Combat Arms Classic Addiess 01 - 02 - 2020
Combat Arms Classic Addiess 01 - 02 - 2020
Combat Arms Classic Address 01 - 02 - 2020
Code:
Engine Entry Point : 0x460000 Engine .code Size : 0x2BA000 Engine .code Offset : 0x1000 CShell Entry Point : 0x37100000 CShell .code Size : 0x708000 CShell .code Offset : 0x1000 d3d9.dll Entry Point : 0x702B0000 d3d9.dll .code Size : 0x196200 d3d9.dll .code Offset : 0x1000 //================[ HookEngine ]================|| #define StartOptimized2D 0x53CD40 #define PresentEngine 0x6638F6 #define BeginEndScene 0x5BD820 #define DipEngine 0x66699D #define Start3D 0x53C96F #define EndScene 0x5BBDC3 //================[ Engine.exe ]================|| #define DeviceGame 0x83A0D0 #define LTClientEXE 0x492D60 #define SendToServer 0x481C20 #define WorldToScreen 0x49EE40 #define CursorCenter 0x7B72DC #define DrawPrimitive 0x7B0BA0 #define IntersectSegment 0x47F510 #define GlassWall 0x5BC8BA #define WireFrame 0x5C9FC9 #define PresetEngine 0x0 #define Endscene 0x5BBDC3 #define DipEngine 0x66699D #define S2S 0x481C20 //================[ CShell.dll ]================|| #define UnlimitedAmmo 0x374F2CB7 #define WeaponSet 0x383F2E98 #define LTClientDLL 0x3837BE08 #define PlayerByIndex 0x371B6061 #define GCS 0x383C2D98 #define EspName1 0x371D45BD #define RapidFire 0x374F2CB7 #define PlayerManager 0x383C2E7C #define PlayerStatus 0x38398224 #define CharacterFX 0x3839874C #define LocalPlayer 0x371B7051 #define ClientInfoMgr 0x57383775 #define ClientInfoMgr 0x38377588 #define WeaponMGR 0x383F343C #define GetConsoleInt 0x3745C3B0 #define LTCommon 0x383F6AC0 #define BuildFont 0x37691530 #define GetFontHandle 0x37405330 #define FillFont 0x376921E0 #define FontECX 0x383EC720 #define LocalPTR 0x383F4B98 #define LTCSBase 0x3837BDF0 #define SuperBullets 0x374F6BC6 #define SuperBullets 0x3726100D #define BypassChat 0x376A2C30 #define BypassMenu 0x376A2BC0 #define NoRecoil 0x373E1248 #define NoReload 0x374FBD72 #define RemoteKill1 0x374FD073 #define RemoteKill2 0x374FD074 #define RemoteKill3 0x374FD473 #define RemoteKill4 0x374FD474 //==============[ PushTo Console ]==============|| #define Consoles 0x3835188C #define Statitics 0x383518B8 #define FPS 0x38351894 #define Jump 0x3835727C #define PickUP 0x3835F0E8 #define BaseMoveAccel 0x3835715C #define StartAccel 0x38357180 #define MaxAccel 0x383571A4 #define AccelInc 0x383571C8 #define WalkVel 0x383571EC #define BRunVel 0x38357234 #define FRunVel 0x38357210 #define SRunVel 0x38357258 #define DuckVel 0x383572A0 #define Tracers 0x3836BFE4 //============[ d3d9.dll ( win 7 ) ]============|| #define DIP2 0x702BEE38
I'd totally keep these up to date for people if I had a logger still. Its been so many years since I've even tried to make one work, I doubt I'll get to it
although that unlimited ammo and all that..? uh what? I didn't think that could be done by address
although that unlimited ammo and all that..? uh what? I didn't think that could be done by address
Originally Posted by supercarz1991
I'd totally keep these up to date for people if I had a logger still. Its been so many years since I've even tried to make one work, I doubt I'll get to it
although that unlimited ammo and all that..? uh what? I didn't think that could be done by address
although that unlimited ammo and all that..? uh what? I didn't think that could be done by address
addresses are working i have logger
Note : if the character cheats, it all works but the method is different
error message?
