Only Chams

**Birdshit** · 04-01-2011

this game is such a buggy pile of shit that I tried 4 different bases and they all come up with the same result, the game *eventually* crashes at vorbisfile.dll or the hack itself... usually on a map load...

EDIT: IT IS THE GENERATESHADER FUNCTION 100 PERCENT POSITIVE (that causes the crashing)... Im looking right now into a different one, also Ive rebuilt most of it on MagicMan's base, and remains stable for many many games

EDIT: I have fixed the crashing issue and am currently doing model recognition for each team (any suggestions for colors? I was thinking KPA visible YELLOW, obscured RED and USA visible GREEN and obscured BLUE

so whatever here it is, good luck NOT crashing constantly.

EDIT: AND ITS THE GAME FOR SOME REASON!:

this is what it looks like although Im not gonna get serious with the model recognition until I can fix this crash! I know it has to do with the pixel shaders messing up the game's ability to load textures as the pure empty MagicMan base works for hours and hours, with the only function being to write a string of text on the upper left of the screen... this JoshRose base does run longer than the magicman one with the same code added however... must be the VirtualMethodTableRepatchingLoopToCounterExtension Repatching

VirusTotal

Virscan

and for you COMPLETE noobs out there who dont even know what do do with a DLL file here is a link to many INJECTORS

https://www.mpgh.net/forum/292-combat...s-updated.html

**msr890** · 04-01-2011

its ur first release lol ... relax... look forward to trying this out though... thanks for the effort

**Birdshit** · 04-01-2011

Ive been reading and reading so many different websites to try and figure out how to do a WorldToScreen ESP for this but no luck so far its all just snippets that are sabotaged to prevent people like me from copy and pasting them

using the VTable Hook Base I found in the C++ section off the "other" site:

main.h:

Code:

#define WIN32_LEAN_AND_MEAN

#ifndef _MAIN_H
#define _MAIN_H

char *GetDirectoryFile(char *filename);
void __cdecl add_log (const char * fmt, ...);
void *DetourFunc(BYTE *src, const BYTE *dst, const int len);
bool RetourFunc(BYTE *src, BYTE *restore, const int len);

#endif

main.cpp:

Code:

//-----------------------------------------------------------------------------------------------------------------------------------
/****************************************************************
Coded by: JoshRose
Type: D3D VTable Base Hook
Credits: Strife, R4z8r, Zoomgod, Roverturbo and MSDN. Thanks all
for helping me when i got stuck.
****************************************************************/
//----------------------------------------------------------------------------------------------------------------------------------
#include <windows.h>
//----------------------------------------------------------------------------------------------------------------------------------
#include "Main.h"
//-----------------------------------------------------------------------------------------------------------------------------------
#include <mmsystem.h>
#pragma comment(lib, "winmm.lib")
//-----------------------------------------------------------------------------------------------------------------------------------
#include <stdio.h>
//-----------------------------------------------------------------------------------------------------------------------------------
#include <fstream>
//-----------------------------------------------------------------------------------------------------------------------------------
#include "detours.h"
#pragma comment(lib,"detours.lib")
//-----------------------------------------------------------------------------------------------------------------------------------
#include <d3d9.h>
#include <d3dx9.h>
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
//-----------------------------------------------------------------------------------------------------------------------------------
using namespace std;
//---------------------------------------------------------------------------------------------------------------------------------
#define HOOK(func,addy) o##func = (t##func)DetourFunction((PBYTE)addy,(PBYTE)hk##func) //Quick Hook using MS Detour
#define UNHOOK(func,addy) o##func = (t##func)DetourFunction((PBYTE)addy,(PBYTE)o##func) //Quick Unook using MS Detour
//---------------------------------------------------------------------------------------------------------------------------------
#define ES  0 //EndScene
#define DIP 1 //DrawIndexedPrimitive
#define RES 2 //Reset
#define CQ 3  //CreateQuery
#define SSS 4 //SetStreamSource
//---------------------------------------------------------------------------------------------------------------------------------
LPDIRECT3DDEVICE9 npDevice; //pDevice is stored here so we can hook through the VTable
//---------------------------------------------------------------------------------------------------------------------------------
LPD3DXFONT      g_pFont = NULL; //D3D Font
LPD3DXLINE      g_pLine = NULL; //D3D Line
D3DVIEWPORT9    g_ViewPort; //ViewPort
//---------------------------------------------------------------------------------------------------------------------------------
//LPDIRECT3DVERTEXBUFFER9 Stream_Data;
//UINT Offset = 0;
//UINT Stride = 0;
unsigned int m_Stride;
bool Chams;

