ESP For Zombie Mode

[TheG2ek]

Hi guys,

I tried to use ESP ZM but failed and doesn't work...

What is a mistake i did ?


Class:

class CAIName
{
public:
	char pad_0000[24]; //0x0000
	char Name[28]; //0x0018
}; //Size: 0x015C

class CAICharacterTable
{
public:
	char pad_0000[24]; //0x0000
	CAIName* pAIName; //0x0018
}; //Size: 0x0144

class CAIClient
{
    public:
        char pad_0000[0xC]; //0x0000
        //__int32 ItemType; //0x0008
        cObject* ObjectWeapon; //0x000C
        char pad_0010[0x94]; //0x0010
        //__int32 WeaponID; //0x0036
        //char pad_0038[106]; //0x003A
        cObject* Object; //0x00A4
        //char pad_0000[164]; //0x0000
        char pad_00A8[87352]; //0x00A8 (Hook offset + 0x2C)
        __int32 iHealth; //0x155AC (0x155E0)
        __int32 iMaxHealth; //0x155B0 (0x155E4)
        char pad_155E8[1388]; //0x155B4 (0x155E8)
        CAICharacterTable* pAICharacterTable; //0x15B20 (0x15B54)
};

Hook :

DWORD dwJMPback;
__declspec(naked) void cAIESP::hkZombiefx() 
{
	

	__asm {
		 MOV DWORD PTR DS : [ESI + 0x5C5745], EBX
	}
	
	__asm PUSHAD
	__asm PUSHFD

	DWORD _esi;

	__asm {
		MOV _esi, ESI
	}
		
	addToObjects(_esi);	
	
	__asm POPFD
	__asm POPAD
	
	__asm JMP [dwJMPback]

}

Function:

void cAIESP::ESPZM(LPDIRECT3DDEVICE9 pDevice)
{
    if (!Engine->inGame()) { return; }
    //AIESP->hkZombiefx();
    DWORD pLTClientShell = *(DWORD*)LTClientShell;
    CPlayer* Me = GetPlayerByIndex(pLTClientShell, Engine->GetMyIndex(pLTClientShell));
    D3DXVECTOR3 My_Head = Engine->GetBonePosition(Me->Object, 6);
 
    std::vector< DWORD >::iterator it = zm_objects.begin();
    while (it != zm_objects.end()) 
	{
 
        if (*it == NULL) 
		{
            int index = it - zm_objects.begin();
            zm_bools.erase(zm_bools.begin() + index);
            it = zm_objects.erase(it);
        }
        else 
		{
            CAIClient* _characterfx = (CAIClient*)(*it);
            cObject* Object = _characterfx->Object;
            if (!Object) 
			{
                if (!zm_bools.at(it - zm_objects.begin()))
                {
                    ++it;
                }
                else
                {
                    int index = it - zm_objects.begin();
                    zm_bools.erase(zm_bools.begin() + index);
                    it = zm_objects.erase(it);
                }
                continue;
            }
 
            zm_bools.at(it - zm_objects.begin())= true;
 
            D3DXVECTOR3 Hc_Head = Engine->GetBonePosition(Object, 6);
            D3DXVECTOR3 Hc_Body = Engine->GetBonePosition(Object, 2);
 
            D3DCOLOR color;
 
 
			if (Engine->WorldToScreen(pDevice, &Hc_Body)) 
			{
 
                if (HealthZM) 
				{
                    char pHP[100];
                    sprintf_s(pHP, "HP:[%d]", _characterfx->iHealth);
                    DirectX->WriteText(pDevice,Hc_Body.x + 20, Hc_Body.y - 50, White, pHP);
                }

                if (LineZM)
                {
					 	POINT pt;
	                 D3DVIEWPORT9 pViewport;
					pDevice->GetViewport(&pViewport);
                    DWORD ScreenCenterX = pViewport.Width / 2;
                    DWORD ScreenCenterY = pViewport.Height / 2;
 
                    int LinesComeFrom_X = ScreenCenterX;
                    int LinesComeFrom_Y;
 
                    AIESP->DrawLine(pDevice, LinesComeFrom_X, LinesComeFrom_Y, Hc_Body.x, Hc_Body.y, color);
                }
            }
            ++it;
        }
    }
}

Call :

AIESP->ESPZM(pDevice);

Where is mistake ?

