Help💡 Looking to develop a player location hook service -- Does it already exist?

Posts 1–9 of 9 · Page 1 of 1

💡 Looking to develop a player location hook service -- Does it already exist?

Hi,

I've spent the past couple of days researching the current state of the DayZ environment (BattlEye, hacks available, etc) and feel I have a basic enough understanding to make a thread and ask a few questions I couldn't easily answer myself. Apologies in advance if I'm repeating an often requested piece of information - I have tried.

I'd like to develop a small hack that'll pull player locations from memory and display them in-game using DX overlays. Doing this shouldn't require any interaction with the server, game DLL modifications, or in-game scripts. The hope here is to keep it clean, simple and avoid detection completely.

Questions:
1. First and foremost - Has this already been done? I don't like to reinvent the wheel. If so, links?
2. Does BattlEye run detections for memory hooks or anything similar? I'm still not entirely knowledgeable as to how deep it goes.
3. Can anyone point to any resources that might be available to shortcut development time? Stuff like player data (location, name) memory offsets, hook code, etc.

If its worth anything, I do intend to open source my developments. I'm mainly doing this for the fun of it, and this is what I tend to do when a game starts to bore me hah.

Originally Posted by strich

1. Yes. Tons of source and full RPM projects have been released. The entire thing is literally handed to you.

2. I've never attempted to reverse or look into BE too much (though dumps have been publicly released), but if you're simply reading player information, you don't need to hook anything. If all you're doing is reading/writing memory, it's very simple. As far as the overlay goes, I'd say use the PEWPEWPEW base for the w2c stuff and DirectX hooking .

3. http://www.mpgh.net/forum/624-dayz-m...r-leeched.html - This thread will get you started, and actually, if all you want is ESP, then it will be all you need. There is a lot more on where the thread originated from. At least in the comments I mean.

For quick ref.

x coord = [ [ [ player ] + 0x18 ] + 0x28 ]

y coord = [ [ [ player ] + 0x18 ] + 0x30 ] (You also have to subtract this value from the map size which varies)

z coord = [ [ [ player ] + 0x18 ] + 0x2C ]

Originally Posted by Woodhouse

1. Yes. Tons of source and full RPM projects have been released. The entire thing is literally handed to you.

2. I've never attempted to reverse or look into BE too much (though dumps have been publicly released), but if you're simply reading player information, you don't need to hook anything. If all you're doing is reading/writing memory, it's very simple. As far as the overlay goes, I'd say use the PEWPEWPEW base for the w2c stuff and DirectX hooking .

3. This thread will get you started, and actually, if all you want is ESP, then it will be all you need. There is a lot more on where the thread originated from. At least in the comments I mean.

Thanks for all the information mate. Looks great. I downloaded the PEWPEWPEW source and meant to review it tonight - I'll make it my main priority.

One thing that bothers me still is the BattlEye scanner - Does it only scan for known public compiled application signatures or does it have the ability to define heuristic signatures as well? I'm getting some conflicting information on what it is able to detect and what one can do to avoid it.

Originally Posted by strich

Really, all Bastian's been able to do to combat against RPM's is add signatures to public releases. As long as you're not recompiling detected public source and your executable doesn't somehow end up in his hands, it should never become detected.

EDIT: Actually, now that I think about it, they tried blocking RPM's a while, but whatever it was (I think they fucked with privileges or something) never affected my project. I've never been banned for the record.

Originally Posted by Woodhouse

Can you summarize what your project does for me? Eg anything special or just plain old DLL injection?

Originally Posted by strich

Can you summarize what your project does for me? Eg anything special or just plain old DLL injection?

No dll needed for mine. Pretty simple executable coded in C. Aside from some strings (x & y coords, nearest player, vehicle and weapon) printed on screen using the the win32 GDI, it's all external. DirectX is a bitch to get working in C. Simple ESP with WPM functions (refile ammo, fix vehicle, hack blood, etc.) and weapon spawning. Have been bouncing between gui and a console project. I've been working through some metamorphic code principals/concepts so that I can release something pretty basic that can never become detected. Every instance of the program being ran will be completely different. All BE can do is add a sig to the original executable that everyone downloads, but once it's ran a few times, all should be well. Though, this has limited me to a console without any sort of UI.

Originally Posted by Woodhouse

Sounds interesting. I'm hoping to move past the memory reading part of my application ASAP so I can focus on a nice DirectX renderer overlay - Fully integrated 3D radar screen overlay, which I've almost already got working. Just need the data!
PM me if you feel like collaborating (I can't due to my access on this site at the moment) - As a professional video game developer I have skills with DX (Can prove it in a PM). Just FYI I have no interest in selling or making a business of whatever I make. Just having some fun.

Originally Posted by Woodhouse

No dll needed for mine. Pretty simple executable coded in C. Aside from some strings (x & y coords, nearest player, vehicle and weapon) printed on screen using the the win32 GDI, it's all external.

Does this mean your using ReadProcessMemory? I was under the impression BattleEye looked out for such things in its scans? No?