Register for your free account! | Forgot your password?

Go Back   elitepvpers › Coders Den › General Coding
You last visited: Today at 23:59

  • Please register to post and access all features, it's quick, easy and FREE!

Advertisement



Wanting to learn to make cheats

Discussion on Wanting to learn to make cheats within the General Coding forum part of the Coders Den category.

Reply
 
Old   #16



 
Sheintan's Avatar
 
elite*gold: 81
Join Date: Apr 2011
Posts: 349
Received Thanks: 56
You should start with a simple external CS2 project first. Python can be easier for learning the basics, but C++ is generally a better choice for this kind of development. Internal or kernel-level development is much more difficult and not recommended for beginners.
Sheintan is offline  
Thanks
1 User
Old   #17
 
elite*gold: 0
Join Date: Mar 2011
Posts: 15
Received Thanks: 1
Quote:
Originally Posted by Sheintan View Post
You should start with a simple external CS2 project first. Python can be easier for learning the basics, but C++ is generally a better choice for this kind of development. Internal or kernel-level development is much more difficult and not recommended for beginners.
These are all things ill need to learn.

Virtual was the 🔑

True cr3 found, dtb done solely on dma.

Just putting it all together now, Hdcamera up next.

Monumental achievement for 3 weeks
suxers is offline  
Old   #18
 
elite*gold: 8
Join Date: Apr 2007
Posts: 466
Received Thanks: 122
Quote:
Originally Posted by MalwareEnjoyer View Post
I’ve seen people cache the memory from physical to virtual memory to speed up reading.

Kernel mapping will be the hardest thing you do in your journey. Be creative when you go hunting for a driver. My current driver was from a local mechanic shop used for firmware flashing for cars.

Perhaps it would be a good time to learn driver mapping then do cr3 with a driver. That’ll most likely like you find a solution
What books on assembly would you recommend?
jaren is offline  
Old   #19
 
MalwareEnjoyer's Avatar
 
elite*gold: 0
Join Date: Nov 2023
Posts: 466
Received Thanks: 140
Quote:
Originally Posted by suxers View Post
These are all things ill need to learn.

Virtual was the 🔑

True cr3 found, dtb done solely on dma.

Just putting it all together now, Hdcamera up next.

Monumental achievement for 3 weeks
are you doing kernel? I think you are foucsing on the wrong thing. Idk what step you at but doing cr3 isnt useful. You need to go into kernel drivers or at least something that can be applied universally.

Doing cr3 cant be applied to everything. 2ndly, this would fall under a bypass but isn't really a bypass anymore and is just the standard.

kernel mapping is what you wanna know 100%

what are you even working on right now?

writing in advance:

learn driver entries, you can normally see whats happening in 2s and know if its exploitable in 2s. If you look at this and know why its exploitable you in a good area but if not. id drop cr3 and move to drivers and x64 arch:







i know its kinda messy but yeah.

this driver is good for small projects off kdmapper. its safe to run alongside without issues. You can download the driver from dirctio.

if you wanna look into it, thus far ive only got and fixing

0x8011E044, 0x8011E048, 0x8011E04C, 0x8011E050,
0x8011E060, 0x8011E064, 0x8011E068, 0x8011E074,
0x8011E080, 0x8011E084, 0x8011E088, 0x8011E08C,
0x8011E090, 0x8011E094, 0x8011E098, 0x8011E09C,
0x8011E0A0, 0x8011E0A4, 0x8011E0A8,
0x80116054, 0x80116058, 0x8011605C, 0x80116078, 0x8011607C,
0x8011B941



Quote:
Originally Posted by jaren View Post
What books on assembly would you recommend?
doesnt matter really. its like buying clothing. same same

MalwareEnjoyer is offline  
Thanks
3 Users
Old   #20
 
elite*gold: 8
Join Date: Apr 2007
Posts: 466
Received Thanks: 122
Quote:
Originally Posted by MalwareEnjoyer View Post
are you doing kernel? I think you are foucsing on the wrong thing. Idk what step you at but doing cr3 isnt useful. You need to go into kernel drivers or at least something that can be applied universally.

