💬 How to Update some Stuffs

I Will show you how to update some Stuff's for ESP.

I'm using CrossFire AL CShell.dll

GetNodeTransform:

Code:

101CDB61   68 48883F10      PUSH CShell.103F8848                     ; ASCII "Data.m_pParentTransform"
101CDB66   50               PUSH EAX
101CDB67   FFD5             CALL EBP
101CDB69   8B0B             MOV ECX,DWORD PTR DS:[EBX]
101CDB6B   51               PUSH ECX
101CDB6C   E8 2F81FFFF      CALL CShell.101C5CA0
101CDB71   83C4 1C          ADD ESP,0x1C
101CDB74   807E 04 00       CMP BYTE PTR DS:[ESI+0x4],0x0
101CDB78   0F85 4C010000    JNZ CShell.101CDCCA
101CDB7E   8B0D B0AC4610    MOV ECX,DWORD PTR DS:[0x1046ACB0] //Addy
101CDB84   8B11             MOV EDX,DWORD PTR DS:[ECX]
101CDB86   8B52 34          MOV EDX,DWORD PTR DS:[EDX+0x34] //parms...
101CDB89   6A 01            PUSH 0x1
101CDB8B   8D4424 3C        LEA EAX,DWORD PTR SS:[ESP+0x3C]
101CDB8F   50               PUSH EAX
101CDB90   8B43 10          MOV EAX,DWORD PTR DS:[EBX+0x10]
101CDB93   50               PUSH EAX
101CDB94   8B43 0C          MOV EAX,DWORD PTR DS:[EBX+0xC]
101CDB97   50               PUSH EAX
101CDB98   FFD2             CALL EDX
101CDB9A   85C0             TEST EAX,EAX

GetNodeTransform Code:

Old by @~FALLEN~:

Code:

void GetNodeTransform(cObject* obj,UINT Bone,_Transform* Trans)
{
	if(!CShellBase)
	 return;
       unsigned long LTModel = *(unsigned long*)(CShellBase+0x341758);
	__asm
	{
		mov ecx,LTModel;
		mov edx,dword ptr ds:[ecx];
		mov edx,dword ptr ds:[edx+0x34];
		push 1;
		push Trans;
		push Bone;
		push obj;
		call edx;
	}
}

Updated:

Code:

void GetNodeTransform(cObject* obj,UINT Bone,_Transform* Trans)
{
	DWORD CShell = (DWORD)GetModuleHandleW(L"CShell.dll");

	if( !CShell )
	 return;
	
	DWORD LTModel = *(DWORD *)( CShell + 0x46ACB0 );

	__asm
	{
		mov ecx,LTModel;
		mov edx,dword ptr ds:[ecx];
		mov edx,dword ptr ds:[edx+0x34];
		push 1;
		push Trans;
		push Bone;
		push obj;
		call edx;
	}
}

Is same, but whit Fixed thing's for Newbies.

GetPlayerIndex, ClientInfoClassSize & ClassSize.

Code:

1001FFD0   56               PUSH ESI //0x1FFD0 GetPLayerIndexReturns
1001FFD1   8BF1             MOV ESI,ECX
1001FFD3   0FB686 44740000  MOVZX EAX,BYTE PTR DS:[ESI+0x7444] //ClassSize
1001FFDA   50               PUSH EAX
1001FFDB   E8 60141700      CALL CShell.10191440
1001FFE0   83C4 04          ADD ESP,0x4
1001FFE3   84C0             TEST AL,AL
1001FFE5   75 04            JNZ SHORT CShell.1001FFEB
1001FFE7   0C FF            OR AL,0xFF
1001FFE9   5E               POP ESI
1001FFEA   C3               RETN
1001FFEB   0FB68E 44740000  MOVZX ECX,BYTE PTR DS:[ESI+0x7444]
1001FFF2   69C9 C8040000    IMUL ECX,ECX,0x4C8 //GetPlayerIndex
1001FFF8   8A8431 4C740000  MOV AL,BYTE PTR DS:[ECX+ESI+0x744C] //ClientInfoClassSize
1001FFFF   5E               POP ESI
10020000   C3               RETN

ClientInfo:

Code:

1000F917   68 8C3F3C10      PUSH CShell.103C3F8C                     ; ASCII "rez/Snd2/Ghost/Etc/EscapeAirplane.wav"
1000F91C   E8 2F3B2200      CALL CShell.10233450
1000F921   C2 0400          RETN 0x4
1000F924   CC               INT3
1000F925   CC               INT3
1000F926   CC               INT3
1000F927   CC               INT3
1000F928   CC               INT3
1000F929   CC               INT3
1000F92A   CC               INT3
1000F92B   CC               INT3
1000F92C   CC               INT3
1000F92D   CC               INT3
1000F92E   CC               INT3
1000F92F   CC               INT3
1000F930   81EC 98000000    SUB ESP,0x98
1000F936   A1 84A24610      MOV EAX,DWORD PTR DS:[0x1046A284]
1000F93B   33C4             XOR EAX,ESP
1000F93D   898424 94000000  MOV DWORD PTR SS:[ESP+0x94],EAX
1000F944   A1 88D74610      MOV EAX,DWORD PTR DS:[0x1046D788]
1000F949   53               PUSH EBX
1000F94A   55               PUSH EBP
1000F94B   56               PUSH ESI
1000F94C   57               PUSH EDI
1000F94D   8BF9             MOV EDI,ECX
1000F94F   8B88 E42F0100    MOV ECX,DWORD PTR DS:[EAX+0x12FE4]
1000F955   C601 01          MOV BYTE PTR DS:[ECX],0x1
1000F958   8B15 88D74610    MOV EDX,DWORD PTR DS:[0x1046D788]      //Addy
1000F95E   8B82 E42F0100    MOV EAX,DWORD PTR DS:[EDX+0x12FE4]
1000F964   8B4F 74          MOV ECX,DWORD PTR DS:[EDI+0x74]
1000F967   8948 38          MOV DWORD PTR DS:[EAX+0x38],ECX
1000F96A   33DB             XOR EBX,EBX
1000F96C   899F 80000000    MOV DWORD PTR DS:[EDI+0x80],EBX
1000F972   C647 70 01       MOV BYTE PTR DS:[EDI+0x70],0x1
1000F976   90               NOP
1000F977   E8 742D0363      CALL winmm.timeGetTime
1000F97C   05 88130000      ADD EAX,0x1388
1000F981   6A 7F            PUSH 0x7F
1000F983   8947 7C          MOV DWORD PTR DS:[EDI+0x7C],EAX
1000F986   8B35 88D74610    MOV ESI,DWORD PTR DS:[0x1046D788]        ; CShell.1047BA18
1000F98C   8D5424 29        LEA EDX,DWORD PTR SS:[ESP+0x29]
1000F990   53               PUSH EBX
1000F991   52               PUSH EDX
1000F992   81C6 48740000    ADD ESI,0x7448 //0x7444 + 0x4.

