![[Release]Code](https://www.elitepvpers.com/forum/iconimages/crossfire-hacks-bots-cheats-exploits/release-code_ltr.gif){kind=small}
basic player info you can see ghost and speed hack here
{
public:
float fMoveMentWalkRate; //0000
float fMovementDuckRate; //0004
float fMovementSideRate; //0008
float fMoveMentAcceleration; //000C
float fMoveMentFriction; //0010
float fJumpTime; //0014
float fJumpVelocity; //0018
float fJumpLandedWaitTime; //001C
float fJumpLandedNoTimeRate; //0020
float fJumpRepeatPenaltyMoveRate; //0024
float fJumpRepeatPenaltyHeightRate; //0028
float Unknown0; //002C
float Unknown1; //0030
float fPVPosDefault; //0034
float Unknown2; //0038
float Unknown3; //003C
float fPVRotDefault; //0040
float Unknown4; //0044
float Unknown5; //0048
float fPvModelFov; //004C
float fPvOnlyMoveGap; //0050
float Unknown6; //0054
float Unknown7; //0058
float fDamagePenaltyTime; //005C
float fDamagePenaltyMoveRate; //0060
float fC4PlantTime; //0064
float fC4DefuseTime; //0068
float fMaxCanDefuseDistance; //006C
float fCharcterHiddenAlpha; //0070
float fCharecterHiddenWalkAlpha; //0074
float fCharecterHiddenRunAlpha; //0078
float fMovementHiddenRate; //007C
char unknown8[4];
float fCrossHairColorChangeRateRed; //0084
float Unknown9; //0088
float fCrossHairColorChangeRateGreen; //008C
float Unknown10; //0090
};
weapon info incomplete but you can do a no recoil decrease the spread a bit
size 0x16C8 loops for every weapon
088
float fCrossHairColorChangeRateGreen; //008C
float Unknown10; //0090
};
weapon info incomplete but you can do a no recoil decrease the spread a bit
size 0x16C8 loops for every weapon
Code:
{
public:
BYTE WeaponClass; //0000
BYTE Unknown0; //0001
char Unknown1[32]; //0002
char cSkinFileName[64]; //0022
char cSkinFileName2[64]; //0062
char Unknown2[64]; //00A2
char Unknown3[64]; //00E2
char Unknown4[64]; //0122
char cRenderStyleFileName[64]; //0162
char Unknown5[64]; //01A2
char Unknown6[64]; //01E2
char Unknown7[64]; //0222
char Unknown8[64]; //0262
char Unknown9[64]; //02A2
char Unknown10[64]; //02E2
char Unknown11[64]; //0322
char Unknown12[64]; //0362
char Unknown13[64]; //03A2
char Unknown14[64]; //03E2
char Unknown15[64]; //0422
char Unknown16[64]; //0462
char Unknown17[64]; //04A2
char Unknown18[32]; //04E2
char Unknown19[32]; //0502
char cReloadSoundName[32]; //0522
char cBlowBackSoundName[32]; //0542
char Unknown20[32]; //0562
char cBigIconName[32]; //0582
char cSmallIconName[32]; //05A2
char unknown21[12];
BYTE Unknown22; //05CE
BYTE Unknown23; //05CF
BYTE Unknown24; //05D0
BYTE Unknown25; //05D1
char unknown26[16];
char Unknown27[34]; //05E2
char unknown28[1644];
__int16 iAmmoPerMagazine; //0C70
__int16 iAmmoDamage; //0C72
char unknown29[24];
float MaxAmmo; //0C8C
__int16 iAmmoPerMagazine; //0C90
__int16 iAmmoDamage; //0C92
float iUnlimitedAmmo; //0C94