Doing cr3 cant be applied to everything. 2ndly, this would fall under a bypass but isn't really a bypass anymore and is just the standard.

kernel mapping is what you wanna know 100%

what are you even working on right now?

writing in advance:

learn driver entries, you can normally see whats happening in 2s and know if its exploitable in 2s. If you look at this and know why its exploitable you in a good area but if not. id drop cr3 and move to drivers and x64 arch:







i know its kinda messy but yeah.

this driver is good for small projects off kdmapper. its safe to run alongside without issues. You can download the driver from dirctio.

if you wanna look into it, thus far ive only got and fixing

0x8011E044, 0x8011E048, 0x8011E04C, 0x8011E050,
0x8011E060, 0x8011E064, 0x8011E068, 0x8011E074,
0x8011E080, 0x8011E084, 0x8011E088, 0x8011E08C,
0x8011E090, 0x8011E094, 0x8011E098, 0x8011E09C,
0x8011E0A0, 0x8011E0A4, 0x8011E0A8,
0x80116054, 0x80116058, 0x8011605C, 0x80116078, 0x8011607C,
0x8011B941





doesnt matter really. its like buying clothing. same same

You're the man, thank you.. I'll start w/ that and follow your road map. Really appreciate the experience you're sharing here. I'm mostly interested in developing tools/bots for MMOs and such.
jaren is offline  
Old   #21
 
MalwareEnjoyer's Avatar
 
elite*gold: 0
Join Date: Nov 2023
Posts: 466
Received Thanks: 140
Quote:
Originally Posted by jaren View Post
You're the man, thank you.. I'll start w/ that and follow your road map. Really appreciate the experience you're sharing here. I'm mostly interested in developing tools/bots for MMOs and such.
I dont know what MMOs are but you wouldnt need to learn x64 arch. That's only for driver loading really. You need to know the os 1:1 to load drivers. You can skip that part and just learn like memory and such. not assembly
MalwareEnjoyer is offline  
Old   #22
 
elite*gold: 8
Join Date: Apr 2007
Posts: 466
Received Thanks: 122
Quote:
Originally Posted by MalwareEnjoyer View Post
I dont know what MMOs are but you wouldnt need to learn x64 arch. That's only for driver loading really. You need to know the os 1:1 to load drivers. You can skip that part and just learn like memory and such. not assembly
Ah I see. Would u still recommend C++ mainly? I'm sort of proficient in C# and I've made a somewhat decent pixel bot for silkroad online (MMO) but that's about it. I guess i just don't know what next logical step is. MMOs are games like world of warcraft, guild wars, etc..


Also I definitely want to learn the foundations of C as I feel that will really broaden my knowledge of programming fundamentals, as I've probably skipped a bunch of important ****.
jaren is offline  
Old   #23
 
MalwareEnjoyer's Avatar
 
elite*gold: 0
Join Date: Nov 2023
Posts: 466
Received Thanks: 140
Quote:
Originally Posted by jaren View Post
Ah I see. Would u still recommend C++ mainly? I'm sort of proficient in C# and I've made a somewhat decent pixel bot for silkroad online (MMO) but that's about it. I guess i just don't know what next logical step is. MMOs are games like world of warcraft, guild wars, etc..


Also I definitely want to learn the foundations of C as I feel that will really broaden my knowledge of programming fundamentals, as I've probably skipped a bunch of important ****.
ok

are there anti-cheats + do they HWID ban?

what are the games engines?

what protection are they running?

if they have a anti-cheat plus hwiding.Youd need asmx64 or etc.

if there arent dumpers for your game engine, youd have to reverse it yourself.

if there is protection youd have to reverse it.

it depends on what your goal is and what you wanna do in life. I do system engineering now irl. I got the job through driver loading. No relation but yeah
MalwareEnjoyer is offline  
Old   #24
 
elite*gold: 8
Join Date: Apr 2007
Posts: 466
Received Thanks: 122
Quote:
Originally Posted by MalwareEnjoyer View Post
ok

are there anti-cheats + do they HWID ban?

what are the games engines?

what protection are they running?

if they have a anti-cheat plus hwiding.Youd need asmx64 or etc.

if there arent dumpers for your game engine, youd have to reverse it yourself.

if there is protection youd have to reverse it.

it depends on what your goal is and what you wanna do in life. I do system engineering now irl. I got the job through driver loading. No relation but yeah
I have my BS in software engineering w/ a track in C# but I feel kind of lost because my rl job is not computer related at all but I get paid a lot so.. I do like data and so I've thought about data analysis for my masters but something about making a program that automates something in game gets me excited, know what I mean?

