Is This Code Right?

Posts 1–15 of 22 · Page 1 of 2

Is This Code Right?

Hi Can you guys tell me if this code will work to make a hack its my first so yeah.

#include "stdafx.h"
#include <windows.h>
#define LTCAddy 0x3780AB70
void __cdecl PushToConsole(const char* szCommand )
{
DWORD dwCShell = (DWORD)GetModuleHandleA("CShell.dll");
if( dwCShell != NULL )
{
DWORD *LTClient = ( DWORD* )( 0x3780AB70 );
void* CONoff = ( void* )*( DWORD* )( *LTClient + 0x208 );
__asm
{
push szCommand;
call CONoff;
add esp, 4;
}
}
}
bool IsGameReadyForHook()
{
if( GetModuleHandleA( "d3d9.dll" ) != NULL
&& GetModuleHandleA( "ClientFX.fxd" ) != NULL
&& GetModuleHandleA( "CShell.dll" ) != NULL )
return true;
return false;
void main();
PushToConsole("Tracers " );
Sleep(234);
// Tracer Code
PushToConsole("Nx Chams" );//
Sleep(234);
//Chams and BTW is use Sleep (234) is to reduce lag

bool speed = false;
while(true){
if(GetAsyncKeyState(VK_F3)<0){
if(speed){
PushToConsole("BaseMoveAccel 3000.000000");
PushToConsole("StartAccel 500.000000");
PushToConsole("MaxAccel 3000.000000");
PushToConsole("AccelInc 6000.000000");
PushToConsole("WalkVel 70.000000");
PushToConsole("FRunVel 285.000000");
PushToConsole("BRunVel 285.000000");
PushToConsole("SRunVel 285.000000");
PushToConsole("DuckVel 50.000000");
speed = false;
} else {
PushToConsole("BaseMoveAccel 3000.000000");
PushToConsole("StartAccel 3000.000000");
PushToConsole("MaxAccel 3000.000000");
PushToConsole("AccelInc 3000.000000");
PushToConsole("WalkVel 3000.000000");
PushToConsole("FRunVel 3000.000000");
PushToConsole("BRunVel 3000.000000");
PushToConsole("SRunVel 3000.000000");
PushToConsole("DuckVel 3000.000000");
speed = true;
}
} //Speed Hack Turned On By Pressing F3
MessageBoxA( NULL, "Made By UrxHaxor But call me TehSplice for now on

", "Successfully Injected!", MB_YESNO| MB_ICONWARNING);
{
}
return TRUE;
}

Code:

PushToConsole("Tracers " );
Sleep(234);
// Tracer Code
PushToConsole("Nx Chams" );//
Sleep(234);

This is wrong

NX Chams is
PushToConsole("SkelModelStencil 1");
Tracers is
PushToConsole("ShowFirePath 1" );

Please refer here for PTC Commands: http://www.mpgh.net/forum/207-combat...ga-thread.html

Also you need this at the end ( Source: CAFlames ):

Code:

BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&main, NULL, 0,NULL);
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}

You defined LTCAddy for no reason as you used the addy in the code anyways...

Put that message box in void main.

Don't need #include "stdafx.h"

Not sure if that PTC Method works so replaced it with one that I have. No clue where source.

You forgot this:

Code:

void main();{


while (!IsGameReadyForHook()){

}

Heres the fixed up source:

Code:

#include <windows.h>
#define ADDR_CONSOLEUNWRAPPED 0x486010

void PushToConsole(const char* Command)
{
void* Console = (void*)ADDR_CONSOLEUNWRAPPED;
_asm
{
push Command
mov eax, Console
call eax
add esp, 0x4
}
}
bool IsGameReadyForHook()
{
if( GetModuleHandleA( "d3d9.dll" ) != NULL
&& GetModuleHandleA( "ClientFX.fxd" ) != NULL
&& GetModuleHandleA( "CShell.dll" ) != NULL )
return true;
return false;
void main();{

MessageBoxA( NULL, "Made By UrxHaxor But call me TehSplice for now on ", "Successfully Injected!", MB_YESNO| MB_ICONWARNING);
while (!IsGameReadyForHook()){

