Modern Warfare 3 Source Code / Address Thread

**Kenshin13** · 10-07-2012

Originally Posted by rawr im a tiger

I don't want to damage IW5M by releasing my addresses, but this one shouldn't hurt

Laser:
004D14B6

*(BYTE*)0x4D14B7 = NULL;

Thx master131 :P

**Fawkes1234** · 10-12-2012

Originally Posted by -InSaNe-

Some structs..

Code:

typedef struct
{
	char unknown0[12];
	char Name[16];
	__int32 Team;
}ClientInfo_T;

typedef struct
{
	char _0x0000[0x8];
	int Width;
	int Height;
	int FovX;
	int FovY;
	Vector Origin;
	Vector ViewAxis[3];
	char _0x0048[0x24];
	float ZoomProgress;
	char _0x0070[0x4ABC]; 
	Vector ViewAngles;
	char _0x4B34[0x30];
	float WeaponViewAngleX;
	float WeaponViewAngleY;
}RefDef_T;

typedef struct
{
public:
       Vector Recoil;
       Vector vOrigin;
       Vector DeltaOrigin; 
       float ReadViewAngleY;
       float ReadViewAngleX;
       char _0x0070[108];
       float SetViewAngleY;
       float SetViewAngleX; 
} ViewMatrix;

typedef struct
{
	char _0x0000[0x2];                         
	short Valid;                                   
	char _0x0004[0x10];                        
	Vector Origin;                                
	Vector Angles;                              
	char _0x002C[0x3C];                      
	int Flags;                                  
	char _0x006C[0xC];                          
	Vector OldOrigin;                           
	char _0x0084[0x18];                         
	Vector OldAngles;                        
	char _0x00A8[0x28];                     
	int ClientNumber;                                 
	short Type;                            
	char _0x00D6[0x12];                          
        Vector NewOrigin;   
	char _0x00F4[0x1C];                        
	Vector NewAngles;                            
	char _0x011C[0x7C];                      
	byte WeaponID;                            
	char _0x0199[0x37];                    
	int IsAlive; 
	char _0x01D4[0x24];
}Entity_T; 

typedef struct
{
    int servertime; 
    int playerstate; 
    int staminatimer; 
    unsigned short playerstance;
    char _pad[10];
    int velocity; 
    Vector Origin;
    Vector Velocity;
    char _pad1[44];
    float refdefViewAngleY; 
    float refdefViewAngleX; 
    char _pad2[232];
    int ClientNumber; 
    char _pad3[4];
    float viewAngleY;
    float viewAngleX; 
    char _pad4[4];
    int   playerStanceInt; 
    float playerStanceFlt;
    char _pad5[80];
    int MaxEntities;
    char _pad6[432];
    int WeaponNum;
    unsigned short EquipmentState;
    unsigned short WeaponSwapState;
    float WeaponZoomFlt;
    float MovementSpreadMultiplier;
    char _pad7[4];
    float DefaultSpreadMultiplier;
    int  WeaponState;
    char _pad8[352];
    BYTE perkslot3;
    char _pad9[19];
}CG_T;

typedef struct
{
public:
	__int32 Time;
	char unknown0[512];
	__int32 Uav;
	char unknown1[384];
	__int32 SpreadValue;
}CGS_T;

insane best man

**Kenshin13** · 10-17-2012

Code:

Name: Magic Number | Server ID | Match ID
Offset: 0xFF5058
Length: 4-Bytes || DWORD
Value: Changes with each game
Use: Can be used to exploit a command to end games on unpatched versions of MW3 (TeknoMW3 Only)
HOW TO USE:

typedef (__cdecl* ProcessCommand)(int zero, char* Cmd); //Define ProcessCommand
ProcessCommand endRoundProcess = 0x429920; //Instantiate(Proper Context for C++?) The "endRoundProcess". Similar to CBuf_AddText, you can use either.

char buf[30]; //Create the buffer

sprintf_s(buf, "mr %d -1 endround;", *(int*)0xFF5058); //Put the magic number in the endround command
endRoundProcess(0, buf); //Send it to be processed.

