MPGHThe Dark Arts
RegisterLog in

SmileHow to silent aimbot for real

Posts 1–15 of 27 · Page 1 of 2
How to silent aimbot for real
At thread https://www.mpgh.net/forum/showthread.php?t=1583432 the op uploaded list of things the cheat writing to memory (aimbot, speed, teleport,...) and also contain old version binary.

I found out that the cheat create a JMP at 0x2ce333, 0x2ce369 and 0x2ce39f, camera pos at 0xb93cb5, 0xb93cc1 and 0xb93ccf

I opened the old version in disassembler and jump into that memory address and assembly code in there address:
  • movss xmm0, dword ptr [edx+0DCh] (0x2ce333)
  • movss xmm0, dword ptr [edx+0E0h] (0x2ce369)
  • movss xmm0, dword ptr [edx+0E4h] (0x2ce39f)



edx+0DC is actually a forward pos from our camera pos to looking pos but reversed, also those xmm0 registers are wrote to xmm7, xmm2 and xmm3
The forward pos when I look down, where Y is positive:


So you need to create a forward vector from your camera pos to desirable pos
Here is the math I am using:
Code:
vec3 GetForwardVector(vec3 pos1, vec3 pos2) const {
                auto direction = pos2 - pos1;

		float len = sqrt(direction.x * direction.x + direction.y * direction.y + direction.z * direction.z);
		if (len == 0.f) return vec3();
		return vec3(direction.x / len, direction.y / len, direction.z / len);
	}
What you can do is change there xmm registers to your own pos (I changed those xmm7, xmm2 and xmm3)
Or change the pos at edx+0DC (I haven't tried this one yet but those memory are also used for function that render chunks so I think you need to change it back to old value)



Here is the sig to that function that create the raycast (only used for projectile): 55 8B EC 83 E4 ? 83 EC ? F3 0F ? ? ? F3 0F ? ? ? ? ? ? 8B 55
You can find it in cheat engine, scroll down a little bit and you will see the assembly code I mentioned

Video of silent aimbot I made (the entity list in here is bad so some entities are not being spotted)
#1 ·
you did a great job, i've been looking for something like this for years, this aimbot can be set not on monsters but on resources like mushrooms, bones, etc.?
#2 ·
Quote Originally Posted by 3rd View Post
you did a great job, i've been looking for something like this for years, this aimbot can be set not on monsters but on resources like mushrooms, bones, etc.?
Yes as long as you have it pos

- - - Updated - - -

Quote Originally Posted by rohan123123 View Post
daaamn sick hack are u planning to release it? also make it public pls
It is open source rn but the cheat is poop, a lot of crashs are happening and I need a better way to filter entity list
#5 · edited ·
What is your discord?
What is your discord?
#3 ·
daaamn sick hack are u planning to release it? also make it public pls
#4 ·
entity
Small question, did you get the entity list from Chloe's AOB? 8B 0D ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 2A 01 00 00 + 0x7C?

I can't seem to get any reliable entity list from it. If you could set me on the right path would be much appreciated!
#6 ·
Quote Originally Posted by bnjih View Post
Small question, did you get the entity list from Chloe's AOB? 8B 0D ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 2A 01 00 00 + 0x7C?

I can't seem to get any reliable entity list from it. If you could set me on the right path would be much appreciated!
Yes I get it from chole

The way I filter it is not the best but should work most of the time
This is how I do it in c++
Code:
auto worldPtr = Offset::world;

if (!*(std::byte**)worldPtr) return;

int entityStride = *(int*)(*(std::byte**)worldPtr + 0x80);
int entitySize = *(int*)(*(std::byte**)worldPtr + 0x84);
int entityBasePtr = *(int*)(*(std::byte**)worldPtr + 0x7C);

for (int i = 0; i < entitySize; i++) {
	auto entity = (std::byte*)(entityBasePtr + i * entityStride + 0x10);

