screen.x; screen_pos->y = screen.y; screen_pos->z = screen.z; return screen_pos->z < 1 ? true : false; } Essa versão de WorldToScreen vai falhar as vezes, então melhor do que usar ela é usar as informações que o jogo armazena na engine, em vez de pegar as informações direto do directx. Outra maneira é usar a WorldToScreen que todos utilizam por ai, deve ser algo como: bool world_to_screen( const LTVector &obj_pos, LTVector &screen_pos ) { if ( auto p_draw_prim = m_lt_client->get_draw_prim() ) { D3DXVECTOR3 pos{ obj_pos.x, obj_pos.y, obj_pos.z }; D3DXVECTOR3 screen{ screen_pos.x, screen_pos.y, screen_pos.z }; D3DXVec3Project( &screen, &pos, &p_draw_prim->m_cached_viewport, &p_draw_prim->m_projection, &p_draw_prim->m_view, &p_draw_prim->m_world ); screen_pos.x = screen.x; screen_pos.y = screen.y; screen_pos.z = screen.z; } return ( screen_pos.z < 1.0f ); } Essa versão vai funcionar normalmente, mas nos queremos utilizar a versão da própria engine, e algumas das informações usadas acima vem de uma classe que está logo abaixo. O jogo utiliza uma classe chamada CD3DDrawPrim para armazenar diversas informações sobre direct3d, segue abaixo a classe CD3DDrawPrim: Você pode brincar com esses parâmetros e fazer coisas visuais bem legais. Mas a função que queremos é a seguinte: GetD3DXVec3Project Offset na vtable: 0x32 * 4 = 0xC8 Elemento na vtable: 0x32 ou 50 ( Existem outras 49 funções antes desta ). A função é a seguinte: void GetD3DXVec3Project(LTVector vPlayer3DPos, LTVector &vPlayer2DPos, float &fDot) Então para usar é simples, tão simples que vocês vão ter que achar um ponteiro para CD3DDrawPrim, que pode ser recuperado através de uma função da classe CLTClient: CLTClient->GetDrawPrim(); Agora vamos escrever nossa WorldToScreen: // pos_3d é a posição do objeto no mundo // pos_2d é a saída para nossa tela bool world_to_screen( const LTVector &pos_3d, LTVector &pos_2d ) { if( auto p_draw_prim = lt_client->get_draw_prim() ) { // O terceiro parâmetro que vai na função é o dot e é basicamente isso: // D3DXVec3Transform(&Vec4ViewPlayerPos, &VECTOR3In, &this->m_kView); // *fDot = Vec4ViewPlayerPos.z; float dot{ 0.f }; p_draw_prim->get_d3dx_vec3_project( pos_3d, pos_2d, dot ); } // Caso a saída para tela for maior que 1.0f, então não está visível na tela return ( pos_2d.z < 1.0f ); } Simples e eficiente. Essa é a melhor implementação de WorldToScreen para o Combat Arms que você vai ver, pois ela usa da própria Engine. Se você quer aprender mais sobre a engine ou quer otimizar seu cheat, criando código limpo e eficiente me adicione no discord: qqshutup#9762 Créditos qqshutup

Alguns dias atrás eu reverti utilizando meu logger para a send to server o ID 130 que vem da função CCBAClientWeapon::SendWeaponFireMessages que é chamada pela função CCBAClientWeapon::Fire Se você alterar o model_node para 8 ( Head ) você poderá fazer always headshot, vai poder atirar em qualquer parte da hitbox do jogador e dar HS ( pode não funcionar com females, por algum motivo estranho... você vai matar de HS mas não será em um tiro ). #Edit: O problema com females descrito acima, pode ser contornado da seguinte maneira: auto read{ msg->clone() }; const auto message_id{ msg->read_uint8() }; if( message_id == 130 ) { clt_message_write_client *send{}; // this = CCBAClientWeapon std::uint8_t dummy_0{}; // absolut std::uint16_t weapon_id{}; // this->m_weapon_id std::uint16_t ammo_id{}; // this->m_ammo->id std::uint16_t weapon_id2{}; // unused ( 0xFFFF ), mod_item::id LTVector flash_pos{}; // this->m_flash_pos LTVector fire_pos{}; // (param)fire_pos LTRotation object_rot{}; // (param)camera_rot float yaw{}; // player_mgr->m_yaw bool zooming{}; // player_mgr->m_zoomview || player_mgr->m_zooming bool triple_shot_mode{}; // this->is_triple_shot_mode() bool last_fire_type{}; // this->m_last_fire_type != FT_NORMAL_FIRE std::uint8_t perturb{}; // (param)perturb * 255 ( 0.f ~ 1.f to uint8_t ) float dynamic_perturb_factor{}; // this->m_dynamic_perturb_factor std::uint32_t dynamic_perturb_factor_x{}; // this->dynamic_perturb_factor * 1000 LTVector vectors_per_round{}; // this->m_fire_path_for_multiple_vectos_per_round_bug or (param)direction bool hit_player{}; // this->m_hit_player void *victim{}; // this->m_victim std::uint32_t model_node{}; // this->m_model_node LTVector object_center{}; // lt_client->get_object_pos( this->m_victim, &object_center ); float impact_distance{}; // this->m_impact_distance std::uint32_t dummy_1{}; // ? std::uint32_t object_generation{}; // lt_client->get_object_generation( this->victim, &object_generation ); bool impact_point_narrow{}; // this->m_impact_point_narrow GameObjectClientPointOfViewData point_of_view_data{}; // lt_client->get_game_object_interpolated_data( this->m_victim, &point_of_view_data ) bool weapon_fire_debug{}; // g_client_weapon_fire_debug.m_init && g_client_weapon_fire_debug.m_val >= 1.0 std::uint32_t view_time_ms{}; // point_of_view_data.ViewTimeMS std::uint32_t previous_discrete_sequence_no{}; // point_of_view_data.PreviousDiscreteSequenceNo std::uint32_t discrete_sequence_no{}; // point_of_view_data.DiscreteSequenceNo std::uint32_t previous_from_sequence_no{}; // point_of_view_data.PreviousFromSequenceNo std::uint32_t from_sequence_no{}; // point_of_view_data.FromSequenceNo std::uint32_t to_sequence_no{}; // point_of_view_data.ToSequenceNo bool hit_me{}; // this->m_hit_me bool object{}; // (param)object != 0 float throw_fire_force{}; // CClientPerkSkill::GetThrowFireForce() bool is_dual_left_fire{}; // this->m_is_dual_left_fire bool write_debug{}; // !CPlayerMgr::IsFirstPerson() || ( bWriteDebug = 0, g_pPlayerMgr->m_bUsingExternalCamera ) dummy_0 = read->read_uint8(); weapon_id = read->read_uint16(); ammo_id = read->read_uint16(); weapon_id2 = read->read_uint16(); flash_pos = read->read_ltvector(); fire_pos = read->read_ltvector(); object_rot = read->read_ltrotation(); yaw = read->read_float(); zooming = read->read_bool(); triple_shot_mode = read->read_bool(); last_fire_type = read->read_bool(); perturb = read->read_uint8(); dynamic_perturb_factor = read->read_float(); dynamic_perturb_factor_x = read->read_uint32(); vectors_per_round = read->read_ltvector(); hit_player = read->read_bool(); send->write_uint8 ( message_id ); send->write_uint8 ( dummy_0 ); send->write_uint16 ( weapon_id ); send->write_uint16 ( ammo_id ); send->write_uint16 ( weapon_id2 ); send->write_ltvector ( flash_pos ); send->write_ltvector ( fire_pos ); send->write_ltrotation ( object_rot ); send->write_float ( yaw ); send->write_bool ( zooming ); send->write_bool ( triple_shot_mode ); send->write_bool ( last_fire_type ); send->write_uint8 ( perturb ); send->write_float ( dynamic_perturb_factor ); send->write_uint32 ( dynamic_perturb_factor_x ); send->write_ltvector ( vectors_per_round ); send->write_bool ( hit_player ); if ( hit_player ) { victim = read->read_object(); model_node = read->read_uint8(); send->write_object( victim ); send->write_uint8 ( model_node ); const auto g_use_fire_packet_impact_distance_client{ true }; if ( g_use_fire_packet_impact_distance_client ) // g_use_fire_packet_impact_distance_client == true { object_center = read->read_ltvector(); impact_distance = read->read_float(); dummy_1 = read->read_bits( 3 ); send->write_ltvector( object_center ); send->write_float ( impact_distance ); send->write_bits ( dummy_1, 3 ); if ( !dummy_1 ) //dummy1 != 0 { // unused // const auto b_normal_x{ read->read_bool() }; // this->m_normal_x != 0.f send->write_bool( b_normal_x ); if ( b_normal_x ) { const auto normal_x{ read->read_float() }; // this->m_normal_x send->write_float( normal_x ); } const auto b_normal_y{ read->read_bool() }; // this->m_normal_y != 0.f send->write_bool( b_normal_y); if( b_normal_y ) { const auto normal_y{ read->read_float() }; // this->m_normal_y send->write_float( normal_y ); } const auto b_normal_z{ read->read_bool() }; // this->m_normal_z != 0.f send->write_bool( b_normal_z ); if( b_normal_z ) { const auto normal_z{ read->read_float() }; // this->m_normal_z send->write_float( normal_z ); } } } else { // unused // const auto impact_point{ read->read_ltvector() }; // this->m_impact_point const auto normal { read->read_ltvector() }; // this->normal send->write_ltvector( impact_point ); send->write_ltvector( normal ); } const auto g_use_legacy_unguranted_update_packet_clientg{ false }; if ( !g_use_legacy_unguranted_update_packet_clientg ) // g_use_legacy_unguranted_update_packet_clientg == false { object_generation = read->read_uint32(); impact_point_narrow = read->read_bool(); send->write_uint32( object_generation ); send->write_bool ( impact_point_narrow ); const auto g_use_client_side_extrapolation_client{ false }; if ( g_use_client_side_extrapolation_client ) // g_use_client_side_extrapolation_client == false { // unused // const auto dummy_2{ read->read_uint32() }; const auto yaw{ read->read_uint32() }; send->write_uint32( dummy_2 ); send->write_uint32( yaw ); } else { // lt_client->get_game_object_interpolated_data( this->victim, &point_of_view_data ) // weapon_fire_debug = read->read_bool(); send->write_bool( weapon_fire_debug ); if ( weapon_fire_debug ) // weapon == false { // unused // const auto dims { read->read_ltvector() }; // local var const auto view_data{ read->read_ltvector() }; // local var const auto center { read->read_ltvector() }; // local var read->read_data ( &point_of_view_data, 0x600 ); // data send->write_ltvector( dims ); send->write_ltvector( view_data ); send->write_ltvector( center ); send->write_data ( &point_of_view_data, 0x600 ); } else { view_time_ms = read->read_uint32(); previous_discrete_sequence_no = read->read_uint32(); discrete_sequence_no = read->read_uint32(); previous_from_sequence_no = read->read_uint32(); from_sequence_no = read->read_uint32(); to_sequence_no = read->read_uint32(); send->write_uint32( view_time_ms ); send->write_uint32( previous_discrete_sequence_no ); send->write_uint32( discrete_sequence_no ); send->write_uint32( previous_from_sequence_no ); send->write_uint32( from_sequence_no ); send->write_uint32( to_sequence_no ); } } } } hit_me = read->read_bool(); object = read->read_bool(); send->write_bool( hit_me ); send->write_bool( object ); // unused // //if ( object && !hit_player ) // object == true if the fire is on a player //{ // /* // result.x = (param)impact_pos->x - (param)fire_pos->x; // result.y = (param)impact_pos->y - (param)fire_pos->y; // result.z = (param)impact_pos->z - (param)fire_pos->z; // // angle = (param)direction.x * result.x + (param)direction.y * result.y + (param)direction.z * result.z; // */ // const auto angle{ read->read_float() }; // angle // const auto object{ read->read_object() }; // (param)object // // send->write_float( angle ); // send->write_object( object ); //} throw_fire_force = read->read_float(); is_dual_left_fire = read->read_bool(); write_debug = read->read_bool(); send->write_float( throw_fire_force ); send->write_bool ( is_dual_left_fire ); send->write_bool ( write_debug ); return o_send_to_server( send->read(), flags ); } Créditos qqshutup

