Originally Posted by Void
EPP:
0x37730832;
0x37730832;
Originally Posted by Void
Enemy Player Pointer
Originally Posted by Void
You need the Enemy Pointer Class to use any Enemy Pointer!
correct me if im wrong ?
correct me if im wrong ?
Originally Posted by Void
EPP:
0x37730832;
0x37730832;
...and not just that, I think you got people mad at you now.
Originally Posted by Void
EPP:
0x37730832;
0x37730832;
I noticed there wasnt a sticky thread on the game or much infos or it must be spread out so.... Just some stuffz so you can make yourself some snazzy dazzy esps and bots and shit: feel free to post w/e you want
from my couple days of reversing game doesnt really intrest me just wanted to see what the fuss is about(I suck lol and there are alot of good players in CA) , I always come back to playing BF2
Mostly a dump of where to find stuff
Engine hooks u can draw up in her.
ClientInfo
didnt fully rebuild but w/e u can add what you want: only worked on this when i was bored last week :/
Nothing usefull As i went sealione route .
Proof:
creds : sealione and zoomgod for inspiration
from my couple days of reversing game doesnt really intrest me just wanted to see what the fuss is about(I suck lol and there are alot of good players in CA) , I always come back to playing BF2
Mostly a dump of where to find stuff
Code:
005337E1 A1 A4E17F00 MOV EAX,DWORD PTR DS:[7FE1A4] 005337E6 8B88 F8060000 MOV ECX,DWORD PTR DS:[EAX+6F8]//cshell 005337EC 894C24 04 MOV DWORD PTR SS:[ESP+4],ECX 005337F0 ^E9 8BFFF2FF JMP Engine.00463780 005337F5 68 50177800 PUSH Engine.00781750 ; ASCII "d3ddevice" 005337FA 56 PUSH ESI 005337FB E8 C1C21B00 CALL Engine.006EFAC1 005337F5 68 50177800 PUSH Engine.00781750 ; ASCII "d3ddevice" 005337FA 56 PUSH ESI 005337FB E8 C1C21B00 CALL Engine.006EFAC1 00533800 83C4 08 ADD ESP,8 00533803 85C0 TEST EAX,EAX 00533805 75 10 JNZ SHORT Engine.00533817 00533807 FF15 2C638000 CALL DWORD PTR DS:[80632C] ; Engine.005872E0//device found here 0053380D 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 00533811 8902 MOV DWORD PTR DS:[EDX],EAX 00533813 33C0 XOR EAX,EAX 00533815 5E POP ESI 00533816 C3 RETN 00533817 B8 01000000 MOV EAX,1
Engine hooks u can draw up in her.
Code:
005353B0 833D 04638000 00 CMP DWORD PTR DS:[806304],0 005353B7 75 36 JNZ SHORT Engine.005353EF 005353B9 6A 49 PUSH 49 005353BB E8 60AAF6FF CALL Engine.0049FE20 005353C0 83C4 04 ADD ESP,4 005353C3 833D E0DB7F00 01 CMP DWORD PTR DS:[7FDBE0],1 005353CA 7C 1D JL SHORT Engine.005353E9 005353CC A1 4C607D00 MOV EAX,DWORD PTR DS:[7D604C] 005353D1 68 703D7700 PUSH Engine.00773D70 005353D6 68 D43D7700 PUSH Engine.00773DD4 ; ASCII "LT_NOTINITIALIZED" 005353DB 68 B81A7800 PUSH Engine.00781AB8 ; ASCII "FlipScreen" 005353E0 50 PUSH EAX 005353E1 E8 7AB6F6FF CALL Engine.004A0A60 005353E6 83C4 10 ADD ESP,10 005353E9 B8 49000000 MOV EAX,49 005353EE C3 RETN
Code:
3715F660 53 PUSH EBX //tried tracing back this function with no luck but you can see that the call in red is from the same class so i traced that for the this:it is lazy but w/e 3715F661 8BD9 MOV EBX,ECX 3715F663 56 PUSH ESI 3715F664 8D43 08 LEA EAX,DWORD PTR DS:[EBX+8] 3715F667 57 PUSH EDI 3715F668 C700 00000000 MOV DWORD PTR DS:[EAX],0 3715F66E 50 PUSH EAX 3715F66F A1 10D97E37 MOV EAX,DWORD PTR DS:[377ED910] 3715F674 8B88 84000000 MOV ECX,DWORD PTR DS:[EAX+84] 3715F67A FFD1 CALL ECX 3715F67C 8B7C24 1C MOV EDI,DWORD