MPGHThe Dark Arts
RegisterLog in

Modern Warfare 3 Source Code / Address Thread

Posts 16–30 of 117 · Page 2 of 8
Quote Originally Posted by rawr im a tiger View Post
I don't want to damage IW5M by releasing my addresses, but this one shouldn't hurt

Laser:
004D14B6
*(BYTE*)0x4D14B7 = NULL;


Thx master131 :P
#16 ·
Quote Originally Posted by MarkHC View Post
Some structs..
Code:
typedef struct
{
	char unknown0[12];
	char Name[16];
	__int32 Team;
}ClientInfo_T;

typedef struct
{
	char _0x0000[0x8];
	int Width;
	int Height;
	int FovX;
	int FovY;
	Vector Origin;
	Vector ViewAxis[3];
	char _0x0048[0x24];
	float ZoomProgress;
	char _0x0070[0x4ABC]; 
	Vector ViewAngles;
	char _0x4B34[0x30];
	float WeaponViewAngleX;
	float WeaponViewAngleY;
}RefDef_T;

typedef struct
{
public:
       Vector Recoil;
       Vector vOrigin;
       Vector DeltaOrigin; 
       float ReadViewAngleY;
       float ReadViewAngleX;
       char _0x0070[108];
       float SetViewAngleY;
       float SetViewAngleX; 
} ViewMatrix;

typedef struct
{
	char _0x0000[0x2];                         
	short Valid;                                   
	char _0x0004[0x10];                        
	Vector Origin;                                
	Vector Angles;                              
	char _0x002C[0x3C];                      
	int Flags;                                  
	char _0x006C[0xC];                          
	Vector OldOrigin;                           
	char _0x0084[0x18];                         
	Vector OldAngles;                        
	char _0x00A8[0x28];                     
	int ClientNumber;                                 
	short Type;                            
	char _0x00D6[0x12];                          
        Vector NewOrigin;   
	char _0x00F4[0x1C];                        
	Vector NewAngles;                            
	char _0x011C[0x7C];                      
	byte WeaponID;                            
	char _0x0199[0x37];                    
	int IsAlive; 
	char _0x01D4[0x24];
}Entity_T; 

typedef struct
{
    int servertime; 
    int playerstate; 
    int staminatimer; 
    unsigned short playerstance;
    char _pad[10];
    int velocity; 
    Vector Origin;
    Vector Velocity;
    char _pad1[44];
    float refdefViewAngleY; 
    float refdefViewAngleX; 
    char _pad2[232];
    int ClientNumber; 
    char _pad3[4];
    float viewAngleY;
    float viewAngleX; 
    char _pad4[4];
    int   playerStanceInt; 
    float playerStanceFlt;
    char _pad5[80];
    int MaxEntities;
    char _pad6[432];
    int WeaponNum;
    unsigned short EquipmentState;
    unsigned short WeaponSwapState;
    float WeaponZoomFlt;
    float MovementSpreadMultiplier;
    char _pad7[4];
    float DefaultSpreadMultiplier;
    int  WeaponState;
    char _pad8[352];
    BYTE perkslot3;
    char _pad9[19];
}CG_T;

typedef struct
{
public:
	__int32 Time;
	char unknown0[512];
	__int32 Uav;
	char unknown1[384];
	__int32 SpreadValue;
}CGS_T;
insane best man
#17 ·
Code:
Name: Magic Number | Server ID | Match ID
Offset: 0xFF5058
Length: 4-Bytes || DWORD
Value: Changes with each game
Use: Can be used to exploit a command to end games on unpatched versions of MW3 (TeknoMW3 Only)
HOW TO USE:

typedef (__cdecl* ProcessCommand)(int zero, char* Cmd); //Define ProcessCommand
ProcessCommand endRoundProcess = 0x429920; //Instantiate(Proper Context for C++?) The "endRoundProcess". Similar to CBuf_AddText, you can use either.

