Modern Warfare 3 Source Code / Address Thread

[Lovroman]

dvar_s* FindDvar(char* dvar)
{
 DWORD findDvar = 0x610D40;
 DWORD Result = 0;
 __asm
 {
  mov edi, dvar;
  call findDvar;
  mov dword ptr ds:[Result], eax;
 }
return *(dvar_s**)&Result;
}

Usage:

FindDvar("cg_fov")->DefaultValue0 = 90.0f;

For SP.
Credits: Kenshin13

[hkKenshin]

//This structure contains the most recent info gotten from the current packet
//See Quake3 source
typedef struct
{
	int ClientNumber;
	short Type;
	int eventParam;
	char _0x00D6[0xE];
	Vector NewOrigin;
	char _0x00F4[0x1C];
	Vector NewAngles;
	char _0x011C[44];
	int TargetEntity;
	int AttackerEntity;
	char _0x0150[88];
	int eventParam2;
}entityState_t;

CG_EntityEvents .......... 0x4B6BB0

Here's the main things:

int event -> [ebp+0xB4]
char eventParam -> [ebp+0xB8]

( Do push ebp, mov ebp, esp first. Also, only use a naked hook. ( It's a __usercall ) )

Credits: /me

[MW2TopTenWORLD]

Hey, Making a MW3 Tool and Decided to share what I have till now....

TeknoMW3

//TeknoMW3 Offsets for Solo Tool (2.7.0.1 Tekno , 1.4.382 MW3)
//Offsets found by : MW2TopTenWORLD

FOV : 0x059CE10C , Type : Float , Any Value
UAV : 0x059D3D60 , Type : Boolean (Byte) , 1 = on , 0 = off
Invisible Gun : 0x059CE0C0 , Type : Boolean (Byte) , 1 = off , 0 = on
Third Person : 0x059CF244 , Type : Boolean (Byte) , 1 = on , 0 = off
Mini Map Size : 0x059C16E0 , Type : Float , Any Value (1.60 = big)
Debug Mode (L33T Mode) : 0x059DAD4C , Type : Boolean (Byte) , 1 = on , 0 = off
"Wallhack" -> Simply the walls disappear : 0x059C9FBC , Type : Float, Any value....
Hear Footsteps : 0x059CECA0 , Type : Boolean (Byte) , 1 = on (hear) , 0 = off (dont hear)
Show crosshair : 0x059C4108 , Type : Boolean (Byte) , 1 = on (show) , 0 = off (dont show)
Sleight of Hand reload time : 0x059D6A80 , Type : Float , Any value.. (0.0001 = Instant reload.. lower the better!)
Steady Aim (crosshair size) : 0x059D6A34 , Type : Float , Any Value... (0.0001 = Mini crosshair... lower the better!)
QuickDraw (Aiming time) : 0x059D7108 , Type : Float , Any Value... (1000 = Super Reload... higher the better!)
Gun X Position : 0x059D3854 , Type : Float , Any Value...
Gun Y Position : 0x059D38A0 , Type : Float , Any Value...
Gun Z Position : 0x059D38EC , Type : Float , Any Value...
Blur : 0x059CBB58 , Type : Float , Any Value...
Enemy names far scale : 0x059CF7E8 , Type : Float , Any Value... (2 is perfect!!! anything higher might be invisible)
Enemy names Size : 0x059CF6B8 , Type : Float , Any Value... (2 is perfect!!! anything higher might be invisible)
Enemy names Rank Size : 0x059CF834 , Type : Float , Any Value... (2 is perfect!!! anything higher might be invisible)

//Most of these stats you need to play a match before they stick!
XP : 0x01CDBA54 , Type : Int (4Bytes) , any value...
Prestige : 0x01CDBC64 , Type : Int (4Bytes) , any value....
Score : 0x01CDBC6C , Type : Int (4Bytes) , Any Value...
Kills : 0x01CDBC94 , Type : Int (4Bytes) , Any Value...
Tokens : 0x1CDDAC3 , Type : Int (4Bytes) , Any Value...
Wins : 0x01CDBCC8 , Type : Int (4Bytes) , Any Value...
Losses : 0x01CDBCCC , Type : Int (4Bytes) , Any Value...
Deaths : 0x01CDBC9C , Type : Int (4Bytes) , Any Value...
Current Title : 0x01CDD862 , Type : Bytes (4Bytes also work) , Any Value...
Ties : 0x01CDBCD0 , Type : Int (4Bytes) , Any Value...
WinStreak : 0x01CDBCD4 , Type : Int (4Bytes) , Any Value...
HeadShots : 0x01CDBCA8 , Type : Int (4Bytes) , Any Value...
Extra Classes : 0x01CDDACB (0x0A for 15.. basicly 1 = 6 classes because its 1 more class than the default (5) ) , Type : Array of Bytes
Assists : 0x01CDBCA4 , Type : Int (4Bytes) , Any Value...
Killstreak : 0x01CDBC98 , Type : Int (4Bytes) , Any Value...
All Perks Pro : 0x01CDC9EF (Write 07 07 07 07 07 07 07 07 07 07 07 07 07 07 07 07 ) , Type : Array of Bytes

