Someon to Help me,how to mak UAV hack,pointer offset

Posts 16–30 of 49 · Page 2 of 4

Originally Posted by HOOSIER

If you dont understand C++ just stay with cheat engine... they would be used as includes for functions of your hack . there is another site that has posted code for some sdk hacking for AVA no recoil is one of them . though if i was you i would just use cheat engine and search like in the video i posted you should be able to find a few nice hacks this way .

Well, I find many soucce code about AVA SDK in ************* forum, but don't know how to use.

for example :

code:

Code:

void NoRecoilSpread (APlayerController* pPC)
{
    for(int i(0); i < (((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread.Count); i++)
    {
        ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread.Data[i] = 0;
    }

    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenDucking = NullSpread;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenDuckingA = NullSpread;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenFalling = NullSpread;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenFallingA = NullSpread;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenMoving = NullSpread;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenMovingA = NullSpread;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenSteady = NullSpread;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenSteadyA = NullSpread;

    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenDucking = NullKickback;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenDuckingA = NullKickback;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenFalling = NullKickback;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenFallingA = NullKickback;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenMoving = NullKickback;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenMovingA = NullKickback;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenSteady = NullKickback;
    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenSteadyA = NullKickback;
    
    for(int i(0); i < (((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickbacks.Count); i++)
    {
        ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickbacks.Data[i].X = 0;
        ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickbacks.Data[i].Y = 0;
    }

    ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Accuracy = 1000;
}

I know these ,but I can't compile it in visualstudio 2012, just missing head file ,#include <???>

where can I find a complete project code which can be compile to .exe ?

Originally Posted by maxrio

Well, I find many soucce code about AVA SDK in ************* forum, but don't know how to use.

for example :

code:

Code:

void NoRecoilSpread (APlayerController* pPC) { for(int i(0); i < (((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread.Count); i++) { ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread.Data[i] = 0; } ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenDucking = NullSpread; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenDuckingA = NullSpread; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenFalling = NullSpread; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenFallingA = NullSpread; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenMoving = NullSpread; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenMovingA = NullSpread; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenSteady = NullSpread; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Spread_WhenSteadyA = NullSpread; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenDucking = NullKickback; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenDuckingA = NullKickback; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenFalling = NullKickback; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenFallingA = NullKickback; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenMoving = NullKickback; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenMovingA = NullKickback; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenSteady = NullKickback; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickback_WhenSteadyA = NullKickback; for(int i(0); i < (((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickbacks.Count); i++) { ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickbacks.Data[i].X = 0; ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Kickbacks.Data[i].Y = 0; } ((AavaWeap_BaseGun*)pPC->Pawn->Weapon)->Accuracy = 1000; }

I know these ,but I can't compile it in visualstudio 2012, just missing head file ,#include <???>

where can I find a complete project code which can be compile to .exe ?

Dude, You're too far from doing that . You will have to create a hook to the engine (UE3) and then make a hook for GetAsyncKey or use it as assembly and then use the hook and the SDK functions . You've to learn C++ .

Originally Posted by Janitor

Why don't you start learning how to code and code basic stuff first . There's really a wide range of helpful YouTube videos that can help you to get into this and start to get familiar with it. I can link you to a few if you would like to.

You do realize that you're on a game hacking forum , right ?

many of us are here for the lulz... or to help people.... not all of us hack XD>..... but yeah good point

What about if you check the Programming Section we have , and tell them your problem ?
@maxrio

Originally Posted by maxrio

No ，thank you for helping me.

I can not find a way to search recoil value, but after that I found the crosshair value ,it is a float value from 0 to 1, 0 is the smallest，and 1 is the biggest. This only can be seen ,but not change any recoil. Can you tell me the principia of recoil ,is folat or 4byte ?

