Updating cubeone.....

[nilly]

I'll make a tutorial on making a full screen client sometime in the future. There are still a few things I want to look at before releasing it.

---------- Post added at 08:56 AM ---------- Previous post was at 08:42 AM ----------

Getting the new variable names can be a little tricky. Basically when I found cubeone's auto-nexus code, I took a look at all the variables in the code that could possibly change (_-UI, _-xY, and etc...) with a new client. From there I looked for where those variables were used inside the original code (non hacked code) of cubeone's client. Then looked through a dump of the current client's scripts for similar areas to see if I could see similarities. Often the code will look identical only the names changed. This is how I found the new variable name in the current client.

It can take some time. I would definitely use a program that can search text inside files as that makes things much easier.

[UltraN00b]

Now thats good! I tried the same thing using Microgram, edited the wrapper classes, but couldn't embed the updated flash client.

[nilly]

Well I just got the aimbot working in the new client. It took some muscle to get it in there but I did it. My original intent if I were to get the aimbot working was to make a tutorial on how to add the aimbot code to the client but the process isn't exactly straight forward. I'll have to think about this.

---------- Post added at 12:54 PM ---------- Previous post was at 12:51 PM ----------

BTW Kong, thanks for the tip on Rabcdasm. It is pretty nice.

[thefeint]

Well I just got the aimbot working in the new client. It took some muscle to get it in there but I did it. My original intent if I were to get the aimbot working was to make a tutorial on how to add the aimbot code to the client but the process isn't exactly straight forward. I'll have to think about this.

---------- Post added at 12:54 PM ---------- Previous post was at 12:51 PM ----------

BTW Kong, thanks for the tip on Rabcdasm. It is pretty nice.

WOW please please please release this new one with the autonexus and aimbot!!!!

[Dr Donkey Kong]

Awesome news, i reformatted my computer and installed water cooling. Overclocking to 4.2GHz now, so i got distracted

[059]

Well I just got the aimbot working in the new client. It took some muscle to get it in there but I did it. My original intent if I were to get the aimbot working was to make a tutorial on how to add the aimbot code to the client but the process isn't exactly straight forward. I'll have to think about this.

---------- Post added at 12:54 PM ---------- Previous post was at 12:51 PM ----------

BTW Kong, thanks for the tip on Rabcdasm. It is pretty nice.

Great news!


Also anyone know why this happens? http://www.mpgh.net/forum/599-realm-...name-kind.html This is why I don't use rabcdasm.

[nilly]

059, try rabcasm. You already disassembled the .abc file with rabcdasm. After you made your changes you need to assemble the .asasm files with rabcasm (no d).

[UltraN00b]

Nilly please don't make a client... rather make a post on how to do the autoaim. Believe me, after getting 2,000+ downloads on my clent, not a single thanks, upon that people were doing Hurr Durr I don't know how to run swf!!Author cant make hackzzzz !! Hurlp Plzzzz!!

---------- Post added at 01:39 AM ---------- Previous post was at 01:35 AM ----------

And... look at what happened to CubE's Client, people just put their own names and posted the same client... Over and Over and Over Again!!!

[nilly]

Well keeping with the spirit of the thread, here is the aimbot code for v123.4.4:

