Thread: Chopperboxes

Page 1 of 2 12 LastLast
Results 1 to 15 of 17
  1. #1
    cardoow's Avatar
    Join Date
    Jan 2008
    Gender
    male
    Posts
    214
    Reputation
    28
    Thanks
    747
    My Mood
    Amazed

    Chopperboxes

    Since a lot of people ask how to do chopper esp, i posted this a while ago on another forum

    Chewperbewxerz function
    Code:
    .text:000000014029AE10                 push    rbx
    .text:000000014029AE12                 sub     rsp, 20h
    .text:000000014029AE16                 mov     ebx, ecx
    .text:000000014029AE18                 call    sub_1402A2A50 //entity isalive and type checks
    .text:000000014029AE1D                 lea     rdx, loc_1402A2B20
    .text:000000014029AE24                 mov     ecx, ebx
    .text:000000014029AE26                 call    sub_140554D70 //some more client and entity checks
    .text:000000014029AE2B                 mov     ecx, ebx
    .text:000000014029AE2D                 add     rsp, 20h
    .text:000000014029AE31                 pop     rbx
    .text:00000001402A2890                 mov     r11, rsp
    .text:00000001402A2893                 push    r13
    .text:00000001402A2895                 sub     rsp, 80h
    .text:00000001402A289C                 movsxd  rdx, cs:dword_14158177C
    .text:00000001402A28A3                 mov     r13d, ecx
    .text:00000001402A28A6                 lea     rcx, dword_141581600
    .text:00000001402A28AD                 mov     rax, rdx
    .text:00000001402A28B0                 imul    rax, 5D8h
    .text:00000001402A28B7                 cmp     dword ptr [rax+rcx+0FAC04h], 0
    .text:00000001402A28BF                 jz      loc_1402A2A3C
    .text:00000001402A28C5                 mov     [r11-10h], rbp
    .text:00000001402A28C9                 mov     [r11-18h], rsi
    .text:00000001402A28CD                 mov     [r11-20h], rdi
    .text:00000001402A28D1                 mov     [r11-28h], r12
    .text:00000001402A28D5                 mov     r12, cs:qword_141580D40
    .text:00000001402A28DC                 mov     [r11-30h], r14
    .text:00000001402A28E0                 mov     r14d, [rax+rcx+0FAC0Ch]
    .text:00000001402A28E8                 mov     [r11-38h], r15
    .text:00000001402A28EC                 mov     [r11+8], rbx
    .text:00000001402A28F0                 movaps  [rsp+88h+var_48], xmm6
    .text:00000001402A28F5                 xor     ebp, ebp
    .text:00000001402A28F7                 lea     rdi, unk_141699B4C
    .text:00000001402A28FE                 lea     rsi, unk_14167C20C
    .text:00000001402A2905                 lea     rcx, unk_14168B77C
    .text:00000001402A290C                 nop     dword ptr [rax+00h]
    .text:00000001402A2910
    .text:00000001402A2910 loc_1402A2910:                          ; CODE XREF: sub_14029AE10+7BFBj
    .text:00000001402A2910                 cmp     ebp, edx
    .text:00000001402A2912                 jz      loc_1402A29F8
    .text:00000001402A2918                 cmp     dword ptr [rsi-8], 0
    .text:00000001402A291C                 jz      loc_1402A29F8
    .text:00000001402A2922                 test    r14d, r14d
    .text:00000001402A2925                 jz      short loc_1402A2930
    .text:00000001402A2927                 cmp     r14d, [rsi]
    .text:00000001402A292A                 jz      loc_1402A29F8
    .text:00000001402A2930
    .text:00000001402A2930 loc_1402A2930:                          ; CODE XREF: sub_14029AE10+7B15j
    .text:00000001402A2930                 test    byte ptr [rdi+104h], 1
    .text:00000001402A2937                 jz      loc_1402A29F8
    .text:00000001402A293D                 mov     eax, [rsi+0Ch]
    .text:00000001402A2940                 shr     eax, 6
    .text:00000001402A2943                 test    al, 1
    .text:00000001402A2945                 jnz     loc_1402A29F8
    .text:00000001402A294B                 mov     eax, [rdi]
    .text:00000001402A294D                 cmp     eax, 1
    .text:00000001402A2950                 jz      short loc_1402A295B
    .text:00000001402A2952                 cmp     eax, 12h
    .text:00000001402A2955                 jnz     loc_1402A29F8
    .text:00000001402A295B
    .text:00000001402A295B loc_1402A295B:                          ; CODE XREF: sub_14029AE10+7B40j
    .text:00000001402A295B                 test    byte ptr [rdi+4], 20h
    .text:00000001402A295F                 jnz     loc_1402A29F8
    .text:00000001402A2965                 cmp     [rdi+74h], edx
    .text:00000001402A2968                 jz      loc_1402A29F8
    .text:00000001402A296E                 lea     rdx, [rdi-0FCh]
    .text:00000001402A2975                 mov     ecx, r13d
    .text:00000001402A2978                 call    sub_1402A3010
    .text:00000001402A297D                 lea     rax, [rsp+88h+arg_8]
    .text:00000001402A2985                 lea     r9, [rsp+88h+arg_18]
    .text:00000001402A298D                 mov     [rsp+88h+var_60], rax
    .text:00000001402A2992                 lea     rax, [rsp+88h+arg_10]
    .text:00000001402A299A                 lea     r8, [rsp+88h+var_58]
    .text:00000001402A299F                 movaps  xmm6, xmm0
    .text:00000001402A29A2                 lea     rdx, [rdi-0FCh]
    .text:00000001402A29A9                 mov     ecx, r13d
    .text:00000001402A29AC                 mov     [rsp+88h+var_68], rax
    .text:00000001402A29B1                 call    sub_1402A2B90
    .text:00000001402A29B6                 test    al, al
    .text:00000001402A29B8                 jz      short loc_1402A29EB
    .text:00000001402A29BA                 movss   xmm3, [rsp+88h+arg_8]
    .text:00000001402A29C3                 movss   xmm2, [rsp+88h+arg_10]
    .text:00000001402A29CC                 movss   xmm1, [rsp+88h+arg_18]
    .text:00000001402A29D5                 movss   xmm0, [rsp+88h+var_58]
    .text:00000001402A29DB                 movss   dword ptr [rsp+88h+var_60], xmm6
    .text:00000001402A29E1                 mov     [rsp+88h+var_68], r12
    .text:00000001402A29E6                 call    sub_1402A27C0 //draw the boxes
    .text:00000001402A29EB
    .text:00000001402A29EB loc_1402A29EB:                          ; CODE XREF: sub_14029AE10+7BA8j
    .text:00000001402A29EB                 mov     edx, cs:dword_14158177C
    .text:00000001402A29F1                 lea     rcx, unk_14168B77C
    .text:00000001402A29F8
    .text:00000001402A29F8 loc_1402A29F8:                          ; CODE XREF: sub_14029AE10+7B02j
    .text:00000001402A29F8                                         ; sub_14029AE10+7B0Cj ...
    .text:00000001402A29F8                 add     rsi, 5D8h
    .text:00000001402A29FF                 inc     ebp
    .text:00000001402A2A01                 add     rdi, 238h
    .text:00000001402A2A08                 cmp     rsi, rcx
    .text:00000001402A2A0B                 jl      loc_1402A2910
    .text:00000001402A2A11                 movaps  xmm6, [rsp+88h+var_48]
    .text:00000001402A2A16                 mov     r15, [rsp+88h+var_38]
    .text:00000001402A2A1B                 mov     r14, [rsp+88h+var_30]
    .text:00000001402A2A20                 mov     r12, [rsp+88h+var_28]
    .text:00000001402A2A25                 mov     rdi, [rsp+88h+var_20]
    .text:00000001402A2A2A                 mov     rsi, [rsp+88h+var_18]
    .text:00000001402A2A2F                 mov     rbp, [rsp+88h+var_10]
    .text:00000001402A2A34                 mov     rbx, [rsp+88h+arg_0]
    .text:00000001402A2A3C
    .text:00000001402A2A3C loc_1402A2A3C:                          ; CODE XREF: sub_14029AE10+7AAFj
    .text:00000001402A2A3C                 add     rsp, 80h
    .text:00000001402A2A43                 pop     r13
    .text:00000001402A2A45                 retn
    a way on how to enable it is by using this addy -->0x141581610<--
    and set the byte to 0x8 for thermalvision( have to be in a correct spot otherwise it will flicker)
    or set the byte to 0x10 which gives you chewperbewxerz at all time.
    Fix the ninja stuff yourself, its pretty easy to find from my reference.