IDirect3DPixelShader9 *shaderRed;
IDirect3DPixelShader9 *shaderBlue;
//---------------------------------------------------------------------------------------------------------------------------------

//---------------------------------------------------------------------------------------------------------------------------------
typedef HRESULT (WINAPI* tSetStreamSource)(LPDIRECT3DDEVICE9 pDevice,UINT StreamNumber,IDirect3DVertexBuffer9* pStreamData,UINT OffsetInBytes,UINT Stride);
tSetStreamSource oSetStreamSource;

typedef HRESULT (WINAPI* tEndScene)(LPDIRECT3DDEVICE9 pDevice);
tEndScene oEndScene = NULL;

typedef HRESULT (WINAPI* tDrawIndexedPrimitive)(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE PrimType,INT BaseVertexIndex,UINT MinVertexIndex,UINT NumVertices,UINT startIndex,UINT primCount);
tDrawIndexedPrimitive oDrawIndexedPrimitive = NULL;

typedef HRESULT(WINAPI* tReset)(LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters);
tReset oReset = NULL;

typedef HRESULT (WINAPI* tCreateQuery)(LPDIRECT3DDEVICE9 pDevice, D3DQUERYTYPE Type,IDirect3DQuery9** ppQuery);
tCreateQuery oCreateQuery;
//---------------------------------------------------------------------------------------------------------------------------------
PBYTE HookVTableFunction( PDWORD* dwVTable, PBYTE dwHook, INT Index )
{
    DWORD dwOld = 0;
    VirtualProtect((void*)((*dwVTable) + (Index*4) ), 4, PAGE_EXECUTE_READWRITE, &dwOld);

    PBYTE pOrig = ((PBYTE)(*dwVTable)[Index]);
    (*dwVTable)[Index] = (DWORD)dwHook;

    VirtualProtect((void*)((*dwVTable) + (Index*4)), 4, dwOld, &dwOld);

    return pOrig;
}
//-----------------------------------------------------------------------------------------------------------------------------------

HRESULT GenerateShader( IDirect3DDevice9 *pDevice, IDirect3DPixelShader9 **pShader, float r, float g, float b )
{
    char szShader[ 256 ];
    ID3DXBuffer *pShaderBuf = NULL;
	sprintf_s( szShader, "ps_3_0\ndef c0, %f, %f, %f, %f\nmov oC0,c0", r, g, b, 1.0f );
    if( D3DXAssembleShader( szShader, sizeof( szShader ), NULL, NULL, 0, &pShaderBuf, NULL ) == D3D_OK )
        pDevice->CreatePixelShader( ( const DWORD* )pShaderBuf->GetBufferPointer(), pShader );
    else
        return E_FAIL;

    return S_OK;
}   
//-----------------------------------------------------------------------------------------------------------------------------------
HRESULT WINAPI hkCreateQuery(LPDIRECT3DDEVICE9 pDevice, D3DQUERYTYPE Type,IDirect3DQuery9** ppQuery)
{
	if (m_Stride = 36)
	{
if( Type == D3DQUERYTYPE_OCCLUSION )
{
Type = D3DQUERYTYPE_EVENT;
}
	}
return oCreateQuery( pDevice, Type, ppQuery );
}
//-----------------------------------------------------------------------------------------------------------------------------------
HRESULT WINAPI hkSetStreamSource(LPDIRECT3DDEVICE9 pDevice,UINT StreamNumber,IDirect3DVertexBuffer9* pStreamData,UINT OffsetInBytes,UINT Stride)
{
	if(StreamNumber == 0){
		m_Stride = Stride;
	}