  trait method QName(PackageNamespace(""), "_-0B8")
   method
    refid "com.company.assembleegameclient.objects:Player/_-0B8"
    param QName(PackageNamespace(""), "Number")
    returns QName(PackageNamespace(""), "void")
    body
     maxstack 16
     localcount 16
     initscopedepth 16
     maxscopedepth 18
     code
      pushfalse
      pushtrue
      setlocal2
      setlocal3
      getlocal0
      pushscope
      getlocal1
      getlex              QName(PackageNamespace("com.company.assembleegameclient.parameters"), "Parameters")
      getproperty         QName(PackageNamespace(""), "data_")
      getproperty         Multiname("cameraAngle", [PrivateNamespace("*", "com.company.assembleegameclient.objects:Player#0"), PackageNamespace(""), PrivateNamespace("*", "com.company.assembleegameclient.objects:Player#1"), PackageNamespace("com.company.assembleegameclient.objects"), PackageInternalNs("com.company.assembleegameclient.objects"), Namespace("http://adobe.com/AS3/2006/builtin"), ProtectedNamespace("_-00H"), StaticProtectedNs("_-00H"), StaticProtectedNs("_-M4"), StaticProtectedNs("_-036"), StaticProtectedNs("_-QF"), StaticProtectedNs("Object")])
	  add
      setlocal            7
      getlex              QName(PackageNamespace(""), "map_")
      getproperty         QName(PackageNamespace(""), "gs_")
      getproperty         QName(PackageNamespace(""), "mui_")
      getproperty         QName(PackageNamespace(""), " use") ;<-Doesn't resolve to the right address, hex edit to fix
	  iftrue              L138
      pushnull
      coerce              QName(PackageNamespace("com.company.assembleegameclient.objects"), "GameObject")
      setlocal            4
      pushbyte            255
      setlocal            8
      pushbyte            0
      setlocal            9
      pushbyte            0
      setlocal            10
      pushnull
      coerce_a
      setlocal            11
      pushbyte            0
      setlocal            12
      pushbyte            0
      setlocal            13
      pushbyte            0
      setlocal            5
      getlex              QName(PackageNamespace(""), "map_")
      getproperty         QName(PackageNamespace(""), "goDict_")
      coerce_a
      setlocal            6
      jump                L131
L40:
      label
      getlocal            6
      getlocal            5
      nextvalue
      coerce              QName(PackageNamespace("com.company.assembleegameclient.objects"), "GameObject")
      setlocal            4
      getlocal            4
	  getlex              QName(PackageNamespace("com.company.assembleegameclient.objects"), "Player")
      istypelate
      iftrue              L131
	  getlocal			  4
      getlex              QName(PackageNamespace("com.company.assembleegameclient.objects"), "Character")
      istypelate
      iffalse             L131
	  getlocal			  4
      getproperty         QName(PackageNamespace(""), "props_")
      getproperty         QName(PackageNamespace(""), "isEnemy_")
	  iffalse             L131
      getlocal            4
      callproperty        QName(PackageNamespace(""), " case"), 0
      iftrue              L131
      getlocal            4
      callproperty        QName(PackageNamespace(""), "_-Fo"), 0
      iftrue              L131
      getlocal            4
      callproperty        QName(PackageNamespace(""), "_-IB"), 0
      iftrue              L131
      getlocal            4
      callproperty        QName(PackageNamespace(""), "isPaused"), 0
      iftrue              L131
      getlex              QName(PackageNamespace(""), "Math")
      getlocal            4
      getproperty         QName(PackageNamespace(""), "y_")
      getlex              QName(PackageNamespace(""), "y_")
      subtract
      dup
      multiply
      getlocal            4
      getproperty         QName(PackageNamespace(""), "x_")
      getlex              QName(PackageNamespace(""), "x_")
      subtract
      dup
      multiply
      add
      callproperty        QName(PackageNamespace(""), "sqrt"), 1
      dup
      setlocal            9
      getlex              QName(PackageNamespace("com.company.assembleegameclient.objects"), "ObjectLibrary")
      getproperty         QName(PackageNamespace(""), "_-PC")
      getlex              QName(PackageNamespace(""), "_-dd")
      pushbyte            0
      getproperty         MultinameL([PrivateNamespace("*", "com.company.assembleegameclient.objects:Projectile#0"), PrivateNamespace("*", "com.company.assembleegameclient.objects:Projectile#1"), PackageNamespace(""), PackageNamespace("com.company.assembleegameclient.objects"), PackageInternalNs("com.company.assembleegameclient.objects"), Namespace("http://adobe.com/AS3/2006/builtin"), ProtectedNamespace("_-uM"), StaticProtectedNs("_-uM"), StaticProtectedNs("_-QF")])
	  convert_i
	  getproperty         MultinameL([PrivateNamespace("*", "com.company.assembleegameclient.objects:Projectile#0"), PrivateNamespace("*", "com.company.assembleegameclient.objects:Projectile#1"), PackageNamespace(""), PackageNamespace("com.company.assembleegameclient.objects"), PackageInternalNs("com.company.assembleegameclient.objects"), Namespace("http://adobe.com/AS3/2006/builtin"), ProtectedNamespace("_-uM"), StaticProtectedNs("_-uM"), StaticProtectedNs("_-QF")])
	  getproperty         QName(PackageNamespace(""), "_-85")
      pushbyte			  0
      getproperty         MultinameL([PrivateNamespace("*", "com.company.assembleegameclient.objects:Projectile#0"), PrivateNamespace("*", "com.company.assembleegameclient.objects:Projectile#1"), PackageNamespace(""), PackageNamespace("com.company.assembleegameclient.objects"), PackageInternalNs("com.company.assembleegameclient.objects"), Namespace("http://adobe.com/AS3/2006/builtin"), ProtectedNamespace("_-uM"), StaticProtectedNs("_-uM"), StaticProtectedNs("_-QF")])
      dup
      setlocal            11
      getproperty         QName(PackageNamespace(""), "speed_")
      pushshort           10000
      divide
      getlocal            11
      getproperty         QName(PackageNamespace(""), "lifetime_")
      multiply
      ifgt                L131
      getlocal            8
      pushbyte            255
      ifeq                L109
      getlocal            9
      getlocal            8
      iflt                L109
      jump                L131
L109:
      getlocal            4
      getproperty         QName(PackageNamespace(""), "_-PV")
      dup
      setlocal            13
      getlocal            12
      iflt                L131
      getlocal            13
      setlocal            12
      getlocal            9
      setlocal            8
      getlex              QName(PackageNamespace(""), "Math")
      getlocal            4
      getproperty         QName(PackageNamespace(""), "y_")
      getlex              QName(PackageNamespace(""), "y_")
      subtract
      getlocal            4
      getproperty         QName(PackageNamespace(""), "x_")
      getlex              QName(PackageNamespace(""), "x_")
      subtract
      callproperty        QName(PackageNamespace(""), "atan2"), 2
      setlocal            7
      jump                L131
L131:
      hasnext2            6, 5
      iftrue              L40
      kill                6
      kill                5
      getlocal            12
      pushbyte            0
      ifeq                L141
L138:
      getlocal0
      getlocal            7
      callpropvoid        QName(PrivateNamespace("*", "com.company.assembleegameclient.objects:Player#0"), "shoot"), 1
L141:
      returnvoid
     end ; code
    end ; body
   end ; method
  end ; trait

