Undetected Memory Wallhack

Originally Posted by dreek1

It's beautiful code but it's more simples do that:

Code:

#define ADDR_TEXTURES 0x0119AD20
/*
55 56 57 8B F8 8B F1 75 ?? // luizimloko reference

00476680  /$ 81EC C0040000  SUB ESP,4C0
00476686  |. F605 C8AE1901 >TEST BYTE PTR DS:[119AEC8],1
0047668D  |. 55             PUSH EBP
0047668E  |. 56             PUSH ESI
0047668F  |. 57             PUSH EDI
00476690  |. 8BF8           MOV EDI,EAX
00476692  |. 8BF1           MOV ESI,ECX
00476694  |. 75 11          JNZ SHORT crossfir.004766A7
00476696  |. 830D C8AE1901 >OR DWORD PTR DS:[119AEC8],1
0047669D  |. B8 20AD1901    MOV EAX,crossfir.0119AD20   //ADDR_TEXTURE
004766A2  |. E8 79840700    CALL crossfir.004EEB20
004766A7  |> 8B06           MOV EAX,DWORD PTR DS:[ESI]
004766A9  |. 8B50 18        MOV EDX,DWORD PTR DS:[EAX+18]
004766AC  |. 8D4C24 58      LEA ECX,DWORD PTR SS:[ESP+58]
004766B0  |. 51             PUSH ECX
004766B1  |. 57             PUSH EDI


*/

class cTextures// Have more textures like Chams,etc..
{
public:
	char pad_0000[16]; //0x0000
	int32_t FullBright; //0x0010
	char pad_0014[144]; //0x0014
	int32_t WallHack; //0x00A4
	char pad_00A8[16]; //0x00A8
	int32_t SeeGhost; //0x00B8
}; //Size: 0x00BC
cTextures *pTexture;

void CALL_FUNCTION()
{
	pTexture = (cTextures *)(ADDR_TEXTURES);
	if (pTexture != NULL) {
		pTexture->FullBright = 6;//Original value is 5 
		pTexture->WallHack = 0;//Original value is 16777217
		pTexture->SeeGhost = 3;//Original value is 5 
	}
}

Can i ask ?
What method did you use to create updated class ?
I guess you're using reclass right ?

Originally Posted by 96neko

ingame msgbox is a game engine function, for the d3d part pm in skype

Originally Posted by UltraPGNoob

Actually the function sets the text to write in the endscene and the message is drawn because it changes the currently displayed popup id on the screen which draws a message box if the id is corresponding the message box. When playing around with this ID you can even use other message boxes such as the save replay or anything that acts as a popup. You could also watch the replay when on login screen for example.

i understand nw . it's about sync between the frames got it

ty
btw about the messagebox function can we use it to track client error functions ? as it should use specific arguments for the message (clienterror_xxx) right ?
how do i find something like that without C.E as an option?

Find call references on the call command that calls the display message box function or by string and if there's a dwitch then you need to find the call of the switch + the id of string pushed as argument.

Originally Posted by UltraPGNoob

what switch ??
is this even a good way to get client error or should i try something else ?

Strings are usually in switches and each cases gives one string to format. Take a look at object.dll there's good examples there.

Originally Posted by I2espect

btw about the messagebox function can we use it to track client error functions ? as it should use specific arguments for the message (clienterror_xxx) right ?
how do i find something like that without C.E as an option?

take a clean dump of the cshell and use IDA to strat reversing , as UltraPGNoob said , the client errors is called upon what case it handle , for example , if there's a p2p error the client will popup the p2p msg , i hope this makes things little clear .
for weapon hack , theres a simple way to do it but it needs cheat engine ,login into game , go into training room or enter a room with a friend just don't die , attach crossfire.exe -> exact value / 4 bytes , put your main weapon , use ak-47 or any default weapon , search for 1 , drop ur weapon (g),search for 0, until theres 10 results when you search for 0 , change the value 0 -> 1, and just press "g" to see if the weapon back, just scan the address and do the rest , i think i've explained too much...

Originally Posted by 96neko

The problem is getting a C.E undetected or a full bypass to xigncode3. Only a few people has it and I don't think they would share it.

Originally Posted by 96neko

its nice i can bypass xigncode 3 unlimited i try that

Originally Posted by 96neko

I still use ollydbg it's actually easy to get the the push and the call of a switch. Then get the jmp for this error.

Originally Posted by vaisefud3

The problem is getting a C.E undetected or a full bypass to xigncode3. Only a few people has it and I don't think they would share it.

well the bypass ain't hard tho i have it already and it's working since they changed to xc3

Originally Posted by gaerGAERHGaerherh

its nice i can bypass xigncode 3 unlimited i try that

good for u + who gave you the permission to use my video as ur sig ? xD

Originally Posted by UltraPGNoob

I still use ollydbg it's actually easy to get the the push and the call of a switch. Then get the jmp for this error.

yep u can do it that way , but my way you can spawn any weapon you want without getting any error ( unlimited weapon spawn, a loop through weapon list each time u drop a weapon another weapon just spawn xD ) , tho im sure they will take long before someone actually do it

Originally Posted by 96neko

good for u + who gave you the permission to use my video as ur sig ? xD

lol

//msgshort

Originally Posted by 96neko

I had tried back in 2012-2014 with weapon teleport but I kinda gave up on this due to school. May I add you on Skype so we discuss about private stuff about CF?

Originally Posted by dreek1

It's beautiful code but it's more simples do that:
[...]

if you change the value like that you will get D/C Ban.

Originally Posted by UltraPGNoob

I had tried back in 2012-2014 with weapon teleport but I kinda gave up on this due to school. May I add you on Skype so we discuss about private stuff about CF?

ok //2shortmsg

Done /msgtoshort

Undetected Memory Wallhack

Post a Reply

Similar Threads

Tags for this Thread