Teleport/Speedhack + source

level 60 · 03/09/2011, 02:56

Also zunächst ich hatte noch keine Möglichkeit es zu testen, das kann ich erst morgen. Vielleicht funktioniert es, vllt ist es auch outdated, aber dann müsste man nur die Offsets ändern um es wieder zum laufen zu bringen.

(Download im Anhang)

Steuerung:
Numpad
0+1 = Set WP 1
0+2 = Set WP 2
0+3 = Set WP 3
0+4 = Lock Speed

1 = Warp to WP 1
2 = Warp to WP 2
3 = Warp to WP 3
4 = Display Speed
5 = + 10% speed
6 = - 10% speed

Source:

ccp:

Code:

#pragma comment(lib,"d3dx9.lib")
#pragma comment(lib,"user32.lib")
#pragma comment(lib,"Gdi32.lib")
#pragma comment(lib,"Advapi32.lib")
#pragma warning (disable:4244)
#pragma warning (disable:4996)
#include <windows.h>
#include <stdio.h>
#include <math.h>
#include <d3dx9.h>
#include <detours.h>
#include "Rift.h"

#define PlayerX 0xE615B4 //0xD47374
#define PlayerSpeed 0xE615B0 //0xD42670

char gMsg[6][256] = {0};
int ChatBoxX = 10;
int ChatBoxY = 125;
bool LockSpeed = false;
bool bCreateTheFont = true;
float x,y,z,Speed,LockedSpeed = 0;
float WaypointX[8],WaypointY[8],WaypointZ[8] = {0};

void DisplayChatWnd()
{
        DrawConString(ChatBoxX,ChatBoxY-5,255,0,0,255,"__________________");
        DrawConString(ChatBoxX,ChatBoxY+5,255,255,255,255,gMsg[0]);
        DrawConString(ChatBoxX,ChatBoxY+15,255,255,255,255,gMsg[1]);
        DrawConString(ChatBoxX,ChatBoxY+25,255,255,255,255,gMsg[2]);
        DrawConString(ChatBoxX,ChatBoxY+35,255,255,255,255,gMsg[3]);
        DrawConString(ChatBoxX,ChatBoxY+45,255,255,255,255,gMsg[4]);
        DrawConString(ChatBoxX,ChatBoxY+55,255,255,255,255,gMsg[5]);
        DrawConString(ChatBoxX,ChatBoxY+60,255,0,0,255,"__________________");
}

void AddText(const char *text, ...)
{
        va_list va_alist;
        va_start(va_alist, text);

        char logbuf[256] = {0};
        _vsnprintf(logbuf+strlen(logbuf), sizeof(logbuf) - strlen(logbuf), text, va_alist);

        va_end(va_alist);

        strcpy(gMsg[0],gMsg[1]);
        strcpy(gMsg[1],gMsg[2]);
        strcpy(gMsg[2],gMsg[3]);
        strcpy(gMsg[3],gMsg[4]);
        strcpy(gMsg[4],gMsg[5]);
        strcpy(gMsg[5],logbuf);
}

void GetPlayerLocation(void)
{
        DWORD RiftBase = (DWORD)GetModuleHandleA("rift.exe");
        x,y,z = 0;
        DWORD thefirst  = (RiftBase+PlayerX);
        DWORD thesecond = (*(DWORD*)thefirst + 0x4);
        DWORD thethird  = (*(DWORD*)thesecond + 0x104);
        DWORD thefourth = (*(DWORD*)thethird + 0x20);
        DWORD theresultx = (*(DWORD*)thefourth + 0xD0); 
        x = (*(float*)theresultx);
        DWORD theresulty = (*(DWORD*)thefourth + 0xD8);
        y = (*(float*)theresulty);
        DWORD theresultz = (*(DWORD*)thefourth + 0xD4);
        z = (*(float*)theresultz);
}


void SetPlayerLocation(float x, float y, float z)
{
        DWORD RiftBase = (DWORD)GetModuleHandleA("rift.exe");