You'll need three programs to add this feature to your client.
RABCDAsm (which can be found here: https:// github.com/CyberShadow/RABCDAsm), Yogda, and a hex editor like HxD.

First make sure you decompress your target client (using rabc: swfdecompress yourfilename.swf). You'll need to do this for the hex editor.

Basically to add the aimbot to your client, disassemble the client using rabcdasm (abcexport yourfilename.swf then rabcdasm the yourfilename-1.abc). You'll then have a directory full of .asasm files. These are the files you modify to change how the game behaves. Open up \yourfilename-1\com\company\assembleegameclient\objects\Player.c lass.asasm. Look for the function _-0B8 and replace that function with the one I have above. Go back to rabc, and assemble the main.asasm file (rabcasm \yourfilename-1\yourfilename-1.main.asasm) then replace the .abc file in the client with the one you made (abcreplace yourfilename.swf 1 \yourfilename-1\yourfilename-1.main.abc). There is just one more thing to do....

If you noticed. On line 27 of the code I posted above I made a comment that says, "Doesn't resolve to the right address, hex edit to fix." One of the variables used in the hack is protected in some way and I have not found a way to code it properly with actionscript assembly like the code above. To get around this I manually edited the instruction with a hex editor.

First we need to get the correct bytes for our instruction. Open up yogda and have it open your client file. Navigate to com.company.assembleegameclient.game:_-hz. Expand that and open up the clearInput() function at the bottom. Look for an instruction that says private: use in the parameter section (line 113 for me). Look at the bytecode to the left (says 68 9F 19 for me). Write down the last two numbers (9F 19). It may or may not be the same for you. Then navigate to com.company.assembleegameclient.com:Player. Expand and open _-0B8 function. On line 24 you should see something like 66 A3 46 getproperty use. Open up your hex editor, and search for the byte sequence 66A346111D01002080336304 (I got these from the binary numbers column from line 24 on). Search again to make sure you're at the right spot in the file. Replace the last 2 bytes of the instruction on line 24 with the ones you wrote down. Save the file.

Congrats, you now have an aimbot.

If this all is too much for you. I'm sure someone will make a client for you.

[UltraN00b]

Great Work! Keep It Up!!!! BTW what editor are you using?? Secondly Cant Find the function _-08B.Nope... Still not found

[059]

Nilly please don't make a client... rather make a post on how to do the autoaim. Believe me, after getting 2,000+ downloads on my clent, not a single thanks, upon that people were doing Hurr Durr I don't know how to run swf!!Author cant make hackzzzz !! Hurlp Plzzzz!!

---------- Post added at 01:39 AM ---------- Previous post was at 01:35 AM ----------

And... look at what happened to CubE's Client, people just put their own names and posted the same client... Over and Over and Over Again!!!

Agreed.

059, try rabcasm. You already disassembled the .abc file with rabcdasm. After you made your changes you need to assemble the .asasm files with rabcasm (no d).

Oh my, don't I feel silly. Wow I completely misread the readme. Thank you so much.

[UltraN00b]

059 Can you find the _-08B Function??

[nilly]

Great Work! Keep It Up!!!! BTW what editor are you using?? Secondly Cant Find the function _-08B.Nope... Still not found

Whoops. I mistakenly wrote _-08B. Its _-0B8. I corrected how to post.

[UltraN00b]

OK Resolved! Thanks For Answering!

[059]

I did it, but now I can't shoot, and autofire does nothing. Messed up somewhere