**MarkHC** · 10-17-2012

Just for the record.. MagicNumber = ServerID

Dunno why everybody call it MagicNumber

**Kenshin13** · 10-17-2012

Originally Posted by -InSaNe-

Just for the record.. MagicNumber = ServerID

Dunno why everybody call it MagicNumber

Meh it's more like the current match's id. It changes every map rotate.
Plus I head Nukem call it that....easier to call it that than make a name

**mwxplayer** · 10-25-2012

I read all the addresses but IW5M are very less can anyone tell me how can i find Addresses (Cheat Engine yeah but Confuse which address is for what?)

**Kenshin13** · 11-17-2012

Here's the address I used to draw the nametags for my newest release.
IW5M/Tekno Address:

Code:


CG_DrawOverheadName ............ 0x00588A10

You can use it like @barata55 and typedef it ->

Code:

typedef (__cdecl* sub_588A10)(int cg_ClientNum, Entity cEntity, float alphaValue); sub_588A10 origFunc = (sub_588A10)0x00588A10;

Then loop through each entity filtering the enemies or every player and draw their names by changing alphaVal to 1.0f ->

Code:

for(int i=0; i<MAXENTITIES; i++) { if(cEntity.Type == ET_PLAYER && cEntity.IsValid && (cEntity.IsAlive & 1)) origFunc(CG->localClientNumber, cEntity, 1.0f); }

::::::::::OR:::::::::::

You can hook it to make and toggle like I did which is useful if you don't use the Entity structure:

Code:

typedef (__cdecl *sub_588A10)(int var1, var2, float alpha); sub_588A10 origFunc = NULL; //Function to draw the names if they were to be draw -> void __cdecl DrawNames(uint var1, uint var2, float alphaVal) { if(ShouldNamesBeDrawn) return origFunc(var1, var2, 1.0f); else return origFunc(var1, var2, alphaVal); } //Our hook, six bytes long) origFunc = (sub_588A10)DetourFunction((PBYTE)0x00588A10, (PBYTE)&DrawNames, 6);

Credits: KingOrgy(Tutorial Which Made me do something similar), @barata55(Inspiration+Method A) and @Kenshin13(Finding the mofo)

This is how I found it. (Using IDA)
Look for a referenced string: "cg_friendlyNameFadeIn"
You may also try to find it using any of the following also:

Code:

[B]
  LODWORD(dword_8FAB74) = sub_4A5CF0((int)"cg_overheadNamesSize", 0.6499999761581421, 0.0, 100.0, 4);
  dword_8FAA80 = sub_4A5CF0((int)"cg_overheadNamesNearDist", 64.0, 0.0, 3.402823466385289e38, 4);
  dword_8FAB4C = sub_4A5CF0((int)"cg_overheadNamesFarDist", 512.0, 0.0, 3.402823466385289e38, 4);
  dword_B0A7E4 = sub_4A5CF0((int)"cg_overheadIconSize", 1.100000023841858, 0.0, 100.0, 4);
  dword_8FAB24 = sub_4A5CF0((int)"cg_overheadNamesFarScale", 0.699999988079071, 0.0, 3.402823466385289e38, 4);
  dword_8FF0F8 = sub_4A5CF0((int)"cg_overheadRankSize", 0.5, 0.0, 3.402823466385289e38, 4);
  dword_B04640 = sub_4A5CF0((int)"cg_overheadTitleSize", 0.5, 0.0, 3.402823466385289e38, 4);
  dword_B04684 = sub_44EB50((int)"cg_overheadNamesGlow", 0.0, 0.0, 0.0, 1.0, 4);
  dword_8FAB98 = sub_50C760((unsigned int)"cg_overheadNamesFont", 2, 0, 10, 4);
  dword_8FAAA4 = sub_50C760((unsigned int)"cg_friendlyNameFadeOut", 1500, 0, 2147483647, 4);
[B]

Which will lead you to this:

Code:

dword_8FAB48 = sub_50C760((unsigned int)"cg_friendlyNameFadeIn", 0, 0, 2147483647, 4);

