Client modifications for beginners

Page 3 of 6

09/07/2015 12:49 WhyNot555#31

Quote:

Originally Posted by Best Coder 2014

Removing the "Please rest for a while" message definitely does not prevent you from getting a high ping when using an autoclicker. It does the exact opposite, in fact.

Lol, I just tested it yesterday, maybe it was my connection?!! :rolleyes:.Anyway I am gonna test it again as soon as I back home. If I found to be wrong I will remove it. People can test it and tell me the results in comments though. Thanks.
#Edit: I`ve tested it again at a click rate 100 click/sec (1 click/.01 sec) using stfb and found that if the skill is casted i.e you are hitting the target using the skill, the ping isn`t getting higher. If the skill isn`t casted e.g. using it on pk mode on a target in twincity where you can`t hit, the ping is getting higher. If you used the pointer on pots, the ping is getting higher. What we need is not to get higher ping while casting the skill in a fight and that what I found to be acheived, however other Opinions and tesing results are highly considered and welcomed...

09/08/2015 14:46 gunite69#32

Damn dude... "Removing "The target is not in range!"" Does that really work lol?

09/08/2015 15:05 jokerboy123#33

If we remove the ''to far away to jump'' message, howmuch % will we get an DC by the big jumps?

09/09/2015 00:10 WhyNot555#34

Quote:

Originally Posted by gunite69

Damn dude... "Removing "The target is not in range!"" Does that really work lol?

Yea, working very well :) why dont you have a try!

Quote:

Originally Posted by jokerboy123

If we remove the ''to far away to jump'' message, howmuch % will we get an DC by the big jumps?

According to how long is your jumps,any way long jumps isn`t good making you easy target to get.It is useful for jumping freely if you`re laggy. if you wanna make it limited then edit cmp eax,10 to higher number 13 etc but you won`t be able to jump if your ping is high as the message in this case isn`t removed.

09/09/2015 01:23 gunite69#35

will give it a try:)
Edit: Is that code "186DA" always be the one to search for ? or is that code only for the current patch? (meaning it will get outdated?) Is there a always a way to find out the lastest code for the patch.

09/09/2015 02:57 WhyNot555#36

It is a constant, didn't you notice we search for all constants ! It won't be changed.

09/09/2015 03:48 gunite69#37

Did not Know haha... I'm finding address on cheat engine and putting it thru to olly lol >.>

09/12/2015 15:12 jokerboy123#38

Since i removed the ��to far away�� jumps, whenever im on the P7 map, i get instant client crash after i click on several places of the map, any idea how/why?

P.S special thanks WhyNot555 for helping me out so often:D

09/12/2015 18:38 gunite69#39

i'm having difficulties in searching for all constants. I dont know whether to enter as hexadecimal, single etc

Even when I do. is the red line the one meaning that it is the 1st one?

Faling to do step 8 :(

09/12/2015 21:42 WhyNot555#40

Quote:

Originally Posted by jokerboy123

Since i removed the ��to far away�� jumps, whenever im on the P7 map, i get instant client crash after i click on several places of the map, any idea how/why?

P.S special thanks WhyNot555 for helping me out so often:D

Ooh yea,one of these 2 things will resolve the crash. Either to add wall jump to ur client or to edit cmp eax.10 to higher number instead of nopping the 18 line in the far jump codes.

Quote:

Originally Posted by gunite69

i'm having difficulties in searching for all constants. I dont know whether to enter as hexadecimal, single etc

Even when I do. is the red line the one meaning that it is the 1st one?
Faling to do step 8 :(

Search for constants I given as hexadecimal. I didn't get what you meant by:is the red line the one meaning that it is the 1st one?

09/13/2015 17:56 gunite69#41

to those using gm commands. use /scale 180.

talk in whisper. if u press n talk they can hear you,

is there another way to prevent that?

Quote:

Originally Posted by WhyNot555

Lol, I just tested it yesterday, maybe it was my connection?!! :rolleyes:.Anyway I am gonna test it again as soon as I back home. If I found to be wrong I will remove it. People can test it and tell me the results in comments though. Thanks.
#Edit: I`ve tested it again at a click rate 100 click/sec (1 click/.01 sec) using stfb and found that if the skill is casted i.e you are hitting the target using the skill, the ping isn`t getting higher. If the skill isn`t casted e.g. using it on pk mode on a target in twincity where you can`t hit, the ping is getting higher. If you used the pointer on pots, the ping is getting higher. What we need is not to get higher ping while casting the skill in a fight and that what I found to be acheived, however other Opinions and tesing results are highly considered and welcomed...

I got the same results. IN pk mode at TC aiming down my clicker on someone i get huge lag. its a delayed lag doesnt happen often.

Secondly. I get lag at poting.... i basically lag when i hold down my pot key (whch is pretty bad haha)

thirdly, i dont notice too much of a difference when trying out that less lag in a fight. still testing and giving it a go :) So far thank you for the guide! It has been amazing.

EDIT: Anyone else getting fps problems? im using "10" as the number

09/13/2015 18:35 jokerboy123#42

Quote:

Originally Posted by gunite69

to those using gm commands. use /scale 180.

talk in whisper. if u press n talk they can hear you,

is there another way to prevent that?

I got the same results. IN pk mode at TC aiming down my clicker on someone i get huge lag. its a delayed lag doesnt happen often.

