Oh I didn't use that for it, actually got the basic technique from a poster on another forum
Code:
#include "CProcess.h"
#include "allshit.h"
CProcess gProcess;
struct LocalPlayer_t
{
DWORD BaseEntity;
int m_fFlags;
int m_lifestate;
int TriggerID;
}LocalPlayer;
void ReadProcessMemory()
{
ReadProcessMemory(gProcess.hProcess, (LPCVOID)(gProcess.dwClient+0x73B29C), &LocalPlayer.BaseEntity, 4, 0); // BaseEntity
ReadProcessMemory(gProcess.hProcess, (LPCVOID)(LocalPlayer.BaseEntity+0x314), &LocalPlayer.m_fFlags, 4, 0); // m_fFlags
ReadProcessMemory(gProcess.hProcess, (LPCVOID)(LocalPlayer.m_lifestate+0x8F), &LocalPlayer.m_lifestate, 4, 0); // m_lifestate
ReadProcessMemory(gProcess.hProcess, (LPCVOID)(LocalPlayer.TriggerID+0x14A8), &LocalPlayer.TriggerID, 4, 0); // EnemyID to Trigger
}
DWORD WINAPI Thread_Trigger( LPVOID lpParam )
{
while(true)
{
ReadProcessMemory();
LocalPlayer.TriggerID--; // TriggerID -1
if(LocalPlayer.TriggerID >= 0 && LocalPlayer.PlayerID < 64)
{
if(GetASyncKeyState(6)) // Mouse5
{
Sleep(15); // TriggerDelay
mouse_event(MOUSEEVENTF_LEFTDOWN, 0, 0, 0, 0);
Sleep(10);
mouse_event(MOUSEEVENTF_LEFTUP, 0, 0, 0, 0);
}
}
}
}
int main()
{
gProcess.Initialize();
CreateThread(0, 0, Thread_Trigger, 0, 0, 0);
}
That's the main.cpp of the source code I based my hack on if you want to take a look at it. It's not really that complex so hopefully easy to identify the crash
Code:
#pragma once
#include <Windows.h>
#include <TlHelp32.h>
class CProcess
{
public:
PROCESSENTRY32 pGame;
HANDLE hProcess;
HWND hwndCss;
DWORD dwClient;
DWORD dwEngine;
DWORD dwOverlay;
DWORD dwVGui;
DWORD dwLibCef;
DWORD dwSteam;
DWORD FindProcess(const char *ccName, PROCESSENTRY32 *pEntry)
{
PROCESSENTRY32 pEntry32;
pEntry32.dwSize = sizeof(PROCESSENTRY32);
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnapshot == INVALID_HANDLE_VALUE) return 0;
if (!Process32First(hSnapshot, &pEntry32))
{
CloseHandle(hSnapshot);
return 0;
}
do
{
if (!strcmpi(pEntry32.szExeFile, ccName))
{
memcpy((void *)pEntry, (void *)&pEntry32, sizeof(PROCESSENTRY32));
CloseHandle(hSnapshot);
return pEntry32.th32ProcessID;
}
} while (Process32Next(hSnapshot, &pEntry32));
CloseHandle(hSnapshot);
return 0;
}
DWORD FindThread(DWORD dwProcess)
{
THREADENTRY32 tEntry32;
tEntry32.dwSize = sizeof(THREADENTRY32);
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (hSnapshot == INVALID_HANDLE_VALUE) return 0;
if (!Thread32First(hSnapshot, &tEntry32))
{
CloseHandle(hSnapshot);
return 0;
}
do
{
if (tEntry32.th32OwnerProcessID == dwProcess)
{
CloseHandle(hSnapshot);
return tEntry32.th32ThreadID;
}
} while (Thread32Next(hSnapshot, &tEntry32));
CloseHandle(hSnapshot);
return 0;
}
DWORD GetModuleBase(LPSTR lpModuleName, DWORD dwProcessId)
{ MODULEENTRY32 lpModuleEntry = {0};
HANDLE hSnapShot = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessId);
if(!hSnapShot)
return NULL;
lpModuleEntry.dwSize = sizeof(lpModuleEntry);
BOOL bModule = Module32First( hSnapShot, &lpModuleEntry );
while(bModule)
{
if(!strcmp(lpModuleEntry.szModule, lpModuleName ) )
{CloseHandle( hSnapShot );
return (DWORD)lpModuleEntry.modBaseAddr;
}
bModule = Module32Next( hSnapShot, &lpModuleEntry );
}
CloseHandle( hSnapShot );
return NULL;
}
void Initialize()
{
while (!FindProcess("hl2.exe", &pGame)) Sleep(10);
while (!(FindThread(pGame.th32ProcessID))) Sleep(10);
hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pGame.th32ProcessID);
dwClient = GetModuleBase("client.dll", pGame.th32ProcessID);
dwEngine = GetModuleBase("engine.dll", pGame.th32ProcessID);
dwOverlay = GetModuleBase("GameOverlayRenderer.dll", pGame.th32ProcessID);
dwVGui = GetModuleBase("vguimatsurface.dll", pGame.th32ProcessID);
dwLibCef = GetModuleBase("libcef.dll", pGame.th32ProcessID);
dwSteam = GetModuleBase("steam.dll", pGame.th32ProcessID);
hwndCss = FindWindow(NULL, "Team Fortress 2");
}
};
extern CProcess gProcess;
Sorry, this may also be useful