char unknown30[476];
float Unknown31; //0E74
float Unknown32; //0E78
};
struct _LocalWorld
{
char unknown0[212];
float Unknown1; //00D4
__int32 iWeapon; //00D8
char unknown2[4];
float Unknown3; //00E0
char unknown4[48];
float fLocalWorldX; //0114
float fLocalWorldY; //0118
float fLocalWorldZ; //011C
char unknown5[12];
float Unknown6; //012C
float Unknown7; //0130
char unknown8[56];
float Unknown9; //016C
};
Another way to see ghost:
00647910 55 PUSH EBP
00647911 8BEC MOV EBP,ESP
00647913 83EC 08 SUB ESP,8
00647916 894D FC MOV DWORD PTR SS:[EBP-4],ECX
00647919 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0064791C 0FB688 93000000 MOVZX ECX,BYTE PTR DS:[EAX+93]
00647923 81F9 FF000000 CMP ECX,0FF //////////////////cmp ecx,255
00647929 7C 17 JL SHORT crossfir.00647942//////////here nop or JG
0064792B 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0064792E 8B82 88000000 MOV EAX,DWORD PTR DS:[EDX+88]
00647934 83E0 42 AND EAX,42/////////////////////66
00647937 75 09 JNZ SHORT crossfir.00647942
00647939 C745 F8 00000000 MOV DWORD PTR SS:[EBP-8],0
00647940 EB 07 JMP SHORT crossfir.00647949
00647942 C745 F8 01000000 MOV DWORD PTR SS:[EBP-8],1
00647949 8A45 F8 MOV AL,BYTE PTR SS:[EBP-8]
0064794C 8BE5 MOV ESP,EBP
0064794E 5D POP EBP
0064794F C3 RETN
Turn on bounding boxes
0069F580 55 PUSH EBP
0069F581 8BEC MOV EBP,ESP
0069F583 6A 00 PUSH 0 //push 1 value
0069F585 68 D0FC6B00 PUSH crossfir.006BFCD0 ; ASCII "ModelDebug_DrawBoxes"
0069F58A B9 74CE7000 MOV ECX,crossfir.0070CE74 //follow this to a jmp patch that will draw boxes also
0069F58F E8 2CE8ECFF CALL crossfir.0056DDC0
0069F594 5D POP EBP
0069F595 C3 RETN
Another way tot urn on Debugging boxes
void __cdecl SetConsoleVariable(char* szVal){
void* vSetVar = (void*) 0x4169C0;
_asm
{
push szVal
call vSetVar
add esp, 4
}
}
SetConsoleVariable("ModelDebug_DrawBoxes 1");
0x4169C0 Is L***ient + 0x1F8 (iirc)
LClient = CShell + 0x524014
GetObjectPos L***ient + 0x94
Built In wallhack/whitewalls
005677D0 C745 FC 1CE96B00 MOV DWORD PTR SS:[EBP-4],crossfir.006BE9>; ASCII "ForceMode"
005677D7 8BE5 MOV ESP,EBP
005677D9 5D POP EBP
005677DA C3 RETN
005677DB CC INT3
005677DC CC INT3
005677DD CC INT3
005677DE CC INT3
005677DF CC INT3
005677E0 55 PUSH EBP
005677E1 8BEC MOV EBP,ESP
005677E3 83EC 74 SUB ESP,74
005677E6 894D 90 MOV DWORD PTR SS:[EBP-70],ECX
005677E9 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
005677EC 0FB688 55010000 MOVZX ECX,BYTE PTR DS:[EAX+155]
005677F3 85C9 TEST ECX,ECX
005677F5 74 21 JE SHORT crossfir.00567818
005677F7 6A 03 PUSH 3
005677F9 6A 23 PUSH 23
005677FB 8B55 90 MOV EDX,DWORD PTR SS:[EBP-70]
005677FE 8B0A MOV ECX,DWORD PTR DS:[EDX]
00567800 E8 ABCAFEFF CALL crossfir.005542B0
00567805 6A 00 PUSH 0
00567807 68 8C000000 PUSH 8C
0056780C 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
