Walk Through Walls ( + String, + Pattern )

Here a working Walk Through Walls (WTW) Source:

Source:

Code:

if (GetAsyncKeyState(VK_RSHIFT))
            for (int i=0; i<0x1FF; ++i)
                if (*(float*)(pPlayerPointer + 4*i) == 56)
                            *(float*)(pPlayerPointer + 4*i) = -56;

String:

Code:

StaticMissionName

PS: The String exists 2 times, the second is the right ;)

Pattern:

Code:

DWORD WTW_Offset = 0;
WTW_Offset = FindPattern(CShell, ScanSize, "\x68\x00\x00\x00\x00\x8D\x4C\x24\x2D\x6A\x00\x51\xC6\x44\x24\x34\x00\xE8\x00\x00\x00\x00\x8B\x0D\x00\x00\x00\x00", "x????xxxxxxxxxxxxx????xx????");
WTW_Offset = *(DWORD*)(WTW_Offset + 0x?);

Creditz:

@pceumel - Source out of his Base
@CFHackerExtreme - String, Pattern

Have Fun and give Creditz

do you have the new offset ?

Originally Posted by mamo007

do you have the new offset ?

Give cshell and i will say you new offset)

Originally Posted by GoldWhite

Give cshell and i will say you new offset)

Unpacked CShell i already got it

I don`t use this Source, i use another source.
Search the new offset

String is:

Code:

StaticMissionName

PS: Peace?

Originally Posted by CFHackerExtreme

I don`t use this Source, i use another source.
Search the new offset String is:

Code:

StaticMissionName

PS: Peace?

Peace

/......

Originally Posted by CFHackerExtreme

Here a working Walk Through Walls (WTW) Source:

Source:

Code:

if (GetAsyncKeyState(VK_RSHIFT))
            for (int i=0; i<0x1FF; ++i)
                if (*(float*)(pPlayerPointer + 4*i) == 56)
                            *(float*)(pPlayerPointer + 4*i) = -56;

String:

Code:

StaticMissionName

PS: The String exists 2 times, the second is the right ;)

Pattern:

Code:

DWORD WTW_Offset = 0;
WTW_Offset = FindPattern(CShell, ScanSize, "\x68\x00\x00\x00\x00\x8D\x4C\x24\x2D\x6A\x00\x51\xC6\x44\x24\x34\x00\xE8\x00\x00\x00\x00\x8B\x0D\x00\x00\x00\x00", "x????xxxxxxxxxxxxx????xx????");
WTW_Offset = *(DWORD*)(WTW_Offset + 0x?);

Creditz:

@pceumel - Source out of his Base
@CFHackerExtreme - String, Pattern

Have Fun and give Creditz

can you give more info ? explain how does it work ? does it make client error ?

what update?

thank you for sharing

Thanks

Is this differs from the old one ?. @CFHackerExtreme

String: "StaticMissionName"

100AB0BC 68 DC735210 PUSH CShell.105273DC ; ASCII "StaticMissionName"
100AB0C1 8BCE MOV ECX,ESI
100AB0C3 E8 38B43100 CALL CShell.103C6500
100AB0C8 8BC8 MOV ECX,EAX
100AB0CA E8 919D3300 CALL CShell.103E4E60
100AB0CF 68 FF010000 PUSH 1FF
100AB0D4 8D4C24 29 LEA ECX,DWORD PTR SS:[ESP+29]
100AB0D8 6A 00 PUSH 0
100AB0DA 51 PUSH ECX
100AB0DB C64424 30 00 MOV BYTE PTR SS:[ESP+30],0
100AB0E0 E8 A7DD3E00 CALL CShell.10498E8C ; JMP to MSVCR80.memset
100AB0E5 8B0D F4795F10 MOV ECX,DWORD PTR DS:[105F79F4]
100AB0EB 8B11 MOV EDX,DWORD PTR DS:[ECX]
100AB0ED 8B82 14020000 MOV EAX,DWORD PTR DS:[EDX+214]
100AB0F3 83C4 0C ADD ESP,0C
100AB0F6 68 44755210 PUSH CShell.10527544
100AB0FB 6A 00 PUSH 0
100AB0FD 68 4A5A0000 PUSH 5A4A
100AB102 FFD0 CALL EAX
100AB104 0FB78B B0000000 MOVZX ECX,WORD PTR DS:[EBX+B0]
100AB10B 0FB793 AE000000 MOVZX EDX,WORD PTR DS:[EBX+AE]
100AB112 50 PUSH EAX
100AB113 51 PUSH ECX
100AB114 8B0D F4795F10 MOV ECX,DWORD PTR DS:[105F79F4]
100AB11A 8B01 MOV EAX,DWORD PTR DS:[ECX]
100AB11C 52 PUSH EDX
100AB11D 8B90 14020000 MOV EDX,DWORD PTR DS:[EAX+214]

