Advertisement
tcyknhrabirwjyljhp

Untitled

May 27th, 2022
23
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 13.67 KB | None | 0 0
  1.  
  2. EXTERN JmpBack : QWORD
  3. EXTERN JmpBack2 : QWORD
  4. EXTERN BadClass : QWORD
  5. EXTERN PlayerClass : QWORD
  6. EXTERN ?GetList@@YAX_J@Z : PROC
  7. EXTERN ?GetPlayerList@@YAX_J@Z : PROC
  8.  
  9. .code
  10.  
  11. GetBadGuys PROC
  12.  
  13. mov rax,[BadClass]
  14. cmp rax,[rcx+10h]
  15. jne BSkip
  16.  
  17. push rax
  18. push rbx
  19. push rcx
  20. push rdx
  21. push rbp
  22. push rdi
  23. push rsi
  24. push r8
  25. push r9
  26. push r10
  27. push r11
  28. push r12
  29. push r13
  30. push r14
  31. push r15
  32.  
  33. call ?GetList@@YAX_J@Z
  34.  
  35. pop r15
  36. pop r14
  37. pop r13
  38. pop r12
  39. pop r11
  40. pop r10
  41. pop r9
  42. pop r8
  43. pop rsi
  44. pop rdi
  45. pop rbp
  46. pop rdx
  47. pop rcx
  48. pop rbx
  49. pop rax
  50.  
  51. BSkip:
  52. mov rax,[rbx+58h]
  53. mov rdx,[rax+28h]
  54. mov rax,[rdx+58h]
  55. cmp qword ptr[rax+88h],00
  56. jmp qword ptr [JmpBack]
  57. GetBadGuys ENDP
  58.  
  59. GetLocalGuys PROC
  60.  
  61.  
  62. push rax
  63. push rbx
  64. push rcx
  65. push rdx
  66. push rbp
  67. push rdi
  68. push rsi
  69. push r8
  70. push r9
  71. push r10
  72. push r11
  73. push r12
  74. push r13
  75. push r14
  76. push r15
  77.  
  78. mov rcx,qword ptr[rcx+250h]
  79. call ?GetList@@YAX_J@Z
  80.  
  81. pop r15
  82. pop r14
  83. pop r13
  84. pop r12
  85. pop r11
  86. pop r10
  87. pop r9
  88. pop r8
  89. pop rsi
  90. pop rdi
  91. pop rbp
  92. pop rdx
  93. pop rcx
  94. pop rbx
  95. pop rax
  96.  
  97. mov rcx,qword ptr[rcx+250h]
  98. test rcx,rcx
  99. je Skip
  100. mov rax,qword ptr[rcx]
  101. jmp qword ptr[rax+600h]
  102. Skip:
  103. ret
  104. GetLocalGuys ENDP
  105.  
  106. GetPlayers PROC
  107.  
  108. mov rax,[PlayerClass]
  109. cmp rax,[rbx+10h]
  110. mov rax,[rbx]
  111. jne PSkip
  112.  
  113. push rax
  114. push rbx
  115. push rcx
  116. push rdx
  117. push rbp
  118. push rdi
  119. push rsi
  120. push r8
  121. push r9
  122. push r10
  123. push r11
  124. push r12
  125. push r13
  126. push r14
  127. push r15
  128.  
  129. call ?GetPlayerList@@YAX_J@Z
  130.  
  131. pop r15
  132. pop r14
  133. pop r13
  134. pop r12
  135. pop r11
  136. pop r10
  137. pop r9
  138. pop r8
  139. pop rsi
  140. pop rdi
  141. pop rbp
  142. pop rdx
  143. pop rcx
  144. pop rbx
  145. pop rax
  146.  
  147. PSkip:
  148. call qword ptr[rax+158h]
  149. movss xmm0,dword ptr[rax+00000598h]
  150. jmp qword ptr [JmpBack2]
  151. GetPlayers ENDP
  152.  
  153. END
  154.  
  155. //push rbx
  156. //sub rsp,40
  157. //movsd xmm0,[rcx+00000220]
  158. //lea r8,[rcx+0000022C]
  159. //
  160. //World2Otter-Win64-Shipping.exe+E0B810
  161. //
  162. //RCX + 22C
  163.  
