Functions from cracky7

#define ASM_OPKX 0x00466960 #define MEM_POSX 0x00C2B518 #define MEM_POSY 0x00C2B51C #define MEM_POSZ 0x00C2B520 DWORD Callbackbase = (ASM_OPKX+0x13);//posx float PositieX; float PositieY; float PositieZ; void __declspec(naked) playerbase() { __asm { jmp [toccopkon]//jmp tocodecave toccopkon://codecave to opk mov eax, PositieX // PositieX means PositionX add edx, 0D8h mov [edx],eax mov ecx,PositieY mov [edx+4],ecx mov eax,PositieZ jmp [Callbackbase]//jump back to Original code } } if(item.opk==1) { PositieX = *(float*)MEM_POSX; PositieY = *(float*)(MEM_POSX + 0x4); PositieZ = *(float*)(MEM_POSX + 0x8); cdetour->DetourFunc((PBYTE)ASM_OPKX, (PBYTE)playerbase,5); }else { ctool->WriteAsm((void*)ASM_OPKX,(PBYTE)"\x8B\x07\x81\xC2\xD8\x00\x00\x00",8);//off byte eerste 2 regels }

.text:0046695A mov edx, [esi+1BCh] // edx = pointer + 1BC (believe its pointer to struc of all players, i call it basepointer) .text:00466960 mov eax, [edi] // Value of edi is stored in eax. This is the X position (We can use this to store our position in eax, so all players will teleport to us) .text:00466962 add edx, 0D8h // Add 0xD8 to edx (PlayerpositionX = esi+1BC+D8 => basepointer+D8) .text:00466968 mov [edx], eax // Get the value of eax in edx. ( With hack our positionx is in eax. So everybody will teleport to us in X-axis) .text:0046696A mov ecx, [edi+4] // Value of edi+4 is stored in eax. This is the Y position (We can use this to store our position in eax, so all players will teleport to us) .text:0046696D mov [edx+4], ecx // Get the value of eax in edx+4. ( With hack our positiony is in eax. So everybody will teleport to us in Y-axis) .text:00466970 mov eax, [edi+8] // Value of edi+8 is stored in eax. This is the Z position (We can use this to store our position in eax, so all players will teleport to us) .text:00466973 mov edi, [esp+2Ch+var_1C] .text:00466977 mov [edx+8], eax

mov eax, PositieX // Get our position on X-axis in eax add edx, 0D8h // edx+D8 is where enemy position is. mov [edx],eax // Get our positionX in edx, so all enemy players will teleport to us. mov ecx,PositieY // Get our position on Y-axis in eax mov [edx+4],ecx // Get our positionY in edx, so all enemy players will teleport to us. mov eax,PositieZ // Get our position on X-axis in eax jmp [Callbackbase]//jump back to Original code. We will jump back to this part: 00466973 mov edi, [esp+2Ch+var_1C]. This is where we stopped modifying the Original code.

if(item.opk==1)// when opk is turned on { PositieX = *(float*)MEM_POSX; // get our positionX into PositieX (used in opk) PositieY = *(float*)(MEM_POSX + 0x4); // get our positionY into PositieY (used in opk) PositieZ = *(float*)(MEM_POSX + 0x8);// get our positionZ into PositieZ (used in opk) cdetour->DetourFunc((PBYTE)ASM_OPKX, (PBYTE)playerbase,5);// The jmp will be 5 bytes long }else { ctool->WriteAsm((void*)ASM_OPKX,(PBYTE)"\x8B\x07\x81\xC2\xD8\x00\x00\x00",8); } Offbyte explained: .text:00466960 mov eax, [edi] // ASM_OPKX , where we begin our modification (2 bytes long, 0x8B 0x07) .text:00466962 add edx, 0D8h // See above ( 6 bytes long, 0x81 0xC2 0xD8 0x00 0x00 0x00) .text:00466968 mov [edx], eax // because our jmp to jump to codecave is 5 bytes long will need to restore add edx, 0D8h aswell. The offbytes of both will be 0x8B 0x07 0x81 0xC2 0xD8 0x00 0x00 0x00. After this the original code wont go to the place where we modify it.

#define ASM_UNLAMMO1 0x004A7A09 DWORD Callbackunlammo1 = (ASM_UNLAMMO1+0x5); DWORD lowerammo1; DWORD refillammo1; void __declspec(naked) UNLAMMO1() { __asm { jmp [toccunl1]//jmp naar codecave toccunl1://codecave cmp eax, [lowerammo1] je [toccunl1even] mov ecx, eax dec ecx mov [edi],ecx jmp [Callbackunlammo1] toccunl1even: mov ecx, [refillammo1] mov [edi], ecx jmp [Callbackunlammo1]//jump terug naar oorspronkelijke code } } if(item.unlammo11==1) { if(item.unlammo1refill>0) { lowerammo1 = item.unlammo1refill-1; } if(item.unlammo1refillto>0) { refillammo1 = item.unlammo1refillto-1; } cdetour->DetourFunc((PBYTE)ASM_UNLAMMO1, (PBYTE)UNLAMMO1,5); }else { ctool->WriteAsm((PBYTE*)ASM_UNLAMMO1,(PBYTE)"\x8B\xC8\x49\x89\x0F",5); }

//.text:004A7A09 mov ecx, eax // store the amount of bullets in ecx //.text:004A7A0B dec ecx // decrease the amount of bullets by 1 //.text:004A7A0C mov [edi], ecx // Set the new bullet value in edi

DWORD Callbackunlammo1 = (ASM_UNLAMMO1+0x5); // We'll modify the mov ecx,eax and inc ecx and mov [edi],ecx. Those are 5 bytes long so we can jump back to inc dword ptr [esi]. DWORD lowerammo1; DWORD refillammo1; void __declspec(naked) UNLAMMO1() { __asm { jmp [toccunl1]//jmp to codecave toccunl1://codecave cmp eax, [lowerammo1] // compares eax to lowerammo1. In eax was the bulletvalue stored. je [toccunl1even] // jump if eax is equal to lowerammo1, then jump to toccunl1even. So when ur ammo value has reached the value when u want to refill ur ammo. mov ecx, eax // if the bullet value isn't equal to the value when u want to refill. Then decrease the bullets value dec ecx // decrease bullet mov [edi],ecx // set bullets in edi jmp [Callbackunlammo1] // jump back to original code toccunl1even: // when the bulletvalue is equal to the amount of bullets that you want to refill at then: mov ecx, [refillammo1] // put your bullet value that u want to refill to, in ecx. mov [edi], ecx // Put our new bullet value in edi. jmp [Callbackunlammo1]//jump back to oorspronkelijke code } }

if(item.unlammo11==1) // when you turned on the hack { cdetour->DetourFunc((PBYTE)ASM_UNLAMMO1, (PBYTE)UNLAMMO1,5); // activate the codecave, the jmp to codecave is 5 bytes long. if(item.unlammo1refill>0) // when the refill value is 1 or greater so lowerammo1 cant be negative. { lowerammo1 = item.unlammo1refill-1;//put the value from item.unlammo1refill in lowerammo1. This is the ammo value when u want to refill it. } if(item.unlammo1refillto>0) // same as above { refillammo1 = item.unlammo1refillto-1; // put the value where u want to refill to in refillammo1 } }else { ctool->WriteAsm((PBYTE*)ASM_UNLAMMO1,(PBYTE)"\x8B\xC8\x49\x89\x0F",5);//off byte // mov ecx,eax = 0x8B 0xC8 // dec ecx = 0x49 // mov [edi],ecx = 0x89 0x0F }

Huib->AddCategory(" Unl ammo1", Unlammo, &item.unlammo11,2); if(item.unlammo11==1){ Huib->AddItem(" Refill", Tellenunl, &item.unlammo1refill,31); Huib->AddItem(" Refill to", Tellenunl, &item.unlammo1refillto,31); }

These things can all be done easialy with making a jump. But I want to be able to make some extra option for functions.

Quickdraw 1 (primary weapon)

Code:

#define ASM_QUICKDRAW1		0x0053FB93
#define ASM_QUICKDRAW2		0x0053FE2B

DWORD Callbackzoomin = (ASM_QUICKDRAW1-0x2);
DWORD Inzoomtimer;
void __declspec(naked) QUICKDRAW1()
{	
		__asm {
				mov eax, [Inzoomtimer]
				add esp, 10h
				jmp [Callbackzoomin]//jump terug naar oorspronkelijke code
		}
}

if(item.quickdraw1)
	{
		Inzoomtimer = 9-item.quickdraw1;
		cdetour->DetourFunc((PBYTE)ASM_QUICKDRAW1-0x7, (PBYTE)QUICKDRAW1,5);
	}else
	{
		 ctool->WriteAsm((PBYTE*)QUICKDRAW1-0x7,(PBYTE)"\x8B\x02\x83\xC4\x10",5);//off byten 1regel
	}

Quick draw 1 (primary weapon) explained:
The Original code is(this is a long time ago since i made this, so I hope I remember correctly):

Code:

.text:00540176                 mov     edx, [esi+2BCh] // get the value of [esi+2BC] in edx (how many times it will take to zoom in)
.text:0054017C                 mov     eax, [edx] // get value of edx in eax
.text:0054017E                 add     esp, 10h // add 10 bytes to esp
.text:00540181                 cmp     ebx, eax //  compares ebx with eax (ebx is if I remember correctly the value of how many times it looped)
.text:00540183                 jle     loc_54020D// jump if less or equal (jump if it's not completly zoomed in

The standard value of esi+2BC is 9 if im right. So when ebx is 10 (A), then it is completly zoomed in. We want that to happen faster or instantanious.
So I'll make a function that can make the weapon zoom within a second, or a bit faster then normal.

Code:

DWORD Callbackzoomin = (ASM_QUICKDRAW1-0x2);
DWORD Inzoomtimer;
void __declspec(naked) QUICKDRAW1()
{	
		__asm {
				mov eax, [Inzoomtimer] // get our value in eax, so when for example Inzoomtimer is 5, so the weapon will be zoomed in after 5 loops instead of 9.
				add esp, 10h // not really important for us, but must be in it since the jump to this codecade is 5 bytes long. Longer then mov eax, [edx]
				jmp [Callbackzoomin]//jump back to Original code
		}
}

Now we have to make this working:

Code:

if(item.quickdraw1)
	{
		Inzoomtimer = 9-item.quickdraw1; // controlls in menu. When item.quickdraw is getting bigger. Then Inzoomtimer is getting closer to 0(faster)
		cdetour->DetourFunc((PBYTE)ASM_QUICKDRAW1-0x7, (PBYTE)QUICKDRAW1,5); // make codecave
	}else
	{
		 ctool->WriteAsm((PBYTE*)QUICKDRAW1-0x7,(PBYTE)"\x8B\x02\x83\xC4\x10",5);//Off bytes
	}

In menu:
Huib->AddItem(" Quickdraw1", quickdraw, &item.quickdraw1,10);

Quick draw 2(secondary)
For secundary its the same as quickdraw 1. Only some eax etc will change but the logica is the same. So i wont explain that but just give the code.

Code:

DWORD Callbackzoomout = (ASM_QUICKDRAW2-0x2);//posx
DWORD Outzoomtimer;
void __declspec(naked) QUICKDRAW2()
{	
		__asm {
			jmp [tocczoomout]//jmp naar codecave
tocczoomout://codecave
				mov ecx, [Outzoomtimer]
				add esp, 10h
				jmp [Callbackzoomout]//jump terug naar oorspronkelijke code
		}
}

if(item.quickdraw2)
	{
		Outzoomtimer = 9-item.quickdraw2;
		cdetour->DetourFunc((PBYTE)ASM_QUICKDRAW2-0x7, (PBYTE)QUICKDRAW2,5);
	}else
	{
		 ctool->WriteAsm((PBYTE*)QUICKDRAW2-0x7,(PBYTE)"\x8B\x02\x83\xC4\x10",5);//off byten 1regel
	}

Also if you want it easier change:
.text:00540183 jle loc_54020D
into:
.text:00540183 nop (6x) if im right. Then it will zoom in within a second

Code:

No weapon switch time

This can also be done easier, but I want to controll how fast it goes.

Code:

#define ASM_NWST1			0x0053F7B3
#define ASM_NWST2			0x0053F836

DWORD Callbacknwst = (ASM_NWST2+0x8);
DWORD nwsttimer;
void __declspec(naked) NWST()
{	
		__asm {
				add	eax, [nwsttimer]
				pop edi
				mov [esi+21Ch], eax
				jmp [Callbacknwst]
		}
}

if(item.weapswitch>1)
	{
		nwsttimer = item.weapswitch - 1;
		ctool->WriteAsm((PBYTE)ASM_NWST1, (PBYTE)"\x7E\x43",2);
		cdetour->DetourFunc((PBYTE)ASM_NWST2, (PBYTE)NWST,5);
	}
	if(item.weapswitch==1)
	{
		ctool->WriteAsm((PBYTE)ASM_NWST1, (PBYTE)"\x90\x90",2);
	}
	if(item.weapswitch==0)
	{
		ctool->WriteAsm((PBYTE)ASM_NWST1, (PBYTE)"\x7E\x43",2);
		ctool->WriteAsm((PBYTE)ASM_NWST2, (PBYTE)"\x40\x5F\x89\x86\x1C\x02\x00\x00",8);
	}

The first part is (ASM_NWST1):

Code:

.text:0053FDA0                 cmp     eax, [ecx] // compares eax with ecx
.text:0053FDA2                 push    edi 
.text:0053FDA3                 jle     short loc_53FDE8 // jump if less or equal.

We can make it switch imidiatly by making 53FDA3 not jump. We'll do this by nopping it( 0x90 0x90)

The second part is where we can controll how fast you're switching.

.text:0053FE26 inc eax
This is increasing eax by one untill it has reached the end of the weapon switching part. If we can make it so it will increase by 2 everytime it passes. Then switching a weapon will be twice as fast. We can do this by: add eax,2. Now it will be twice as fast. The problem is that inc eax is only one byte and add eax,2 is 3. So it doesnt fit. We need to make a codecave

Code:

DWORD Callbacknwst = (ASM_NWST2+0x8);//nwst
DWORD nwsttimer;
void __declspec(naked) NWST()
{	
		__asm {
				add	eax, [nwsttimer] // add how many times faster u want to go in eax
				pop edi
				mov [esi+21Ch], eax
				jmp [Callbacknwst]//jump terug naar oorspronkelijke code
		}
}

thats how nwst works. I dont feel like explaining it futher since my hand hurts because of this post ^^

Btw Thanks all

Functions from cracky7

Post a Reply

Similar Threads

Tags for this Thread