[Source+Info] CrossFire
[Source+Info] CrossFire
Credits - Strife (Fatboy for the pointer)
[php]#include <Windows.h>
#include <d3d9.h>
#include <detours.h>
#pragma comment (lib, "d3d9.lib")
#pragma comment (lib, "detours.lib")
IDirect3DDevice9 * pGameDevice;
////
//BeginScene
////////////////////////
typedef HRESULT(WINAPI* BeginScene_)(LPDIRECT3DDEVICE9 pDevice);
BeginScene_ pBeginScene;
HRESULT WINAPI nBeginScene(LPDIRECT3DDEVICE9 pDevice)
{
_asm NOP;
HRESULT hRet = pBeginScene(pDevice);
return hRet;
}
/*---------*/
////
//EndScene
////////////////////////
typedef HRESULT(WINAPI* EndScene_)(LPDIRECT3DDEVICE9 pDevice);
EndScene_ pEndScene;
HRESULT WINAPI nEndScene(LPDIRECT3DDEVICE9 pDevice)
{
HRESULT hRet = pEndScene(pDevice);
return hRet;
}
/*---------*/
////
///DrawIndexedPrimitive
////////////////////////
typedef HRESULT(WINAPI* DrawIndexedPrimitive_)(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinIndex,
UINT NumVertices, UINT StartIndex, UINT PrimitiveCount);
DrawIndexedPrimitive_ pDrawIndexedPrimitive;
HRESULT WINAPI nDrawIndexedPrimitive(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinIndex,
UINT NumVertices, UINT StartIndex, UINT PrimitiveCount)
{
{ pDevice->SetRenderState( D3DRS_FOGENABLE, false ); }
IDirect3DVertexBuffer9* pStreamData = NULL;
UINT iOffsetInBytes,iStride;
pDevice->GetStreamSource(0,&pStreamData,&iOffsetInBytes,&i Stride);
if ( iStride == 40 )
{
pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
pDevice->SetRenderState( D3DRS_ZFUNC, D3DCMP_NEVER );
}
return pDrawIndexedPrimitive(pDevice, Type, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
}
/*-------------*/
////
///SetStreamSource
///////////////////////
typedef HRESULT(WINAPI* SetStreamSource_)(LPDIRECT3DDEVICE9 pDevice, UINT StreamNumber, IDirect3DVertexBuffer9 * pStreamData, UINT OffsetInBytes, UINT Stride);
SetStreamSource_ pSetStreamSource;
HRESULT WINAPI nSetStreamSource(LPDIRECT3DDEVICE9 pDevice, UINT StreamNumber, IDirect3DVertexBuffer9 * pStreamData, UINT OffsetInBytes, UINT Stride)
{
_asm NOP;
HRESULT hRet = pSetStreamSource(pDevice, StreamNumber, pStreamData, OffsetInBytes, Stride);
return hRet;
}
/*-------------*/
////
//Reset
///////////////////////
typedef HRESULT(WINAPI* Reset_)(LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters);
Reset_ pReset;
HRESULT WINAPI nReset(LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters)
{
_asm NOP;
HRESULT hRet = pReset(pDevice, pPresentationParameters);
return hRet;
}
/*-------------*/
DWORD dwWait(LPVOID lpArgs)
{
DWORD Base = NULL;
for (;Base == NULL;Sleep(100))
Base = (DWORD)GetModuleHandle("crossfire.exe");
MessageBox(NULL, "Hack Injected", "Notice", MB_OK); // Confirmation Box
for(;pGameDevice == NULL; Sleep(10000))
{
DWORD dwProtect;
VirtualProtect((void*)(0x70A440), 4, PAGE_EXECUTE_READWRITE, &dwProtect);
memcpy(&pGameDevice, (void*)(0x70A440), 4);
VirtualProtect((void*)(0x70A440), 4, dwProtect, NULL);
}
DWORD* pdwNewDevice =(DWORD*)*(DWORD*)pGameDevice;
pdwNewDevice = (DWORD*)pdwNewDevice[0]; //turn our pointer into an array for the vtable*/
pEndScene = (EndScene_)DetourFunction((PBYTE)pdwNewDevice[42],(PBYTE)nEndScene);
return 0;
}
bool WINAPI DllMain(HMODULE hMod, DWORD dwReason, LPVOID lpReserved)
{
if(dwReason == DLL_PROCESS_ATTACH)
{
CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)dwWait, NULL, NULL, NULL);
return true;
}
return false;
}[/php]
Basic D3D Hook.