	return oSetStreamSource(pDevice, StreamNumber, pStreamData, OffsetInBytes, Stride);
}
//-----------------------------------------------------------------------------------------------------------------------------------
HRESULT WINAPI hkEndScene(LPDIRECT3DDEVICE9 pDevice)
{
    while(!npDevice) {
        npDevice = pDevice;                       //Here we store pDevice so we can re-hook with a VTable hook later.
    }

        if (GetAsyncKeyState(VK_INSERT)&1)
	{
		Chams = !Chams;
	}                                          
    if(g_pFont == NULL) D3DXCreateFont(pDevice, 15, 0, FW_BOLD, 1, 0, DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, ANTIALIASED_QUALITY, DEFAULT_PITCH | FF_DONTCARE, "Verdana", &g_pFont); //Create fonts
                                                  
    if(g_pLine == NULL) D3DXCreateLine(pDevice, &g_pLine); //Create lines

    pDevice->GetViewport(&g_ViewPort);
	GenerateShader(pDevice, &shaderBlue, 0.0f, 0.0f, 1.0f);
	GenerateShader(pDevice, &shaderRed, 1.0f, 0.0f, 0.0f);
    return oEndScene(pDevice);
}
//---------------------------------------------------------------------------------------------------------------------------------
HRESULT WINAPI hkDrawIndexedPrimitive(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE PrimType,INT BaseVertexIndex,UINT MinVertexIndex,UINT NumVertices,UINT startIndex,UINT primCount)
{

    //if(pDevice->GetStreamSource(0, &Stream_Data, &Offset, &Stride) == D3D_OK)
    //Stream_Data->Release();
			if (Chams) 
	{
		if ((m_Stride == 36 && ((primCount >= 1000))))//FIX THIS  
		{
			pDevice->SetRenderState((D3DRENDERSTATETYPE)0x28, FALSE);
			pDevice->SetRenderState(D3DRS_LASTPIXEL, TRUE);
			pDevice->SetRenderState(D3DRS_SPECULARENABLE, TRUE);
			pDevice->SetRenderState(D3DRS_LIGHTING, FALSE);
			pDevice->SetRenderState(D3DRS_COLORVERTEX, TRUE);
			//
			pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
			pDevice->SetPixelShader( shaderBlue ); //behind color
			oDrawIndexedPrimitive(pDevice, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
			pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_TRUE );
			pDevice->SetPixelShader( shaderRed ); //isvisible color
        //pDevice->SetRenderState(D3DRS_FILLMODE,D3DFILL_WIREFRAME);
			oDrawIndexedPrimitive(pDevice, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
        //pDevice->SetRenderState(D3DRS_FILLMODE,D3DFILL_SOLID);
		}
			}
    return oDrawIndexedPrimitive(pDevice, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);

}
//---------------------------------------------------------------------------------------------------------------------------------
HRESULT WINAPI hkReset(LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters)
{
    if( g_pFont )
        g_pFont->OnLostDevice();

    if( g_pLine )
        g_pLine->OnLostDevice();

    HRESULT iReturnValue = oReset(pDevice, pPresentationParameters);

    if(iReturnValue == D3D_OK) {

        if( g_pFont )
            g_pFont->OnResetDevice();

        if( g_pLine )
            g_pLine->OnResetDevice();
    }

    return iReturnValue;