  164. // movups xmm0,xmmword ptr[rax+11Ch]
  165. #include "includes.h"
  166. #include <iostream>
  167. #include "imgui/imgui_internal.h"
  168. #include "imgui/imgui.h"
  169. #include <vector>
  170.  
  171. struct Vector3
  172. {
  173. float x, y, z;
  174. };
  175.  
  176. struct BadGuyStruct
  177. {
  178. intptr_t Instance;
  179. int Health;
  180. Vector3 Pos;
  181. };
  182.  
  183. struct PlayerStruct
  184. {
  185. intptr_t Instance;
  186. bool TeamID;
  187. Vector3 Pos;
  188. };
  189.  
  190. extern LRESULT ImGui_ImplWin32_WndProcHandler(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam);
  191. typedef bool (*World2Screen) (intptr_t PlayerCtrl, Vector3 pos, ImVec2& screen, bool relative);
  192. typedef uintptr_t(*StaticFindObject) (long long klass, long long package, const wchar_t* name, bool exact);
  193. //ProjectWorldLocationToScreen
  194. World2Screen ScreenPtr;
  195. StaticFindObject FindObject;
  196.  
  197. Present oPresent;
  198. HWND window = NULL;
  199. WNDPROC oWndProc;
  200. ID3D11Device* pDevice = NULL;
  201. ID3D11DeviceContext* pContext = NULL;
  202. ID3D11RenderTargetView* mainRenderTargetView;
  203.  
  204. extern "C" void GetLocalGuys();
  205. extern "C" void GetBadGuys();
  206. extern "C" void GetPlayers();
  207. extern "C" UINT64 JmpBack = 0;
  208. extern "C" UINT64 JmpBack2 = 0;
  209. extern "C" uintptr_t BadClass = 0;
  210. extern "C" uintptr_t PlayerClass = 0;
  211. std::vector<BadGuyStruct> BadList;
  212. std::vector<PlayerStruct> PlayerList;
  213.  
  214. bool bShow = false;
  215. bool bShowPlayer = false;
  216. bool _TeamID = true;
  217. int ClearCounter = 0;
  218.  
  219. void GetPlayerList(intptr_t BadGuy)
  220. {
  221. // 0x240 0x328 = teamID ( 0 / 1 )
  222. bool* TeamID = NULL;
  223.  
  224. intptr_t Capsule = BadGuy;
  225. Capsule = Capsule + 0x290;
  226. Capsule = *(intptr_t*)Capsule;
  227.  
  228. intptr_t PlayerData = BadGuy;
  229. PlayerData = PlayerData + 0x240;
  230.  
  231. PlayerData = *(intptr_t*)PlayerData;
  232. if (PlayerData)
  233. {
  234. PlayerData = PlayerData + 0x328;
  235. bool* TeamID = (bool*)PlayerData;
  236. }
  237.  
  238. if (Capsule > 0 && PlayerData > 0)
  239. {
  240. Capsule = Capsule + 0x11C;
  241. Vector3* Pos = (Vector3*)Capsule;
  242. bool bAdd = true;
  243. for (PlayerStruct &b : PlayerList)
  244. {
  245. if (b.Instance == BadGuy)
  246. {
  247. bAdd = false;
  248. b.Pos = *Pos;
  249. }
  250. }
  251. if (bAdd)
  252. {
  253. PlayerStruct tmp;
  254. tmp.Instance = BadGuy;
  255. tmp.Pos = *Pos;
  256. tmp.TeamID = *TeamID;
  257. PlayerList.push_back(tmp);
  258. }
  259. }
  260. }
  261.  
  262. void GetList(intptr_t BadGuy)
  263. {
  264. if (BadGuy == 0)
  265. {
  266. return;
  267. }
  268. intptr_t pHealth = BadGuy + 0x648;
  269. int* health = (int*)pHealth;
  270. intptr_t Capsule = BadGuy;
  271. Capsule = Capsule + 0x290;
  272. Capsule = *(intptr_t*)Capsule;
  273. if (Capsule > 0)
  274. {
  275. Capsule = Capsule + 0x11C;
  276. Vector3* Pos = (Vector3*)Capsule;
  277. bool bAdd = true;
  278. for (BadGuyStruct &b : BadList)
  279. {
  280. if (b.Instance == BadGuy)
  281. {
  282. bAdd = false;
  283. b.Health = *health;
  284. b.Pos = *Pos;
  285. }
  286. }
  287. if (bAdd)
  288. {
  289. BadGuyStruct tmp;
  290. tmp.Instance = BadGuy;
  291. tmp.Health = *health;
  292. tmp.Pos = *Pos;
  293. BadList.push_back(tmp);
  294. }
  295. }
  296. }
  297.  
