Game Offset/Address/Cheat Engine Table Mega-Thread

[Silent]

If you find anything in the game that might be helpful to someone, post it here. This thread is being made so that people can easily post resources so others can hack, if you're not posting resources your post will be deleted.

[An0m4ly_15]

RegisterFont -> 0x14084EBC0
RegisterShader -> 0x140863E30
RegisterTag -> 0x14069C180
GetTagPos -> 0x140069780
entities -> 0x157831040 (?)
entity size -> 0x6F8
clientinfo -> 0x157794878 (?)
clientinfo size -> 0x1228 (?)


entity related stuff:

   if ( *(_BYTE *)(v13 + 0x688) & 1 ) // alive
    		
    v9 = *(_WORD *)(v4 + 0x478); // clientnum

[LackingAgoodName]

Didn't test in SP or ZM. These aren't meant to be significant, but maybe it'll get the ball rolling on this thread?

Primary Ammo: 7FF6F307BD24 (4 Bytes)
Primary Reserve Ammo: 7FF6F307BBF0 (4 Bytes)

[ZeubyX]

Solo zombies
Ammo : 7FF6FB9FBD0C (4 Bytes)
Ammo : 7FF6FB9FBD3C
Ammo : 7FF6FB9FBD6C
Ammo : 7FF6FB9FBD54
include primary/secondary
Health : 7FF6FB67ECFC (change to 999 and lock it = godmode)
Jump height : 7FF6E058FA98 (FLOAT)
Unlucky offset money change everytime I restart the map, and I can't get the pointers due to anti-debugger. But im still trying.

Result:

[astrals]

7FF70C1ABD84 special grenade ( 4bytes )
7FF70BE2ECFC health for me (4bytes )

[ZeubyX]

Here updated offset for solo zombies :
Ammo: 7FF7D486BD3C 4 (Bytes)
Ammo: 7FF7D486BD0C 4 (Bytes)
Grenade : 7FF7D486BCF4 (4 Bytes)
Health : 7FF7D44EECFC (change to 999 and lock it = godmode)
Jump_Height : 7FF7B93FFA98 (FLOAT) default is 39.
money offset still change after the map restart.. need pointers

[CamxxCore]

You people need to patch your exe or everything in this thread is pretty much useless. The game will load at a dynamic base every time. Basically just open the exe in a hex editor and change the byte at 0x186 from 0x22 to 0x23. This will add the IMAGE_FILE_RELOCS_STRIPPED (0x01) flag to the characteristics of the PE header so the file loads at the same base address every-time.

[KingX735]

You people need to patch your exe or everything in this thread is pretty much useless. The game will load at a dynamic base every time. Basically just open the exe in a hex editor and change the byte at 0x186 from 0x22 to 0x23. This will add the IMAGE_FILE_RELOCS_STRIPPED (0x01) flag to the characteristics of the PE header so the file loads at the same base address every-time.

Why would you do that anyway, that's pointless. Cheats wouldn't work for people who didn't. You can get the base address of a process using any language, then you may want to calculate the correct address according to it.

As for sharing memory addresses on this thread, just put the full address (base + address) e.g: s2_mp64_ship+XXXXXXX

[iBaSHyXx]

your jump height doesnt work for me but i found everything else myself, a little confused
i also get 0 results from pointer scans on the jolts address, not sure why but probably me doing it all wrong

[xmitti]

PartyHost_GameStateChanged 0x7FF6E4949880
PartyHost_AutoStart 0x7FF6E4383E30
PartyHost_StartMatch 0x7FF6E4387450
CBUF_InsertText 0x7FF6E496B380
Cvar_SetString 0x7FF6E48989A0

[MisterY]