PlayerClient Yaw and Pitch:

Code:

10336836   68 9C6A3F10      PUSH CShell.103F6A9C                     ; ASCII "CameraYawAndPitch%d"
1033683B   8D5424 18        LEA EDX,DWORD PTR SS:[ESP+0x18]
1033683F   68 04010000      PUSH 0x104 ;YAW
10336844   52               PUSH EDX
10336845   FFD5             CALL EBP
10336847   83C4 10          ADD ESP,0x10
1033684A   6A 00            PUSH 0x0
1033684C   6A 00            PUSH 0x0
1033684E   6A 00            PUSH 0x0
10336850   8D46 04          LEA EAX,DWORD PTR DS:[ESI+0x4]
10336853   50               PUSH EAX
10336854   56               PUSH ESI
10336855   53               PUSH EBX
10336856   8D4C24 28        LEA ECX,DWORD PTR SS:[ESP+0x28]
1033685A   51               PUSH ECX
1033685B   6A 0B            PUSH 0xB
1033685D   E8 2E94FFFF      CALL CShell.1032FC90
10336862   8BC8             MOV ECX,EAX
10336864   E8 17EDFFFF      CALL CShell.10335580
10336869   D9EE             FLDZ
1033686B   83C7 01          ADD EDI,0x1
1033686E   83C6 0C          ADD ESI,0xC
10336871   83FF 0D          CMP EDI,0xD
10336874  ^72 9A            JB SHORT CShell.10336810
10336876   5F               POP EDI
10336877   DDD8             FSTP ST
10336879   5D               POP EBP
1033687A   5B               POP EBX
1033687B   8B8C24 08010000  MOV ECX,DWORD PTR SS:[ESP+0x108]
10336882   5E               POP ESI
10336883   33CC             XOR ECX,ESP
10336885   E8 90B80400      CALL CShell.1038211A
1033688A   81C4 08010000    ADD ESP,0x108 ;PITCH

Not sure about that Yaw and Pitch, to have sure, just use Classes.

Thanks @CrazyFrost to Post Binary String.

Binary String: 56 8B F1 0F B6 86 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04

Credits:

@~FALLEN~
@Ginyat101
@gellin
@CrazyFrost

Good work!

to help many people.

Thanks for crediting... There's more efficient ways to do some of this stuff though... might post it later, idk...

nice job, it may works

WoW looks like u spent lots of time on this and work so I thanked even though idk how to use this

assembly? lmao :P

Originally Posted by giniyat101

assembly? lmao :P

You wouldn't believe how many people use my exact code with just updated pointers / offsets... Kind of sad really...

Originally Posted by ~FALLEN~

You wouldn't believe how many people use my exact code with just updated pointers / offsets... Kind of sad really...

i just checked iltmodel and found that GetNodeTransform is #13 pointer in the list, means that 0x34 matches the sdk provided GetNodeTransform .. lol .. just lol.

Originally Posted by giniyat101

i just checked iltmodel and found that GetNodeTransform is #13 pointer in the list, means that 0x34 matches the sdk provided GetNodeTransform .. lol .. just lol.

@giniyat101 Most of the core structs follow the sdk exact / very closely...
@XarutoUsoCrack I see you stole my esp style... cool... p.s the health bars are upside down =/
btw you're doing the line esp wrong... just saying

giniyat... get your ass on msn <3 lol

Thanks For This
CameraYawAndPitch%d

Code:

Base_BoneESP = FindPattern((DWORD)LoadLibraryA(tmp), 0xFFFFFFFF, (PBYTE)"\x8B\x0D\x00\x00\x00\x00\x8B\x44\x24\x00\x8B\x11\x8B\x52\x00\x57\x68", "xx????xxx?xxxx?xx"); Base_BoneESP = *(DWORD*)(Base_BoneESP + 0x2);

Is easy to create a Bone ESP, the GetNodeTransform is 80% of Code.

Originally Posted by XarutoUsoCrack

Is easy to create a Bone ESP, the GetNodeTransform is 80% of Code.

U know for what this pattern ?
Its for Update GetNodeTransform
)

@3D i know that:

I made all this ESP myself.

Of couse, GetNodeTransform of @~FALLEN~ updated by me.

I know that Pattern, nice for you.

Originally Posted by XarutoUsoCrack

@3D i know that:

I made all this ESP myself.

Of couse, GetNodeTransform of @~FALLEN~ updated by me.

I know that Pattern, nice for you.

I know u have it
I dont share for u...
I share it because its will be so easy to update for people

💬 How to Update some Stuffs

Post a Reply

Similar Threads