Não irá falhar com zumbis como striker ou crusher. O esqueleto que muitos usam por ai falha, já que são copy & paste de pessoas que escreviam código muito mal. Da para adicionar os dedos da mão, mas fica com você fazer isso. enum MBoneNodes { M_BONE_FACEEYELID, M_BONE_FACEJAW, M_BONE_HEAD, M_BONE_NECK, M_BONE_HEAD01, M_BONE_NECK01, M_BONE_L_SHOULDER, M_BONE_L_UPPERARM, M_BONE_L_LOWERARM, M_BONE_L_HAND, M_BONE_R_SHOULDER, M_BONE_R_UPPERARM, M_BONE_R_LOWERARM, M_BONE_R_HAND, M_BONE_UPPERTORSO, M_BONE_TORSO, M_BONE_R_PELVIS, M_BONE_L_PELVIS, M_BONE_L_UPPERLEG, M_BONE_L_LOWERLEG, M_BONE_L_FOOT, M_BONE_L_TOE0, M_BONE_R_UPPERLEG, M_BONE_R_LOWERLEG, M_BONE_R_FOOT, M_BONE_R_TOE0, MAX }; static constexpr const char *bone_node[] { "Face_Eyelid", "Face_Jaw", "Head", "Neck", "Bip01 Head", "Bip01 Neck", "Left_shoulder", "Left_armu", "Left_arml", "Left_hand", "Right_shoulder", "Right_armu", "Right_arml", "Right_hand", "Upper_Torso", "Torso", "Right_pelvis", "Left_pelvis", "Left_legu", "Left_legl", "Left_foot", "Bip01 L Toe0", "Right_Legu", "Right_legl", "Right_foot", "Bip01 R Toe0" }; void skeleton( model_instance *obj, const ImColor &col ) { static constexpr int nodes[][ 2 ] { //Right leg { M_BONE_R_TOE0, M_BONE_R_FOOT }, { M_BONE_R_FOOT, M_BONE_R_LOWERLEG }, { M_BONE_R_LOWERLEG, M_BONE_R_UPPERLEG }, { M_BONE_R_UPPERLEG, M_BONE_L_PELVIS }, //Left leg { M_BONE_L_TOE0, M_BONE_L_FOOT }, { M_BONE_L_FOOT, M_BONE_L_LOWERLEG }, { M_BONE_L_LOWERLEG, M_BONE_L_UPPERLEG }, { M_BONE_L_UPPERLEG, M_BONE_L_PELVIS }, //Torso { M_BONE_L_PELVIS, M_BONE_R_PELVIS }, { M_BONE_R_PELVIS, M_BONE_TORSO }, { M_BONE_TORSO, M_BONE_UPPERTORSO }, { M_BONE_UPPERTORSO, M_BONE_NECK }, { M_BONE_UPPERTORSO, M_BONE_NECK01 }, //Right arm { M_BONE_NECK01, M_BONE_R_UPPERARM }, //non male, M_BONE_R_SHOULDER not exists... is a bug? { M_BONE_NECK, M_BONE_R_SHOULDER }, { M_BONE_R_SHOULDER, M_BONE_R_UPPERARM }, { M_BONE_R_UPPERARM, M_BONE_R_LOWERARM }, { M_BONE_R_LOWERARM, M_BONE_R_HAND }, //Left arm { M_BONE_NECK01, M_BONE_L_SHOULDER }, //non male, M_BONE_L_SHOULDER exists... { M_BONE_NECK, M_BONE_L_SHOULDER }, { M_BONE_L_SHOULDER, M_BONE_L_UPPERARM }, { M_BONE_L_UPPERARM, M_BONE_L_LOWERARM }, { M_BONE_L_LOWERARM, M_BONE_L_HAND }, //Head { M_BONE_NECK01, M_BONE_HEAD01 }, { M_BONE_NECK, M_BONE_HEAD }, { M_BONE_HEAD, M_BONE_FACEJAW }, { M_BONE_FACEJAW, M_BONE_FACEEYELID } }; for ( const auto &bone : nodes ) { static LTTransform obj_start{}; static LTTransform obj_end{}; static HMODELNODE model_node_start{}; static HMODELNODE model_node_end{}; static LTVector screen_start{}; static LTVector screen_end{}; const auto start_node{ engine_ctx.m_lt_client->get_model_lt()->get_node_c( obj, bone_node[ bone[ 0 ] ], model_node_start ) }; const auto end_node{ engine_ctx.m_lt_client->get_model_lt()->get_node_c( obj, bone_node[ bone[ 1 ] ], model_node_end ) }; if ( start_node == LT_OK && end_node == LT_OK ) { const auto start_transform{ engine_ctx.m_lt_client->get_model_lt()->get_node_transform( obj, model_node_start, &obj_start ) }; const auto end_transform{ engine_ctx.m_lt_client->get_model_lt()->get_node_transform( obj, model_node_end, &obj_end ) }; if ( start_transform == LT_OK && end_transform == LT_OK ) { if ( math::world_to_screen( &obj_start.m_vPos, &screen_start ) && math::world_to_screen( &obj_end.m_vPos, &screen_end ) ) { renderer::line( { screen_start.x, screen_start.y }, { screen_end.x, screen_end.y }, col ); } } } } }

Se alguma dessas regiões estiver visível ele irá retornar ela. bool is_visible( const LTVector &cam, const LTVector &obj ) { intersect_query query{}; intersect_info info{}; query.m_from = cam; query.m_to = obj; return !engine_ctx.m_lt_client->intersect_segment( &query, &info ); } if ( priorize ) { HMODELNODE model_node{ INVALID_MODEL_NODE }; static constexpr const char *nodes[]{ "Head", "Right_arml", "Left_arml", "Right_foot", "Left_foot" }; for ( const auto &node : nodes ) { if ( engine_ctx.m_lt_client->get_model_lt()->get_node_c( object, node, model_node ) == LT_OK ) { if ( engine_ctx.m_lt_client->get_model_lt()->get_node_transform( object, model_node, &transform ) == LT_OK ) { // local = camera if ( is_visible( local->m_pos, transform.m_vPos ) ) { // LTVector *best_node for aimbot if ( best_node ) *best_node = transform.m_vPos; return true; } } } } } Você pode percorrer todos nodes da entidade, mas não recomendo pois é lento.

Vai desenhar uma box 3d ( inteira branca ) e o esqueleto do jogador ( não é visível através de paredes ). A função que desenha o esqueleto é pesada, vai dropar bastante fps. using fn_draw_model = void( __cdecl * ) ( void * ); //NModelDebug::DrawModelBox fn_draw_model model_box{ reinterpret_cast< fn_draw_model >( 0x00661F70 ) }; //NModelDebug::DrawModelSkeleton fn_draw_model model_skeleton{ reinterpret_cast< fn_draw_model >( 0x00662120 ) }; //---------------------------- //Basta passar o objeto ( model_instance* ) //Na classe client_info é o 0x8, só chamar get_local_client()->obj ( 0x8 vem da classe cam_target_info que vai ser derivada pela client_info, get_local_client() é interna do client_info_mgr que retorna um ponteiro para a classe client_info ) //Na classe character_fx é o 0x10 ( player->server_obj, server_obj vem da classe special_fx que vai ser derivada pela character_fx ) //Depois só adicionar no loop dos personagens model_box( player->server_obj ); model_skeleton( player->server_obj );

