Modern Warfare 3 Source Code / Address Thread

[wara286]

Kinda useless, but:

.text:004A6660 ; int __cdecl ErrorBox(int type, char *text, ...)

Used to show ingame message / error boxes.

Type Description
0 Crashes the game and displays text as MessageBox
1 Displays the text ingame as an error
2 Displays the text ingame as a message

[Hitokiri~]

Kinda useless, but:

.text:004A6660 ; int __cdecl ErrorBox(int type, char *text, ...)

Used to show ingame message / error boxes.

Type Description
0 Crashes the game and displays text as MessageBox
1 Displays the text ingame as an error
2 Displays the text ingame as a message

It's called Com_Error() and has the following values:

enum class ErrorMode
{
ERR_FATAL,
ERR_DROP,
ERR_SERVERDISCONNECT
}

[Hitokiri~]

Originally kept this for myself but since I'm bored and stuck in the toilet ( Blame spicy food ), I decided to do this.

MW3 Packet Checksums.

Why? Because you don't necessarily need MW3 open to forge packets.

struct Packet{
   int magic; // -1
   char data[];
   unsigned short checksum;
}

Packets undergo the following process before they're sent:

- The packet gets a 32 bit header ( All 1's )
- The 16 bit CRC is added from the below function ( byte swapped )
- The final packet is GZip compressed ( With OOB packets; Huffman is used if it's a game packet )

unsigned short NET_CalcChecksum( char* src, size_t length )
{
    unsigned long checksum = 0;
    unsigned long partA = 0, partB = 0, partC = 0;
    size_t len_a = 0;
    auto* s = src;
    
    for( auto i = 0; i < ( ( length - 4 ) >> 2 ) + 1; i ++ )
    {
        partA += ( s[ i + 1 ] & 0xff ) | ( ( s[ i ] << 8 ) & 0xff );
        partB += ( s[ i + 3 ] & 0xff ) | ( ( s[ i + 2 ] << 8 ) & 0xff );
        s += 4;
    }
    
    len_a = length - 4 * ( ( ( length - 4 ) >> 2 ) + 1 );
    
    for( auto i = len_a; i; i -= 2 )
        partC += ( src[ i + 1 ] & 0xff ) | ( ( src[ i ] << 8 ) & 0xff );
    
    checksum = partA + partB + partC + ( src[ 0 ] & 0xff );
    
    for( auto i = ( checksum >> 16 ) & 0xffff; checksum >> 16; i = checksum >> 16 )
        checksum = i + ( checksum >> 16 );
    
    return ( ~checksum ) & 0xffff;
}

The procedure is:

auto NET_SendPacket( char* src, size_t len )
{
    size_t outLen = 0;


    char* dst = ( char* ) calloc( len + 6 ), dst2 = nullptr;
    memcpy( &dst[ 4 ], src, len )


    *PINT( dst ) = -1;
    auto m_crc = NET_CalcChecksum( dst, len + 4 );
    
    dst[ len + 4 ] = m_crc >> 16;
    dst[ len + 5 ] = m_crc & 0xff;
    
    GZip_Compress( dst, dst2, len + 6, &outLen );
    
    auto result = sendto( router->sock, dst2, outLen, 0, reinterpret_cast< sockaddr* >( & netChan->remoteAddr ), sizeof( netChan->remoteAddr ) );
    free( dst );
    free( dst2 );
    
    return result == ( len + 6 );
}

[wara286]

Haven't seen this around...
Can be used to automatically generate a hacker class or something like that.
Note that your attachments are only displayed if you have the weapon level required to equip them, same thing for the camos.
Using akimbo on a RSASS sadly doesn't work either .
Also things like setting a perk2 perk into a perk1 slot won't work ingame.

typedef struct
{
	BYTE PrimaryWeapon; //0x0000
	char unk1[1];
	BYTE PrimaryAttachment1; //0x0002
	char unk2[1];
	BYTE PrimaryAttachment2; //0x0004
	char unk3[1];
	BYTE PrimaryCamo; //0x0006
	char unk4;
	BYTE Perk; //0x0008
	char unk5[3];
	BYTE SecondaryWeapon; //0x000C 
	char unk6;
	BYTE SecondaryAttachment1; //0x000E 
	char unk7;
	BYTE SecondaryAttachment2; //0x0010 
	char unk8;
	BYTE SecondaryCamo; //0x0012 
	char unk9;
	BYTE SecondaryPerk; //0x0014 
	char unk10[3];
	BYTE Grenate; //0x0018 
	char unk11;
	BYTE Perk1; //0x001A 
	char unk12;
	BYTE Perk2; //0x001C 
	char unk13;
	BYTE Perk3; //0x001E 
	char unk14;
	BYTE KillstreakType; //0x0022 
	char unk15;
	BYTE TacticalEquip; //0x0024 
	char unk16;
	char ClassName[15]; //0x0028 
	char unk17[6];
	BYTE DeathStreak; //0x003D 
	char unk18;
	BYTE AssaultStreak1; //0x003F 
	char unk22;
	BYTE AssaultStreak2; //0x0041 
	char unk23;
	BYTE AssaultStreak3; //0x0043 
	char unk24;
	BYTE SupportStreak1; //0x0045 
	char unk25;
	BYTE SupportStreak2; //0x0047 
	char unk26;
	BYTE SupportStreak3; //0x0049 
	char unk27;
	BYTE SpecStreak1; //0x004B 
	char unk19;
	BYTE SpecStreak2; //0x004D 
	char unk20;
	BYTE SpecStreak3; //0x004F 
	char unk21;

