[Help] C# Game hacking

C# Game hacking

Hello MPGH Members and espeacially @master131,

i wanted to code an ESP in C# for MW3.

Is it possible to do an internal ESP for it.
And how does it work ? Is it just like offsets ?

Greetz from Germany,

Ripper1447.

If you want to do an "internal" ESP (I think you mean injectable hack) then it's best you code it in C++, not C#. It is possible in C# but it is quite advanced and is not very well documented. If you want to have a try anyway, look up EasyHook. Like I said, you might have difficulties figuring it out because not alot of people write about it. You'll have more better luck doing it in C++.

Originally Posted by master131

If you want to do an "internal" ESP (I think you mean injectable hack) then it's best you code it in C++, not C#. It is possible in C# but it is quite advanced and is not very well documented. If you want to have a try anyway, look up EasyHook. Like I said, you might have difficulties figuring it out because not alot of people write about it. You'll have more better luck doing it in C++.

Advanced and not very documenetd! Damit, those are two words i hate when i comes to coding. Im still gonna give it a go.

Originally Posted by Pingo

Advanced and not very documenetd! Damit, those are two words i hate when i comes to coding. Im still gonna give it a go.

Go ahead, just note that enabling the unsafe keyword in C# will save you ALOT of time (not to mention CPU resources).

Originally Posted by master131

If you want to do an "internal" ESP (I think you mean injectable hack) then it's best you code it in C++, not C#. It is possible in C# but it is quite advanced and is not very well documented. If you want to have a try anyway, look up EasyHook. Like I said, you might have difficulties figuring it out because not alot of people write about it. You'll have more better luck doing it in C++.

I don't have much experience with C++ so i try EasyHook.

How do i find the players ? Are they stored as offsets in the RAM or do i have to find the player models somewere in the game engine ?

Players can be found by using the array of "entity_t" and "clientinfo_t" structures in memory. If you want me to explain everything well it's going to be a pain in the ass because it's not as simple as that to explain so I'm just going to give a rough explanation. All of the following is assuming that you already know how to inject your own DLL into another process using EasyHook.

Here are the C++ versions of those 2 structs:

Code:

typedef struct
{
	char _0x0000[0x2];                               //0x0
	short Valid;                                     //0x2 (0xADF8C2)
	char _0x0004[0x10];                              //0x4
	Vector Origin;                                   //0x14 (0xADF8D4)
	Vector Angles;                                   //0x20 (0xADF8E0)
	char _0x002C[0x3C];                              //0x2C
	int Flags;                                       //0x68 (0xADF928)
	char _0x006C[0xC];                               //0x6C
	Vector OldOrigin;                                //0x78 (0xADF938)
	char _0x0084[0x18];                              //0x84
	Vector OldAngles;                                //0x9C (0xADF95C)
	char _0x00A8[0x28];                              //0xA8
	int ClientNum;                                   //0xD0 (0xADF990)
	short Type;                                      //0xD4 (0xADF994)
	char _0x00D6[0x12];                              //0xD6
	Vector NewOrigin;                                //0xE8 (0xADF9A8)
	char _0x00F4[0x1C];                              //0xF4
	Vector NewAngles;                                //0x110 (0xADF9D0)
	char _0x011C[0x7C];                              //0x11C
	byte WeaponID;                                   //0x198 (0xADFA58)
	char _0x0199[0x37];                              //0x199
	int IsAlive;                                     //0x1D0 (0xADFA90)
	char _0x01D4[0x24];                              //0x1D4
}entity_t; //[Addr: 0xADF8C0] [Size: 0x1F8]

typedef struct
{
	int Valid;                                       //0x0 (0xAD3978)
	char _0x0004[0x8];                               //0x4
	char Name[16];                                   //0xC (0xAD3984)
	int Team;                                        //0x1C (0xAD3994)
	char _0x0020[0x4];                               //0x20
	int Rank;                                        //0x24 (0xAD399C)
	char _0x0028[0x10];                              //0x28
	int Perk;                                        //0x38 (0xAD39B0)
	char _0x003C[0x8];                               //0x3C
	int Score;                                       //0x44 (0xAD39BC)
	char _0x0048[0x458];                             //0x48
	int Attacking;                                   //0x4A0 (0xAD3E18)
	char _0x04A4[0x4];                               //0x4A4
	int Zooming;                                     //0x4A8 (0xAD3E20)
	char _0x04AC[0xB8];                              //0x4AC
}clientinfo_t; //[Addr: 0xAD3978] [Size: 0x564]

You need to convert those to work in C#, either using the "safe" method (slow and tedious) using MarshalAs and StructLayout attributes or the "unsafe" method, using the unsafe keyword to create fixed arrays. Here is a small example, this is the first few bits of the entity_t structure converted for C# using the unsafe method.

Code:

struct Vector
{
    public float x, y, z;
}

unsafe struct Entity_t
{
    private fixed byte _0x0000[0x2]; //0x0
    public short Valid; //0x2 (0xADF8C2)
    private fixed byte _0x0004[0x10]; //0x4
    public Vector Origin; //0x14 (0xADF8D4)
    public Vector Angles; //0x20 (0xADF8E0)
}

Note that I used the private keyword, this is because those fixed arrays are useless and we don't want them appearing in Intellisense.

Once you've actually converted the structures properly, you can access this "array of entity_t and clientinfo_t" in memory by doing something like this:

Code:

private Entity_t* Entities = (Entity_t*)AddressForEntitiesHere;
private ClientInfo_t Clients = (ClientInfo_t)AddressForClientInfoHere

Then you can get a specific player by using Entities[index].

You can find addresses in this post (it's the address next to Entities and ClientInfo).
http://www.mpgh.net/forum/604-call-d...ml#post6485641

If you want to know the logic behind drawing a box around a player on the screen, refer to other ESP sources on Google for MW3, I'm sure there are snippets available. Also, you need to be able to hook EndScene in C#, which can be done with EasyHook and a managed DirectX wrapper for .NET such as SharpDX or SlimDX. If you look at spazzarama's Direct3D hook code, it has the code to hook DirectX 9, 10, and 11 (but we only need DirectX 9).

https://github.com/spazzarama/Direct3DHook

Wasn't as simple as it sounded right?

Thank you so much, you are the best what happens to MPGH

Originally Posted by Ripper1447

Thank you so much, you are the best what happens to MPGH

No problem, perhaps one day I'll write up a full/in-depth tutorial for those who want to take it seriously but right now I'm tied up with other things.

HelpC# Game hacking

Post a Reply

Similar Threads

Tags for this Thread