Credit(s) : @I2espect , @dreek1

[Janitor]

Thread moved to the proper section.

[aS1an1Sm]

Try this:

class CAIClient;
std::vector<CAIClient*> zObjects;
CAIClient* __ESI;

class CAIClient
{
    public:
        char pad_0000[0xC]; //0x0000
        //__int32 ItemType; //0x0008
        cObject* ObjectWeapon; //0x000C
        char pad_0010[0x94]; //0x0010
        //__int32 WeaponID; //0x0036
        //char pad_0038[106]; //0x003A
        cObject* Object; //0x00A4
        //char pad_0000[164]; //0x0000
        char pad_00A8[87352]; //0x00A8 (Hook offset + 0x2C)
        __int32 iHealth; //0x155AC (0x155E0)
        __int32 iMaxHealth; //0x155B0 (0x155E4)
        char pad_155E8[1388]; //0x155B4 (0x155E8)
        CAICharacterTable* pAICharacterTable; //0x15B20 (0x15B54)
};


In Hook:

MOV __ESI, ESI;
zObjects.push_back(__ESI);

In Render:

if(!InGame){
	if (!zObjects.empty())
		zObjects.clear();
		
	return;
}

if (!zObjects.empty())
{
	for (auto zObj : zObjects)
	{
		// Do your stuff like..

                if(!zObj)continue; // check for valid pointers

                if(zObj->iHealth < 1)continue; // check health

                Draw ESP here....
	}
}

[TheG2ek]

This Hook will Crash Game after 1 or 2 games try using SFX , its best way

Thanx Zaid For ur comment <3

- - - Updated - - -

Try this:

class CAIClient;
std::vector<CAIClient*> zObjects;
CAIClient* __ESI;

class CAIClient
{
    public:
        char pad_0000[0xC]; //0x0000
        //__int32 ItemType; //0x0008
        cObject* ObjectWeapon; //0x000C
        char pad_0010[0x94]; //0x0010
        //__int32 WeaponID; //0x0036
        //char pad_0038[106]; //0x003A
        cObject* Object; //0x00A4
        //char pad_0000[164]; //0x0000
        char pad_00A8[87352]; //0x00A8 (Hook offset + 0x2C)
        __int32 iHealth; //0x155AC (0x155E0)
        __int32 iMaxHealth; //0x155B0 (0x155E4)
        char pad_155E8[1388]; //0x155B4 (0x155E8)
        CAICharacterTable* pAICharacterTable; //0x15B20 (0x15B54)
};


In Hook:

MOV __ESI, ESI;
zObjects.push_back(__ESI);

In Render:

if(!InGame){
	if (!zObjects.empty())
		zObjects.clear();
		
	return;
}

if (!zObjects.empty())
{
	for (auto zObj : zObjects)
	{
		// Do your stuff like..

                if(!zObj)continue; // check for valid pointers

                if(zObj->iHealth < 1)continue; // check health

                Draw ESP here....
	}
}

Bro check ur private msgs

[mamo007]

MOV DWORD PTR DS : [ESI + 0x5C5745], EBX

[aS1an1Sm]

MOV ECX,ESI
MOV DWORD PTR DS:[ESI+0x15A44],EBX
CALL CShell.10558FB0
CMP DWORD PTR DS:[ESI+0x204],EBX
JNZ SHORT CShell.105619BE
CMP BYTE PTR DS:[ESI+0x15A80],BL

ESI + 0x204 // 1=Dead, 0=Alive

class CAIClient
{
       char pad_0000[0x204];
       DWORD Dead;
}

Much better than health checking