Enemy Player Pointer

**StupidLittleNoob** · 10-19-2010

So I know everybody is like " I have no idea what it is !!!! I JUST NEED THE EPP !!!" and whatever in their signatures so I decided to help out with your quest for the EPP by telling you one vital piece of information that I had recently learned from a leaked VIP source.

The epp begins with :

Code:

0x37

**mmbob** · 10-19-2010

Legit .

**StupidLittleNoob** · 10-19-2010

Originally Posted by mmbob

Legit .

300th thanker = /me

**Void** · 10-19-2010

EPP:

0x37730832;

**StupidLittleNoob** · 10-19-2010

Originally Posted by Void

EPP:

0x37730832;

wtf david that was tc only info...

**CodeDemon** · 10-19-2010

Originally Posted by Void

EPP:

0x37730832;

D: Straight out of the ******* TC forum

**whatup777** · 10-19-2010

Originally Posted by CodeDemon

D: Straight out of the Infinity TC forum

Which Im not apart of.

**ipwnuuaal5** · 10-19-2010

Originally Posted by Void

EPP:

0x37730832;

I thought you would keep it private.. Now everyone will make full opks and telekills. sigh..

**NOOB** · 10-19-2010

Originally Posted by Void

EPP:

0x37730832;

**DBag4Life69** · 10-19-2010

Originally Posted by Void

EPP:

0x37730832;

Dude... Add me on MSN. y.owns.you@gmail.com

...and not just that, I think you got people mad at you now.

**supascimmy** · 10-19-2010

Originally Posted by Void

EPP:

0x37730832;

fuck you david. we're banning you from infinity for leaking private information.

**SNal2F** · 10-19-2010

I noticed there wasnt a sticky thread on the game or much infos or it must be spread out so.... Just some stuffz so you can make yourself some snazzy dazzy esps and bots and shit: feel free to post w/e you want

from my couple days of reversing game doesnt really intrest me just wanted to see what the fuss is about(I suck lol and there are alot of good players in CA) , I always come back to playing BF2

Mostly a dump of where to find stuff

Code:

005337E1   A1 A4E17F00      MOV EAX,DWORD PTR DS:[7FE1A4]
005337E6   8B88 F8060000    MOV ECX,DWORD PTR DS:[EAX+6F8]//cshell 
005337EC   894C24 04        MOV DWORD PTR SS:[ESP+4],ECX
005337F0  ^E9 8BFFF2FF      JMP Engine.00463780
005337F5   68 50177800      PUSH Engine.00781750                     ; ASCII "d3ddevice"
005337FA   56               PUSH ESI
005337FB   E8 C1C21B00      CALL Engine.006EFAC1
005337F5   68 50177800      PUSH Engine.00781750                     ; ASCII "d3ddevice"
005337FA   56               PUSH ESI
005337FB   E8 C1C21B00      CALL Engine.006EFAC1
00533800   83C4 08          ADD ESP,8
00533803   85C0             TEST EAX,EAX
00533805   75 10            JNZ SHORT Engine.00533817
00533807   FF15 2C638000    CALL DWORD PTR DS:[80632C]               ; Engine.005872E0//device found here
0053380D   8B5424 0C        MOV EDX,DWORD PTR SS:[ESP+C]
00533811   8902             MOV DWORD PTR DS:[EDX],EAX
00533813   33C0             XOR EAX,EAX
00533815   5E               POP ESI
00533816   C3               RETN
00533817   B8 01000000      MOV EAX,1

Engine hooks u can draw up in her.

Code:

005353B0   833D 04638000 00 CMP DWORD PTR DS:[806304],0
005353B7   75 36            JNZ SHORT Engine.005353EF
005353B9   6A 49            PUSH 49
005353BB   E8 60AAF6FF      CALL Engine.0049FE20
005353C0   83C4 04          ADD ESP,4
005353C3   833D E0DB7F00 01 CMP DWORD PTR DS:[7FDBE0],1
005353CA   7C 1D            JL SHORT Engine.005353E9
005353CC   A1 4C607D00      MOV EAX,DWORD PTR DS:[7D604C]
005353D1   68 703D7700      PUSH Engine.00773D70
005353D6   68 D43D7700      PUSH Engine.00773DD4                     ; ASCII "LT_NOTINITIALIZED"
005353DB   68 B81A7800      PUSH Engine.00781AB8                     ; ASCII "FlipScreen"
005353E0   50               PUSH EAX
005353E1   E8 7AB6F6FF      CALL Engine.004A0A60
005353E6   83C4 10          ADD ESP,10
005353E9   B8 49000000      MOV EAX,49
005353EE   C3               RETN