0x214 this is WTW offset?
105F79F4 this is Clientshell addres?

if chsell.dll is unpacked true))
ClientShell = *(DWORD*)(CShell+0x600BC8);
DWORD PlayerClient = *(DWORD*)(ClientShell+0x54);

How to find 0x600BC8 ?

any name string ClientShell?

because weaponreload see:

10044651 BE 507B5110 MOV ESI,CShell.10517B50 ; ASCII "WeaponReload"
10044656 B9 0D000000 MOV ECX,0D
1004465B 33ED XOR EBP,EBP
1004465D F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:>
1004465F 0F85 A5000000 JNZ CShell.1004470A
10044665 807C24 24 01 CMP BYTE PTR SS:[ESP+24],1
1004466A 75 32 JNZ SHORT CShell.1004469E
1004466C 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C]
10044670 8B48 54 MOV ECX,DWORD PTR DS:[EAX+54]
10044673 85C9 TEST ECX,ECX
10044675 74 27 JE SHORT CShell.1004469E
10044677 E8 24BF2600 CALL CShell.102B05A0
1004467C 50 PUSH EAX
1004467D E8 8E8D1F00 CALL CShell.1023D410
10044682 83C4 04 ADD ESP,4
10044685 85C0 TEST EAX,EAX
10044687 894424 20 MOV DWORD PTR SS:[ESP+20],EAX
1004468B 0F84 99250000 JE CShell.10046C2A
10044691 8BD0 MOV EDX,EAX
10044693 81C2 6C040000 ADD EDX,46C
10044699 ^E9 7DFDFFFF JMP CShell.1004441B
1004469E 80FA 01 CMP DL,1
100446A1 0F85 83250000 JNZ CShell.10046C2A
100446A7 8B15 007A5F10 MOV EDX,DWORD PTR DS:[105F7A00] ; CShell.106068C0

i use loadlib.
wich ClientShell pointer
4 Minutes Ago #13
GoldWhite ??

Originally Posted by Astr3Lune

How to find 0x600BC8 ?

any name string ClientShell?

because weaponreload see:

10044651 BE 507B5110 MOV ESI,CShell.10517B50 ; ASCII "WeaponReload"
10044656 B9 0D000000 MOV ECX,0D
1004465B 33ED XOR EBP,EBP
1004465D F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:>
1004465F 0F85 A5000000 JNZ CShell.1004470A
10044665 807C24 24 01 CMP BYTE PTR SS:[ESP+24],1
1004466A 75 32 JNZ SHORT CShell.1004469E
1004466C 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C]
10044670 8B48 54 MOV ECX,DWORD PTR DS:[EAX+54]
10044673 85C9 TEST ECX,ECX
10044675 74 27 JE SHORT CShell.1004469E
10044677 E8 24BF2600 CALL CShell.102B05A0
1004467C 50 PUSH EAX
1004467D E8 8E8D1F00 CALL CShell.1023D410
10044682 83C4 04 ADD ESP,4
10044685 85C0 TEST EAX,EAX
10044687 894424 20 MOV DWORD PTR SS:[ESP+20],EAX
1004468B 0F84 99250000 JE CShell.10046C2A
10044691 8BD0 MOV EDX,EAX
10044693 81C2 6C040000 ADD EDX,46C
10044699 ^E9 7DFDFFFF JMP CShell.1004441B
1004469E 80FA 01 CMP DL,1
100446A1 0F85 83250000 JNZ CShell.10046C2A
100446A7 8B15 007A5F10 MOV EDX,DWORD PTR DS:[105F7A00] ; CShell.106068C0

