MPGHThe Dark Arts
RegisterLog in

Walk Through Walls ( + String, + Pattern )

Posts 16–30 of 49 · Page 2 of 4
Im use Crossfire indonesia
n i try Unpack CShell.dll
and Look here WeaponReload

10044651 . BE 507B5110 MOV ESI,CShell_U.10517B50 ; ASCII "WeaponReload"
10044656 . B9 0D000000 MOV ECX,0D
1004465B . 33ED XOR EBP,EBP
1004465D . F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:>
1004465F . 0F85 A5000000 JNZ CShell_U.1004470A
10044665 . 807C24 24 01 CMP BYTE PTR SS:[ESP+24],1
1004466A . 75 32 JNZ SHORT CShell_U.1004469E
1004466C . 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C]
10044670 . 8B48 54 MOV ECX,DWORD PTR DS:[EAX+54]
10044673 . 85C9 TEST ECX,ECX
10044675 . 74 27 JE SHORT CShell_U.1004469E
10044677 . E8 24BF2600 CALL CShell_U.102B05A0
1004467C . 50 PUSH EAX
1004467D . E8 8E8D1F00 CALL CShell_U.1023D410
10044682 . 83C4 04 ADD ESP,4
10044685 . 85C0 TEST EAX,EAX
10044687 . 894424 20 MOV DWORD PTR SS:[ESP+20],EAX
1004468B . 0F84 99250000 JE CShell_U.10046C2A
10044691 . 8BD0 MOV EDX,EAX
10044693 . 81C2 6C040000 ADD EDX,46C
10044699 .^E9 7DFDFFFF JMP CShell_U.1004441B
1004469E > 80FA 01 CMP DL,1
100446A1 . 0F85 83250000 JNZ CShell_U.10046C2A
100446A7 . 8B15 007A5F10 MOV EDX,DWORD PTR DS:[105F7A00] ; CShell_U.106068C0
100446AD . 8BCA MOV ECX,EDX
100446AF . E8 4CD0FEFF CALL CShell_U.10031700
100446B4 . 3B4424 14 CMP EAX,DWORD PTR SS:[ESP+14]
100446B8 . 0F84 6C250000 JE CShell_U.10046C2A
100446BE . 8BCA MOV ECX,EDX
100446C0 . E8 4BD0FEFF CALL CShell_U.10031710
100446C5 . 3B4424 14 CMP EAX,DWORD PTR SS:[ESP+14]
100446C9 . 0F84 5B250000 JE CShell_U.10046C2A
100446CF . 85DB TEST EBX,EBX
100446D1 . 0F84 53250000 JE CShell_U.10046C2A
100446D7 . 0FB783 08F0010>MOVZX EAX,WORD PTR DS:[EBX+1F008]

105F7A00 <=== this right or not?
#16 ·
Quote Originally Posted by Astr3Lune View Post
Im use Crossfire indonesia
n i try Unpack CShell.dll
and Look here WeaponReload

10044651 . BE 507B5110 MOV ESI,CShell_U.10517B50 ; ASCII "WeaponReload"
10044656 . B9 0D000000 MOV ECX,0D
1004465B . 33ED XOR EBP,EBP
1004465D . F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:>
1004465F . 0F85 A5000000 JNZ CShell_U.1004470A
10044665 . 807C24 24 01 CMP BYTE PTR SS:[ESP+24],1
1004466A . 75 32 JNZ SHORT CShell_U.1004469E
1004466C . 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C]
10044670 . 8B48 54 MOV ECX,DWORD PTR DS:[EAX+54]
10044673 . 85C9 TEST ECX,ECX
10044675 . 74 27 JE SHORT CShell_U.1004469E
10044677 . E8 24BF2600 CALL CShell_U.102B05A0
1004467C . 50 PUSH EAX
1004467D . E8 8E8D1F00 CALL CShell_U.1023D410
10044682 . 83C4 04 ADD ESP,4
10044685 . 85C0 TEST EAX,EAX
10044687 . 894424 20 MOV DWORD PTR SS:[ESP+20],EAX
1004468B . 0F84 99250000 JE CShell_U.10046C2A
10044691 . 8BD0 MOV EDX,EAX
10044693 . 81C2 6C040000 ADD EDX,46C
10044699 .^E9 7DFDFFFF JMP CShell_U.1004441B
1004469E > 80FA 01 CMP DL,1
100446A1 . 0F85 83250000 JNZ CShell_U.10046C2A
100446A7 . 8B15 007A5F10 MOV EDX,DWORD PTR DS:[105F7A00] ; CShell_U.106068C0
100446AD . 8BCA MOV ECX,EDX
100446AF . E8 4CD0FEFF CALL CShell_U.10031700
100446B4 . 3B4424 14 CMP EAX,DWORD PTR SS:[ESP+14]
100446B8 . 0F84 6C250000 JE CShell_U.10046C2A
100446BE . 8BCA MOV ECX,EDX
100446C0 . E8 4BD0FEFF CALL CShell_U.10031710
100446C5 . 3B4424 14 CMP EAX,DWORD PTR SS:[ESP+14]
100446C9 . 0F84 5B250000 JE CShell_U.10046C2A
100446CF . 85DB TEST EBX,EBX
100446D1 . 0F84 53250000 JE CShell_U.10046C2A
100446D7 . 0FB783 08F0010>MOVZX EAX,WORD PTR DS:[EBX+1F008]