    --->Addresses 3.3.3<---
    New address for the function is 0x14029B280
    New address for the byte patch is 0x1416FF690


    --->Addresses 3.4.3<---
    New address for the function is 0x14029BFC0
    New address for the byte patch is 0x141711590

    Last edited by cardoow; 11-26-2013 at 09:42 AM.

  2. #2
    plsdontbug's Avatar
    Join Date
    Jan 2013
    Gender
    male
    Posts
    48
    Reputation
    10
    Thanks
    8
    Amazing, they really did a great job while making a game this time, they even built in a esp for us this time xD

  3. #3
    cardoow's Avatar
    Join Date
    Jan 2008
    Gender
    male
    Posts
    214
    Reputation
    28
    Thanks
    747
    My Mood
    Amazed
    Quote Originally Posted by plsdontbug View Post
    Amazing, they really did a great job while making a game this time, they even built in a esp for us this time xD
    this time? you must be kiddin me! its build in almost every cod version

  4. The Following User Says Thank You to cardoow For This Useful Post:

    Lovroman (11-25-2013)

  5. #4
    BullDog12345's Avatar
    Join Date
    May 2013
    Gender
    male
    Location
    Haven't a Fkin Clue #?#
    Posts
    198
    Reputation
    10
    Thanks
    226
    My Mood
    Psychedelic
    so were do we put the code

    sry kinda new to hacking with ESP stuff
    **DONT BOTHER TRYING**

  6. #5
    Lovroman's Avatar
    Join Date
    Sep 2012
    Gender
    male
    Posts
    9,430
    Reputation
    611
    Thanks
    9,719
    My Mood
    Cheerful
    Quote Originally Posted by BullDog12345 View Post
    so were do we put the code

    sry kinda new to hacking with ESP stuff
    In CE(add address as byte and change value to 10) or your application's code.