i use loadlib.
wich ClientShell pointer
4 Minutes Ago #13
GoldWhite ??

100456B1 BE F8FC5110 MOV ESI,CShell1_.1051FCF8 ; ASCII "WeaponReload"
100456B6 B9 0D000000 MOV ECX,0xD
100456BB 33ED XOR EBP,EBP
100456BD F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:>
100456BF 0F85 A5000000 JNZ CShell1_.1004576A
100456C5 807C24 24 01 CMP BYTE PTR SS:[ESP+0x24],0x1
100456CA 75 32 JNZ SHORT CShell1_.100456FE
100456CC 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+0x1C]
100456D0 8B48 54 MOV ECX,DWORD PTR DS:[EAX+0x54]
100456D3 85C9 TEST ECX,ECX
100456D5 74 27 JE SHORT CShell1_.100456FE
100456D7 E8 14ED2500 CALL CShell1_.102A43F0
100456DC 50 PUSH EAX
100456DD E8 8EBE1E00 CALL CShell1_.10231570
100456E2 83C4 04 ADD ESP,0x4
100456E5 85C0 TEST EAX,EAX
100456E7 894424 20 MOV DWORD PTR SS:[ESP+0x20],EAX
100456EB 0F84 99250000 JE CShell1_.10047C8A
100456F1 8BD0 MOV EDX,EAX
100456F3 81C2 6C040000 ADD EDX,0x46C
100456F9 ^ E9 7DFDFFFF JMP CShell1_.1004547B
100456FE 80FA 01 CMP DL,0x1
10045701 0F85 83250000 JNZ CShell1_.10047C8A
10045707 8B15 C80B6010 MOV EDX,DWORD PTR DS:[0x10600BC8]
1004570D 8BCA MOV ECX,EDX
1004570F E8 2CCAFEFF CALL CShell1_.10032140
10045714 3B4424 14 CMP EAX,DWORD PTR SS:[ESP+0x14]
10045718 0F84 6C250000 JE CShell1_.10047C8A
1004571E 8BCA MOV ECX,EDX
10045720 E8 2BCAFEFF CALL CShell1_.10032150
10045725 3B4424 14 CMP EAX,DWORD PTR SS:[ESP+0x14]
10045729 0F84 5B250000 JE CShell1_.10047C8A
1004572F 85DB TEST EBX,EBX
10045731 0F84 53250000 JE CShell1_.10047C8A
10045737 0FB783 08F00100 MOVZX EAX,WORD PTR DS:[EBX+0x1F008]
1004573E 66:3D FFFF CMP AX,0xFFFF
10045742 0F84 42250000 JE CShell1_.10047C8A
10045748 50 PUSH EAX
10045749 E8 22BE1E00 CALL CShell1_.10231570
1004574E 83C4 04 ADD ESP,0x4
10045751 85C0 TEST EAX,EAX
10045753 894424 20 MOV DWORD PTR SS:[ESP+0x20],EAX
10045757 0F84 2D250000 JE CShell1_.10047C8A
1004575D 8BC8 MOV ECX,EAX
1004575F 81C1 6C040000 ADD ECX,0x46C
10045765 ^ E9 AAFDFFFF JMP CShell1_.10045514
1004576A 8BF8 MOV EDI,EAX

Walk Through Walls ( + String, + Pattern )

Similar Threads

Tags for this Thread