Class Mods :

Unlimited Carepackages on Class 2 : 0x01CDC044 , Type : Array of Bytes , Value 00 06 00 00 00 00 00 00 00 01 0E 00 11 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 7A 00 00 00 6C 00 0F 00 26 00 0C 00 00 00 5F 00 6E 00 00 00 43 50 20 32 00 6D 20 43 6C 61 73 73 20 32 00 00 00 00 00 00 00 76 00 01 00 03 00 20 00 0B 00 0F 00 12 00 00 00 00 00 00 00 02 00 00 00 04
AUG Class on Class 1 : 0x01CDBFEC , Type Array of Bytes , Value 5A 00 11 00 00 00 01

[hkKenshin]

Sleight of Hand reload time : 0x059D6A80 , Type : Float , Any value.. (0.0001 = Instant reload.. lower the better!)
Steady Aim (crosshair size) : 0x059D6A34 , Type : Float , Any Value... (0.0001 = Mini crosshair... lower the better!)
QuickDraw (Aiming time) : 0x059D7108 , Type : Float , Any Value... (1000 = Super Reload... higher the better!)

Those don't even work on private versions.

Also alot of these have been released before ( Thus you didn't find them. ) or are easy as hell to find.

However the ones for perks and stuff, yea, good job on that.

[MW2TopTenWORLD]

Those don't even work on private versions.

Also alot of these have been released before ( Thus you didn't find them. ) or are easy as hell to find.

However the ones for perks and stuff, yea, good job on that.

The ones that you quoted saying that they dont work, they do work!... You need to use Sleight of Hand , Steady Aim and Quickdraw... and they work! If you want I can post a picture? (only the mini crosshair will be visible but il make a gif of the insta relad and quick draw)

[hkKenshin]

The ones that you quoted saying that they dont work, they do work!... You need to use Sleight of Hand , Steady Aim and Quickdraw... and they work! If you want I can post a picture? (only the mini crosshair will be visible but il make a gif of the insta relad and quick draw)

As I explained, they do not work in private servers. Those are server sided Dvars. They will ONLY work in private matches.

[MW2TopTenWORLD]

As I explained, they do not work in private servers. Those are server sided Dvars. They will ONLY work in private matches.

Are you sure?!... Il record a video for you... (I made a program for it....so Il record it!)....
Its as an attachment below!

And it was not a private match... it was a public server called AWOG AUT / GER No Akimbo or something like that....



Sorry it had to be a .rar because it wouldnt accept the .wmv file

[hkKenshin]

Are you sure?!... Il record a video for you... (I made a program for it....so Il record it!)....
Its as an attachment below!

And it was not a private match... it was a public server called AWOG AUT / GER No Akimbo or something like that....



Sorry it had to be a .rar because it wouldnt accept the .wmv file

If it just edits the crosshair size, that's client sided. The Steady Aim perk is used to decrease weapon spread. All it'll do is decrease the crosshair size. That's it. ( I might have mistook it for you saying it does no spread. )
And yes, I'm sure. The rest of them ( Zooming/Reload speed ) are controlled by those Dvars yes, but in iw5mp_server.exe and not iw5mp.exe Aka they're server sided. At least, last time I tried them a few months ago, that was the case.

[MW2TopTenWORLD]

I just posted a video of me using them in iw5mp.exe and everything works just fine... Crosshair size , reload speed and ADS speed... I am NOT using those on iw5mp_server.exe , I was using it on a "public" server called AWOG AUT / GET No Akimbo and My program was memory editing iw5mp.exe not iw5mp_server.exe!

[hkKenshin]

I just posted a video of me using them in iw5mp.exe and everything works just fine... Crosshair size , reload speed and ADS speed... I am NOT using those on iw5mp_server.exe , I was using it on a "public" server called AWOG AUT / GET No Akimbo and My program was memory editing iw5mp.exe not iw5mp_server.exe!

...Re-read what I just said because you're really not understanding at all.
Even if your reload speed appears faster, the server will calculate the time it takes for you to reload itself then set your ammo to full once that's up. Increasing the animation speed doesn't do anything.

