Since this stuff is asked on a daily basis i will post some info about it.
Index
- GameGuard
- Weapon hack
- Finding adresses
- Refrences
Note: references are linked below.
1.
GameGuard
Q: What is GameGuard?
A: GameGuard is a detection system that detects and prevents memory changes.
Q: My detour is detected what do i do now?
A: You either bypass GameGuard or you find another way to hook (VMT) or you make a new detour, chaning from present to endscene or others may help to.
Q: I get detected after injecting, what do i do now?
A: Serveral things can get you detect:
- Outdated / detected hacks
- Local modifcation
- Wrong adresses (coding)
- Messing with memory
How you get undetected changes time after time, that's what makes the system so smart.
To prevent detection you either have to bypass GameGuard or you can look at what the issue is. for exmaple:
Code:
mov eax, 56Ch
cmp eax, 4
jne 444
444 -> crash
Let's take this as example, 0x56C gets stored inside eax, then we compare eax to the value 4 if its not equal it jumps to an adress (444 for example) that adress makes the game crash.
So in other words if eax is another value then 4 it will crash.
So we could modify this code with assembly (bypass required):
Code:
void WriteAsm(void * _xAdress, BYTE * _xByte, int _xSize)
{
DWORD dwOldProtection = 0; //We use this to store our old protection status in.
VirtualProtect(_xAdress, _xSize, PAGE_READWRITE, &dwOldProtection); //We store our old protection state inside dwOldProtection
memcpy(_xAdress, (PBYTE)_xByte, _xSize); //We write the bytes to the adress
VirtualProtect(_xAdress, _xSize, dwOldProtection, 0); //We restore the old protection
}
Then we rewrite the cmp eax, 4.
The original bytes from cmp eax, 4 are:
So we rewrite them to our value (for example 2) then the bytes we overwrite are:
We do this by using the WriteAsm function, our function:

The overwriting function will be:
Code:
WriteAsm((void *)0x19485, (PBYTE)"\83\xF8\x02", 3);
Check bypassed aslong as we write our eax (0x56C) to the value of 2.
2.
Weapon hack
Q: What is a weapon hack?
A: Weapon hacks are like the name says it's a hack where you can use diffrent guns then the game allows you.
Q: How do i make a weapon hack?
A: You have to understand how the game works.
The game assings a index value to each weapon, the game checks the value of that index constantly if the value is changes it changes to another gun.
A few examples:
Code:
new sound
index 0
//tado DA_M7
path Weapons\Dagger WR_fire
radius 1000
new sound
index 1
//tado DA_KNUCKLE
path Weapons\Dagger WR_fire
radius 1000
If the weapon index is 0 you will get the DA_M7 knife, if it's one you will get the DA_KNUCKLE, as sample as that.
There are a few ways to code the weapon hack, there is a new one i don't know how that one works so i'm only gonna explain the one that i know works for sure. (atleast used to, things may have changed).
Code:
void Weapon(int index)
{
DWORD dwWeapon = 0x101EC;
if(dwPlayer != 0)
{
*(DWORD*)(dwPlayer + (dwWeapon) ) = index;
*(DWORD*)(dwPlayer + (dwWeapon + 0x2) ) = index;
*(DWORD*)(dwPlayer + (dwWeapon + 0x4) ) = index;
}
}
3.
Finding adresses
Q: Where can i find a good tutorial on how to find adresses?
A: Well there are a few in the source code section, i'm gonna link them below.
Q: Okay, but those are outdated!
A: They may be, they may not be, but the game changes constantly and i can't keep everything up to dated.
But i know for a fact some of those still work, and i did not post them so you see what i'm doing.
I posted them so you could learn the principal of how it works (track & trace, etc).
Q: Why don't the offsets change every update?
A: Because offsets are total diffrent thing.
What actually causes addies to change is the following:
Addies change whenever code around that part is changed.
You can also experiment with it in C++.
For example your code is the following:
This is our original code (imagen it's a game engine).

The assembly code looks the following:

Now we add a piece of code (example) that is the following:
Code:
if(*(DWORD*)0xFF == 3)
{
*(DWORD*)0xCC = 0;
}
Now we have the following code

And the assembly looks diffrent!

That piece of code changed everything below it!!
So the assembly adresses are diffrent.
More to be added.
References
Virtual method table (vmt principal, no hooking).