[Release] Engine LTC / Alt. LTC!

[ppl2pass]

Here is the code from the sigscan:

0x4A4750

[T0y]

https://www.mpgh.net/forum/207-combat...ml#post2979681

ALT. LTC
Address : 0x4A4750

This has been posted.

[ac1d_buRn]

For some reason, When i use that i crash O.o
I use Gordon's one

[SNal2F]

 typedef void (__cdecl *lpSetConsoleVariable)(unsigned long console,char* szVal);
lpSetConsoleVariable SetConsoleVariable;


SetConsoleVariable = (lpSetConsoleVariable)(0x0484BC0);
SetConsoleVariable(0x8003F0,"SkelModelStencil -1");

[Mr.Magicman]

There are 2... Its the engine LTC and one that i know CoderNever posted like 4 months back

[SNal2F]

There are 2... Its the engine LTC and one that i know CoderNever posted like 4 months back

Fuckin obvioulsy how would i have gotten that without knowing the jmp to the real .......


real +208

0046FA40   A1 3C001037      MOV EAX,DWORD PTR DS:[3710003C]
0046FA45   8B88 2C001037    MOV ECX,DWORD PTR DS:[EAX+3710002C]
0046FA4B   8B1424           MOV EDX,DWORD PTR SS:[ESP]
0046FA4E   05 00001037      ADD EAX,37100000
0046FA53   81C1 00001037    ADD ECX,37100000
0046FA59   3BD1             CMP EDX,ECX
0046FA5B   72 0E            JB SHORT Engine.0046FA6B
0046FA5D   8B40 50          MOV EAX,DWORD PTR DS:[EAX+50]
0046FA60   03C1             ADD EAX,ECX
0046FA62   3BD0             CMP EDX,EAX
0046FA64   73 05            JNB SHORT Engine.0046FA6B
0046FA66   E9 A5630100      JMP Engine.00485E10 //1st one
0046FA6B   C3               RETN

00485E10   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]//can see szcommand parameter moved and pushed below
00485E14   50               PUSH EAX
00485E15   68 F0038000      PUSH Engine.008003F0
00485E1A   E8 A1EDFFFF      CALL Engine.00484BC0 //sub function can do here (unsigned long, szCommand)
00485E1F   83C4 08          ADD ESP,8
00485E22   C3               RETN

O no wai another way to do ooooooo itttttt

00484BC0   8B4424 08        MOV EAX,DWORD PTR SS:[ESP+8]
00484BC4   8B4C24 04        MOV ECX,DWORD PTR SS:[ESP+4]
00484BC8   6A 00            PUSH 0
00484BCA   6A 00            PUSH 0
00484BCC   50               PUSH EAX
00484BCD   51               PUSH ECX
00484BCE   E8 2DF8FFFF      CALL Engine.00484400(unsigned long,szcommand,int,int) //can do here
00484BD3   83C4 10          ADD ESP,10
00484BD6   C3               RETN

00484AB0   8B4424 0C        MOV EAX,DWORD PTR SS:[ESP+C]
00484AB4   8B4C24 08        MOV ECX,DWORD PTR SS:[ESP+8]
00484AB8   8B5424 04        MOV EDX,DWORD PTR SS:[ESP+4]
00484ABC   6A 00            PUSH 0
00484ABE   50               PUSH EAX
00484ABF   51               PUSH ECX
00484AC0   52               PUSH EDX
00484AC1   E8 3AF9FFFF      CALL Engine.00484400
00484AC6   83C4 10          ADD ESP,10
00484AC9   C3               RETN

pfffffffff stupid shit bro. also all of thos are faster since they are all wrapped anyways ...many more ways to do it.

[whatup777]

Fuckin obvioulsy how would i have gotten that without knowing the jmp to the real .......


real +208

0046FA40   A1 3C001037      MOV EAX,DWORD PTR DS:[3710003C]
0046FA45   8B88 2C001037    MOV ECX,DWORD PTR DS:[EAX+3710002C]
0046FA4B   8B1424           MOV EDX,DWORD PTR SS:[ESP]
0046FA4E   05 00001037      ADD EAX,37100000
0046FA53   81C1 00001037    ADD ECX,37100000
0046FA59   3BD1             CMP EDX,ECX
0046FA5B   72 0E            JB SHORT Engine.0046FA6B
0046FA5D   8B40 50          MOV EAX,DWORD PTR DS:[EAX+50]
0046FA60   03C1             ADD EAX,ECX
0046FA62   3BD0             CMP EDX,EAX
0046FA64   73 05            JNB SHORT Engine.0046FA6B
0046FA66   E9 A5630100      JMP Engine.00485E10 //1st one
0046FA6B   C3               RETN

00485E10   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]//can see szcommand parameter moved and pushed below
00485E14   50               PUSH EAX
00485E15   68 F0038000      PUSH Engine.008003F0
00485E1A   E8 A1EDFFFF      CALL Engine.00484BC0 //sub function can do here (unsigned long, szCommand)
00485E1F   83C4 08          ADD ESP,8
00485E22   C3               RETN

O no wai another way to do ooooooo itttttt

00484BC0   8B4424 08        MOV EAX,DWORD PTR SS:[ESP+8]
00484BC4   8B4C24 04        MOV ECX,DWORD PTR SS:[ESP+4]
00484BC8   6A 00            PUSH 0
00484BCA   6A 00            PUSH 0
00484BCC   50               PUSH EAX
00484BCD   51               PUSH ECX
00484BCE   E8 2DF8FFFF      CALL Engine.00484400(unsigned long,szcommand,int,int) //can do here
00484BD3   83C4 10          ADD ESP,10
00484BD6   C3               RETN

00484AB0   8B4424 0C        MOV EAX,DWORD PTR SS:[ESP+C]
00484AB4   8B4C24 08        MOV ECX,DWORD PTR SS:[ESP+8]
00484AB8   8B5424 04        MOV EDX,DWORD PTR SS:[ESP+4]
00484ABC   6A 00            PUSH 0
00484ABE   50               PUSH EAX
00484ABF   51               PUSH ECX
00484AC0   52               PUSH EDX
00484AC1   E8 3AF9FFFF      CALL Engine.00484400
00484AC6   83C4 10          ADD ESP,10
00484AC9   C3               RETN

pfffffffff stupid shit bro. also all of thos are faster since they are all wrapped anyways ...many more ways to do it.

Why so pro.

[Mr.Magicman]

Why so pro.

Becouse hes +2 years more than you

We are going to be like them at some point. /

[vinay478]

 typedef void (__cdecl *lpSetConsoleVariable)(unsigned long console,char* szVal);
lpSetConsoleVariable SetConsoleVariable;


SetConsoleVariable = (lpSetConsoleVariable)(0x0484BC0);
SetConsoleVariable(0x8003F0,"SkelModelStencil -1");

W8... So you now need addies to get PTC/RCC commands to work ?? :O

[anaestheist]

W8... So you now need addies to get PTC/RCC commands to work ?? :O

Amg, this is teh end1!@!@!.... No.

[Stephen]

Amg, this is teh end1!@!@!.... No.

You don't know shit. Shut the fuck up.

[whatup777]

You don't know shit. Shut the fuck up.

Lol .

[anaestheist]

You don't know shit. Shut the fuck up.

How is it to insult people when you know they can't comeback anything because you cocksucked every admin already?

[Mr.Magicman]

How is it to insult people when you know they can't comeback anything because you cocksucked every admin already?

Gtfo Im tired of you. Nobody flames stephen with low reputation

[anaestheist]

Gtfo Im tired of you. Nobody flames stephen with low reputation

You forgot something, i don't care.