        DWORD thefirst  = (RiftBase+PlayerX);
        DWORD thesecond = (*(DWORD*)thefirst + 0x4);
        DWORD thethird  = (*(DWORD*)thesecond + 0x104);
        DWORD thefourth = (*(DWORD*)thethird + 0x20);
        DWORD theresultx = (*(DWORD*)thefourth + 0xD0);
        DWORD theresulty = (*(DWORD*)thefourth + 0xD8);
        DWORD theresultz = (*(DWORD*)thefourth + 0xD4);
        if (x) (*(float*)theresultx) = x;
        if (y) (*(float*)theresulty) = y;
        if (z) (*(float*)theresultz) = z;
}

void GetPlayerSpeed(void)
{
        DWORD RiftBase = (DWORD)GetModuleHandleA("rift.exe");
        Speed = 1;
        DWORD thefirst  = (RiftBase+PlayerSpeed);
        DWORD thesecond = (*(DWORD*)thefirst + 0xFC);
        DWORD thethird  = (*(DWORD*)thesecond + 0x20);
        DWORD theresult = (*(DWORD*)thethird + 0xD4);
        Speed = (*(float*)theresult);
}


void SetPlayerSpeed(float s)
{
        DWORD RiftBase = (DWORD)GetModuleHandleA("rift.exe");
        
        DWORD thefirst  = (RiftBase+PlayerSpeed);
        DWORD thesecond = (*(DWORD*)thefirst + 0xFC);
        DWORD thethird  = (*(DWORD*)thesecond + 0x20);
        DWORD theresult = (*(DWORD*)thethird + 0xD4);
        if (LockSpeed) 
                (*(float*)theresult) = LockedSpeed;
        else  if (s >= 0 && s <= 2) (*(float*)theresult) = s;
}

void SetWP(int i) 
{ 
        AddText("Waypoint %i set.",i);
        GetPlayerLocation();
        WaypointX[i] = x;
        WaypointY[i] = y;
        WaypointZ[i] = z;
}

HRESULT WINAPI nBeginScene(LPDIRECT3DDEVICE9 pDevice)
{
        _asm NOP;
        HRESULT hRet = pBeginScene(pDevice);

        if( bCreateTheFont )
        { 
                bCreateTheFont=false;  
                D3DXCreateFontA( pDevice, 12, 0, FW_BOLD, 1, FALSE,DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, ANTIALIASED_QUALITY, DEFAULT_PITCH | FF_DONTCARE, "Arial", &Fonte[12]);
                D3DXCreateFontA( pDevice, 15, 7, FW_THIN, 1, FALSE,DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, ANTIALIASED_QUALITY, DEFAULT_PITCH | FF_DONTCARE, "Gill Sans MT Condensed", &Fonte[3]);
        }

        //if (LockSpeed) SetPlayerSpeed(LockedSpeed);

        //DisplayChatWnd();
        
        return hRet;
}



BOOL Load(void)
{     

        DWORD RiftBase=(DWORD)GetModuleHandleA("rift.exe");
        DWORD d3d9DLL=(DWORD)GetModuleHandle("d3d9.dll");

        if ( d3d9DLL && RiftBase )
        {
                DWORD *vTable;
                addrD3DBase=dwFindPattern(d3d9DLL,0x128000,patternD3DBase,maskD3DBase); 

                if ( addrD3DBase ) 
                {
                        memcpy(&vTable,(void *)(addrD3DBase+2),4);
                        
                        pBeginScene = (BeginScene_)DetourFunction((PBYTE)vTable[42],(PBYTE)nBeginScene);
                        pReset = (Reset_t)DetourFunction((PBYTE)vTable[16],(PBYTE)nReset);
                        pCreateQuery = (CreateQuery_)DetourFunction((PBYTE)vTable[118],(PBYTE)nCreateQuery);
                        pSetViewport = (SetViewport_t)DetourFunction((PBYTE)vTable[47],(PBYTE)nSetViewport);
                }
        }

        while (1)
        {
                if(GetAsyncKeyState(VK_NUMPAD0)) 
                {
                        if(GetAsyncKeyState(VK_NUMPAD1)) SetWP(1);
                        if(GetAsyncKeyState(VK_NUMPAD2)) SetWP(2);
                        if(GetAsyncKeyState(VK_NUMPAD3)) SetWP(3);

                        if(GetAsyncKeyState(VK_NUMPAD4))
                        {               
                                LockSpeed = !LockSpeed;
                                if (LockSpeed) 
                                {
                                        GetPlayerSpeed();
                                        LockedSpeed = Speed;
                                        AddText("Speed locked %g", Speed);
                                }
                                else AddText("Speed unlocked");
                        }
                }
                else
                {
                        if(GetAsyncKeyState(VK_NUMPAD1)) 
                        {
                                if (WaypointX[1]&&WaypointY[1]&&WaypointZ[1])
                                {
                                        AddText("Warped to WP 1");
                                        SetPlayerLocation(WaypointX[1],WaypointY[1],WaypointZ[1]);
                                }
                                else AddText("No WP set...");
                        }

