[Collection Thread] War Rock Cheat Programming Discussion

[MRx86™]

Since nobody at today was able to make IsAlive check... The real once which warrock doing. and everyone checking it from health.. and since i found it 1 year ago. i'm sharing now the real ISALIVE CHECK FOR WarRock..

How i came to this conclusion which say this was IS the IsAliveCheck..
Around 1 year ago i was looking crosshairs code of warrock...
and i found this thing which wasn't the thing which i was looking but during the checking i founded out also this ...

how i came up to this conclusion, when you are getting killed your crosshairs left your screen. that how i cam up this conclusion.

00586BB3 3905 90E5AD00 cmp dword ptr [ADE590], eax
00586BB9 75 18 jnz short 00586BD3 // its always crosshairs which enable crosshairs always if be nopped.
00586BBB A1 A49EAD00 mov eax, dword ptr [AD9EA4]
00586BC0 8BB8 D8C40000 mov edi, dword ptr [eax+C4D8]
00586BC6 E8 DE0CE9FF call 004178A9
00586BCB 3BC7 cmp eax, edi
00586BCD 74 04 je short 00586BD3
00586BCF B1 01 mov cl, 1
00586BD1 EB 02 jmp short 00586BD5
00586BD3 32C9 xor cl, cl
00586BD5 8B46 44 mov eax, dword ptr [esi+44]
00586BD8 E8 A3460D00 call 0065B280
00586BDD 80BE 24010000 0>cmp byte ptr [esi+124], 0
00586BE4 0F84 C5010000 je 00586DAF

00586BBB A1 A49EAD00 mov eax, dword ptr [AD9EA4]
00586BC0 8BB8 D8C40000 mov edi, dword ptr [eax+C4D8]
00586BC6 E8 DE0CE9FF call 004178A9 call to IsAliveCheck

00417892 57 push edi
00417893 8B3D D87EAD00 mov edi, dword ptr [AD7ED8]
00417899 68 40638C00 push 008C6340 ; ASCII "CLS_DIE"
0041789E 6A 05 push 5
004178A0 59 pop ecx
004178A1 E8 7A9E2C00 call 006E1720
004178A6 59 pop ecx
004178A7 5F pop edi
004178A8 C3 retn
004178A9 A1 F49EAD00 mov eax, dword ptr [AD9EF4]
004178AE 85C0 test eax, eax
004178B0 75 22 jnz short 004178D4
004178B2 6A 08 push 8
004178B4 E8 CB6A4100 call 0082E384 ; jmp to MSVCR90.operator new
004178B9 59 pop ecx
004178BA 85C0 test eax, eax
004178BC 74 0F je short 004178CD
004178BE 6A 03 push 3
004178C0 59 pop ecx
004178C1 C700 1C6B8C00 mov dword ptr [eax], 008C6B1C
004178C7 66:8948 04 mov word ptr [eax+4], cx
004178CB EB 02 jmp short 004178CF
004178CD 33C0 xor eax, eax
004178CF A3 F49EAD00 mov dword ptr [AD9EF4], eax
004178D4 C3 retn

Since if you know when you are dead inside the game crosshairs left your screen.


how does disasembled code look in c++

DWORD PlayerPtr = *(DWORD*)0xAD9EA4;
if ( PlayerPtr != 0 )
{
       if ( *(DWORD*)(PlayerPtr+0xC4D8) !=  *(DWORD*)0xAD9EF4 /*Is Alive ptr*/ )
       {
            // Your Player or other player are ALIVE

       }
}

P.S if you understand this code you can also make spawn check invicibility check which also no one was able to do... in the whole STORY of warrock..



P.S every credit for this going TO GHTheBoss aka TheBoss from GameHacks also the GameHacks Owner
Skype : GHTheBoss

[Cyno™]

Cool thx

[MRx86™]

Also another contribute to this great community...

WarRock Engine Font :P draw directly with WarRock Font with out using any directx font inside your cheats :P warrock doing the job for you....

First of all you should know about engine font...
WarRock didn't use any D3D releated font...
WarRock is Using GDI Library for draw text ingame...
Api used to DrawFont is DrawTextW ( which is UNICODE )

Why using engine font ? well engine font should be always better...

one of the milion of thing which can be cool.
You don't need to reset font, warrock reset it for you.

IDA PSEUDO CODE FROM AN OLD CLIENT VERSION

_int32 __stdcall sub_65D410(int a1, const WCHAR chText)
{
HDC v3; // edi@1
HDC v4; // esi@1
struct tagRECT rc; // [sp+Ch] [bp-10h]@1

v3 = GetDC(o);
v4 = CreateCompatibleDC(v3);
SelectObject(v4, *(HGDIOBJ *)(a1 + 116));
rc.left = 0;
rc.top = 0;
rc.right = 0;
rc.bottom = 0;
DrawTextW(v4, &chText, 1, &rc, 0xC00u);
DeleteDC(v4);
ReleaseDC(0, v3);
return rc.right - rc.left;
}

NEW FUNCTION FROM LAST EST CLIENT...

