MPGHThe Dark Arts
RegisterLog in

STW easy way

Posts 1–14 of 14 · Page 1 of 1
STW easy way
Hello MPGH I'm here again and today I'll share an easier way to do Shoot Through Walls ('STW').

With this method you can do RemoteKill too...

First way to use
Code:
#define ADDR_STW 0x7294C8 

void YourFunction(){
*(float*)(ADDR_STW + 0xC) = 100.0f;
}
Second way
Code:
class CrossFire_Texture
{
public:
	char pad_0000[12]; //0x0000
	float STW; //0x000C
}; //Size: 0x0040


void CALL_STW()
{
	CrossFire_Texture *pCF_texture = (CrossFire_Texture*)ADDR_STW;
	if (pCF_texture != NULL) {
		pCF_texture->STW = 100.0f;
	}
}
How to get ADDR?

Code:
DC 1D ?? ?? ?? ?? DF E0 F6 C4 05 7A ?? D9 EE D9 5D ?? EB

0044D4C0  |. 83EC 08        SUB ESP,8
0044D4C3  |. DD1C24         FSTP QWORD PTR SS:[ESP]
0044D4C6  |. E8 D9531700    CALL crossfir.005C28A4
0044D4CB  |. 83C4 08        ADD ESP,8
0044D4CE  |. D95D 94        FSTP DWORD PTR SS:[EBP-6C]
0044D4D1  |. D945 94        FLD DWORD PTR SS:[EBP-6C]
0044D4D4  |. DC1D C8947200  FCOMP QWORD PTR DS:[7294C8]
0044D4DA  |. DFE0           FSTSW AX
0044D4DC  |. F6C4 05        TEST AH,5
0044D4DF  |. 7A 07          JPE SHORT crossfir.0044D4E8
0044D4E1  |. D9EE           FLDZ
0044D4E3  |. D95D F0        FSTP DWORD PTR SS:[EBP-10]
0044D4E6  |. EB 23          JMP SHORT crossfir.0044D50B
0044D4E8  |> D945 10        FLD DWORD PTR SS:[EBP+10]
0044D4EB  |. 8B45 1C        MOV EAX,DWORD PTR SS:[EBP+1C]
0044D4EE  |. 8B4D 08        MOV ECX,DWORD PTR SS:[EBP+8]
0044D4F1  |. D82481         FSUB DWORD PTR DS:[ECX+EAX*4]
0044D4F4  |. 8B55 1C        MOV EDX,DWORD PTR SS:[EBP+1C]
0044D4F7  |. 8B45 0C        MOV EAX,DWORD PTR SS:[EBP+C]
0044D4FA  |. D90490         FLD DWORD PTR DS:[EAX+EDX*4]


Code:
\xDC\x1D\x00\x00\x00\x00\xDF\xE0\xF6\xC4\x05\x7A\x00\xD9\xEE\xD9\x5D\x00\xEB
Code:
xx????xxxxxx?xxxx?x
#1 · edited ·
Very Useful Thanks
#2 ·
Quote Originally Posted by dreek1 View Post
Hello MPGH I'm here again and today I'll share an easier way to do Shoot Through Walls ('STW').

With this method you can do RemoteKill too...

First way to use
Code:
#define ADDR_STW 0x7294C8 

void YourFunction(){
*(float*)(ADDR_STW + 0xC) = 100.0f;
}
Second way
Code:
class CrossFire_Texture
{
public:
	char pad_0000[12]; //0x0000
	float STW; //0x000C
}; //Size: 0x0040


void CALL_STW()
{
	CrossFire_Texture *pCF_texture = (CrossFire_Texture*)ADDR_STW;
	if (pCF_texture != NULL) {
		pCF_texture->STW = 100.0f;
	}
}
How to get ADDR?