A hierarquia das classes está preservada. MAKE_VA_FUNC_PADDING = É um macro que adiciona uma função virtual void abstrata. MAKE_VA_FUNC_PADDING( 0 ) irá expandir para: virtual void function_0() = 0; MAKE_VFUNC_PADDING = É um macro que adiciona uma função virtual void. MAKE_VFUNC_PADDING( 0 ) irá expandir para: virtual void function_0(); class ilt_csbase { public: MAKE_VAFUNC_PADDING( 0 ); // _InterfaceImplementation MAKE_VAFUNC_PADDING( 1 ); // Common MAKE_VAFUNC_PADDING( 2 ); // Physics MAKE_VAFUNC_PADDING( 3 ); // GetTransformLT MAKE_VAFUNC_PADDING( 4 ); // GetModelLT MAKE_VAFUNC_PADDING( 5 ); // SoundMgr MAKE_VAFUNC_PADDING( 6 ); // CPrint MAKE_VAFUNC_PADDING( 7 ); // CPrintW MAKE_VAFUNC_PADDING( 8 ); // GetContainerCode MAKE_VAFUNC_PADDING( 9 ); // GetObjectContainers MAKE_VAFUNC_PADDING( 10 ); // GetContainedObjects MAKE_VAFUNC_PADDING( 11 ); // OpenFile MAKE_VAFUNC_PADDING( 12 ); // CopyFile MAKE_VAFUNC_PADDING( 13 ); // OpenMemoryStream MAKE_VAFUNC_PADDING( 14 ); // GetBlindObjectData MAKE_VAFUNC_PADDING( 15 ); // FreeBlindObjectData MAKE_VAFUNC_PADDING( 16 ); // CopyString MAKE_VAFUNC_PADDING( 17 ); // CreateString MAKE_VAFUNC_PADDING( 18 ); // FreeString MAKE_VAFUNC_PADDING( 19 ); // CompareStrings MAKE_VAFUNC_PADDING( 20 ); // CompareStringsUpper MAKE_VAFUNC_PADDING( 21 ); // GetStringData MAKE_VAFUNC_PADDING( 22 ); // GetVarValueFloat MAKE_VAFUNC_PADDING( 23 ); // GetVarValueVector MAKE_VAFUNC_PADDING( 24 ); // GetVarValueColor MAKE_VFUNC_PADDING( 25 ); // SetVarValueFloat MAKE_VAFUNC_PADDING( 26 ); // GetVarValueString MAKE_VAFUNC_PADDING( 27 ); // GetEngineVar MAKE_VAFUNC_PADDING( 28 ); // GetEngineVarValueInt MAKE_VAFUNC_PADDING( 29 ); // GetEngineVarValueFloat MAKE_VAFUNC_PADDING( 30 ); // GetEngineVarValueString MAKE_VAFUNC_PADDING( 31 ); // GetTime MAKE_VAFUNC_PADDING( 32 ); // GetTimeMS MAKE_VAFUNC_PADDING( 33 ); // GetFrameTime MAKE_VAFUNC_PADDING( 34 ); // GetFrameTimeMS MAKE_VAFUNC_PADDING( 35 ); // GetSourceWorldOffset MAKE_VAFUNC_PADDING( 36 ); // RemoveObject MAKE_VAFUNC_PADDING( 37 ); // GetLightGroupID MAKE_VAFUNC_PADDING( 38 ); // GetOccluderID MAKE_VAFUNC_PADDING( 39 ); // GetTextureEffectVarID MAKE_VAFUNC_PADDING( 40 ); // LinkObjRef MAKE_VAFUNC_PADDING( 41 ); // GetObjectRotation MAKE_VAFUNC_PADDING( 42 ); // GetObjectPos MAKE_VAFUNC_PADDING( 43 ); // GetAnimIndex MAKE_VAFUNC_PADDING( 44 ); // SetModelAnimation MAKE_VAFUNC_PADDING( 45 ); // GetModelAnimation MAKE_VAFUNC_PADDING( 46 ); // SetModelLooping MAKE_VAFUNC_PADDING( 47 ); // GetModelLooping MAKE_VAFUNC_PADDING( 48 ); // ResetModelAnimation MAKE_VAFUNC_PADDING( 49 ); // GetModelPlaybackState MAKE_VAFUNC_PADDING( 50 ); // GetPointContainers MAKE_VAFUNC_PADDING( 51 ); // GetObjectGeneration MAKE_VAFUNC_PADDING( 52 ); // SetObjectPosAndDimsWithoutPhysics MAKE_VAFUNC_PADDING( 53 ); // SetObjectPos MAKE_VAFUNC_PADDING( 54 ); // SetServerPosIgnoreLength MAKE_VAFUNC_PADDING( 55 ); // SetScreenModel MAKE_VAFUNC_PADDING( 56 ); // VideoMgr MAKE_VAFUNC_PADDING( 57 ); // GetDrawPrim MAKE_VAFUNC_PADDING( 58 ); // GetTexInterface MAKE_VAFUNC_PADDING( 59 ); // GetFontManager MAKE_VAFUNC_PADDING( 60 ); // Cursor MAKE_VAFUNC_PADDING( 61 ); // GetBenchmarkMgr MAKE_VAFUNC_PADDING( 62 ); // GetModelPlaybackAnimationState MAKE_VAFUNC_PADDING( 63 ); // GetModelPlaybackAnimationStateName MAKE_VAFUNC_PADDING( 64 ); // GetPointShade MAKE_VAFUNC_PADDING( 65 ); // IsEngine2 MAKE_VAFUNC_PADDING( 66 ); // GetRendererStats MAKE_VAFUNC_PADDING( 67 ); // SetObjectRenderGroup MAKE_VAFUNC_PADDING( 68 ); // SetObjectRenderGroupEnabled MAKE_VAFUNC_PADDING( 69 ); // SetAllObjectRenderGroupEnabled MAKE_VAFUNC_PADDING( 70 ); // AddGlowRenderStyleMapping MAKE_VAFUNC_PADDING( 71 ); // SetGlowDefaultRenderStyle MAKE_VAFUNC_PADDING( 72 ); // SetNoGlowRenderStyle MAKE_VAFUNC_PADDING( 73 ); // AddVertexShader MAKE_VAFUNC_PADDING( 74 ); // RemoveVertexShader MAKE_VAFUNC_PADDING( 75 ); // RemoveAllVertexShaders MAKE_VAFUNC_PADDING( 76 ); // GetVertexShader MAKE_VAFUNC_PADDING( 77 ); // AddPixelShader MAKE_VAFUNC_PADDING( 78 ); // RemovePixelShader MAKE_VAFUNC_PADDING( 79 ); // RemoveAllPixelShaders MAKE_VAFUNC_PADDING( 80 ); // GetPixelShader MAKE_VAFUNC_PADDING( 81 ); // GetSConValueFloat MAKE_VAFUNC_PADDING( 82 ); // GetSConValueString MAKE_VAFUNC_PADDING( 83 ); // GetDeviceObjectName MAKE_VAFUNC_PADDING( 84 ); // GetGlobalLightDir MAKE_VAFUNC_PADDING( 85 ); // SetGlobalLightDir MAKE_VAFUNC_PADDING( 86 ); // GetGlobalLightColor MAKE_VAFUNC_PADDING( 87 ); // SetGlobalLightColor MAKE_VAFUNC_PADDING( 88 ); // GetGlobalLightConvertToAmbient MAKE_VAFUNC_PADDING( 89 ); // SetGlobalLightConvertToAmbient MAKE_VAFUNC_PADDING( 90 ); // SendToServer MAKE_VAFUNC_PADDING( 91 ); // GetServerIPAddress MAKE_VAFUNC_PADDING( 92 ); // ProcessAttachments MAKE_VAFUNC_PADDING( 93 ); // AddParticle MAKE_VAFUNC_PADDING( 94 ); // IsLocalToServer MAKE_VAFUNC_PADDING( 95 ); // GetLightGroupColor MAKE_VAFUNC_PADDING( 96 ); // SetLightGroupColor MAKE_VAFUNC_PADDING( 97 ); // GetOccluderEnabled MAKE_VAFUNC_PADDING( 98 ); // SetOccluderEnabled MAKE_VAFUNC_PADDING( 99 ); // SetTextureEffectVar MAKE_VAFUNC_PADDING( 100 ); // GetSpriteControl MAKE_VAFUNC_PADDING( 101 ); // SetSpriteEffectShaderID MAKE_VAFUNC_PADDING( 102 ); // GetCanvasFn MAKE_VAFUNC_PADDING( 103 ); // SetCanvasFn MAKE_VAFUNC_PADDING( 104 ); // GetCanvasRadius MAKE_VAFUNC_PADDING( 105 ); // SetCanvasRadius MAKE_VAFUNC_PADDING( 106 ); // GetMaxRadiusInPoly MAKE_VAFUNC_PADDING( 107 ); // GetClientFrameCode MAKE_VAFUNC_PADDING( 108 ); // Get_ILanguageLocale MAKE_VAFUNC_PADDING( 109 ); // GetGameObjectInterpolatedData MAKE_VAFUNC_PADDING( 110 ); // CalculateGameObjectInterpolatedData MAKE_VAFUNC_PADDING( 111 ); // CalculateGameObjectOccasionalInterpolatedData MAKE_VAFUNC_PADDING( 112 ); // GetLastReceivedUpdateSequenceNoAndTime MAKE_VAFUNC_PADDING( 113 ); // FirstActiveWorldModelIterator MAKE_VAFUNC_PADDING( 114 ); // NextActiveWorldModelIterator MAKE_VAFUNC_PADDING( 115 ); // GetD3DXLocalPosition }; class ilt_client : public ilt_csbase { public: }; class clt_client : public ilt_client { public: MAKE_VFUNC_PADDING( 0 ); // _InterfaceImplementation MAKE_VFUNC_PADDING( 1 ); // Common MAKE_VFUNC_PADDING( 2 ); // Physics MAKE_VFUNC_PADDING( 3 ); // GetTransformLT MAKE_VFUNC_PADDING( 4 ); // GetModelLT MAKE_VFUNC_PADDING( 5 ); // SoundMgr MAKE_VFUNC_PADDING( 6 ); // CPrint MAKE_VFUNC_PADDING( 7 ); // CPrintW MAKE_VFUNC_PADDING( 8 ); // GetContainerCode MAKE_VFUNC_PADDING( 9 ); // GetObjectContainers MAKE_VFUNC_PADDING( 10 ); // GetContainedObjects MAKE_VFUNC_PADDING( 11 ); // OpenFile MAKE_VFUNC_PADDING( 12 ); // CopyFile MAKE_VFUNC_PADDING( 13 ); // OpenMemoryStream MAKE_VFUNC_PADDING( 14 ); // GetBlindObjectData MAKE_VFUNC_PADDING( 15 ); // FreeBlindObjectData MAKE_VFUNC_PADDING( 16 ); // CopyString MAKE_VFUNC_PADDING( 17 ); // CreateString MAKE_VFUNC_PADDING( 18 ); // FreeString MAKE_VFUNC_PADDING( 19 ); // CompareStrings MAKE_VFUNC_PADDING( 20 ); // CompareStringsUpper MAKE_VFUNC_PADDING( 21 ); // GetStringData MAKE_VFUNC_PADDING( 22 ); // GetVarValueFloat MAKE_VFUNC_PADDING( 23 ); // GetVarValueVector MAKE_VFUNC_PADDING( 24 ); // GetVarValueColor MAKE_VFUNC_PADDING( 25 ); // SetVarValueFloat MAKE_VFUNC_PADDING( 26 ); // GetVarValueString MAKE_VFUNC_PADDING( 27 ); // GetEngineVar MAKE_VFUNC_PADDING( 28 ); // GetEngineVarValueInt MAKE_VFUNC_PADDING( 29 ); // GetEngineVarValueFloat MAKE_VFUNC_PADDING( 30 ); // GetEngineVarValueString MAKE_VFUNC_PADDING( 31 ); // GetTime MAKE_VFUNC_PADDING( 32 ); // GetTimeMS MAKE_VFUNC_PADDING( 33 ); // GetFrameTime MAKE_VFUNC_PADDING( 34 ); // GetFrameTimeMS MAKE_VFUNC_PADDING( 35 ); // GetSourceWorldOffset MAKE_VFUNC_PADDING( 36 ); // RemoveObject MAKE_VFUNC_PADDING( 37 ); // GetLightGroupID MAKE_VFUNC_PADDING( 38 ); // GetOccluderID MAKE_VFUNC_PADDING( 39 ); // GetTextureEffectVarID MAKE_VFUNC_PADDING( 40 ); // LinkObjRef MAKE_VFUNC_PADDING( 41 ); // GetObjectRotation MAKE_VFUNC_PADDING( 42 ); // GetObjectPos MAKE_VFUNC_PADDING( 43 ); // GetAnimIndex MAKE_VFUNC_PADDING( 44 ); // SetModelAnimation MAKE_VFUNC_PADDING( 45 ); // GetModelAnimation MAKE_VFUNC_PADDING( 46 ); // SetModelLooping MAKE_VFUNC_PADDING( 47 ); // GetModelLooping MAKE_VFUNC_PADDING( 48 ); // ResetModelAnimation MAKE_VFUNC_PADDING( 49 ); // GetModelPlaybackState MAKE_VFUNC_PADDING( 50 ); // GetPointContainers MAKE_VFUNC_PADDING( 51 ); // GetObjectGeneration MAKE_VFUNC_PADDING( 52 ); // SetObjectPosAndDimsWithoutPhysics MAKE_VFUNC_PADDING( 53 ); // SetObjectPos MAKE_VFUNC_PADDING( 54 ); // SetServerPosIgnoreLength MAKE_VFUNC_PADDING( 55 ); // SetScreenModel MAKE_VFUNC_PADDING( 56 ); // VideoMgr MAKE_VFUNC_PADDING( 57 ); // GetDrawPrim MAKE_VFUNC_PADDING( 58 ); // GetTexInterface MAKE_VFUNC_PADDING( 59 ); // GetFontManager MAKE_VFUNC_PADDING( 60 ); // Cursor MAKE_VFUNC_PADDING( 61 ); // GetBenchmarkMgr MAKE_VFUNC_PADDING( 62 ); // GetModelPlaybackAnimationState MAKE_VFUNC_PADDING( 63 ); // GetModelPlaybackAnimationStateName MAKE_VFUNC_PADDING( 64 ); // GetPointShade MAKE_VFUNC_PADDING( 65 ); // IsEngine2 MAKE_VFUNC_PADDING( 66 ); // GetRendererStats MAKE_VFUNC_PADDING( 67 ); // SetObjectRenderGroup MAKE_VFUNC_PADDING( 68 ); // SetObjectRenderGroupEnabled MAKE_VFUNC_PADDING( 69 ); // SetAllObjectRenderGroupEnabled MAKE_VFUNC_PADDING( 70 ); // AddGlowRenderStyleMapping MAKE_VFUNC_PADDING( 71 ); // SetGlowDefaultRenderStyle MAKE_VFUNC_PADDING( 72 ); // SetNoGlowRenderStyle MAKE_VFUNC_PADDING( 73 ); // AddVertexShader MAKE_VFUNC_PADDING( 74 ); // RemoveVertexShader MAKE_VFUNC_PADDING( 75 ); // RemoveAllVertexShaders MAKE_VFUNC_PADDING( 76 ); // GetVertexShader MAKE_VFUNC_PADDING( 77 ); // AddPixelShader MAKE_VFUNC_PADDING( 78 ); // RemovePixelShader MAKE_VFUNC_PADDING( 79 ); // RemoveAllPixelShaders MAKE_VFUNC_PADDING( 80 ); // GetPixelShader MAKE_VFUNC_PADDING( 81 ); // GetSConValueFloat MAKE_VFUNC_PADDING( 82 ); // GetSConValueString MAKE_VFUNC_PADDING( 83 ); // GetDeviceObjectName MAKE_VFUNC_PADDING( 84 ); // GetGlobalLightDir MAKE_VFUNC_PADDING( 85 ); // SetGlobalLightDir MAKE_VFUNC_PADDING( 86 ); // GetGlobalLightColor MAKE_VFUNC_PADDING( 87 ); // SetGlobalLightColor MAKE_VFUNC_PADDING( 88 ); // GetGlobalLightConvertToAmbient MAKE_VFUNC_PADDING( 89 ); // SetGlobalLightConvertToAmbient MAKE_VFUNC_PADDING( 90 ); // SendToServer MAKE_VFUNC_PADDING( 91 ); // GetServerIPAddress MAKE_VFUNC_PADDING( 92 ); // ProcessAttachments MAKE_VFUNC_PADDING( 93 ); // AddParticle MAKE_VFUNC_PADDING( 94 ); // IsLocalToServer MAKE_VFUNC_PADDING( 95 ); // GetLightGroupColor MAKE_VFUNC_PADDING( 96 ); // SetLightGroupColor MAKE_VFUNC_PADDING( 97 ); // GetOccluderEnabled MAKE_VFUNC_PADDING( 98 ); // SetOccluderEnabled MAKE_VFUNC_PADDING( 99 ); // SetTextureEffectVar MAKE_VFUNC_PADDING( 100 ); // GetSpriteControl MAKE_VFUNC_PADDING( 101 ); // SetSpriteEffectShaderID MAKE_VFUNC_PADDING( 102 ); // GetCanvasFn MAKE_VFUNC_PADDING( 103 ); // SetCanvasFn MAKE_VFUNC_PADDING( 104 ); // GetCanvasRadius MAKE_VFUNC_PADDING( 105 ); // SetCanvasRadius MAKE_VFUNC_PADDING( 106 ); // GetMaxRadiusInPoly MAKE_VFUNC_PADDING( 107 ); // GetClientFrameCode MAKE_VFUNC_PADDING( 108 ); // Get_ILanguageLocale MAKE_VFUNC_PADDING( 109 ); // GetGameObjectInterpolatedData MAKE_VFUNC_PADDING( 110 ); // CalculateGameObjectInterpolatedData MAKE_VFUNC_PADDING( 111 ); // CalculateGameObjectOccasionalInterpolatedData MAKE_VFUNC_PADDING( 112 ); // GetLastReceivedUpdateSequenceNoAndTime MAKE_VFUNC_PADDING( 113 ); // FirstActiveWorldModelIterator MAKE_VFUNC_PADDING( 114 ); // NextActiveWorldModelIterator MAKE_VFUNC_PADDING( 115 ); // GetD3DXLocalPosition };