PTR SS:[ESP+1C] 3715F680 83C4 04 ADD ESP,4 3715F683 6A 00 PUSH 0 3715F685 57 PUSH EDI 3715F686 8BCB MOV ECX,EBX 3715F688 E8 F3E2FFFF CALL cshell.3715D980 3715F68D E8 7EFDFFFF CALL cshell.3715F410 3715F692 8BF0 MOV ESI,EAX 3715F694 85F6 TEST ESI,ESI 3715F696 75 20 JNZ SHORT cshell.3715F6B8 3715F698 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 3715F69C A1 10D97E37 MOV EAX,DWORD PTR DS:[377ED910] 3715F6A1 8B10 MOV EDX,DWORD PTR DS:[EAX] 3715F6A3 8B52 18 MOV EDX,DWORD PTR DS:[EDX+18] 3715F6A6 51 PUSH ECX 3715F6A7 68 04A46E37 PUSH cshell.376EA404 ; ASCII "CCBAClientInfoMgr::AddClient %s End" 3715E914 8B0D 48CE7E37 MOV ECX,DWORD PTR DS:[377ECE48] ; cshell.37805DA0 3715E91A 6A 00 PUSH 0 3715E91C 56 PUSH ESI 3715E91D E8 5EF0FFFF CALL cshell.3715D980
Code:
class PointerTo
{
public:
char pad[4];
PlayerInfo * first;
__int32 index;
};
class PlayerInfo
{
public:
__int32 Unknown0; //0000
__int32 index; //0004
__int32 Unknown2; //0008
__int32 Unknown3; //000C
char Name[12]; //0010
char unknown5[12];
_Object* obj; //0028
char unknown7[76];
__int8 IsDead; //0078
__int8 Unknown9; //0079
__int16 Unknown10; //007A
char unknown11[488];
PlayerInfo* Next; //0264
};
class _Object
{
public:
char Pad[4];
D3DXVECTOR3 origin;
};
Nothing usefull As i went sealione route .
Code:
typedef int (__thiscall *lpAmountAlive)(unsigned long ulThis); lpAmountAlive AmountAlive; //0x3715C3A0 typedef int (__thiscall *lpTotalPlayers)(unsigned long ulThis); lpTotalPlayers TotalPlayers;//0x3715C210
Proof:
creds : sealione and zoomgod for inspiration
Originally Posted by SNal2F
I noticed there wasnt a sticky thread on the game or much infos or it must be spread out so.... Just some stuffz so you can make yourself some snazzy dazzy esps and bots and shit: feel free to post w/e you want
from my couple days of reversing game doesnt really intrest me just wanted to see what the fuss is about(I suck lol and there are alot of good players in CA) , I always come back to playing BF2
Mostly a dump of where to find stuff
Engine hooks u can draw up in her.
ClientInfo
didnt fully rebuild but w/e u can add what you want: only worked on this when i was bored last week :/
Nothing usefull As i went sealione route .
Proof:
YouTube - esp test(buggy)
creds : sealione and zoomgod for inspiration
from my couple days of reversing game doesnt really intrest me just wanted to see what the fuss is about(I suck lol and there are alot of good players in CA) , I always come back to playing BF2
Mostly a dump of where to find stuff
Code:
005337E1 A1 A4E17F00 MOV EAX,DWORD PTR DS:[7FE1A4] 005337E6 8B88 F8060000 MOV ECX,DWORD PTR DS:[EAX+6F8]//cshell 005337EC 894C24 04 MOV DWORD PTR SS:[ESP+4],ECX 005337F0 ^E9 8BFFF2FF JMP Engine.00463780 005337F5 68 50177800 PUSH Engine.00781750 ; ASCII "d3ddevice" 005337FA 56 PUSH ESI 005337FB E8 C1C21B00 CALL Engine.006EFAC1 005337F5 68 50177800 PUSH Engine.00781750 ; ASCII "d3ddevice" 005337FA 56 PUSH ESI 005337FB E8 C1C21B00 CALL Engine.006EFAC1 00533800 83C4 08 ADD ESP,8 00533803 85C0 TEST EAX,EAX 00533805 75 10 JNZ SHORT Engine.00533817 00533807 FF15 2C638000 CALL DWORD PTR DS:[80632C] ; Engine.005872E0//device found here 0053380D 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 00533811 8902 MOV DWORD PTR DS:[EDX],EAX 00533813 33C0 XOR EAX,EAX 00533815 5E POP ESI 00533816 C3 RETN 00533817 B8 01000000 MOV EAX,1
Engine hooks u can draw up in her.
