New pSilent Hints
Hey guys i'm back and im kinda disappointed because I have yet to see a public cheat with the new psilent since it shouldn't be that hard to figure out, but since I will not Feed the C+P, I am only going to tell you some tips and point you in the right direction :).
First off, The new pSilent is not normal pSilent like before, Everyone in your game can see your snaps this is due to the old public method being patched. Also Should debunk the myth that "Fake" angles for anti-aims still work, no just no the hitbox update broke all fake angles.
Lets get started, First what you'll have to do is get the ClientState which is engine.dll + 0x5CE1C4. You can get engine.dll internally Like this
ok so now that we have those we do need to get INetChannel,
Net channel being (0x94).
Now this part has all been pointless because if you looked through anywhere at all this should be easy but anyway you get access to these
rwby was just asking about a couple things from this class.
Now to the pSilent part by having this you can now access CGOTVRecorder which is in CNetChannel.
Your turn to go and reverse the class and find out what you can use. Big Hint #1 CGOTVRecorder is going to be used to exploit demo's
heres big hint #2
Now i've only just got this working myself and ive lost 2 accounts to UT doing this wrong... But I did not tell you how you should be doing the pSil Ive only given a bit more than is publicly known.
GL HF may the anti C+P be with you, this psilent patch is being used in most privates.
First off, The new pSilent is not normal pSilent like before, Everyone in your game can see your snaps this is due to the old public method being patched. Also Should debunk the myth that "Fake" angles for anti-aims still work, no just no the hitbox update broke all fake angles.
Lets get started, First what you'll have to do is get the ClientState which is engine.dll + 0x5CE1C4. You can get engine.dll internally Like this
Code:
(DWORD)GetModuleHandle(/*engine.dll*/XorStr<0x07, 11, 0x2B15D8E1>("\x62\x66\x6E\x63\x65\x69\x23\x6A\x63\x7C" + 0x2B15D8E1).s);
Code:
CClientState + m_nNetChannel
Now this part has all been pointless because if you looked through anywhere at all this should be easy but anyway you get access to these
Code:
// Generated using ReClass
class N00000000;
class CClientState;
class INetChannel;
class FLOAT;
class N00000285;
class N000010AD;
class N000010C0;
class Entity;
class INetChannelHandler;
class N00001187;
class Netmsgbinder;
class CUtlVector;
class T;
class bf_write;
class CUtlMemory;
class netadr_t;
class N00002ABB;
class N00002ABE;
class N00002AC3;
class N00000000 // This is engine.dll + 0x5CE1C4
{
public:
CClientState* pClientState;
char pad_0x0004[0x3C];
};//Size=0x0040
class CClientState
{
public:
char pad_0x0000[0x8]; //0x0000
N00000285* ClientStateVtable; //0x0008
char pad_0x000C[0x4]; //0x000C
Netmsgbinder* PROCESS_NET_MESSAGE(Tick); //0x0010
Netmsgbinder* PROCESS_NET_MESSAGE(StringCmd); //0x0014
Netmsgbinder* PROCESS_NET_MESSAGE(SignonState); //0x0018
Netmsgbinder* PROCESS_NET_MESSAGE(SetConVar); //0x001C
Netmsgbinder* N0000001B; //0x0020
Netmsgbinder* N0000001C; //0x0024
Netmsgbinder* N0000001D; //0x0028
Netmsgbinder* N0000001E; //0x002C
Netmsgbinder* N0000001F; //0x0030
Netmsgbinder* N00000020; //0x0034
Netmsgbinder* N00000021; //0x0038
Netmsgbinder* N00000022; //0x003C
Netmsgbinder* N00000023; //0x0040
Netmsgbinder* N00000024; //0x0044
Netmsgbinder* N00000025; //0x0048
Netmsgbinder* N00000026; //0x004C
Netmsgbinder* N00000027; //0x0050
Netmsgbinder* N00000028; //0x0054
Netmsgbinder* N00000029; //0x0058
Netmsgbinder* N0000002A; //0x005C
Netmsgbinder* N0000002B; //0x0060
Netmsgbinder* N0000002C; //0x0064
Netmsgbinder* N0000002D; //0x0068
Netmsgbinder* N0000002E; //0x006C
Netmsgbinder* N0000002F; //0x0070
Netmsgbinder* N00000030; //0x0074
Netmsgbinder* N0000039C; //0x0078
Netmsgbinder* N00000032; //0x007C
Netmsgbinder* N00000033; //0x0080
Netmsgbinder* N00000034; //0x0084
Netmsgbinder* N00000035; //0x0088
Netmsgbinder* N00000036; //0x008C
__int32 m_Socket; //0x0090
INetChannel* m_NetChannel; //0x0094 <-- This was what I was after!