}
PushToConsole("ShowFirePath 1" );
Sleep(234);
// Tracer Code
PushToConsole("SkelModelStencil 1");
Sleep(234);
//Chams and BTW is use Sleep (234) is to reduce lag  
bool speed = false;
while(true){
if(GetAsyncKeyState(VK_F3)<0){ 
if(speed){ 
PushToConsole("BaseMoveAccel 3000.000000"); 
PushToConsole("StartAccel 500.000000"); 
PushToConsole("MaxAccel 3000.000000"); 
PushToConsole("AccelInc 6000.000000"); 
PushToConsole("WalkVel 70.000000"); 
PushToConsole("FRunVel 285.000000"); 
PushToConsole("BRunVel 285.000000"); 
PushToConsole("SRunVel 285.000000"); 
PushToConsole("DuckVel 50.000000"); 
speed = false; 
} else { 
PushToConsole("BaseMoveAccel 3000.000000"); 
PushToConsole("StartAccel 3000.000000"); 
PushToConsole("MaxAccel 3000.000000"); 
PushToConsole("AccelInc 3000.000000"); 
PushToConsole("WalkVel 3000.000000"); 
PushToConsole("FRunVel 3000.000000"); 
PushToConsole("BRunVel 3000.000000"); 
PushToConsole("SRunVel 3000.000000"); 
PushToConsole("DuckVel 3000.000000"); 
speed = true; 
} 
} //Speed Hack Turned On By Pressing F3

BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&main, NULL, 0,NULL);
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}

That should work

Unless i forgot something. I don't think I did.

Spoon Feed FTW.

This should work. If not, try detouring the function and encrypting your Console Commands strings.

Code:

#include "Files.h"
#include <windows.h>

/*Global Variables*/
#define ADDR_CONSOLEUNWRAPPED	0x486010
#define ADDR_GAMESTATUS			0x37806FC4

int g_NXCHAMS = 0;

/*Global Variables*/

void PushCommands(const char* Command)//Credits to Master131
{
	void* Console = (void*)ADDR_CONSOLEUNWRAPPED;

	_asm
	{
		call get_eip
			push Command
			add eax, 0xF
			push eax
			jmp Console
			add esp, 0x4
	}
	return;
	_asm
	{
get_eip:
		mov eax, [esp]
		sub eax, 5
			ret
	}
}

bool IsGameReady()
{
	if( GetModuleHandleA( "d3d9.dll" ) != NULL
		&& GetModuleHandleA( "ClientFX.fxd" ) != NULL
		&& GetModuleHandleA( "CShell.dll" ) != NULL )
		return true;
	return false;
}

void HackThread(void)
{
	while(true)
	{
		if(*(BYTE*)ADDR_GAMESTATUS == 1)
		{
			if((g_NXCHAMS > 0) && (GetAsyncKeyState(VK_NUMPAD1) &1))
			{
				PushCommands("SkelModelStencil 1");
			}else{
				PushCommands("SkelModelStencil 0");
			}
		}
		Sleep(200);
	}
}

DWORD CALLBACK dwMainThread(LPVOID)
{
	while (!IsGameReady())
		Sleep(75);

	HackThread();

	return 0;
}

void EraseHeaders(HINSTANCE hModule)
{
	PIMAGE_DOS_HEADER pDoH; 
	PIMAGE_NT_HEADERS pNtH;
	DWORD i, ersize, protect;

	if (!hModule) return;
	
	// well just to make clear what we doing
	pDoH = (PIMAGE_DOS_HEADER)(hModule);

	pNtH = (PIMAGE_NT_HEADERS)((LONG)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);

	ersize = sizeof(IMAGE_DOS_HEADER);
	if ( VirtualProtect(pDoH, ersize, PAGE_READWRITE, &protect) )
	{
		for ( i=0; i < ersize; i++ )
				*(BYTE*)((BYTE*)pDoH + i) = 0;
	}

	ersize = sizeof(IMAGE_NT_HEADERS);
	if ( pNtH && VirtualProtect(pNtH, ersize, PAGE_READWRITE, &protect) )
	{
		for ( i=0; i < ersize; i++ )
				*(BYTE*)((BYTE*)pNtH + i) = 0;
	}
	return;
}

void HideModule(HINSTANCE hModule)
{
	DWORD dwPEB_LDR_DATA = 0;
	_asm
	{
		pushad;
		pushfd;
		mov eax, fs:[30h]           
		mov eax, [eax+0Ch]          
		mov dwPEB_LDR_DATA, eax		

			mov esi, [eax+0Ch]			
		mov edx, [eax+10h]			