Now if you cross-reference 0x8FAB48, you should get only one other function:

Code:

void __usercall sub_5891B0(int a1<eax>, char a2<cl>, int a3, int a4)
{
  char v4; // bl@1
  int v5; // ebp@1
  int v6; // esi@6
  int v7; // edi@8
  char v8; // cl@13
  int *v9; // edx@18
  int v10; // eax@21
  int v11; // edx@21
  signed int v12; // ecx@21
  int v13; // edi@21
  int v14; // esi@21
  double v15; // st7@22
  int v16; // [sp+1Ch] [bp-18h]@1
  int v17; // [sp+20h] [bp-14h]@1
  int v18; // [sp+24h] [bp-10h]@1
  int v19; // [sp+28h] [bp-Ch]@1
  int v20; // [sp+2Ch] [bp-8h]@1
  int v21; // [sp+30h] [bp-4h]@1
  char v22; // [sp+38h] [bp+4h]@4
  int v23; // [sp+38h] [bp+4h]@23
  float v24; // [sp+38h] [bp+4h]@26

  v4 = a2;
  v16 = *(_DWORD *)(dword_8FAAB0 + 12);
  v17 = *(_DWORD *)(dword_B0466C + 12);
  v5 = a3;
  v18 = *(_DWORD *)(dword_8FAB48 + 12); //This is our cross-referenced function.
  v19 = *(_DWORD *)(dword_8FAAA4 + 12);
  v20 = 250;
  v21 = 250;
  v22 = a1 == 3 || a1 && a1 == dword_9FC764[344 * a4];
  v6 = LODWORD(dword_96A25C);
  if ( (unsigned __int8)sub_4A5CA0(v5) )
    v6 = sub_4BB3E0();
  v7 = sub_481FA0(v5);
  if ( (unsigned __int8)sub_489F70(v5) )
    v7 = 0;
  if ( v7 >= *(_DWORD *)(dword_8FAAB0 + 12) )
    v4 = 0;
  if ( v4 )
  {
    v8 = LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]);
    if ( !(v8 & 1) )
    {
      LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]) = v8 | 1;
      dword_8F3980[3 * (a4 + 18 * v5) + 1] = v6;
    }
    dword_8F3980[3 * (a4 + 18 * v5)] = v6;
  }
  else
  {
    LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]) &= 0xFEu;
  }
  if ( v7 <= 0 )
  {
    v9 = &v18;
    if ( !v22 )
      v9 = &v20;
  }
  else
  {
    v9 = &v16;
  }
  v12 = v9[1];
  v13 = *v9;
  v11 = dword_8F3980[3 * (a4 + 18 * v5)];
  v10 = dword_8F3980[3 * (a4 + 18 * v5) + 1];
  v14 = v6 - v11;
  if ( v14 < v12 )
  {
    v23 = v11 - v10;
    if ( v11 - v10 >= v13 )
      v15 = (double)(v12 - v14) / (double)v12;
    else
      v15 = (double)v23 / (double)v13;
  }
  else
  {
    v15 = 0.0;
  }
  v24 = v15;
  sub_588A10(v13, v5, (int)((char *)&unk_A08630 + 504 * a4), v24);
}

Good shit eh?
Looking at the bottom, you'll see that sub_588A10 is what takes the parameters. Therefore 0x588A10 is our function.

For the parameters:

Code:

void __usercall sub_588A10(char a1<dil>, int a2, int a3, float a4)

So we get our typedef:

Code:

typedef (__cdecl* sub_588A10)(int a2, int a3, float a4);

Voila.