Code:
005353B0 833D 04638000 00 CMP DWORD PTR DS:[806304],0 005353B7 75 36 JNZ SHORT Engine.005353EF 005353B9 6A 49 PUSH 49 005353BB E8 60AAF6FF CALL Engine.0049FE20 005353C0 83C4 04 ADD ESP,4 005353C3 833D E0DB7F00 01 CMP DWORD PTR DS:[7FDBE0],1 005353CA 7C 1D JL SHORT Engine.005353E9 005353CC A1 4C607D00 MOV EAX,DWORD PTR DS:[7D604C] 005353D1 68 703D7700 PUSH Engine.00773D70 005353D6 68 D43D7700 PUSH Engine.00773DD4 ; ASCII "LT_NOTINITIALIZED" 005353DB 68 B81A7800 PUSH Engine.00781AB8 ; ASCII "FlipScreen" 005353E0 50 PUSH EAX 005353E1 E8 7AB6F6FF CALL Engine.004A0A60 005353E6 83C4 10 ADD ESP,10 005353E9 B8 49000000 MOV EAX,49 005353EE C3 RETN
Code:
3715F660 53 PUSH EBX //tried tracing back this function with no luck but you can see that the call in red is from the same class so i traced that for the this:it is lazy but w/e 3715F661 8BD9 MOV EBX,ECX 3715F663 56 PUSH ESI 3715F664 8D43 08 LEA EAX,DWORD PTR DS:[EBX+8] 3715F667 57 PUSH EDI 3715F668 C700 00000000 MOV DWORD PTR DS:[EAX],0 3715F66E 50 PUSH EAX 3715F66F A1 10D97E37 MOV EAX,DWORD PTR DS:[377ED910] 3715F674 8B88 84000000 MOV ECX,DWORD PTR DS:[EAX+84] 3715F67A FFD1 CALL ECX 3715F67C 8B7C24 1C MOV EDI,DWORD PTR SS:[ESP+1C] 3715F680 83C4 04 ADD ESP,4 3715F683 6A 00 PUSH 0 3715F685 57 PUSH EDI 3715F686 8BCB MOV ECX,EBX 3715F688 E8 F3E2FFFF CALL cshell.3715D980 3715F68D E8 7EFDFFFF CALL cshell.3715F410 3715F692 8BF0 MOV ESI,EAX 3715F694 85F6 TEST ESI,ESI 3715F696 75 20 JNZ SHORT cshell.3715F6B8 3715F698 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 3715F69C A1 10D97E37 MOV EAX,DWORD PTR DS:[377ED910] 3715F6A1 8B10 MOV EDX,DWORD PTR DS:[EAX] 3715F6A3 8B52 18 MOV EDX,DWORD PTR DS:[EDX+18] 3715F6A6 51 PUSH ECX 3715F6A7 68 04A46E37 PUSH cshell.376EA404 ; ASCII "CCBAClientInfoMgr::AddClient %s End" 3715E914 8B0D 48CE7E37 MOV ECX,DWORD PTR DS:[377ECE48] ; cshell.37805DA0 3715E91A 6A 00 PUSH 0 3715E91C 56 PUSH ESI 3715E91D E8 5EF0FFFF CALL cshell.3715D980
Code:
class PointerTo
{
public:
char pad[4];
PlayerInfo * first;
__int32 index;
};
class PlayerInfo
{
public:
__int32 Unknown0; //0000
__int32 index; //0004
__int32 Unknown2; //0008
__int32 Unknown3; //000C
char Name[12]; //0010
char unknown5[12];
_Object* obj; //0028
char unknown7[76];
__int8 IsDead; //0078
__int8 Unknown9; //0079
__int16 Unknown10; //007A
char unknown11[488];
PlayerInfo* Next; //0264
};
class _Object
{
public:
char Pad[4];
D3DXVECTOR3 origin;
};
Nothing usefull As i went sealione route .