A hierarquia das classes está preservada. MAKE_VA_FUNC_PADDING = É um macro que adiciona uma função virtual void abstrata. MAKE_VA_FUNC_PADDING( 0 ) irá expandir para: virtual void function_0() = 0; MAKE_VFUNC_PADDING = É um macro que adiciona uma função virtual void. MAKE_VFUNC_PADDING( 0 ) irá expandir para: virtual void function_0(); class iclient_shell { public: MAKE_VAFUNC_PADDING( 0 ); // _InterfaceImplementation MAKE_VAFUNC_PADDING( 1 ); // PreUpdate MAKE_VAFUNC_PADDING( 2 ); // PostUpdate MAKE_VAFUNC_PADDING( 3 ); // Update MAKE_VAFUNC_PADDING( 4 ); // OnObjectRotate MAKE_VAFUNC_PADDING( 5 ); // OnEngineInitialized MAKE_VAFUNC_PADDING( 6 ); // OnEngineTerm MAKE_VAFUNC_PADDING( 7 ); // OnEvent MAKE_VAFUNC_PADDING( 8 ); // OnTouchNotify MAKE_VAFUNC_PADDING( 9 ); // OnPlaySound MAKE_VAFUNC_PADDING( 10 ); // OnLockRenderer MAKE_VAFUNC_PADDING( 11 ); // OnUnLockRenderer MAKE_VAFUNC_PADDING( 12 ); // OnConsolePrint MAKE_VAFUNC_PADDING( 13 ); // OnKeyUp MAKE_VAFUNC_PADDING( 14 ); // OnKeyDown MAKE_VAFUNC_PADDING( 15 ); // OnCommandOff MAKE_VAFUNC_PADDING( 16 ); // OnCommandOn MAKE_VAFUNC_PADDING( 17 ); // OnModelKey MAKE_VAFUNC_PADDING( 18 ); // OnEnterWorld MAKE_VAFUNC_PADDING( 19 ); // OnExitWorld MAKE_VAFUNC_PADDING( 20 ); // OnMessage MAKE_VAFUNC_PADDING( 21 ); // PreLoadWorld MAKE_VAFUNC_PADDING( 22 ); // OnObjectMove MAKE_VAFUNC_PADDING( 23 ); // SpecialEffectNotify MAKE_VAFUNC_PADDING( 24 ); // OnObjectRemove MAKE_VAFUNC_PADDING( 25 ); // SetServerVar MAKE_VFUNC_PADDING( 26 ); // SetWSInstance MAKE_VFUNC_PADDING( 27 ); // GetWSInstance MAKE_VFUNC_PADDING( 28 ); // SetXignCodeInstance MAKE_VFUNC_PADDING( 29 ); // GetXignCodeInstance MAKE_VAFUNC_PADDING( 30 ); // - MAKE_VAFUNC_PADDING( 31 ); // - MAKE_VAFUNC_PADDING( 32 ); // - MAKE_VAFUNC_PADDING( 33 ); // - MAKE_VAFUNC_PADDING( 34 ); // - MAKE_VAFUNC_PADDING( 35 ); // - MAKE_VFUNC_PADDING( 36 ); // ClearTCPConnections MAKE_VFUNC_PADDING( 37 ); // ClearUDPConnections MAKE_VFUNC_PADDING( 38 ); // InitializeResources MAKE_VFUNC_PADDING( 39 ); // PreEngineInitialized MAKE_VFUNC_PADDING( 40 ); // PostInitializeResources MAKE_VFUNC_PADDING( 41 ); // IsRendererInitted MAKE_VFUNC_PADDING( 42 ); // OnObjectFileNames MAKE_VFUNC_PADDING( 43 ); // OnBlockConsoleCmd MAKE_VFUNC_PADDING( 44 ); // OnVertexShaderSetConstants MAKE_VFUNC_PADDING( 45 ); // OnPixelShaderSetConstants MAKE_VFUNC_PADDING( 46 ); // OnEffectShaderSetParams }; class iltclient_shell_stub : public iclient_shell { public: MAKE_VFUNC_PADDING( 1 ); // PreUpdate MAKE_VFUNC_PADDING( 2 ); // PostUpdate MAKE_VFUNC_PADDING( 3 ); // Update MAKE_VFUNC_PADDING( 4 ); // OnObjectRotate MAKE_VFUNC_PADDING( 5 ); // OnEngineInitialized MAKE_VFUNC_PADDING( 6 ); // OnEngineTerm MAKE_VFUNC_PADDING( 7 ); // OnEvent MAKE_VAFUNC_PADDING( 8 ); // OnTouchNotify MAKE_VFUNC_PADDING( 9 ); // OnPlaySound MAKE_VFUNC_PADDING( 10 ); // OnLockRenderer MAKE_VFUNC_PADDING( 11 ); // OnUnLockRenderer MAKE_VFUNC_PADDING( 12 ); // OnConsolePrint MAKE_VFUNC_PADDING( 13 ); // OnKeyUp MAKE_VFUNC_PADDING( 14 ); // OnKeyDown MAKE_VFUNC_PADDING( 15 ); // OnCommandOff MAKE_VFUNC_PADDING( 16 ); // OnCommandOn MAKE_VFUNC_PADDING( 17 ); // OnModelKey MAKE_VFUNC_PADDING( 18 ); // OnEnterWorld MAKE_VFUNC_PADDING( 19 ); // OnExitWorld MAKE_VFUNC_PADDING( 20 ); // OnMessage MAKE_VFUNC_PADDING( 21 ); // PreLoadWorld MAKE_VFUNC_PADDING( 22 ); // OnObjectMove MAKE_VFUNC_PADDING( 23 ); // SpecialEffectNotify MAKE_VFUNC_PADDING( 24 ); // OnObjectRemove MAKE_VFUNC_PADDING( 25 ); // SetServerVar MAKE_VAFUNC_PADDING( 30 ); // - MAKE_VAFUNC_PADDING( 31 ); // - MAKE_VAFUNC_PADDING( 32 ); // - MAKE_VAFUNC_PADDING( 33 ); // - MAKE_VAFUNC_PADDING( 34 ); // - MAKE_VAFUNC_PADDING( 35 ); // - MAKE_VFUNC_PADDING( 36 ); // ClearTCPConnections MAKE_VFUNC_PADDING( 37 ); // ClearUDPConnections MAKE_VFUNC_PADDING( 38 ); // InitializeResources MAKE_VFUNC_PADDING( 39 ); // PreEngineInitialized MAKE_VFUNC_PADDING( 40 ); // PostInitializeResources MAKE_VFUNC_PADDING( 41 ); // IsRendererInitted MAKE_VFUNC_PADDING( 42 ); // OnObjectFileNames MAKE_VFUNC_PADDING( 43 ); // OnBlockConsoleCmd MAKE_VFUNC_PADDING( 44 ); // OnVertexShaderSetConstants MAKE_VFUNC_PADDING( 45 ); // OnPixelShaderSetConstants MAKE_VFUNC_PADDING( 46 ); // OnEffectShaderSetParams MAKE_VFUNC_PADDING( 47 ); // OnTouchNotify MAKE_VFUNC_PADDING( 48 ); // srand }; class cgame_client_shell : public iltclient_shell_stub { public: MAKE_VFUNC_PADDING( 3 ); // Update MAKE_VFUNC_PADDING( 5 ); // OnEngineInitialized MAKE_VFUNC_PADDING( 6 ); // OnEngineTerm MAKE_VFUNC_PADDING( 8 ); // OnTouchNotify MAKE_VFUNC_PADDING( 19 ); // OnExitWorld MAKE_VFUNC_PADDING( 20 ); // OnMessage MAKE_VFUNC_PADDING( 30 ); // - MAKE_VFUNC_PADDING( 31 ); // - MAKE_VFUNC_PADDING( 32 ); // - MAKE_VFUNC_PADDING( 33 ); // - MAKE_VFUNC_PADDING( 34 ); // - MAKE_VFUNC_PADDING( 35 ); // - MAKE_VAFUNC_PADDING( 49 ); // GetAuthServer MAKE_VAFUNC_PADDING( 50 ); // GetLobbyServer MAKE_VFUNC_PADDING( 51 ); // PauseGame MAKE_VFUNC_PADDING( 52 ); // OnWin32Message MAKE_VAFUNC_PADDING( 53 ); // GetClientInfoMgr MAKE_VFUNC_PADDING( 54 ); // GetBotInfoMgr MAKE_VFUNC_PADDING( 55 ); // GetInterfaceMgr MAKE_VAFUNC_PADDING( 56 ); // GetPlayerMgr MAKE_VAFUNC_PADDING( 57 ); // GetClientWeaponAllocator MAKE_VFUNC_PADDING( 58 ); // PostLevelLoadFirstUpdate MAKE_VFUNC_PADDING( 59 ); // GetLastKeyInputTime MAKE_VFUNC_PADDING( 60 ); // RefreshLastKeyInputTime MAKE_VAFUNC_PADDING( 61 ); // SetupClientConnectionMgr MAKE_VAFUNC_PADDING( 62 ); // SetupMissionStuff MAKE_VAFUNC_PADDING( 63 ); // GetSFXMgr MAKE_VFUNC_PADDING( 64 ); // EnterChannelReq MAKE_VFUNC_PADDING( 65 ); // UpdatePerformanceStatistics }; class ccbagame_client_shell : public cgame_client_shell { public: MAKE_VFUNC_PADDING( 49 ); // GetAuthServer MAKE_VFUNC_PADDING( 50 ); // GetLobbyServer MAKE_VFUNC_PADDING( 53 ); // GetClientInfoMgr MAKE_VFUNC_PADDING( 56 ); // GetPlayerMgr MAKE_VFUNC_PADDING( 57 ); // GetClientWeaponAllocator MAKE_VFUNC_PADDING( 61 ); // SetupClientConnectionMgr MAKE_VFUNC_PADDING( 62 ); // SetupMissionStuff MAKE_VFUNC_PADDING( 63 ); // GetSFXMgr MAKE_VFUNC_PADDING( 66 ); // EnterChannelReq };