  298. float VectorDistance(Vector3* v1, Vector3 *v2)
  299. {
  300. Vector3 v;
  301. v.x = v1->x - v2->x;
  302. v.y = v1->y - v2->y;
  303. v.z = v1->z - v2->z;
  304. return sqrt(v.x*v.x + v.y*v.y + v.z*v.z);
  305. }
  306.  
  307. void* DetourFunction64(void* pSource, void* pDestination, int dwLen)
  308. {
  309. DWORD MinLen = 14;
  310.  
  311. if (dwLen < MinLen) return NULL;
  312.  
  313. BYTE stub[] = {
  314. 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00, // jmp qword ptr [$+6]
  315. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 // ptr
  316. };
  317.  
  318. void* pTrampoline = VirtualAlloc(0, dwLen + sizeof(stub), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  319.  
  320. DWORD dwOld = 0;
  321. VirtualProtect(pSource, dwLen, PAGE_EXECUTE_READWRITE, &dwOld);
  322.  
  323. DWORD64 retto = (DWORD64)pSource + dwLen;
  324.  
  325. // trampoline
  326. memcpy(stub + 6, &retto, 8);
  327. memcpy((void*)((DWORD_PTR)pTrampoline), pSource, dwLen);
  328. memcpy((void*)((DWORD_PTR)pTrampoline + dwLen), stub, sizeof(stub));
  329.  
  330. // orig
  331. memcpy(stub + 6, &pDestination, 8);
  332. memcpy(pSource, stub, sizeof(stub));
  333.  
  334. for (int i = MinLen; i < dwLen; i++)
  335. {
  336. *(BYTE*)((DWORD_PTR)pSource + i) = 0x90;
  337. }
  338.  
  339. VirtualProtect(pSource, dwLen, dwOld, &dwOld);
  340. return (void*)((DWORD_PTR)pTrampoline); // not needed but well who cares xD
  341. }
  342.  
  343. void InitImGui()
  344. {
  345. ImGui::CreateContext();
  346. ImGuiIO& io = ImGui::GetIO();
  347. io.ConfigFlags = ImGuiConfigFlags_NoMouseCursorChange;
  348. ImGui_ImplWin32_Init(window);
  349. ImGui_ImplDX11_Init(pDevice, pContext);
  350. }
  351.  
  352. LRESULT __stdcall WndProc(const HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam) {
  353.  
  354. if (true && ImGui_ImplWin32_WndProcHandler(hWnd, uMsg, wParam, lParam))
  355. return true;
  356.  
  357. return CallWindowProc(oWndProc, hWnd, uMsg, wParam, lParam);
  358. }
  359.  
  360. bool init = false;
  361. HRESULT __stdcall hkPresent(IDXGISwapChain* pSwapChain, UINT SyncInterval, UINT Flags)
  362. {
  363. if (!init)
  364. {
  365. if (SUCCEEDED(pSwapChain->GetDevice(__uuidof(ID3D11Device), (void**)& pDevice)))
  366. {
  367. pDevice->GetImmediateContext(&pContext);
  368. DXGI_SWAP_CHAIN_DESC sd;
  369. pSwapChain->GetDesc(&sd);
  370. window = sd.OutputWindow;
  371. ID3D11Texture2D* pBackBuffer;
  372. pSwapChain->GetBuffer(0, __uuidof(ID3D11Texture2D), (LPVOID*)& pBackBuffer);
  373. pDevice->CreateRenderTargetView(pBackBuffer, NULL, &mainRenderTargetView);
  374. pBackBuffer->Release();
  375. oWndProc = (WNDPROC)SetWindowLongPtr(window, GWLP_WNDPROC, (LONG_PTR)WndProc);
  376. InitImGui();
  377. init = true;
  378. }
  379.  
  380. else
  381. return oPresent(pSwapChain, SyncInterval, Flags);
  382. }
  383.  