**MarkHC** · 11-19-2012

Originally Posted by Kenshin13

bla bla bla coding stuff.. bla bla bla

This is how I found it. (Using IDA)
Look for a referenced string: "cg_friendlyNameFadeIn"
You may also try to find it using any of the following also:

Code:

[B]
  LODWORD(dword_8FAB74) = sub_4A5CF0((int)"cg_overheadNamesSize", 0.6499999761581421, 0.0, 100.0, 4);
  dword_8FAA80 = sub_4A5CF0((int)"cg_overheadNamesNearDist", 64.0, 0.0, 3.402823466385289e38, 4);
  dword_8FAB4C = sub_4A5CF0((int)"cg_overheadNamesFarDist", 512.0, 0.0, 3.402823466385289e38, 4);
  dword_B0A7E4 = sub_4A5CF0((int)"cg_overheadIconSize", 1.100000023841858, 0.0, 100.0, 4);
  dword_8FAB24 = sub_4A5CF0((int)"cg_overheadNamesFarScale", 0.699999988079071, 0.0, 3.402823466385289e38, 4);
  dword_8FF0F8 = sub_4A5CF0((int)"cg_overheadRankSize", 0.5, 0.0, 3.402823466385289e38, 4);
  dword_B04640 = sub_4A5CF0((int)"cg_overheadTitleSize", 0.5, 0.0, 3.402823466385289e38, 4);
  dword_B04684 = sub_44EB50((int)"cg_overheadNamesGlow", 0.0, 0.0, 0.0, 1.0, 4);
  dword_8FAB98 = sub_50C760((unsigned int)"cg_overheadNamesFont", 2, 0, 10, 4);
  dword_8FAAA4 = sub_50C760((unsigned int)"cg_friendlyNameFadeOut", 1500, 0, 2147483647, 4);
[B]

Which will lead you to this:

Code:

dword_8FAB48 = sub_50C760((unsigned int)"cg_friendlyNameFadeIn", 0, 0, 2147483647, 4);

Now if you cross-reference 0x8FAB48, you should get only one other function:

Code:

void __usercall sub_5891B0(int a1<eax>, char a2<cl>, int a3, int a4)
{
  char v4; // bl@1
  int v5; // ebp@1
  int v6; // esi@6
  int v7; // edi@8
  char v8; // cl@13
  int *v9; // edx@18
  int v10; // eax@21
  int v11; // edx@21
  signed int v12; // ecx@21
  int v13; // edi@21
  int v14; // esi@21
  double v15; // st7@22
  int v16; // [sp+1Ch] [bp-18h]@1
  int v17; // [sp+20h] [bp-14h]@1
  int v18; // [sp+24h] [bp-10h]@1
  int v19; // [sp+28h] [bp-Ch]@1
  int v20; // [sp+2Ch] [bp-8h]@1
  int v21; // [sp+30h] [bp-4h]@1
  char v22; // [sp+38h] [bp+4h]@4
  int v23; // [sp+38h] [bp+4h]@23
  float v24; // [sp+38h] [bp+4h]@26

  v4 = a2;
  v16 = *(_DWORD *)(dword_8FAAB0 + 12);
  v17 = *(_DWORD *)(dword_B0466C + 12);
  v5 = a3;
  v18 = *(_DWORD *)(dword_8FAB48 + 12); //This is our cross-referenced function.
  v19 = *(_DWORD *)(dword_8FAAA4 + 12);
  v20 = 250;
  v21 = 250;
  v22 = a1 == 3 || a1 && a1 == dword_9FC764[344 * a4];
  v6 = LODWORD(dword_96A25C);
  if ( (unsigned __int8)sub_4A5CA0(v5) )
    v6 = sub_4BB3E0();
  v7 = sub_481FA0(v5);
  if ( (unsigned __int8)sub_489F70(v5) )
    v7 = 0;
  if ( v7 >= *(_DWORD *)(dword_8FAAB0 + 12) )
    v4 = 0;
  if ( v4 )
  {
    v8 = LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]);
    if ( !(v8 & 1) )
    {
      LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]) = v8 | 1;
      dword_8F3980[3 * (a4 + 18 * v5) + 1] = v6;
    }
    dword_8F3980[3 * (a4 + 18 * v5)] = v6;
  }
  else
  {
    LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]) &= 0xFEu;
  }
  if ( v7 <= 0 )
  {
    v9 = &v18;
    if ( !v22 )
      v9 = &v20;
  }
  else
  {
    v9 = &v16;
  }
  v12 = v9[1];
  v13 = *v9;
  v11 = dword_8F3980[3 * (a4 + 18 * v5)];
  v10 = dword_8F3980[3 * (a4 + 18 * v5) + 1];
  v14 = v6 - v11;
  if ( v14 < v12 )
  {
    v23 = v11 - v10;
    if ( v11 - v10 >= v13 )
      v15 = (double)(v12 - v14) / (double)v12;
    else
      v15 = (double)v23 / (double)v13;
  }
  else
  {
    v15 = 0.0;
  }
  v24 = v15;
  sub_588A10(v13, v5, (int)((char *)&unk_A08630 + 504 * a4), v24);
}