As far as anti-cheat systems.. for a game like silkroad online, which is what I'm currently making tools for (but it is a dying game and really it is just for learning purposes), it uses hackshield or maxiguard.. maxiguard I'm pretty sure is just a .dll filter that is usually bypassed w/ VM. There are also public repos on github w/ working bots that I can look at, but private servers are now implementing this maxiguard protection against regular bots (because they have macro bots in game), which is super ironic. For WoW, this is what google states:

WoW uses Warden anti-cheat to scan memory. It analyzes player behavior for repetitive patterns. The addon API blocks automated gameplay inputs.
jaren is offline  
Thanks
1 User
Old   #25
 
MalwareEnjoyer's Avatar
 
elite*gold: 0
Join Date: Nov 2023
Posts: 466
Received Thanks: 140
Quote:
Originally Posted by jaren View Post
I have my BS in software engineering w/ a track in C# but I feel kind of lost because my rl job is not computer related at all but I get paid a lot so.. I do like data and so I've thought about data analysis for my masters but something about making a program that automates something in game gets me excited, know what I mean?

As far as anti-cheat systems.. for a game like silkroad online, which is what I'm currently making tools for (but it is a dying game and really it is just for learning purposes), it uses hackshield or maxiguard.. maxiguard I'm pretty sure is just a .dll filter that is usually bypassed w/ VM. There are also public repos on github w/ working bots that I can look at, but private servers are now implementing this maxiguard protection against regular bots (because they have macro bots in game), which is super ironic. For WoW, this is what google states:

WoW uses Warden anti-cheat to scan memory. It analyzes player behavior for repetitive patterns. The addon API blocks automated gameplay inputs.

Realistically, I was once like you. That feeling goes away after you make your fist cheat and make couple thousand. I used to be such a happy person when speaking to people. Hello, how are you doing? Etc etc MSP style.

Now after doing it for so long. It’s no longer fun. That feeling is gone. Now I spend lots of time creating a bypass for X Y Z and I don’t have that thrill as much.

So it all goes back to you as a person and what you wanna do in life. It’ll take an extremely long time to fully understand it all. We talking 3 years minimum to even make a bypass for a shitty game at the bare minimum.

I feel sorry for you man but definitely remember the human mind is against you. It’ll never be satisfied. It will always want more or have something to chase. Once you achieve that goal it’s becomes boring and it’s more so. What’s next?

Life is like gta5 man. When you play it with friends and mess around it’s fun. When you just mod your money it’s boring. Enjoy and appreciate the things you have not what don’t you have. Follow what you genuinely see yourself doing for extended periods of time.

If you wanna start your journey get into assembly and it’ll all fall together. Assembly because that’s more towards the os and I’d say that’s more beneficial then learning the cheat logic side of things. Learning the OS will also help you land a job easily in the future.

I know I said previously don’t do assembly but from that message I definitely recommend it. Like I said previously. Don’t go into this with the mindset of cheats. Don’t even think of that. Understand what happens internally then in the future start applying that knowledge to the cheat logic
MalwareEnjoyer is offline  
Old   #26
 
elite*gold: 0
Join Date: Mar 2011
Posts: 15
Received Thanks: 1
Quote:
Originally Posted by MalwareEnjoyer View Post
are you doing kernel? I think you are foucsing on the wrong thing. Idk what step you at but doing cr3 isnt useful. You need to go into kernel drivers or at least something that can be applied universally.

Doing cr3 cant be applied to everything. 2ndly, this would fall under a bypass but isn't really a bypass anymore and is just the standard.

kernel mapping is what you wanna know 100%

what are you even working on right now?

writing in advance:

learn driver entries, you can normally see whats happening in 2s and know if its exploitable in 2s. If you look at this and know why its exploitable you in a good area but if not. id drop cr3 and move to drivers and x64 arch:







i know its kinda messy but yeah.

this driver is good for small projects off kdmapper. its safe to run alongside without issues. You can download the driver from dirctio.

if you wanna look into it, thus far ive only got and fixing

0x8011E044, 0x8011E048, 0x8011E04C, 0x8011E050,
0x8011E060, 0x8011E064, 0x8011E068, 0x8011E074,
0x8011E080, 0x8011E084, 0x8011E088, 0x8011E08C,
0x8011E090, 0x8011E094, 0x8011E098, 0x8011E09C,
0x8011E0A0, 0x8011E0A4, 0x8011E0A8,
0x80116054, 0x80116058, 0x8011605C, 0x80116078, 0x8011607C,
0x8011B941





doesn't matter really. its like buying clothing. same same

Basic ESP, DMA Only(GoodFirmware)
/ Fuser/ MAKBox/Kmbox--Will look at this after ESP

Gaming PC runs:
- Game.exe
- Entitas ECS / Il2Cpp runtime
- HDCamera, PositionComponent, ItemDataContext
- GameAssembly.dll (GameContextModule)
- ScanMacro.ahk (auto-move input)
|
Radar PC runs:
- GameECSReader.exe
- VAD heap scan (decoy DTB)
- klass-heap scan (true CR3 phys)
- TypeInfo read (true CR3 phys)
- Upgrade/harvest (class name verify)
- Hot refresh (WorldVector blob)
- client.exe (imgui overlay)
- reads loot_snapshot.json + view_proj matrix → W2S → screen render

No injection. No hooks. No driver. FPGA reads physical memory. Page tables translate.