char buf[30]; //Create the buffer

sprintf_s(buf, "mr %d -1 endround;", *(int*)0xFF5058); //Put the magic number in the endround command
endRoundProcess(0, buf); //Send it to be processed.
#18 · edited ·
Just for the record.. MagicNumber = ServerID Dunno why everybody call it MagicNumber
#19 ·
Quote Originally Posted by MarkHC View Post
Just for the record.. MagicNumber = ServerID Dunno why everybody call it MagicNumber
Meh it's more like the current match's id. It changes every map rotate.
Plus I head Nukem call it that....easier to call it that than make a name
#20 ·
I read all the addresses but IW5M are very less can anyone tell me how can i find Addresses (Cheat Engine yeah but Confuse which address is for what?)
#21 ·
Here's the address I used to draw the nametags for my newest release.
IW5M/Tekno Address:

Code:

CG_DrawOverheadName ............ 0x00588A10


You can use it like @barata55 and typedef it ->
Code:
typedef (__cdecl* sub_588A10)(int cg_ClientNum, Entity cEntity, float alphaValue);
sub_588A10 origFunc = (sub_588A10)0x00588A10;


Then loop through each entity filtering the enemies or every player and draw their names by changing alphaVal to 1.0f ->
Code:
for(int i=0; i<MAXENTITIES; i++)
{
  if(cEntity.Type == ET_PLAYER && cEntity.IsValid && (cEntity.IsAlive & 1))
         origFunc(CG->localClientNumber, cEntity, 1.0f);
}



::::::::::OR:::::::::::

You can hook it to make and toggle like I did which is useful if you don't use the Entity structure:

Code:
typedef (__cdecl *sub_588A10)(int var1, var2, float alpha);
sub_588A10 origFunc = NULL;

//Function to draw the names if they were to be draw ->
void __cdecl DrawNames(uint var1, uint var2, float alphaVal)
{
     if(ShouldNamesBeDrawn) return origFunc(var1, var2, 1.0f);
     else return origFunc(var1, var2, alphaVal);
}

//Our hook, six bytes long)
origFunc = (sub_588A10)DetourFunction((PBYTE)0x00588A10, (PBYTE)&DrawNames, 6);


Credits: KingOrgy(Tutorial Which Made me do something similar), @barata55(Inspiration+Method A) and @Kenshin13(Finding the mofo)

 
If you wanna update the offset...


This is how I found it. (Using IDA)
Look for a referenced string: "cg_friendlyNameFadeIn"
You may also try to find it using any of the following also:
Code:
[B]
  LODWORD(dword_8FAB74) = sub_4A5CF0((int)"cg_overheadNamesSize", 0.6499999761581421, 0.0, 100.0, 4);
  dword_8FAA80 = sub_4A5CF0((int)"cg_overheadNamesNearDist", 64.0, 0.0, 3.402823466385289e38, 4);
  dword_8FAB4C = sub_4A5CF0((int)"cg_overheadNamesFarDist", 512.0, 0.0, 3.402823466385289e38, 4);
  dword_B0A7E4 = sub_4A5CF0((int)"cg_overheadIconSize", 1.100000023841858, 0.0, 100.0, 4);
  dword_8FAB24 = sub_4A5CF0((int)"cg_overheadNamesFarScale", 0.699999988079071, 0.0, 3.402823466385289e38, 4);
  dword_8FF0F8 = sub_4A5CF0((int)"cg_overheadRankSize", 0.5, 0.0, 3.402823466385289e38, 4);
  dword_B04640 = sub_4A5CF0((int)"cg_overheadTitleSize", 0.5, 0.0, 3.402823466385289e38, 4);
  dword_B04684 = sub_44EB50((int)"cg_overheadNamesGlow", 0.0, 0.0, 0.0, 1.0, 4);
  dword_8FAB98 = sub_50C760((unsigned int)"cg_overheadNamesFont", 2, 0, 10, 4);
  dword_8FAAA4 = sub_50C760((unsigned int)"cg_friendlyNameFadeOut", 1500, 0, 2147483647, 4);
[B]
Which will lead you to this:
Code:
dword_8FAB48 = sub_50C760((unsigned int)"cg_friendlyNameFadeIn", 0, 0, 2147483647, 4);
Now if you cross-reference 0x8FAB48, you should get only one other function:
Code:
void __usercall sub_5891B0(int a1<eax>, char a2<cl>, int a3, int a4)
{
  char v4; // bl@1
  int v5; // ebp@1
  int v6; // esi@6
  int v7; // edi@8
  char v8; // cl@13
  int *v9; // edx@18
  int v10; // eax@21
  int v11; // edx@21
  signed int v12; // ecx@21
  int v13; // edi@21
  int v14; // esi@21
  double v15; // st7@22
  int v16; // [sp+1Ch] [bp-18h]@1
  int v17; // [sp+20h] [bp-14h]@1
  int v18; // [sp+24h] [bp-10h]@1
  int v19; // [sp+28h] [bp-Ch]@1
  int v20; // [sp+2Ch] [bp-8h]@1
  int v21; // [sp+30h] [bp-4h]@1
  char v22; // [sp+38h] [bp+4h]@4
  int v23; // [sp+38h] [bp+4h]@23
  float v24; // [sp+38h] [bp+4h]@26