0056780F 8B08 MOV ECX,DWORD PTR DS:[EAX]
00567811 E8 9ACAFEFF CALL crossfir.005542B0
00567816 EB 1F JMP SHORT crossfir.00567837
00567818 6A 03 PUSH 3
0056781A 68 8C000000 PUSH 8C
0056781F 8B4D 90 MOV ECX,DWORD PTR SS:[EBP-70]
00567822 8B09 MOV ECX,DWORD PTR DS:[ECX]
00567824 E8 87CAFEFF CALL crossfir.005542B0
00567829 6A 00 PUSH 0
0056782B 6A 23 PUSH 23
0056782D 8B55 90 MOV EDX,DWORD PTR SS:[EBP-70]
00567830 8B0A MOV ECX,DWORD PTR DS:[EDX]
00567832 E8 79CAFEFF CALL crossfir.005542B0
00567837 6A 01 PUSH 1////////// white walls
00567839 6A 16 PUSH 16///////D3DRS_LASTPIXEL = 16?? not sure
0056783B 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
0056783E 8B08 MOV ECX,DWORD PTR DS:[EAX]
00567840 E8 6BCAFEFF CALL crossfir.005542B0
00567845 6A 01 PUSH 1/////////////////////////////////NICE WALLHACK ASUS
00567847 6A 07 PUSH 7//////////////////////////////// D3DRS_ZENABLE = 7,
00567849 8B4D 90 MOV ECX,DWORD PTR SS:[EBP-70]
0056784C 8B09 MOV ECX,DWORD PTR DS:[ECX]
0056784E E8 5DCAFEFF CALL crossfir.005542B0
o weapon values
XmShotgun 0
MP5 2
P90 3
Knife 5
Grenade 6
FlashBang 7
Smoke 8
C4 9
M4A1 11
AK 12
Aug 13
M700 14
AWM 15
M60 17
DragSniper 23
Ak "says 74" 27
"ENgineer gun from BF2 small not shotgun" 28
XM8 30
Gali 32
"Old pistol six shooter" 33
Scar 34
Axe 35
SPAShotgun 36
//creds:whitegun
client info is this or close to it:
ClientInfo size 0xF8
L***ientShell + 0x64F4 = ClientInfo Clients [16]
This structure stores team, name, etc. You can work out the rest.
credits: ECsTaSY(mp*h)
{
public:
float fMoveMentWalkRate; //0000
float fMovementDuckRate; //0004
float fMovementSideRate; //0008
float fMoveMentAcceleration; //000C
float fMoveMentFriction; //0010
float fJumpTime; //0014
float fJumpVelocity; //0018
float fJumpLandedWaitTime; //001C
float fJumpLandedNoTimeRate; //0020
float fJumpRepeatPenaltyMoveRate; //0024
float fJumpRepeatPenaltyHeightRate; //0028
float Unknown0; //002C
float Unknown1; //0030
float fPVPosDefault; //0034
float Unknown2; //0038
float Unknown3; //003C
float fPVRotDefault; //0040
float Unknown4; //0044
float Unknown5; //0048
float fPvModelFov; //004C
float fPvOnlyMoveGap; //0050
float Unknown6; //0054
float Unknown7; //0058
float fDamagePenaltyTime; //005C
float fDamagePenaltyMoveRate; //0060
float fC4PlantTime; //0064
float fC4DefuseTime; //0068
float fMaxCanDefuseDistance; //006C
float fCharcterHiddenAlpha; //0070
float fCharecterHiddenWalkAlpha; //0074
float fCharecterHiddenRunAlpha; //0078
float fMovementHiddenRate; //007C
char unknown8[4];
float fCrossHairColorChangeRateRed; //0084
float Unknown9; //0088
float fCrossHairColorChangeRateGreen; //008C
float Unknown10; //0090
};
weapon info incomplete but you can do a no recoil decrease the spread a bit
size 0x16C8 loops for every weapon
088
float fCrossHairColorChangeRateGreen; //008C
float Unknown10; //0090
};