}
//-----------------------------------------------------------------------------------------------------------------------------------
LRESULT CALLBACK MsgProc(HWND hwnd,UINT uMsg,WPARAM wParam,LPARAM lParam){return DefWindowProc(hwnd, uMsg, wParam, lParam);}
void DX_Init(DWORD* table)
{
    WNDCLASSEX wc = {sizeof(WNDCLASSEX),CS_CLASSDC,MsgProc,0L,0L,GetModuleHandle(NULL),NULL,NULL,NULL,NULL,"DX",NULL};
    RegisterClassEx(&wc);
    HWND hWnd = CreateWindow("DX",NULL,WS_OVERLAPPED,100,100,300,300,GetDesktopWindow(),NULL,wc.hInstance,NULL);
    LPDIRECT3D9 pD3D = Direct3DCreate9( D3D_SDK_VERSION );
    D3DPRESENT_PARAMETERS d3dpp;
    ZeroMemory( &d3dpp, sizeof(d3dpp) );
    d3dpp.Windowed = TRUE;
    d3dpp.SwapEffect = D3DSWAPEFFECT_DISCARD;
    d3dpp.BackBufferFormat = D3DFMT_UNKNOWN;
    LPDIRECT3DDEVICE9 pd3dDevice;
    pD3D->CreateDevice(D3DADAPTER_DEFAULT,D3DDEVTYPE_HAL,hWnd,D3DCREATE_SOFTWARE_VERTEXPROCESSING,&d3dpp,&pd3dDevice);
    DWORD* pVTable = (DWORD*)pd3dDevice;
    pVTable = (DWORD*)pVTable[0];

    table[ES]   = pVTable[42];                    //EndScene address
    table[DIP]  = pVTable[82];                    //DrawIndexedPrimitive address
    table[RES]  = pVTable[16];                    //Reset address
	table[CQ]  = pVTable[118];                   //CreateQuery address
	table[SSS]  = pVTable[100];                   //SetStreamSource address

    DestroyWindow(hWnd);
}
//------------------------------------------------------------------------------------------------------------------------------------
DWORD WINAPI VirtualMethodTableRepatchingLoopToCounterExtensionRepatching( LPVOID  Param )
{
    while(1) {
        Sleep(100);
        HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkDrawIndexedPrimitive, 82); //Hook DrawIndexedPrimitive
        HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkEndScene, 42); //Hook EndScene
        HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkReset, 16); //Hook Reset
		HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkCreateQuery, 118); //Hook CreateQuery
		HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkSetStreamSource, 100); //Hook SetStreamSource

    }

    return 1;
}

//------------------------------------------------------------------------------------------------------------------------------------
bool hooked = false;
DWORD WINAPI LoopFunction( LPVOID lpParam  )
{

    
        if( hooked == false) {
            DWORD VTable[5] = {0};

            while(GetModuleHandle("d3d9.dll")==NULL) {
                Sleep(250);
            }

            DX_Init(VTable);
            HOOK(EndScene,VTable[ES]);            //Hook EndScene as a device discovery hook

            while(!npDevice) {
                Sleep(50); //Sleep until npDevice is not equal to NULL
            }
            UNHOOK(EndScene, VTable[ES]);         //Unhook as soon as we have a valid pointer to pDevice

            *(PDWORD)&oDrawIndexedPrimitive = VTable[DIP];
            *(PDWORD)&oEndScene = VTable[ES];
            *(PDWORD)&oReset = VTable[RES];
			*(PDWORD)&oCreateQuery = VTable[CQ];
			*(PDWORD)&oSetStreamSource = VTable[SSS];

            CreateThread(NULL,0,&VirtualMethodTableRepatchingLoopToCounterExtensionRepatching,NULL,0,NULL); //Create hooking thread

            hooked = true;

            Sleep(200);

        }
    return 0;
}
//------------------------------------------------------------------------------------------------------------------------------------
BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpvReserved)
{
    if(dwReason == DLL_PROCESS_ATTACH) {
        CreateThread(0, 0, LoopFunction, 0, 0, 0);
   
    }
    else if(dwReason == DLL_PROCESS_DETACH) {
    }

    return TRUE;
}
//------------------------------------------------------------------------------------------------------------------------------------

too bad external links arent allowed... on the beyondunreal wiki it has a whole page based on Object Structs for the UE3 engine...