Zombies V1.3.2113141 offsets (reloaded version):
Health (int): 0x1BCBECFC
Special (float): 0x1C03D5F0 (1=max special)
Give weapon 1 (int): 0x1C03BA28
Give weapon 2 (int): 0x1C03BA4C
Give weapon 3 (int): 0x1C03BA58
Rapid fire (int): 0x1C03B9D8
Jump height (float): 0xBCFA98
X, Y, Z (float): 0x1C03B694, 0x1C03B694 + 0x4, 0x1C03B694 + 0x8
Norecoil (byte): 0x5494D (116=OFF, 117=ON)
Current weapon ID (int): 0x1BFBB628
Timescale (float): 0x13EF5BE4
Ammo (int): start offset = 0x1C03BCF4, add 0x18 for the next ammo offset
Zombies' health (int): start offset = 0x1BCCB17C, add 0x418 for the next zombie
Zombies X, Y, Z (float): start offset = 0x1C15EF94, add 0x5BA0 for the next zombie
Money (array of bytes): ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 06 6B 00 00 31
Round (array of bytes): ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 06 C0 00 00 54 ??
(I don't know if the patterns are 100% correct)

Remember to add the base address to every offset, if you are using cheat engine for example you have to insert "s2_mp64_ship + <offset>".

 

2 = BAR
9 = Bren
19 = FG 42
22 = Fliegerfaust
28 = Grease Gun
30 = Jack in the box
34 = Karabin
36 = Lee Enfield
39 = Lewis
45 = 1911
47 = M1941
51 = M1 Garand
53 = M30 Luftwaffe Drilling
58 = MG 15
60 = MG 42
65 = Waffe 28
67 = MP-40
74 = PPSh-41
85 = M1903
88 = STG44
90 = SVT-40
91 = Tesla Gun
98 = M1928
103 = Type 100
108 = Toggle Action
111 = Combat Shotgun

[jfrazer91]

Current Weapon Name: String [21] s2_mp64_ship.exe+0x164F3E98

Primary Grenades ID: [Byte] s2_mp64_ship.exe+0x1C03BB54 - Change this to grenade ID you want and get a Max Ammo to see changes.

Secondary Grenades ID: [Byte] s2_mp64_ship.exe+0x1C03BB60 - Change this to grenade ID you want and get a Max Ammo to see changes. Example: Change ID: 0 to 30 to have Jack in the box then collect a max ammo to see changes.

Weapon Melee ID: [Byte] s2_mp64_ship.exe+0x1C03BA40 - Currently cannot get this to work with changing to Red Talon (Sword) but working on it. P.S. To test yourself make sure to set as 2 byte or more to use any ID above 255.

 

:====NONE====
0:None

:====LETHAL====
5:S-Mine 44
10:Satchel Charge
23:MK 2 Fragmentation
30:Jack in the box
82:No 74 ST
99:Throwing Knife

:====LMGS====
8:Ronnie
9:Bren
38:Belgian Rattlesnake
39:Lewis
57:Prop Shredder
58:MG 15
59:Bone Saw
60:MG 42

:====MELEE====
83:US Shovel

:====PACK-A-PUNCH====

:====PISTOLS====
40:P-08
41:G.I.'s Souvenir
42:P-08
43:1911
44:Bacon and Eggs
45:1911
54:Machine Pistol
55:Red 9
56:Machine Pistol

:====RIFLES====
1:Fu-Bar
2:BAR
18: Device 450
19:FG 42
46:Emma-Gee
47:M1941
48:M2 Carbine
49:M1A1 Carbine
50:G.O.A.T
51:M1 Garand
87:STG770
88:STG44
89:AVT-40
90:SVT-40

:====EXPLOSIVES====
3:M1 Bazooka
70:Panzerschreck

:====SHOTGUNS====
52:Trips
53:M30 Luftwaffe Drilling
61:Sawed-Off Shotgun
62:Last Model
63:Sawed-Off Shotgun
107:Lucky
108:Toggle Action
109:Combat Shotgun
110: Diplomatic Solution
111:Combat Shotgun

:====SMGS====
27:The Greaser
28:Grease Gun
64:Flapjack
65:Waffe 28
66:Hardly Werkeing
67:MP-40
71:Babushka
72:The Classic
73: Dedushka
74:PPSh-41
97:Chicago Typewriter
98:M1928
102:Blood Type
103:Type 100

