I'm in need of PlayerCount offset

[Dan']

If its called something else, could you name it for me? I'm doing Fleep's tuts and I think this is why my ESP is not working

I don't mind repping if you help me!

[Yemiez]

If its called something else, could you name it for me? I'm doing Fleep's tuts and I think this is why my ESP is not working

I don't mind repping if you help me!

If you're doing a for loop to read ent data just use < 64
such as:

for (int i = 0; i < 64; i++) {
     ReadEntInfo(i);
}

[Sen66]

Well, you can post your code so we can see what you do wrong

[Dan']

My main.cpp

#include <Windows.h>
#include <sstream>
#include <iostream> 
#include <math.h>  
#include "HackProcess.h"
#include <vector>
#include <algorithm>   

/*----------------AIMBOT RELATED CODE------------------*/
//Create our 'hooking' and process managing object
CHackProcess fProcess;  
using namespace std;  
//We use F6 to exit the hack
#define F6_Key 0x75
//right click
#define RIGHT_MOUSE 0x02
//Here we store the num of players and update it regularly to know how many enemies we are dealing with
//this saves us doing loops unless their necessary e.g. we have 12 players and still loop 32 times wasting our great resources
//This makes our triggerbot MUCH faster in general
int NumOfPlayers = 10;
const DWORD dw_PlayerCountOffs = 0x5CE10C;//Engine.dll

//The player base is VERY important so we know where our player info is at
//including current jump status so we can use force jumping making our bHop
const DWORD Player_Base = 0x53FB04;//0x00574560;
//The ATTACK address BELOW, WE WRITE 5 TO SHOOT OR 4 TO 
const DWORD dw_mTeamOffset = 0x98;//client
const DWORD dw_Health = 0x90;//client
//FOR the x coord we can use cl_pdump for m_vecOrigin Vector or just move around the map looking for different values
//e.g. to find y coordinate walk up ladder search up, walk down search down etc.
const DWORD dw_Pos = 0x25C;//client

//Enemy Vars including the enemy loop
const DWORD EntityPlayer_Base = 0x54D324;
//How far in memory is each enemy data
const DWORD EntityLoopDistance = 0x10;

//ViewAngles
//We find these by moving our mouse around constantly looking for changed/unchanged value,
//the alternative is to use cl_pdump 1 and search for the value assigned to m_angRotation vector
const DWORD dw_m_angRotation = 0x461A9C;
RECT m_Rect; 

//Set of initial variables you'll need
//Our desktop handle
HDC HDC_Desktop;
//Brush to paint ESP etc
HBRUSH EnemyBrush;
HFONT Font; //font we use to write text with

//ESP Variables
const DWORD dw_vMatrix = 0x4C33000;
const DWORD dw_antiFlick = 0x4C32E5C;

HWND TargetWnd;
HWND Handle;

COLORREF SnapLineCOLOR;
COLORREF TextCOLOR;

typedef struct
{
	float flMatrix[4][4];
}WorldToScreenMatrix_t;

float Get3dDistance(float * myCoords, float * enemyCoords)
{
	return sqrt(
		pow(double(enemyCoords[0] - myCoords[0]), 2.0) +
		pow(double(enemyCoords[1] - myCoords[1]), 2.0) +
		pow(double(enemyCoords[2] - myCoords[2]), 2.0));
}

void SetupDrawing(HDC hDesktop, HWND handle)
{
	HDC_Desktop = hDesktop;
	Handle = handle;
	EnemyBrush = CreateSolidBrush(RGB(255, 0, 0));
	//Color
	SnapLineCOLOR = RGB(0, 0, 255);
	TextCOLOR = RGB(0, 255, 0);
}


//We will use this struct throughout all other tutorials adding more variables every time
struct MyPlayer_t  
{ 
	DWORD CLocalPlayer; 
	int Team; 
	int Health; 
	WorldToScreenMatrix_t WorldToScreenMatrix;
	float Position[3];
	int flickerCheck;
	void ReadInformation() 
	{
		// Reading CLocalPlayer Pointer to our "CLocalPlayer" DWORD. 
		ReadProcessMemory (fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + Player_Base), &CLocalPlayer, sizeof(DWORD), 0);
		// Reading out our Team to our "Team" Varible. 
		ReadProcessMemory (fProcess.__HandleProcess, (PBYTE*)(CLocalPlayer + dw_mTeamOffset), &Team, sizeof(int), 0);
		// Reading out our Health to our "Health" Varible.     
		ReadProcessMemory (fProcess.__HandleProcess, (PBYTE*)(CLocalPlayer + dw_Health), &Health, sizeof(int), 0); 
		// Reading out our Position to our "Position" Varible. 
		ReadProcessMemory (fProcess.__HandleProcess, (PBYTE*)(CLocalPlayer + dw_Pos), &Position, sizeof(float[3]), 0); 