Code:

Structs

Array_Mirror

pointer Data 
int ArrayNum 
int ArrayMax 

BitArray_Mirror

pointer IndirectData 
int InlineData[4]  
int NumBits 
int MaxBits 

BoneAtom

Bone Atom definition

Quat Rotation 
Vector Translation 
float Scale 

Box

Modifiers: immutable

Vector Min 
Vector Max 
byte IsValid 

BoxSphereBounds

Vector Origin 
Vector BoxExtent 
float SphereRadius 

Color

Modifiers: immutable

byte B 
byte G 
byte R 
byte A 

Cylinder

float Radius 
float Height 

double

int A 
int B 

Guid

Modifiers: immutable

int A 
int B 
int C 
int D 

IndirectArray_Mirror

pointer Data 
int ArrayNum 
int ArrayMax 

InterpCurveFloat

array<InterpCurvePointFloat> Points 
EInterpMethodType InterpMethod 

InterpCurveLinearColor

array<InterpCurvePointLinearColor> Points 
EInterpMethodType InterpMethod 

InterpCurvePointFloat

float InVal 
float OutVal 
float ArriveTangent 
float LeaveTangent 
EInterpCurveMode InterpMode 

InterpCurvePointLinearColor

float InVal 
LinearColor OutVal 
LinearColor ArriveTangent 
LinearColor LeaveTangent 
EInterpCurveMode InterpMode 

InterpCurvePointQuat

float InVal 
Quat OutVal 
Quat ArriveTangent 
Quat LeaveTangent 
EInterpCurveMode InterpMode 

InterpCurvePointTwoVectors

float InVal 
TwoVectors OutVal 
TwoVectors ArriveTangent 
TwoVectors LeaveTangent 
EInterpCurveMode InterpMode 

InterpCurvePointVector

float InVal 
Vector OutVal 
Vector ArriveTangent 
Vector LeaveTangent 
EInterpCurveMode InterpMode 

InterpCurvePointVector2D

float InVal 
Vector2D OutVal 
Vector2D ArriveTangent 
Vector2D LeaveTangent 
EInterpCurveMode InterpMode 

[edit] InterpCurveQuat

array<InterpCurvePointQuat> Points 
EInterpMethodType InterpMethod 

InterpCurveTwoVectors

array<InterpCurvePointTwoVectors> Points 
EInterpMethodType InterpMethod 

InterpCurveVector

array<InterpCurvePointVector> Points 
EInterpMethodType InterpMethod 

InterpCurveVector2D

array<InterpCurvePointVector2D> Points 
EInterpMethodType InterpMethod 

IntPoint

Modifiers: immutable

Screen coordinates

int X 
int Y 

LinearColor

Modifiers: immutable

float R 
float G 
float B 
float A 

Default values:
Property 	Value
A 	1.0

Map_Mirror

Set_Mirror Pairs 

Matrix

Modifiers: immutable

Plane XPlane 
Plane YPlane 
Plane ZPlane 
Plane WPlane 

MultiMap_Mirror

Set_Mirror Pairs 

OctreeElementId

Mirror for FElementId used in generic Octree

pointer Node 
int ElementIndex 

Plane

Extends: Vector

Modifiers: immutable

float W 

pointer

int Dummy 

Quat

Modifiers: immutable

float X 
float Y 
float Z 
float W 

qword

int A 
int B 

RawDistribution

byte Type 
byte Op 
byte LookupTableNumElements 
byte LookupTableChunkSize 
array<float> LookupTable 
float LookupTableTimeScale 
float LookupTableStartTime 

RenderCommandFence

A fence used to track rendering thread command execution.

int NumPendingFences 

RenderCommandFence_Mirror

int NumPendingFences 

Rotator

Modifiers: immutable

int Pitch 
int Yaw 
int Roll 

Set_Mirror

SparseArray_Mirror Elements 
pointer Hash 
int InlineHash 
int HashSize 

SHVector

A vector of spherical harmonic coefficients.

float V[9]  
float Padding[3]  

SHVectorRGB

A vector of spherical harmonic coefficients for each color component.

