MW2 OFFSETS & STRUCTS

[wara286]

Since I lost interest in finishing my multihack, I might as well post my offsets & structs

 

GetTagPos = 0x0048E6E0;
GetTagPtr = 0x0056B770;
RegisterTag = 0x005399E0;
Com_Error = 0x569F50;
DrawEngineText = 0x004C5600;
ShowConsole = 0x5CB490;

 

R_DrawStretchPic = 0x4BBFE0;
R_RegisterShader = 0x0040FD60;
R_RegisterFont = 0x004C58E0;

 

CL_WritePacket = 0x004C09C0;
CL_GetUserCmd = 0x0004BBAC0;
CL_GetSnapshot = 0x004BBB40;
CL_ParseServerMessage = 0x004CA980;

 

CG_Obituary = 0048F2B0;
CG_Trace = 0x004BB0D0;
CG_Draw2D = 0x488420;
CG_Init = 0x00498930;
CG_FireWeapon = 0x004B9E90;

 

cgs_t = 0x0089D3A0;
cg_t = 0x008A0E50;
refdef_t = 0x90B5C8;
viewMatrix_t = 0xBC7690;
input_t = 0x00AB2B18;

cl_cmdNumber = 0x00BC8ADC;
usercmd_t = 0xBC76DC;

entity_t = 0x9A4090; SIZE=0x204
clientInfo_t = 0x997860; SIZE = 0x52C

 

typedef int(__cdecl* tDrawStretchPic)(float x, float y, float w, float h, float a5, float a6, float a7, float a8, float* color, int* shader);
typedef int*(__cdecl* tRegisterShader)(char* szName);
typedef void(__cdecl* tCGTrace)(trace_t* trace, vec3 start, vec3 end, int clientNum, int mask);
typedef void*(__cdecl* tGetTagPtr)(int clientNum);
typedef int(__cdecl* tGetTagPos)(entity_t* ent, void* tagPtr, int id, float* out);
typedef int(__cdecl* tRegisterTag)(char* szName);
typedef void(__cdecl* tComError)(int error, const char* msg, ...);
typedef void(__cdecl* tDrawEngineText)(char* text, int len, void* font, float x, float y, float scaleX, float scaleY, float* color, int style);
typedef void*(__cdecl* tRegisterFont)(char* szName);

 

typedef struct
{
	char pad_0x0000[0x2]; //0x0000
	BYTE Valid; //0x0002 
	char pad_0x0003[0x15]; //0x0003
	vec3 Origin; //0x0018 
	char pad_0x0024[0x48]; //0x0024
	__int32 Pose; //0x006C 
	char pad_0x0070[0x18]; //0x0070
	vec3 unkOrigin; //0x0088 
	char pad_0x0094[0x48]; //0x0094
	__int32 ClientNumber; //0x00DC 
	__int32 EntityType; //0x00E0 
	char pad_0x00E4[0x4]; //0x00E4
	BYTE PlayerPose; //0x00E8 
	BYTE Shooting; //0x00E9 
	BYTE Zoomed; //0x00EA 
	char pad_0x00EB[0x19]; //0x00EB
	vec3 unkOrigin2; //0x0104 
	char pad_0x0110[0x98]; //0x0110
	__int16 WeaponNum; //0x01A8 
	char pad_0x01AA[0x32]; //0x01AA
	__int32 IsAlive; //0x01DC 
} entity_t;

typedef struct
{
	__int32 ServerTime; //0x0000 Safe
	BYTE Buttons; //0x0004 Safe
	BYTE Zoom; //0x0005 Maybe?
	BYTE Zoom1; //0x0006 Maybe?
	char pad_0x0007[0x1]; //0x0007
	__int32 ViewAngles[3]; //Safe
	WORD Weapon; //0x0014 Maybe?
	char pad_0x0016[0x4]; //0x0016
	BYTE MoveButtonX; //0x001A Safe
	BYTE MoveButtonY; //0x001B Safe
	char pad_0x001C[0xC]; //0x001C
}usercmd_t;