		//Here we find how many player entities exist in our game, through this we make sure to only loop the amount of times we need
		//when grabbing player data
		//Note that this call could be even better at a regular 15 or so seconds timer but performance shouldn't vary a great deal
		ReadProcessMemory(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordEngine + dw_PlayerCountOffs), &NumOfPlayers, sizeof(int), 0);


		//anti flicker
		ReadProcessMemory(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordEngine + dw_antiFlick), &flickerCheck, sizeof(int), 0);
		//vmatrix
		//if (flickerCheck == 0)
		//{
		ReadProcessMemory(fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordEngine + dw_vMatrix), &WorldToScreenMatrix, sizeof(WorldToScreenMatrix), 0);
		//}
	}
}MyPlayer;    


bool WorldToScreen(float * from, float * to)
{
	float w = 0.0f;

	to[0] = MyPlayer.WorldToScreenMatrix.flMatrix[0][0] * from[0] + MyPlayer.WorldToScreenMatrix.flMatrix[0][1] * from[1] + MyPlayer.WorldToScreenMatrix.flMatrix[0][2] * from[2] + MyPlayer.WorldToScreenMatrix.flMatrix[0][3];
	to[1] = MyPlayer.WorldToScreenMatrix.flMatrix[1][0] * from[0] + MyPlayer.WorldToScreenMatrix.flMatrix[1][1] * from[1] + MyPlayer.WorldToScreenMatrix.flMatrix[1][2] * from[2] + MyPlayer.WorldToScreenMatrix.flMatrix[1][3];
	w = MyPlayer.WorldToScreenMatrix.flMatrix[3][0] * from[0] + MyPlayer.WorldToScreenMatrix.flMatrix[3][1] * from[1] + MyPlayer.WorldToScreenMatrix.flMatrix[3][2] * from[2] + MyPlayer.WorldToScreenMatrix.flMatrix[3][3];

	if (w < 0.01f)
		return false;
	float invw = 1.0f / w;
	to[0] *= invw;
	to[1] *= invw;

	int width = (int)(m_Rect.right - m_Rect.left);
	int height = (int)(m_Rect.bottom - m_Rect.top);

	float x = width/2;
	float y = height/2;

	x += 0.5 * to[0] * width + 0.5;
	y -= 0.5 * to[1] * height + 0.5;

	to[0] = x + m_Rect.left;
	to[1] = y + m_Rect.top;

	return true;
}




//ENemy struct
struct PlayerList_t 
{
	DWORD CBaseEntity; 
	int Team; 
	int Health; 
	float Position[3]; 
	float AimbotAngle[3]; 
	char Name[39]; 

	void ReadInformation(int Player) 
	{
		// Reading CBaseEntity Pointer to our "CBaseEntity" DWORD + Current Player in the loop. 0x10 is the CBaseEntity List Size 
		//"client.dll"+00545204 //0x571A5204
		ReadProcessMemory (fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + EntityPlayer_Base  + (Player * EntityLoopDistance)),&CBaseEntity, sizeof(DWORD), 0);
		// Reading out our Team to our "Team" Varible. 
		ReadProcessMemory (fProcess.__HandleProcess, (PBYTE*)(CBaseEntity + dw_mTeamOffset), &Team, sizeof(int), 0);
		// Reading out our Health to our "Health" Varible.     
		ReadProcessMemory (fProcess.__HandleProcess, (PBYTE*)(CBaseEntity + dw_Health), &Health, sizeof(int), 0); 
		// Reading out our Position to our "Position" Varible. 
		ReadProcessMemory (fProcess.__HandleProcess, (PBYTE*)(CBaseEntity + dw_Pos), &Position, sizeof(float[3]), 0); 
 	}
}PlayerList[10];  