LoopInLoadOrderModuleList: 
		lodsd		            
			mov esi, eax			
			mov ecx, [eax+18h]		
		cmp ecx, hModule		
			jne SkipA				
			mov ebx, [eax]		
		mov ecx, [eax+4]	
		mov [ecx], ebx		
			mov [ebx+4], ecx	
			jmp InMemoryOrderModuleList  
SkipA:
		cmp edx, esi       
			jne LoopInLoadOrderModuleList 

InMemoryOrderModuleList:
		mov eax, dwPEB_LDR_DATA	
			mov esi, [eax+14h]   
		mov edx, [eax+18h]  

LoopInMemoryOrderModuleList: 
		lodsd
			mov esi, eax
			mov ecx, [eax+10h]
		cmp ecx, hModule
			jne SkipB
			mov ebx, [eax] 
		mov ecx, [eax+4]
		mov [ecx], ebx
			mov [ebx+4], ecx
			jmp InInitializationOrderModuleList
SkipB:
		cmp edx, esi
			jne LoopInMemoryOrderModuleList

InInitializationOrderModuleList:
		mov eax, dwPEB_LDR_DATA 
			mov esi, [eax+1Ch]	    
		mov edx, [eax+20h]	    

LoopInInitializationOrderModuleList: 
		lodsd
			mov esi, eax		
			mov ecx, [eax+08h]
		cmp ecx, hModule		
			jne SkipC
			mov ebx, [eax] 
		mov ecx, [eax+4]
		mov [ecx], ebx
			mov [ebx+4], ecx
			jmp Finished
SkipC:
		cmp edx, esi
			jne LoopInInitializationOrderModuleList

Finished:
		popfd;
		popad;
	}
}

unsigned char APIENTRY DllMain( HMODULE hModule,
					   DWORD  ul_reason_for_call,
					   LPVOID lpReserved
					 )
{

	if(ul_reason_for_call == DLL_PROCESS_ATTACH)
	{
		EraseHeaders(hModule);
		HideModule(hModule);
		CreateThread(NULL, NULL, dwMainThread, NULL, NULL, NULL);
		MessageBoxA(NULL, "Basically Made By Comando2056/Flengo", "Should Work", MB_OK);
	}

	return TRUE;
}

Originally Posted by Flengo

Spoon Feed FTW.

This should work. If not, try detouring the function and encrypting your Console Commands strings.

Code:

void EraseHeaders(HINSTANCE hModule)
{
	PIMAGE_DOS_HEADER pDoH; 
	PIMAGE_NT_HEADERS pNtH;
	DWORD i, ersize, protect;

	if (!hModule) return;
	
	// well just to make clear what we doing
	pDoH = (PIMAGE_DOS_HEADER)(hModule);

	pNtH = (PIMAGE_NT_HEADERS)((LONG)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);

	ersize = sizeof(IMAGE_DOS_HEADER);
	if ( VirtualProtect(pDoH, ersize, PAGE_READWRITE, &protect) )
	{
		for ( i=0; i < ersize; i++ )
				*(BYTE*)((BYTE*)pDoH + i) = 0;
	}

	ersize = sizeof(IMAGE_NT_HEADERS);
	if ( pNtH && VirtualProtect(pNtH, ersize, PAGE_READWRITE, &protect) )
	{
		for ( i=0; i < ersize; i++ )
				*(BYTE*)((BYTE*)pNtH + i) = 0;
	}
	return;
}

void HideModule(HINSTANCE hModule)
{
	DWORD dwPEB_LDR_DATA = 0;
	_asm
	{
		pushad;
		pushfd;
		mov eax, fs:[30h]           
		mov eax, [eax+0Ch]          
		mov dwPEB_LDR_DATA, eax		

			mov esi, [eax+0Ch]			
		mov edx, [eax+10h]			

LoopInLoadOrderModuleList: 
		lodsd		            
			mov esi, eax			
			mov ecx, [eax+18h]		
		cmp ecx, hModule		
			jne SkipA				
			mov ebx, [eax]		
		mov ecx, [eax+4]	
		mov [ecx], ebx		
			mov [ebx+4], ecx	
			jmp InMemoryOrderModuleList  
SkipA:
		cmp edx, esi       
			jne LoopInLoadOrderModuleList 

InMemoryOrderModuleList:
		mov eax, dwPEB_LDR_DATA	
			mov esi, [eax+14h]   
		mov edx, [eax+18h]  