                        if(GetAsyncKeyState(VK_NUMPAD2)) 
                        {
                                if (WaypointX[2]&&WaypointY[2]&&WaypointZ[2])
                                {
                                        AddText("Warped to WP 2");
                                        SetPlayerLocation(WaypointX[2],WaypointY[2],WaypointZ[2]);
                                }
                                else AddText("No WP set...");
                        }

                        if(GetAsyncKeyState(VK_NUMPAD3))
                        {
                                if (WaypointX[3]&&WaypointY[3]&&WaypointZ[3])
                                {
                                        AddText("Warped to WP 3");
                                        SetPlayerLocation(WaypointX[3],WaypointY[3],WaypointZ[3]);
                                }
                                else AddText("No WP set...");
                        }

                        if(GetAsyncKeyState(VK_NUMPAD4))
                        {
                                SetPlayerSpeed(1);
                                GetPlayerSpeed();
                                AddText("Speed= %g", Speed);
                        }

                        if(GetAsyncKeyState(VK_NUMPAD5))
                        {
                                SetPlayerSpeed(Speed-0.1f);
                                GetPlayerSpeed();
                                AddText("Speed- %g", Speed);
                        }

                        if(GetAsyncKeyState(VK_NUMPAD6))
                        {
                                SetPlayerSpeed(Speed+0.1f);
                                GetPlayerSpeed();
                                AddText("Speed+ %g", Speed);
                        }
                
                        
                }
                if(GetAsyncKeyState(VK_END)) FreeLibraryAndExitThread(GetModuleHandle("pRift.dll"),0);
                Sleep(100);
        }

        return 0;
}

BOOL WINAPI DllMain (HMODULE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
        switch (fdwReason)
        {
                case DLL_PROCESS_ATTACH:
                {
                        CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)Load, NULL, NULL, NULL);
                        break;
                }
                case DLL_PROCESS_DETACH:
                {
                        DetourRemove((PBYTE)pBeginScene, (PBYTE)nBeginScene);
                        DetourRemove((PBYTE)pReset, (PBYTE)nReset);
                        DetourRemove((PBYTE)pCreateQuery, (PBYTE)nCreateQuery);
                        DetourRemove((PBYTE)pSetViewport, (PBYTE)nSetViewport);
                        break;
                }
                break;
        }
        return TRUE;
}

Rift.h:

Code:

DWORD addrD3DBase;
PBYTE patternD3DBase=(PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86";
char maskD3DBase[]="xx????xx????xx";

bool bDataCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
    for(;*szMask;++szMask,++pData,++bMask)
        if(*szMask=='x' && *pData!=*bMask )
            return false;
    return (*szMask) == NULL;
}
DWORD dwFindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
    for(DWORD i=0; i < dwLen; i++)
        if( bDataCompare( (BYTE*)( dwAddress+i ),bMask,szMask) )
            return (DWORD)(dwAddress+i);
   
    return 0;
}
//lolstolen
float ScreenCenterX,ScreenCenterY = 0;

typedef HRESULT(WINAPI* BeginScene_)(LPDIRECT3DDEVICE9 pDevice);
BeginScene_ pBeginScene;

typedef HRESULT(WINAPI* CreateQuery_)(LPDIRECT3DDEVICE9 pDevice, D3DQUERYTYPE Type,IDirect3DQuery9** ppQuery);
CreateQuery_ pCreateQuery;

typedef HRESULT ( WINAPI* Reset_t )( LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters );
Reset_t pReset;

typedef HRESULT ( WINAPI* SetViewport_t )( LPDIRECT3DDEVICE9 pDevice, CONST D3DVIEWPORT9 *pViewport );
SetViewport_t pSetViewport;

ID3DXFont * Fonte[13];


void DrawConString(int x, int y, int Red, int Green, int Blue, int Alpha, const char *text, ...)
{
        LPD3DXFONT Font = Fonte[12];
        D3DCOLOR fontColor = D3DCOLOR_ARGB(Alpha, Red, Green, Blue);