ClientInfo

Code:

3715F660   53                    PUSH EBX  //tried tracing back this function with no luck but you can see that the call in red is from the same class so i traced that for the this:it is lazy but w/e 
3715F661   8BD9                  MOV EBX,ECX
3715F663   56                    PUSH ESI
3715F664   8D43 08               LEA EAX,DWORD PTR DS:[EBX+8]
3715F667   57                    PUSH EDI
3715F668   C700 00000000         MOV DWORD PTR DS:[EAX],0
3715F66E   50                    PUSH EAX
3715F66F   A1 10D97E37           MOV EAX,DWORD PTR DS:[377ED910]
3715F674   8B88 84000000         MOV ECX,DWORD PTR DS:[EAX+84]
3715F67A   FFD1                  CALL ECX
3715F67C   8B7C24 1C             MOV EDI,DWORD PTR SS:[ESP+1C]
3715F680   83C4 04               ADD ESP,4
3715F683   6A 00                 PUSH 0
3715F685   57                    PUSH EDI
3715F686   8BCB                  MOV ECX,EBX
3715F688   E8 F3E2FFFF           CALL cshell.3715D980
3715F68D   E8 7EFDFFFF           CALL cshell.3715F410
3715F692   8BF0                  MOV ESI,EAX
3715F694   85F6                  TEST ESI,ESI
3715F696   75 20                 JNZ SHORT cshell.3715F6B8
3715F698   8B4C24 10             MOV ECX,DWORD PTR SS:[ESP+10]
3715F69C   A1 10D97E37           MOV EAX,DWORD PTR DS:[377ED910]
3715F6A1   8B10                  MOV EDX,DWORD PTR DS:[EAX]
3715F6A3   8B52 18               MOV EDX,DWORD PTR DS:[EDX+18]
3715F6A6   51                    PUSH ECX
3715F6A7   68 04A46E37           PUSH cshell.376EA404                                    ; ASCII "CCBAClientInfoMgr::AddClient %s End"



3715E914   8B0D 48CE7E37         MOV ECX,DWORD PTR DS:[377ECE48]                         ; cshell.37805DA0
3715E91A   6A 00                 PUSH 0
3715E91C   56                    PUSH ESI
3715E91D   E8 5EF0FFFF           CALL cshell.3715D980

didnt fully rebuild but w/e u can add what you want: only worked on this when i was bored last week :/

Code:

class PointerTo
{
public:
	char pad[4];
	PlayerInfo * first;
    __int32 index;

};


class PlayerInfo
{
public:
	
    __int32 Unknown0; //0000
	__int32 index; //0004
	__int32 Unknown2; //0008
	__int32 Unknown3; //000C
	char Name[12]; //0010
	char unknown5[12];
	_Object* obj; //0028
	char unknown7[76];
	__int8 IsDead; //0078
	__int8 Unknown9; //0079
	__int16 Unknown10; //007A
	char unknown11[488];
	PlayerInfo* Next; //0264
};



class _Object
{
public:
	char Pad[4];
	D3DXVECTOR3 origin;
};

Nothing usefull As i went sealione route .

Code:

typedef int (__thiscall *lpAmountAlive)(unsigned long ulThis);
lpAmountAlive AmountAlive; //0x3715C3A0


typedef int (__thiscall *lpTotalPlayers)(unsigned long ulThis);
lpTotalPlayers TotalPlayers;//0x3715C210

Proof:

creds : sealione and zoomgod for inspiration

**ac1d_buRn** · 10-19-2010

Originally Posted by SNal2F

I noticed there wasnt a sticky thread on the game or much infos or it must be spread out so.... Just some stuffz so you can make yourself some snazzy dazzy esps and bots and shit: feel free to post w/e you want

from my couple days of reversing game doesnt really intrest me just wanted to see what the fuss is about(I suck lol and there are alot of good players in CA) , I always come back to playing BF2

Mostly a dump of where to find stuff

Code:

005337E1   A1 A4E17F00      MOV EAX,DWORD PTR DS:[7FE1A4]
005337E6   8B88 F8060000    MOV ECX,DWORD PTR DS:[EAX+6F8]//cshell 
005337EC   894C24 04        MOV DWORD PTR SS:[ESP+4],ECX
005337F0  ^E9 8BFFF2FF      JMP Engine.00463780
005337F5   68 50177800      PUSH Engine.00781750                     ; ASCII "d3ddevice"
005337FA   56               PUSH ESI
005337FB   E8 C1C21B00      CALL Engine.006EFAC1
005337F5   68 50177800      PUSH Engine.00781750                     ; ASCII "d3ddevice"
005337FA   56               PUSH ESI
005337FB   E8 C1C21B00      CALL Engine.006EFAC1
00533800   83C4 08          ADD ESP,8
00533803   85C0             TEST EAX,EAX
00533805   75 10            JNZ SHORT Engine.00533817
00533807   FF15 2C638000    CALL DWORD PTR DS:[80632C]               ; Engine.005872E0//device found here
0053380D   8B5424 0C        MOV EDX,DWORD PTR SS:[ESP+C]
00533811   8902             MOV DWORD PTR DS:[EDX],EAX
00533813   33C0             XOR EAX,EAX
00533815   5E               POP ESI
00533816   C3               RETN
00533817   B8 01000000      MOV EAX,1

Engine hooks u can draw up in her.

Code:

005353B0   833D 04638000 00 CMP DWORD PTR DS:[806304],0
005353B7   75 36            JNZ SHORT Engine.005353EF
005353B9   6A 49            PUSH 49
005353BB   E8 60AAF6FF      CALL Engine.0049FE20
005353C0   83C4 04          ADD ESP,4
005353C3   833D E0DB7F00 01 CMP DWORD PTR DS:[7FDBE0],1
005353CA   7C 1D            JL SHORT Engine.005353E9
005353CC   A1 4C607D00      MOV EAX,DWORD PTR DS:[7D604C]
005353D1   68 703D7700      PUSH Engine.00773D70
005353D6   68 D43D7700      PUSH Engine.00773DD4                     ; ASCII "LT_NOTINITIALIZED"
005353DB   68 B81A7800      PUSH Engine.00781AB8                     ; ASCII "FlipScreen"
005353E0   50               PUSH EAX
005353E1   E8 7AB6F6FF      CALL Engine.004A0A60
005353E6   83C4 10          ADD ESP,10
005353E9   B8 49000000      MOV EAX,49
005353EE   C3               RETN

ClientInfo

Code:

3715F660   53                    PUSH EBX  //tried tracing back this function with no luck but you can see that the call in red is from the same class so i traced that for the this:it is lazy but w/e 
3715F661   8BD9                  MOV EBX,ECX
3715F663   56                    PUSH ESI
3715F664   8D43 08               LEA EAX,DWORD PTR DS:[EBX+8]
3715F667   57                    PUSH EDI
3715F668   C700 00000000         MOV DWORD PTR DS:[EAX],0
3715F66E   50                    PUSH EAX
3715F66F   A1 10D97E37           MOV EAX,DWORD PTR DS:[377ED910]
3715F674   8B88 84000000         MOV ECX,DWORD PTR DS:[EAX+84]
3715F67A   FFD1                  CALL ECX
3715F67C   8B7C24 1C             MOV EDI,DWORD PTR SS:[ESP+1C]
3715F680   83C4 04               ADD ESP,4
3715F683   6A 00                 PUSH 0
3715F685   57                    PUSH EDI
3715F686   8BCB                  MOV ECX,EBX
3715F688   E8 F3E2FFFF           CALL cshell.3715D980
3715F68D   E8 7EFDFFFF           CALL cshell.3715F410
3715F692   8BF0                  MOV ESI,EAX
3715F694   85F6                  TEST ESI,ESI
3715F696   75 20                 JNZ SHORT cshell.3715F6B8
3715F698   8B4C24 10             MOV ECX,DWORD PTR SS:[ESP+10]
3715F69C   A1 10D97E37           MOV EAX,DWORD PTR DS:[377ED910]
3715F6A1   8B10                  MOV EDX,DWORD PTR DS:[EAX]
3715F6A3   8B52 18               MOV EDX,DWORD PTR DS:[EDX+18]
3715F6A6   51                    PUSH ECX
3715F6A7   68 04A46E37           PUSH cshell.376EA404                                    ; ASCII "CCBAClientInfoMgr::AddClient %s End"