[INFO & NOTICE]
You will need the detours lib to compile this in your compiler, which can be found by searching on google. If you get "detoursfunction" undeclared identifier error its because you are using the detours library 2.1 and not the 1.5 (the function was removed in 2.1 for some reason).. If you get a link error stating that it couldnt open detours.lib or some shit, just compile in release mode or ignore it.
EDIT: Uploaded 1.5 detours library and header file
LINK: http://www.*******.com/file/5630576/...Detours15.html
You will still need to download the 2.1 library which can be located at
http://research.microsof*****m/en-us/projects/detours/
And don't forget the D3D9 SDK
http://www.microsof*****m/downloads/d...displaylang=en
[php]"MessageBox(NULL, "Hack Injected", "Notice", MB_OK);" [/php]
All this does is bring up a small window that says the hack was injected upon injection, press ok. It's useless, I really only use it for testing purposes.
-------------
Random Stuff (Credits Fatboy)
D3D
[php]d3dx9_29.dll
BASE: 00740000
0076CA84 FF91 48010000 CALL DWORD PTR DS:[ECX+148]//we can surely jack this call for an undetected hook later on.
0x70A440 static pointer that will lead us to the vtable
Model rec:
Players Stride: 40,44
sky:28[/php]
Steal PWord through injection (log it..)
[php]char Name[21];
char Pw[23];
DWORD MyName;
DWORD MyPw;
Base = (DWORD)GetModuleHandle("CShell.dll");
MyName = (Base + 0x53670C);
MyPw = (Base + 0x536721);[/php]
[php]00650700 55 PUSH EBP
00650701 8BEC MOV EBP,ESP
00650703 83EC 1C SUB ESP,1C
00650706 894D E4 MOV DWORD PTR SS:[EBP-1C],ECX
00650709 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
0065070C 0FB788 C2050000 MOVZX ECX,WORD PTR DS:[EAX+5C2]/
mmmz 
00650713 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
00650716 817D F8 FFFF0000 CMP DWORD PTR SS:[EBP-8],0FFFF
0065071D 75 05 JNZ SHORT crossfir.00650724
0065071F E9 D6000000 JMP crossfir.006507FA
00650724 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
00650727 0FB782 C0050000 MOVZX EAX,WORD PTR DS:[EDX+5C0]
0065072E 50 PUSH EAX
0065072F E8 EC140000 CALL crossfir.00651C20
00650734 8BC8 MOV ECX,EAX
00650736 E8 B5150000 CALL crossfir.00651CF0
0065073B 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0065073E B9 74CE7000 MOV ECX,crossfir.0070CE74
00650743 E8 7886F1FF CALL crossfir.00568DC0
00650748 85C0 TEST EAX,EAX //or here
0065074A 74 0C JE SHORT crossfir.00650758 //turn the boxes on and off here
0065074C 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
0065074F 51 PUSH ECX
00650750 E8 9B850000 CALL crossfir.00658CF0
00650755 83C4 04 ADD ESP,4
00650758 B9 BCCE7000 MOV ECX,crossfir.0070CEBC
0065075D E8 5E86F1FF CALL crossfir.00568DC0
00650762 85C0 TEST EAX,EAX
00650764 74 0C JE SHORT crossfir.00650772
00650766 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
00650769 52 PUSH EDX
0065076A E8 31A90000 CALL crossfir.0065B0A0
0065076F 83C4 04 ADD ESP,4
00650772 B9 A4CE7000 MOV ECX,crossfir.0070CEA4
00650777 E8 4486F1FF CALL crossfir.00568DC0
0065077C 85C0 TEST EAX,EAX
0065077E 74 0E JE SHORT crossfir.0065078E[/php]
[php]class class1
{
public:
float fMoveMentWalkRate; //0000
float fMovementDuckRate; //0004
float fMovementSideRate; //0008