But yes, Short answer: true CR3 was never the full key but a door to a few more doors. It’s a proof path for when AC splits PE page tables from heap/process DTB.
The VM method was built so after a restart you can:

1. Find Game
2. Get live GA VA + PA
3. Hunt a CR3 that phys-walks that GA with MZ
4. Pin that as SANDECS_DTB / true, keep decoy for heaps

That’s the soft unlock: not permanent, but a reproducible attach after every Game launch.

So what was the point?
Value of true-CR3 / VM method:
Re-find Game + GA after every new PID
Prove PE with MZ (no phantom identity)
Know when dual-DTB is real vs collapsed
When true does walk GA, PE/TypeInfo can be cleaner under AC
Avoid soft-harvest / wrong GA
true CR3 I'm using it to prove decoy is the PE owner this time instead of guessing dead pins from the old PID.

Updated:
HARD_ENTITY
found through verified managed heap object headers , the object has a valid klass pointer (at offset +0x00 → +0x08 → +0x10 klass chain) to a known class name ( "PositionComponent" or "ItemData") via TypeInfo

HD VP =from_hd=true, hd_camera set
live eye=LIVE_CAM while walking (dCamXZ 5–25m)
space lock=player_xyz = cam_xyz
distance=Nearest piles ~9–25m list sorted by eye

Where I go from here?

PHYS_SPINE attach path
Dense ENTITY loot
Dual-DTB upgrade

Biggest issue is a stale GA_PA, I'll include it as a gate and pin field, not as an addressing mode.
suxers is offline  
Old   #27
 
MalwareEnjoyer's Avatar
 
elite*gold: 0
Join Date: Nov 2023
Posts: 466
Received Thanks: 140
Quote:
Originally Posted by suxers View Post
Basic ESP, DMA Only(GoodFirmware)
/ Fuser/ MAKBox/Kmbox--Will look at this after ESP

Gaming PC runs:
- Game.exe
- Entitas ECS / Il2Cpp runtime
- HDCamera, PositionComponent, ItemDataContext
- GameAssembly.dll (GameContextModule)
- ScanMacro.ahk (auto-move input)
|
Radar PC runs:
- GameECSReader.exe
- VAD heap scan (decoy DTB)
- klass-heap scan (true CR3 phys)
- TypeInfo read (true CR3 phys)
- Upgrade/harvest (class name verify)
- Hot refresh (WorldVector blob)
- client.exe (imgui overlay)
- reads loot_snapshot.json + view_proj matrix → W2S → screen render

No injection. No hooks. No driver. FPGA reads physical memory. Page tables translate.

But yes, Short answer: true CR3 was never the full key but a door to a few more doors. It’s a proof path for when AC splits PE page tables from heap/process DTB.
The VM method was built so after a restart you can:

1. Find Game
2. Get live GA VA + PA
3. Hunt a CR3 that phys-walks that GA with MZ
4. Pin that as SANDECS_DTB / true, keep decoy for heaps

That’s the soft unlock: not permanent, but a reproducible attach after every Game launch.

So what was the point?
Value of true-CR3 / VM method:
Re-find Game + GA after every new PID
Prove PE with MZ (no phantom identity)
Know when dual-DTB is real vs collapsed
When true does walk GA, PE/TypeInfo can be cleaner under AC
Avoid soft-harvest / wrong GA
true CR3 I'm using it to prove decoy is the PE owner this time instead of guessing dead pins from the old PID.

Updated:
HARD_ENTITY
found through verified managed heap object headers , the object has a valid klass pointer (at offset +0x00 → +0x08 → +0x10 klass chain) to a known class name ( "PositionComponent" or "ItemData") via TypeInfo

HD VP =from_hd=true, hd_camera set
live eye=LIVE_CAM while walking (dCamXZ 5–25m)
space lock=player_xyz = cam_xyz
distance=Nearest piles ~9–25m list sorted by eye

Where I go from here?

