Wanting to learn to make cheats

You should start with a simple external CS2 project first. Python can be easier for learning the basics, but C++ is generally a better choice for this kind of development. Internal or kernel-level development is much more difficult and not recommended for beginners.

Quote:

Originally Posted by Sheintan You should start with a simple external CS2 project first. Python can be easier for learning the basics, but C++ is generally a better choice for this kind of development. Internal or kernel-level development is much more difficult and not recommended for beginners.

These are all things ill need to learn.

Virtual was the 🔑

True cr3 found, dtb done solely on dma.

Just putting it all together now, Hdcamera up next.

Monumental achievement for 3 weeks

Quote:

Originally Posted by MalwareEnjoyer I’ve seen people cache the memory from physical to virtual memory to speed up reading. Kernel mapping will be the hardest thing you do in your journey. Be creative when you go hunting for a driver. My current driver was from a local mechanic shop used for firmware flashing for cars. Perhaps it would be a good time to learn driver mapping then do cr3 with a driver. That’ll most likely like you find a solution

What books on assembly would you recommend?

Quote:

Originally Posted by suxers These are all things ill need to learn. Virtual was the 🔑 True cr3 found, dtb done solely on dma. Just putting it all together now, Hdcamera up next. Monumental achievement for 3 weeks

are you doing kernel? I think you are foucsing on the wrong thing. Idk what step you at but doing cr3 isnt useful. You need to go into kernel drivers or at least something that can be applied universally.

Doing cr3 cant be applied to everything. 2ndly, this would fall under a bypass but isn't really a bypass anymore and is just the standard.

kernel mapping is what you wanna know 100%

what are you even working on right now?

writing in advance:

learn driver entries, you can normally see whats happening in 2s and know if its exploitable in 2s. If you look at this and know why its exploitable you in a good area but if not. id drop cr3 and move to drivers and x64 arch:

[Only registered and activated users can see links. Click Here To Register...]

[Only registered and activated users can see links. Click Here To Register...]

[Only registered and activated users can see links. Click Here To Register...]

i know its kinda messy but yeah.

this driver is good for small projects off kdmapper. its safe to run alongside without issues. You can download the driver from dirctio.

if you wanna look into it, thus far ive only got and fixing

0x8011E044, 0x8011E048, 0x8011E04C, 0x8011E050,
0x8011E060, 0x8011E064, 0x8011E068, 0x8011E074,
0x8011E080, 0x8011E084, 0x8011E088, 0x8011E08C,
0x8011E090, 0x8011E094, 0x8011E098, 0x8011E09C,
0x8011E0A0, 0x8011E0A4, 0x8011E0A8,
0x80116054, 0x80116058, 0x8011605C, 0x80116078, 0x8011607C,
0x8011B941

[Only registered and activated users can see links. Click Here To Register...]

Quote:

Originally Posted by jaren What books on assembly would you recommend?

doesnt matter really. its like buying clothing. same same

[Only registered and activated users can see links. Click Here To Register...]

Quote:

Originally Posted by MalwareEnjoyer are you doing kernel? I think you are foucsing on the wrong thing. Idk what step you at but doing cr3 isnt useful. You need to go into kernel drivers or at least something that can be applied universally. Doing cr3 cant be applied to everything. 2ndly, this would fall under a bypass but isn't really a bypass anymore and is just the standard. kernel mapping is what you wanna know 100% what are you even working on right now? writing in advance: learn driver entries, you can normally see whats happening in 2s and know if its exploitable in 2s. If you look at this and know why its exploitable you in a good area but if not. id drop cr3 and move to drivers and x64 arch: [Only registered and activated users can see links. Click Here To Register...] [Only registered and activated users can see links. Click Here To Register...] [Only registered and activated users can see links. Click Here To Register...] i know its kinda messy but yeah. this driver is good for small projects off kdmapper. its safe to run alongside without issues. You can download the driver from dirctio. if you wanna look into it, thus far ive only got and fixing 0x8011E044, 0x8011E048, 0x8011E04C, 0x8011E050, 0x8011E060, 0x8011E064, 0x8011E068, 0x8011E074, 0x8011E080, 0x8011E084, 0x8011E088, 0x8011E08C, 0x8011E090, 0x8011E094, 0x8011E098, 0x8011E09C, 0x8011E0A0, 0x8011E0A4, 0x8011E0A8, 0x80116054, 0x80116058, 0x8011605C, 0x80116078, 0x8011607C, 0x8011B941 [Only registered and activated users can see links. Click Here To Register...] doesnt matter really. its like buying clothing. same same [Only registered and activated users can see links. Click Here To Register...]