float fMoveMentAcceleration; //000C
float fMoveMentFriction; //0010
float fJumpTime; //0014
float fJumpVelocity; //0018
float fJumpLandedWaitTime; //001C
float fJumpLandedNoTimeRate; //0020
float fJumpRepeatPenaltyMoveRate; //0024
float fJumpRepeatPenaltyHeightRate; //0028
float Unknown0; //002C
float Unknown1; //0030
float fPVPosDefault; //0034
float Unknown2; //0038
float Unknown3; //003C
float fPVRotDefault; //0040
float Unknown4; //0044
float Unknown5; //0048
float fPvModelFov; //004C
float fPvOnlyMoveGap; //0050
float Unknown6; //0054
float Unknown7; //0058
float fDamagePenaltyTime; //005C
float fDamagePenaltyMoveRate; //0060
float fC4PlantTime; //0064
float fC4DefuseTime; //0068
float fMaxCanDefuseDistance; //006C
float fCharcterHiddenAlpha; //0070
float fCharecterHiddenWalkAlpha; //0074
float fCharecterHiddenRunAlpha; //0078
float fMovementHiddenRate; //007C
char unknown8[4];
float fCrossHairColorChangeRateRed; //0084
float Unknown9; //0088
float fCrossHairColorChangeRateGreen; //008C
float Unknown10; //0090
};[/php]
See Ghost
[php]00647910 55 PUSH EBP
00647911 8BEC MOV EBP,ESP
00647913 83EC 08 SUB ESP,8
00647916 894D FC MOV DWORD PTR SS:[EBP-4],ECX
00647919 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0064791C 0FB688 93000000 MOVZX ECX,BYTE PTR DS:[EAX+93]
00647923 81F9 FF000000 CMP ECX,0FF //////////////////cmp ecx,255
00647929 7C 17 JL SHORT crossfir.00647942//////////here nop or JG
0064792B 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0064792E 8B82 88000000 MOV EAX,DWORD PTR DS:[EDX+88]
00647934 83E0 42 AND EAX,42/////////////////////66
00647937 75 09 JNZ SHORT crossfir.00647942
00647939 C745 F8 00000000 MOV DWORD PTR SS:[EBP-8],0
00647940 EB 07 JMP SHORT crossfir.00647949
00647942 C745 F8 01000000 MOV DWORD PTR SS:[EBP-8],1
00647949 8A45 F8 MOV AL,BYTE PTR SS:[EBP-8]
0064794C 8BE5 MOV ESP,EBP
0064794E 5D POP EBP
0064794F C3 RETN[/php]
NoSmoke
[php]0064DB70 55 PUSH EBP
0064DB71 8BEC MOV EBP,ESP
0064DB73 B9 ACCF7000 MOV ECX,crossfir.0070CFAC
0064DB78 E8 43B2F1FF CALL crossfir.00568DC0
0064DB7D 85C0 TEST EAX,EAX
0064DB7F 75 1E JNZ SHORT crossfir.0064DB9F//no smoke
0064DB81 68 40DA6400 PUSH crossfir.0064DA40
0064DB86 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
0064DB89 50 PUSH EAX
0064DB8A 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+C]
0064DB8D 51 PUSH ECX
0064DB8E E8 CD2CFCFF CALL crossfir.00610860
0064DB93 05 6C010000 ADD EAX,16C
0064DB98 8BC8 MOV ECX,EAX
0064DB9A E8 D120FCFF CALL crossfir.0060FC70
0064DB9F 5D POP EBP
0064DBA0 C3 RETN[/php]
Weapinfo
[php]{
public:
BYTE WeaponClass; //0000
BYTE Unknown0; //0001
char Unknown1[32]; //0002
char cSkinFileName[64]; //0022
char cSkinFileName2[64]; //0062
char Unknown2[64]; //00A2
char Unknown3[64]; //00E2
char Unknown4[64]; //0122
char cRenderStyleFileName[64]; //0162
char Unknown5[64]; //01A2
char Unknown6[64]; //01E2
char Unknown7[64]; //0222
char Unknown8[64]; //0262
char Unknown9[64]; //02A2
char Unknown10[64]; //02E2
char Unknown11[64]; //0322
char Unknown12[64]; //0362
char Unknown13[64]; //03A2
char Unknown14[64]; //03E2
char Unknown15[64]; //0422
char Unknown16[64]; //0462
char Unknown17[64]; //04A2
char Unknown18[32]; //04E2
