Originally Posted by Anger5K i have problem for speed client error 28_5 where problem ? Bypass Code: void CreateBackupBasicPlayer(){ DWORD CShell = (DWORD)GetModuleHandleA("CShell.dll"); if (DoOnce == true) { DWORD BPlayerMgr = *(DWORD*)(CShell + 0x14A8B20); if (BPlayerMgr != NULL) { for (int i = 0; i < 28; i++) { DWORD BPlayerLoop = (DWORD)(BPlayerMgr + i); if (BPlayerLoop) { BackupBasic[i] = new BasicPlayerSize; memcpy(BackupBasic[i], (PVOID)(BPlayerLoop), sizeof(BasicPlayerSize)); } } } if (CShell != NULL) { Detour* _detour = new Detour(CShell + 0x86E70); _detour->HookFunction(0xE9, (DWORD)fn_BasicPlayerInfo, 5); _detour->Hook(); jmp_bpi = _detour->GetReturnAddress(); } DoOnce = false; } } Speed Code: void sped(){ DWORD CShell = (DWORD)GetModuleHandleA("CShell.dll"); DWORD PlayerClient = *(DWORD*)(CShell + aCLTPlayerClient + 0x78); DWORD ad_BasicPlayerInfo = *(DWORD*)(CShell + asm_BasicPlayerInfo); if (CShell != NULL) { CreateBackupBasicPlayer(); } if (PlayerClient != NULL) { if (menu.items[31].value) { *(float*)(ad_BasicPlayerInfo + 0x8) = (float) 2.40f; } else { *(float*)(ad_BasicPlayerInfo + 0x8) = (float) 0.90f; } } } Some tools Code: class ModelInstance { char _UnkSpace[4]; D3DXVECTOR3 Body; D3DXVECTOR3 Foot; D3DXVECTOR3 Head; D3DXVECTOR3& GetPosition() const { return *(D3DXVECTOR3*)((uintptr_t)this + 0x00E8); } }; class Detour { public: Detour() { memset(this, 0, sizeof(Detour)); } Detour(DWORD OriginalFunc) { this->OriginalFunc = OriginalFunc; this->ReturnAddress = OriginalFunc; } ~Detour() { UnHook(); } void ReHook() { if (!this) return; if (!this->OriginalFunc || this->dwSize == 0) return; if (IsBadReadPtr((void*)this->OriginalFunc, this->dwSize)) return; DWORD dwOldProtect; VirtualProtect(reinterpret_cast<void*>(this->OriginalFunc), this->dwSize, PAGE_EXECUTE_READWRITE, &dwOldProtect); for (size_t i = 0; i < this->dwSize; i++) *(BYTE*)(this->OriginalFunc + i) = this->NewByte[i]; VirtualProtect(reinterpret_cast<void*>(this->OriginalFunc), this->dwSize, dwOldProtect, NULL); } void UnHook() { if (!this) return; if (!this->OriginalFunc || this->dwSize == 0) return; if (IsBadReadPtr((void*)this->OriginalFunc, this->dwSize)) return; DWORD dwOldProtect; VirtualProtect(reinterpret_cast<void*>(this->OriginalFunc), this->dwSize, PAGE_EXECUTE_READWRITE, &dwOldProtect); for (size_t i = 0; i < this->dwSize; i++) *(BYTE*)(this->OriginalFunc + i) = this->OldByte[i]; VirtualProtect(reinterpret_cast<void*>(this->OriginalFunc), this->dwSize, dwOldProtect, NULL); } void Hook() { for (size_t i = 0; i < this->dwSize; i++) this->OldByte.push_back(*(BYTE*)(this->OriginalFunc + i)); DWORD dwOldProtect; VirtualProtect(reinterpret_cast<void*>(this->OriginalFunc), this->dwSize, PAGE_EXECUTE_READWRITE, &dwOldProtect); memset(reinterpret_cast<void*>(this->OriginalFunc), 0x90, this->dwSize); DWORD relativeAddress = ((DWORD)this->NewFunc - this->OriginalFunc) - 5; if (this->FirstByte == 0xE9) *(BYTE*)this->OriginalFunc = 0xE9; else if (this->FirstByte == 0xE8) *(BYTE*)this->OriginalFunc = 0xE8; *(DWORD*)(this->OriginalFunc + 0x1) = relativeAddress; for (DWORD x = 0x5; x < this->dwSize; x++) *(BYTE*)(this->OriginalFunc + x) = 0x90; DWORD temp; VirtualProtect(reinterpret_cast<void*>(this->OriginalFunc), this->dwSize, dwOldProtect, &temp); for (size_t i = 0; i < this->dwSize; i++) NewByte.push_back(*(BYTE*)(this->OriginalFunc + i)); Sleep(100); } void HookFunction(DWORD FirstByte, DWORD NewFunc, size_t dwSize) { this->NewFunc = NewFunc; this->dwSize = dwSize; this->FirstByte = FirstByte; } DWORD GetReturnAddress() { return this->ReturnAddress + this->dwSize; } private: DWORD OriginalFunc; DWORD NewFunc; size_t dwSize; DWORD ReturnAddress; DWORD FirstByte; std::vector<BYTE> OldByte; std::vector<BYTE> NewByte; }; struct BasicPlayerSize { BYTE Databasic[168]; } *BackupBasic[28]; BasicPlayerSize *GetBasicPlayerByIndex(int index) { return BackupBasic[index]; } DWORD jmp_bpi; void __declspec(naked) fn_BasicPlayerInfo() { __asm { CALL GetBasicPlayerByIndex JMP[jmp_bpi] } } as I told u, u wouldn't need to bypass this if u searched for it in CPlayerClnt