A ultima vez que vi alguém usar do próprio SDK para obter ponteiros foi em 2013 ( Kamshak ) de lá para cá usam dezenas de endereços globais na base. //Engine.exe+326ECC é o endereço da variável global: static CDatataPtrs ptrs = NULL; //Se quiser o endereço dessa função é só digitar SetMasterDatabase onde você digita para ir para um endereço no memory viewer //Ou chamar GetProcAddress com Engine.exe de módulo //Engine.SetMasterDatabase //53 - push ebx //8B 5C 24 08 - mov ebx,[esp+08] //85 DB - test ebx,ebx //0F84 B1000000 - je Engine.exe+661AE //56 - push esi //8B 35 CC6E7800 - mov esi,[ Engine.exe+326ECC ] //85 F6 - test esi,esi //75 22 - jne Engine.exe+6612A //6A 24 - push 24 //E8 9195FDFF - call Engine.exe+3F6A0 //83 C4 04 - add esp,04 //85 C0 - test eax,eax //74 0A - je Engine.exe+66120 //89 30 - mov[ eax ],esi //89 70 0C - mov[ eax + 0C ],esi //89 70 18 - mov[ eax + 18 ],esi //EB 02 - jmp Engine.exe+66122 //33 C0 - xor eax,eax //8B F0 - mov esi,eax //89 35 CC6E7800 - mov[ Engine.exe+326ECC ],esi //3B 1E - cmp ebx,[ esi ] 8B 35 ? ? ? ? 85 F6 75 22 6A 24 E8 ? ? ? ? 83 C4 04 85 C0 74 0A 89 30 89 70 0C 89 70 18 EB 02 33 C0 8B F0 89 35 ? ? ? ? 3B 1E //Adicione + 0x2 para obter o endereço correto //Depois é so atribuir a ela const auto database_ptr{ reinterpret_cast< uint32_t* >( PATTERN_SCAN + 0x2 ) }; CDatabasePtrs *m_data_base_ptr{ *reinterpret_cast< CDatabasePtrs* >( *database_ptr ) }; Essa pattern provavelmente jamais vai parar de funcionar, por que não mexem em coisas antigas do jogo, essa função provavelmente nunca irá mudar. Depois disso é só olhar o SDK e mover a classe CDatabasePtrs do ltmodule.cpp para ltmodule.h, vocês conseguem obter as seguintes interfaces: Depois vocês podem fazer algo como: if( m_data_base_ptr ) { const auto num_interfaces{ m_data_base_ptr->local_database.pointer->interfaces()->Num() }; for ( uint32_t idx{ 0 }; idx < num_interfaces; ++idx ) { std::cout << "m_name: " << m_data_base_ptr->local_database.pointer->interfaces()->get( idx )->name << '\n'; std::cout << "m_version: " << m_data_base_ptr->local_database.pointer->interfaces()->get( idx )->version << '\n'; std::cout << "m_interfaces: " << m_data_base_ptr->local_database.pointer->interfaces()->get( idx )->interfaces << '\n'; std::cout << "m_holders: " << m_data_base_ptr->local_database.pointer->interfaces()->get( idx )->holders << '\n'; std::cout << "m_current_interface: " << m_data_base_ptr->local_database.pointer->interfaces()->get( idx )->current_interface << "\n\n"; } } Então vão obter: A versão mais recente do CE agora consegue fazer a mesma função do RECLASS.NET que é obter o RTTI de classes virtuais ou abstratas caso disponível. Se usarem um pouco da cabeça isso consegue ficar mais fácil ainda ( dica: crie uma enum ). Enjoy it.