  7. #6
    BullDog12345's Avatar
    Join Date
    May 2013
    Gender
    male
    Location
    Haven't a Fkin Clue #?#
    Posts
    198
    Reputation
    10
    Thanks
    226
    My Mood
    Psychedelic
    okays thnks Lovroman
    **DONT BOTHER TRYING**

  8. The Following User Says Thank You to BullDog12345 For This Useful Post:

    Lovroman (11-25-2013)

  9. #7
    BullDog12345's Avatar
    Join Date
    May 2013
    Gender
    male
    Location
    Haven't a Fkin Clue #?#
    Posts
    198
    Reputation
    10
    Thanks
    226
    My Mood
    Psychedelic
    sry im back again this si still confusing @Lovroman can you give me a vid tutorial on how to do this please

    thnx @BullDog12345
    **DONT BOTHER TRYING**

  10. #8
    cardoow's Avatar
    Join Date
    Jan 2008
    Gender
    male
    Posts
    214
    Reputation
    28
    Thanks
    747
    My Mood
    Amazed
    1. Open game
    2. Open CE
    3. Add 0x1416FF690 to your address list
    4. Freeze the value
    5. Change the value to 0x10
    6. Have phun

  11. #9
    Diamond's Avatar
    Join Date
    Apr 2013
    Gender
    male
    Location
    CoD Section
    Posts
    2,233
    Reputation
    200
    Thanks
    2,527
    My Mood
    Devilish
    Quote Originally Posted by BullDog12345 View Post
    sry im back again this si still confusing @Lovroman can you give me a vid tutorial on how to do this please

    thnx @BullDog12345
    You can't just jump straight into these kinds of things, first you must learn the language basics like read some books or watch videos .
    Instagram: fadi.ovo

    Twitter: @byFadi

    YouTube: OVO MobZai

  12. #10
    monkiii's Avatar
    Join Date
    Jan 2010
    Gender
    male
    Posts
    7
    Reputation
    10
    Thanks
    0
    My Mood
    Happy
    I get an confusing flicker, while Im using 0x141711590
    And when I freeze the value, its still switching between 0 and 10.

    Any Ideas?

  13. #11
    cardoow's Avatar
    Join Date
    Jan 2008
    Gender
    male
    Posts
    214
    Reputation
    28
    Thanks
    747
    My Mood
    Amazed
    Are u freezing it in CE?

  14. #12
    monkiii's Avatar
    Join Date
    Jan 2010
    Gender
    male
    Posts
    7
    Reputation
    10
    Thanks
    0
    My Mood
    Happy
    as I said, Im hitting the checkbox but its still switching.. and Im ingame the models are blinking white..

  15. #13
    cardoow's Avatar
    Join Date
    Jan 2008
    Gender
    male
    Posts
    214
    Reputation
    28
    Thanks
    747
    My Mood
    Amazed
    You cant just freeze it in CE because the thread on which the value gets set is called way more times in a frame then your CE call it, thats why its flickering.
    You have to hook in game and search for a right spot

  16. #14
    GTEUK1's Avatar
    Join Date
    Nov 2013
    Gender
    male
    Posts
    76
    Reputation
    22
    Thanks
    62
    My Mood
    Cheeky
    Finding out what writes to the address also helps to try and find the static

    I am looking at a way to NOP the writing of it which would negate the timer

    Set a timer to 50ms otherwise but do not expect to use any scoped weapons with precision

  17. #15
    cardoow's Avatar
    Join Date
    Jan 2008
    Gender
    male
    Posts
    214
    Reputation
    28
    Thanks
    747
    My Mood
    Amazed
    Quote Originally Posted by GTEUK1 View Post
    Finding out what writes to the address also helps to try and find the static

    I am looking at a way to NOP the writing of it which would negate the timer

    Set a timer to 50ms otherwise but do not expect to use any scoped weapons with precision
    good luck


    What i did, search where its getting set right before the function where they draw the boxes

Page 1 of 2 12 LastLast

Similar Threads

  1. [Release] MW3 R29 UNDETECT ChopperBox Esp
    By Papil in forum Call of Duty Modern Warfare 3 Private Server Hacks
    Replies: 17
    Last Post: 08-30-2013, 07:03 PM
  2. [Release] TeknoMW3 : Simple Wallhack/ChopperBoxes
    By mwxplayer in forum Call of Duty Modern Warfare 3 Private Server Hacks
    Replies: 3
    Last Post: 11-30-2012, 02:54 PM