And another thing. You found these values via DvarName->DvarPointer->DvarStructure + 0xC->Value right? That won't work for everyone. Dvars are registered usually sequentially yes but the dvar pointer sometimes changes even on the same version. So those offsets might only work for you. Yes, I've tested them as well and the three I pointed out doesn't work.

[MW2TopTenWORLD]

...Re-read what I just said because you're really not understanding at all.
Even if your reload speed appears faster, the server will calculate the time it takes for you to reload itself then set your ammo to full once that's up. Increasing the animation speed doesn't do anything.

And another thing. You found these values via DvarName->DvarPointer->DvarStructure + 0xC->Value right? That won't work for everyone. Dvars are registered usually sequentially yes but the dvar pointer sometimes changes even on the same version. So those offsets might only work for you. Yes, I've tested them as well and the three I pointed out doesn't work.

Oh :\ ... but ... I found them before I formatted my PC.. after I formatted I used a different game ( before format I used Steam Dedicated server with teknomw3 and after format I used reloaded with teknoMW3 and they still worked! .. so how does it change? (sorry if im being noobie)...

[hkKenshin]

Oh :\ ... but ... I found them before I formatted my PC.. after I formatted I used a different game ( before format I used Steam Dedicated server with teknomw3 and after format I used reloaded with teknoMW3 and they still worked! .. so how does it change? (sorry if im being noobie)...

It has to do with the time taken to register a dvar and the order they're registered in.

[hkKenshin]

int* IsPlaying = ( int* ) 0x8FF110;

bool IsInGame( ) { return *IsPlaying & 4096; }

//Fixes aimbot in spectator mode etc.

[hkKenshin]

Was bored again. This is how the game calculates WorldToScreen.
Offsets are for MP.

bool WorldToScreen ( float flVec[ 3 ], float* flScreen )
{
	DWORD screenMatrix = ( ( *(DWORD*)0x1337F48 == 2 ) ? 0x1338030 : 0x1337F50 );
	float * flWorld = (float*)0x96A298, *flWorld2 = (float*)0x96A2A4;
	float flVec[ 3 ], flVec2[3];
	flVec[ 0 ] = flVec[ 0 ] - flWorld[ 0 ];
	flVec[ 1 ] = flVec[ 1 ] - flWorld[ 1 ];
	flVec[ 2 ] = flVec[ 2 ] - flWorld[ 2 ];

	float dp = sqrt( ( ( flVec[ 0 ] * flVec[ 0 ] ) + ( flVec[ 1 ] * flVec[ 1 ] ) + ( flVec[ 2 ] * flVec[ 2 ] ) ) );
	if( -dp >= 0.f )
		dp = 1.f;
	float flTmp = 1.f / dp;

	flVec[ 0 ] *= flTmp;
	flVec[ 1 ] *= flTmp;
	flVec[ 2 ] *= flTmp;

	flVec[ 0 ] = ( ( flVec[ 0 ] * flWorld2[ 0 ] ) + ( flVec[ 1 ] * flWorld2[ 1 ] ) + ( flVec[ 2 ] * flWorld2[ 2 ] ) );
	flVec[ 1 ] = ( ( flVec[ 0 ] * flWorld2[ 3 ] ) + ( flVec[ 1 ] * flWorld2[ 4 ] ) + ( flVec[ 2 ] * flWorld2[ 5 ] ) );
	flVec[ 2 ] = ( ( flVec[ 0 ] * flWorld2[ 6 ] ) + ( flVec[ 1 ] * flWorld2[ 7 ] ) + ( flVec[ 2 ] * flWorld2[ 8 ] ) );

	if( flVec[ 0 ] > 0.f )
	{
		flScreen[ 0 ] = ( *(float*)(screenMatrix+0x20) * 0.5f * ( 1.f - ( flVec[ 1 ] / *(float*)0x96A290 ) / flVec[ 0 ] ) );
		flScreen[ 1 ] = ( *(float*)(screenMatrix+0x24) * 0.5f * ( 1.f - ( flVec[ 2 ] / *(float*)0x96A294 ) / flVec[ 0 ] ) );
		return true;
	}
	return false;
}

Example:

float flOut[ 2 ], flPosition[ 3 ];

cEngine->GetTagPosition( cg_entities[ i ], wBoneTables[ j_head ], &flPosition );
if( WorldToScreen( flPosition, &flOut ) )
   cEngine->DrawText( flOut[ 0 ], flOut[ 1 ], cEngine->EspFont, "[ x ]" );

[hkKenshin]

Wanna play on older servers?

memset( (PVOID)4350089, 144, 5 );
memset( (PVOID)4359131, 144, 5 );

Credits: /meh