typedef struct
{
	char unk1[0x8]; //0x0000
	__int32 width; //0x0008 safe
	__int32 height; //0x000C safe
	float fovX; //0x0010 probably
	float fovY; //0x0014 probably
	vec3 vOrg; //0x0018 safe
	vec3 viewAxis[3]; //0x0024 safe
	char unk2[16]; //0x0048 
	char unk3[16148]; //0x0058 
	vec3 ViewAngles; //0x3F6C Safe
	char unk4[24]; //0x3F78 
	float WeaponViewAngleX; //0x3F90 Maybe
	float WeaponViewAngleY; //0x3F94 Maybe
} refdef_t;

typedef struct
{
	__int32 Valid;
	char unk[8];
	char Name[16]; //0x0000  
	__int32 Team; //0x0010  
	__int32 SomeOtherTeamVar; //0x0014  
} clientInfo_t;

typedef struct
{
	vec3 Recoil; //0x0000 safe
	vec3 Origin; //0x000C safe
	char pad_0x0018[0xC]; //0x0018
	float readViewAngleX; //0x0024 safe
	float readViewAngleY; //0x0028 safe
	char pad_0x002C[0x14]; //0x002C
	float writeViewAngleX; //0x0040 safe
	float writeVireAngleY; //0x0044 safe
} viewMatrix_t;

typedef struct
{
	__int32 ServerTime; //0x0000 
 	char pad_0x0004[0xC]; //0x0004
	__int32 IsPlaying; //0x0010 
	char pad_0x0014[0x4]; //0x0014
	__int32 iVelocity; //0x0018 
	vec3 Origin; //0x001C 
        vec3 Velocity; //0x0028 
	char pad_0x0034[0x7C]; //0x0034
 	__int32 Pose; //0x00B0 
 	char pad_0x00B4[0x50]; //0x00B4
	__int32 ClientNumber; //0x0104 
	char pad_0x0108[0x4]; //0x0108
        float ViewAngleX; //0x010C 
	float ViewAngleY; //0x0110 
	char pad_0x0114[0x14]; //0x0114
	__int32 unknown; //0x0128
	char pad_0x012C[0x24]; //0x012C
	__int32 Health; //0x0150
} cg_t;

typedef struct
{
	char pad_0x0000[0x8]; //0x0000
	__int32 Width; //0x0008 
	__int32 Height; //0x000C 
	char pad_0x0010[0x10]; //0x0010
	char Gametype[3]; //0x0020 
} cgs_t;

Don't forget to give credits

FAQ
Q: WTF Is this?
A: This is only for cheat coding. If you don't understand it, ignore it, or if you don't know how to use them, read question 2
Q: How do I use this?
A: Learn C++: Buy some books about it & read them.


Please forgive me if an offset doesn't work, I haven't tested all of them yet, but they should be correct.
Also, it could be possible that I fucked up somewhere while copying the offsets from my hack, but everything seems OK for me

[bouclier]

Since I lost interest in finishing my multihack, I might as well post my offsets & structs

[SPOILER=Some Functions][CODE]GetTagPos = 0x0048E6E0;
GetTagPtr = 0x0056B770;
etc...

Hi, I'm kind of new when it comes to reversing (messed with the source engine before but that's it) and I was wondering how you were able to find offsets because when I open iw4mp into ida pro/ollydbyg I can't find any string and I don't really know what I have to do in this situation? I'm currently trying to dump the file and to re analyze it it's currently loading?

So could you give me some hints on how to reverse it ?

[wara286]

So could you give me some hints on how to reverse it ?

Sure, no problem
First things first, you're on the right way with dumping the executable to get the non-packed version.
I personally use the command line program peDump, but you can do the same with OllyDbg or some other program.
When you open up the dumped executable in IDA Pro, you can now see a list of strings.
Another good tip is to download the Quake 3 Source, it's free, and because as you know mw2 is using a modified version of the quake3 engine, it can be useful when reversing functions that are in the iw4mp binary as well as in the quake source.