Good shit eh?
Looking at the bottom, you'll see that sub_588A10 is what takes the parameters. Therefore 0x588A10 is our function.

For the parameters:

Code:

void __usercall sub_588A10(char a1<dil>, int a2, int a3, float a4)

So we get our typedef:

Code:

typedef (__cdecl* sub_588A10)(int a2, int a3, float a4);

Voila.

https://www.mpgh.net/forum/604-call-d...ml#post6691749

Although I didn't bother to make a complete tutorial for this.. so good job bro

**Kenshin13** · 11-19-2012

Originally Posted by -InSaNe-

https://www.mpgh.net/forum/604-call-d...ml#post6691749

Although I didn't bother to make a complete tutorial for this.. so good job bro

You posted that? :O
Never even saw it...
LoL It works with other strings to...I tried 3 others.
And KingOrgy searched for a seperate string....He never searched "cg_friendlyNamesFadeIn" (or Out for that matter.) You found that yourself? :P
Well at least in the tutorial I saw.

**Kenshin13** · 12-10-2012

Some Shit I just found:

**Kenshin13** · 01-18-2013

Courtesy @NightmareTX :P

Code:

DrawThermalScreen(The Black-White Screen)
.........0x0042E75E [NOP 5-Bytes Off Here]
.........0x00A03938 [Change this BYTE to 1]

ThermalOverlay(Looks sexy if you disable the above)
.........0x004C1E30 [NOP 5-Bytes Off Here]
.........0x05F9CCC0[Change this BYTE to 1]

Just tested.

**mwxplayer** · 01-20-2013

Originally Posted by Kenshin13

Courtesy @NightmareTX :P

Code:

.........0x05F9CCC0[Change this BYTE to 1]

Just tested.

Game Crashes.. on changing that byte to 1.

**Kenshin13** · 01-20-2013

Originally Posted by mwxplayer

Game Crashes.. on changing that byte to 1.

Ever heard of VirtualProtect() ? I tested it.

**mwxplayer** · 01-22-2013

1.4.382 (TeknoMW3/IW5M) SP Addresses :

Code:

Primary Ammo - iw5sp.exe+EA9898
Primary Ammo bullets - iw5sp.exe+EA9910
Grenades : iw5sp.exe+EA991C
Flash Grenades : iw5sp.exe+EA9928

**Kenshin13** · 01-22-2013

Once again, courtesy @NightmareTX

Code:

Server-Client Friction: 0x6DA734
Process Name: iw5mp_server.exe/iw5m_server.exe
Function: Controls friction of objects in a server.
Value Type: Floating-Point.
Default Value: 1000.0

Thread: Modern Warfare 3 Source Code / Address Thread

Thread Tools

Display

The Following User Says Thank You to Kenshin13 For This Useful Post:

The Following 2 Users Say Thank You to Kenshin13 For This Useful Post:

The Following User Says Thank You to Kenshin13 For This Useful Post:

The Following User Says Thank You to Kenshin13 For This Useful Post:

Similar Threads

Modern Warfare 3 Source Code / Address Thread

CrossFire Hack Source Code Resource Thread

[Info] Source Code Section Thread List

[Source Code] Battlefield 3 Hack Source Code / Reversal Thread

Buying blackops or modern warefare 3 or modern warfare 2 codes for steam