//We receive the 2-D Coordinates the colour and the device we want to use to draw those colours with
//HDC so we know where to draw and brush because we need it to draw
void DrawFilledRect(int x, int y, int w, int h)
{
	//We create our rectangle to draw on screen
	RECT rect = { x, y, x + w, y + h }; 
	//We clear that portion of the screen and display our rectangle
	FillRect(HDC_Desktop, &rect, EnemyBrush);
}


void DrawBorderBox(int x, int y, int w, int h, int thickness)
{
	//Top horiz line
	DrawFilledRect(x, y, w, thickness);
	//Left vertical line
	DrawFilledRect( x, y, thickness, h);
	//right vertical line
	DrawFilledRect((x + w), y, thickness, h);
	//bottom horiz line
	DrawFilledRect(x, y + h, w+thickness, thickness);
}


//Here is where we draw our line from point A to Point B
void DrawLine(float StartX, float StartY, float EndX, float EndY, COLORREF Pen)
{
	int a,b=0;
	HPEN hOPen;
	// penstyle, width, color
	HPEN hNPen = CreatePen(PS_SOLID, 2, Pen);
	hOPen = (HPEN)SelectObject(HDC_Desktop, hNPen);
	// starting point of line
	MoveToEx(HDC_Desktop, StartX, StartY, NULL);
	// ending point of line
	a = LineTo(HDC_Desktop, EndX, EndY);
	DeleteObject(SelectObject(HDC_Desktop, hOPen));
}

//Draw our text with this function
void DrawString(int x, int y, COLORREF color, const char* text)
{	
	SetTextAlign(HDC_Desktop,TA_CENTER|TA_NOUPDATECP);

	SetBkColor(HDC_Desktop,RGB(0,0,0));
	SetBkMode(HDC_Desktop,TRANSPARENT);

	SetTextColor(HDC_Desktop,color);

	SelectObject(HDC_Desktop,Font);

	TextOutA(HDC_Desktop,x,y,text,strlen(text));

	DeleteObject(Font);
}

void DrawESP(int x, int y, float distance)
{
	//ESP rectangle
	int width = 18100 / distance;
	int height = 36000 / distance;
	DrawBorderBox(x - (width / 2), y - height, width, height, 1);

	DrawLine((m_Rect.right - m_Rect.left) / 2, 
		m_Rect.bottom - m_Rect.top, x, y, 
		SnapLineCOLOR);


	std::stringstream ss;
	ss << (int)distance;

	char * distanceInfo = new char[ss.str().size() + 1];
	strcpy(distanceInfo, ss.str().c_str());

	DrawString(x, y, TextCOLOR, distanceInfo);

	delete[] distanceInfo;


}

void ESP()
{
	GetWindowRect(FindWindow(NULL, "Counter-Strike: Global Offensive"), &m_Rect);

	for (int i = 0; i < NumOfPlayers; i++)
	{
		PlayerList[i].ReadInformation(i);

		if (PlayerList[i].Health < 2)
			continue;

		if (PlayerList[i].Team == MyPlayer.Team)
			continue;

		float EnemyXY[3];
		if (WorldToScreen(PlayerList[i].Position, EnemyXY))
		{
			DrawESP(EnemyXY[0] - m_Rect.left, EnemyXY[1] - m_Rect.top, Get3dDistance(MyPlayer.Position, PlayerList[i].Position));
		}
	}
}



int main()
{
	//Do we have OUR CSS GAME?
	fProcess.RunProcess(); 

	ShowWindow(FindWindowA("ConsoleWindowClass", NULL), false);
	TargetWnd = FindWindow(0, "Counter-Strike: Global Offensive");
	HDC HDC_Desktop = GetDC(TargetWnd);
	SetupDrawing(HDC_Desktop, TargetWnd);
	
	//Our infinite loop will go here
	for (;;)
	{
		MyPlayer.ReadInformation();
		ESP();
	}


	return 0;
}

HackProcess.h

#pragma once

#include <Windows.h>
#include <TlHelp32.h>

//THIS FILE SIMPLY DOES MOST OF THE BACKEND WORK FOR US, 
//FROM FINDING THE PROCESS TO SETTING UP CORRECT ACCESS FOR US 
//TO EDIT MEMORY 
//IN MOST GAMES, A SIMPLER VERSION OF THIS CAN BE USED, or if you're injecting then its often not necessary
//This file has been online for quite a while so credits should be shared but im using this from NubTIK
//So Credits to him and thanks

class CHackProcess
{
public:

