WolfTeam Inventory Hack - all versions(Aeria).

#include <Windows.h>
#include "inventory.h"
#pragma pack(1) //without this, WTInventoryItem will have padding .

WORD WeaponCodes[418] =
{ 7100, 7101, 7102, 5005,
5004, 5013, 5002, 3042,
3035, 3002, 3044, 3099,
3098, 3064, 3065, 3049,
3100, 3080, 3115, 3052,
3069, 3068, 3108, 3109,
3122, 3127, 3131, 3040,
3059, 3060, 3104, 3125,
3095, 3047, 3054, 3045,
3118, 3081, 9034, 3088,
3040, 3083, 3072, 3071,
3107, 5001, 3125, 3140,
3141, 3142, 3143, 3101,
3078, 3079, 3063, 3062,
3053, 3043, 3084, 3058,
3093, 3092, 3091, 3090,
3900, 3910, 7507, 7508,
7511, 7514, 7515, 7509,
7510, 7512, 7513, 7516,
3121, 3120, 3103, 3061,
3070, 3085, 3119, 3057,
3114, 3056, 3055, 3094,
3124, 3113, 3086, 3112,
3111, 3110, 3123, 3087,
3075, 3117, 3116, 3077,
3126, 3130, 3102, 3041,
3106, 3105, 3067, 3066,
3051, 3097, 3096, 3089,
3074, 3073, 3046, 5015,
5014, 5010, 5012, 5011,
5008, 5009, 5006, 3136,
3137, 3138, 3139, 3133,
3399, 6013, 6040, 3301,
3303, 6026, 6027, 3028,
6029, 3253, 6018, 6017,
6016, 6021, 6022, 6015,
6019, 6020, 6023, 6012,
6011, 6010, 6014, 7506,
6004, 6005, 6003, 6024,
6030, 6031, 6032, 6033,
6007, 6006, 6009, 6002,
6001, 7002, 7003, 7004,
7200, 7006, 8001, 8002,
8501, 8601, 8602, 8503,
8701, 7517, 1001, 1002,
1003, 1004, 1005, 1006,
1007, 1008, 1009, 1010,
1011, 1012, 1013, 1014,
1015, 1016, 1017, 2001,
9022, 2003, 2006, 2007,
2009, 2011, 2013, 2015,
2017, 2019, 9001, 9002,
9003, 9004, 9005, 9006,
9007, 9008, 9011, 9013,
9015, 9016, 9017, 9023,
9024, 9025, 9026, 9027,
9028, 7073, 3900, 3910,
7074, 7075, 9018, 9037,
9036, 9019, 1021, 1022,
6046, 6047, 6048, 2021,
2022, 7123, 7111, 7112,
7122, 7113, 7121, 2023,
7070, 7071, 7072, 7073,
3132, 3201, 6201, 6203,
8003, 1020, 1030, 2005,
7201, 7110, 3003, 3006,
3008, 3009, 3011, 3013,
3014, 3016, 3017, 3019,
3020, 3022, 3025, 3030,
3032, 3033, 3036, 3128,
5007, 7501, 5024, 6042,
11006, 11003, 11005, 11004,
13003, 13001, 16014, 16016,
16018, 21078, 21074, 21063,
21060, 21046, 21035, 21023,
20062, 20058, 13002, 13004,
12210, 12154, 12162, 12148,
12141, 12020, 21135, 12259,
12205, 31025, 31049, 10006,
10026, 10047, 10060, 10027,
17007, 6008, 19610, 12226,
12233, 12234, 12235, 20086,
12203, 12204, 31121, 31108,
31095, 31107, 32198,
15018, 15114, 15047, 10010,
10094, 10097, 10096, 10083,
10085, 10087, 10019, 10011,
17010, 17014, 10014, 17008,
10018, 17012, 17013, 10020,
10001, 10081, 10088, 10093,
10048, 10086, 10039, 10084,
17006, 10049, 10017, 10005,
17016, 10016, 10004, 17015,
10031, 10092, 10029, 10030,
10050, 10051, 10052, 10053,
10054, 10055, 10056, 10057,
10058, 10059, 14032, 10027,
10091, 10090, 10012, 10038,
10046, 10089, 10082, 17009,
17001, 10008, 10009, 17011,
10044, 10045, 31019, 31160,
31109, 31072, 11002, 12073,
16013, 16020, 16015, 13007,
16012, 12072, 19002, 12004,
12038, 12030, 15071
};

WTInventoryItem InventoryItems[500] = { 0 };
DWORD InventoryContinue;
DWORD WepCountSubContinue;

__declspec(naked) void HookedInventory()
{
	_asm
	{
			lea esi, InventoryItems
			mov cx, [eax + esi]
			add eax, 2
			jmp dword ptr[InventoryContinue]
	}
}