__int32 m_nChallengeNr; //0x0098
char pad_0x009C[0x4C]; //0x009C
__int32 m_nSignonState; //0x00E8
char pad_0x00EC[0x8]; //0x00EC
float m_flNextCmdTime; //0x00F4
__int32 m_nServerCount; //0x00F8
__int32 m_nCurrentSequence; //0x00FC
char pad_0x0100[0x8]; //0x0100
FLOAT m_ClockOffsets[16]; //0x0108
__int32 m_iCurClockOffset; //0x0148
__int32 m_nServerTick; //0x014C
__int32 m_nClientTick; //0x0150
__int32 m_nDeltaTick; //0x0154
unsigned char m_bPaused; //0x0158
char pad_0x0159[0x3]; //0x0159
__int32 m_nViewEntity; //0x015C
char pad_0x0160[0x8]; //0x0160
char m_szLevelName[260]; //0x0168
char m_szLevelNameShort[40]; //0x026C
char pad_0x0294[0x5EC]; //0x0294
Entity* N00000233; //0x0880
Entity* N00000426; //0x0884
Entity* N00000427; //0x0888
Entity* N00000428; //0x088C
Entity* N00000429; //0x0890
char pad_0x0894[0x3130]; //0x0894
};//Size=0x39C4
class INetChannel
{
public:
__int32 vtable; //0x0000
Netmsgbinder* msgbinder1; //0x0004
Netmsgbinder* msgbinder2; //0x0008
Netmsgbinder* msgbinder3; //0x000C
Netmsgbinder* msgbinder4; //0x0010
unsigned char m_bProcessingMessages; //0x0014
unsigned char m_bShouldDelete; //0x0015
char pad_0x0016[0x2]; //0x0016
__int32 m_nOutSequenceNr; //0x0018
__int32 m_nInSequenceNr; //0x001C
__int32 m_nOutSequenceNrAck; //0x0020
__int32 m_nOutReliableState; //0x0024
__int32 m_nInReliableState; //0x0028
__int32 m_nChokedPackets; //0x002C
bf_write m_StreamReliable; //0x0030
CUtlMemory m_ReliableDataBuffer; //0x0048
bf_write m_StreamUnreliable; //0x0054
CUtlMemory m_UnreliableDataBuffer; //0x006C
bf_write m_StreamVoice; //0x0078
CUtlMemory m_VoiceDataBuffer; //0x0090
__int32 m_Socket; //0x009C
__int32 m_StreamSocket; //0x00A0
__int32 m_MaxReliablePayloadSize; //0x00A4
char pad_0x00A8[0x4]; //0x00A8
netadr_t remote_address; //0x00AC
float last_received; //0x00B8
char pad_0x00BC[0x4]; //0x00BC
float connect_time; //0x00C0
char pad_0x00C4[0x4]; //0x00C4
__int32 m_Rate; //0x00C8
float m_fClearTime; //0x00CC
char pad_0x00D0[0x8]; //0x00D0
CUtlVector m_WaitingList[0]; //0x00D8
CUtlVector m_WaitingList[1]; //0x00EC
char pad_0x0100[0x4120]; //0x0100
__int32 m_PacketDrop; //0x4220
char m_Name[32]; //0x4224
__int32 m_ChallengeNr; //0x4244
float m_Timeout; //0x4248
INetChannelHandler* m_MessageHandler; //0x424C
CUtlVector m_NetMessages; //0x4250
__int32 m_pDemoRecorder; //0x4264
__int32 m_nQueuedPackets; //0x4268
float m_flInterpolationAmount; //0x426C
float m_flRemoteFrameTime; //0x4270
float m_flRemoteFrameTimeStdDeviation; //0x4274
float m_nMaxRoutablePayloadSize; //0x4278
__int32 m_nSplitPacketSequence; //0x427C
char pad_0x4280[0x14]; //0x4280
};//Size=0x4294
Now to the pSilent part by having this you can now access CGOTVRecorder which is in CNetChannel.
Your turn to go and reverse the class and find out what you can use. Big Hint #1 CGOTVRecorder is going to be used to exploit demo's
heres big hint #2
Code:
Tickrate = pCmd->tickrate;
if ( (int Cvar_82 = sv_maxusrcmd_holdaim )
maxusrcmd_holdaim = Var_12;
else
maxusrcmd_holdaim = (Var_71 + 52))();
if ( m_iLastWeaponFireUsercmd - Tickrate < maxusrcmd_holdaim )
{
v47 = *(player + 0xF9C);
_mm_storel_epi64(&vars0, _mm_loadl_epi64((player + 0xF94)));
}
GL HF may the anti C+P be with you, this psilent patch is being used in most privates.
Originally Posted by Truix
.