105F7A00 <=== this right or not?
ClientShell = *(DWORD*)(CShell+0x5F7A00);
DWORD PlayerClient = *(DWORD*)(ClientShell+0x54);
#17 ·
Quote Originally Posted by GoldWhite View Post
ClientShell = *(DWORD*)(CShell+0x5F7A00);
DWORD PlayerClient = *(DWORD*)(ClientShell+0x54);
You use a wrong pointer .
Te right : ClientShell = *(DWORD*)(CShell+0x6068C0);
DWORD PlayerClient = *(DWORD*)(ClientShell+0x54);
And FlyHack offset is : 0x64C @Astr3Lune @GoldWhite
#25 ·
Quote Originally Posted by ramo View Post

You use a wrong pointer .
Te right : ClientShell = *(DWORD*)(CShell+0x6068C0);
DWORD PlayerClient = *(DWORD*)(ClientShell+0x54);
And FlyHack offset is : 0x64C @Astr3Lune @GoldWhite
this offset 0x64C for cf indo ?
#26 ·
Quote Originally Posted by sabatbatu View Post
this offset 0x64C for cf indo ?
I think its the same as CFNA !!
#27 ·
Quote Originally Posted by ramo View Post

I think its the same as CFNA !!
sam the offse?

i use this binary scane

"8B 8C 24 ?? ?? ?? ?? 85 C9 0F 86 ?? ?? ?? ??"

10481B6F 8B8C24 F0050000 MOV ECX,DWORD PTR SS:[ESP+5F0] <===== This is
10481B76 85C9 TEST ECX,ECX
10481B78 0F86 EC000000 JBE CShell.10481C6A
10481B7E 8BBC24 F8050000 MOV EDI,DWORD PTR SS:[ESP+5F8]
10481B85 33C0 XOR EAX,EAX



and pointer Clientshell

look here:


10044651 BE 507B5110 MOV ESI,CShell.10517B50 ; ASCII "WeaponReload"
10044656 B9 0D000000 MOV ECX,0D
1004465B 33ED XOR EBP,EBP
1004465D F3:A6 REPE CMPS BYTE PTR ES:[EDI],BYTE PTR DS:>
1004465F 0F85 A5000000 JNZ CShell.1004470A
10044665 807C24 24 01 CMP BYTE PTR SS:[ESP+24],1
1004466A 75 32 JNZ SHORT CShell.1004469E
1004466C 8B4424 1C MOV EAX,DWORD PTR SS:[ESP+1C]
10044670 8B48 54 MOV ECX,DWORD PTR DS:[EAX+54]
10044673 85C9 TEST ECX,ECX
10044675 74 27 JE SHORT CShell.1004469E
10044677 E8 24BF2600 CALL CShell.102B05A0
1004467C 50 PUSH EAX
1004467D E8 8E8D1F00 CALL CShell.1023D410
10044682 83C4 04 ADD ESP,4
10044685 85C0 TEST EAX,EAX
10044687 894424 20 MOV DWORD PTR SS:[ESP+20],EAX
1004468B 0F84 99250000 JE CShell.10046C2A
10044691 8BD0 MOV EDX,EAX
10044693 81C2 6C040000 ADD EDX,46C
10044699 ^E9 7DFDFFFF JMP CShell.1004441B
1004469E 80FA 01 CMP DL,1
100446A1 0F85 83250000 JNZ CShell.10046C2A
100446A7 8B15 007A5F10 MOV EDX,DWORD PTR DS:[105F7A00] <===Crossfire indonesia ; CShell.106068C0
100446AD 8BCA MOV ECX,EDX
#28 ·
Quote Originally Posted by ramo View Post

You use a wrong pointer .
Te right : ClientShell = *(DWORD*)(CShell+0x6068C0);
DWORD PlayerClient = *(DWORD*)(ClientShell+0x54);
And FlyHack offset is : 0x64C @Astr3Lune @GoldWhite
Pointer for cf indo)) i know fly offset) see my post))
#29 ·
ok thanks.

i wont make Fly hack.