The entity, cgs and cg structs can be found in cg_init, which is the only function that uses the string "white" to load a shader.
The function which is using the string "white" inside CG_Init is also your R_RegisterShader function.
Below this you will see a function which is using some "fonts/..." string: this is your R_RegisterFont function.
R_RegisterFont will return the registered font, if you scan for xrefs to the font, you will find some kind of DrawEngineText function.
The same can be done to find your R_DrawStretchPic function.
CG_Draw2D, is function that can be hooked to draw your menu and initialize your aimbot. It can be found by searching for the string "cg_DrawDamageDirection".
The return value of the function that uses this string is written to an address which, when you find the xref that reads from it, will lead you CG_Draw2D.
CL_WritePacket can be found by searching for the string "Overflow compressed msg buf in CL_WritePacket()".
Usercmd_t as well as cl_cmdNumber can be found by reversing the CL_WritePacket function.
In the function which can be found by searching for "AimTarget_GetTagPos: Cannot find tag [%s] on entity\n" are three calls above the call to Com_Error which uses the string you just searched for as a parameter.
These two calls are GetTagPtr and GetTagPos.

The structs can be found using the program reClass.

I hope that you found my post usefull

[bouclier]

thank you for your hints )) just a last question if you don't mind is this the source that you're talking about ******.com/id-Software/Quake-III-Arena/tree/master/code because I've found a lot of different ones?

[wara286]

thank you for your hints )) just a last question if you don't mind is this the source that you're talking about ******.com/id-Software/Quake-III-Arena/tree/master/code because I've found a lot of different ones?

I think that i am using this one: (u-n-k-n-o-w-n-c-h-e-a-t-s-.-m-e)/forum/downloads.php?do=file&title=quake-3-1-32b-source-zip&cid=12&ctitle=anti-cheat-software-and-programming-files&id=3994

[bouclier]

thank you so much

[bouclier]

Now I have been reversing the game and I found it if anyone wants 0x8A41A0 it's the index of the local player u use it like that

#define LOCALINDEX 0x8A41A0

to retrieve its value  *(int*)LOCALINDEX
and to use it you can do it like that (size of ceentity being 0x204)
DWORD* GetLocalPlayerPtr()
    return (CENTITYOFFSET + 0x204 * *(int*)LOCALINDEX)

I didn't test this code but it should work I think anyway the offset is correct I just wanted to contribute since wara helped me I might post other things in the future


EDIT IM REALLY DUMB YOU COULD GET IT WITH THE CG_T CLASS BUT FOR SOME REASON IN IDA THEY USE THE OFFSET DIRECTLY INSTEAD OF DOING CG_T OFFSET + 0x104

[wara286]

Some enums:

typedef enum
{
	EV_NONE,
	EV_FOLIAGE_SOUND,
	EV_STOP_WEAPON_SOUND,
	EV_SOUND_ALIAS,
	EV_SOUND_ALIAS_AS_MASTER,
	EV_STOPSOUNDS,
	EV_STANCE_FORCE_STAND,
	EV_STANCE_FORCE_CROUCH,
	EV_STANCE_FORCE_PRONE,
	EV_STANCE_INVALID,
	EV_ITEM_PICKUP,
	EV_AMMO_PICKUP,
	EV_NOAMMO,
	EV_EMPTYCLIP,
	EV_EMPTY_OFFHAND_PRIMARY,
	EV_EMPTY_OFFHAND_SECONDARY,
	EV_OFFHAND_END_NOTIFY,
	EV_RESET_ADS,
	EV_RELOAD,
	EV_RELOAD_FROM_EMPTY,
	EV_RELOAD_START,
	EV_RELOAD_END,
	EV_RELOAD_START_NOTIFY,
	EV_RELOAD_ADDAMMO,
	EV_RAISE_WEAPON,
	EV_FIRST_RAISE_WEAPON,
	EV_PUTAWAY_WEAPON,
	EV_WEAPON_ALT,
	EV_WEAPON_SWITCH_STARTED,
	EV_PULLBACK_WEAPON,
	EV_FIRE_WEAPON,
	EV_FIRE_WEAPON_LASTSHOT,
	EV_FIRE_RICOCHET,
	EV_RECHAMBER_WEAPON,
	EV_EJECT_BRASS,
	EV_FIRE_WEAPON_LEFT,
	EV_FIRE_WEAPON_LASTSHOT_LEFT,
	EV_EJECT_BRASS_LEFT,
	EV_HITCLIENT_FIRE_WEAPON,
	EV_HITCLIENT_FIRE_WEAPON_LASTSHOT,
	EV_HITCLIENT_FIRE_WEAPON_LEFT,
	EV_HITCLIENT_FIRE_WEAPON_LASTSHOT_LEFT,
	EV_SV_FIRE_WEAPON,
	EV_SV_FIRE_WEAPON_LASTSHOT,
	EV_SV_FIRE_WEAPON_LEFT,
	EV_SV_FIRE_WEAPON_LASTSHOT_LEFT,
	EV_MELEE_SWIPE,
	EV_FIRE_MELEE,
	EV_PREP_OFFHAND,
	EV_USE_OFFHAND,
	EV_SWITCH_OFFHAND,
	EV_MELEE_HIT,
	EV_MELEE_MISS,
	EV_MELEE_BLOOD,
	EV_FIRE_TURRET,
	EV_FIRE_SENTRY,
	EV_FIRE_QUADBARREL_1,
	EV_FIRE_QUADBARREL_2,
	EV_BULLET_HIT,
	EV_BULLET_HIT_SHIELD,
	EV_BULLET_HIT_EXPLODE,
	EV_BULLET_HIT_CLIENT_SMALL,
	EV_BULLET_HIT_CLIENT_LARGE,
	EV_BULLET_HIT_CLIENT_EXPLODE,
	EV_BULLET_HIT_CLIENT_SHIELD,
	EV_EXPLOSIVE_IMPACT_ON_SHIELD,
	EV_EXPLOSIVE_SPLASH_ON_SHIELD,
	EV_GRENADE_BOUNCE,
	EV_GRENADE_STICK,
	EV_GRENADE_REST,
	EV_GRENADE_EXPLODE,
	EV_GRENADE_PICKUP,
	EV_GRENADE_LETGO,
	EV_ROCKET_EXPLODE,
	EV_ROCKET_EXPLODE_NOMARKS,
	EV_FLASHBANG_EXPLODE,
	EV_CUSTOM_EXPLODE,
	EV_CUSTOM_EXPLODE_NOMARKS,
	EV_CHANGE_TO_DUD,
	EV_DUD_EXPLODE,
	EV_DUD_IMPACT,
	EV_TROPHY_EXPLODE,
	EV_BULLET,
	EV_PLAY_FX,
	EV_PLAY_FX_ON_TAG,
	EV_STOP_FX_ON_TAG,
	EV_PLAY_FX_ON_TAG_FOR_CLIENTS,
	EV_PHYS_EXPLOSION_SPHERE,