Okay , I do not play AVA right now . But since I made many hacks including recoil hack , I will tell you how .
First , you'll have to get the weapon function .. now you can ask me , how ?
1-Get a shot gun (remington) and a pistol.
2-Open any memory scanner If you have it undetected , switch to the pistol and search in the memory scanner for 4 byte type , value : 1 .
3-Switch to the shot gun and type next scan value : 8 or 9 (depending on how many shots the gun you have shots).
4-Do that again until you find one or two addresses , by this way you will check 2 of those addresses memory . You will find the right one changing when you change the type of the weapon.
5-After you got the right address , this address is the super weapons address . Now you will have to memory browse in the address and scroll down about 20 line and search for the recoil (you will find it easy but you have to scroll down many lines about 20 line) , after you think it is the recoil function , try it and change the value to 0 or 3 or 4 (and freeze the value). If it worked then you found it . Also If you need the rapid fire , it is around in this lines too.

Originally Posted by Coituz

Okay , I do not play AVA right now . But since I made many hacks including recoil hack , I will tell you how .
First , you'll have to get the weapon function .. now you can ask me , how ?
1-Get a shot gun (remington) and a pistol.
2-Open any memory scanner If you have it undetected , switch to the pistol and search in the memory scanner for 4 byte type , value : 1 .
3-Switch to the shot gun and type next scan value : 8 or 9 (depending on how many shots the gun you have shots).
4-Do that again until you find one or two addresses , by this way you will check 2 of those addresses memory . You will find the right one changing when you change the type of the weapon.
5-After you got the right address , this address is the super weapons address . Now you will have to memory browse in the address and scroll down about 20 line and search for the recoil (you will find it easy but you have to scroll down many lines about 20 line) , after you think it is the recoil function , try it and change the value to 0 or 3 or 4 (and freeze the value). If it worked then you found it . Also If you need the rapid fire , it is around in this lines too.

Well, You are really a good man.

I test it for whole night, short gun:SPAS-12 or Blue Skull, pistol:P226 or Wather P38 or Mk23 Socom,
search value 1,then 8 then 1 ,then none, I try and try again, but can not find the value, can you tell me other way?

More, I learn a lot and using D3d wallhack with AVA SDK, the wallhack is success,but AVA sdk for no recoil will crush the game,I set GetAsyncKey END.
I try to find Global Name table and Global Object table in Ollydbg(in game and attach),but can't find it while following tutorial in IDA (the ava.exe is packed by vmp so my IDA can't analyse it).

Originally Posted by maxrio

Well, You are really a good man.

I test it for whole night, short gun:SPAS-12 or Blue Skull, pistol:P226 or Wather P38 or Mk23 Socom,
search value 1,then 8 then 1 ,then none, I try and try again, but can not find the value, can you tell me other way?

More, I learn a lot and using D3d wallhack with AVA SDK, the wallhack is success,but AVA sdk for no recoil will crush the game,I set GetAsyncKey END.
I try to find Global Name table and Global Object table in Ollydbg(in game and attach),but can't find it while following tutorial in IDA (the ava.exe is packed by vmp so my IDA can't analyse it).

About the switching between shot gun and pistol is not available anymore because when you switch from the shot gun to the pistol the address changes , you can also try to make the value 9.
And about the SDK , If you need the no recoil of the game with SDK , I must use Team Viewer so I can see what makes the game crashes.

Originally Posted by maxrio

(the ava.exe is packed by vmp so my IDA can't analyse it).

What's the problem?
1.) Start the Game and inject a bypass (not 100% sure if the bypass is needed).
2.) Wait until the game is loaded.
3.) Download and open a Dump tool like Scylla.
4.) Dump the game.
5.) Open the dump in IDA.

Originally Posted by ccman32

thanks so much,

win7 64， in Game and attached by Ollydbg，I don't know the OEP of exe, can't dump.

win7 64, AVA.exe drag into the ollydbg, using VMP OEP Finder script, when exe load driver, crashed. can't find oep

winXp 32,AVA.exe drag into the ollydbg, using VMP OEP Finder script, when exe load driver, crashed. can't find oep

Originally Posted by Coituz

About the switching between shot gun and pistol is not available anymore because when you switch from the shot gun to the pistol the address changes , you can also try to make the value 9.
And about the SDK , If you need the no recoil of the game with SDK , I must use Team Viewer so I can see what makes the game crashes.

Well,yesterday,I finally find superweapon value, I'll try to find the no recoil and rapid fire value follow the tutorial you teach me!

Originally Posted by maxrio

I did not say anything about using Ollydbg...

