About C&P Triggerbot - EntityList

I was having problems with my C&P triggerbot and was confused what it was as when I used ProcMem.h it worked fine. I found out the problem and it was these lines.

Code:

RPM(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + EntityListOff), &EntityList, sizeof(DWORD), NULL); // entity list

RPM(fProcess.__HandleProcess, (PBYTE*)(EntityList + ((LocalCrosshair - 1) * 0x10)), &EnemyInCross, sizeof(DWORD), NULL); // enemy in crosshair

It would only shoot at some enemies and keep shooting even though enemy is dead but if I change it to this:

Code:

RPM(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + EntityListOff + ((LocalCrosshair - 1) * 0x10)), &EnemyInCross, sizeof(DWORD), NULL); // enemy in crosshair

trigger works perfectly and shoots at all enemies and stops when they're dead.

So my question is:
Why do I have to use (fProcess.__dwordClient + EntityListOff + ...) instead of (EntityList + ...)?
Thanks

Originally Posted by phoenix8383

I was having problems with my C&P triggerbot and was confused what it was as when I used ProcMem.h it worked fine. I found out the problem and it was these lines.

Code:

RPM(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + EntityListOff), &EntityList, sizeof(DWORD), NULL); // entity list

RPM(fProcess.__HandleProcess, (PBYTE*)(EntityList + ((LocalCrosshair - 1) * 0x10)), &EnemyInCross, sizeof(DWORD), NULL); // enemy in crosshair

It would only shoot at some enemies and keep shooting even though enemy is dead but if I change it to this:

Code:

RPM(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + EntityListOff + ((LocalCrosshair - 1) * 0x10)), &EnemyInCross, sizeof(DWORD), NULL); // enemy in crosshair

Because its located inside the module "client.dll"

I never actually looked at what you typed above your question lol

Originally Posted by PsychoBitch

Because its located inside the module "client.dll"

I never actually looked at what you typed above your question lol

:/
@Blueblood1 Do you know why?

Originally Posted by phoenix8383

:/
@Blueblood1 Do you know why?

You should format your question better, your essentially asking the same thing?
do you mean as to why you have the dwordClient there?

__dwordClient is basically the module inside CS:GO that handles the client (and alot of other stuff), the entitylist is INSIDE this module (hence why you need to start FROM clientdll then move FORWARD by N amount of bytes (EntityList offset))
There are a bunch of other modules located inside client.dll, if you open up ollydgb and click on "Executable Modules" you'll find every module located inside csgo.exe (If you attach it to CS:GO that is:P)

How to ollydbg:
Open ollydbg.
Click -> File -> Attach -> Choose "csgo" -> Press "Attach" button

Click the big blue "E" (Which stands for executable modules)
And boom there you go, you have all the modules located inside csgo.exe.

If you wish to reverse further I'd suggest watching some tutorials for Ollydgb and or IDA Pro (very usefull, has nice pseudocode)

Double click "(&Directory)client.dll"

You can scan for strings if you wish, there you can find all NetVars (like m_iHealth, m_iTeamNum etc..)

EDIT:
If you want a nice and SIMPLE memory class you can use one I've just put together:

Memory class

Memory.h

Code:

#pragma once

#include <Windows.h>


// Basic memory class

class Memory {
public:
	 DWORD hPID; // the process id
	 HANDLE hProc; // Handle to process


	 bool Process(char* ProcessName); // made it a bool incase you want to do something like
	 // while(!memory->Process("csgo.exe") etc
	 DWORD Module(LPSTR ModuleName, DWORD&); // Incase you wanna use pattern scanning for your offsets you need the modules size


	 // Basic template classes for RPM/WPM
	 template <class cData>
	 cData Read(DWORD dwAddress)
	 {
		 cData cRead;
		 ReadProcessMemory(hProc, (LPVOID)dwAddress, &cRead, sizeof(cData), NULL);
		 return cRead;
	 }

	 template <class cData>
	 void Write(DWORD addr, cData val) {
		 WriteProcessMemory(hProc, (LPVOID)addr, &val, sizeof(cData), NULL);
	 }
};
 

// pointer to our object
// its extern because its supposed to be 'initalized' in Memory.cpp (Or any other file, but only once!)
// Then you can just include Memory.h anywhere and do gMemory->Process("ayyy.exe"); or something
extern Memory* gMemory;

Memory.cpp

Code:

#include "Memory.h"
#include <TlHelp32.h> // Has all the CreateToolhelp32Snapshot etc...


// On the heap ayyyyyyyyy
Memory* gMemory = new Memory();


// Basically like every other memory wrapper tbh
// copy pasta erry daaay amirite

bool Memory::Process(char * ProcessName)
{
	HANDLE hhPID = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
	PROCESSENTRY32 ProcEntry;
	ProcEntry.dwSize = sizeof(ProcEntry);


	do
		if (!strcmp(ProcEntry.szExeFile, ProcessName))
		{


			Memory::hPID = ProcEntry.th32ProcessID;
			CloseHandle(hhPID);


			Memory::hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Memory::hPID);
			return true;
		}
	while (Process32Next(hhPID, &ProcEntry));
	return false;
}

DWORD Memory::Module(LPSTR ModuleName, DWORD& modSizeTo)
{
	HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, Memory::hPID);
	MODULEENTRY32 mEntry;
	mEntry.dwSize = sizeof(mEntry);


	do
		if (!strcmp(mEntry.szModule, ModuleName))
		{
			CloseHandle(hModule);
			modSizeTo = mEntry.modBaseSize;
			return (DWORD)mEntry.modBaseAddr;
		}
	while (Module32Next(hModule, &mEntry));
	return 0;
}

And just a very simple offset class (Note they may be outdated I'm not sure...)