Code:
typedef int (__thiscall *lpAmountAlive)(unsigned long ulThis); lpAmountAlive AmountAlive; //0x3715C3A0 typedef int (__thiscall *lpTotalPlayers)(unsigned long ulThis); lpTotalPlayers TotalPlayers;//0x3715C210
Proof:
YouTube - esp test(buggy)
creds : sealione and zoomgod for inspiration
Nice ESP actially. How come it flickers tho?
Originally Posted by SNal2F
I noticed there wasnt a sticky thread on the game or much infos or it must be spread out so.... Just some stuffz so you can make yourself some snazzy dazzy esps and bots and shit: feel free to post w/e you want
from my couple days of reversing game doesnt really intrest me just wanted to see what the fuss is about(I suck lol and there are alot of good players in CA) , I always come back to playing BF2
Mostly a dump of where to find stuff
Engine hooks u can draw up in her.
ClientInfo
didnt fully rebuild but w/e u can add what you want: only worked on this when i was bored last week :/
Nothing usefull As i went sealione route .
Proof:
YouTube - esp test(buggy)
creds : sealione and zoomgod for inspiration
from my couple days of reversing game doesnt really intrest me just wanted to see what the fuss is about(I suck lol and there are alot of good players in CA) , I always come back to playing BF2
Mostly a dump of where to find stuff
Code:
005337E1 A1 A4E17F00 MOV EAX,DWORD PTR DS:[7FE1A4] 005337E6 8B88 F8060000 MOV ECX,DWORD PTR DS:[EAX+6F8]//cshell 005337EC 894C24 04 MOV DWORD PTR SS:[ESP+4],ECX 005337F0 ^E9 8BFFF2FF JMP Engine.00463780 005337F5 68 50177800 PUSH Engine.00781750 ; ASCII "d3ddevice" 005337FA 56 PUSH ESI 005337FB E8 C1C21B00 CALL Engine.006EFAC1 005337F5 68 50177800 PUSH Engine.00781750 ; ASCII "d3ddevice" 005337FA 56 PUSH ESI 005337FB E8 C1C21B00 CALL Engine.006EFAC1 00533800 83C4 08 ADD ESP,8 00533803 85C0 TEST EAX,EAX 00533805 75 10 JNZ SHORT Engine.00533817 00533807 FF15 2C638000 CALL DWORD PTR DS:[80632C] ; Engine.005872E0//device found here 0053380D 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C] 00533811 8902 MOV DWORD PTR DS:[EDX],EAX 00533813 33C0 XOR EAX,EAX 00533815 5E POP ESI 00533816 C3 RETN 00533817 B8 01000000 MOV EAX,1
Engine hooks u can draw up in her.
Code:
005353B0 833D 04638000 00 CMP DWORD PTR DS:[806304],0 005353B7 75 36 JNZ SHORT Engine.005353EF 005353B9 6A 49 PUSH 49 005353BB E8 60AAF6FF CALL Engine.0049FE20 005353C0 83C4 04 ADD ESP,4 005353C3 833D E0DB7F00 01 CMP DWORD PTR DS:[7FDBE0],1 005353CA 7C 1D JL SHORT Engine.005353E9 005353CC A1 4C607D00 MOV EAX,DWORD PTR DS:[7D604C] 005353D1 68 703D7700 PUSH Engine.00773D70 005353D6 68 D43D7700 PUSH Engine.00773DD4 ; ASCII "LT_NOTINITIALIZED" 005353DB 68 B81A7800 PUSH Engine.00781AB8 ; ASCII "FlipScreen" 005353E0 50 PUSH EAX 005353E1 E8 7AB6F6FF CALL Engine.004A0A60 005353E6 83C4 10 ADD ESP,10 005353E9 B8 49000000 MOV EAX,49 005353EE C3 RETN
Code:
3715F660 53 PUSH EBX //tried tracing back this function with no luck but you can see that the call in red is from the same class so i traced that for the this:it is lazy but w/e 3715F661 8BD9 MOV EBX,ECX 3715F663 56 PUSH ESI 3715F664 8D43 08 LEA EAX,DWORD PTR DS:[EBX+8] 3715F667 57 PUSH EDI 3715F668 C700 00000000 MOV DWORD PTR DS:[EAX],0 3715F66E 50 PUSH EAX 3715F66F A1 10D97E37 MOV EAX,DWORD PTR DS:[377ED910] 3715F674 8B88 84000000 MOV ECX,DWORD PTR DS:[EAX+84] 3715F67A FFD1 CALL ECX 3715F67C 8B7C24 1C MOV EDI,DWORD PTR SS:[ESP+1C] 3715F680 83C4 04 ADD ESP,4 3715F683 6A 00 PUSH 0 3715F685 57 PUSH EDI 3715F686 8BCB MOV ECX,EBX 3715F688 E8 F3E2FFFF CALL cshell.3715D980 3715F68D E8 7EFDFFFF CALL cshell.3715F410 3715F692 8BF0 MOV ESI,EAX 3715F694 85F6 TEST ESI,ESI 3715F696 75 20 JNZ SHORT cshell.3715F6B8 3715F698 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10] 3715F69C A1 10D97E37 MOV EAX,DWORD PTR DS:[377ED910] 3715F6A1 8B10 MOV EDX,DWORD PTR DS:[EAX] 3715F6A3 8B52 18 MOV EDX,DWORD PTR DS:[EDX+18] 3715F6A6 51 PUSH ECX 3715F6A7 68 04A46E37 PUSH cshell.376EA404 ; ASCII "CCBAClientInfoMgr::AddClient %s End" 3715E914 8B0D 48CE7E37 MOV ECX,DWORD PTR DS:[377ECE48] ; cshell.37805DA0 3715E91A 6A 00 PUSH 0 3715E91C 56 PUSH ESI 3715E91D E8 5EF0FFFF CALL cshell.3715D980
Code:
class PointerTo
{
public:
char pad[4];
PlayerInfo * first;
__int32 index;
};
u
class PlayerInfo
{
public:
__int32 Unknown0; //0000
__int32 index; //0004
__int32 Unknown2; //0008
__int32 Unknown3; //000C
char Name[12]; //0010
char unknown5[12];
_Object* obj; //0028
char unknown7[76];
__int8 IsDead; //0078
__int8 Unknown9; //0079
__int16 Unknown10; //007A
char unknown11[488];
PlayerInfo* Next; //0264
};
class _Object
{
public:
char Pad[4];
D3DXVECTOR3 origin;
};
Nothing usefull As i went sealione route .
Code:
typedef int (__thiscall *lpAmountAlive)(unsigned long ulThis); lpAmountAlive AmountAlive; //0x3715C3A0 typedef int (__thiscall *lpTotalPlayers)(unsigned long ulThis); lpTotalPlayers TotalPlayers;//0x3715C210
Proof:
YouTube - esp test(buggy)
creds : sealione and zoomgod for inspiration
Originally Posted by Mr.Magicman
nice straight leech of fatboy from uc forum.
xD
snal2f, teamoffset is 0x70 in clientinfo
also try looking for the sfxmgr (for player object, health, armor, etc)
also try looking for the sfxmgr (for player object, health, armor, etc)
Originally Posted by mmbob
EPP:
Code:
0xDEADBEEF
Im pretty sure that's the teleport addy.
Originally Posted by wassup40
Im pretty sure that's the teleport addy.
@OP
Thanks! That only narrows it down to about a million addresses!
0x90000 about that many left in cshell.
A playerinfo linked list, oh my. This game must not have been designed by the brightest of fellows.
Originally Posted by HL-SDK
A playerinfo linked list, oh my. This game must not have been designed by the brightest of fellows.
This thread is closed for replies.
Similar Threads
Combat Arms Hack Coding / Programming / Source CodeThe Enemy Player Pointer Address 39 Combat Arms EU Hack Coding/Source CodeEnemy Player Pointer Adress
4 C++/C ProgrammingBase player pointer?!?!?
2 C++/C Programming[Cube2] player pointers
9 Combat Arms Hack Coding / Programming / Source CodeCA Player pointer
33
4 C++/C ProgrammingBase player pointer?!?!? 2 C++/C Programming[Cube2] player pointers 9 Combat Arms Hack Coding / Programming / Source CodeCA Player pointer 33