Auto Finding GameStatus without Classes.

[Genesis]

Was looking to find a way to find GameStatus without classes about a month ago and i used my super leet math skills to figure out a ghetto sort of way.
I'm feeling sort of nice so i'll post it to the public.

Basically, LTClient Address + 0x18808 - 0x7c + 0x10 = GameStatus Address
For the current patch it would be 0x378206B8 + 0x18808 - 0x7c + 0x10 = 0x37838E54

Now you can use the LTClient sigscan to grab a working GameStatus.

dwLTClient= FindPattern(dwCShellEntry, dwCShellCodeSize,(PBYTE) "\x8B\x0D\x00\x00\x00\x00\xD9\x54\x24\x00\x53\xD9\x54\x[DONT COPY AND PASTE ME!]24\x00\x8D\x5C\x24\x00\xD9\x5C\x24\x00\x53\[NO COPY AND PASTING]xD9\xE8\x50", "xx????xxx?xxxx?xxx?xxx?xxx");

If you've had any sort of experience with hacking CA you'd know the CShell Entry point and Code size, so just edit the sig scan, i don't want leechers all over this.

Anyway, the final step.
Find where you are calling your sig scans, and basically do this.

dwGameStatus = dwLTClient + 0x18808 - 0x7c + 0x10;

Bam, working gamestatus all the time without the use of a class or a gamestatus sig.

Its a shame Gamestatus isn't primarily used anymore, but i hope people can still find it useful.

[R4v0r]

Why not simple use the GameStatus signature?

[5555satan]

Why not simple use the GameStatus signature?

cuz this will auto update and wont get patched....

[Saltine]

Was looking to find a way to find GameStatus without classes about a month ago and i used my super leet math skills to figure out a ghetto sort of way.
I'm feeling sort of nice so i'll post it to the public.

Basically, LTClient Address + 0x18808 - 0x7c + 0x10 = GameStatus Address
For the current patch it would be 0x378206B8 + 0x18808 - 0x7c + 0x10 = 0x37838E54

Now you can use the LTClient sigscan to grab a working GameStatus.

dwLTClient= FindPattern(dwCShellEntry, dwCShellCodeSize,(PBYTE) "\x8B\x0D\x00\x00\x00\x00\xD9\x54\x24\x00\x53\xD9\x54\x[DONT COPY AND PASTE ME!]24\x00\x8D\x5C\x24\x00\xD9\x5C\x24\x00\x53\[NO COPY AND PASTING]xD9\xE8\x50", "xx????xxx?xxxx?xxx?xxx?xxx");

If you've had any sort of experience with hacking CA you'd know the CShell Entry point and Code size, so just edit the sig scan, i don't want leechers all over this.

Anyway, the final step.
Find where you are calling your sig scans, and basically do this.

dwGameStatus = dwLTClient + 0x18808 - 0x7c + 0x10;

Bam, working gamestatus all the time without the use of a class or a gamestatus sig.

Its a shame Gamestatus isn't primarily used anymore, but i hope people can still find it useful.

Nice job, but why not condense the addition into one constant haha?

dwGameStatus = dwLTClient + 0x1879C;

[Shadow`]

Nice job on this, it will be useful to members who still use Gamestatus.

[Genesis]

Nice job, but why not condense the addition into one constant haha?

dwGameStatus = dwLTClient + 0x1879C;

I said i was leet at math in the first post, truth is i'm terrible at math! It was more random guessing and me thinking i was good that deceived my mind into me figuring this out XD Thanks.

[coderstrikeagain]

Well if you do auto spamming on your hack you should use this if you don't use the class or anything else.

[Departure]

What if the "class" changes then this offset will change... there is no guessing involved here its the offset of the class to the game status, in this case you are jumping 0x1879C bytes from the start of the LTClient "class", Btw I am not even sure why people call these a class, I am sure C++ even call this a structure.

Good work, and you can do this for any of the functions/Values of any class/Structure without the need to have the structure defined in your code.. ooops I mean "Class" Defined...

[[MPGH]Flengo]

I don't think this will last very long. A lot of things can be changed in between. Jumping 0x1879C bytes is pretty big.

[Acea]

Why not use class checks

[Genesis]

I don't think this will last very long. A lot of things can be changed in between. Jumping 0x1879C bytes is pretty big.

You may think that, but i've had this for 2 patches now

[Ch40zz-C0d3r]

You guys...
I think I should release my dynamic sfxmgr way LOL
There is a virtual, simply hook it, grab ECX pointer + offset and youre done.

[ZysorceN]

You guys...
I think I should release my dynamic sfxmgr way LOL
There is a virtual, simply hook it, grab ECX pointer + offset and youre done.

There is many ways to do this virtuals that return the game status Static Global Variables Code caves. and i could keep mentioning method's so like i would tell anybody else. fucking stop asking for attention either make it open source or not. just do not ask if you should.

[Suernoep]

nice job :0 amazing

[Departure]

You guys...
I think I should release my dynamic sfxmgr way LOL
There is a virtual, simply hook it, grab ECX pointer + offset and youre done.

Don't think about it just do it... I was thinking about releasing photos of my cock, but then realized the amount of envy from other members and the fags around here, It wouldn't be good for my pm box, Point being less talk and more action, if you say your going to do something just do it.....