3715E914   8B0D 48CE7E37         MOV ECX,DWORD PTR DS:[377ECE48]                         ; cshell.37805DA0
3715E91A   6A 00                 PUSH 0
3715E91C   56                    PUSH ESI
3715E91D   E8 5EF0FFFF           CALL cshell.3715D980

didnt fully rebuild but w/e u can add what you want: only worked on this when i was bored last week :/

Code:

class PointerTo
{
public:
	char pad[4];
	PlayerInfo * first;
    __int32 index;

};


class PlayerInfo
{
public:
	
    __int32 Unknown0; //0000
	__int32 index; //0004
	__int32 Unknown2; //0008
	__int32 Unknown3; //000C
	char Name[12]; //0010
	char unknown5[12];
	_Object* obj; //0028
	char unknown7[76];
	__int8 IsDead; //0078
	__int8 Unknown9; //0079
	__int16 Unknown10; //007A
	char unknown11[488];
	PlayerInfo* Next; //0264
};



class _Object
{
public:
	char Pad[4];
	D3DXVECTOR3 origin;
};

Nothing usefull As i went sealione route .

Code:

typedef int (__thiscall *lpAmountAlive)(unsigned long ulThis);
lpAmountAlive AmountAlive; //0x3715C3A0


typedef int (__thiscall *lpTotalPlayers)(unsigned long ulThis);
lpTotalPlayers TotalPlayers;//0x3715C210

Proof:
YouTube - esp test(buggy)

creds : sealione and zoomgod for inspiration

who are you /

Nice ESP actially. How come it flickers tho?

**Mr.Magicman** · 10-19-2010

Originally Posted by SNal2F

I noticed there wasnt a sticky thread on the game or much infos or it must be spread out so.... Just some stuffz so you can make yourself some snazzy dazzy esps and bots and shit: feel free to post w/e you want

from my couple days of reversing game doesnt really intrest me just wanted to see what the fuss is about(I suck lol and there are alot of good players in CA) , I always come back to playing BF2

Mostly a dump of where to find stuff

Code:

005337E1 A1 A4E17F00 MOV EAX,DWORD PTR DS:[7FE1A4] 005337E6 8B88 F8060000 MOV ECX,DWORD PTR DS:[EAX+6F8]//cshell 005337EC 894C24 04 MOV DWORD PTR SS:[ESP+4],ECX 005337F0 ^E9 8BFFF2FF JMP Engine.00463780 005337F5 68 50177800 PUSH Engine.00781750 ; ASCII "d3ddevice" 005337FA 56 PUSH ESI 005337FB E8 C1C21B00 CALL Engine.006EFAC1 005337F5 68 50177800 PUSH Engine.00781750 ; ASCII "d3ddevice" 005337FA 56 PUSH ESI 005337FB E8 C1C21B00 CALL Engine.006EFAC1 00533800 83C4 08 ADD ESP,8 00533803 85C0 TEST EAX,EAX 00533805 75 10 JNZ SHORT Engine.00533817 00533807 FF15 2C638000 CALL DWORD PTR DS:[80632C] ; Engine.005872E0//device found here 0053380D 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 00533811 8902 MOV DWORD PTR DS:[EDX],EAX 00533813 33C0 XOR EAX,EAX 00533815 5E POP ESI 00533816 C3 RETN 00533817 B8 01000000 MOV EAX,1

Engine hooks u can draw up in her.

Code:

005353B0 833D 04638000 00 CMP DWORD PTR DS:[806304],0 005353B7 75 36 JNZ SHORT Engine.005353EF 005353B9 6A 49 PUSH 49 005353BB E8 60AAF6FF CALL Engine.0049FE20 005353C0 83C4 04 ADD ESP,4 005353C3 833D E0DB7F00 01 CMP DWORD PTR DS:[7FDBE0],1 005353CA 7C 1D JL SHORT Engine.005353E9 005353CC A1 4C607D00 MOV EAX,DWORD PTR DS:[7D604C] 005353D1 68 703D7700 PUSH Engine.00773D70 005353D6 68 D43D7700 PUSH Engine.00773DD4 ; ASCII "LT_NOTINITIALIZED" 005353DB 68 B81A7800 PUSH Engine.00781AB8 ; ASCII "FlipScreen" 005353E0 50 PUSH EAX 005353E1 E8 7AB6F6FF CALL Engine.004A0A60 005353E6 83C4 10 ADD ESP,10 005353E9 B8 49000000 MOV EAX,49 005353EE C3 RETN