LoopInMemoryOrderModuleList: 
		lodsd
			mov esi, eax
			mov ecx, [eax+10h]
		cmp ecx, hModule
			jne SkipB
			mov ebx, [eax] 
		mov ecx, [eax+4]
		mov [ecx], ebx
			mov [ebx+4], ecx
			jmp InInitializationOrderModuleList
SkipB:
		cmp edx, esi
			jne LoopInMemoryOrderModuleList

InInitializationOrderModuleList:
		mov eax, dwPEB_LDR_DATA 
			mov esi, [eax+1Ch]	    
		mov edx, [eax+20h]	    

LoopInInitializationOrderModuleList: 
		lodsd
			mov esi, eax		
			mov ecx, [eax+08h]
		cmp ecx, hModule		
			jne SkipC
			mov ebx, [eax] 
		mov ecx, [eax+4]
		mov [ecx], ebx
			mov [ebx+4], ecx
			jmp Finished
SkipC:
		cmp edx, esi
			jne LoopInInitializationOrderModuleList

Finished:
		popfd;
		popad;
	}
}


}

I've been gone to long. Wut is dis.

Originally Posted by AtomicStone

I've been gone to long. Wut is dis.

PEB Hiding Methods.

I had another class, from matypatty's base, but I didn't wanna include that in here.

Originally Posted by Flengo

PEB Hiding Methods.

I had another class, from matypatty's base, but I didn't wanna include that in here.

Herm... Are these methods needed? My hacks work fine without em.

Originally Posted by AtomicStone

Herm... Are these methods needed? My hacks work fine without em.

Those help though.

But can someone help me convert tht to a dll

also @AtomicStone thanks this is my first 1

Originally Posted by UrxHaxor

But can someone help me convert tht to a dll

also @AtomicStone thanks this is my first 1

If you set the Project/File to DLL. Just build it and open your File Directory.
There's your Dll

Originally Posted by Reflex-

If you set the Project/File to DLL. Just build it and open your File Directory.
There's your Dll

But when ever I do tht i use Portal to inject and it gives me a error saying it cant be found i use Microsoft Visual C++ 2010 Express thn i goto Win32 project thn .dll and i check export symbols.. Then i try to inject and i get a errorr

and @AtomicStone i try to build the code but i get a error and i know where the error is but whn ever i fix it it another one comes
#include <windows.h>
#define ADDR_CONSOLEUNWRAPPED 0x486010

void PushToConsole(const char* Command)
{
void* Console = (void*)ADDR_CONSOLEUNWRAPPED;
_asm
{
push Command
mov eax, Console
call eax
add esp, 0x4
}
}
bool IsGameReadyForHook()
{
if( GetModuleHandleA( "d3d9.dll" ) != NULL
&& GetModuleHandleA( "ClientFX.fxd" ) != NULL
&& GetModuleHandleA( "CShell.dll" ) != NULL )
return true;
return false;
void main();{

MessageBoxA( NULL, "Made By UrxHaxor But call me TehSplice for now on ", "Successfully Injected!", MB_YESNO| MB_ICONWARNING);
while (!IsGameReadyForHook()){

}
PushToConsole("ShowFirePath 1" );
Sleep(234);
// Tracer Code
PushToConsole("SkelModelStencil 1");
Sleep(234);
//Chams and BTW is use Sleep (234) is to reduce lag
bool speed = false;
while(true){
if(GetAsyncKeyState(VK_F3)<0){
if(speed){
PushToConsole("BaseMoveAccel 3000.000000");
PushToConsole("StartAccel 500.000000");
PushToConsole("MaxAccel 3000.000000");
PushToConsole("AccelInc 6000.000000");
PushToConsole("WalkVel 70.000000");
PushToConsole("FRunVel 285.000000");
PushToConsole("BRunVel 285.000000");
PushToConsole("SRunVel 285.000000");
PushToConsole("DuckVel 50.000000");
speed = false;
} else {
PushToConsole("BaseMoveAccel 3000.000000");
PushToConsole("StartAccel 3000.000000");
PushToConsole("MaxAccel 3000.000000");
PushToConsole("AccelInc 3000.000000");
PushToConsole("WalkVel 3000.000000");
PushToConsole("FRunVel 3000.000000");
PushToConsole("BRunVel 3000.000000");
PushToConsole("SRunVel 3000.000000");
PushToConsole("DuckVel 3000.000000");
speed = true;
}
} //Speed Hack Turned On By Pressing F3

BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{ <====== Also here.
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&main, NULL, 0,NULL);
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
} <============== The sqigly line is under it and says Expected }