but my base fly hack not work and crash Client MFC sometime
please Fix it GoldWhite

see:
#define CShell_Pointer 0x5F7A00


bool flyhack;

DWORD CShell = (DWORD)GetModuleHandleA(Yuzra);
DWORD pWeaponMgr = *(DWORD*)(CShell + MgrWeapon);
DWORD BASEPLAYER = *(DWORD*)(CShell + CShell_Pointer + 0x54);

if(flyhack)
{
if(GetAsyncKeyState(VK_SHIFT))
{
*(float*)(*(DWORD *)(BASEPLAYER) + 0x5F0) = -2.125f;
}
else
{
*(float*)(*(DWORD *)(BASEPLAYER) + 0x5F0) = 1;
}
}
#18 ·
DWORD PlayerClient = *(DWORD*)(ClientShell+0x54);
if(PlayerClient!=NULL)
{
int FLY=0x64c;//8B 8C 24 ?? ?? ?? ?? 85 C9 0F 86 ?? ?? ?? ??
if(GetAsyncKeyState(VK_SPACE))
{
*(float *)(PlayerClient + FLY) = -3,5;
}
else
{
*(float *)(PlayerClient + FLY) = 1;
}
}
#19 · edited ·
Quote Originally Posted by GoldWhite View Post
DWORD PlayerClient = *(DWORD*)(ClientShell+0x54);
if(PlayerClient!=NULL)
{
int FLY=0x64c;//8B 8C 24 ?? ?? ?? ?? 85 C9 0F 86 ?? ?? ?? ??
if(GetAsyncKeyState(VK_SPACE))
{
*(float *)(PlayerClient + FLY) = -3,5;
}
else
{
*(float *)(PlayerClient + FLY) = 1;
}
}

Work or no ?
#20 ·
Quote Originally Posted by Astr3Lune View Post
Work or no ?
work perfect))

---------- Post added at 04:56 AM ---------- Previous post was at 04:56 AM ----------

Quote Originally Posted by ComboDance View Post
what we should to do with this ?
it's pattern for logger and more...
#22 ·
Quote Originally Posted by GoldWhite View Post
work perfect))

---------- Post added at 04:56 AM ---------- Previous post was at 04:56 AM ----------


it's pattern for logger and more...

#define ClientShell 0x5F7A00

int FLY;

DWORD PlayerClient = *(DWORD*)(ClientShell+0x54);


if(PlayerClient!=NULL)
{
if(GetAsyncKeyState(VK_SPACE))
{
*(float *)(PlayerClient + 0x5F0) = -3.5;
}
else
{
*(float *)(PlayerClient + 0x5F0) = 1;
}


Fly Hack not work Crash CLient MFC


and Wtw_offset scaner Not work
#23 ·
Quote Originally Posted by GoldWhite View Post
work perfect))

---------- Post added at 04:56 AM ---------- Previous post was at 04:56 AM ----------


it's pattern for logger and more...
i don't know this
WTW_Offset = *(DWORD*)(WTW_Offset + 0x?);
i have offset for that then what should we do now?
i see it different from
if (GetAsyncKeyState(VK_RSHIFT))
for (int i=0; i<0x1FF; ++i)
if (*(float*)(pPlayerPointer + 4*i) == 56)
*(float*)(pPlayerPointer + 4*i) = -56;
Please explain for me
#24 ·
Quote Originally Posted by CFHackerExtreme View Post
Pattern:

Code:
DWORD WTW_Offset = 0;
WTW_Offset = FindPattern(CShell, ScanSize, "\x68\x00\x00\x00\x00\x8D\x4C\x24\x2D\x6A\x00\x51\xC6\x44\x24\x34\x00\xE8\x00\x00\x00\x00\x8B\x0D\x00\x00\x00\x00", "x????xxxxxxxxxxxxx????xx????");
WTW_Offset = *(DWORD*)(WTW_Offset + 0x?);
Creditz:

@pceumel - Source out of his Base
@CFHackerExtreme - String, Pattern

Have Fun and give Creditz
what we should to do with this ?
#21 ·
Quote Originally Posted by kmanev073 View Post
can you give more info ? explain how does it work ? does it make client error ?
who cares? if it makes client error use this tutorial
#30 ·
Posts 16–30 of 49 · Page 2 of 4
This thread is closed for replies.

Similar Threads

WarRock - International HacksWalk through wall in velrufVIP-Member 16 CrossFire Hack Coding / Programming / Source CodeWalk through walls?POpoedaniel 15 WarRock - International Hacks[Tut]Walk Through Walls on OharaDeath526Death526 9 Hack RequestsWalk through wallsmpghacc 3 Combat Arms Hacks & Cheatshow to walk through wallsDAdamian11 14

Tags for this Thread

None

Talk with us