Secondly. I get lag at poting.... i basically lag when i hold down my pot key (whch is pretty bad haha)

thirdly, i dont notice too much of a difference when trying out that less lag in a fight. still testing and giving it a go :) So far thank you for the guide! It has been amazing.

EDIT: Anyone else getting fps problems? im using "10" as the number

Im using +5 as number(200FP), Works fine and as for the scale.. GM commands, I'm using team chat, wonder can they see it too(I'm not in a team)

09/13/2015 20:30 donn#43

If they want to, they can.

09/14/2015 07:10 shmuel12#44

i think code is changed cuz i don't found it

09/14/2015 12:53 gunite69#45

hmmm trying to do a non dc client.. still possible ?

Code:

[Making Conquer.exe NON-DC]
0. Backup the Conquer.exe
1. Open Conquer in OllyDBG and let it analyze the code.

2. Find a code block that looks like this
Code:

004A6830  |. 8B10                       MOV EDX,DWORD PTR DS:[EAX]
004A6832  |. 6A 00                      PUSH 0
004A6834  |. 6A 00                      PUSH 0
004A6836  |. 68 0000FF00                PUSH 0FF0000
004A683B  |. 68 D5070000                PUSH 7D5
004A6840  |. 68 B7860100                PUSH 186B7
004A6845  |> 8BC8                       MOV ECX,EAX

3. Easiest way to find that is, find command (Ctrl + F) for that PUSH 186B7

4. Couple lines above that there should be codeblock that looks like this
Code:

004A67FD  |. 89BD ECFEFFFF              MOV DWORD PTR SS:[EBP-114],EDI
004A6803  |. 8985 F8FEFFFF              MOV DWORD PTR SS:[EBP-108],EAX
004A6809  |. 899D FCFEFFFF              MOV DWORD PTR SS:[EBP-104],EBX
004A680F  |. E8 30560400                CALL <JMP.&WINMM.timeGetTime>
004A6814  |. 8D8D ECFEFFFF              LEA ECX,DWORD PTR SS:[EBP-114]
004A681A  |. 8985 14FFFFFF              MOV DWORD PTR SS:[EBP-EC],EAX

5. Notice the CALL to winmm jmp.

6. Next what we need to do is make the exe jump to our own code instead of that call.

7. We need to search a place that can have 20 bytes (example from 500000 to 500020)

8. Scroll to almost the bottom of the Conquer.exe module and you should see lines like this (note the addresses)
Code:

00524C54   . 8B4D F0                    MOV ECX,DWORD PTR SS:[EBP-10]
00524C57   . 83C1 08                    ADD ECX,8
00524C5A   .^E9 3B31FBFF                JMP Conquer.004D7D9A
00524C5F   . B8 108C5500                MOV EAX,Conquer.00558C10
00524C64   .^E9 C1B2FCFF                JMP <JMP.&MSVCRT.__CxxFrameHandler>
00524C69     00                         DB 00
00524C6A     0000                       ADD BYTE PTR DS:[EAX],AL
00524C6C     0000                       ADD BYTE PTR DS:[EAX],AL
00524C6E     0000                       ADD BYTE PTR DS:[EAX],AL
00524C70     0000                       ADD BYTE PTR DS:[EAX],AL
00524C72     0000                       ADD BYTE PTR DS:[EAX],AL
00524C74     0000                       ADD BYTE PTR DS:[EAX],AL
00524C76     0000                       ADD BYTE PTR DS:[EAX],AL
00524C78     0000                       ADD BYTE PTR DS:[EAX],AL
00524C7A     0000                       ADD BYTE PTR DS:[EAX],AL
00524C7C     0000                       ADD BYTE PTR DS:[EAX],AL

9. ADD BYTES PTR DS:[EAX],AL might be DB 00 for you guys ignore that.

10. We start writing our own code at 00524C6A

11. Hit Ctrl + E and write these to the HEX part of the window just came. You can't put those 0x's or the ','s
Code:

0x81, 0x05, 0xB0, 0xEF, 0x56, 0x00, 0x6A, 0x04, 
0x00, 0x00, 0xA1, 0xB0, 0xEF, 0x56, 0x00, 0xE9, 
0x96, 0x1B, 0xF8, 0xFF

12. So just write 81 05 B0 EF and so on..

13. After that the codeblock should look like this
Code:

00524C6A     8105 B0EF5600 6A040000     ADD DWORD PTR DS:[56EFB0],46A
00524C74     A1 B0EF5600                MOV EAX,DWORD PTR DS:[56EFB0]
00524C79    ^E9 961BF8FF                JMP Conquer.004A6814

14. Note that we add the 46A (hex) into a static location, after that we mov it to eax

15. Note the address it jumps to, it should be exactly one line BELOW the call to timeGetTime()

16. It jumps to code that looks like this (Should be familiar from before)
Code:

004A6814  |. 8D8D ECFEFFFF              LEA ECX,DWORD PTR SS:[EBP-114]

17. What we now need to do is, change the CALL thing to jump to our own code that we just wrote. Remember the address?

18. We replace this
Code:

004A680F  |. E8 30560400                CALL <JMP.&WINMM.timeGetTime>

with
Code:

004A680F     E9 56E40700                JMP Conquer.00524C6A

19. Now every time the jump function "trys" to call the old timeGetTime, it jumps to our code that holds the lastjumptime+46A and then moves it to eax at some point it'll add it to the packet (lazy mofos not doing server side check)

Page 3 of 6

Last »