        RECT rct;
        rct.left=x; 
        rct.top=y; 
        rct.right=rct.left+1000;
        rct.bottom=rct.top+1000;

        va_list va_alist;
        va_start(va_alist, text);

        char logbuf[256] = {0};
        _vsnprintf(logbuf+strlen(logbuf), sizeof(logbuf) - strlen(logbuf), text, va_alist);

        va_end(va_alist);

        Font->DrawTextA(NULL, logbuf, -1, &rct, 0, fontColor );
}

HRESULT WINAPI nReset( LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters )
{
        _asm NOP;

        if( Fonte[12] )
                Fonte[12]->OnLostDevice();

        HRESULT hRet = pReset(pDevice, pPresentationParameters);

        if(hRet == D3D_OK && Fonte[12])

        return hRet;
}

HRESULT WINAPI nSetViewport(LPDIRECT3DDEVICE9 pDevice, CONST D3DVIEWPORT9 *pViewport)
{
        _asm NOP;
        HRESULT hRet = pSetViewport(pDevice, pViewport);

        ScreenCenterX = ( float )pViewport->Width / 2;
        ScreenCenterY = ( float )pViewport->Height / 2; 

        return hRet;
}
HRESULT WINAPI nCreateQuery(LPDIRECT3DDEVICE9 pDevice, D3DQUERYTYPE Type,IDirect3DQuery9** ppQuery) 
{ 
        if( Type == D3DQUERYTYPE_OCCLUSION ) Type = D3DQUERYTYPE_TIMESTAMP; 
        return pCreateQuery( pDevice, Type, ppQuery );
}

Das Programm ist nicht von mir, ich poste es nur hier. Credits gehen an "Pwno".

Ich werde mir das in den nächsten Tagen anschauen und evtl aktualisieren. Vielleicht gibt es hier auch einige coder die was damit anfangen können.

mfg
Level 60

Childish · 03/09/2011, 17:58

It's "safe"

rofl.

level 60 · 03/09/2011, 23:02

Quote:

Originally Posted by Childish

It's "safe"

rofl.

It is a DLL injector therefore gives false positive results.
If you dont trust it you might compile the code manually.

ivorjoint · 03/10/2011, 11:16

it fails to inject

vinko4444 · 03/10/2011, 16:26

kommt immer verify failed wie muss mann denn injecten?

whypire · 03/13/2011, 11:47

don't speedhax and teleport in Rift. They can detect it server-side and ban your ***... I got banned once for speedhacking.

PrzeM3333 · 04/01/2011, 21:16

Quote:

Originally Posted by whypire

don't speedhax and teleport in Rift. They can detect it server-side and ban your ***... I got banned once for speedhacking.

You got banned forever or 24h?

.SaFe · 04/02/2011, 09:31

Quote:

Originally Posted by level 60

It is a DLL injector therefore gives false positive results.
If you dont trust it you might compile the code manually.

sure , but not so much positive ;O

highlolz · 04/20/2011, 02:30

Quote:

Originally Posted by ironious

You are full of ****. Rift has no cheat detection software. If you were banned its because you are an idiot and were hacking in front of other players nad you were reported

and from witch source do you know that dude?

ironious · 04/23/2011, 21:07

Quote:

Originally Posted by highlolz

and from witch source do you know that dude?

WoW has Warden anti cheat software. This game has nothing. I heard it from a bot creator on *******.com Lots of games have no anti cheat software. Its not un-common. the biggest way you get caught is you are seen by a GM or are reported by a player.

Oh yeah, this bot is a Trojan. Kaspersky caught it right away. This is why its not working for anyone or injecting properly.

mgX · 04/25/2011, 03:19

Quote:

Originally Posted by ironious

WoW has Warden anti cheat software. This game has nothing. I heard it from a bot creator on *******.com Lots of games have no anti cheat software. Its not un-common. the biggest way you get caught is you are seen by a GM or are reported by a player.

Oh yeah, this bot is a Trojan. Kaspersky caught it right away. This is why its not working for anyone or injecting properly.

Trojan?? Did you even bother reading the sourcecode? Theres nothing trojanic in that except for a dll injection....

martincavas · 04/25/2011, 21:16

The code might be clean as I did not checked it, but the compiled version could have couple of lines that could affect users in a malicious way. Because everyones a leecher here and nobody knows how to compile, theyll just take your file and use it in the hope itll work.

Please bann this idiot.

BlackDragon85 · 04/27/2011, 12:10

Warning: trojaner

eleos9334 · 04/27/2011, 16:37

Same.

Gozzinela · 05/03/2011, 16:07

Trojan WARNING