  v4 = a2;
  v16 = *(_DWORD *)(dword_8FAAB0 + 12);
  v17 = *(_DWORD *)(dword_B0466C + 12);
  v5 = a3;
  v18 = *(_DWORD *)(dword_8FAB48 + 12); //This is our cross-referenced function.
  v19 = *(_DWORD *)(dword_8FAAA4 + 12);
  v20 = 250;
  v21 = 250;
  v22 = a1 == 3 || a1 && a1 == dword_9FC764[344 * a4];
  v6 = LODWORD(dword_96A25C);
  if ( (unsigned __int8)sub_4A5CA0(v5) )
    v6 = sub_4BB3E0();
  v7 = sub_481FA0(v5);
  if ( (unsigned __int8)sub_489F70(v5) )
    v7 = 0;
  if ( v7 >= *(_DWORD *)(dword_8FAAB0 + 12) )
    v4 = 0;
  if ( v4 )
  {
    v8 = LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]);
    if ( !(v8 & 1) )
    {
      LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]) = v8 | 1;
      dword_8F3980[3 * (a4 + 18 * v5) + 1] = v6;
    }
    dword_8F3980[3 * (a4 + 18 * v5)] = v6;
  }
  else
  {
    LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]) &= 0xFEu;
  }
  if ( v7 <= 0 )
  {
    v9 = &v18;
    if ( !v22 )
      v9 = &v20;
  }
  else
  {
    v9 = &v16;
  }
  v12 = v9[1];
  v13 = *v9;
  v11 = dword_8F3980[3 * (a4 + 18 * v5)];
  v10 = dword_8F3980[3 * (a4 + 18 * v5) + 1];
  v14 = v6 - v11;
  if ( v14 < v12 )
  {
    v23 = v11 - v10;
    if ( v11 - v10 >= v13 )
      v15 = (double)(v12 - v14) / (double)v12;
    else
      v15 = (double)v23 / (double)v13;
  }
  else
  {
    v15 = 0.0;
  }
  v24 = v15;
  sub_588A10(v13, v5, (int)((char *)&unk_A08630 + 504 * a4), v24);
}
Good shit eh?
Looking at the bottom, you'll see that sub_588A10 is what takes the parameters. Therefore 0x588A10 is our function.

For the parameters:
Code:
void __usercall sub_588A10(char a1<dil>, int a2, int a3, float a4)
So we get our typedef:
Code:
typedef (__cdecl* sub_588A10)(int a2, int a3, float a4);
Voila.
#22 · edited ·
Quote Originally Posted by Kenshin13 View Post
bla bla bla coding stuff.. bla bla bla
 
If you wanna update the offset...