	auto test2 = (int*)(*(std::byte**)entity);
	if (IsBadReadPtr(test2, sizeof(void*))) continue;

	auto name = *(std::byte**)(*(std::byte**)entity + 0x64);
	auto ptr1 = *(std::byte**)(*(std::byte**)entity + 0xE8);

	if (name == 0x0 
		|| IsBadReadPtr(name, sizeof(void*))
		|| IsBadReadPtr(ptr1, sizeof(void*))) continue;

	auto ptr2 = *(std::byte**)(ptr1 + 0x04);

	if (IsBadReadPtr(ptr2, sizeof(void*))) continue;

	auto name2 = *(const char**)(*(std::byte**)entity + 0x64);
	auto entityPos = (vec3*)(ptr2 + 0x80);
}
Cheat engine lua script (change worldBasePtr):
Code:
worldBasePtr = "trove.exe+11F74BC"

entityStrideAddr = string.format("[%s]+80", worldBasePtr)
entitySizeAddr = string.format("[%s]+84", worldBasePtr)

function a()
    local entityBasePtr = string.format("[%s]+7C", worldBasePtr)
    local entityStride = readInteger(entityStrideAddr)
    local entitySize = readInteger(entitySizeAddr)

    local a = 0

    print(string.format("Base: [%X]", readInteger(entityBasePtr)))
    for i = 0, entitySize - 1 do
            local entity = string.format("[%s]+%X+10", entityBasePtr, (i * entityStride))
            local name = string.format("[[%s]+64]", entity)

            local x_addr = string.format("[[[%s]+E8]+04]+80", entity)
            local y_addr = string.format("[[[%s]+E8]+04]+84", entity)
            local z_addr = string.format("[[[%s]+E8]+04]+88", entity)

            if readString(name) ~= nil and readFloat(x_addr) ~= nil and readFloat(y_addr) ~= nil and readFloat(z_addr) ~= nil
            then
                -- print(name)
                a = a + 1
                --print(x_addr)
                print(string.format("[%d]: %s | %.1f %.1f %.1f", i, readString(name), readFloat(x_addr) ,readFloat(y_addr), readFloat(z_addr)))
            end
    end
    print("valid entity: "..a)
end
Oh ye you need to get world pointer address from that AOB in order to work with the entity list:
#7 · edited ·
would it be possible for you to post a tutorial how to do it?
#8 ·
ok but this will take time also find a better ways beside changing xmm register
#9 · edited ·
It seems your lua is not working. But it still look useful i think many are grateful to you.
#10 · edited ·
Simple silent aimbot
I made a external cheat that can do silent aimbot, it aiming to every npc.

Source code are provided in
Some explanations are inside readme file

virus check aimbot exe:
https://www.virustotal.com/gui/file/...d358?nocache=1ⓘ
https://www.virscan.org/report/0aa1a...395c518124d358ⓘ

virus check source code:
https://www.virustotal.com/gui/file/...a19f?nocache=1ⓘ
https://www.virscan.org/report/4481b...d2fa42d1dca19fⓘ

Demo video:



aimbot_mpgh.net.zip103 KB · 60 downloads Clean
Download & Thanks
Trove-aimbot src_mpgh.net.zip6 KB · 54 downloads Clean
Download & Thanks
#11 · edited ·
does it work with resources?
#12 ·
Quote Originally Posted by A9ne View Post
does it work with resources?
Uhh what resources?
#13 ·
for example, Radiant Shard or Meteorite Fragment and the like
#14 ·
Quote Originally Posted by A9ne View Post
for example, Radiant Shard or Meteorite Fragment and the like
You need to somehow have their coordinate, this one only attack mods, some objects and radiant shard chests, not plants or resources on the ground
#15 · edited ·
Posts 1–15 of 27 · Page 1 of 2

Post a Reply

Similar Threads

CounterStrike (CS) 1.6 Hacks / Counter Strike: Source (CSS) Hackslf source wallhack/Silent aimbot!GOgorling 1

Tags for this Thread

None

Need help?