Code:
DC 1D ?? ?? ?? ?? DF E0 F6 C4 05 7A ?? D9 EE D9 5D ?? EB

0044D4C0  |. 83EC 08        SUB ESP,8
0044D4C3  |. DD1C24         FSTP QWORD PTR SS:[ESP]
0044D4C6  |. E8 D9531700    CALL crossfir.005C28A4
0044D4CB  |. 83C4 08        ADD ESP,8
0044D4CE  |. D95D 94        FSTP DWORD PTR SS:[EBP-6C]
0044D4D1  |. D945 94        FLD DWORD PTR SS:[EBP-6C]
0044D4D4  |. DC1D C8947200  FCOMP QWORD PTR DS:[7294C8]
0044D4DA  |. DFE0           FSTSW AX
0044D4DC  |. F6C4 05        TEST AH,5
0044D4DF  |. 7A 07          JPE SHORT crossfir.0044D4E8
0044D4E1  |. D9EE           FLDZ
0044D4E3  |. D95D F0        FSTP DWORD PTR SS:[EBP-10]
0044D4E6  |. EB 23          JMP SHORT crossfir.0044D50B
0044D4E8  |> D945 10        FLD DWORD PTR SS:[EBP+10]
0044D4EB  |. 8B45 1C        MOV EAX,DWORD PTR SS:[EBP+1C]
0044D4EE  |. 8B4D 08        MOV ECX,DWORD PTR SS:[EBP+8]
0044D4F1  |. D82481         FSUB DWORD PTR DS:[ECX+EAX*4]
0044D4F4  |. 8B55 1C        MOV EDX,DWORD PTR SS:[EBP+1C]
0044D4F7  |. 8B45 0C        MOV EAX,DWORD PTR SS:[EBP+C]
0044D4FA  |. D90490         FLD DWORD PTR DS:[EAX+EDX*4]


Code:
\xDC\x1D\x00\x00\x00\x00\xDF\xE0\xF6\xC4\x05\x7A\x00\xD9\xEE\xD9\x5D\x00\xEB
Code:
xx????xxxxxx?xxxx?x

Thanks for Sharing ♥
#3 ·
This AOB does not work with CFVN, do you have a way to find this AOB at CFVN, I have a CShell.dll Dump file at CFVN
#4 ·
Quote Originally Posted by janeth0123 View Post
This AOB does not work with CFVN, do you have a way to find this AOB at CFVN, I have a CShell.dll Dump file at CFVN
oww sh*t. why cshell....

0044D4DF |. 7A 07 JPE SHORT crossfir.0044D4E8
#5 ·
Quote Originally Posted by janeth0123 View Post
This AOB does not work with CFVN, do you have a way to find this AOB at CFVN, I have a CShell.dll Dump file at CFVN
crossfire module
#6 ·
Quote Originally Posted by jayjay153 View Post
oww sh*t. why cshell....

0044D4DF |. 7A 07 JPE SHORT crossfir.0044D4E8
can you guide me
#7 ·
Quote Originally Posted by janeth0123 View Post
can you guide me
He means to find it in crossfire.exe dump not in cshell.
the reason why he fontred the crossfir. is for you to see that the module is crossfire.exe

search the aob in crossfire.exe dump not in cshell.
Code:
0044D4D4  |. DC1D C8947200  FCOMP QWORD PTR DS:[7294C8]  <---this is still what you need to find.
0044D4DA  |. DFE0           FSTSW AX
0044D4DC  |. F6C4 05        TEST AH,5
0044D4DF  |. 7A 07          JPE SHORT crossfir.0044D4E8 <--- Crossfire.exe not CShell
#8 · edited ·
Great job
So It causes CF Client error 18_1 ?
#9 ·
Quote Originally Posted by [K]akashi View Post
Great job
So It causes CF Client error 18_1 ?
yeah, because this check is server-side
#10 ·
Quote Originally Posted by CaiozinhoFC1 View Post
yeah, because this check is server-side
hmmm Thanks bro
#11 ·
Example
Any example to use Remote Kill with this?
#12 ·
Quote Originally Posted by DepHax View Post
Any example to use Remote Kill with this?
conditional with the weapon
#13 ·
Quote Originally Posted by DepHax View Post
Any example to use Remote Kill with this?
Just make Hook on function with your function of RemoteKill/ Silent Aim... It's undetected
#14 ·
Posts 1–14 of 14 · Page 1 of 1

Post a Reply

Similar Threads

WarRock - International Hackstrade easy way to play with hw ban and ip ban for working b bypassmheeniacmheeniac 0 WarRock - International HacksWhat is the most easy way to make a trainer? im a n00b..metallica92metallica92 27 Generalearn money the easy wayMAmaiko 16 WolfTeam HacksEASY WAY TO EARN GOLD IN WOLFTEAMKEkemooo305 7 WarRock - International Hackseasy way to create wr test accountsC_c_norris 16

Tags for this Thread

None

Need help?