Quote:
Originally Posted by Dogukan47
hey hab mal eine frage also wenn man addys zum beispiel mit olly sucht dann sucht man ja z.B. für playerpointer DX01 doch was ist mit 5slot no recoil usw. gitb es irgend eine liste wo das drinne steht oder kann mir das irgendjemand sagen?
|
Unl.Ammo:
"ReadLevelData done"
You should see:
___:0048DB08 push offset aReadleveldataD ; "ReadLevelData done"
___:0048DB0D push ecx
___:0048DB0E call dword_8125C8
___:0048DB14 pop ecx
___:0048DB15 pop ecx
___:0048DB16 mov ecx, dword_9E2730
___:0048DB1C mov eax, [ecx]
___:0048DB1E call dword ptr [eax+1Ch]
___:0048DB21 cmp dword_9E23DC, 0
___:0048DB28 jz short locret_48DB2F
___:0048DB2A jmp sub_4A3E1C
The addie would be 9E2730, so its #define UnlimammoMem 0x9E2730
NFD:
Now search "S2_COM06". You will see:
___:004B9124 push offset aS2_com06 ; "S2_COM06"
___:004B9129 push eax
___:004B912A call ebx
___:004B912C pop ecx
___:004B912D pop ecx
___:004B912E test eax, eax
Now from there search "lea esi, [edi+" but remove the "". You may have to search several times until you see:
__:004B957B fstp [ebp+var_4]
___:004B957E push ecx
___:004B957F fld [ebp+var_4]
___:004B9582 lea esi, [edi+102C8h]
___:004B9588 fstp [esp+2Ch+var_2C]
___:004B958B call sub_41164F
___:004B9590 mov eax, dword_9E27D8
___:004B9595 call sub_4D6C2F
___:004B959A xor ebx, ebx
___:004B959C mov esi, eax
___:004B959E cmp byte_9E23E6, bl
___:004B95A4 jnz short loc_4B95D3
___:004B95A6 cmp byte_9E23E7, bl
___:004B95AC jz short loc_4B95B5
___:004B95AE push offset aBackwardmove ; "Backwardmove"
Or just search "Backwardmove" and look above it. The offset is 102C8h so it would be #define OFS_NFD 0x102C8. Just remove the h
OFS_Z:
Now search "Bip01 R ForeArm" and you will see this:
___:004C1519 push offset aBip01RForearm ; "Bip01 R ForeArm"
___:004C151E lea eax, [esp+0F0h+var_B0]
If you dont, search again. Now search "lea eax, [ebx+" but remove the "". You may have to search twice but you should see something like this:
___:004C1937 fld [esp+264h+var_250]
___:004C193B fstp dword ptr [eax+34h]
___:004C193E lea eax, [ebx+102E8h]
___:004C1944 mov ecx, [eax+4]
___:004C1947 xor ecx, [eax]
102E8h is the ofs_z addie so it's #define OFS_Z 0x102E8
5Slot:
This one is much easier, just search "CA01" until you see this:
___:004B5589 loc_4B5589: ; CODE XREF: sub_4B5280+298j
___:004B5589 push offset aCa01 ; "CA01"
___:004B558E push eax
___:004B558F call sub_797F96
___:004B5594 pop ecx
___:004B5595 pop ecx
___:004B5596 test eax, eax
___:004B5598 jnz short loc_4B55A9
___:004B559A push 50h
___:004B559C mov byte ptr [ebx+1021B4h], 1
___:004B55A3 pop edi
___:004B55A4 jmp loc_4B56A2
The offset for 5th slot is 1021B4h but just remove the h. So it's #define OFS_SLOT5 0x1021B4. To get the other slots just add 1 to the last number(4) and
that would be slot 6 or just subtract the last number from slot5 and 1021B3 is slot4. And if you subtract another from slot4 it would be 1021B2 and that's
slot3. Hopefully you get the point. So it's...
#define slot1 0x1021B0
#define slot2 0x1021B1
#define slot3 0x1021B2
#define slot4 0x1021B3
#define slot5 0x1021B4
#define slot6 0x1021B5
#define slot7 0x1021B6
#define slot8 0x1021B7
Credits:
Shunnai - Best minion EVER!!! <3
barcoder- Writing tut
TheCamels8 - Help with offsets
Alex_Agnew - Help with addies
PS:
STW Search:"Claymore bounding box %s!"
WTW Search:"AIMode_Repair_Icon"
Have Fun