Someon to Help me,how to mak UAV hack,pointer offset

[maxrio]

Well, no. In the past we set a 4 bytes address to 1111(10) which is decimal cause we didnt know that the UAV was being stored as a bit. I gradually found that later.
So in conclusion to that as you can see, this number in decimal has more than "1" in base 2(binary). One of them is the UAV.
There is also a bit in that same address that is responsible for the display of the name, HP, rank and distance of the UAV.
In zombie mode it's proven to you that only those things are displayed although the zombies aren't fully UAVed.

Also, the debugger of Cheat Engine may help you to find those responsible bits. But only if you know how to use it, and know a bit of assembly and hexadecimal numbers.

well,thanks!

Last night, in tutorial map, 3 enimies, CE scan type binary, UAV 3 enemy, scan 0011, CE crushed(I try many times,my pc 4g ram,CE report errors).

[maxrio]

I did not say anything about using Ollydbg...

Well, to dump .exe we should find the OEP ?

then using Scylla or ImportRec,input OEP address thus we can dump.

I can't find the oep due to the protector of exe,that's my big problem

[Jabberwock]

well,thanks!

Last night, in tutorial map, 3 enimies, CE scan type binary, UAV 3 enemy, scan 0011, CE crushed(I try many times,my pc 4g ram,CE report errors).

I thought it was already obvious but you should check for changed number.

[maxrio]

I thought it was already obvious but you should check for changed number.

Well I find the no recoil/kickback/crosshair offset. Is bullet speed and bullet damage in the same struct ?

And I find the XYZ axis offset and base, I try to make a OPK hack, I find many address of ememy position, their are the same offset ,but different base address, do you know the Regularity of it?

[zZzeta/S]

Playe(pawn) class holds a pointer to the next pawn

[maxrio]

Playe(pawn) class holds a pointer to the next pawn

this can be found in AVA sdk files?

[zZzeta/S]

this can be found in AVA sdk files?

You can do it manualy too.
The lowest instance you need is your playercontroler
This one points to Pawn so : PlayerController->Pawn
In the Pawn Class is a Pointer to the next pawn so you can loop through them.
You should also get a Pointer to WorldInfo: PlayerController->pawn->WorldInfo->Pawnlist

If you got all those things you can just loop through all your pawns

for playerController->Pawn->WorldInfo->PawnList//you will need to cast this into a usable var; target; target = target->NextPawn//cast this also on a usable formart eg AvAPawn)
{
    //Do your shit here
    //target equals the ava pawn class now
       UE3Vector my Pos = PlayerController->Pawn->Location;
       target->Location = (myPos.y + 10);
    
}

If you don't go external you could just hook up process event and do your shit with the sdk

[maxrio]

You can do it manualy too.
The lowest instance you need is your playercontroler
This one points to Pawn so : PlayerController->Pawn
In the Pawn Class is a Pointer to the next pawn so you can loop through them.
You should also get a Pointer to WorldInfo: PlayerController->pawn->WorldInfo->Pawnlist

If you got all those things you can just loop through all your pawns

for playerController->Pawn->WorldInfo->PawnList//you will need to cast this into a usable var; target; target = target->NextPawn//cast this also on a usable formart eg AvAPawn)
{
    //Do your shit here
    //target equals the ava pawn class now
       UE3Vector my Pos = PlayerController->Pawn->Location;
       target->Location = (myPos.y + 10);
    
}

If you don't go external you could just hook up process event and do your shit with the sdk

weill,I don't know use sdk should first hook process enent ,and then make any functions eg ((AavaPlayerController*)pPC)->TestServerEndRound(); before you just tell me.

I found this code ,Is it right?