This is how I found it. (Using IDA)
Look for a referenced string: "cg_friendlyNameFadeIn"
You may also try to find it using any of the following also:
Code:
[B]
  LODWORD(dword_8FAB74) = sub_4A5CF0((int)"cg_overheadNamesSize", 0.6499999761581421, 0.0, 100.0, 4);
  dword_8FAA80 = sub_4A5CF0((int)"cg_overheadNamesNearDist", 64.0, 0.0, 3.402823466385289e38, 4);
  dword_8FAB4C = sub_4A5CF0((int)"cg_overheadNamesFarDist", 512.0, 0.0, 3.402823466385289e38, 4);
  dword_B0A7E4 = sub_4A5CF0((int)"cg_overheadIconSize", 1.100000023841858, 0.0, 100.0, 4);
  dword_8FAB24 = sub_4A5CF0((int)"cg_overheadNamesFarScale", 0.699999988079071, 0.0, 3.402823466385289e38, 4);
  dword_8FF0F8 = sub_4A5CF0((int)"cg_overheadRankSize", 0.5, 0.0, 3.402823466385289e38, 4);
  dword_B04640 = sub_4A5CF0((int)"cg_overheadTitleSize", 0.5, 0.0, 3.402823466385289e38, 4);
  dword_B04684 = sub_44EB50((int)"cg_overheadNamesGlow", 0.0, 0.0, 0.0, 1.0, 4);
  dword_8FAB98 = sub_50C760((unsigned int)"cg_overheadNamesFont", 2, 0, 10, 4);
  dword_8FAAA4 = sub_50C760((unsigned int)"cg_friendlyNameFadeOut", 1500, 0, 2147483647, 4);
[B]
Which will lead you to this:
Code:
dword_8FAB48 = sub_50C760((unsigned int)"cg_friendlyNameFadeIn", 0, 0, 2147483647, 4);
Now if you cross-reference 0x8FAB48, you should get only one other function:
Code:
void __usercall sub_5891B0(int a1<eax>, char a2<cl>, int a3, int a4)
{
  char v4; // bl@1
  int v5; // ebp@1
  int v6; // esi@6
  int v7; // edi@8
  char v8; // cl@13
  int *v9; // edx@18
  int v10; // eax@21
  int v11; // edx@21
  signed int v12; // ecx@21
  int v13; // edi@21
  int v14; // esi@21
  double v15; // st7@22
  int v16; // [sp+1Ch] [bp-18h]@1
  int v17; // [sp+20h] [bp-14h]@1
  int v18; // [sp+24h] [bp-10h]@1
  int v19; // [sp+28h] [bp-Ch]@1
  int v20; // [sp+2Ch] [bp-8h]@1
  int v21; // [sp+30h] [bp-4h]@1
  char v22; // [sp+38h] [bp+4h]@4
  int v23; // [sp+38h] [bp+4h]@23
  float v24; // [sp+38h] [bp+4h]@26

  v4 = a2;
  v16 = *(_DWORD *)(dword_8FAAB0 + 12);
  v17 = *(_DWORD *)(dword_B0466C + 12);
  v5 = a3;
  v18 = *(_DWORD *)(dword_8FAB48 + 12); //This is our cross-referenced function.
  v19 = *(_DWORD *)(dword_8FAAA4 + 12);
  v20 = 250;
  v21 = 250;
  v22 = a1 == 3 || a1 && a1 == dword_9FC764[344 * a4];
  v6 = LODWORD(dword_96A25C);
  if ( (unsigned __int8)sub_4A5CA0(v5) )
    v6 = sub_4BB3E0();
  v7 = sub_481FA0(v5);
  if ( (unsigned __int8)sub_489F70(v5) )
    v7 = 0;
  if ( v7 >= *(_DWORD *)(dword_8FAAB0 + 12) )
    v4 = 0;
  if ( v4 )
  {
    v8 = LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]);
    if ( !(v8 & 1) )
    {
      LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]) = v8 | 1;
      dword_8F3980[3 * (a4 + 18 * v5) + 1] = v6;
    }
    dword_8F3980[3 * (a4 + 18 * v5)] = v6;
  }
  else
  {
    LOBYTE(dword_8F3980[3 * (a4 + 18 * v5) + 2]) &= 0xFEu;
  }
  if ( v7 <= 0 )
  {
    v9 = &v18;
    if ( !v22 )
      v9 = &v20;
  }
  else
  {
    v9 = &v16;
  }
  v12 = v9[1];
  v13 = *v9;
  v11 = dword_8F3980[3 * (a4 + 18 * v5)];
  v10 = dword_8F3980[3 * (a4 + 18 * v5) + 1];
  v14 = v6 - v11;
  if ( v14 < v12 )
  {
    v23 = v11 - v10;
    if ( v11 - v10 >= v13 )
      v15 = (double)(v12 - v14) / (double)v12;
    else
      v15 = (double)v23 / (double)v13;
  }
  else
  {
    v15 = 0.0;
  }
  v24 = v15;
  sub_588A10(v13, v5, (int)((char *)&unk_A08630 + 504 * a4), v24);
}
Good shit eh?
Looking at the bottom, you'll see that sub_588A10 is what takes the parameters. Therefore 0x588A10 is our function.