char Unknown19[32]; //0502
char cReloadSoundName[32]; //0522
char cBlowBackSoundName[32]; //0542
char Unknown20[32]; //0562
char cBigIconName[32]; //0582
char cSmallIconName[32]; //05A2
char unknown21[12];
BYTE Unknown22; //05CE
BYTE Unknown23; //05CF
BYTE Unknown24; //05D0
BYTE Unknown25; //05D1
char unknown26[16];
char Unknown27[34]; //05E2
char unknown28[1644];
__int16 iAmmoPerMagazine; //0C70
__int16 iAmmoDamage; //0C72
char unknown29[24];
float MaxAmmo; //0C8C
__int16 iAmmoPerMagazine; //0C90
__int16 iAmmoDamage; //0C92
float iUnlimitedAmmo; //0C94
char unknown30[476];
float Unknown31; //0E74
float Unknown32; //0E78
};[/php]
[php]struct _LocalWorld
{
char unknown0[212];
float Unknown1; //00D4
__int32 iWeapon; //00D8
char unknown2[4];
float Unknown3; //00E0
char unknown4[48];
float fLocalWorldX; //0114
float fLocalWorldY; //0118
float fLocalWorldZ; //011C
char unknown5[12];
float Unknown6; //012C
float Unknown7; //0130
char unknown8[56];
float Unknown9; //016C
};[/php]
Whitewalls/wallhack
[php]005677D0 C745 FC 1CE96B00 MOV DWORD PTR SS:[EBP-4],crossfir.006BE9>; ASCII "ForceMode"
005677D7 8BE5 MOV ESP,EBP
005677D9 5D POP EBP
005677DA C3 RETN
005677DB CC INT3
005677DC CC INT3
005677DD CC INT3
005677DE CC INT3
005677DF CC INT3
005677E0 55 PUSH EBP
005677E1 8BEC MOV EBP,ESP
005677E3 83EC 74 SUB ESP,74
005677E6 894D 90 MOV DWORD PTR SS:[EBP-70],ECX
005677E9 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
005677EC 0FB688 55010000 MOVZX ECX,BYTE PTR DS:[EAX+155]
005677F3 85C9 TEST ECX,ECX
005677F5 74 21 JE SHORT crossfir.00567818
005677F7 6A 03 PUSH 3
005677F9 6A 23 PUSH 23
005677FB 8B55 90 MOV EDX,DWORD PTR SS:[EBP-70]
005677FE 8B0A MOV ECX,DWORD PTR DS:[EDX]
00567800 E8 ABCAFEFF CALL crossfir.005542B0
00567805 6A 00 PUSH 0
00567807 68 8C000000 PUSH 8C
0056780C 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
0056780F 8B08 MOV ECX,DWORD PTR DS:[EAX]
00567811 E8 9ACAFEFF CALL crossfir.005542B0
00567816 EB 1F JMP SHORT crossfir.00567837
00567818 6A 03 PUSH 3
0056781A 68 8C000000 PUSH 8C
0056781F 8B4D 90 MOV ECX,DWORD PTR SS:[EBP-70]
00567822 8B09 MOV ECX,DWORD PTR DS:[ECX]
00567824 E8 87CAFEFF CALL crossfir.005542B0
00567829 6A 00 PUSH 0
0056782B 6A 23 PUSH 23
0056782D 8B55 90 MOV EDX,DWORD PTR SS:[EBP-70]
00567830 8B0A MOV ECX,DWORD PTR DS:[EDX]
00567832 E8 79CAFEFF CALL crossfir.005542B0
00567837 6A 01 PUSH 1////////// white walls
00567839 6A 16 PUSH 16///////D3DRS_LASTPIXEL = 16?? not sure
0056783B 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
0056783E 8B08 MOV ECX,DWORD PTR DS:[EAX]
00567840 E8 6BCAFEFF CALL crossfir.005542B0
00567845 6A 01 PUSH 1/////////////////////////////////NICE WALLHACK ASUS
00567847 6A 07 PUSH 7//////////////////////////////// D3DRS_ZENABLE = 7,
00567849 8B4D 90 MOV ECX,DWORD PTR SS:[EBP-70]
0056784C 8B09 MOV ECX,DWORD PTR DS:[ECX]
0056784E E8 5DCAFEFF CALL crossfir.005542B0[/php]
Weapvals
[php]XmShotgun 0
MP5 2
P90 3
Knife 5
Grenade 6
FlashBang 7
Smoke 8
C4 9
M4A1 11
AK 12
Aug 13
M700 14
AWM 15
M60 17
DragSniper 23
Ak "says 74" 27
"ENgineer gun from BF2 small not shotgun" 28
XM8 30
Gali 32
"Old pistol six shooter" 33
Scar 34
Axe 35
SPAShotgun 36
//creds:whitegun[/php]
NameESP (Cred: Fatboy..)