Como faz tempo que ninguém posta endereços do Combat Arms Brazil, estou postando. Me surpreende vocês nunca terem lido o básico do SDK. ------------------------------------------------------------ m_name: CA_IClientUserInfo.Default m_version: 1 m_interfaces: 02822CC0 m_holders: 02822CE8 CAPIHolder< CA_IClientUserInfo >: CAPIHolderBase __vfptr: 377CA194 m_api_name: CA_IClientUserInfo.Default m_version: 1 m_pointer: 0077BC68 m_current_interface: 0077BC68 ------------------------------------------------------------ m_name: CA_IHttpUploader.Default m_version: 1 m_interfaces: 02822D88 m_holders: 02822DB0 CAPIHolder< CA_IHttpUploader >: CAPIHolderBase __vfptr: 379D0354 m_api_name: CA_IHttpUploader.Default m_version: 1 m_pointer: 0071F418 m_current_interface: 0071F418 ------------------------------------------------------------ m_name: CA_IQueuedTaskThreadPool.Default m_version: 1 m_interfaces: 02822E70 m_holders: 02822E88 CAPIHolder< CA_IQueuedTaskThreadPool >: CAPIHolderBase __vfptr: 006D0D00 m_api_name: CA_IQueuedTaskThreadPool.Default m_version: 1 m_pointer: 0071F780 m_current_interface: 0071F780 ------------------------------------------------------------ m_name: CA_IURLDownloaderFactory.Default m_version: 1 m_interfaces: 02822F58 m_holders: 02822F80 CAPIHolder< CA_IURLDownloaderFactory >: CAPIHolderBase __vfptr: 377D1DA4 m_api_name: CA_IURLDownloaderFactory.Default m_version: 1 m_pointer: 0071F938 m_current_interface: 0071F938 ------------------------------------------------------------ m_name: ICallStack.Default m_version: 0 m_interfaces: 0282BD28 m_holders: 0282BEA8 CAPIHolder< ICallStack >: CAPIHolderBase __vfptr: 006D7BBC m_api_name: ICallStack.Default m_version: 0 m_pointer: 00000000 m_current_interface: 00000000 ------------------------------------------------------------ m_name: IClientDebugGraphMgr.Default m_version: 0 m_interfaces: 02826840 m_holders: 028266D8 CAPIHolder< IClientDebugGraphMgr >: CAPIHolderBase __vfptr: 006D2E04 m_api_name: IClientDebugGraphMgr.Default m_version: 0 m_pointer: 0072EED8 m_current_interface: 0072EED8 ------------------------------------------------------------ m_name: IClientFileMgr.Default m_version: 0 m_interfaces: 02826648 m_holders: 02826618 CAPIHolder< IClientFileMgr >: CAPIHolderBase __vfptr: 006D372C m_api_name: IClientFileMgr.Default m_version: 0 m_pointer: 00803E18 m_current_interface: 00803E18 ------------------------------------------------------------ m_name: IClientFormatMgr.Default m_version: 0 m_interfaces: 02826690 m_holders: 02826858 CAPIHolder< IClientFormatMgr >: CAPIHolderBase __vfptr: 006DDB60 m_api_name: IClientFormatMgr.Default m_version: 0 m_pointer: 0072E208 m_current_interface: 0072E208 ------------------------------------------------------------ m_name: IClientShell.Default m_version: 4 m_interfaces: 02821260 m_holders: 02821188 CAPIHolder< IClientShell >: CAPIHolderBase __vfptr: 006D2300 m_api_name: IClientShell.Default m_version: 4 m_pointer: 382EADD0 m_current_interface: 382EADD0 ------------------------------------------------------------ m_name: ICommandLineArgs.Default m_version: 0 m_interfaces: 028211A0 m_holders: 028211B8 CAPIHolder< ICommandLineArgs >: CAPIHolderBase __vfptr: 006D22EC m_api_name: ICommandLineArgs.Default m_version: 0 m_pointer: 00771E64 m_current_interface: 00771E64 ------------------------------------------------------------ m_name: ICompress.Default m_version: 0 m_interfaces: 028276E0 m_holders: 02827770 CAPIHolder< ICompress >: CAPIHolderBase __vfptr: 006D75FC m_api_name: ICompress.Default m_version: 0 m_pointer: 0073EE68 m_current_interface: 0073EE68 ------------------------------------------------------------ m_name: IErrorFilter.Default m_version: 0 m_interfaces: 0282BEC0 m_holders: 0282BDA0 CAPIHolder< IErrorFilter >: CAPIHolderBase __vfptr: 006D7BA8 m_api_name: IErrorFilter.Default m_version: 0 m_pointer: 00000000 m_current_interface: 00000000 ------------------------------------------------------------ m_name: IErrorPrint.Default m_version: 0 m_interfaces: 02821110 m_holders: 0282BDB8 CAPIHolder< IErrorPrint >: CAPIHolderBase __vfptr: 006D7B94 m_api_name: IErrorPrint.Default m_version: 0 m_pointer: 00000000 m_current_interface: 00000000 ------------------------------------------------------------ m_name: IFindObj.Default m_version: 0 m_interfaces: 02827740 m_holders: 028268D0 CAPIHolder< IFindObj >: CAPIHolderBase __vfptr: 006EAF64 m_api_name: IFindObj.Default m_version: 0 m_pointer: 0074F688 m_current_interface: 0074F688 ------------------------------------------------------------ m_name: IInstanceHandleClient.Default m_version: 4 m_interfaces: 02827530 m_holders: 028273E0 CAPIHolder< IInstanceHandleClient >: CAPIHolderBase __vfptr: 006D60F8 m_api_name: IInstanceHandleClient.Default m_version: 4 m_pointer: 37F722F8 m_current_interface: 37F722F8 ------------------------------------------------------------ m_name: IInstanceHandleServer.Default m_version: 1 m_interfaces: 028276F8 m_holders: 02827710 CAPIHolder< IInstanceHandleServer >: CAPIHolderBase __vfptr: 006D610C m_api_name: IInstanceHandleServer.Default m_version: 1 m_pointer: 00000000 m_current_interface: 00000000 ------------------------------------------------------------ m_name: ILTBenchmarkMgr.Default m_version: 0 m_interfaces: 028273F8 m_holders: 02827620 CAPIHolder< ILTBenchmarkMgr >: CAPIHolderBase __vfptr: 006D37E0 m_api_name: ILTBenchmarkMgr.Default m_version: 0 m_pointer: 0074FC70 m_current_interface: 0074FC70 ------------------------------------------------------------ m_name: ILTCSBase.Client m_version: 4 m_interfaces: 02827668 m_holders: 02827578 CAPIHolder< ILTCSBase >: CAPIHolderBase __vfptr: 377CF038 m_api_name: ILTCSBase.Client m_version: 4 m_pointer: 0073D760 m_current_interface: 0073D760 ------------------------------------------------------------ m_name: ILTCSBase.Server m_version: 4 m_interfaces: 0282BFF8 m_holders: 0282C010 No holder! m_current_interface: 00753CA0 ------------------------------------------------------------ m_name: ILTClient.Default m_version: 404 m_interfaces: 028210B0 m_holders: 028210C8 CAPIHolder< ILTClient >: CAPIHolderBase __vfptr: 006D2328 m_api_name: ILTClient.Default m_version: 404 m_pointer: 0073D760 m_current_interface: 0073D760 ------------------------------------------------------------ m_name: ILTClientSoundMgr.Default m_version: 0 m_interfaces: 02938208 m_holders: 02938340 No holder! m_current_interface: 00804E58 ------------------------------------------------------------ m_name: ILTCollisionMgr.Client m_version: 0 m_interfaces: 0282BF80 m_holders: 0282BF98 CAPIHolder< ILTCollisionMgr >: CAPIHolderBase __vfptr: 006DF4FC m_api_name: ILTCollisionMgr.Client m_version: 0 m_pointer: 00000000 m_current_interface: 00000000 ------------------------------------------------------------ m_name: ILTCollisionMgr.Server m_version: 0 m_interfaces: 029380A0 m_holders: 029382C8 CAPIHolder< ILTCollisionMgr >: CAPIHolderBase __vfptr: 006DF4FC m_api_name: ILTCollisionMgr.Server m_version: 0 m_pointer: 00000000 m_current_interface: 00000000 ------------------------------------------------------------ m_name: ILTCommon.Client m_version: 4 m_interfaces: 02826750 m_holders: 02826720 CAPIHolder< ILTCommon >: CAPIHolderBase __vfptr: 006D3768 m_api_name: ILTCommon.Client m_version: 4 m_pointer: 00772E90 m_current_interface: 00772E90 ------------------------------------------------------------ m_name: ILTCommon.Server m_version: 4 m_interfaces: 0282BE48 m_holders: 0282BF38 CAPIHolder< ILTCommon >: CAPIHolderBase __vfptr: 006D3768 m_api_name: ILTCommon.Server m_version: 4 m_pointer: 007731F0 m_current_interface: 007731F0 ------------------------------------------------------------ m_name: ILTCursor.Default m_version: 0 m_interfaces: 02821170 m_holders: 02821200 CAPIHolder< ILTCursor >: CAPIHolderBase __vfptr: 006D2314 m_api_name: ILTCursor.Default m_version: 0 m_pointer: 00773530 m_current_interface: 00773530 ------------------------------------------------------------ m_name: ILTDrawPrim.Default m_version: 0 m_interfaces: 02826900 m_holders: 02826918 CAPIHolder< ILTDrawPrim >: CAPIHolderBase __vfptr: 006D37B8 m_api_name: ILTDrawPrim.Default m_version: 0 m_pointer: 00781F78 m_current_interface: 00781F78 ------------------------------------------------------------ m_name: ILTFontManager.Default m_version: 0 m_interfaces: 02827440 m_holders: 028276B0 CAPIHolder< ILTFontManager >: CAPIHolderBase __vfptr: 006D37CC m_api_name: ILTFontManager.Default m_version: 0 m_pointer: 007794B4 m_current_interface: 007794B4 ------------------------------------------------------------ m_name: ILTModel.Client m_version: 0 m_interfaces: 02826768 m_holders: 02826780 CAPIHolder< ILTModel >: CAPIHolderBase __vfptr: 006D377C m_api_name: ILTModel.Client m_version: 0 m_pointer: 007722B0 m_current_interface: 007722B0 ------------------------------------------------------------ m_name: ILTModel.Server m_version: 0 m_interfaces: 0282BC80 m_holders: 0282BD88 CAPIHolder< ILTModel >: CAPIHolderBase __vfptr: 006D377C m_api_name: ILTModel.Server m_version: 0 m_pointer: 00772868 m_current_interface: 00772868 ------------------------------------------------------------ m_name: ILTModelClient.Default m_version: 0 m_interfaces: 02938280 m_holders: 029382F8 CAPIHolder< ILTModelClient >: CAPIHolderBase __vfptr: 377CEFAC m_api_name: ILTModelClient.Default m_version: 0 m_pointer: 007722B0 m_current_interface: 007722B0 ------------------------------------------------------------ m_name: ILTPhysics.Client m_version: 0 m_interfaces: 028275D8 m_holders: 02827698 CAPIHolder< ILTPhysics >: CAPIHolderBase __vfptr: 006D37F4 m_api_name: ILTPhysics.Client m_version: 0 m_pointer: 00773748 m_current_interface: 00773748 ------------------------------------------------------------ m_name: ILTPhysics.Server m_version: 0 m_interfaces: 0282BFE0 m_holders: 0282BFB0 CAPIHolder< ILTPhysics >: CAPIHolderBase __vfptr: 006D37F4 m_api_name: ILTPhysics.Server m_version: 0 m_pointer: 00773958 m_current_interface: 00773958 ------------------------------------------------------------ m_name: ILTRenderMgr.Default m_version: 0 m_interfaces: 0282BED8 m_holders: 0282BE60 CAPIHolder< ILTRenderMgr >: CAPIHolderBase __vfptr: 377CF010 m_api_name: ILTRenderMgr.Default m_version: 0 m_pointer: 007508B8 m_current_interface: 007508B8 ------------------------------------------------------------ m_name: ILTRenderStyles.Default m_version: 0 m_interfaces: 0282BEF0 m_holders: 0282BD58 CAPIHolder< ILTRenderStyles >: CAPIHolderBase __vfptr: 006D9114 m_api_name: ILTRenderStyles.Default m_version: 0 m_pointer: 00776990 m_current_interface: 00776990 ------------------------------------------------------------ m_name: ILTServer.Default m_version: 404 m_interfaces: 02820508 m_holders: 02821128 CAPIHolder< ILTServer >: CAPIHolderBase __vfptr: 006D1448 m_api_name: ILTServer.Default m_version: 404 m_pointer: 00753CA0 m_current_interface: 00753CA0 ------------------------------------------------------------ m_name: ILTSoundMgr.Client m_version: 0 m_interfaces: 02826828 m_holders: 028268E8 CAPIHolder< ILTSoundMgr >: CAPIHolderBase __vfptr: 006D3790 m_api_name: ILTSoundMgr.Client m_version: 0 m_pointer: 00804E58 m_current_interface: 00804E58 ------------------------------------------------------------ m_name: ILTSoundMgr.Server m_version: 0 m_interfaces: 0282BC68 m_holders: 0282BD40 CAPIHolder< ILTSoundMgr >: CAPIHolderBase __vfptr: 006D3790 m_api_name: ILTSoundMgr.Server m_version: 0 m_pointer: 00773D28 m_current_interface: 00773D28 ------------------------------------------------------------ m_name: ILTTexInterface.Default m_version: 0 m_interfaces: 028211E8 m_holders: 028210E0 CAPIHolder< ILTTexInterface >: CAPIHolderBase __vfptr: 006D22D8 m_api_name: ILTTexInterface.Default m_version: 0 m_pointer: 0074D590 m_current_interface: 0074D590 ------------------------------------------------------------ m_name: ILTTransform.Default m_version: 0 m_interfaces: 02826678 m_holders: 028266F0 CAPIHolder< ILTTransform >: CAPIHolderBase __vfptr: 006D3754 m_api_name: ILTTransform.Default m_version: 0 m_pointer: 00773AA0 m_current_interface: 00773AA0 ------------------------------------------------------------ m_name: ILTVideoMgr.Default m_version: 0 m_interfaces: 02826948 m_holders: 02826930 CAPIHolder< ILTVideoMgr >: CAPIHolderBase __vfptr: 006D37A4 m_api_name: ILTVideoMgr.Default m_version: 0 m_pointer: 00774308 m_current_interface: 00774308 ------------------------------------------------------------ m_name: ILocaleManager.Default m_version: 0 m_interfaces: 02827458 m_holders: 02827608 CAPIHolder< ILocaleManager >: CAPIHolderBase __vfptr: 006D41E4 m_api_name: ILocaleManager.Default m_version: 0 m_pointer: 00805EA8 m_current_interface: 00805EA8 ------------------------------------------------------------ m_name: IModelManipulator.Client m_version: 0 m_interfaces: 02938310 m_holders: 02938268 No holder! m_current_interface: 00804CB4 ------------------------------------------------------------ m_name: IModelManipulator.Server m_version: 0 m_interfaces: 029381C0 m_holders: 02938328 No holder! m_current_interface: 00804CFC ------------------------------------------------------------ m_name: IModelManipulatorClient.Default m_version: 0 m_interfaces: 02938160 m_holders: 02938178 CAPIHolder< IModelManipulatorClient >: CAPIHolderBase __vfptr: 377CEFFC m_api_name: IModelManipulatorClient.Default m_version: 0 m_pointer: 00804CB4 m_current_interface: 00804CB4 ------------------------------------------------------------ m_name: IServerConsoleState.Default m_version: 0 m_interfaces: 0282BE78 m_holders: 0282BCF8 CAPIHolder< IServerConsoleState >: CAPIHolderBase __vfptr: 006DADA0 m_api_name: IServerConsoleState.Default m_version: 0 m_pointer: 00753020 m_current_interface: 00753020 ------------------------------------------------------------ m_name: IServerFileMgr.Default m_version: 0 m_interfaces: 02827410 m_holders: 02827518 CAPIHolder< IServerFileMgr >: CAPIHolderBase __vfptr: 006D41D0 m_api_name: IServerFileMgr.Default m_version: 0 m_pointer: 00788070 m_current_interface: 00788070 ------------------------------------------------------------ m_name: IServerShell.Default m_version: 4 m_interfaces: 02821230 m_holders: 028210F8 CAPIHolder< IServerShell >: CAPIHolderBase __vfptr: 006D1470 m_api_name: IServerShell.Default m_version: 4 m_pointer: 00000000 m_current_interface: 00000000 ------------------------------------------------------------ m_name: ISysFontManager.Default m_version: 0 m_interfaces: 02938088 m_holders: 029380B8 CAPIHolder< ISysFontManager >: CAPIHolderBase __vfptr: 006E28CC m_api_name: ISysFontManager.Default m_version: 0 m_pointer: 00774928 m_current_interface: 00774928 ------------------------------------------------------------ m_name: IWorldBlindObjectData.Default m_version: 0 m_interfaces: 028267E0 m_holders: 02826810 CAPIHolder< IWorldBlindObjectData >: CAPIHolderBase __vfptr: 006D3740 m_api_name: IWorldBlindObjectData.Default m_version: 0 m_pointer: 00770E30 m_current_interface: 00770E30 ------------------------------------------------------------ m_name: IWorldBlockerData.Default m_version: 0 m_interfaces: 028274A0 m_holders: 028274D0 CAPIHolder< IWorldBlockerData >: CAPIHolderBase __vfptr: 006D4824 m_api_name: IWorldBlockerData.Default m_version: 0 m_pointer: 00770FA8 m_current_interface: 00770FA8 ------------------------------------------------------------ m_name: IWorldClient.Default m_version: 0 m_interfaces: 02827560 m_holders: 02827728 No holder! m_current_interface: 00771398 ------------------------------------------------------------ m_name: IWorldClientBSP.Default m_version: 0 m_interfaces: 028265D0 m_holders: 02826888 CAPIHolder< IWorldClientBSP >: CAPIHolderBase __vfptr: 006D3704 m_api_name: IWorldClientBSP.Default m_version: 0 m_pointer: 00771398 m_current_interface: 00771398 ------------------------------------------------------------ m_name: IWorldParticleBlockerData.Default m_version: 0 m_interfaces: 02827638 m_holders: 02827650 CAPIHolder< IWorldParticleBlockerData >: CAPIHolderBase __vfptr: 006D3808 m_api_name: IWorldParticleBlockerData.Default m_version: 0 m_pointer: 007715B8 m_current_interface: 007715B8 ------------------------------------------------------------ m_name: IWorldServer.Default m_version: 0 m_interfaces: 029382E0 m_holders: 02938370 No holder! m_current_interface: 00771910 ------------------------------------------------------------ m_name: IWorldServerBSP.Default m_version: 0 m_interfaces: 0282BD70 m_holders: 0282BE00 CAPIHolder< IWorldServerBSP >: CAPIHolderBase __vfptr: 006D848C m_api_name: IWorldServerBSP.Default m_version: 0 m_pointer: 00771910 m_current_interface: 00771910 ------------------------------------------------------------ m_name: IWorldSharedBSP.Default m_version: 0 m_interfaces: 02826630 m_holders: 02826708 CAPIHolder< IWorldSharedBSP >: CAPIHolderBase __vfptr: 006D3718 m_api_name: IWorldSharedBSP.Default m_version: 0 m_pointer: 00803D28 m_current_interface: 00803D28 ------------------------------------------------------------