} customClass_t; //Size=0x0062

 

#define CAMO_GOLD 13
#define CAMO_FALL 12
#define CAMO_RED 11
#define CAMO_BLUE 10
#define CAMO_WINTER 9
#define CAMO_SNAKE 8
#define CAMO_MARINE 7
#define CAMO_CHOCO 6
#define CAMO_HEX 5
#define CAMO_DIGITAL 4
#define CAMO_MULTICAM 3
#define CAMO_SNOW 2
#define CAMO_CLASSIC 1

 

#define ATTACHMENT_NONE 0
#define ATTACHMENT_RED_DOT 1
#define ATTACHMENT_ACOG 2
#define ATTACHMENT_GRIP 3
#define ATTACHMENT_AKIMBO 4
#define ATTACHMENT_THERMAL 5
#define ATTACHMENT_SHOTGUN 6
#define ATTACHMENT_HARTBEAT 7
#define ATTACHMENT_FMJ 8
#define ATTACHMENT_AMMO 9
#define ATTACHMENT_RAPID_FIRE 10
#define ATTACHMENT_EOTECH 11
#define ATTACHMENT_TACTICAL_KNIFE 12
#define ATTACHMENT_ZOOM 13
#define ATTACHMENT_TUBE 14
#define ATTACHMENT_SILENCER 17
#define ATTACHMENT_HYBRID 20

 

#define KILLSTREAK_TYPE_ASSAULT 94
#define KILLSTREAK_TYPE_SUPPORT 95
#define KILLSTREAK_TYPE_SPECIALIST 97

 

#define PERK_SCAVENGER 43
#define PERK_SLEIGHT_OF_HAND 15
#define PERK_OVERKILL 17
#define PERK_DEAD_SILENCE 8
#define PERK_BLIND_EYE 36
#define PERK_EXTREME_CONDITIONING 33
#define PERK_BLAST_SHIELD 25
#define PERK_ASSASIN 39

 

#define WEAPON_RSASS 41
#define WEAPON_MK14 12
#define WEAPON_MG36 38
#define WEAPON_AUG 90

For those who are curious: You can get the AUG by setting the WeaponID to 90 and the camo to 8 (snake camo).

[Hitokiri~]

Haven't seen this around...
Can be used to automatically generate a hacker class or something like that.
Note that your attachments are only displayed if you have the weapon level required to equip them, same thing for the camos.
Using akimbo on a RSASS sadly doesn't work either .
Also things like setting a perk2 perk into a perk1 slot won't work ingame.

typedef struct
{
    BYTE PrimaryWeapon; //0x0000
    char unk1[1];
    BYTE PrimaryAttachment1; //0x0002
    char unk2[1];
    BYTE PrimaryAttachment2; //0x0004
    char unk3[1];
    BYTE PrimaryCamo; //0x0006
    char unk4;
    BYTE Perk; //0x0008
    char unk5[3];
    BYTE SecondaryWeapon; //0x000C 
    char unk6;
    BYTE SecondaryAttachment1; //0x000E 
    char unk7;
    BYTE SecondaryAttachment2; //0x0010 
    char unk8;
    BYTE SecondaryCamo; //0x0012 
    char unk9;
    BYTE SecondaryPerk; //0x0014 
    char unk10[3];
    BYTE Grenate; //0x0018 
    char unk11;
    BYTE Perk1; //0x001A 
    char unk12;
    BYTE Perk2; //0x001C 
    char unk13;
    BYTE Perk3; //0x001E 
    char unk14;
    BYTE KillstreakType; //0x0022 
    char unk15;
    BYTE TacticalEquip; //0x0024 
    char unk16;
    char ClassName[15]; //0x0028 
    char unk17[6];
    BYTE DeathStreak; //0x003D 
    char unk18;
    BYTE AssaultStreak1; //0x003F 
    char unk22;
    BYTE AssaultStreak2; //0x0041 
    char unk23;
    BYTE AssaultStreak3; //0x0043 
    char unk24;
    BYTE SupportStreak1; //0x0045 
    char unk25;
    BYTE SupportStreak2; //0x0047 
    char unk26;
    BYTE SupportStreak3; //0x0049 
    char unk27;
    BYTE SpecStreak1; //0x004B 
    char unk19;
    BYTE SpecStreak2; //0x004D 
    char unk20;
    BYTE SpecStreak3; //0x004F 
    char unk21;