__declspec(naked) void WepCount()
{
	_asm
	{
		mov eax, 418
		jmp dword ptr[WepCountSubContinue]
	}
}

#pragma once
void WepCount();
void HookedInventory();

// { };
#pragma pack(1)

struct WTInventoryItem
{
	DWORD ptr;
	unsigned char unk[2]; //0..5 = unknown.
	short TimeLeft; //6..7 = time left.
	char _unk1[2]; //8.9 = unknown.
	char* unknown; //10-13 = unknown.
	short WeaponID; //+0xE = weaponID.
	char _unk2[3];
}extern InventoryItems[500];

/*
struct WTInventoryItem
{
	//char Unk[14];//0..0xD
	char Unk[6];//0..5 = unknown.
	short TimeLeft; //6..7 = time left.
	char Unk2[6]; //8..0xD = unknown.
	WORD WepID;//0xE..0xF
	char Padding[3];//0x16..0x18 = unknown.
/*	char Unk3[2]; //0x10..0x11 = unknown.
	void* unknown; //0x12-0x15 = unknown.
	//
	
}extern InventoryItems[500];
*/
//19 = sizeof InventoryItem
//
extern DWORD InventoryContinue;
extern DWORD WepCountSubContinue;
extern WORD WeaponCodes[418];

bool compare(PBYTE sig, PCHAR mask, PBYTE adr)
{
	for (unsigned int i = 0; i < strlen(mask); i++)
	if (mask[i] == 'x' && sig[i] != adr[i]) return false;

	return true;
}

DWORD FindSignature(PBYTE sig, PCHAR mask, DWORD dwBase, DWORD dwLen, int iIndex)
{
	int cIndex = 0;
	if (!dwBase || !mask || !dwLen || !sig) return false;
	for (PBYTE i = (PBYTE)dwBase; i != (PBYTE)(dwBase + dwLen); i++)
	if (compare(sig, mask, i))
	if (iIndex == cIndex++) return (DWORD)i;
	return false;
}

DWORD TrampolineHookWithoutOld(BYTE *src, BYTE *dst, int len)
{
	if (!src || !dst || !len) return 0;
	DWORD dwOld;
	VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &dwOld);
	src[0] = 0xE9;
	*(DWORD*)((DWORD)src + 1) = (DWORD)(dst - (DWORD)src) - 5;
	if (len > 5) for (int i = 5; i < len; i++) src[i] = 0x90;
	return ((DWORD)src + len);
}

int unknown = 0;
void InventoryHack()
{
	//--------------------------------------------------------------------------------------------------------------
	//inventory hack://416
	
	int wepid = 0;
	for (int i = 0; i < 417; i++){// sizeof(WeaponCodes)
		InventoryItems[i].WeaponID = WeaponCodes[wepid++];
		InventoryItems[i].unknown = NULL; //if you don't do this, you can't select weapons O.O
		//InventoryItems[i].TimeLeft = -1;// 1337 = 1337 days, -1 = permenent;
				InventoryItems[i].TimeLeft = 1337;
	}
	
	PBYTE lpInventory = NULL;
	DWORD InventoryTMP = FindSignature((PBYTE)"CS_IN_ITEMLIST_ACK", "xxxxxxxxxxxxxxxxxxx", CshellBase, 7720000, 0);
	if (InventoryTMP)
	{
		BYTE InventoryFuncSig[5] = { 0x68, 0x00, 0x00, 0x00, 0x00 }; //push address.
		*(DWORD*)&InventoryFuncSig[1] = InventoryTMP;
		lpInventory = (PBYTE)FindSignature(&InventoryFuncSig[0], "xxxxx", CshellBase, 5000000, 0);
	}
	PBYTE WepCountSub = (PBYTE)FindSignature((PBYTE)"\xFF\x05\x00\x00\x00\x00\x0F\xB6\xC1\x50\x8D\x8F\x00\x00\x00\x00", "xx????xxxxxx????", (DWORD)lpInventory, 300, 0);
	PBYTE InventorySub = (PBYTE)(FindSignature((PBYTE)"\x8B\x86\x04\x20\x00\x00\x66\x8B\x0C\x30\x83\xC0\x02", "xxxxxxxxxxxxx", (DWORD)lpInventory, 500, 0) + 6);
	if ((DWORD)InventorySub == 6) InventorySub = NULL;

	char buf[50] = { 0 };
	sprintf_s(buf, "count: %X, set:%X", (int)WepCountSub, (int)InventorySub);
	//MessageBoxA(0, buf, buf, 0);
	WepCountSubContinue = TrampolineHookWithoutOld(WepCountSub, (PBYTE)&WepCount, 9);
	InventoryContinue = TrampolineHookWithoutOld(InventorySub, (PBYTE)&HookedInventory, 7);
	//--------------------------------------------------------------------------------------------------------------
}