AavaPlayerController* pPC = NULL;
UObject   *pCallObject                    = NULL;

void __declspec(naked)hkProcessEvent ()
{
    __asm mov pCallObject, ecx; //get caller from ecx register and save it in pCallObject
    __asm
    {
        push eax
        mov eax, dword ptr [esp + 0x8]
        mov pUFunc, eax
        mov eax, dword ptr [esp + 0xC]
        mov pParms, eax
        mov eax, dword ptr [esp + 0x10]
        mov pResult, eax
        pop eax        
    } // Manually get the proper parameters for the function

    _asm pushad //Save registers on stack   
    
    if ( pUFunc ) //make sure pfunc is valid
    {
        strcpy( FunctionName, pUFunc->GetFullName() ); //get function name
        if ( !strcmp( FunctionName, "Function avaGame.avaGameViewportClient.PostRender")) //If its a postrender call
        {
            UGameViewportClient* viewport = (UGameViewportClient*)pCallObject;
            if(viewport) //caller should be a Viewportclient object, make sure it is
            {
                UGameViewportClient_eventPostRender_Parms* parameters= (UGameViewportClient_eventPostRender_Parms*)pParms; //get the parameters
                if(parameters)
                {
                    PostRender(parameters->Canvas); // call a hooked postrender method
                }
            }      
        }      
        else if(!strcmp( FunctionName, "Function Engine.PlayerController.PlayerTick" ))
        {
            pPC = (AavaPlayerController*)pCallObject;         
        }
        
        else if( !strcmp( FunctionName, "Function avaGame.avaPlayerController.Destroyed")) //if the playersonctroller gets destroyed, make sure it poins to null
        {
            if(pPC == pCallObject)
            {
                pPC = NULL;
            }
        }
    }
    __asm popad //restore registers from stack
    __asm
    {
        push pResult
        push pParms
        push pUFunc
        call pProcessEvent

        retn 0xC
    } //put parameters on stack and call the orginal function

}

UObject* GetViewport() 
{
    return UObject::FindObject<UObject>("avaGameViewportClient Transient.GameEngine.avaGameViewportClient");    
}

UObject* GetPlayerController()
{   
    return UObject::FindObject<UObject>("avaPlayerControllerEx TheWorld.PersistentLevel.avaPlayerControllerEx");
}

UObject* SkipRound()
{
    return UObject::FindObject<UObject>("avaGame.avaPlayerController.TestServerEndRound");
}

void OnAttach ()
{       
    for(; ; Sleep(30))
    {
    HookEngine(GetViewport());
    HookEngine(GetPlayerController());
    HookEngine(SkipRound());
    if(GetAsyncKeyState(VK_HOME) & 0x8000)
    {
    if(pPC->IsA(AavaPlayerController::StaticClass()))
    {
    Beep(1000, 500);
    ((AavaPlayerController*)pPC)->TestServerEndRound();
    
    }
    }
    Sleep(500);
}
}
BOOL WINAPI DllMain ( HMODULE hModule, DWORD dwReason, LPVOID lpReserved )
{
    if ( dwReason == DLL_PROCESS_ATTACH )   
        CreateThread ( NULL, 0, ( LPTHREAD_START_ROUTINE ) OnAttach, NULL, 0, NULL );
        Beep(1000, 500);
    
    return TRUE;
}

[maxrio]

Well, many days later. I reply to myself.

Someon can tell me if bullet speed is in the same struct of bullets amounts？

[Janitor]

Hmm I'm really afraid that is the coders of this section are inactive .
@master131 Can you provide some help to this member if you may ?

[zZzeta/S]

you don't need bullet speed at all. Bullets are travelling on FLT_MAX.

[[MPGH]master131]

Hmm I'm really afraid that is the coders of this section are inactive .
@master131 Can you provide some help to this member if you may ?

Don't know anything about AVA's game engine.

[Jabberwock]

Don't know anything about AVA's game engine.

Thought as much.

[trueday1337]

Does C++ or java have anything to do with this?

[maxrio]

you don't need bullet speed at all. Bullets are travelling on FLT_MAX.

Well,bullet speed in the gun struct seems difficult to find,I'll try to find later.

Em,how about knife Killing range，can we kill enemy in a long distance ? in the knife struct what 's the type ,4byte,1byte ,float ? Once I change the value in the knife struct,game always crush.