	EV_PHYS_EXPLOSION_CYLINDER,
	EV_PHYS_EXPLOSION_JOLT,
	EV_RADIUSDAMAGE,
	EV_PHYS_JITTER,
	EV_EARTHQUAKE,
	EV_GRENADE_SUICIDE,
	EV_DETONATE,
	EV_NIGHTVISION_WEAR,
	EV_NIGHTVISION_REMOVE,
	EV_MISSILE_REMOTE_BOOST,
	EV_OBITUARY,
	EV_NO_PRIMARY_GRENADE_HINT,
	EV_NO_SECONDARY_GRENADE_HINT,
	EV_TARGET_TOO_CLOSE_HINT,
	EV_TARGET_NOT_ENOUGH_CLEARANCE_HINT,
	EV_LOCKON_REQUIRED_HINT,
	EV_VEHICLE_COLLISION,
	EV_VEHICLE_SUSPENSION_SOFT,
	EV_VEHICLE_SUSPENSION_HARD,
	EV_FOOTSTEP_SPRINT,
	EV_FOOTSTEP_RUN,
	EV_FOOTSTEP_WALK,
	EV_FOOTSTEP_PRONE,
	EV_JUMP,
	EV_LANDING_DEFAULT,
	EV_LANDING_BARK,
	EV_LANDING_BRICK,
	EV_LANDING_CARPET,
	EV_LANDING_CLOTH,
	EV_LANDING_CONCRETE,
	EV_LANDING_DIRT,
	EV_LANDING_FLESH,
	EV_LANDING_FOLIAGE,
	EV_LANDING_GLASS,
	EV_LANDING_GRASS,
	EV_LANDING_GRAVEL,
	EV_LANDING_ICE,
	EV_LANDING_METAL,
	EV_LANDING_MUD,
	EV_LANDING_PAPER,
	EV_LANDING_PLASTER,
	EV_LANDING_ROCK,
	EV_LANDING_SAND,
	EV_LANDING_SNOW,
	EV_LANDING_WATER,
	EV_LANDING_WOOD,
	EV_LANDING_ASPHALT,
	EV_LANDING_CERAMIC,
	EV_LANDING_PLASTIC,
	EV_LANDING_RUBBER,
	EV_LANDING_CUSHION,
	EV_LANDING_FRUIT,
	EV_LANDING_PAINTEDMETAL,
	EV_LANDING_RIOTSHIELD,
	EV_LANDING_SLUSH,
	EV_LANDING_PAIN_DEFAULT,
	EV_LANDING_PAIN_BARK,
	EV_LANDING_PAIN_BRICK,
	EV_LANDING_PAIN_CARPET,
	EV_LANDING_PAIN_CLOTH,
	EV_LANDING_PAIN_CONCRETE,
	EV_LANDING_PAIN_DIRT,
	EV_LANDING_PAIN_FLESH,
	EV_LANDING_PAIN_FOLIAGE,
	EV_LANDING_PAIN_GLASS,
	EV_LANDING_PAIN_GRASS,
	EV_LANDING_PAIN_GRAVEL,
	EV_LANDING_PAIN_ICE,
	EV_LANDING_PAIN_METAL,
	EV_LANDING_PAIN_MUD,
	EV_LANDING_PAIN_PAPER,
	EV_LANDING_PAIN_PLASTER,
	EV_LANDING_PAIN_ROCK,
	EV_LANDING_PAIN_SAND,
	EV_LANDING_PAIN_SNOW,
	EV_LANDING_PAIN_WATER,
	EV_LANDING_PAIN_WOOD,
	EV_LANDING_PAIN_ASPHALT,
	EV_LANDING_PAIN_CERAMIC,
	EV_LANDING_PAIN_PLASTIC,
	EV_LANDING_PAIN_RUBBER,
	EV_LANDING_PAIN_CUSHION,
	EV_LANDING_PAIN_FRUIT,
	EV_LANDING_PAIN_PAINTEDMETAL,
	EV_LANDING_PAIN_RIOTSHIELD,
	EV_LANDING_PAIN_SLUSH,
	EV_MANTLE
}entity_event_t;