[php]typedef void (__thiscall *lpDrawEngineString)(unsigned long ulBase, char *String, int x, int y, unsigned long Color, bool Shadow);
lpDrawEngineString DrawEngineString;
DrawEngineString = (lpDrawEngineString )(CShellBase + 0x1899F0);
DrawEngineString(ulBase, "Hello World", 30, 80, D3DCOLOR_XRGB(255, 0, 0), true);[/php]
[php]#include <Windows.h>
#include <d3d9.h>
#include <detours.h>
#pragma comment (lib, "d3d9.lib")
#pragma comment (lib, "detours.lib")
IDirect3DDevice9 * pGameDevice;
////
//BeginScene
////////////////////////
typedef HRESULT(WINAPI* BeginScene_)(LPDIRECT3DDEVICE9 pDevice);
BeginScene_ pBeginScene;
HRESULT WINAPI nBeginScene(LPDIRECT3DDEVICE9 pDevice)
{
_asm NOP;
HRESULT hRet = pBeginScene(pDevice);
return hRet;
}
/*---------*/
////
//EndScene
////////////////////////
typedef HRESULT(WINAPI* EndScene_)(LPDIRECT3DDEVICE9 pDevice);
EndScene_ pEndScene;
HRESULT WINAPI nEndScene(LPDIRECT3DDEVICE9 pDevice)
{
HRESULT hRet = pEndScene(pDevice);
return hRet;
}
/*---------*/
////
///DrawIndexedPrimitive
////////////////////////
typedef HRESULT(WINAPI* DrawIndexedPrimitive_)(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinIndex,
UINT NumVertices, UINT StartIndex, UINT PrimitiveCount);
DrawIndexedPrimitive_ pDrawIndexedPrimitive;
HRESULT WINAPI nDrawIndexedPrimitive(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinIndex,
UINT NumVertices, UINT StartIndex, UINT PrimitiveCount)
{
{ pDevice->SetRenderState( D3DRS_FOGENABLE, false ); }
IDirect3DVertexBuffer9* pStreamData = NULL;
UINT iOffsetInBytes,iStride;
pDevice->GetStreamSource(0,&pStreamData,&iOffsetInBytes,&i Stride);
if ( iStride == 40 )
{
pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
pDevice->SetRenderState( D3DRS_ZFUNC, D3DCMP_NEVER );
}
return pDrawIndexedPrimitive(pDevice, Type, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
}
/*-------------*/
////
///SetStreamSource
///////////////////////
typedef HRESULT(WINAPI* SetStreamSource_)(LPDIRECT3DDEVICE9 pDevice, UINT StreamNumber, IDirect3DVertexBuffer9 * pStreamData, UINT OffsetInBytes, UINT Stride);
SetStreamSource_ pSetStreamSource;
HRESULT WINAPI nSetStreamSource(LPDIRECT3DDEVICE9 pDevice, UINT StreamNumber, IDirect3DVertexBuffer9 * pStreamData, UINT OffsetInBytes, UINT Stride)
{
_asm NOP;
HRESULT hRet = pSetStreamSource(pDevice, StreamNumber, pStreamData, OffsetInBytes, Stride);
return hRet;
}
/*-------------*/
////
//Reset
///////////////////////
typedef HRESULT(WINAPI* Reset_)(LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters);
Reset_ pReset;
HRESULT WINAPI nReset(LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters)
{
_asm NOP;
HRESULT hRet = pReset(pDevice, pPresentationParameters);
return hRet;
}
/*-------------*/
DWORD dwWait(LPVOID lpArgs)
{
DWORD Base = NULL;
for (;Base == NULL;Sleep(100))
Base = (DWORD)GetModuleHandle("crossfire.exe");
MessageBox(NULL, "Hack Injected", "Notice", MB_OK); // Confirmation Box
for(;pGameDevice == NULL; Sleep(10000))
{
DWORD dwProtect;
VirtualProtect((void*)(0x70A440), 4, PAGE_EXECUTE_READWRITE, &dwProtect);
memcpy(&pGameDevice, (void*)(0x70A440), 4);
VirtualProtect((void*)(0x70A440), 4, dwProtect, NULL);
}
DWORD* pdwNewDevice =(DWORD*)*(DWORD*)pGameDevice;
pdwNewDevice = (DWORD*)pdwNewDevice[0]; //turn our pointer into an array for the vtable*/
pEndScene = (EndScene_)DetourFunction((PBYTE)pdwNewDevice[42],(PBYTE)nEndScene);
return 0;
}
bool WINAPI DllMain(HMODULE hMod, DWORD dwReason, LPVOID lpReserved)
{
if(dwReason == DLL_PROCESS_ATTACH)
{
CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)dwWait, NULL, NULL, NULL);
return true;
}
return false;
}[/php]
Basic D3D Hook.