You're the man, thank you.. I'll start w/ that and follow your road map. Really appreciate the experience you're sharing here. I'm mostly interested in developing tools/bots for MMOs and such.

Quote:

Originally Posted by jaren You're the man, thank you.. I'll start w/ that and follow your road map. Really appreciate the experience you're sharing here. I'm mostly interested in developing tools/bots for MMOs and such.

I dont know what MMOs are but you wouldnt need to learn x64 arch. That's only for driver loading really. You need to know the os 1:1 to load drivers. You can skip that part and just learn like memory and such. not assembly

Quote:

Originally Posted by MalwareEnjoyer I dont know what MMOs are but you wouldnt need to learn x64 arch. That's only for driver loading really. You need to know the os 1:1 to load drivers. You can skip that part and just learn like memory and such. not assembly

Ah I see. Would u still recommend C++ mainly? I'm sort of proficient in C# and I've made a somewhat decent pixel bot for silkroad online (MMO) but that's about it. I guess i just don't know what next logical step is. MMOs are games like world of warcraft, guild wars, etc..


Also I definitely want to learn the foundations of C as I feel that will really broaden my knowledge of programming fundamentals, as I've probably skipped a bunch of important shit.

Quote:

Originally Posted by jaren Ah I see. Would u still recommend C++ mainly? I'm sort of proficient in C# and I've made a somewhat decent pixel bot for silkroad online (MMO) but that's about it. I guess i just don't know what next logical step is. MMOs are games like world of warcraft, guild wars, etc.. Also I definitely want to learn the foundations of C as I feel that will really broaden my knowledge of programming fundamentals, as I've probably skipped a bunch of important shit.

ok

are there anti-cheats + do they HWID ban?

what are the games engines?

what protection are they running?

if they have a anti-cheat plus hwiding.Youd need asmx64 or etc.

if there arent dumpers for your game engine, youd have to reverse it yourself.

if there is protection youd have to reverse it.

it depends on what your goal is and what you wanna do in life. I do system engineering now irl. I got the job through driver loading. No relation but yeah

Quote:

Originally Posted by MalwareEnjoyer ok are there anti-cheats + do they HWID ban? what are the games engines? what protection are they running? if they have a anti-cheat plus hwiding.Youd need asmx64 or etc. if there arent dumpers for your game engine, youd have to reverse it yourself. if there is protection youd have to reverse it. it depends on what your goal is and what you wanna do in life. I do system engineering now irl. I got the job through driver loading. No relation but yeah

I have my BS in software engineering w/ a track in C# but I feel kind of lost because my rl job is not computer related at all but I get paid a lot so.. I do like data and so I've thought about data analysis for my masters but something about making a program that automates something in game gets me excited, know what I mean?

As far as anti-cheat systems.. for a game like silkroad online, which is what I'm currently making tools for (but it is a dying game and really it is just for learning purposes), it uses hackshield or maxiguard.. maxiguard I'm pretty sure is just a .dll filter that is usually bypassed w/ VM. There are also public repos on github w/ working bots that I can look at, but private servers are now implementing this maxiguard protection against regular bots (because they have macro bots in game), which is super ironic. For WoW, this is what google states:

WoW uses Warden anti-cheat to scan memory. It analyzes player behavior for repetitive patterns. The addon API blocks automated gameplay inputs.

Quote:

Originally Posted by jaren I have my BS in software engineering w/ a track in C# but I feel kind of lost because my rl job is not computer related at all but I get paid a lot so.. I do like data and so I've thought about data analysis for my masters but something about making a program that automates something in game gets me excited, know what I mean? As far as anti-cheat systems.. for a game like silkroad online, which is what I'm currently making tools for (but it is a dying game and really it is just for learning purposes), it uses hackshield or maxiguard.. maxiguard I'm pretty sure is just a .dll filter that is usually bypassed w/ VM. There are also public repos on github w/ working bots that I can look at, but private servers are now implementing this maxiguard protection against regular bots (because they have macro bots in game), which is super ironic. For WoW, this is what google states: WoW uses Warden anti-cheat to scan memory. It analyzes player behavior for repetitive patterns. The addon API blocks automated gameplay inputs.

Realistically, I was once like you. That feeling goes away after you make your fist cheat and make couple thousand. I used to be such a happy person when speaking to people. Hello, how are you doing? Etc etc MSP style.

Now after doing it for so long. It’s no longer fun. That feeling is gone. Now I spend lots of time creating a bypass for X Y Z and I don’t have that thrill as much.

So it all goes back to you as a person and what you wanna do in life. It’ll take an extremely long time to fully understand it all. We talking 3 years minimum to even make a bypass for a shitty game at the bare minimum.