006566F0 83EC 10 sub esp, 10
006566F3 53 push ebx
006566F4 56 push esi
006566F5 57 push edi
006566F6 33DB xor ebx, ebx
006566F8 53 push ebx
006566F9 FF15 68388B00 call dword ptr [8B3868]
006566FF 8BF8 mov edi, eax
00656701 57 push edi
00656702 FF15 88308B00 call dword ptr [8B3088] ; GDI32.CreateCompatibleDC
00656708 8BF0 mov esi, eax
0065670A 8B4424 20 mov eax, dword ptr [esp+20]
0065670E 8B48 74 mov ecx, dword ptr [eax+74]
00656711 51 push ecx
00656712 56 push esi
00656713 FF15 78308B00 call dword ptr [8B3078] ; GDI32.SelectObject
00656719 68 000C0000 push 0C00
0065671E 8D5424 10 lea edx, dword ptr [esp+10]
00656722 52 push edx
00656723 6A 01 push 1
00656725 8D4424 30 lea eax, dword ptr [esp+30]
00656729 50 push eax
0065672A 56 push esi
0065672B 895C24 20 mov dword ptr [esp+20], ebx
0065672F 895C24 24 mov dword ptr [esp+24], ebx
00656733 895C24 28 mov dword ptr [esp+28], ebx
00656737 895C24 2C mov dword ptr [esp+2C], ebx
0065673B FF15 44388B00 call dword ptr [8B3844]
00656741 56 push esi
00656742 FF15 74308B00 call dword ptr [8B3074] ; GDI32.DeleteDC
00656748 57 push edi
00656749 53 push ebx
0065674A FF15 40388B00 call dword ptr [8B3840]
00656750 8B4424 14 mov eax, dword ptr [esp+14]
00656754 2B4424 0C sub eax, dword ptr [esp+C]
00656758 5F pop edi
00656759 5E pop esi
0065675A 5B pop ebx
0065675B 83C4 10 add esp, 10
0065675E C2 0800 retn 8

#define ADDR_ENGINEFONT 0x6566F0
typedef the function and start drawing with warrock font ..

Another typ regarding your hook if you want a safe hook ... warrock call each frame multiwidebytetochar( i don't remember exactly api name) which is used by warrock font ... you can hook your menu inside multiwidebytetochar( i don't remember exactly api name)...

Engine font result here my menu is being drawed by warrock.

P.S every credit for this going TO GHTheBoss aka TheBoss from GameHacks also the GameHacks Owner
Skype : GHTheBoss

you got a nice charity today

[Cyno™]

nice post

[babyiloveyou12]

Request.
How to calculate GM warning.

[Kazbah__]

You dont need to calculate it there is a addy inside warrock.exe

[babyiloveyou12]

Originally Posted by Kazbah__

You dont need to calculate it there is a addy inside warrock.exe

But they said that your going to calculate it!
Base+E4etc etc! i guess

[v1pclan5]

Searching for a Position logger,
or something else where i can read Ingame my xyz position (:

[Phantom.]

Originally Posted by v1pclan5

Searching for a Position logger,
or something else where i can read Ingame my xyz position (:

Use Cheat Engine, add the X,Y,Z Coordinates manually and than u can see ur Position.

[v1pclan5]

Originally Posted by Phantom.

Use Cheat Engine, add the X,Y,Z Coordinates manually and than u can see ur Position.

Can you explain me this a little bit more?
Cheat engine will detectet from warrock or not?

[Alliance™]

Someone can help me i have this problem:

This address fo example (0x0040D700) contains char unicode example UNICODE ("A");
The next address (0x0040D700+1),(0x0040D700+2)... contains other char UNICODE;
I wont to change address value UNICODE with other char of string ,example "Hello";
I use this method:

DWORD address=0x0040D700;
wchar_t *text=L"Hello";

for(int i=0;i<wcslen(text);i++)
{
*(DWORD*)(address+i)=text[i];
}

This method work , change the pointer value but display ASCII char and not UNICODE char when i debugg with ollydbg.
I need store a UNICODE char somenone know what i change in my code?

[NikM]

wchar_t's size is 2 Bytes.

for (int i = 0; i<wcslen(text); i++)
{
	*(wchar_t*)(address + (i * 2)) = text[i];
}

[AmazingTurtle]

@NikM optimiert

for (int i = 0; i < wcslen(text); i++)
	*reinterpret_cast<wchar_t*>(address + (i * sizeof(wcbar_t))) = text[i];

[Cyno™]

Originally Posted by AmazingTurtle

@NikM optimiert

for (int i = 0; i < wcslen(text); i++)
	*reinterpret_cast<wchar_t*>(address + (i * sizeof(wcbar_t))) = text[i];

Der code ist Performance technisch nicht besser außerdem hat er ja nur den code von alliance berichtigt

[babyiloveyou12]

Originally Posted by v1pclan5

Can you explain me this a little bit more?
Cheat engine will detectet from warrock or not?

Add the address of Z,Y & Z via CE.
But CE is detected so you can draw using ES and log your pos!

Request GMWarning Addies.