HelpHow to get the offsets from the String Reference of Dumped CShell_x64.dll

Ive been here for about 8 years and I dont have any contribution to this beloved website and yet I ask for help, sorry.

Thank you in advance!

Im new to programming and Im planning to make an External ESP for Crossfire PH
Im able to use LoadModule and get String Reference using x64Dbg.


My knowledge so far is this:

[ BaseAddress ] = (ex: CShell_x64.dll+someaddress)
|
v
+----------------------+
| PlayerManager| = (BaseAddress + 0xsomeoffsets)
+----------------------+
|
|---> PlayerSize (Max Players) = (PlayerManager + 0xsomeoffsets)
|
|
| |
+--> Player 0 (Player Index) = (PlayerManager + 0xsomeoffsets)
----Healthoffset = Value = 100
|
+--> Player 1 (Player Index)
----Healthoffset = 100
|
... and so on


If I understand it correctly, in order to get my players health value I need:

PlayerManager+ Player[0]+Healthoffset = 100(health value)

PlayerManager+ Player[1]+Healthoffset = 100(health value)


And to get all players health to a list I need to get PlayerSize first to get max players and then loop thru this size and get all available players total index count

totalplayers = [loop thru PlayerSize to check total player available]

and then:

ListArray = PlayerManager+ Player[totalplayers] = 100(health value)

My Problem is I dont know what to take from these String References.
How or where to get the base address and how or where or what to get the offset of the referenced string (ex: PlayerInfo)

(Double clicked the text reference)
Address=00007FFF89FFA466
Disassembly=lea rdx,qword ptr ds:[7FFF8BDECCF8]
String Address=00007FFF8BDECCF8
String="PlayerInfo"

I dont know how to get the offset from here like the (0x00) something like this


And Also is this the base address?
cshell_x64.dll+00007FFF894A0000 (from the view modules)

And Why is it Unloaded in the view modules

I was able to use CE to search for values, debug, pointer scan with the help of WKE misc-system settings.
If you don't use WKE cf will minimize your app that's attempting to open process or use processhandle, idk.

But now, I'm getting disconnected even if I change the WKE folder name and location or even redownloading it.

Hello,
There is no playersize anymore they exists in CLTClientShell list begins at 0x10
CShell does not have a fixed base address it's virtual so u have to get module base address everytime u open CF
You can't use CE or any debugger without using undetected kernel driver, AC detecting all debuggers running on ur system so u have to change the name and u have to change every call into Kernel to be able to use it, also in CFPH they detect read/write into any module so u have to bypass this one too,

And about CPlayer, there are no longer static offsets for each value, they use a virtual function which returns the offset of every value
Virtual functions are static but offsets are dynamic so you have to access the virtual function in order to get the offset you need


CPlayer = CLTClientShell + 0x10 + (PlayerIndex * 0x8)
CPlayerVTable[0] = 0x100 (health for example)
Health = CPlayer + 0x100