CF:Info

People are asking about cf so i will post assembly dump of useful things for esp and bot.Its nothing new but i guess some people are having trouble find info on the game.

player loop getting the name

Code:

 for( unsigned int i = 0; i < 16; i++ ){
	
	   _st3rdPlayerInfo * pPlayerInfo = (_st3rdPlayerInfo*)((ulCLTClientShell + 0xDC98)+ (i * 0x1C0));

1001D2CA   8B0D A87F2E10    MOV ECX,DWORD PTR DS:[102E7FA8]          ; cshell.102F0288
1001D2D0   69C0 C0010000    IMUL EAX,EAX,1C0
1001D2D6   52               PUSH EDX
1001D2D7   8D9408 9EDC0000  LEA EDX,DWORD PTR DS:[EAX+ECX+DC9E]
1001D2DE   52               PUSH EDX
1001D2DF   8D4424 2C        LEA EAX,DWORD PTR SS:[ESP+2C]
1001D2E3   68 98A12710      PUSH cshell.1027A198                     ; ASCII "%s  HP : %d"

structs:

Code:

lass _st3rdPlayerInfo;
class _Object;
class _IDK;
class _st3rdPlayerInfo
{ 
public:
    _Object* pObj; //0x9338  
	__int8 ClientID; //0x933C  
	__int8 Team; //0x933D  75
	char Name[12]; //0x933E  //DC76
	__int16 ID047D59C0; //0x934A  
	_IDK* pIDK; //0x934C  
		char unknown37712[8]; //0x9350
	__int32 HasC4; //0x9358  
	__int32 ID047D5EC0; //0x935C  
	__int32 Rank; //0x9360  
	__int32 pointerunk;
	__int32 ID04A6BD40; //0x9368  
	__int16 health; //0x936C  
	__int16 kills; //0x936E  

};

class _Object
{
public:
BYTE pad0[0x4];
D3DXVECTOR3 Origin;
}; 
class _IDK
{
public:
	char unknown0[6276]; //0x0000
	__int16 ID0F2E65A0; //0x1884  
	__int8 ID07C67B38; //0x1886  
	bool IsMutant; //0x1887 
};

class PlayerClnt; //clientshell +50 , camera is at +4
class PlayerClnt
{
public:
	char unknown0[8]; //0x0000
	float unkf; //0x0008  
	char unknown12[248]; //0x000C
	float pitch; //0x0104  
	float yaw; //0x0108  
	
		
};

GetMyindex:

Code:

typedef int (__thiscall *lpGetMeIdxInPlayerInfoList)(unsigned long ulCLTClientShell);
lpGetMeIdxInPlayerInfoList GetMeIdxInPlayerInfoList;

 unsigned long ulCLTClientShell = *(unsigned long*)(CShellBase + 0x2E7FA8);
 GetMeIdxInPlayerInfoList = (lpGetMeIdxInPlayerInfoList) (CShellBase + 0x1F1D0 );

int me =  GetMeIdxInPlayerInfoList(ulCLTClientShelll);
1001F1D0   56               PUSH ESI
1001F1D1   8BF1             MOV ESI,ECX
1001F1D3   0FB686 94DC0000  MOVZX EAX,BYTE PTR DS:[ESI+DC94]
1001F1DA   50               PUSH EAX
1001F1DB   E8 E07B0E00      CALL cshell.10106DC0
1001F1E0   83C4 04          ADD ESP,4
1001F1E3   84C0             TEST AL,AL
1001F1E5   75 04            JNZ SHORT cshell.1001F1EB
1001F1E7   0C FF            OR AL,0FF
1001F1E9   5E               POP ESI
1001F1EA   C3               RETN
1001F1EB   0FB68E 94DC0000  MOVZX ECX,BYTE PTR DS:[ESI+DC94]
1001F1F2   69C9 C0010000    IMUL ECX,ECX,1C0
1001F1F8   8A8431 9CDC0000  MOV AL,BYTE PTR DS:[ECX+ESI+DC9C]
1001F1FF   5E               POP ESI
1001F200   C3               RETN

engine text:

Code:

typedef void (__thiscall *lpDrawEngineString)(unsigned long ulBase, char *String, int x, int y, unsigned long Color, bool Shadow,int unk);
lpDrawEngineString DrawEngineString;


1018B07A   6A 00            PUSH 0
1018B07C   6A 00            PUSH 0
1018B07E   68 424242FF      PUSH FF424242
1018B083   83C1 C1          ADD ECX,-3F
1018B086   51               PUSH ECX
1018B087   6A 3E            PUSH 3E
1018B089   68 F84D2A10      PUSH cshell.102A4DF8                     ; ASCII "- (NO CLAN)"
1018B08E   8B0D 20209110    MOV ECX,DWORD PTR DS:[10912020]
1018B094   E8 57280400      CALL cshell.101CD8F0

DevicePointer:

Code:

1001CD90   A1 30552E10      MOV EAX,DWORD PTR DS:[102E5530]

lulz thats aimbot+ESP on a golden plater xD
anyways im preaty sure pitch/yaw are at _LTPlayerClient+0x110 and _LTPlayerClient+0x10C or at least thats wt i use

btw im in the look for new features, if u got anything to trade PM me, i got some stuff u might be interested in

Originally Posted by MiNT

ya they are in plyrclnt @ 0x50 , its actually never changed since the game was in beta, and my classes are old hence the offset placement ;D. I havent even updated but i use to be able to kill everyone b4 the round started by modifying my camera.

Originally Posted by SNal2F

nice, so i take that ur gana quit the game for a second time ? xD
if u want help with viz check or a few other things PM :P

Originally Posted by MiNT

nice, so i take that ur gana quit the game for a second time ? xD
if u want help with viz check or a few other things PM :P

Im kinda busy with school

also i didnt have time to give you appropriate reply on viewangles from the viewmatrix. The lithtech engine stores the angles in range of 360 degress in radians, when you do the calculation from the viewmatrix that is 180 degrees -PI -> PI : 3.14 radians, which is how bf2 stores there viewangles its kinda of pain cuz you will have to test the different variations.

also the inverse of viewmatrix 41 42 43 will be your camera coordinates

Originally Posted by SNal2F

Im kinda busy with school

also i didnt have time to give you appropriate reply on viewangles from the viewmatrix. The lithtech engine stores the angles in range of 360 degress in radians, when you do the calculation from the viewmatrix that is 180 degrees usally -PI -> PI : 3.14 radians, which is how bf2 stores there viewangles its kinda of pain cuz you will have to test the different variations.

also the inverse of viewmatrix 41 42 43 will be your camera coordinates

school? me too

hehe this guy deserves a thanks. so everyone give him thanks

Originally Posted by SNal2F

Im kinda busy with school

lol i fixed that problem 2 weeks ago, now my aimbot is working fine, i was getting the pos right, but for the pitch/yaw i was forgetting to do the inverse //

edit: btw u use a different device ptr than me -.-, im guessing CShell has its own or its a fvck up on z8's part, i use **(LPDIRECT3DDEVICE9**)0x006C8390

Originally Posted by MiNT

ya they both do exe & the cshell stores the device.

Lol thanks for info =D

lol!lol!lol!lol!lol!

can't i get the hack???

CF:Info

Tags for this Thread