(Just do GetAddress::GetOffset/GetNetvar as they are static pointers

)

Offset class

keep in mind, these offsets may be outdated.

Addresses.h

Code:

#pragma once
#include <Windows.h>


class NetVars {
public:
	static DWORD m_iHealth;
	static DWORD m_iTeam;
	static DWORD m_iInCross;
	static DWORD m_VecOrigin;
	static DWORD m_fFlags;
	static DWORD m_bIsSpotted;
	static DWORD m_bIsScoped;
	static DWORD m_iCompRank, m_iCompWins;
	static DWORD m_FlashDuration;
};

class Offsets {
public:
	static DWORD LocalPlayer;
	static DWORD EntityList;
	static DWORD LftAttack;
	static DWORD RgtAttack;
	static DWORD Jump;
	static DWORD EnginePtr;
	static DWORD dwAng;
	static DWORD PunchAngle;
	static DWORD shotsFired;
	static DWORD IGameResources;
	static DWORD RadarBase;
	
	static DWORD GlowObjectBase;
};



class GetAddres {
public:
	static Offsets* GetOffset;
	static NetVars* GetNetVar;
};

Addresses.cpp

Code:

#include "Addresses.h"

DWORD NetVars::m_iHealth = 0xFC;
DWORD NetVars::m_iTeam = 0xF0;
DWORD NetVars::m_iInCross = 0x2410;
DWORD NetVars::m_VecOrigin = 0x134;
DWORD NetVars::m_fFlags = 0x100;
DWORD NetVars::m_bIsSpotted = 0x935;
DWORD NetVars::m_bIsScoped = 0x1c00;
DWORD NetVars::m_iCompRank = 0x1A3C;
DWORD NetVars::m_iCompWins = 0x1B40;
DWORD NetVars::m_FlashDuration = 0x1DB4;

DWORD Offsets::LocalPlayer = 0x00A76CBC;
DWORD Offsets::EntityList = 0x04A18C54;
DWORD Offsets::LftAttack = 0x02E8ABB4;
DWORD Offsets::RgtAttack = 0x02E8ABA8;
DWORD Offsets::Jump = 0x04AA99B4;
DWORD Offsets::EnginePtr = 0x005D2284;
DWORD Offsets::dwAng = 0x4CE0;
DWORD Offsets::PunchAngle = 0x13e8;
DWORD Offsets::shotsFired = 0x1d6c;
DWORD Offsets::IGameResources = 0x04A38EAC;
DWORD Offsets::RadarBase = 0x04A4D8EC;
DWORD Offsets::GlowObjectBase = 0x04B2BB24;


Offsets* GetAddres::GetOffset = new Offsets;
NetVars* GetAddres::GetNetVar = new NetVars;

Originally Posted by PsychoBitch

You should format your question better, your essentially asking the same thing?
do you mean as to why you have the dwordClient there?

When I use

Code:

RPM(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + EntityListOff), &EntityList, sizeof(DWORD), NULL); // entity list

RPM(fProcess.__HandleProcess, (PBYTE*)(EntityList + ((LocalCrosshair - 1) * 0x10)), &EnemyInCross, sizeof(DWORD), NULL); // enemy in crosshair

the triggerbot only half works.
But if I use

Code:

RPM(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + EntityListOff + ((LocalCrosshair - 1) * 0x10)), &EnemyInCross, sizeof(DWORD), NULL); // enemy in crosshair

the triggerbot works perfectly.

In my first RPM I set fProcess.__dwordClient + EntityListOff to &EntityList. Then I used &EntityList for my second RPM but as stated above the triggerbot only half works.

But if I use fProcess.__dwordClient + EntityListOff instead of &EntityList my triggerbot works fine.

Hope this helps clarify my question.
Thanks.

Originally Posted by phoenix8383

When I use

Code:

RPM(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + EntityListOff), &EntityList, sizeof(DWORD), NULL); // entity list

RPM(fProcess.__HandleProcess, (PBYTE*)(EntityList + ((LocalCrosshair - 1) * 0x10)), &EnemyInCross, sizeof(DWORD), NULL); // enemy in crosshair

the triggerbot only half works.
But if I use

Code:

RPM(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + EntityListOff + ((LocalCrosshair - 1) * 0x10)), &EnemyInCross, sizeof(DWORD), NULL); // enemy in crosshair

Yes thank you for claryfying your question, the problem may be performance wise (Doubt it) but there really should be no difference as you are doing the same thing excep you just read them seperatly, however the bottom one is obviously preffered as minimizing RPM calls is critical externally (Its already slow enough external, hence why you should always try pad structs out so you only need to do one single RPM/WPM call)

Originally Posted by PsychoBitch

If it's doing the same thing, why doesn't my first code work?

About C&P Triggerbot - EntityList

Post a Reply

Similar Threads

Tags for this Thread