weapon info incomplete but you can do a no recoil decrease the spread a bit
size 0x16C8 loops for every weapon
Code:
{
public:
BYTE WeaponClass; //0000
BYTE Unknown0; //0001
char Unknown1[32]; //0002
char cSkinFileName[64]; //0022
char cSkinFileName2[64]; //0062
char Unknown2[64]; //00A2
char Unknown3[64]; //00E2
char Unknown4[64]; //0122
char cRenderStyleFileName[64]; //0162
char Unknown5[64]; //01A2
char Unknown6[64]; //01E2
char Unknown7[64]; //0222
char Unknown8[64]; //0262
char Unknown9[64]; //02A2
char Unknown10[64]; //02E2
char Unknown11[64]; //0322
char Unknown12[64]; //0362
char Unknown13[64]; //03A2
char Unknown14[64]; //03E2
char Unknown15[64]; //0422
char Unknown16[64]; //0462
char Unknown17[64]; //04A2
char Unknown18[32]; //04E2
char Unknown19[32]; //0502
char cReloadSoundName[32]; //0522
char cBlowBackSoundName[32]; //0542
char Unknown20[32]; //0562
char cBigIconName[32]; //0582
char cSmallIconName[32]; //05A2
char unknown21[12];
BYTE Unknown22; //05CE
BYTE Unknown23; //05CF
BYTE Unknown24; //05D0
BYTE Unknown25; //05D1
char unknown26[16];
char Unknown27[34]; //05E2
char unknown28[1644];
__int16 iAmmoPerMagazine; //0C70
__int16 iAmmoDamage; //0C72
char unknown29[24];
float MaxAmmo; //0C8C
__int16 iAmmoPerMagazine; //0C90
__int16 iAmmoDamage; //0C92
float iUnlimitedAmmo; //0C94
char unknown30[476];
float Unknown31; //0E74
float Unknown32; //0E78
};
struct _LocalWorld
{
char unknown0[212];
float Unknown1; //00D4
__int32 iWeapon; //00D8
char unknown2[4];
float Unknown3; //00E0
char unknown4[48];
float fLocalWorldX; //0114
float fLocalWorldY; //0118
float fLocalWorldZ; //011C
char unknown5[12];
float Unknown6; //012C
float Unknown7; //0130
char unknown8[56];
float Unknown9; //016C
};
Another way to see ghost:
00647910 55 PUSH EBP
00647911 8BEC MOV EBP,ESP
00647913 83EC 08 SUB ESP,8
00647916 894D FC MOV DWORD PTR SS:[EBP-4],ECX
00647919 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0064791C 0FB688 93000000 MOVZX ECX,BYTE PTR DS:[EAX+93]
00647923 81F9 FF000000 CMP ECX,0FF //////////////////cmp ecx,255
00647929 7C 17 JL SHORT crossfir.00647942//////////here nop or JG
0064792B 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0064792E 8B82 88000000 MOV EAX,DWORD PTR DS:[EDX+88]
00647934 83E0 42 AND EAX,42/////////////////////66
00647937 75 09 JNZ SHORT crossfir.00647942
00647939 C745 F8 00000000 MOV DWORD PTR SS:[EBP-8],0
00647940 EB 07 JMP SHORT crossfir.00647949
00647942 C745 F8 01000000 MOV DWORD PTR SS:[EBP-8],1
00647949 8A45 F8 MOV AL,BYTE PTR SS:[EBP-8]
0064794C 8BE5 MOV ESP,EBP
0064794E 5D POP EBP
0064794F C3 RETN
Turn on bounding boxes
0069F580 55 PUSH EBP
0069F581 8BEC MOV EBP,ESP
0069F583 6A 00 PUSH 0 //push 1 value
0069F585 68 D0FC6B00 PUSH crossfir.006BFCD0 ; ASCII "ModelDebug_DrawBoxes"
0069F58A B9 74CE7000 MOV ECX,crossfir.0070CE74 //follow this to a jmp patch that will draw boxes also
0069F58F E8 2CE8ECFF CALL crossfir.0056DDC0
0069F594 5D POP EBP
0069F595 C3 RETN
Another way tot urn on Debugging boxes
void __cdecl SetConsoleVariable(char* szVal){
void* vSetVar = (void*) 0x4169C0;
_asm
{
push szVal
call vSetVar
add esp, 4
}
}
SetConsoleVariable("ModelDebug_DrawBoxes 1");
0x4169C0 Is L***ient + 0x1F8 (iirc)
LClient = CShell + 0x524014
GetObjectPos L***ient + 0x94
Built In wallhack/whitewalls
005677D0 C745 FC 1CE96B00 MOV DWORD PTR SS:[EBP-4],crossfir.006BE9>; ASCII "ForceMode"
005677D7 8BE5 MOV ESP,EBP
005677D9 5D POP EBP
005677DA C3 RETN
005677DB CC INT3
005677DC CC INT3
005677DD CC INT3
005677DE CC INT3
005677DF CC INT3
005677E0 55 PUSH EBP
005677E1 8BEC MOV EBP,ESP
005677E3 83EC 74 SUB ESP,74
005677E6 894D 90 MOV DWORD PTR SS:[EBP-70],ECX
005677E9 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
005677EC 0FB688 55010000 MOVZX ECX,BYTE PTR DS:[EAX+155]
005677F3 85C9 TEST ECX,ECX
005677F5 74 21 JE SHORT crossfir.00567818
005677F7 6A 03 PUSH 3
005677F9 6A 23 PUSH 23
005677FB 8B55 90 MOV EDX,DWORD PTR SS:[EBP-70]
005677FE 8B0A MOV ECX,DWORD PTR DS:[EDX]
00567800 E8 ABCAFEFF CALL crossfir.005542B0
00567805 6A 00 PUSH 0
00567807 68 8C000000 PUSH 8C
0056780C 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
0056780F 8B08 MOV ECX,DWORD PTR DS:[EAX]
00567811 E8 9ACAFEFF CALL crossfir.005542B0
00567816 EB 1F JMP SHORT crossfir.00567837
00567818 6A 03 PUSH 3
0056781A 68 8C000000 PUSH 8C
0056781F 8B4D 90 MOV ECX,DWORD PTR SS:[EBP-70]
00567822 8B09 MOV ECX,DWORD PTR DS:[ECX]
00567824 E8 87CAFEFF CALL crossfir.005542B0
00567829 6A 00 PUSH 0
0056782B 6A 23 PUSH 23
0056782D 8B55 90 MOV EDX,DWORD PTR SS:[EBP-70]
00567830 8B0A MOV ECX,DWORD PTR DS:[EDX]
00567832 E8 79CAFEFF CALL crossfir.005542B0
00567837 6A 01 PUSH 1////////// white walls
00567839 6A 16 PUSH 16///////D3DRS_LASTPIXEL = 16?? not sure
0056783B 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
0056783E 8B08 MOV ECX,DWORD PTR DS:[EAX]
00567840 E8 6BCAFEFF CALL crossfir.005542B0
00567845 6A 01 PUSH 1/////////////////////////////////NICE WALLHACK ASUS
00567847 6A 07 PUSH 7//////////////////////////////// D3DRS_ZENABLE = 7,
00567849 8B4D 90 MOV ECX,DWORD PTR SS:[EBP-70]
0056784C 8B09 MOV ECX,DWORD PTR DS:[ECX]
0056784E E8 5DCAFEFF CALL crossfir.005542B0
o weapon values
XmShotgun 0
MP5 2
P90 3
Knife 5
Grenade 6
FlashBang 7
Smoke 8
C4 9
M4A1 11
AK 12
Aug 13
M700 14
AWM 15
M60 17
DragSniper 23
Ak "says 74" 27
"ENgineer gun from BF2 small not shotgun" 28
XM8 30
Gali 32
"Old pistol six shooter" 33
Scar 34
Axe 35
SPAShotgun 36
//creds:whitegun
client info is this or close to it:
ClientInfo size 0xF8
L***ientShell + 0x64F4 = ClientInfo Clients [16]
This structure stores team, name, etc. You can work out the rest.
credits: ECsTaSY(mp*h)
vllt könnt ihr damit was anfangen
