Combat Arms Classic Addiess 01 - 02 - 2020

[phpsel]

Combat Arms Classic Address 01 - 02 - 2020

Engine Entry Point : 0x460000
Engine .code Size : 0x2BA000
Engine .code Offset : 0x1000
 
CShell Entry Point : 0x37100000
CShell .code Size : 0x708000
CShell .code Offset : 0x1000
 
d3d9.dll Entry Point : 0x702B0000
d3d9.dll .code Size : 0x196200
d3d9.dll .code Offset : 0x1000
 
//================[ HookEngine ]================||
 
#define StartOptimized2D              0x53CD40
#define PresentEngine                 0x6638F6
#define BeginEndScene                 0x5BD820
#define DipEngine                     0x66699D
#define Start3D                       0x53C96F
#define EndScene                      0x5BBDC3
 
//================[ Engine.exe ]================||
 
#define DeviceGame                    0x83A0D0
#define LTClientEXE                   0x492D60
#define SendToServer                  0x481C20
#define WorldToScreen                 0x49EE40
#define CursorCenter                  0x7B72DC
#define DrawPrimitive                 0x7B0BA0
#define IntersectSegment              0x47F510
#define GlassWall                     0x5BC8BA
#define WireFrame                     0x5C9FC9
#define PresetEngine		      0x0
#define Endscene		      0x5BBDC3
#define DipEngine	              0x66699D
#define S2S	                      0x481C20
 
//================[ CShell.dll ]================||
 
#define UnlimitedAmmo                 0x374F2CB7
#define WeaponSet                     0x383F2E98
#define LTClientDLL                   0x3837BE08
#define PlayerByIndex                 0x371B6061
#define GCS                           0x383C2D98
#define EspName1		      0x371D45BD
#define RapidFire		      0x374F2CB7
#define PlayerManager                 0x383C2E7C
#define PlayerStatus                  0x38398224
#define CharacterFX                   0x3839874C
#define LocalPlayer                   0x371B7051
#define ClientInfoMgr                 0x57383775
#define ClientInfoMgr		      0x38377588
#define WeaponMGR                     0x383F343C
#define GetConsoleInt                 0x3745C3B0
#define LTCommon                      0x383F6AC0
#define BuildFont                     0x37691530
#define GetFontHandle                 0x37405330
#define FillFont                      0x376921E0
#define FontECX                       0x383EC720
#define LocalPTR                      0x383F4B98
#define LTCSBase                      0x3837BDF0
#define SuperBullets                  0x374F6BC6
#define SuperBullets		      0x3726100D
#define BypassChat                    0x376A2C30
#define BypassMenu                    0x376A2BC0
#define NoRecoil                      0x373E1248
#define NoReload                      0x374FBD72
#define RemoteKill1	              0x374FD073
#define RemoteKill2	              0x374FD074
#define RemoteKill3	              0x374FD473
#define RemoteKill4	              0x374FD474
 
//==============[ PushTo Console ]==============||
 
#define Consoles                      0x3835188C
#define Statitics                     0x383518B8
#define FPS                           0x38351894
#define Jump                          0x3835727C
#define PickUP                        0x3835F0E8
#define BaseMoveAccel                 0x3835715C
#define StartAccel                    0x38357180
#define MaxAccel                      0x383571A4
#define AccelInc                      0x383571C8
#define WalkVel                       0x383571EC
#define BRunVel                       0x38357234
#define FRunVel                       0x38357210
#define SRunVel                       0x38357258
#define DuckVel                       0x383572A0
#define Tracers		              0x3836BFE4
 
//============[ d3d9.dll ( win 7 ) ]============||
 
 
#define DIP2                          0x702BEE38

[supercarz1991]

I'd totally keep these up to date for people if I had a logger still. Its been so many years since I've even tried to make one work, I doubt I'll get to it

although that unlimited ammo and all that..? uh what? I didn't think that could be done by address

[phpsel]

I'd totally keep these up to date for people if I had a logger still. Its been so many years since I've even tried to make one work, I doubt I'll get to it

although that unlimited ammo and all that..? uh what? I didn't think that could be done by address

addresses are working i have logger

Note : if the character cheats, it all works but the method is different

[mrJames92]

error message?

[supercarz1991]

error message?

these are completely useless. They're a year out of date

[lithiseasy]

I don't know why they insist on using too many addresses yet.

A single CDatabasePrts address returns pointers to more than 30 interfaces, including CLTClient.

And CLTClient contains virtual functions that return pointers to other interfaces. It is much easier to maintain a vtable than a pattern for several pointers.

DIP Engine
DIP Engine should not be used for wall/chams and the correct name is vertex_buffer_controller::render not dip engine, the correct way is to hook inside cd3d_skel_mesh::render as it receives a model_instance * argument containing entity information, if you compare it with some entity (character) in the world, you can do perfect wallhack.

SendToServer
SendToServer is in the CLTClient vtable

std::uint32_t __thiscall CLTClient::SendToServer(CLTClient *this, CLTMessage_Write_Client *pMsg, std::uint32_t flags)

WeaponSet
The correct name is CharInfo, and inside it there is a pointer to CItemListMgr that contains members that inform the equipped item, such as the weapon for example.

LTClientDLL
LTClientDLL is just a pointer that points to CLTClient (inside Engine.exe)

LTCSBase
CLTClient is derived from ILTCSBase which is an abstract class, so it has no pointer and there is no pointer to ILTCSBase.

CLTClient : ILTClient : ILTCSBase : IBase

RemoteKill
RemoteKill is patched, there is a server side intersect segment.
The only way to do that is by looking at how the ID130 and ID100 work that are used in the send to server.

"PushToConsole"

struct ncon_var_track
{
	std::uint32_t m_init;
	float         m_val;
	char          m_str_val[ 0x1C ];
};
auto size{ sizeof( ncon_var_track ) };

Most of these addresses are actually a struct called ncon_var_track.
And most are one after the other, that means you can do the following:

class dummy_con_vars
{
public:
	ncon_var_track *m_player_gravity;
	ncon_var_track *m_in_air_accel_multiplier;
	ncon_var_track *m_slide_to_stop_time;
	ncon_var_track *m_max_push_y_velocity;
	ncon_var_track *m_base_move_accel;
	ncon_var_track *m_start_accel;
	ncon_var_track *m_max_accel;
	ncon_var_track *m_accel_inc;
	ncon_var_track *m_walk_vel;
	ncon_var_track *m_frun_vel;
	ncon_var_track *m_brun_vel;
	ncon_var_track *m_srun_vel;
	ncon_var_track *m_srun_vel;
	ncon_var_track *m_jump_vel;
	ncon_var_track *m_duck_vel;
	ncon_var_track *m_workaround_stuck_at_wall;
};

auto vars{ reinterpret_cast< dummy_con_vars* >( addr_player_gravity ) };
//
vars->m_player_gravity->m_val = 0.0f;

Most of these other pointers are unnecessary and some can be obtained through instances in other classes. So there is no reason to create a pattern for all these addresses, it is very tiring.