	PROCESSENTRY32 __gameProcess;
	HANDLE __HandleProcess;
	HWND __HWNDCss; 
	DWORD __dwordClient;
	DWORD __dwordEngine;
	DWORD __dwordOverlay;
	DWORD __dwordVGui;
	DWORD __dwordLibCef;
	DWORD __dwordSteam; 
	DWORD FindProcessName(const char *__ProcessName, PROCESSENTRY32 *pEntry)
	{	 
		PROCESSENTRY32 __ProcessEntry;
		__ProcessEntry.dwSize = sizeof(PROCESSENTRY32);
		HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
		if (hSnapshot == INVALID_HANDLE_VALUE) return 0;        if (!Process32First(hSnapshot, &__ProcessEntry))
		{
			CloseHandle(hSnapshot);
			return 0;
		}
		do{if (!_strcmpi(__ProcessEntry.szExeFile, __ProcessName))
		{
			memcpy((void *)pEntry, (void *)&__ProcessEntry, sizeof(PROCESSENTRY32));
			CloseHandle(hSnapshot);
			return __ProcessEntry.th32ProcessID;
		}} while (Process32Next(hSnapshot, &__ProcessEntry));
		CloseHandle(hSnapshot);
        return 0;
}


DWORD getThreadByProcess(DWORD __DwordProcess)
{	 
		THREADENTRY32 __ThreadEntry;
		__ThreadEntry.dwSize = sizeof(THREADENTRY32);
		HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
		if (hSnapshot == INVALID_HANDLE_VALUE) return 0;

		if (!Thread32First(hSnapshot, &__ThreadEntry)) {CloseHandle(hSnapshot); return 0; }

        do {if (__ThreadEntry.th32OwnerProcessID == __DwordProcess)
		{
			CloseHandle(hSnapshot);
			return __ThreadEntry.th32ThreadID;
		}} while (Thread32Next(hSnapshot, &__ThreadEntry)); 
		CloseHandle(hSnapshot);       
		return 0;
}

DWORD GetModuleNamePointer(LPSTR LPSTRModuleName, DWORD __DwordProcessId)
{ 
		MODULEENTRY32 lpModuleEntry = {0};
		HANDLE hSnapShot = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, __DwordProcessId);
		if(!hSnapShot)
			return NULL;  
		lpModuleEntry.dwSize = sizeof(lpModuleEntry);
		BOOL __RunModule = Module32First( hSnapShot, &lpModuleEntry );
		while(__RunModule)
		{
			if(!strcmp(lpModuleEntry.szModule, LPSTRModuleName ) )
			{CloseHandle( hSnapShot );
			return (DWORD)lpModuleEntry.modBaseAddr;
			}
			__RunModule = Module32Next( hSnapShot, &lpModuleEntry );
		}
		CloseHandle( hSnapShot );
		return NULL;
}


void runSetDebugPrivs() 
{
	HANDLE __HandleProcess=GetCurrentProcess(), __HandleToken;
	TOKEN_PRIVILEGES priv;
	LUID __LUID; 
	OpenProcessToken(__HandleProcess, TOKEN_ADJUST_PRIVILEGES, &__HandleToken);
	LookupPrivilegeValue(0, "seDebugPrivilege", &__LUID);
    priv.PrivilegeCount = 1;
	priv.Privileges[0].Luid = __LUID;
	priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    AdjustTokenPrivileges(__HandleToken, false, &priv, 0, 0, 0);
	CloseHandle(__HandleToken);
	CloseHandle(__HandleProcess);
}
	
	
	
void RunProcess()
{
	//commented lines are for non steam versions of the game
	runSetDebugPrivs();
	while (!FindProcessName("csgo.exe", &__gameProcess)) Sleep(12);
	while (!(getThreadByProcess(__gameProcess.th32ProcessID))) Sleep(12);
	__HandleProcess = OpenProcess(PROCESS_ALL_ACCESS, false, __gameProcess.th32ProcessID); 
	while(__dwordClient == 0x0) __dwordClient = GetModuleNamePointer("client.dll", __gameProcess.th32ProcessID);
	while(__dwordEngine == 0x0) __dwordEngine = GetModuleNamePointer("engine.dll", __gameProcess.th32ProcessID);
	//while(__dwordOverlay == 0x0) __dwordOverlay = GetModuleNamePointer("gameoverlayrenderer.dll", __gameProcess.th32ProcessID);
	while(__dwordVGui == 0x0) __dwordVGui = GetModuleNamePointer("vguimatsurface.dll", __gameProcess.th32ProcessID);
	//while(__dwordLibCef == 0x0) __dwordLibCef = GetModuleNamePointer("libcef.dll", __gameProcess.th32ProcessID);
//	while(__dwordSteam == 0x0) __dwordSteam = GetModuleNamePointer("steam.dll", __gameProcess.th32ProcessID); 
	__HWNDCss = FindWindow(NULL, "Counter-Strike: Global Offensive"); 
}
};

extern CHackProcess fProcess;