[INFO & NOTICE]
You will need the detours lib to compile this in your compiler, which can be found by searching on google. If you get "detoursfunction" undeclared identifier error its because you are using the detours library 2.1 and not the 1.5 (the function was removed in 2.1 for some reason).. If you get a link error stating that it couldnt open detours.lib or some shit, just compile in release mode or ignore it.
EDIT: Uploaded 1.5 detours library and header file
LINK: http://www.*******.com/file/5630576/...Detours15.html
You will still need to download the 2.1 library which can be located at
http://research.microsof*****m/en-us/projects/detours/
And don't forget the D3D9 SDK
http://www.microsof*****m/downloads/d...displaylang=en
[php]"MessageBox(NULL, "Hack Injected", "Notice", MB_OK);" [/php]
All this does is bring up a small window that says the hack was injected upon injection, press ok. It's useless, I really only use it for testing purposes.
-------------
Random Stuff (Credits Fatboy)
D3D
[php]d3dx9_29.dll
BASE: 00740000
0076CA84 FF91 48010000 CALL DWORD PTR DS:[ECX+148]//we can surely jack this call for an undetected hook later on.
0x70A440 static pointer that will lead us to the vtable
Model rec:
Players Stride: 40,44
sky:28[/php]
Steal PWord through injection (log it..)
[php]char Name[21];
char Pw[23];
DWORD MyName;
DWORD MyPw;
Base = (DWORD)GetModuleHandle("CShell.dll");
MyName = (Base + 0x53670C);
MyPw = (Base + 0x536721);[/php]
[php]00650700 55 PUSH EBP
00650701 8BEC MOV EBP,ESP
00650703 83EC 1C SUB ESP,1C
00650706 894D E4 MOV DWORD PTR SS:[EBP-1C],ECX
00650709 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
0065070C 0FB788 C2050000 MOVZX ECX,WORD PTR DS:[EAX+5C2]/
mmmz 00650713 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
00650716 817D F8 FFFF0000 CMP DWORD PTR SS:[EBP-8],0FFFF
0065071D 75 05 JNZ SHORT crossfir.00650724
0065071F E9 D6000000 JMP crossfir.006507FA
00650724 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
00650727 0FB782 C0050000 MOVZX EAX,WORD PTR DS:[EDX+5C0]
0065072E 50 PUSH EAX
0065072F E8 EC140000 CALL crossfir.00651C20
00650734 8BC8 MOV ECX,EAX
00650736 E8 B5150000 CALL crossfir.00651CF0
0065073B 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0065073E B9 74CE7000 MOV ECX,crossfir.0070CE74
00650743 E8 7886F1FF CALL crossfir.00568DC0
00650748 85C0 TEST EAX,EAX //or here
0065074A 74 0C JE SHORT crossfir.00650758 //turn the boxes on and off here
0065074C 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
0065074F 51 PUSH ECX
00650750 E8 9B850000 CALL crossfir.00658CF0
00650755 83C4 04 ADD ESP,4
00650758 B9 BCCE7000 MOV ECX,crossfir.0070CEBC
0065075D E8 5E86F1FF CALL crossfir.00568DC0
00650762 85C0 TEST EAX,EAX
00650764 74 0C JE SHORT crossfir.00650772
00650766 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
00650769 52 PUSH EDX
0065076A E8 31A90000 CALL crossfir.0065B0A0
0065076F 83C4 04 ADD ESP,4
00650772 B9 A4CE7000 MOV ECX,crossfir.0070CEA4
00650777 E8 4486F1FF CALL crossfir.00568DC0
0065077C 85C0 TEST EAX,EAX
0065077E 74 0E JE SHORT crossfir.0065078E[/php]
[php]class class1
{
public:
float fMoveMentWalkRate; //0000
float fMovementDuckRate; //0004
float fMovementSideRate; //0008
float fMoveMentAcceleration; //000C
float fMoveMentFriction; //0010
float fJumpTime; //0014
float fJumpVelocity; //0018
