Public ESP - Reverse Engineering ?

[hutzdani]

Okay im looking into editing the contents of the public ESP file that wa sposted soem time ago, is there a way to decompile the .DLL file that we inject ?

Anyone recomend some software to do this ? as im looking to fix some issues with names tags and possibly add the clas type logos onto the esp and some other stuff also.

[Blubb1337]

I don't think there is a way to decompile that .dll.

[billy9999]

there are some programs that can only decompile a part of the .dll
but u can try to edit it with a hex editor

[yozod]

Are you a spy?

[TranceWulf]

Decompile with IDA Pro? Worked for me. It looked like it was just enabling some commands (cvars, if you will) to turn on names and health bars for other players.

[~G36E~]

Hex Editor?
you can try that..

[TranceWulf]

nop

why you wann do this?

To build exploits off of it and whatnot.

Hex Editor?
you can try that..

Almost completely useless for DLLs unless you can read compiled code in hex.

[~G36E~]

Well then i dont have any other suggestions good luck.

[n0aim]

good luck.

There you go.

[Koen]

I do not have the source, and I don't know if the maker will give me it, sorry man

I'll take a look around though, you can mess with some player iteration though

CGameBase* base = (CGameBase*)0x152AC60; // or call 0x77FF50

    if( base && !IsBadReadPtr(base, 4) )
    {
        if( base->EntityManager && !IsBadReadPtr(base->EntityManager, 4) )
        {
            if( base->EntityManager->LocalPlayerData )
            {
                MessageBox(0, base->EntityManager->LocalPlayerData->Name, 0, 0 );
            }

            int PlayerList = base->EntityManager->GetPlayerList();
            
            int PlayerEnd  = PlayerList + 4;
            
            int i = 0;
            while(1)
            {
                DWORD dwAddr = *(DWORD*)PlayerList + (i * 4);
        
                if( dwAddr == *(DWORD*)PlayerEnd )
                {
                    MessageBox(0, "Looped done", 0, 0);
                    break;
                }
        
                char data[256];
                CPlayerData* player = *(CPlayerData**)dwAddr;

                if(!player->IsLocal())
                {
                    CPlayer* parent = player->GetParent();
                    if(parent)
                    {
                        sprintf(data, "[%i] %s %i [%f %f %f]", i, player->Name, player->Team, parent->X, parent->Y, parent->Z);

                        MessageBox(0, data, 0, 0);
                    }
                }
                
            
                i++;
            }
        }
    }

class CGameBase
{
public:
    char unknown0[44];
    CEntityManager* EntityManager; //002C
};
class CEntityManager
{
public:
    virtual void Function0();
    virtual int GetPlayerList();
    virtual void Function2();
    char unknown0[176];
    CPlayerData* LocalPlayerData; //00B4
};

class CPlayer
{
public:
    char unknown0[528];
    CPlayerData* PlayerData; //0210
    char unknown1[188];
    float X; //02D0
    float Y; //02D4
    float Z; //02D8
};

class CPlayerData
{
public:
    virtual void Function0();
    virtual void Function1();
    virtual void Function2();
    virtual void Function3();
    virtual void Function4();
    virtual void Function5();
    virtual void Function6();
    virtual void Function7();
    virtual void Function8();
    virtual bool IsLocal(); // Must check before GetParent, may or may not actually check local. But the game called it, so i do too
    virtual void Function10();
    virtual void Function11();
    virtual void Function12();
    virtual CPlayer* GetParent();
    virtual void Function14();
    virtual void Function15();
    virtual void Function16();
    virtual void Function17();
    virtual void Function18();
    virtual void Function19();
    virtual void Function20();
    char unknown0[28];
    char Name[28]; //0020
    char unknown1[108];
    __int32 Team; //00A8
};

etc.

NextGen1 Edit: Credits To Ghoster

[NextGen1]

That player iteration belongs to Ghoster, Creds and thanks

[Loffredo]

It worked, so you kinda made an ESP outta that?

[Koen]

Nah that was Ghosters iteration

[billy9999]

Just some example esp

bool ScreenProjectPoint(D3DXVECTOR3 *in, D3DXVECTOR3 *out)
{
	const D3DXMATRIX &m_Screen = *(D3DXMATRIX *) &g_pGameRender->RenderData->WorldTransform;

	D3DXVECTOR3 Origin = (*in);

	float CX = static_cast< float >( CRender::Get()->ScreenW_1 ) / 2.0f;
	float CY = static_cast< float >( CRender::Get()->ScreenH_1 ) / 2.0f;

	FLOAT w =   m_Screen.m [0][3] * Origin.x +
				m_Screen.m [1][3] * Origin.y +
				m_Screen.m [2][3] * Origin.z +
				m_Screen.m [3][3];

	if(w < 0.0001f)
		return FALSE;

	FLOAT x =   m_Screen.m [0][0] * Origin.x +
				m_Screen.m [1][0] * Origin.y +
				m_Screen.m [2][0] * Origin.z +
				m_Screen.m [3][0]; 

	FLOAT y =   m_Screen.m [0][1] * Origin.x +
				m_Screen.m [1][1] * Origin.y +
				m_Screen.m [2][1] * Origin.z +
				m_Screen.m [3][1]; 

	out->x = CX + CX * x / w;
	out->y = CY - CY * y / w;

	return TRUE;
} 

if(!pFirst->Information->IsLocal())
{
	D3DXVECTOR3 vLocalOrigin, vTargetOrigin;
	GetOrigin( &vLocalOrigin, &pLocalPlayer->Soldier->PlayerViewMatrix );
	GetOrigin( &vTargetOrigin, &pFirst->PlayerViewMatrix );

	float flDistance = GetDistance( vLocalOrigin, vTargetOrigin );

	D3DXVECTOR3 vScreen;
	if( ScreenProjectPoint( &vTargetOrigin, &vScreen ) )
	{
		sprintf( cTargetInfo, "[%.1fm] %s", flDistance, pFirst->Information->Name );

		if(pLocalPlayer->Team != pFirst->Information->Team)
		{

			ddraw.Text(vScreen.x, vScreen.y, Red, bold, DT_CENTER, cTargetInfo);

		}else{

			ddraw.Text(vScreen.x, vScreen.y, Blue, bold, DT_CENTER, cTargetInfo);

		}
	} 
}

note: puts tags on root of the player model

credits: ******, GHOSTER and dogmatt/mattdog