Hirrrh,
I just noticed that I want to pretend to be cool again, sharing stuff no one understands. And those who do understand, won't even look at this because it's way too much shit to handle at once.
Anyways, here are two sources. Wouldnt mind if you tell if you use them (which I doubt).
They're fully updated and should work like I didnt even make them.
should I add some other stuff here? If so, let me know, and I might add it.
Cya with some upcoming shit & nonsense.
I just noticed that I want to pretend to be cool again, sharing stuff no one understands. And those who do understand, won't even look at this because it's way too much shit to handle at once.
Anyways, here are two sources. Wouldnt mind if you tell if you use them (which I doubt).
Code:
// dllmain.cpp : Guess what, it's a dll
#define _CRT_SECURE_NO_WARNINGS //strcpy
#include <windows.h>
#include <stdint.h>
uint32_t baseAddress = (uint32_t)GetModuleHandle(0);
uint32_t hookAddress = (uint32_t)baseAddress + 0xB71B38; //Update the only base-offset here
uint32_t Buffer = (uint32_t)VirtualAlloc(0, 4, MEM_COMMIT, PAGE_READWRITE);
uint32_t Backjump = (uint32_t)hookAddress + 0x7;
void __declspec(naked) hk_pHash() {
__asm {
mov dword ptr[ebp - 4], 00000000
mov eax, [ebp + 8]
mov [Buffer], eax
}
strcpy((char*)Buffer, "0044e2791fd1a34cfa0595accee6de50"); //Update the hash here
__asm jmp [Backjump]
}
void Detour() {
memcpy((void*)hookAddress, "\x90\x90\xE9", 3);
uint32_t pHook = (((uint32_t)hk_pHash - 2)- hookAddress) - 5;
*(uint32_t*)(hookAddress + 3) = pHook;
}
void Main() {
Detour(); //yes that was absolutely needed
}
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
CreateThread(0, 0, (LPTHREAD_START_ROUTINE)&Main, 0, 0, 0);
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
This was meant to lookup who is accessing your playerinfo. It's actually almost finished, just without the reading part. I put it here because I dont have the time for finishing it. Maybe someone else would like to?
Structs.h
dllmain.cpp
Structs.h
Code:
#include <windows.h>
#include <stdint.h>
#pragma once
class Struct1
{
public:
byte unknown[0x20];
uint32_t pName;
};
class Struct2
{
public:
byte unknown[8];
uint32_t playerID;
};
Code:
// dllmain.cpp : Definiert den Einstiegspunkt für die DLL-Anwendung.
#include <windows.h>
#include "Structs.h"
#include <stdint.h>
#include <iostream>
uint32_t baseAddress = (uint32_t)GetModuleHandle(0);
uint32_t pCall = baseAddress + 0xA34500;
uint32_t pHook = baseAddress + 0xA2C0D1;
uint32_t Buffer_Struct1 = (uint32_t)VirtualAlloc(0, 4, MEM_COMMIT, PAGE_READWRITE);
uint32_t Buffer_Struct2 = (uint32_t)VirtualAlloc(0, 4, MEM_COMMIT, PAGE_READWRITE);
uint32_t backjump = pHook + 0x12;
void GetPlayerName() {
Struct1* p_Struct1 = reinterpret_cast<Struct1*>(Buffer_Struct1);
}
void PrintPlayerInfo() {
Struct2* p_Struct2 = reinterpret_cast<Struct2*>(Buffer_Struct2);
}
void __declspec(naked) hk_UserInfo() {
__asm {
lea eax, [ebp - 0x150]
mov [Buffer_Struct1], eax
}
GetPlayerName();
__asm {
mov eax,[Buffer_Struct1]
push eax
mov ecx, [ebp - 0x154]
call pCall
mov [Buffer_Struct2],ebp
}
PrintPlayerInfo(); //+ get PlayerID
__asm {
mov ebp, [Buffer_Struct2]
jmp [backjump]
}
}
void Detour() {
memcpy((void*)pHook, "\x90\xE9", 2);
uint32_t hookshit = (((uint32_t)hk_UserInfo) - (pHook + 1)) - 5;
*(uint32_t*)(pHook + 2) = hookshit;
}
void Init() {
while (!AllocConsole()) {
FreeConsole();
Sleep(10);
}
FILE *conin, *conout;
freopen_s(&conin, "conin$", "r", stdin);
freopen_s(&conout, "conout$", "w", stdout);
freopen_s(&conout, "conout$", "w", stderr);