I feel sorry for you man but definitely remember the human mind is against you. It’ll never be satisfied. It will always want more or have something to chase. Once you achieve that goal it’s becomes boring and it’s more so. What’s next?

Life is like gta5 man. When you play it with friends and mess around it’s fun. When you just mod your money it’s boring. Enjoy and appreciate the things you have not what don’t you have. Follow what you genuinely see yourself doing for extended periods of time.

If you wanna start your journey get into assembly and it’ll all fall together. Assembly because that’s more towards the os and I’d say that’s more beneficial then learning the cheat logic side of things. Learning the OS will also help you land a job easily in the future.

I know I said previously don’t do assembly but from that message I definitely recommend it. Like I said previously. Don’t go into this with the mindset of cheats. Don’t even think of that. Understand what happens internally then in the future start applying that knowledge to the cheat logic

Quote:

Originally Posted by MalwareEnjoyer are you doing kernel? I think you are foucsing on the wrong thing. Idk what step you at but doing cr3 isnt useful. You need to go into kernel drivers or at least something that can be applied universally. Doing cr3 cant be applied to everything. 2ndly, this would fall under a bypass but isn't really a bypass anymore and is just the standard. kernel mapping is what you wanna know 100% what are you even working on right now? writing in advance: learn driver entries, you can normally see whats happening in 2s and know if its exploitable in 2s. If you look at this and know why its exploitable you in a good area but if not. id drop cr3 and move to drivers and x64 arch: [Only registered and activated users can see links. Click Here To Register...] [Only registered and activated users can see links. Click Here To Register...] [Only registered and activated users can see links. Click Here To Register...] i know its kinda messy but yeah. this driver is good for small projects off kdmapper. its safe to run alongside without issues. You can download the driver from dirctio. if you wanna look into it, thus far ive only got and fixing 0x8011E044, 0x8011E048, 0x8011E04C, 0x8011E050, 0x8011E060, 0x8011E064, 0x8011E068, 0x8011E074, 0x8011E080, 0x8011E084, 0x8011E088, 0x8011E08C, 0x8011E090, 0x8011E094, 0x8011E098, 0x8011E09C, 0x8011E0A0, 0x8011E0A4, 0x8011E0A8, 0x80116054, 0x80116058, 0x8011605C, 0x80116078, 0x8011607C, 0x8011B941 [Only registered and activated users can see links. Click Here To Register...] doesn't matter really. its like buying clothing. same same [Only registered and activated users can see links. Click Here To Register...]

Basic ESP, DMA Only(GoodFirmware)
/ Fuser/ MAKBox/Kmbox--Will look at this after ESP

Gaming PC runs:
- Game.exe
- Entitas ECS / Il2Cpp runtime
- HDCamera, PositionComponent, ItemDataContext
- GameAssembly.dll (GameContextModule)
- ScanMacro.ahk (auto-move input)
|
Radar PC runs:
- GameECSReader.exe
- VAD heap scan (decoy DTB)
- klass-heap scan (true CR3 phys)
- TypeInfo read (true CR3 phys)
- Upgrade/harvest (class name verify)
- Hot refresh (WorldVector blob)
- client.exe (imgui overlay)
- reads loot_snapshot.json + view_proj matrix → W2S → screen render

No injection. No hooks. No driver. FPGA reads physical memory. Page tables translate.

But yes, Short answer: true CR3 was never the full key but a door to a few more doors. It’s a proof path for when AC splits PE page tables from heap/process DTB.
The VM method was built so after a restart you can:

1. Find Game
2. Get live GA VA + PA
3. Hunt a CR3 that phys-walks that GA with MZ
4. Pin that as SANDECS_DTB / true, keep decoy for heaps

That’s the soft unlock: not permanent, but a reproducible attach after every Game launch.

So what was the point?
Value of true-CR3 / VM method:
Re-find Game + GA after every new PID
Prove PE with MZ (no phantom identity)
Know when dual-DTB is real vs collapsed
When true does walk GA, PE/TypeInfo can be cleaner under AC
Avoid soft-harvest / wrong GA
true CR3 I'm using it to prove decoy is the PE owner this time instead of guessing dead pins from the old PID.

Updated:
HARD_ENTITY
found through verified managed heap object headers , the object has a valid klass pointer (at offset +0x00 → +0x08 → +0x10 klass chain) to a known class name ( "PositionComponent" or "ItemData") via TypeInfo

HD VP =from_hd=true, hd_camera set
live eye=LIVE_CAM while walking (dCamXZ 5–25m)
space lock=player_xyz = cam_xyz
distance=Nearest piles ~9–25m list sorted by eye

Where I go from here?