  384. ImGui_ImplDX11_NewFrame();
  385. ImGui_ImplWin32_NewFrame();
  386. ImGui::NewFrame();
  387.  
  388. ImGui::Begin("cfemen hook");
  389. ImGui::Checkbox("ESP(F1)", &bShow);
  390. ImGui::Checkbox("Player(F2)", &bShowPlayer);
  391. if (bShow)
  392. {
  393. ImGui::Text("%d", BadList.size());
  394. }
  395.  
  396. /*if (!bShow)
  397. {
  398. BadList.clear();
  399. }*/
  400.  
  401.  
  402. ImGui::End();
  403.  
  404. ClearCounter++;
  405. if (ClearCounter > 100)
  406. {
  407. BadList.clear();
  408. PlayerList.clear();
  409. ClearCounter = 0;
  410. }
  411.  
  412. if (GetAsyncKeyState(VK_F1) & 0x1)
  413. {
  414. bShow = !bShow;
  415. BadClass = FindObject(0, -1, L"BP_BadGuy_C", true);
  416. PlayerClass = FindObject(0, -1, L"BP_Character_C", true);
  417. Sleep(25);
  418. }
  419. if (GetAsyncKeyState(VK_F2) & 0x1)
  420. {
  421. bShowPlayer = !bShowPlayer;
  422. Sleep(25);
  423. }
  424. if (GetAsyncKeyState(VK_F2) & 0x1)
  425. {
  426. _TeamID = !_TeamID;
  427. Sleep(25);
  428. }
  429.  
  430. ImGui::PushStyleVar(ImGuiStyleVar_WindowBorderSize, 0.f);
  431. ImGui::PushStyleColor(ImGuiCol_WindowBg, ImVec4(0.0f, 0.0f, 0.0f, 0.0f));
  432. ImGui::Begin("BackBuffer", reinterpret_cast<bool*>(true), ImGuiWindowFlags_NoTitleBar | ImGuiWindowFlags_NoInputs | ImGuiWindowFlags_NoScrollbar | ImGuiWindowFlags_NoMove | ImGuiWindowFlags_NoResize);
  433. ImGui::SetWindowPos(ImVec2(0, 0), ImGuiCond_Always);
  434. ImGui::SetWindowSize(ImVec2(ImGui::GetIO().DisplaySize.x, ImGui::GetIO().DisplaySize.y), ImGuiCond_Always);
  435.  
  436. ImGuiWindow* window = ImGui::GetCurrentWindow();
  437. ImDrawList* _drawList = window->DrawList;
  438. ImVec2 myVec;
  439. window->FontWindowScale = 1.0f;
  440.  
  441. uintptr_t BaseHandle = (uintptr_t)GetModuleHandleA("GroundBranch-Win64-Shipping.exe");
  442. intptr_t Engine = (intptr_t)BaseHandle+0x5DA5FD0;
  443. Engine = *(intptr_t*)Engine;
  444. if (Engine && bShow)
  445. {
  446. Engine = Engine + 0xDE8;
  447. Engine = *(intptr_t*)Engine;
  448. Engine = Engine + 0x38;
  449. Engine = *(intptr_t*)Engine;
  450. // 0
  451. Engine = *(intptr_t*)Engine;
  452. Engine = Engine + 0x30;
  453. Engine = *(intptr_t*)Engine; // PlayerController
  454.  
  455. //
  456.  
  457. intptr_t Player = Engine;
  458. Player = Player + 0x260;
  459. Vector3* playerPos = NULL;
  460.  
  461. if (Player != 0x260)
  462. {
  463. Player = *(intptr_t*)Player;
  464. if (Player)
  465. {
  466. Player = Player + 0x290; // Capsule
  467. Player = *(intptr_t*)Player;
  468. Player = Player + 0x11C;
  469. playerPos = (Vector3*)Player;
  470. }
  471.  
  472. }
  473.  
  474. ImVec2 Screen;
  475.  
