Finding the No Recoil address

[eazygamez]

Hey pros,

I was wondering if you guys were able to guide me into the right direction for scanning for the No Recoil address. The reason why i'm scanning for the address and not taking it from one of the threads is not only to be self sufficient but to gain a learning experience.

I tried finding out what writes to the y value of the crosshairs but that work out and I didn't know how to scan for the players yaw and pitch to find out what writes to those.

Can one of you guys take a minute to describe to me the process?

Thank you

[RolexVI]

I think some of your answer are in this Sticky
https://www.mpgh.net/forum/207-combat...er-2012-a.html
If i'm wrong I'm sorry

[_disav0w]

find references for no recoil in cshell in olly...that will help find byte and more..
good luck..

[eazygamez]

why would there be a referenced text string of recoil?

---------- Post added at 12:33 AM ---------- Previous post was at 12:33 AM ----------

does anybody know how to find it or is it one guy copying from another?

[_disav0w]

why would there be a referenced text string of recoil?

---------- Post added at 12:33 AM ---------- Previous post was at 12:33 AM ----------

does anybody know how to find it or is it one guy copying from another?

try searching no recoil address and you find and byte too so you seperate into 2 ex; /x95/x56/xE8 <--- off byte on is nop or sometime something...

[eazygamez]

you know how many matches you'll have for that AOB scan?

there must be a way. jeez

[_disav0w]

you know how many matches you'll have for that AOB scan?

there must be a way. jeez

just search no recoil address...it leads you to the bytes ex: E5 E8 E4 E3 now convert : /xe5 /xe8 /xe4 /xe3
if we want to make pattern / mask for no recoil... you get old dump... ex: jan ca dump..
go to old no recoil address get old byte... put old byte on top of new...
ex of pattern..:
old byte: e3 e2 e5 e6 00 e4
new byte..: e5 e2 e3 e6 00 e4
mask: ?x?x?x
it search for pattern in logger than the ? say value might change ...

[eazygamez]

how would you do it with cheat engine?

[5555satan]

here you go

		if(NoRecoil)	
		{
	memcpy((LPVOID) (ADDR_NORECOIL), "\x90\x90\x90", 3);
		}else{
				memcpy((LPVOID) (ADDR_NORECOIL), "\xD8\x66\x58", 3);
		}

[Ch40zz-C0d3r]

So, to get some skill into this thread, instead of leeching theres a way.
So open cheat engine and find your ammo address, set a breakpoint on access or write and shoot one more time.
Trace back from there into a subcall, and there is recoil applied with the CPU-F floats, simply nop both lines to prevent writing the recoil, or nop the both lines to read the recoil

[R3d_L1n3]

So, to get some skill into this thread, instead of leeching theres a way.
So open cheat engine and find your ammo address, set a breakpoint on access or write and shoot one more time.
Trace back from there into a subcall, and there is recoil applied with the CPU-F floats, simply nop both lines to prevent writing the recoil, or nop the both lines to read the recoil

Oh camon he cant find norecoil ! how would he understand break point .. , There trick i know witch is using cheatengine by decreased / increased val while pick a gun

[R4v0r]

Jesus, just help the guy already, @eazygamez
Dump/unpack your CShell.dll, open in IDA, click Search->sequence of bytes
Input this as string: D9 44 24 14 D8 D1 DF E0 DD D9 F6 C4 41 75 09 ,
Click: "Search Down" radiobutton, and check "Find all occurrences", click OK and it will take you to the current NoRecoil address.

This is my method, I do this for all the addresses I use, enjoy

[Acea]

Just load a dumped cshell in ida, hit scan for sequence of bytes, and put 'D8 66 58'. Easy way of updating. But if you were to find the address and lets say you don't have a past reference you can use a bypass and attach cheat engine then put unknown initial value, put a weapon with more recoil, put increased value then scan again, then goto less recoil then do less value and repeat. You could also use classes or a debugger to get it but i'm way to lazy to type all that out. Best way to learn is trial and error

[Ch40zz-C0d3r]

Just load a dumped cshell in ida, hit scan for sequence of bytes, and put 'D8 66 58'. Easy way of updating. But if you were to find the address and lets say you don't have a past reference you can use a bypass and attach cheat engine then put unknown initial value, put a weapon with more recoil, put increased value then scan again, then goto less recoil then do less value and repeat. You could also use classes or a debugger to get it but i'm way to lazy to type all that out. Best way to learn is trial and error

You actually dont need a bypass on x64 systems and x64 version

[eazygamez]

Problem with unknown / decreased / increased is that I land with a load of addresses not to mention, no spread, weapon values (possibly) and hundreds of other addresses that don't correspond to the recoil.

I have my own memory scanner btw so I don't need cheat engine.