ClientInfo

Code:

3715F660 53 PUSH EBX //tried tracing back this function with no luck but you can see that the call in red is from the same class so i traced that for the this:it is lazy but w/e 3715F661 8BD9 MOV EBX,ECX 3715F663 56 PUSH ESI 3715F664 8D43 08 LEA EAX,DWORD PTR DS:[EBX+8] 3715F667 57 PUSH EDI 3715F668 C700 00000000 MOV DWORD PTR DS:[EAX],0 3715F66E 50 PUSH EAX 3715F66F A1 10D97E37 MOV EAX,DWORD PTR DS:[377ED910] 3715F674 8B88 84000000 MOV ECX,DWORD PTR DS:[EAX+84] 3715F67A FFD1 CALL ECX 3715F67C 8B7C24 1C MOV EDI,DWORD PTR SS:[ESP+1C] 3715F680 83C4 04 ADD ESP,4 3715F683 6A 00 PUSH 0 3715F685 57 PUSH EDI 3715F686 8BCB MOV ECX,EBX 3715F688 E8 F3E2FFFF CALL cshell.3715D980 3715F68D E8 7EFDFFFF CALL cshell.3715F410 3715F692 8BF0 MOV ESI,EAX 3715F694 85F6 TEST ESI,ESI 3715F696 75 20 JNZ SHORT cshell.3715F6B8 3715F698 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 3715F69C A1 10D97E37 MOV EAX,DWORD PTR DS:[377ED910] 3715F6A1 8B10 MOV EDX,DWORD PTR DS:[EAX] 3715F6A3 8B52 18 MOV EDX,DWORD PTR DS:[EDX+18] 3715F6A6 51 PUSH ECX 3715F6A7 68 04A46E37 PUSH cshell.376EA404 ; ASCII "CCBAClientInfoMgr::AddClient %s End" 3715E914 8B0D 48CE7E37 MOV ECX,DWORD PTR DS:[377ECE48] ; cshell.37805DA0 3715E91A 6A 00 PUSH 0 3715E91C 56 PUSH ESI 3715E91D E8 5EF0FFFF CALL cshell.3715D980

didnt fully rebuild but w/e u can add what you want: only worked on this when i was bored last week :/

Code:

class PointerTo { public: char pad[4]; PlayerInfo * first; __int32 index; }; u class PlayerInfo { public: __int32 Unknown0; //0000 __int32 index; //0004 __int32 Unknown2; //0008 __int32 Unknown3; //000C char Name[12]; //0010 char unknown5[12]; _Object* obj; //0028 char unknown7[76]; __int8 IsDead; //0078 __int8 Unknown9; //0079 __int16 Unknown10; //007A char unknown11[488]; PlayerInfo* Next; //0264 }; class _Object { public: char Pad[4]; D3DXVECTOR3 origin; };

Nothing usefull As i went sealione route .

Code:

typedef int (__thiscall *lpAmountAlive)(unsigned long ulThis); lpAmountAlive AmountAlive; //0x3715C3A0 typedef int (__thiscall *lpTotalPlayers)(unsigned long ulThis); lpTotalPlayers TotalPlayers;//0x3715C210

Proof:
YouTube - esp test(buggy)

creds : sealione and zoomgod for inspiration

nice straight leech of fatboy from uc forum.

**Synns** · 10-19-2010

Originally Posted by Mr.Magicman

nice straight leech of fatboy from uc forum.

SNal2F is fatboy88 lol.

xD

Thread: Enemy Player Pointer

Thread Tools

Display

Hybrid View

Enemy Player Pointer

The Following 3 Users Say Thank You to StupidLittleNoob For This Useful Post:

The Following User Says Thank You to mmbob For This Useful Post:

The Following 2 Users Say Thank You to SNal2F For This Useful Post:

The Following User Says Thank You to Synns For This Useful Post:

Similar Threads

[Release] Enemy Player Pointer Adress

The Enemy Player Pointer Address

CA Player pointer

[Cube2] player pointers

Base player pointer?!?!?