BOII how to find DVARS /w OllyDBG and CE

[[NEWACCOUNT]Yano]

Hello guys!

I think there already was a tutorial, but as I cant find it anymore i decided to makea new one
This works for SP, ZM and MP.

Things needed:
-OllyDBG
-Cheat Engine
-Black Ops 2

Tutorial step by step:

I. Open up OllyDBG and open t6mp in the folder where your game is saved.
It should load a bit now.

II. Press View -> Executable Modules -> Double click the one that ends with "t6mp.exe"

III. Now you should be in the window "CPU - main thread, module t6mp"

IV. Right-Click into this window and go to Search for -> all referenced text strings

V. After some seconds it should bring up a window "Text string referenced in t6mp:.text"

VI. Right CLick into this window and select "Search for text".

VII. Enter a DVAR or a part of it you wanna have. (e.g. cg_fov).
Enable "Entire scope" , Disable "Case sensitive", click "ok"

VIII. Double-click the grey tagged string. In this case its *ASCII "cg_fov"*
If the wrong one is tagged (e.g. cg_fovDefault), press Shift+L until you got the right one.

IIX. Now you are again in the window "CPU - main thread, module t6mp"

IX. Left to the ASCII "cg_fov" should be "PUSH t6mp. ..."
Some lines under it there should be a line that begins with "MOV DWORD"
In the same line theres an adress in square brackets.
Note down that adress.
Close OllyDBG.

 

0061148F | 68 B04FC000 | PUSH t6mp.00C04FB0 | ASCII "cg_fov"
00611494 | A3 3CA20A01 | MOV DWORD PTR DS:[10AA23C],EAX

Now we go to Cheat Engine

I. Start BO2

II. Go into Private Match

III. In Cheat Engine attach t6mp.exe

IV. Press "Add Adress Manually"

V. Enable "Pointer"

VI. In the first short TextBox you enter 78, in the longer one you enter the adress.
As the type you select the type of the DVAR (in this case its Float), in description enter what u want.
Better enter cg_fov so you know what this adress is for.

VII. Press "Ok". In the list you got the adress and the value should be you FOV ( between 65 and 90 )

 

I hope I could help you
Bye! Yano

[Evasi0nX]

Thanks for the share, I always felt bad waiting for people to release addresses and then just take them without any knowledge of how to find anything other than things like ammo and health. On top of that if there was an update my cheat was useless until someone posted those addresses again. Now i can finally find something on my own! But why do you put 78 into the shorter textbox and would 78 work for other call of duties?

[[NEWACCOUNT]Yano]

ould 78 work for other call of duties?

Im not sure. I think i already tried it one time and it didnt work ^^

[maxxam6899]

Nice tutorial, but i think

If the wrong one is tagged (e.g. cg_fovDefault), press Shift+L until you got the right one.

you mean Strg and not Shift.

[TheRedBeard]

VI. In the first short TextBox you enter 78, in the longer one you enter the adress.
As the type you select the type of the DVAR (in this case its Float), in description enter what u want.
Better enter cg_fov so you know what this adress is for.

Hi,
How did you know the DVAR type was a float? I was searching for a 4 byte type because of the: 'move dword' and I couldn't find it.
For the DVAR phys_gravity it say: 'move byte' and I try to add the pointer with a byte type and it doesn't work too.
Could you help me?
Thanks

[[NEWACCOUNT]Yano]

Hi,
How did you know the DVAR type was a float? I was searching for a 4 byte type because of the: 'move dword' and I couldn't find it.
For the DVAR phys_gravity it say: 'move byte' and I try to add the pointer with a byte type and it doesn't work too.
Could you help me?
Thanks

It should always say MOV DWORD afaik.
Just think logically to find out what type a dvar is.

[TheRedBeard]

It should always say MOV DWORD afaik.

May be I don't have the right DVAR? I can't upload a picture but here is the code:

005DF388|68 D0D7BE00|PUSH t6mp.00BED7D0|;   ASCII "phys_gravity"
005DF38D|881D 292EC002|MOV BYTE PTR DS:[2C02E29],BL
005DF393|E8 7835FFFF|CALL t6mp.005D2910
005DF398|F3:0F1005 A8BCC600|MOVSS XMM0,DWORD PTR DS:[C6BCA8]
005DF3A0|F3:0F100D 306AC200|MOVSS XMM1,DWORD PTR DS:[C26A30]
...

Oh, and many addresses are like 'MOVSS XMM0' and not 'MOV', and I can't find any value.
Exemple:

004E07C8  |. 68 2083BF00|PUSH t6mp.00BF8320 |;  ASCII "aim_slowdown_debug"
004E07CD  |. E8 1EA60E00|CALL t6mp.005CADF0
004E07D2  |. F3:0F1005 849AC200| MOVSS XMM0,DWORD PTR DS:[C29A84]
004E07DA  |. 83C4 38|ADD ESP,38
004E07DD  |. 68 988FC100| PUSH t6mp.00C18F98
004E07E2  |. 68 80100000|PUSH 1080

I can't find any value with C29A84

Just think logically to find out what type a dvar is.

Thanks! I got a few more addresses! I thought all addresses were 4 bytes because of the 'mov dword'.

[[NEWACCOUNT]Yano]

I can't find any value with C29A84

Make sure you add the pointer to the offset.

Eh maybe it also works with the MOV BYTE, not sure

[EricModer13]

I really dont want to bump this thread, but the offset 78 doesnt work. What is the offset for bo2?