No-Recoil and a few other things - Credits Gellin

**vingadormaster** · 02-07-2010

I am sharing with you a message that the gellin posted on another forum for developers, I hope he does not get angry.

I have no knowledge to use it.

MESSAGE:

Originally Posted by Gellin

Here's the new No-Recoil and a few other things.

Code:

RECOIL1    0x2D8A32 + Cshell.dll  ON  ****90x90          OFF xD8x66x54
RECOIL2 0x2D8A41 + Cshell.dll  ON  ****90x90          OFF xD9x46x54
RECOIL3    0x2D8A46 + Cshell.dll  ON  ****90****90****90 OFF xD9x5Ex54xD9x46x48
RECOIL4    0x2D8A52 + Cshell.dll  ON  ****90x90          OFF xD9x5Ex48

L T CLIENT ( I had to put spaces, then arrange the letters. )  0x6196C0 + Cshell.dll
DEVICE            0x8EB710 //Engine.exe

**Deadlocked007** · 02-07-2010

So what is this for? Mhs?

**vingadormaster** · 02-07-2010

I believe that to use in base, I tried to use the mhs but he refused.

should be only for c++

**why06** · 02-07-2010

He's noping the recoil functions, in the Cshell.dll

You can use it like this:

Originally Posted by MSDN (function prototype)

WriteProcessMemory(HANDLE hProcess,LPVOID lpBaseAddress,LPCVOID lpBuffer,SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten);

Code:

WriteProcessMemory(GetModuleHandleA ("engine.exe"), (would put the address here), {0x90} (nop or 144 if ur helicopter, lol), 3-5 (depends on size of istructions), NULL (dont need this >_>));

So yeh like that. Except you would either need to get the basepointer of CShell.dll....there's a couple different ways to do so. I'll just offer some suggestions fully understanding that they may not work.
1.
Use GetModuleHandleA("CShell.dll") to get handle to CShell.dll, then use GetModuleInformation() to find the base address of the module at runtime and use it in ur WPM() function.
2.
There's probably a way to do it with inline asm

Code:

_asm
MOV pointerToCShell, [CShell.dll]

This is probably wrong, but I'd love for you guys to catch me on my mistakes, helps me learn as well

3. third easier way? idk... if ur able to get the base pointer of CShell ahead of time, and its not Dynamically Allocated then sure do that. I wouldn't know if it is or isn't. Haven't done enough research. :P

**|-|3|_][({}PT3R12** · 02-07-2010

Originally Posted by why06

He's noping the recoil functions, in the Cshell.dll

You can use it like this:

Code:

WriteProcessMemory(GetModuleHandleA ("engine.exe"), (would put the address here), {0x90} (nop or 144 if ur helicopter, lol), 3-5 (depends on size of istructions), NULL (dont need this >_>));

So yeh like that. Except you would either need to get the basepointer of CShell.dll....there's a couple different ways to do so. I'll just offer some suggestions fully understanding that they may not work.
1.
Use GetModuleHandleA("CShell.dll") to get handle to CShell.dll, then use GetModuleInformation() to find the base address of the module at runtime and use it in ur WPM() function.
2.
There's probably a way to do it with inline asm

Code:

_asm
MOV pointerToCShell, [CShell.dll]

This is probably wrong, but I'd love for you guys to catch me on my mistakes, helps me learn as well

3. third easier way? idk... if ur able to get the base pointer of CShell ahead of time, and its not Dynamically Allocated then sure do that. I wouldn't know if it is or isn't. Haven't done enough research. :P

Haha i bet everyone uses 144 now

**ac1d_buRn** · 02-08-2010

Nice, But once you nop, You need a detour dont you?

**why06** · 02-08-2010

Originally Posted by ac1d_buRn

Nice, But once you nop, You need a detour dont you?

Detour what?

**ac1d_buRn** · 02-08-2010

Originally Posted by why06

Detour what?

to stop hs from detecting?
When you nop it requires a bypass doesnt it?
Well thats what i read somewhere

**why06** · 02-08-2010

Originally Posted by ac1d_buRn

to stop hs from detecting?
When you nop it requires a bypass doesnt it?
Well thats what i read somewhere

Yeh, me too, but I heard creating a bypass, needed a kernel level driver. So perhaps HS doesn't scan this memory, even though I still would think it hooks WPM()... so idk, if it is detected you can try to create a code cave by jumping before you instruction to an empty space in memory and then jump back to the end of the function essentially skipping the whole routine.

Does anyone know if there's another way to write memory besides WPM? I suppose you could ummmm... get an address to the location in memory and simply change the instruction, by assigning it a new opcodes.... the specifics Im not sure, never done it myself... will have to look at some old hack sources. ;l

**powerfear** · 02-08-2010

Originally Posted by why06

Does anyone know if there's another way to write memory besides WPM?;l

If you make a .dll you can simply make a DWORD with the adress and set it, or use memeset or use memcpy, and make a VirtualProtect with Read & Write on the adress before changing their values.

**why06** · 02-08-2010

Originally Posted by powerfear

If you make a .dll you can simply make a DWORD with the adress and set it, or use memeset or use memcpy, and make a VirtualProtect with Read & Write on the adress before changing their values.

Yeh, that was the easier way. Thanks power, hmmmm... I need to look into VirtualProtect, and never bothered with a lot of those mem___ functions, cuz C++ allocates memory for you, plus I didn't understand wdf memory really worked at the time...