Originally Posted by mrJames92
error message?
I don't know why they insist on using too many addresses yet.
A single CDatabasePrts address returns pointers to more than 30 interfaces, including CLTClient.
And CLTClient contains virtual functions that return pointers to other interfaces. It is much easier to maintain a vtable than a pattern for several pointers.
DIP Engine
DIP Engine should not be used for wall/chams and the correct name is vertex_buffer_controller::render not dip engine, the correct way is to hook inside cd3d_skel_mesh::render as it receives a model_instance * argument containing entity information, if you compare it with some entity (character) in the world, you can do perfect wallhack.
SendToServer
SendToServer is in the CLTClient vtable
WeaponSet
The correct name is CharInfo, and inside it there is a pointer to CItemListMgr that contains members that inform the equipped item, such as the weapon for example.
LTClientDLL
LTClientDLL is just a pointer that points to CLTClient (inside Engine.exe)
LTCSBase
CLTClient is derived from ILTCSBase which is an abstract class, so it has no pointer and there is no pointer to ILTCSBase.
RemoteKill
RemoteKill is patched, there is a server side intersect segment.
The only way to do that is by looking at how the ID130 and ID100 work that are used in the send to server.
"PushToConsole"
Most of these addresses are actually a struct called ncon_var_track.
And most are one after the other, that means you can do the following:
Most of these other pointers are unnecessary and some can be obtained through instances in other classes. So there is no reason to create a pattern for all these addresses, it is very tiring.
A single CDatabasePrts address returns pointers to more than 30 interfaces, including CLTClient.
And CLTClient contains virtual functions that return pointers to other interfaces. It is much easier to maintain a vtable than a pattern for several pointers.
DIP Engine
DIP Engine should not be used for wall/chams and the correct name is vertex_buffer_controller::render not dip engine, the correct way is to hook inside cd3d_skel_mesh::render as it receives a model_instance * argument containing entity information, if you compare it with some entity (character) in the world, you can do perfect wallhack.
SendToServer
SendToServer is in the CLTClient vtable
Code:
std::uint32_t __thiscall CLTClient::SendToServer(CLTClient *this, CLTMessage_Write_Client *pMsg, std::uint32_t flags)
The correct name is CharInfo, and inside it there is a pointer to CItemListMgr that contains members that inform the equipped item, such as the weapon for example.
LTClientDLL
LTClientDLL is just a pointer that points to CLTClient (inside Engine.exe)
LTCSBase
CLTClient is derived from ILTCSBase which is an abstract class, so it has no pointer and there is no pointer to ILTCSBase.
Code:
CLTClient : ILTClient : ILTCSBase : IBase
RemoteKill is patched, there is a server side intersect segment.
The only way to do that is by looking at how the ID130 and ID100 work that are used in the send to server.
"PushToConsole"
Code:
struct ncon_var_track
{
std::uint32_t m_init;
float m_val;
char m_str_val[ 0x1C ];
};
auto size{ sizeof( ncon_var_track ) };
And most are one after the other, that means you can do the following:
Code:
class dummy_con_vars
{
public:
ncon_var_track *m_player_gravity;
ncon_var_track *m_in_air_accel_multiplier;
ncon_var_track *m_slide_to_stop_time;
ncon_var_track *m_max_push_y_velocity;
ncon_var_track *m_base_move_accel;
ncon_var_track *m_start_accel;
ncon_var_track *m_max_accel;
ncon_var_track *m_accel_inc;
ncon_var_track *m_walk_vel;
ncon_var_track *m_frun_vel;
ncon_var_track *m_brun_vel;
ncon_var_track *m_srun_vel;
ncon_var_track *m_srun_vel;
ncon_var_track *m_jump_vel;
ncon_var_track *m_duck_vel;
ncon_var_track *m_workaround_stuck_at_wall;
};
auto vars{ reinterpret_cast< dummy_con_vars* >( addr_player_gravity ) };
//
vars->m_player_gravity->m_val = 0.0f;
