#include <stdio.h>
#include <windows.h>
#include <Psapi.h>

#pragma comment(lib, &quot;psapi.lib&quot;)

// aus dem sdk const.h:
// CBaseEntity::m_fFlags
#define	FL_ONGROUND				(1<<0)	// At rest / on the ground

int main(int argc, char *argv&#91;])
{
	HWND hl2wnd = 0;
	DWORD hl2pid = 0;
	HANDLE hl2proc = 0;
	SYSTEM_INFO sysinfo;
	MEMORY_BASIC_INFORMATION mbasicinfo;
	SIZE_T memory = 0;
	unsigned char *clientdll = 0;
	unsigned long clientdllsize = 0;
	unsigned char *mclientdll = 0;
	unsigned char *sp = 0;
	SIZE_T numbtread = 0;
	unsigned long moffset = 0;
	LPVOID localplayer = 0;
	LPARAM lparam = 0;

	unsigned char localplayersig&#91;] = { 0x33, 0xC0, 0x39, 0x35 };

	hl2wnd = FindWindowA(&quot;Valve001&quot;, 0);
	if(!hl2wnd) return 0;

	GetWindowThreadProcessId(hl2wnd, &amp;hl2pid);
	if(!hl2pid) return 0;

	hl2proc = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, FALSE, hl2pid);
	if(!hl2proc) return 0;

	RtlZeroMemory(&amp;sysinfo, sizeof(SYSTEM_INFO));
	GetSystemInfo(&amp;sysinfo);

	for(memory = 0;
		memory < (SIZE_T)sysinfo.lpMaximumApplicationAddress;
		memory += mbasicinfo.RegionSize)
	{
		if(VirtualQueryEx(hl2proc, (LPCVOID)memory, &amp;mbasicinfo,
			sizeof(MEMORY_BASIC_INFORMATION)))
		{
			wchar_t module[MAX_PATH];
			if(GetModuleBaseNameW(hl2proc, (HMODULE)mbasicinfo.AllocationBase, module, MAX_PATH))
			{
				if(wcscmp(module, L&quot;client.dll&quot;) == 0)
				{
					MODULEINFO minfo;

					RtlZeroMemory(&amp;minfo, sizeof(MODULEINFO));

					clientdll = (unsigned char*)mbasicinfo.AllocationBase;
					if(GetModuleInformation(hl2proc, (HMODULE)mbasicinfo.AllocationBase, &amp;minfo, sizeof(MODULEINFO)))
					{
						clientdllsize = minfo.SizeOfImage;
					}

					break;
				}
			}
		}
	}

	printf(&quot;client.dll %p %p\n&quot;, clientdll, clientdllsize);

	mclientdll = (unsigned char*)malloc(clientdllsize);
	if(!mclientdll) return 0;

	if(!ReadProcessMemory(hl2proc, clientdll, mclientdll, clientdllsize, &amp;numbtread) ||
		numbtread != clientdllsize) return 0;

	// localplayer
	// 5AD7B56D - 33 C0           - xor eax,eax
	// 5AD7B56F - 39 35 44A2295B       - cmp [CreateInterface+2A1DB4],esi
	// 5AD7B575 - 8B CF           - mov ecx,edi

	sp = mclientdll;
	while(sp != mclientdll + clientdllsize)
	{
		if(memcmp(sp++, localplayersig, sizeof(localplayersig)) == 0) break;
		moffset++;
	}

	free(mclientdll);

	if(!ReadProcessMemory(hl2proc, clientdll + moffset + 4, &amp;localplayer, sizeof(LPVOID), 0))
		return 0;

	printf(&quot;localplayer: %p\n&quot;, localplayer);

	lparam = MapVirtualKey(VK_SPACE, 0) << 16;

	while(TRUE)
	{
		DWORD p = 0;
		WORD flag = 0;
		ReadProcessMemory(hl2proc, localplayer, &amp;p, sizeof(DWORD), 0);
		p += 0x2E4; // + offset zu den flags
		ReadProcessMemory(hl2proc, (LPCVOID)p, &amp;flag, sizeof(WORD), 0);

		if(flag &amp; FL_ONGROUND &amp;&amp; GetAsyncKeyState(VK_SPACE))
		{
			PostMessageA(hl2wnd, WM_KEYDOWN, 0, lparam);
			PostMessageA(hl2wnd, WM_CHAR, 0, lparam);
			Sleep(10);
			PostMessageA(hl2wnd, WM_KEYUP, 0, lparam);
		}

		if(GetAsyncKeyState(VK_END) &amp; 1) break;
	}

	CloseHandle(hl2proc);

	return 1;
}