CPlayerMgr do CABR Para aimbot pode utilizar em vez do camera mode que vocês usam de uma classe curta! Usem o m_hCamera e façam um cast para int* no caso como estou em C++ usei ReCa: [hide][/hide] E para yaw e pitch utilizem m_fYaw e m_fPitch! ----------------------------------------------------------------------------------------------------------------------- Hover Hack FIXED!!! Para quem não sabe sou o criador desta função que originalmente chamou-se Air Walk e que veio para substituir o FLY. //Vai de brinde vector da ClientFX para positions inline class CClientFX { public: char pad_0x0000[0xC8]; //0x0000 TVector3 m_vPos; }*p_client_fx; /* --------------------------------------------------------------------------------------- */ if (functions::hover_hack) { const unsigned int m_client_fx = *reinterpret_cast<DWORD*>(reinterpret_cast<DWORD>( GetModuleHandle("ClientFX.fxd")) + 0x6CF34); p_client_fx = reinterpret_cast<CClientFX*>(m_client_fx); if (GetAsyncKeyState(VK_UP) < 0) { functions::lock_pos_z = true; p_player_mgr->m_pMoveMgr->m_fGravity = 0.f; p_client_fx->m_vPos.z += functions::f_hover_hack; functions::last_position = p_client_fx->m_vPos; } if (GetAsyncKeyState(VK_DOWN) < 0) { functions::lock_pos_z = true; p_player_mgr->m_pMoveMgr->m_fGravity = 0.f; p_client_fx->m_vPos.z -= functions::f_hover_hack; functions::last_position = p_client_fx->m_vPos; } if (GetAsyncKeyState(VK_RIGHT)) { functions::lock_pos_z = false; p_player_mgr->m_pMoveMgr->m_fGravity = -1100.f; } if (functions::lock_pos_z) p_client_fx->m_vPos.z = functions::last_position.z; }

Discord para dúvidas! Não ligo para MU e nem sei como joga! Introdução Estou trazendo um bypass que escrevi para o MuSpecial ( que usa MuHackProtection ). "Nota: O bypass não é para o MuHackProtection e sim para o MuSpecial" É um bypass external e usermode, já que o anticheat é usermode! Informações String Stack //MHPClient.dll //Aqui fica onde eles montam as strings para o SPLASH SCREEN quando da hack detected! 5B29AB20 | 8A88 F02E2A5B | MOV CL,BYTE PTR DS:[EAX+5B2A2EF0] | 5B29AB26 | 80E9 1B | SUB CL,1B | 5B29AB29 | 80F1 0C | XOR CL,C | 5B29AB2C | 8888 60502B5B | MOV BYTE PTR DS:[EAX+5B2B5060],CL | eax+5B2B5060:"5EB0DC5E-B9B991A5-C218FC1B-D30FE8BE" 5B29AB32 | 40 | INC EAX | 5B29AB33 | 3D 00010000 | CMP EAX,100 | 5B29AB38 | 72 E6 | JB mhpclient.5B29AB20 | 5B29AB3A | 8B55 0C | MOV EDX,DWORD PTR SS:[EBP+C] | [ebp+C]:"Suspected executions were found" 5B29AB3D | 8B45 08 | MOV EAX,DWORD PTR SS:[EBP+8] | 5B29AB40 | 52 | PUSH EDX | 5B29AB41 | 6A 01 | PUSH 1 | 5B29AB43 | 50 | PUSH EAX | 5B29AB44 | 68 60502B5B | PUSH mhpclient.5B2B5060 | 5B2B5060:"[SplashScreen] SplashType: %d, TextSwitch: %d, DisplayText: %s" 5B29AB49 | 6A 00 | PUSH 0 | 5B29AB4B | B9 40A42A5B | MOV ECX,mhpclient.5B2AA440 | 5B2AA440:&"pP)[,@*[ T)[SOFTWARE\\Webzen\\Mu\\Config" 5B29AB50 | E8 BBA6FFFF | CALL mhpclient.5B295210 | TerminateProcess //MHPClient.dll //Aqui é onde ocorre a call da TerminateProcess logo depois do splash screen! //Eles não fazem a chamada diretamente, no caso ESI contém o endereço da TerminateProcess 5B29A713 | 8B35 D8F0295B | MOV ESI,DWORD PTR DS:[<&TerminateProcess>] | 5B29A719 | 8B3D D0F0295B | MOV EDI,DWORD PTR DS:[<&GetCurrentProcess>] | 5B29A71F | 90 | NOP | 5B29A720 | 6A 00 | PUSH 0 | 5B29A722 | FFD7 | CALL EDI | 5B29A724 | 50 | PUSH EAX | 5B29A725 | FFD6 | CALL ESI | 5B29A727 | FF25 00000000 | JMP DWORD PTR DS:[0] | 5B29A72D | EB F1 | JMP mhpclient.5B29A720 | 5B29A72F | CC | INT3 | Load MHPClient.dll ( CRC Error ) //Main.dll //Aqui é onde ocorre a call para LoadLibraryA e depois um check se foi carregada //Eu só adicionei um jmp na condição e pronto ( não tem heartbeat até o momento em que foi colocado o bypass em meu github a 10 dias ) 5A8E27BE | 53 | PUSH EBX | ebx:"MHPClient.dll" 5A8E27BF | FF15 44808E5A | CALL DWORD PTR DS:[<&LoadLibraryA>] | 5A8E27C5 | 85C0 | TEST EAX,EAX | 5A8E27C7 | 75 1B | JNE main.5A8E27E4 | 5A8E27C9 | 6A 10 | PUSH 10 | 5A8E27CB | 68 389C8E5A | PUSH main.5A8E9C38 | 5A8E9C38:"Error" 5A8E27D0 | 68 3C9E8E5A | PUSH main.5A8E9E3C | 5A8E9E3C:"Plugin load error!" 5A8E27D5 | 50 | PUSH EAX | 5A8E27D6 | FF15 A8818E5A | CALL DWORD PTR DS:[<&MessageBoxA>] | 5A8E27DC | 6A 00 | PUSH 0 | 5A8E27DE | FF15 24808E5A | CALL DWORD PTR DS:[<&ExitProcess>] | 5A8E27E4 | 68 509E8E5A | PUSH main.5A8E9E50 | 5A8E9E50:"EntryProc" Bom foi isso que eu peguei, eu dei "bypass" no TerminateProcess por primeiro, em seguida vi que não tinha heartbeat então fui procurar onde ele era carregado. Github [Hidden Content] Discord Define#5696 iPower pela ajuda de sempre..

Quando você abre o Zoom da arma ou Sniper seu personagem ganha um Delay e fica mais lento... Isso remove essa comparação feita. CPlayerMgr::IsZoomed const uintptr_t IsZoomed = 0x37101615; void CPlayerMgr_IsZoomed() { *reinterpret_cast<PWORD>(IsZoomed) = 0x01B8; //OU VOCÊ PODE USAR MEMCPY memcpy(reinterpret_cast<void*>(IsZoomed), static_cast<const void*>("\xB8\x01"), 2); } Créditos Define (Não sei) Devecchi (Gordo me corrigindo com cast) iPower (Me ajudando a deixar meu código bonito hehe)

Comecei a ver sobre renderização de certas coisas e acabei encontrando algo legal até. Você pode manusear o FOG quando vira um zumbi, é meio inútil e serve mais para encher linguiça em menu mas caso queiram.. cshell.dll+68C2 - 74 0E - je cshell.dll+68D2 cshell.dll+68C4 - 80 B8 D8050000 00 - cmp byte ptr [eax+000005D8],00 { 0 } cshell.dll+68CB - 74 05 - je cshell.dll+68D2 cshell.dll+68CD - E8 7EB4FFFF - call cshell.dll+1D50 cshell.dll+68D2 - 83 7F 10 00 - cmp dword ptr [edi+10],00 { 0 } Então para ignorar esse FOG sendo zumbi basta: cshell.dll+68C2 - 74 0E - je cshell.dll+68D2 cshell.dll+68C4 - 80 B8 D8050000 00 - cmp byte ptr [eax+000005D8],00 { 0 } cshell.dll+68CB - 74 05 - jmp cshell.dll+68D2 cshell.dll+68CD - E8 7EB4FFFF - call cshell.dll+1D50 cshell.dll+68D2 - 83 7F 10 00 - cmp dword ptr [edi+10],00 { 0 } Basta fazer um JMP assim você não corre o risco de nopar algum byte a mais e crashar o game. Buffer Byte: 74 05 New Byte: EB 05 74 = je EB = jmp 05 = 5 bytes