  476. if (Engine && playerPos != NULL)
  477. {
  478. for (BadGuyStruct b : BadList)
  479. {
  480. ImVec2 Screen;
  481. int Len = (int)VectorDistance(playerPos, &b.Pos);
  482. Len = Len / 100;
  483. ScreenPtr(Engine,b.Pos,Screen,true);
  484. char Buffer[32];
  485. sprintf_s(Buffer, "[[%d]]", Len);
  486. if (Len < 100)
  487. {
  488. _drawList->AddText(Screen, ImColor(1.0f, 0.1f, 0.1f),Buffer);
  489. }
  490. else
  491. {
  492. _drawList->AddText(Screen, ImColor(1.0f, 0.5f, 0.1f),Buffer);
  493. }
  494. }
  495.  
  496. //
  497.  
  498. for (PlayerStruct b : PlayerList)
  499. {
  500. ImVec2 Screen;
  501. int Len = (int)VectorDistance(playerPos, &b.Pos);
  502. Len = Len / 100;
  503. ScreenPtr(Engine,b.Pos,Screen,true);
  504. char Buffer[32];
  505. sprintf_s(Buffer, "%d", Len);
  506. if (Len < 100 && bShowPlayer && b.TeamID == _TeamID)
  507. {
  508. _drawList->AddText(Screen, ImColor(0.0f, 1.1f, 0.1f),Buffer);
  509. }
  510. }
  511. }
  512. }
  513.  
  514. //_drawList->AddText(myVec, ImColor(1.0f, 0.1f, 0.1f),"AA");
  515.  
  516.  
  517.  
  518. window->DrawList->PushClipRectFullScreen();
  519. ImGui::End();
  520. ImGui::PopStyleColor();
  521. ImGui::PopStyleVar();
  522.  
  523. ImGui::Render();
  524.  
  525. pContext->OMSetRenderTargets(1, &mainRenderTargetView, NULL);
  526. ImGui_ImplDX11_RenderDrawData(ImGui::GetDrawData());
  527. return oPresent(pSwapChain, SyncInterval, Flags);
  528. }
  529.  
  530. DWORD WINAPI MainThread(LPVOID lpReserved)
  531. {
  532.  
  533. bool init_hook = false;
  534.  
  535. uintptr_t BaseHandle = (uintptr_t)GetModuleHandleA("GroundBranch-Win64-Shipping.exe");
  536.  
  537. uintptr_t pW2S = BaseHandle + 0x36799F0;
  538. // BadGuys finden = any BadGuy Base schauen was davon liest
  539. uintptr_t BadGuys = BaseHandle + 0x32DEF50;
  540. uintptr_t BadGuysOnline = BaseHandle + 0x332393F;
  541. uintptr_t pFindObject = BaseHandle + 0x1B10230;
  542.  
  543. uintptr_t pFindPlayer = BaseHandle + 0x31D6056;
  544.  
  545. DetourFunction64((PVOID)BadGuys, GetLocalGuys, 14); // offline
  546. DetourFunction64((PVOID)BadGuysOnline, GetBadGuys,20); // online
  547.  
  548. DetourFunction64((PVOID)pFindPlayer, GetPlayers,14); // online
  549.  
  550. JmpBack = BadGuysOnline + 20;
  551. JmpBack2 = pFindPlayer + 14;
  552.  
  553. ScreenPtr = (World2Screen)pW2S;
  554. FindObject = (StaticFindObject)pFindObject;
  555.  
  556. //BadClass = FindObject(0, -1, L"BP_BadGuy_C", true);
  557.  
  558. //AllocConsole();
  559. //FILE* fDummy;
  560. //freopen_s(&fDummy, "CONOUT$", "w", stdout);
  561. //std::cout << std::hex << BadClass;
  562.  
  563.  
  564. do
  565. {
  566. if (kiero::init(kiero::RenderType::D3D11) == kiero::Status::Success)
  567. {
  568. kiero::bind(8, (void**)& oPresent, hkPresent);
  569. init_hook = true;
  570. }
  571. } while (!init_hook);
  572. return TRUE;
  573. }
  574.  
  575. BOOL WINAPI DllMain(HMODULE hMod, DWORD dwReason, LPVOID lpReserved)
  576. {
  577. switch (dwReason)
  578. {
  579. case DLL_PROCESS_ATTACH:
  580. DisableThreadLibraryCalls(hMod);
  581. CreateThread(nullptr, 0, MainThread, hMod, 0, nullptr);
  582. break;
  583. case DLL_PROCESS_DETACH:
  584. kiero::shutdown();
  585. break;
  586. }
  587. return TRUE;
  588. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement