Thread: COD2 1.3 Wallhack memcpy problem

I'm trying to make wallhack using memcpy function. (sorry for bad english, hope you understand this post)
cod2 Offset is:

004DC80E C74424 14 80000000 MOV DWORD PTR SS:[ESP+14],80

now i need to change this in memory to get a wallhack:

004DC80E C74424 14 88000000 MOV DWORD PTR SS:[ESP+14],88


looks like memcpy function does not work !

Code:

// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
DWORD old;
DWORD patch[5] = { 0xC7, 0x44, 0x24, 0x14, 0x88 };  

void NoRecoil ()
{
    //fgdfdfdf
}


BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        MessageBox (0,L"Test",L"COD2 chit",64);
        /// No recoil
        DetourFunction((PBYTE)0x004F5860,(PBYTE)NoRecoil);
        /// wh 
            VirtualProtect((void*)0x4DC80E,sizeof(patch),PAGE_READWRITE,&old);
        
        memcpy ((void*)0x4DC80E,(const void*)patch,sizeof(patch));
        //*((BYTE*)0x4DC80E) = 0xC7, 0x44, 0x24, 0x14, 0x88 ;
        VirtualProtect((void*)0x4DC80E,sizeof(patch),old,0);
        
        break;
    case DLL_PROCESS_DETACH:
        DetourRemove ((PBYTE)0x004F5860,(PBYTE)NoRecoil);

        break;
    }
    return TRUE;
}

NoRecoil works great, but wallhack crashes the game.

Pls help, maybe i did something wrong.
Thx.

---

*
ok, i got it.
i need to write just one byte (not 5 lol ) to a adress 0x004DC812.
now works great (on non PB servers,ofcourse )

becouse your patch size aren't correct hire the correct one

Code:

void Player_WallHack ( void )
{
//DWORD old;
HANDLE hand = GetCurrentProcess();
//long t=0;

BYTE patch[0x8] =
{
    0xC7, 0x44, 0x24, 0x14, 0x88, 0x00, 0x00, 0x00,
};
DWORD size = sizeof(patch);
WriteProcessMemory(hand, (void*)(0x004DC80E), patch, size, 0);

}

call Player_WallHack(), in dllmain




edit: for norecoil


//004D7115 |. 74 2C JE SHORT CoD2MP_s.004D7143 //normal
assemble to JNZ
//004D7115 |. 75 2C JNZ SHORT CoD2MP_s.004D7143 //norecoil

it will done by writeprocesmemory

Code:

BYTE NoRecoil[2] = {0x75,0x2C};
WriteProcessMemory(GetCurrentProcess(), (void*) (0x004D7115), &NoRecoil,2, NULL);

hope it helps

it works now, no recoil and wallhack.

for wallhack i need to modify just one byte:

004DC80E C74424 14 80000000 MOV DWORD PTR SS:[ESP+14],80

address now is 04DC812,

Code:

*((BYTE*)0x4DC812) = 0x88 ;

No recoil is done by DetourFunction.

Do u know the pb offsets for cod2??? or tutorial???
Because pb detects this cheat.

Don't patch CG_FireWeapon, you will lose guns sounds and other things, patch the call for CG_FireRecoil, found in the same function, if you need more help I would gladly get the address for you.

I have detoured the cg_firerecoil function, i don't lose sounds.

i found a offset to unlock cheat protected cvars

004371DF 75 2C JNZ SHORT CoD2MP_s.0043720D

now patch the JNZ to JE

Code:

*((BYTE*)0x4371DF) = 0x74;

this hack works nice, but pb kicks me for corrupted memory.
i cant hack punkbuster because it is encrypted, do you know how to decrypt pbcl.dll??

here is a screenshot of my hack

cvars unlocked enables the third person view

Originally Posted by mkahada

I have detoured the cg_firerecoil function, i don't lose sounds.

i found a offset to unlock cheat protected cvars

004371DF 75 2C JNZ SHORT CoD2MP_s.0043720D

now patch the JNZ to JE

Code:

*((BYTE*)0x4371DF) = 0x74;

this hack works nice, but pb kicks me for corrupted memory.
i cant hack punkbuster because it is encrypted, do you know how to decrypt pbcl.dll??

Ok then. How did you find the offset for cheat protected cvars?

my idea

search for "%s cheat protect" in olly

you will find this
about "ASCII "%s is cheat protected" find first JNZ

Code:

004371E5   8B0D CCC5C500    MOV ECX,DWORD PTR DS:[C5C5CC]            ; CoD2MP_s.00C5C9D0
004371EB   8A51 08          MOV DL,BYTE PTR DS:[ECX+8]
004371EE   84D2             TEST DL,DL
004371F0   75 1B            JNZ SHORT CoD2MP_s.0043720D
004371F2   8B16             MOV EDX,DWORD PTR DS:[ESI]
004371F4   52               PUSH EDX
004371F5   68 F4825A00      PUSH CoD2MP_s.005A82F4                   ; ASCII "%s is cheat protected.
"
004371FA   E8 E1ACFFFF      CALL CoD2MP_s.00431EE0
004371FF   83C4 08          ADD ESP,8
00437202   5F               POP EDI

Code:

JNZ SHORT CoD2MP_s.0043720D

assembler to JN SHORT

Done

you can just use the code i have used for the norecoil about his post

addresse is 0x004371F0 patch is 74 1B




or you can use cvar set
http://forum.gamedeception.net/showt...hlight=cvarset

cvar_set("cg_thirdperson","1");
or whate ever

I have tried a search for that before, I will have another go, once I get this working I will release my cod 1, cod 2, cod 4 hack and hopefully cod 5 soon after

i found some offsets for cod4 1.7 :

wallhack :

00445480 6A 04 PUSH 4

patch to push 12

no recoil:
00457CCF |. 74 12 JE SHORT iw3mp.00457CE3

patch JE to JMP

cvar unlock:
0056B386 |. 75 19 JNZ SHORT iw3mp.0056B3A1

patch JNZ to JE


i will look later for cod5 offsets