PHYS_SPINE attach path
Dense ENTITY loot
Dual-DTB upgrade

Biggest issue is a stale GA_PA, I'll include it as a gate and pin field, not as an addressing mode.
What game you doing this for may I ask?
MalwareEnjoyer is offline  
Old   #28
 
elite*gold: 0
Join Date: Mar 2011
Posts: 15
Received Thanks: 1
Quote:
Originally Posted by MalwareEnjoyer View Post
What game you doing this for may I ask?
AC=BE /UnityEngine

Sorry, thought I'd added the name, Sand:RoS

Quote:
Originally Posted by MalwareEnjoyer View Post
are you doing kernel? I think you are foucsing on the wrong thing. Idk what step you at but doing cr3 isnt useful. You need to go into kernel drivers or at least something that can be applied universally.

Doing cr3 cant be applied to everything. 2ndly, this would fall under a bypass but isn't really a bypass anymore and is just the standard.

kernel mapping is what you wanna know 100%

what are you even working on right now?

writing in advance:

learn driver entries, you can normally see whats happening in 2s and know if its exploitable in 2s. If you look at this and know why its exploitable you in a good area but if not. id drop cr3 and move to drivers and x64 arch:







i know its kinda messy but yeah.

this driver is good for small projects off kdmapper. its safe to run alongside without issues. You can download the driver from dirctio.

if you wanna look into it, thus far ive only got and fixing

0x8011E044, 0x8011E048, 0x8011E04C, 0x8011E050,
0x8011E060, 0x8011E064, 0x8011E068, 0x8011E074,
0x8011E080, 0x8011E084, 0x8011E088, 0x8011E08C,
0x8011E090, 0x8011E094, 0x8011E098, 0x8011E09C,
0x8011E0A0, 0x8011E0A4, 0x8011E0A8,
0x80116054, 0x80116058, 0x8011605C, 0x80116078, 0x8011607C,
0x8011B941





doesnt matter really. its like buying clothing. same same

clear a bit, unmap, i see it!

this is helpful to start with thanks.
suxers is offline  
Old   #29
 
elite*gold: 0
Join Date: Mar 2011
Posts: 15
Received Thanks: 1
Update: I've made some real improvements

So far the data size to get where I'm at is around 50gb
Built a tool box so that this can be done on any unity engine game, BE safe for now. Ive learned that more thrashing isnt always better! Turtoise and the hare right?!

But I have achieved hard unlocks across the board, it has required over 300 hours of in game time and about 5 weeks of back and forth with scanning.
suxers is offline  
Reply


Similar Threads Similar Threads
Silkroad Online Sever Files - Wanting To Learn Myself!
05/10/2021 - Silkroad Online - 3 Replies
I'm not here to say im going to make the next big server and throw out a clone pserver and act like ive created something insane lol, but i would love to have access to the latest/best version of the silkroad pserver files and learn how to work with it and have a shot at creating something, which maybe one day could be released publicly. I'm a web developer so have an understanding of code and can learn fast anything new like this, but nothing as far as what silkroad would use, but honestly...
Someone learn me how to make CF hack and i make it every week!
02/05/2016 - CrossFire Hacks, Bots, Cheats & Exploits - 14 Replies
Teach me how to make crossfire hacks if its detected i will make a new one and so on.
[Selling] learn 2 learn (Kurs)
08/24/2015 - Trading - 1 Replies
Hey, da in vielen Teilen Deutschlands langsam wieder die Schulzeit beginnt (und ich das heute erfahren durfte), damit auch die Lernezeit wieder beginnt, wollte ich euch folgendes Vorstellen. Und zwar ist das Lernen heute überall notwendig. Vom Leben als Schüler, zum Auszubildenden oder Studenten, bis hin zum Beruf -überall muss gerlernt werden. Meistens ist es aber dann so, dass es schwer ist, die ganzen Infos in seinen Schädel zu bekommen. Dafür ist dieser Kurs. Ich bin...
wanting to learn
03/28/2009 - Dekaron - 11 Replies
was wondering if any one could pass their hacking skills to me tired of just getting codes from others n such wanna make something of my own n stuff if not i understand if so msn is [email protected]



All times are GMT +2. The time now is 23:59.


Powered by vBulletin®
Copyright ©2000 - 2026, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.

Support | Contact Us | FAQ | Advertising | Privacy Policy | Terms of Service | Abuse
Copyright ©2026 elitepvpers All Rights Reserved.