/**
* entity_t->EntityType
**/

typedef enum {
	ET_GENERAL,
	ET_PLAYER,
	ET_CORPSE,
	ET_ITEM,
	ET_MISSLE,
	ET_INVISIBLE_ENTITY,
	ET_SCRIPTMOVER,
	ET_SOUND_BLEND,
	ET_FX,
	ET_LOOP_FX,
	ET_PRIMARY_LIGHT,
	ET_TURRENT,
	ET_HELICOPTER,
	ET_PLANE,
	ET_VEHICLE,
	ET_VEHICLE_COLLMAP,
	ET_VEHICLE_CORPSE,
	ET_VEHICLE_SPAWNER
} entityType_t;

[JokerKing9903]

Can you please Post the "Unlock All" Offset for MW2? i really need it!

[shryder]

can you provide a sample code on how to use it?
i already made a force dvar change but i don't know how to use this one ,thank you

[wara286]

can you provide a sample code on how to use it?
i already made a force dvar change but i don't know how to use this one ,thank you

In your header file:

typedef struct
{
	vec3 Recoil; //0x0000 
	vec3 Origin; //0x000C 
	char pad_0x0018[0xC]; //0x0018
	float rViewAngleX; //0x0024 
	float rViewAngleY; //0x0028 
	char pad_0x002C[0x14]; //0x002C
	float wViewAngleX; //0x0040 
	float wVireAngleY; //0x0044 
} viewMatrix_t;

In your init function:

viewMatrix_t* viewMatrix = (viewMatrix_t*)0xBC7690;

In your update function (Once per frame):

viewMatrix->Recoil[0] = 0x0;
viewMatrix->Recoil[1] = 0x0;
viewMatrix->Recoil[2] = 0x0;

This is how you use structs and their addresses.

You can also find a lot of tutorials here on mpgh.
But after all it's the best thing to learn proper c++ / c coding because if you don't really know how to code in c / c++, you will get frustrated soon.
I know that it sucks in the beginning, but the best advise is to read some books on c / c++.

[shryder]

In your header file:

typedef struct
{
	vec3 Recoil; //0x0000 
	vec3 Origin; //0x000C 
	char pad_0x0018[0xC]; //0x0018
	float rViewAngleX; //0x0024 
	float rViewAngleY; //0x0028 
	char pad_0x002C[0x14]; //0x002C
	float wViewAngleX; //0x0040 
	float wVireAngleY; //0x0044 
} viewMatrix_t;

In your init function:

viewMatrix_t* viewMatrix = (viewMatrix_t*)0xBC7690;

In your update function (Once per frame):

viewMatrix->Recoil[0] = 0x0;
viewMatrix->Recoil[1] = 0x0;
viewMatrix->Recoil[2] = 0x0;

This is how you use structs and their addresses.

You can also find a lot of tutorials here on mpgh.
But after all it's the best thing to learn proper c++ / c coding because if you don't really know how to code in c / c++, you will get frustrated soon.
I know that it sucks in the beginning, but the best advise is to read some books on c / c++.

Thank you so much man

[gerherhtherherdhher]

In your header file:

typedef struct
{
	vec3 Recoil; //0x0000 
	vec3 Origin; //0x000C 
	char pad_0x0018[0xC]; //0x0018
	float rViewAngleX; //0x0024 
	float rViewAngleY; //0x0028 
	char pad_0x002C[0x14]; //0x002C
	float wViewAngleX; //0x0040 
	float wVireAngleY; //0x0044 
} viewMatrix_t;

In your init function:

viewMatrix_t* viewMatrix = (viewMatrix_t*)0xBC7690;

In your update function (Once per frame):

viewMatrix->Recoil[0] = 0x0;
viewMatrix->Recoil[1] = 0x0;
viewMatrix->Recoil[2] = 0x0;

This is how you use structs and their addresses.

You can also find a lot of tutorials here on mpgh.
But after all it's the best thing to learn proper c++ / c coding because if you don't really know how to code in c / c++, you will get frustrated soon.
I know that it sucks in the beginning, but the best advise is to read some books on c / c++.

Although visual studio is clever enough to optimize that code, it's bad practice initializing floats with ints and thus having the implicit integer to float conversion! Also I have never seen people write 0x0 for 0, in this case rather write this code in C++:

viewMatrix->Recoil = { 0.0f, 0.0f, 0.0f };

[quwhbkdwhbji]

What are theese adresses for wh norecoil or what?

[Hirosay]

Mind pointing me in the right direction for using this for a wallhack? Currently have recoil as well as hooked EndScene in d3d9 but not sure how to go about using your pointers for a wallhack? How would i get a list of players? I tried hooking gettagpos and saving the ents passed to it but that didnt seem to work. Thanks