:====SNIPERS====
31:War Model
32:Kar98k
33:White Death
34:Karabin
35:Smiley
36:Lee Enfield
84:Massachusetts
85:M1903

:====TESLAS====
91:Tesla Gun
92:Bloodthirst
93:Reaper
94:Midnight
95:Hurricane

:====OTHER====
4:WEAPON_MTX2_BERETTA
6:WEAPON_MTX1_BREDA30
7:WEAPON_MTX1_BREDA30
25:WEAPON_MTX1_G43
26:WEAPON_MTX1_G43
37:WEAPON_MTX6_LEVERACTION
68:WEAPON_P38
69:WEAPON_P38
75:WEAPON_REICH
76:WEAPON_REICH
86:WEAPON_MTX1_STEN
105:ZOMBIES_VOLK_PAP
106:WEAPON_MTX3_VOLK

:====Quest Items====
124:Überschnalle
294:Red Talon
295:Brenner Head


:====ToDo====
21:Luftaust-B
22:Fliegerfaust
113:Cool Hand
115: Dude Up
117:Fly Boy
119:Old Captain
120:Pointblank
121:Menace
122:Eagle's Nest
123:Vulcan

I am currently sorting pack a punch guns into their own category. You can copy and paste this list into cheat engine as a drop down list for you weapon ids. Hence the formatting.

[jfrazer91]

I made a little CE Script for Unlimited Special for cracked version of game. Feel free to tidy it up for me as my CE skills are not 100% and there are probably better ways to do this.

Zombies V1.3.2113141 offsets (reloaded version):

 

s2_mp64_ship.exe+0x1C03D5F0 - Set to 1 for level 1 special, set to 2 for level 2 special.

 

s2_mp64_ship.exe+0x1C03D5F4 - Set to 1 to activate current special.

 

Free Fire (Infinite Ammo): s2_mp64_ship.exe+0x1C040C44 - Set it to 1 to have Infinite Ammo.

 

{ Game : s2_mp64_ship.exe
Version:
Date : 2017-12-06
Author : jfraz

This script sets Specials float value to 2.0 and sets Specials decrease address to constantly be 0 therefore stopping special from decreasing on use.
}

[ENABLE]

aobscanmodule(Special,s2_mp64_ship.exe,F3 0F 11 1F 76 1E) // should be unique
alloc(newmem,$1000,"s2_mp64_ship.exe"+2133C4)

label(code)
label(return)

newmem:
mov [rdi],(float)2.0
mov [rdi+04],00
jna s2_mp64_ship.exe+2133E8
code:
movss [rdi],xmm3
jna s2_mp64_ship.exe+2133E8
jmp return

Special:
jmp newmem
nop
return:
registersymbol(Special)

[DISABLE]

Special:
db F3 0F 11 1F 76 1E

unregistersymbol(Special)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "s2_mp64_ship.exe"+2133C4