PHYS_SPINE attach path
Dense ENTITY loot
Dual-DTB upgrade

Biggest issue is a stale GA_PA, I'll include it as a gate and pin field, not as an addressing mode.

Quote:

Originally Posted by suxers Basic ESP, DMA Only(GoodFirmware) / Fuser/ MAKBox/Kmbox--Will look at this after ESP Gaming PC runs: - Game.exe - Entitas ECS / Il2Cpp runtime - HDCamera, PositionComponent, ItemDataContext - GameAssembly.dll (GameContextModule) - ScanMacro.ahk (auto-move input) | Radar PC runs: - GameECSReader.exe - VAD heap scan (decoy DTB) - klass-heap scan (true CR3 phys) - TypeInfo read (true CR3 phys) - Upgrade/harvest (class name verify) - Hot refresh (WorldVector blob) - client.exe (imgui overlay) - reads loot_snapshot.json + view_proj matrix → W2S → screen render No injection. No hooks. No driver. FPGA reads physical memory. Page tables translate. But yes, Short answer: true CR3 was never the full key but a door to a few more doors. It’s a proof path for when AC splits PE page tables from heap/process DTB. The VM method was built so after a restart you can: 1. Find Game 2. Get live GA VA + PA 3. Hunt a CR3 that phys-walks that GA with MZ 4. Pin that as SANDECS_DTB / true, keep decoy for heaps That’s the soft unlock: not permanent, but a reproducible attach after every Game launch. So what was the point? Value of true-CR3 / VM method: Re-find Game + GA after every new PID Prove PE with MZ (no phantom identity) Know when dual-DTB is real vs collapsed When true does walk GA, PE/TypeInfo can be cleaner under AC Avoid soft-harvest / wrong GA true CR3 I'm using it to prove decoy is the PE owner this time instead of guessing dead pins from the old PID. Updated: HARD_ENTITY found through verified managed heap object headers , the object has a valid klass pointer (at offset +0x00 → +0x08 → +0x10 klass chain) to a known class name ( "PositionComponent" or "ItemData") via TypeInfo HD VP =from_hd=true, hd_camera set live eye=LIVE_CAM while walking (dCamXZ 5–25m) space lock=player_xyz = cam_xyz distance=Nearest piles ~9–25m list sorted by eye Where I go from here? PHYS_SPINE attach path Dense ENTITY loot Dual-DTB upgrade Biggest issue is a stale GA_PA, I'll include it as a gate and pin field, not as an addressing mode.

What game you doing this for may I ask?

Quote:

Originally Posted by MalwareEnjoyer What game you doing this for may I ask?

AC=BE /UnityEngine

Sorry, thought I'd added the name, Sand:RoS

Quote:

Originally Posted by MalwareEnjoyer are you doing kernel? I think you are foucsing on the wrong thing. Idk what step you at but doing cr3 isnt useful. You need to go into kernel drivers or at least something that can be applied universally. Doing cr3 cant be applied to everything. 2ndly, this would fall under a bypass but isn't really a bypass anymore and is just the standard. kernel mapping is what you wanna know 100% what are you even working on right now? writing in advance: learn driver entries, you can normally see whats happening in 2s and know if its exploitable in 2s. If you look at this and know why its exploitable you in a good area but if not. id drop cr3 and move to drivers and x64 arch: [Only registered and activated users can see links. Click Here To Register...] [Only registered and activated users can see links. Click Here To Register...] [Only registered and activated users can see links. Click Here To Register...] i know its kinda messy but yeah. this driver is good for small projects off kdmapper. its safe to run alongside without issues. You can download the driver from dirctio. if you wanna look into it, thus far ive only got and fixing 0x8011E044, 0x8011E048, 0x8011E04C, 0x8011E050, 0x8011E060, 0x8011E064, 0x8011E068, 0x8011E074, 0x8011E080, 0x8011E084, 0x8011E088, 0x8011E08C, 0x8011E090, 0x8011E094, 0x8011E098, 0x8011E09C, 0x8011E0A0, 0x8011E0A4, 0x8011E0A8, 0x80116054, 0x80116058, 0x8011605C, 0x80116078, 0x8011607C, 0x8011B941 [Only registered and activated users can see links. Click Here To Register...] doesnt matter really. its like buying clothing. same same [Only registered and activated users can see links. Click Here To Register...]

clear a bit, unmap, i see it!

this is helpful to start with thanks.

Update: I've made some real improvements

So far the data size to get where I'm at is around 50gb
Built a tool box so that this can be done on any unity engine game, BE safe for now. Ive learned that more thrashing isnt always better! Turtoise and the hare right?!

But I have achieved hard unlocks across the board, it has required over 300 hours of in game time and about 5 weeks of back and forth with scanning.