float fJumpLandedWaitTime; //001C
float fJumpLandedNoTimeRate; //0020
float fJumpRepeatPenaltyMoveRate; //0024
float fJumpRepeatPenaltyHeightRate; //0028
float Unknown0; //002C
float Unknown1; //0030
float fPVPosDefault; //0034
float Unknown2; //0038
float Unknown3; //003C
float fPVRotDefault; //0040
float Unknown4; //0044
float Unknown5; //0048
float fPvModelFov; //004C
float fPvOnlyMoveGap; //0050
float Unknown6; //0054
float Unknown7; //0058
float fDamagePenaltyTime; //005C
float fDamagePenaltyMoveRate; //0060
float fC4PlantTime; //0064
float fC4DefuseTime; //0068
float fMaxCanDefuseDistance; //006C
float fCharcterHiddenAlpha; //0070
float fCharecterHiddenWalkAlpha; //0074
float fCharecterHiddenRunAlpha; //0078
float fMovementHiddenRate; //007C
char unknown8[4];
float fCrossHairColorChangeRateRed; //0084
float Unknown9; //0088
float fCrossHairColorChangeRateGreen; //008C
float Unknown10; //0090
};[/php]
See Ghost
[php]00647910 55 PUSH EBP
00647911 8BEC MOV EBP,ESP
00647913 83EC 08 SUB ESP,8
00647916 894D FC MOV DWORD PTR SS:[EBP-4],ECX
00647919 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0064791C 0FB688 93000000 MOVZX ECX,BYTE PTR DS:[EAX+93]
00647923 81F9 FF000000 CMP ECX,0FF //////////////////cmp ecx,255
00647929 7C 17 JL SHORT crossfir.00647942//////////here nop or JG
0064792B 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0064792E 8B82 88000000 MOV EAX,DWORD PTR DS:[EDX+88]
00647934 83E0 42 AND EAX,42/////////////////////66
00647937 75 09 JNZ SHORT crossfir.00647942
00647939 C745 F8 00000000 MOV DWORD PTR SS:[EBP-8],0
00647940 EB 07 JMP SHORT crossfir.00647949
00647942 C745 F8 01000000 MOV DWORD PTR SS:[EBP-8],1
00647949 8A45 F8 MOV AL,BYTE PTR SS:[EBP-8]
0064794C 8BE5 MOV ESP,EBP
0064794E 5D POP EBP
0064794F C3 RETN[/php]
NoSmoke
[php]0064DB70 55 PUSH EBP
0064DB71 8BEC MOV EBP,ESP
0064DB73 B9 ACCF7000 MOV ECX,crossfir.0070CFAC
0064DB78 E8 43B2F1FF CALL crossfir.00568DC0
0064DB7D 85C0 TEST EAX,EAX
0064DB7F 75 1E JNZ SHORT crossfir.0064DB9F//no smoke
0064DB81 68 40DA6400 PUSH crossfir.0064DA40
0064DB86 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
0064DB89 50 PUSH EAX
0064DB8A 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+C]
0064DB8D 51 PUSH ECX
0064DB8E E8 CD2CFCFF CALL crossfir.00610860
0064DB93 05 6C010000 ADD EAX,16C
0064DB98 8BC8 MOV ECX,EAX
0064DB9A E8 D120FCFF CALL crossfir.0060FC70
0064DB9F 5D POP EBP
0064DBA0 C3 RETN[/php]
Weapinfo
[php]{
public:
BYTE WeaponClass; //0000
BYTE Unknown0; //0001
char Unknown1[32]; //0002
char cSkinFileName[64]; //0022
char cSkinFileName2[64]; //0062
char Unknown2[64]; //00A2
char Unknown3[64]; //00E2
char Unknown4[64]; //0122
char cRenderStyleFileName[64]; //0162
char Unknown5[64]; //01A2
char Unknown6[64]; //01E2
char Unknown7[64]; //0222
char Unknown8[64]; //0262
char Unknown9[64]; //02A2
char Unknown10[64]; //02E2
char Unknown11[64]; //0322
char Unknown12[64]; //0362
char Unknown13[64]; //03A2
char Unknown14[64]; //03E2
char Unknown15[64]; //0422
char Unknown16[64]; //0462
char Unknown17[64]; //04A2
char Unknown18[32]; //04E2
char Unknown19[32]; //0502
char cReloadSoundName[32]; //0522
char cBlowBackSoundName[32]; //0542
char Unknown20[32]; //0562
char cBigIconName[32]; //0582
char cSmallIconName[32]; //05A2
char unknown21[12];
BYTE Unknown22; //05CE