Detour();
}
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
CreateThread(0, 0, (LPTHREAD_START_ROUTINE)&Init, 0, 0, 0);
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
Code:
#include <ButtonConstants.au3>
#include <EditConstants.au3>
#include <GUIConstantsEx.au3>
#include <StaticConstants.au3>
#include <WindowsConstants.au3>
#include "Detour.au3"
#NoTrayIcon
#RequireAdmin
#Region Decl
const $off_UFPS = 0xC9BFDE
const $off_Improv = $off_UFPS + 3
const $off_cCalc = 0x109A028
Dim $handle, $baseAddress, $orig_cCalc, $oneFPS, $eByte
#EndRegion
Init()
Opt("GUIOnEventMode", 1)
$Form_Main = GUICreate("FPS Tool", 384, 153, -1, -1)
GUISetOnEvent($GUI_EVENT_CLOSE, "EndTool")
$Group_Mode = GUICtrlCreateGroup("Mode", 8, 8, 185, 137)
$Radio_Normal = GUICtrlCreateRadio("Normal", 24, 32, 113, 17)
GUICtrlSetState(-1, $GUI_CHECKED)
GUICtrlSetOnEvent(-1, "M_Normal")
$Radio_Improv = GUICtrlCreateRadio("FPS Improvement", 24, 56, 113, 17)
GUICtrlSetOnEvent(-1, "M_Improv")
$Radio_UFPS = GUICtrlCreateRadio("Unlimited FPS", 24, 80, 113, 17)
GUICtrlSetOnEvent(-1, "M_UFPS")
$Radio_CFPS = GUICtrlCreateRadio("Custom FPS (max)", 24, 104, 113, 17)
GUICtrlSetOnEvent(-1, "M_Custom")
GUICtrlCreateGroup("", -99, -99, 1, 1)
$Label_CFPS = GUICtrlCreateLabel("Custom FPS", 208, 16, 62, 17)
$Input_CFPS = GUICtrlCreateInput("62.5", 208, 40, 81, 21)
$Button_Set = GUICtrlCreateButton("Set", 296, 39, 75, 23)
GUICtrlSetOnEvent(-1, "SetCFPS")
$Label_C = GUICtrlCreateLabel("Zyntex 2k17", 312, 128, 63, 17)
GUICtrlSetColor(-1, 0x808080)
GUISetState(@SW_SHOW)
SetCustomState($GUI_DISABLE)
While 1
sleep(250)
WEnd
Func SetCustomState($state)
GUICtrlSetState($Input_CFPS, $state)
GUICtrlSetState($Button_Set, $state)
EndFunc
Func SetCFPS()
$wantedFPS = GUICtrlRead($Input_CFPS)
$dSet = $oneFPS / $wantedFPS
WriteProcessMemory($handle, $baseAddress + $off_cCalc, $dSet, "double")
EndFunc
Func M_Custom()
M_Improv()
SetCustomState($GUI_ENABLE)
EndFunc
Func M_UFPS()
WriteProcessMemory($handle, $baseAddress + $off_UFPS, "0xEB0A6A01FF15" & $eByte, "Byte[10]")
WriteProcessMemory($handle, $baseAddress + $off_cCalc, $orig_cCalc, "double")
SetCustomState($GUI_DISABLE)
EndFunc
Func M_Improv()
WriteProcessMemory($handle, $baseAddress + $off_UFPS, "0x7E0A9090909090909090", "Byte[10]")
WriteProcessMemory($handle, $baseAddress + $off_cCalc, $orig_cCalc, "double")
SetCustomState($GUI_DISABLE)
EndFunc
Func M_Normal()
WriteProcessMemory($handle, $baseAddress + $off_UFPS, "0x7E0A6A01FF15" & $eByte, "Byte[10]")
WriteProcessMemory($handle, $baseAddress + $off_cCalc, $orig_cCalc, "double")
SetCustomState($GUI_DISABLE)
EndFunc
Func EndTool()
M_Normal()
sleep(150)
Exit
EndFunc
Func Init()
Local $iPID
$iPID = ProcessExists("S4Client.exe")
If $iPID = 0 Then Error("Start S4L with Faze's Bypass first!")
$handle = OpenProcess($PROCESS_ALL_ACCESS, false, $iPID)
If $handle = 0 Then Error("Unable to open process!")
$baseAddress = _MemoryModuleGetBaseAddress($iPID, "S4Client.exe")
if $baseAddress = 0 Then Error("Base Address returned 0!")
$orig_cCalc = ReadProcessMemory($handle, $baseAddress + $off_cCalc, "double")
if $orig_cCalc = 0 Then Error("ReadProcessMemory failed!")
$oneFPS = $orig_cCalc * 62.5
$eByte = StringReplace(ReadProcessMemory($handle, $baseAddress + $off_UFPS + 6, "Byte[4]"), "0x", "")
EndFunc
Func Error($error)
MsgBox(16, "error", $error)
Exit
EndFunc
They're fully updated and should work like I didnt even make them.
should I add some other stuff here? If so, let me know, and I might add it.
Cya with some upcoming shit & nonsense.