"s2_mp64_ship.exe"+2133A1: 0F 28 D0 - movaps xmm2,xmm0
"s2_mp64_ship.exe"+2133A4: F3 0F 5F D1 - maxss xmm2,xmm1
"s2_mp64_ship.exe"+2133A8: 0F 28 C7 - movaps xmm0,xmm7
"s2_mp64_ship.exe"+2133AB: F3 41 0F 58 C0 - addss xmm0,xmm8
"s2_mp64_ship.exe"+2133B0: 0F 28 D8 - movaps xmm3,xmm0
"s2_mp64_ship.exe"+2133B3: 0F 28 C6 - movaps xmm0,xmm6
"s2_mp64_ship.exe"+2133B6: F3 0F 5F DE - maxss xmm3,xmm6
"s2_mp64_ship.exe"+2133BA: 0F 28 C2 - movaps xmm0,xmm2
"s2_mp64_ship.exe"+2133BD: F3 0F 5D DA - minss xmm3,xmm2
"s2_mp64_ship.exe"+2133C1: 0F 2F DF - comiss xmm3,xmm7
// ---------- INJECTING HERE ----------
"s2_mp64_ship.exe"+2133C4: F3 0F 11 1F - movss [rdi],xmm3
"s2_mp64_ship.exe"+2133C8: 76 1E - jna s2_mp64_ship.exe+2133E8
// ---------- DONE INJECTING ----------
"s2_mp64_ship.exe"+2133CA: 0F 2E DC - ucomiss xmm3,xmm4
"s2_mp64_ship.exe"+2133CD: 7A 0B - jp s2_mp64_ship.exe+2133DA
"s2_mp64_ship.exe"+2133CF: 75 09 - jne s2_mp64_ship.exe+2133DA
"s2_mp64_ship.exe"+2133D1: 48 8D 0D 98 17 99 00 - lea rcx,[s2_mp64_ship.exe+BA4B70]
"s2_mp64_ship.exe"+2133D8: EB 21 - jmp s2_mp64_ship.exe+2133FB
"s2_mp64_ship.exe"+2133DA: 0F 2F DC - comiss xmm3,xmm4
"s2_mp64_ship.exe"+2133DD: 76 31 - jna s2_mp64_ship.exe+213410
"s2_mp64_ship.exe"+2133DF: 48 8D 0D B2 17 99 00 - lea rcx,[s2_mp64_ship.exe+BA4B98]
"s2_mp64_ship.exe"+2133E6: EB 13 - jmp s2_mp64_ship.exe+2133FB
"s2_mp64_ship.exe"+2133E8: 0F 2F FB - comiss xmm7,xmm3
}

[i4mTh3Fr34kPr0]

MP Solo

Weapon #1 Clip #1 - 7FF7CE30532C = 8 Bytes
Weapon #1 Clip #2 - 7FF7CE3051F8 = 4 Bytes
Weapon #2 Clip #1 - 7FF7CE3052FC = 8 Bytes
Weapon #2 Clip #2 - 7FF7CE3051D0 = 4 Bytes
Grenade #1 - 7FF7CE305314 = 8 Bytes
Grenade #2 - 7FF7CE305344 = 8 Bytes

Visible Only:
Scoreboard Death - 7FF7CE30A6EE = 8 Bytes
Scoreboard Kills - 7FF7CE30A6EC = 8 Bytes
Scoreboard Score - 7FF7CE30A6E8 = 4 Bytes

[Sala296]

List of all Weapon IDs as of right now (excluding non-weapons and variations) - Except the saw gun, haven't got round to that yet.

Format:

Name
ID
Upgradable

Upgradable weapons can be attained through ID-1. For example, the M1941 Upgraded would be 49-1, so 48.

 

#Rifles
~
M1941
49
1
~
M1 Garand
53
1
~
STG44
95
1
~
M1A1 Carbine
51
1
~
FG 42
22
1
~
BAR
2
1
~
SVT-40
97
1
~
Gewehr 43
29
1
#SMGs
~
Grease Gun
31
1
~
PPSh-41
80
1
~
Type 100
111
1
~
Waffe 28
71
1
~
M1928
106
1
~
MP-40
73
1
~
Sten
93
1
~
Orso
5
1
~
M-38
60
1
#LMGs
~
Lewis
41
1
~
MG 15
62
1
~
Bren
10
1
~
MG 42
64
1
~
GPMG
8
1
~
MG 81
66
1
#Shotguns
~
Combat Shotgun
119
1
~
M30 Luftwaffe Drilling
55
1
~
Toggle Action
116
1
~
Sawed-Off Shotgun
67
1
#Snipers
~
Karabin
37
1
~
Lee Enfield
39
1
~
M1903
91
1
~
Kar98k
35
1
#Pistols
~
P-08
44
1
~
1911
47
1
~
Machine Pistol
58
1
~
9mm SAP
75
1
~
Reichsrevolver
82
1
~
Enfield No. 2
18
1
#Launchers
~
M1 Bazooka
3
0
~
Panzerschreck
76
0
~
Fliegerflaust
25
1
#Teslas
~
Tesla Gun
99
0
~
Hurricane
103
0
~
Bloodthirst
100
0
~
Midnight
102
0
~
Reaper
101
0
#Specials
~
The Classic
78
1