ESSE POST VAI SER EDITADO CONFORME EU VOU ACHANDO MAIS ALGUMA COISA! Comecei a ver sobre renderização de certas coisas e acabei encontrando algo legal até. [spoiler=IDA] [spoiler=IDA] [spoiler=FOG] cshell.dll+68C2 - 74 0E - je cshell.dll+68D2 cshell.dll+68C4 - 80 B8 D8050000 00 - cmp byte ptr [eax+000005D8],00 { 0 } cshell.dll+68CB - 74 05 - je cshell.dll+68D2 cshell.dll+68CD - E8 7EB4FFFF - call cshell.dll+1D50 cshell.dll+68D2 - 83 7F 10 00 - cmp dword ptr [edi+10],00 { 0 } Então para ignorar esse FOG sendo zumbi basta: cshell.dll+68C2 - 74 0E - je cshell.dll+68D2 cshell.dll+68C4 - 80 B8 D8050000 00 - cmp byte ptr [eax+000005D8],00 { 0 } cshell.dll+68CB - 74 05 - jmp cshell.dll+68D2 cshell.dll+68CD - E8 7EB4FFFF - call cshell.dll+1D50 cshell.dll+68D2 - 83 7F 10 00 - cmp dword ptr [edi+10],00 { 0 } Basta fazer um JMP assim você não corre o risco de nopar algum byte a mais e crashar o game. Buffer Byte: 74 05 New Byte: EB 05 74 = je EB = jmp 05 = 5 bytes Modo SnowballFight Você pode ignorar esse congelamento caso deseje [spoiler=SNOWBALLFIGHT] cshell.dll+68F9 - 74 07 - je cshell.dll+6902 cshell.dll+68FB - 8B CF - mov ecx,edi cshell.dll+68FD - E8 FEB3FFFF - call cshell.dll+1D00 cshell.dll+6902 - 8B 8F 98020000 - mov ecx,[edi+00000298] cshell.dll+68F9 - EB 07 - jmp cshell.dll+6902 cshell.dll+68FB - 8B CF - mov ecx,edi cshell.dll+68FD - E8 FEB3FFFF - call cshell.dll+1D00 cshell.dll+6902 - 8B 8F 98020000 - mov ecx,[edi+00000298] Buffer Byte: 75 07 New Byte: EB 07 74 = je EB = jmp 07 = 7 bytes //Dano recebido [spoiler=DANO] cshell.dll+68E3 - 74 07 - je cshell.dll+68EC cshell.dll+68E5 - 8B CF - mov ecx,edi cshell.dll+68E7 - E8 B4B4FFFF - call cshell.dll+1DA0 cshell.dll+68EC - 8B 0D 88A6D137 - mov ecx,[cshell.dll+C1A688] { [05637198] } cshell.dll+68E3 - 74 07 - jmp cshell.dll+68EC cshell.dll+68E5 - 8B CF - mov ecx,edi cshell.dll+68E7 - E8 B4B4FFFF - call cshell.dll+1DA0 cshell.dll+68EC - 8B 0D 88A6D137 - mov ecx,[cshell.dll+C1A688] { [05637198] } Buffer Byte: 74 07 New Byte: EB 07 74 = je EB = jmp 07 = 7 bytes [spoiler=Crosshair] cshell.dll+6A92 - 74 16 - je cshell.dll+6AAA cshell.dll+6A94 - 8B 06 - mov eax,[esi] cshell.dll+6A96 - 8B 50 74 - mov edx,[eax+74] cshell.dll+6A99 - 8B CE - mov ecx,esi cshell.dll+6A9B - FF D2 - call edx cshell.dll+6A9D - 80 B8 E0030000 00 - cmp byte ptr [eax+000003E0],00 { 0 } cshell.dll+6AA4 - 0F85 DE010000 - jne cshell.dll+6C88 cshell.dll+6AAA - D9EE - fldz cshell.dll+6A92 - 75 16 - jne cshell.dll+6AAA cshell.dll+6A94 - 8B 06 - mov eax,[esi] cshell.dll+6A96 - 8B 50 74 - mov edx,[eax+74] cshell.dll+6A99 - 8B CE - mov ecx,esi cshell.dll+6A9B - FF D2 - call edx cshell.dll+6A9D - 80 B8 E0030000 00 - cmp byte ptr [eax+000003E0],00 { 0 } cshell.dll+6AA4 - 0F85 DE010000 - jne cshell.dll+6C88 cshell.dll+6AAA - D9EE - fldz Buffer Byte: 74 16 New Byte: 75 16 74 = je 75 = jne 16 = 16 bytes

#include "DirectX.h" cDirectX *DirectX; DWORD dwPresent_Ret; VOID WINAPI hkPresent(LPDIRECT3DDEVICE9 pDevice, const RECT *a, const RECT *b, HWND c, const RGNDATA *d) { gLTClient->PushToConsole("SkelModelStencil 1" ); } _declspec(naked) void PresentHook(){ _asm{ MOV EDI,DWORD PTR SS:[EBP+0x8] TEST EDI,EDI PUSHFD PUSHAD PUSH [EBP+0x18]// D PUSH [EBP+0x14]// C PUSH [EBP+0x10]// B PUSH [EBP+0x0C]// A PUSH [EBP+0x08]// Device CALL hkPresent POPAD POPFD jmp dwPresent_Ret } } VOID cDirectX::CreateDevice(DWORD *dwVTable) { LPDIRECT3D9 pD3d9; LPDIRECT3DDEVICE9 pD3DDevice; pD3d9 = Direct3DCreate9(D3D_SDK_VERSION); if(pD3d9 == NULL) return; D3DPRESENT_PARAMETERS pPresentParms; ZeroMemory(&pPresentParms, sizeof(pPresentParms)); pPresentParms.Windowed = TRUE; pPresentParms.BackBufferFormat = D3DFMT_UNKNOWN; pPresentParms.SwapEffect = D3DSWAPEFFECT_DISCARD; if(FAILED(pD3d9->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, GetDesktopWindow(), D3DCREATE_SOFTWARE_VERTEXPROCESSING, &pPresentParms, &pD3DDevice))) return; DWORD *dwTable = (DWORD *)pD3DDevice; dwTable = (DWORD *) dwTable[0]; dwVTable[0] = dwTable[16];//Reset dwVTable[1] = dwTable[17];//Present dwVTable[2] = dwTable[42];//Refrence Only EndScene } DWORD WINAPI Hook(LPVOID lpArgs){ while(GetModuleHandle("d3d9.dll")==NULL) Sleep(250); DWORD dwVtbl[3] = {0}; Engine = new cEngine(); DirectX->CreateDevice(dwVtbl); DWORD PSHOOK = dwVtbl[1] + 0x7; dwPresent_Ret = PSHOOK + 0x5; // Present Address + Hooked 0x7 Bytes In + 0x5 Bytes for return Framework->CreateJump((DWORD)PSHOOK, (DWORD)&PresentHook); //Engine->GetPointers(); return 0; }

[CENTER][FONT=Times New Roman][COLOR=#ff0000][B]@CodeHACKING by LUAN DEVECCHI[/B] [B]PROGRAMA USADO PROGRAMADO PARA PEGAR A SOURCE CODADO PELO DEVECCHI[/B] [B]BY : LizUnPacker [/B][/COLOR] [B][Source-Code] Por banir do Discord[/B] [B]A pedido do : [A]bsolut , DarkBytes e do GR Cheats[/B][/FONT] [B][FONT=Times New Roman][COLOR=#ff0000]AI COM AJUDA DO SMOLL_ICE $ CRACKTOR HOOKAH DARK BYTES CODE BUILDING TODA [/COLOR][/FONT][/B] [FONT=Times New Roman][B]Pena que o WanOliveira abandonou tudo e deixou dois cara fazendo m**** no servidor :([/B][/FONT] [FONT=Times New Roman][B][IMG][Hidden Content]] [/B] [B][Hidden Content][/FONT][/CENTER][FONT=Times New Roman][/FONT] [CENTER][/CENTER]

Bom, eu gostaria de um bypass pra injetar um hack no CABR, eu nao consigo o meu unico bypass foi pro saco, ae eu consegui pegar todos address e alguns offsets! Engine Entry Point : 0x460000 Engine .code Size : 0x26EA00 Engine .code Offset : 0x1000 CShell Entry Point : 0x37100000 CShell .code Size : 0x6B0C00 CShell .code Offset : 0x1000 d3d9.dll Entry Point : 0x6B740000 d3d9.dll .code Size : 0x1A7C00 d3d9.dll .code Offset : 0x1000 //================[ HookEngine ]================|| #define StartOptimized2D 0x539220 #define PresentEngine 0x61C3A6 #define BeginEndScene 0x575150 #define DipEngine 0x61F44D #define Start3D 0x538E4F #define EndScene 0x5736F3 //================[ Engine.exe ]================|| #define DeviceGame 0x7DB480 #define LTClientEXE 0x48EAE0 #define SendToServer 0x47D8E0 #define WorldToScreen 0x49ABC0 #define CursorCenter 0x75B574 #define DrawPrimitive 0x754E30 #define IntersectSegment 0x47B1B0 #define GlassWall 0x5741EA #define WireFrame 0x581A19 Failed to update RemoveTexture Failed to update FullBright Failed to update RemoveEffects //================[ CShell.dll ]================|| #define UnlimitedAmmo 0x374BFE27 #define WeaponSet 0x37CACA40 #define LTClientDLL 0x37C3C378 #define PlayerByIndex 0x371B34F1 #define GCS 0x37C7C9D0 #define PlayerManager 0x37C7CAB4 #define PlayerStatus 0x37C58610 #define CharacterFX 0x37C58B38 #define LocalPlayer 0x371B44E1 #define ClientInfoMgr 0x5737C37A #define WeaponMGR 0x37CAD034 #define GetConsoleInt 0x37435E60 ............................................................. Se desejar o resto das address e so vir PM, e negociamos, eu peguei todos os address e uns bonus, foram 76 address todos atualizados! Se desejar o resto das address e so vir PM, e negociamos, eu peguei todos os address e uns bonus, foram 76 address todos atualizados! Créditos: Underllag

Eai galera, como ninguém posta muita coisa pra esse jogo, decidi compartilhar uma coisa aqui que estava guardado a muito, muito tempo.. Faz um tempinho que não faço mais hack pra esse jogo, então não sei se esses offsets mudaram ou não, mas... class cArmaJogador { public: char _0x0000[20]; __int32 Silenciador; //0x0014 char _0x0018[48]; __int32 PosMira; //0x0048 char _0x004C[164]; __int32 ArmaID; //0x00F0 char _0x00F4[4]; cArmaInfo* pArmaInfo; //0x00F8 char _0x0100[44]; float TamanhoMira; //0x0128 char _0x012C[12]; __int32 FogoRapido; //0x0138 __int32 Muniçao; //0x013C __int32 CartuchoHacker; //0x0140 __int32 SemSelecionar; //0x0144 char _0x0148[8]; __int32 Carregamento; //0x0150 char _0x0154[16]; __int32 SemArma; //0x0164 0 ativa char _0x0168[68]; D3DXVECTOR3 Pos; //0x01AC };//Size=0x0440 Pra quem entende de como funciona o jogo, não preciso dizer onde essa classe está localizada. cArmaInfo é a classe que vocês usam na weapon manager. Alguns outros endereços ( base da player manager somado com os respectivos offsets ( player status, pitch.. ) ). #define PlayerManager 0x37C7CAB4 #define JogadorZ 0x37C585F0 #define ArmaInformacao 0x37C585F8 #define PlayerStatus 0x37C58618 #define Pitch 0x37C58634 #define Yaw 0x37C58638 #define Time 0x37C587D8 #define Vida 0x37C588D4 #define AP 0x37C588D8 #define Stamina 0x37C58A74 Bom é isso, provavelmente esse será uma das minhas últimas contribuições pra esse jogo. Créditos ao Dash por fazer comigo essa classe ( ArmaJogador ) na época ( anos e anos atrás... ).

Estava aqui estacionado... usei para aprender a como fazer um logger.. Base do gellin.. eu removi algumas coisas. Não tenho certeza se esta pegando todos endereços corretos. Serve mais para estudo... ############################################### # # # Logger CA Classic # # Base por Gellin # # #define 10-03-2018 # # # ############################################### Aguardando o jogo... Pronto para continuar, escaneando logs... Engine Entry Point: 0x460000 Engine .code Tamanho: 0x2B7000 Engine .code Offset: 0x1000 CShell Entry Point: 0x37100000 CShell .code Tamanho: 0x6CA200 CShell .code Offset: 0x1000 Logger CA Classic INICIANDO... ########################[HookEngine]######################## #define ADDR_PRESENTENGINE 0x006605F6 #define ADDR_DIPENGINE 0x0066369D ########################[Engine.exe]######################## #define ADDR_SENDTOSERVER 0x0047D640 #define ADDR_WORLDTOSCREEN 0x0049A890 #define ADDR_GLASSWALL 0x005B843A #define ADDR_WIREFRAME 0x005C5C69 #define ADDR_LTCLIENTEXE 0x0048E7B0 #define ADDR_INTERSECTSEGMENT 0x0047AF30 #define ADDR_REMOVETEXTURE 0x005B844D #define ADDR_FULLBRIGHT 0x005B85D3 Logger Completo... Baixar VirusTotal Jotti Créditos Gellin pela base