[Yemiez]

~Large fakn snippet~

afaik there is no NumOfPlayers in CSGO, you'll have to iterate through entities and find out which are players, just do as i Said and use 64 instead of NumOfPlayers

[onlyblame]

With what offset is it possible to read out the correct number of players?
64 is to high and u dont need to loop 64 times.

[jkfauvel]

64 is to high and u dont need to loop 64 times.

So make a playercounter. CBaseEntity will yield NULL if there's no player at the specified id. Just loop through all entities, including non-valid ones and the ones that are NULL should make player count go down. Example: playerCount = 32; and you looped through all 32 id's, you found that 12 are NULL, that means there are 20 players.
Not the best way to get player count but one of the simplest.

I'd make one change to the player list struct:

 
ReadProcessMemory (fProcess.__HandleProcess, (PBYTE*)(fProcess.__dwordClient + EntityPlayer_Base  + ((Player - 1) * EntityLoopDistance)),&CBaseEntity, sizeof(DWORD), 0);
//i'm on my phone so parenthesis might be wrong, or smt else

[onlyblame]

So make a playercounter. CBaseEntity will yield NULL if there's no player at the specified id. Just loop through all entities, including non-valid ones and the ones that are NULL should make player count go down. Example: playerCount = 32; and you looped through all 32 id's, you found that 12 are NULL, that means there are 20 players.
Not the best way to get player count but one of the simplest.

For example: There are 10 Players on the Server and we check 64 entities.
I think u only have to check from 1 until u get a 0 back or?
Im searching for a better way to check as this.
I think its better to make 1 ReadProcess Call instead of 64.

[Yemiez]

For example: There are 10 Players on the Server and we check 64 entities.
I think u only have to check from 1 until u get a 0 back or?
Im searching for a better way to check as this.
I think its better to make 1 ReadProcess Call instead of 64.

Then you can figure it out yourself, we've given you info, if this is not enough then try to figure something out yourself, you can always reverse the game a bit.

[jkfauvel]

For example: There are 10 Players on the Server and we check 64 entities.
I think u only have to check from 1 until u get a 0 back or?
Im searching for a better way to check as this.
I think its better to make 1 ReadProcess Call instead of 64.

Yes, you can do that if you check the entities in a sorted way, which is normally what we do, and is what you suggested.

Should be something like this, kinda shitty cause I'm on mobile, but its good..

int playerCount = 0;
for (int id = 1; id != 32; ++id){ //or 64 whatever
      if (GetCBaseEnt(id) == NULL){ // assuming the func returns CBaseEntity for the specified id
               playerCount = id - 1;
               break;
      }
}
//when id supplied is invalid assign playerCount and break

[onlyblame]

Yes, you can do that if you check the entities in a sorted way, which is normally what we do, and is what you suggested.

Should be something like this, kinda shitty cause I'm on mobile, but its good..

int playerCount = 0;
for (int id = 1; id != 32; ++id){ //or 64 whatever
      if (GetCBaseEnt(id) == NULL){ // assuming the func returns CBaseEntity for the specified id
               playerCount = id;// or id - 1(can't test on my phone lol)
               break;
      }
}
//when id supplied is invalid assign playerCount and break

Thanks ;-)
Its "id - 1" :-)
do u do it like that or with a other method?

[jkfauvel]

Thanks ;-)
Its "id - 1" :-)
do u do it like that or with a other method?

I do it like this when I need the player count, seems to be the simplest way. But I only need the player count for a limited amount of things, such as entity sorting.

[onlyblame]

I do it like this when I need the player count, seems to be the simplest way. But I only need the player count for a limited amount of things, such as entity sorting.

Yesterday all works fine with it to get the player in the first match, but in the second Match it counts only 1 Player :O
How is that possible? At the first Match the entitys are sorted and in the second not i think.
I only play MM, so i can write the id from the players to a array and check if there are 10 values at the array, before the loop dont stop, thats maybe better or?