OutdatedZoom Hack for 4.21

Posts 110 of 10 · Page 1 of 1
Zoom Hack for 4.21
Rewritten from scratch for 4.21!

EDIT: Gave up with trying to post a link to scans/attach the file. So here's the code instead.

Code:
#include <windows.h>
#include <tchar.h>
#include <string>
#include <ddraw.h>
#include <Psapi.h>

HMODULE hDDRAW = nullptr;

typedef HRESULT (WINAPI *DirectDrawCreate_t) (GUID FAR *lpGUID, LPDIRECTDRAW FAR *lplpDD, IUnknown FAR *pUnkOuter);
DirectDrawCreate_t fpDirectDrawCreate = nullptr;
HRESULT WINAPI DirectDrawCreate(GUID FAR *lpGUID, LPDIRECTDRAW FAR *lplpDD, IUnknown FAR *pUnkOuter)
{
    return fpDirectDrawCreate(lpGUID, lplpDD, pUnkOuter);
}

typedef HRESULT (WINAPI *DirectDrawCreateEx_t) (GUID FAR * lpGuid, LPVOID *lplpDD, REFIID iid, IUnknown FAR *pUnkOuter);
DirectDrawCreateEx_t fpDirectDrawCreateEx = nullptr;
HRESULT WINAPI DirectDrawCreateEx(GUID FAR * lpGuid, LPVOID  *lplpDD, REFIID  iid, IUnknown FAR *pUnkOuter)
{
    return fpDirectDrawCreateEx(lpGuid, lplpDD, iid, pUnkOuter);
}

VOID LoadDDRAW()
{
    TCHAR dllPath[MAX_PATH];
    GetSystemDirectory(dllPath, MAX_PATH);
    _tcscat_s(dllPath, MAX_PATH, _T("\\ddraw.dll"));
    hDDRAW = LoadLibrary(dllPath);

    fpDirectDrawCreate = reinterpret_cast<DirectDrawCreate_t>(GetProcAddress(hDDRAW, "DirectDrawCreate"));
    fpDirectDrawCreateEx = reinterpret_cast<DirectDrawCreateEx_t>(GetProcAddress(hDDRAW, "DirectDrawCreateEx"));
}

VOID ExecuteHack()
{
    LoadDDRAW();

    /* Get the base address */
    MODULEINFO mInfo;
    HMODULE hModule = GetModuleHandle(nullptr);
    GetModuleInformation(GetCurrentProcess(), hModule, &mInfo, sizeof(MODULEINFO));
    LPVOID base = mInfo.lpBaseOfDll;

    /* Set the values to change and where to change them */
    byte camValue[] = { 0x00, 0x40, 0x9c, 0x45 };
    auto addressToWrite = reinterpret_cast<DWORD>(base) + 0x0127D1FC;

    /* Do the memory change */
    DWORD oldProtection;
    VirtualProtect(reinterpret_cast<LPVOID>(addressToWrite), 4, PAGE_EXECUTE_READWRITE, &oldProtection);
    memcpy(reinterpret_cast<LPVOID>(addressToWrite), camValue, 4);
    VirtualProtect(reinterpret_cast<LPVOID>(addressToWrite), 4, oldProtection, nullptr);
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
    if (ul_reason_for_call == DLL_PROCESS_ATTACH)
        CreateThread(nullptr, 0, reinterpret_cast<LPTHREAD_START_ROUTINE>(ExecuteHack), nullptr, 0, nullptr);
    return TRUE;
}
Merry Christmas <3
How to find this address 0x0127D1FC
It looks like C, but I can't be sure. What language is it?
What do the byte value stands for ?
camValue[] = { 0x00, 0x40, 0x9c, 0x45 };
Quote Originally Posted by AnonymousLegion91 View Post
It looks like C, but I can't be sure. What language is it?
As long as LoL don't have any client side cheat protection, just use CE
How to find this address 0x0127D1FC
This is an offset of the module base address, pointing to a static address containing a camera zoom value.
Learn windows process memory layout and then learn how to use Cheat Engine if you want to understand how to find it yourself.

What language is it?
It is compiled with a C++ compiler: reinterpret_cast is not a valid C variable casting.

What do the byte value stands for
It is a floating point number egal to 5000.0. The default value of the zoom camera is 2500.0.
So.... how do this work? Where do we put this?
So.... how do this work? Where do we put this?
You have to compile it as a DLL using Visual Studio.
Then you have to inject this DLL in the League of Legends.exe process (with Winject for instance).
But you shouldn't do that. Zoom hacks are bad.
What is a Zoom Hack? Am I the only one not knowing what it means?
It enable you to zoom out (and see the whole map for example)
Or sometime zoom in, and see under the map.
Posts 110 of 10 · Page 1 of 1
This thread is closed for replies.

Similar Threads

Tags for this Thread

None

Need help?