} customClass_t; //Size=0x0062

 

#define CAMO_GOLD 13
#define CAMO_FALL 12
#define CAMO_RED 11
#define CAMO_BLUE 10
#define CAMO_WINTER 9
#define CAMO_SNAKE 8
#define CAMO_MARINE 7
#define CAMO_CHOCO 6
#define CAMO_HEX 5
#define CAMO_DIGITAL 4
#define CAMO_MULTICAM 3
#define CAMO_SNOW 2
#define CAMO_CLASSIC 1

 

#define ATTACHMENT_NONE 0
#define ATTACHMENT_RED_DOT 1
#define ATTACHMENT_ACOG 2
#define ATTACHMENT_GRIP 3
#define ATTACHMENT_AKIMBO 4
#define ATTACHMENT_THERMAL 5
#define ATTACHMENT_SHOTGUN 6
#define ATTACHMENT_HARTBEAT 7
#define ATTACHMENT_FMJ 8
#define ATTACHMENT_AMMO 9
#define ATTACHMENT_RAPID_FIRE 10
#define ATTACHMENT_EOTECH 11
#define ATTACHMENT_TACTICAL_KNIFE 12
#define ATTACHMENT_ZOOM 13
#define ATTACHMENT_TUBE 14
#define ATTACHMENT_SILENCER 17
#define ATTACHMENT_HYBRID 20

 

#define KILLSTREAK_TYPE_ASSAULT 94
#define KILLSTREAK_TYPE_SUPPORT 95
#define KILLSTREAK_TYPE_SPECIALIST 97

 

#define PERK_SCAVENGER 43
#define PERK_SLEIGHT_OF_HAND 15
#define PERK_OVERKILL 17
#define PERK_DEAD_SILENCE 8
#define PERK_BLIND_EYE 36
#define PERK_EXTREME_CONDITIONING 33
#define PERK_BLAST_SHIELD 25
#define PERK_ASSASIN 39

 

#define WEAPON_RSASS 41
#define WEAPON_MK14 12
#define WEAPON_MG36 38
#define WEAPON_AUG 90

For those who are curious: You can get the AUG by setting the WeaponID to 90 and the camo to 8 (snake camo).

Custom classes are a part of mpdata btw.
Also, weapon IDs are shorts.

Still good post.

[Iscurb123]

thats codes work for all modes ? campinagin ? special ops ? and multiplayer ?
second question how i use the codes ? what i need to do in the cheat engine and what the aim assist doing ?
thanks waiting for awnser sorry for my bad english

[Iscurb123]

someone can explain me ?

[Iscurb123]

how i use double weapon xp ?
what i need to do in cheat engine pls help me i am dont know !!

[niko1921]

how i use double weapon xp ?
what i need to do in cheat engine pls help me i am dont know !!

if you don't know some programming languaje, don't bother visiting this section.

[jdoe991]

I managed to get these for TeknoMW3 v3:

Prestige: 01CDBC64
XP: 01CDBA54
Score: 01CDBC6C

[EricModer13]

I found those DVAR addresses using IDA Pro for latest TeknoMW3:

r_fog: 5F96C8C
fullbright: 5F9690C (there's no fullbright dvar, although I found this address)
r_forceLod: 5F96C48
r_detailMap: 5F969C4
r_normalMap: 5F96C4C
r_specularMap: 5F96B18
r_smc_enable: 5F96BB8
r_normal: 5F96BBC
r_specular: 5F969BC
r_detail: 5F96B34
fx_enable: 18A06A4
fx_draw: 18A0720
com_maxfps: 1CE77A4
perk_weapRateMultiplier: 8DD9A0
perk_weapSpreadMultiplier: 8DD948
perk_weapReloadMultiplier: 8DD990
fx_drawclouds: 18A0704
r_dof_enable: 5F96B80 
r_dof_tweak: 5F96BF8
r_drawdecals: 5F96C18
r_filmusetweaks: 5F96A08
cg_blood: B0477C
cg_fov: B0A7A8
cg_drawCrosshair: 8FAA9C
cg_drawFPS: 8FAA74
cg_thirdPersonRange: B04660
cg_thirdPerson: 8FAA7C
cg_thirdPersonMode: 8FAAF0
cg_drawGun: 8FAB60
cg_cursorHints: B0A7DC

[karsly]

Does it still working? I'll try