BYTE Unknown23; //05CF
BYTE Unknown24; //05D0
BYTE Unknown25; //05D1
char unknown26[16];
char Unknown27[34]; //05E2
char unknown28[1644];
__int16 iAmmoPerMagazine; //0C70
__int16 iAmmoDamage; //0C72
char unknown29[24];
float MaxAmmo; //0C8C
__int16 iAmmoPerMagazine; //0C90
__int16 iAmmoDamage; //0C92
float iUnlimitedAmmo; //0C94
char unknown30[476];
float Unknown31; //0E74
float Unknown32; //0E78
};[/php]
[php]struct _LocalWorld
{
char unknown0[212];
float Unknown1; //00D4
__int32 iWeapon; //00D8
char unknown2[4];
float Unknown3; //00E0
char unknown4[48];
float fLocalWorldX; //0114
float fLocalWorldY; //0118
float fLocalWorldZ; //011C
char unknown5[12];
float Unknown6; //012C
float Unknown7; //0130
char unknown8[56];
float Unknown9; //016C
};[/php]
Whitewalls/wallhack
[php]005677D0 C745 FC 1CE96B00 MOV DWORD PTR SS:[EBP-4],crossfir.006BE9>; ASCII "ForceMode"
005677D7 8BE5 MOV ESP,EBP
005677D9 5D POP EBP
005677DA C3 RETN
005677DB CC INT3
005677DC CC INT3
005677DD CC INT3
005677DE CC INT3
005677DF CC INT3
005677E0 55 PUSH EBP
005677E1 8BEC MOV EBP,ESP
005677E3 83EC 74 SUB ESP,74
005677E6 894D 90 MOV DWORD PTR SS:[EBP-70],ECX
005677E9 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
005677EC 0FB688 55010000 MOVZX ECX,BYTE PTR DS:[EAX+155]
005677F3 85C9 TEST ECX,ECX
005677F5 74 21 JE SHORT crossfir.00567818
005677F7 6A 03 PUSH 3
005677F9 6A 23 PUSH 23
005677FB 8B55 90 MOV EDX,DWORD PTR SS:[EBP-70]
005677FE 8B0A MOV ECX,DWORD PTR DS:[EDX]
00567800 E8 ABCAFEFF CALL crossfir.005542B0
00567805 6A 00 PUSH 0
00567807 68 8C000000 PUSH 8C
0056780C 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
0056780F 8B08 MOV ECX,DWORD PTR DS:[EAX]
00567811 E8 9ACAFEFF CALL crossfir.005542B0
00567816 EB 1F JMP SHORT crossfir.00567837
00567818 6A 03 PUSH 3
0056781A 68 8C000000 PUSH 8C
0056781F 8B4D 90 MOV ECX,DWORD PTR SS:[EBP-70]
00567822 8B09 MOV ECX,DWORD PTR DS:[ECX]
00567824 E8 87CAFEFF CALL crossfir.005542B0
00567829 6A 00 PUSH 0
0056782B 6A 23 PUSH 23
0056782D 8B55 90 MOV EDX,DWORD PTR SS:[EBP-70]
00567830 8B0A MOV ECX,DWORD PTR DS:[EDX]
00567832 E8 79CAFEFF CALL crossfir.005542B0
00567837 6A 01 PUSH 1////////// white walls
00567839 6A 16 PUSH 16///////D3DRS_LASTPIXEL = 16?? not sure
0056783B 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
0056783E 8B08 MOV ECX,DWORD PTR DS:[EAX]
00567840 E8 6BCAFEFF CALL crossfir.005542B0
00567845 6A 01 PUSH 1/////////////////////////////////NICE WALLHACK ASUS
00567847 6A 07 PUSH 7//////////////////////////////// D3DRS_ZENABLE = 7,
00567849 8B4D 90 MOV ECX,DWORD PTR SS:[EBP-70]
0056784C 8B09 MOV ECX,DWORD PTR DS:[ECX]
0056784E E8 5DCAFEFF CALL crossfir.005542B0[/php]
Weapvals
[php]XmShotgun 0
MP5 2
P90 3
Knife 5
Grenade 6
FlashBang 7
Smoke 8
C4 9
M4A1 11
AK 12
Aug 13
M700 14
AWM 15
M60 17
DragSniper 23
Ak "says 74" 27
"ENgineer gun from BF2 small not shotgun" 28
XM8 30
Gali 32
"Old pistol six shooter" 33
Scar 34
Axe 35
SPAShotgun 36
//creds:whitegun[/php]
NameESP (Cred: Fatboy..)
[php]typedef void (__thiscall *lpDrawEngineString)(unsigned long ulBase, char *String, int x, int y, unsigned long Color, bool Shadow);
lpDrawEngineString DrawEngineString;
DrawEngineString = (lpDrawEngineString )(CShellBase + 0x1899F0);
DrawEngineString(ulBase, "Hello World", 30, 80, D3DCOLOR_XRGB(255, 0, 0), true);[/php]
Originally Posted by teh1337pr0