For the parameters:
Code:
void __usercall sub_588A10(char a1<dil>, int a2, int a3, float a4)
So we get our typedef:
Code:
typedef (__cdecl* sub_588A10)(int a2, int a3, float a4);
Voila.
http://www.mpgh.net/forum/604-call-d...ml#post6691749 Although I didn't bother to make a complete tutorial for this.. so good job bro
#23 · edited ·
Quote Originally Posted by MarkHC View Post
http://www.mpgh.net/forum/604-call-d...ml#post6691749 Although I didn't bother to make a complete tutorial for this.. so good job bro
You posted that? :O
Never even saw it...
LoL It works with other strings to...I tried 3 others.
And KingOrgy searched for a seperate string....He never searched "cg_friendlyNamesFadeIn" (or Out for that matter.) You found that yourself? :P
Well at least in the tutorial I saw.
#24 ·
Some Shit I just found:

 
FINALLY Teh No-Spread Offsets!

Code:
SpreadMultiplier.........0x0043375A
GetWeaponSpread..........0x004E1130
GetSpreadSeed............0x0096A25C
GetRandomSpread..........0x005E0BC0
Credits: Sfab1 For 1.5.387 Offsets, Me.
#25 ·
Courtesy @NightmareTX_RETIRED :P

Code:
DrawThermalScreen(The Black-White Screen)
.........0x0042E75E [NOP 5-Bytes Off Here]
.........0x00A03938 [Change this BYTE to 1]

ThermalOverlay(Looks sexy if you disable the above)
.........0x004C1E30 [NOP 5-Bytes Off Here]
.........0x05F9CCC0[Change this BYTE to 1]
Just tested.
#26 · edited ·
Quote Originally Posted by Kenshin13 View Post
Courtesy @NightmareTX_RETIRED :P

Code:
.........0x05F9CCC0[Change this BYTE to 1]
Just tested.
Game Crashes.. on changing that byte to 1.
#27 ·
Quote Originally Posted by mwxplayer View Post
Game Crashes.. on changing that byte to 1.
Ever heard of VirtualProtect() ? I tested it.
#28 ·
1.4.382 (TeknoMW3/IW5M) SP Addresses :
Code:
Primary Ammo - iw5sp.exe+EA9898
Primary Ammo bullets - iw5sp.exe+EA9910
Grenades : iw5sp.exe+EA991C
Flash Grenades : iw5sp.exe+EA9928
#29 ·
Once again, courtesy @NightmareTX_RETIRED

Code:
Server-Client Friction: 0x6DA734
Process Name: iw5mp_server.exe/iw5m_server.exe
Function: Controls friction of objects in a server.
Value Type: Floating-Point.
Default Value: 1000.0
#30 ·
Posts 16–30 of 117 · Page 2 of 8

Post a Reply

Similar Threads

Call of Duty 8 - Modern Warfare 3 (MW3) Hacks & CheatsModern Warfare 3 Source Code / Address Threadlolbielolbie 281 Combat Arms Hack Coding / Programming / Source CodeSource Code Section Thread ListCoderNeverCoderNever 8 Battlefield 3 (BF3) Hacks & CheatsBattlefield 3 Hack Source Code / Reversal ThreadHelperHelper 7 CrossFire Hack Coding / Programming / Source CodeCrossFire Hack Source Code Resource ThreadHeroHero 0 Buying Accounts/Keys/ItemsBuying blackops or modern warefare 3 or modern warfare 2 codes for steamTAtavistavis 4

Tags for this Thread

None

Need help?