Originally Posted by maxrio

anyway,the UAV value 1111 for 8 people and other value repesent ?

For the UAV hack you only have to change one bit(Not byte!) in each soldier struct.

Originally Posted by maxrio

I test it for whole night, short gun:SPAS-12 or Blue Skull, pistol:P226 or Wather P38 or Mk23 Socom,
search value 1,then 8 then 1 ,then none, I try and try again, but can not find the value, can you tell me other way?

It won't work. When you switch guns the Weapon pointer is constantly changing and the struct is being dynamically created thus the location of the addresses are changing too.
You need to learn a bit C++ to get a grasp on how things work on the memory. You need to know what are pointers and structs.

The best way to find pointers is through the debugger as this will give you the true pointer to the memory with the least offsets. When Cheat Engine tries to find for you the pointer it also finds fake pointers. Sometimes in this method is finds for you the true pointer in the bunch of pointers it found, but that's not always.

Anyways, AVA memory is build like this: There is first a pointer to the Player Controller(Unreal Engine 3 thingy) class(class is like a struct) from there you can go anywhere, to your pawn pointer or to other things.

So for example if you wanted to go to your pawn's weapon you'll have to go like this:

Player Controller -> Soldier struct -> Weapon struct -> number of bullets(?)

Player Controller will be a green address(static) then after reading it (4 bytes = pointer) then adding an offset (offset to the soldier) also reading that too you'll go inside the soldier struct, in there you can change the UAV thing, or go to another struct from there, like the Weapon struct of your soldier's weapon.

Originally Posted by maxrio

I try to find Global Name table and Global Object table in Ollydbg(in game and attach),but can't find it while following tutorial in IDA (the ava.exe is packed by vmp so my IDA can't analyse it).

Then use one that attaches to the process after it's loaded like Cheat Engine. They are the same.

You sure are very smart

Originally Posted by Jabberwock

For the UAV hack you only have to change one bit(Not byte!) in each soldier struct.

It won't work. When you switch guns the Weapon pointer is constantly changing and the struct is being dynamically created thus the location of the addresses are changing too.
You need to learn a bit C++ to get a grasp on how things work on the memory. You need to know what are pointers and structs.

The best way to find pointers is through the debugger as this will give you the true pointer to the memory with the least offsets. When Cheat Engine tries to find for you the pointer it also finds fake pointers. Sometimes in this method is finds for you the true pointer in the bunch of pointers it found, but that's not always.

Anyways, AVA memory is build like this: There is first a pointer to the Player Controller(Unreal Engine 3 thingy) class(class is like a struct) from there you can go anywhere, to your pawn pointer or to other things.

So for example if you wanted to go to your pawn's weapon you'll have to go like this:

Player Controller -> Soldier struct -> Weapon struct -> number of bullets(?)

Player Controller will be a green address(static) then after reading it (4 bytes = pointer) then adding an offset (offset to the soldier) also reading that too you'll go inside the soldier struct, in there you can change the UAV thing, or go to another struct from there, like the Weapon struct of your soldier's weapon.

Then use one that attaches to the process after it's loaded like Cheat Engine. They are the same.

Well,thanks!

I'll try to get the UAV bit Value, 1111(2)=15 . In the tutorial map, can only see 3 enemies,maybe the binary value is 0011(2).

I gradually know the meaning of struct in C++,and find the superweapon offset.

Originally Posted by maxrio

I'll try to get the UAV bit Value, 1111(2)=15 . In the tutorial map, can only see 3 enemies,maybe the binary value is 0011(2).

Well, no. In the past we set a 4 bytes address to 1111(10) which is decimal cause we didnt know that the UAV was being stored as a bit. I gradually found that later.
So in conclusion to that as you can see, this number in decimal has more than "1" in base 2(binary). One of them is the UAV.
There is also a bit in that same address that is responsible for the display of the name, HP, rank and distance of the UAV.
In zombie mode it's proven to you that only those things are displayed although the zombies aren't fully UAVed.

Also, the debugger of Cheat Engine may help you to find those responsible bits. But only if you know how to use it, and know a bit of assembly and hexadecimal numbers.