SHVector R 
SHVector G 
SHVector B 

SparseArray_Mirror

array<int> Elements 
BitArray_Mirror AllocationFlags 
int FirstFreeIndex 
int NumFreeIndices 

TAlphaBlend

Structure to encompass Alpha Interpolation.

float AlphaIn 
    Internal Lerped value for Alpha
float AlphaOut 
    Resulting Alpha value, between 0.f and 1.f
float AlphaTarget 
    Target to reach
float BlendTime 
    Default blend time
float BlendTimeToGo 
    Time left to reach target
AlphaBlendType BlendType 
    Type of blending used (Linear, Cubic, etc.)

Default values:
Property 	Value
BlendTime 	0.67
BlendType 	ABT_Linear

ThreadSafeCounter

int Value 

TPOV

Point Of View type.

Vector Location 
    Location
Rotator Rotation 
    Rotation
float FOV 
    FOV angle

Default values:
Property 	Value
FOV 	90.0

TwoVectors

Modifiers: immutable

Vector v1 
Vector v2 

UntypedBulkData_Mirror

pointer VfTable 
int BulkDataFlags 
int ElementCount 
int BulkDataOffsetInFile 
int BulkDataSizeOnDisk 
int SavedBulkDataFlags 
int SavedElementCount 
int SavedBulkDataOffsetInFile 
int SavedBulkDataSizeOnDisk 
pointer BulkData 
int LockStatus 
pointer AttachedAr 
int bShouldFreeOnEmpty 

Vector

Modifiers: immutable

float X 
float Y 
float Z 

Vector2D

Modifiers: immutable

float X 
float Y 

Vector4

Modifiers: immutable

float X 
float Y 
float Z 
float W

**B4M** · 04-01-2011

Seems clean.

/approved

**Birdshit** · 04-01-2011

sometimes I think Ive ruined my ability to properly learn this by getting copy and paste results from my first hack (Medal of Honor Singleplayer Chams)... but then I realize that now I understand what and where a function is what VOIDs do and how to declare and what UINTS are and alot of things... what I really missed out on was how to properly debug and reverse... those are so essential to learning the right way how to game hack.

**Birdshit** · 04-03-2011

MODEL RECOGNITION IS SO MUCH EASIER THIS WAY!!!!!

Model |NumVerts LODS (1,2,3,4)
---------------------------------------------------
CH_AST 3211,1820,959,181
CH_LMG 3216,1554,862,180
CH_SMG 2504,1258,745,182
CH_SNI 3203,1765,1061,431

US_AST 3119,1735,897,164
US_LMG 2808,1564,960,197
US_SMG 2835,1519,790,157
US_SNI 3994,2347,1100,180

EXCEPT THAT DOESNT WORK AT ALL WTF!!!!!

**Birdshit** · 04-03-2011

uh wait for my next one Im JUST getting it finished up today....

(trying to prevent the ground pixel shaders from behing drawn ontop of the chams)

for now make sure you're running the game in directx9:

you need to use an injector that will autoinject into the game after its window is established and before the video is initialized somewhere between 2000 and 5000ms

steam library > homefront > properties > Set Launch Options> " -d3d9 " (without quotes)

**msr890** · 04-03-2011

looking forward to release.... good luck

**Daniel103aa** · 04-03-2011

Looking forward to them as well.

**Kriller** · 04-04-2011

Im looking backward for the release.

Thread: Only Chams

Thread Tools

Display

Bugged Chams

The Following 5 Users Say Thank You to Birdshit For This Useful Post:

The Following User Says Thank You to B4M For This Useful Post: