UnKnoWnCheaTs - Multiplayer Game Hacking and Cheats - Call of Duty 6: Code Section

By Any Chance

foxxxynz — Tue, 07 Sep 2010 04:52:43 GMT

By Any Chance Dose Any Have The Strides For MW2 For D3D Cham Making?
Thanks Foxxxynz

[HELP] Structure Building! (AKA Class Building in C++)!

NWEngineer — Mon, 06 Sep 2010 07:28:16 GMT

Here is the structure members of cg which is declared by the instance cg_t in the quake 3 sdk. C | cg_t cg; // cg has the members - Anonymous - mjg4ie7a - Pastebin.com

I have written a comment up top.

I understand the structures of the c language.

Now somehow I have to make these structures in visual studio by looking at the disassemble. I can find the structures by using the method of Wieter20. Is there someone on this board that can show me an example of how to put a class together in visual studio 2010?

I have a very good understanding of the header layout and source code of the quake 3 sdk. I understand the default calling convention of c++ which is _cdecl. I know how to follow the arguments of the functions and step into the function to see the prolog and epilog of that particular function.

I know I am so close to understanding this. I just need a visual of a structure being built. Then I will be on my merry way. Is there anyone on this board that can help me over skype, yahoo, teamviewer, vnc, windows remote, msn, or just playing old posting on this board?

Ahh I know i'm so close to figuring this out. I would like to be able to build a class like this http://www.uc-forum.com/forum/call-d...s-cod-mw2.html

Jugga started out not knowing how to this either. I know i'm close.
I feel it under my skin its like a bug crawling around bitting my veins. :badass:

Hardware breakpoints?

sph4ck — Sat, 04 Sep 2010 09:42:17 GMT

Do you know if VAC scans for hardware breakpoints?

I'm planning to use them in external hack (which would not be that much external) just to sniff return values from some function like isVisible().

Help appreciated

Engine Drawline ?

K@N@VEL — Thu, 02 Sep 2010 20:03:42 GMT

I been looking for a while with no success, Has anyone found a way to draw lines via the engine, WITHOUT using directx ?
:pat:

GetTagPosition Crashing MW2?

0rbit — Fri, 27 Aug 2010 22:38:16 GMT

Hey all,

Recently I've been learning a LOT of hacking stuff and my latest obstacle has been trying to code an aimbot. It currently uses GetTagPos function to get the position of whatever bone for each player, then aims accordingly. What I have noticed, however is that sometime the aimbot seems to crash the game. This can happen anywhere from the second I enable the aimbot, to after 2 or 3 games.
I remember reading a while back that this problem is caused by calling GTP at the same time as the engine, from another thread.
Now that's all well and good, but I'm not really sure how to prevent this problem from occurring. I have had an idea of detouring the GetTagPos call, and maybe putting some kind of if statement in there so it can't be called while it's being called (inb4 xzibit image :D) - returning to the original if its safe to call, and if not, then don't.

Would this be a viable option, or is there a better method I could do?

Thanks,
0rbit

Bone Esp With Visibility Checks

Alexak92 — Tue, 24 Aug 2010 21:55:42 GMT

Just had an idea so here it is..

PHP Code:

  
char * Bones[] = {
/*Head*/          "j_helmet"     , "j_head"            , "j_neck" 
/*Arms*/        , "j_shoulder_le", "j_shoulder_ri"  , "j_elbow_le"     , "j_elbow_ri", "j_wrist_le", "j_wrist_ri", "j_gun"
/*Back*/        , "j_mainroot"   , "j_spineupper"   , "j_spinelower" , "j_spine4" 
/*Legs*/        , "j_hip_ri"     , "j_hip_le"       , "j_knee_le"    , "j_knee_ri" , "j_ankle_ri", "j_ankle_le"};
#define sBone   ARRAYSIZE(Bones)

PHP Code:

  
void BoneESP()
{
    for(int i = 0; i < 18;i++)//looping through players
    {
        for(int I = 0; I < sBone ;I++)//looping through bones
        {
            WORD  Bone  = RegisterTag( Bones[I] ); 
            Game.GetPlayerTag( Bone , &cg_entities[i] , vOut);

            if(Math.WorldToScreen(vOut , &Screenx , &Screeny))
            {                
                if ( cg_entities[i].alive == 17 || cg_entities[i].alive == 49 )
                {               
                    if ( clientInfo[i].team == clientInfo[cg->ClientNum].team )
                    {
                        if(IsVisible(vOut))
                             Drawing.DrawTextWithEngine( Screenx , Screeny  , &colCyan , "."); 
                        else
                             Drawing.DrawTextWithEngine( Screenx , Screeny , &colGreen , "."); 
                    }
                    else
                    {
                        if(IsVisible(vOut))
                            Drawing.DrawTextWithEngine( Screenx , Screeny , &colYellow , "."); 
                        else
                            Drawing.DrawTextWithEngine( Screenx , Screeny , &colRed    , ".");
                    }
                    if((clientInfo[cg->ClientNum].team && clientInfo[i].team ) == 0)
                    {
                        if(IsVisible(vOut))
                            Drawing.DrawTextWithEngine( Screenx , Screeny , &colWhite , "."); 
                        else
                             Drawing.DrawTextWithEngine( Screenx , Screeny , &colPink , "."); 
                    }
                }
            }
        }
    }    
}

Modern Warfare 2 class esp

Alexak92 — Sat, 21 Aug 2010 08:11:55 GMT

PHP Code:

  
char * temp = clientInfo[i].BodyModel;

PHP Code:

  
//tf141 Desert

if(strstr(temp, "mp_body_desert_tf141_assault_a"))      temp = "TF141_Assault"; 

if(strstr(temp, "mp_body_desert_tf141_lmg"))            temp = "TF141_MachineGunner";

if(strstr(temp, "mp_body_desert_tf141_smg"))            temp = "TF141_SubMachineGunner";

if(strstr(temp, "mp_body_tf141_desert_sniper"))            temp = "TF141_Sniper";

if(strstr(temp, "mp_body_riot_tf141_desert"))            temp = "TF141_Riot Control";

if(strstr(temp, "mp_body_desert_tf141_shotgun"))        temp = "TF141_Shotgun";                    

//tf141 Forest

if(strstr(temp, "mp_body_forest_tf141_assault_a"))        temp = "TF141_Assault"; 

if(strstr(temp, "mp_body_forest_tf141_lmg"))            temp = "TF141_MachineGunner";

if(strstr(temp, "mp_body_forest_tf141_smg"))            temp = "TF141_SubMachineGunner";

if(strstr(temp, "mp_body_ally_sniper_ghillie_forest"))    temp = "TF141_Sniper";

if(strstr(temp, "mp_body_riot_tf141_forest"))            temp = "TF141_Riot Control";

if(strstr(temp, "mp_body_forest_tf141_shotgun"))        temp = "TF141_Shotgun";                

//tf141 Snow

if(strstr(temp, "mp_body_tf141_assault_b"))                temp = "TF141_Assault"; 

if(strstr(temp, "mp_body_tf141_lmg"))                    temp = "TF141_MachineGunner";

if(strstr(temp, "mp_body_tf141_smg"))                    temp = "TF141_SubMachineGunner";

if(strstr(temp, "mp_body_tf141_arctic_sniper"))            temp = "TF141_Sniper";

if(strstr(temp, "mp_body_riot_tf141_arctic"))            temp = "TF141_Riot Control";

if(strstr(temp, "mp_body_tf141_shotgun"))                temp = "TF141_Shotgun";

//SpetsNaz - snow

if(strstr(temp, "mp_body_opforce_arctic_assault; "))    temp = "SpetsNaz_Assault";

if(strstr(temp, "mp_body_opforce_arctic_assault_a; "))    temp = "SpetsNaz_Assault";

if(strstr(temp, "mp_body_opforce_arctic_assault_b; "))    temp = "SpetsNaz_Assault";

if(strstr(temp, "mp_body_opforce_arctic_assault_c; "))    temp = "SpetsNaz_Assault";

if(strstr(temp, "mp_body_opforce_arctic_lmg"))            temp = "SpetsNaz_MachineGunner";

if(strstr(temp, "mp_body_opforce_arctic_lmg_a"))        temp = "SpetsNaz_MachineGunner";

if(strstr(temp, "mp_body_opforce_arctic_lmg_b"))        temp = "SpetsNaz_MachineGunner";

if(strstr(temp, "mp_body_opforce_arctic_lmg_c"))        temp = "SpetsNaz_MachineGunner";

if(strstr(temp, "mp_body_opforce_arctic_smg"))            temp = "SpetsNaz_SubMachineGunner";

if(strstr(temp, "mp_body_opforce_arctic_smg_a"))        temp = "SpetsNaz_SubMachineGunner";

if(strstr(temp, "mp_body_opforce_arctic_smg_b"))        temp = "SpetsNaz_SubMachineGunner";

if(strstr(temp, "mp_body_opforce_arctic_smg_c"))        temp = "SpetsNaz_SubMachineGunner";

if(strstr(temp, "mp_body_opforce_arctic_shotgun"))        temp = "SpetsNaz_Shotgun";

if(strstr(temp, "mp_body_opforce_arctic_shotgun_a"))    temp = "SpetsNaz_Shotgun";

if(strstr(temp, "mp_body_opforce_arctic_shotgun_b"))    temp = "SpetsNaz_Shotgun";

if(strstr(temp, "mp_body_opforce_arctic_shotgun_c"))    temp = "SpetsNaz_Shotgun";           

if(strstr(temp, "mp_body_op_arctic_sniper"))            temp = "SpetsNaz_Sniper";

if(strstr(temp, "mp_body_riot_op_arctic"))                temp = "SpetsNaz_RiotControl";

//SpetsNaz

if(strstr(temp, "mp_body_airborne_assault"))            temp = "SpetsNaz_Assault";

if(strstr(temp, "mp_body_airborne_assault_a"))            temp = "SpetsNaz_Assault";

if(strstr(temp, "mp_body_airborne_assault_b"))            temp = "SpetsNaz_Assault";

if(strstr(temp, "mp_body_airborne_assault_c"))            temp = "SpetsNaz_Assault";

if(strstr(temp, "mp_body_airborne_lmg"))                temp = "SpetsNaz_MachineGunner";

if(strstr(temp, "mp_body_airborne_lmg_a"))                temp = "SpetsNaz_MachineGunner";

if(strstr(temp, "mp_body_airborne_lmg_b"))                temp = "SpetsNaz_MachineGunner";

if(strstr(temp, "mp_body_airborne_lmg_c"))                temp = "SpetsNaz_MachineGunner";            

if(strstr(temp, "mp_body_airborne_smg"))                temp = "SpetsNaz_SubMachineGunner";

if(strstr(temp, "mp_body_airborne_smg_a"))                temp = "SpetsNaz_SubMachineGunner";

if(strstr(temp, "mp_body_airborne_smg_b"))                temp = "SpetsNaz_SubMachineGunner";

if(strstr(temp, "mp_body_airborne_smg_c"))                temp = "SpetsNaz_SubMachineGunner";    

if(strstr(temp, "mp_body_airborne_shotgun"))            temp = "SpetsNaz_Shotgun";

if(strstr(temp, "mp_body_airborne_shotgun_a"))            temp = "SpetsNaz_Shotgun";

if(strstr(temp, "mp_body_airborne_shotgun_b"))            temp = "SpetsNaz_Shotgun";

if(strstr(temp, "mp_body_airborne_shotgun_c"))            temp = "SpetsNaz_Shotgun";        

if(strstr(temp, "mp_body_op_sniper_ghillie_urban"))     temp = "SpetsNaz_Sniper";

if(strstr(temp, "mp_body_op_sniper_ghillie_forest"))    temp = "SpetsNaz_Sniper";

if(strstr(temp, "mp_body_op_airborne_sniper"))            temp = "SpetsNaz_Sniper";

if(strstr(temp, "mp_body_riot_op_airborne"))            temp = "SpetsNaz_RiotControl";

//Op4 Desert

if(strstr(temp, "mp_body_opforce_arab_assault_a"))        temp = "OpFor_Assault"; 

if(strstr(temp, "mp_body_opforce_arab_lmg_a"))            temp = "OpFor_MachineGunner";

if(strstr(temp, "mp_body_opforce_arab_smg_a"))            temp = "OpFor_SubMachineGunner";

if(strstr(temp, "mp_body_op_sniper_ghillie_desert"))    temp = "OpFor_Sniper";

if(strstr(temp, "mp_body_op_arab_sniper"))                temp = "OpFor_Sniper";

if(strstr(temp, "mp_body_riot_op_arab"))                temp = "OpFor_RiotControl";

if(strstr(temp, "mp_body_opforce_arab_shotgun_a"))        temp = "OpFor_Shotgun";

//militia regular

if(strstr(temp, "mp_body_militia_assault_aa_blk"))        temp = "Militia_Assault"; 

if(strstr(temp, "mp_body_militia_assault_ab_blk"))        temp = "Militia_Assault";

if(strstr(temp, "mp_body_militia_assault_ac_blk"))        temp = "Militia_Assault";

if(strstr(temp, "mp_body_militia_assault_aa_wht"))        temp = "Militia_Assault"; 

if(strstr(temp, "mp_body_militia_assault_ab_wht"))        temp = "Militia_Assault"; 

if(strstr(temp, "mp_body_militia_assault_ac_wht"))        temp = "Militia_Assault"; 

if(strstr(temp, "mp_body_militia_lmg_aa_blk"))            temp = "Militia_MachineGunner";

if(strstr(temp, "mp_body_militia_lmg_ab_blk"))            temp = "Militia_MachineGunner";

if(strstr(temp, "mp_body_militia_lmg_ac_blk"))            temp = "Militia_MachineGunner";

if(strstr(temp, "mp_body_militia_lmg_aa_wht"))            temp = "Militia_MachineGunner";

if(strstr(temp, "mp_body_militia_lmg_ab_wht"))            temp = "Militia_MachineGunner";

if(strstr(temp, "mp_body_militia_lmg_ac_wht"))            temp = "Militia_MachineGunner";

if(strstr(temp, "mp_body_militia_smg_aa_wht"))            temp = "Militia_SubMachineGunner";

if(strstr(temp, "mp_body_militia_smg_ab_wht"))            temp = "Militia_SubMachineGunner";

if(strstr(temp, "mp_body_militia_smg_ac_wht"))            temp = "Militia_SubMachineGunner";

if(strstr(temp, "mp_body_militia_smg_aa_blk"))            temp = "Militia_SubMachineGunner";

if(strstr(temp, "mp_body_militia_smg_ab_blk"))            temp = "Militia_SubMachineGunner";

if(strstr(temp, "mp_body_militia_smg_ac_blk"))            temp = "Militia_SubMachineGunner";

if(strstr(temp, "mp_body_op_sniper_ghillie_urban"))        temp = "Militia_Sniper";

if(strstr(temp, "mp_body_op_militia_sniper"))                    temp =  "Militia_Sniper";

if(strstr(temp, "mp_body_riot_op_militia"))                temp = "Militia_RiotControl";

if(strstr(temp, "mp_body_militia_smg_aa_blk"))            temp = "Militia_Shotgun";



//us Army regular

if(strstr(temp, "mp_body_us_army_assault"))                temp = "Us_army_Assault"; 

if(strstr(temp, "mp_body_us_army_assault_a"))            temp = "Us_army_Assault"; 

if(strstr(temp, "mp_body_us_army_assault_b"))            temp = "Us_army_Assault"; 

if(strstr(temp, "mp_body_us_army_assault_c"))            temp = "Us_army_Assault"; 

if(strstr(temp, "mp_body_us_army_lmg"))                    temp = "Us_army_MachineGunner";

if(strstr(temp, "mp_body_us_army_lmg_a"))                temp = "Us_army_MachineGunner";

if(strstr(temp, "mp_body_us_army_lmg_b"))                temp = "Us_army_MachineGunner";

if(strstr(temp, "mp_body_us_army_lmg_c"))                temp = "Us_army_MachineGunner";        

if(strstr(temp, "mp_body_us_army_smg"))                    temp = "Us_army_SubMachineGunner";

if(strstr(temp, "mp_body_us_army_smg_a"))                temp = "Us_army_SubMachineGunner";

if(strstr(temp, "mp_body_us_army_smg_b"))                temp = "Us_army_SubMachineGunner";

if(strstr(temp, "mp_body_us_army_smg_c"))                temp = "Us_army_SubMachineGunner";

if(strstr(temp, "mp_body_us_army_shotgun"))                temp = "Us_army_Shotgun";

if(strstr(temp, "mp_body_us_army_shotgun_a"))            temp = "Us_army_Shotgun";

if(strstr(temp, "mp_body_us_army_shotgun_b"))            temp = "Us_army_Shotgun";

if(strstr(temp, "mp_body_us_army_shotgun_c"))            temp = "Us_army_Shotgun";    

if(strstr(temp, "mp_body_army_sniper"))                    temp = "Us_army_Sniper";

if(strstr(temp, "mp_body_ally_sniper_ghillie_urban"))    temp = "Us_army_Sniper";

if(strstr(temp, "mp_body_us_army_riot"))                temp = "Us_army_RiotControl";

//Seals

if(strstr(temp, "mp_body_seal_udt_assault"))            temp = "Seals_Assault"; 

if(strstr(temp, "mp_body_seal_udt_assault_a"))            temp = "Seals_Assault"; 

if(strstr(temp, "mp_body_seal_udt_assault_b"))            temp = "Seals_Shotgun"; 

if(strstr(temp, "mp_body_seal_udt_assault_c"))            temp = "Seals_Assault"; 

if(strstr(temp, "mp_body_seal_udt_lmg"))                temp = "Seals_MachineGunner";    

if(strstr(temp, "mp_body_seal_udt_smg"))                temp = "Seals_SubMachineGunner";                

if(strstr(temp, "mp_body_seal_udt_sniper"))                temp = "Seals_Sniper";

if(strstr(temp, "mp_body_riot_udt"))                    temp = "Seals_RiotControl";

CG_Trace for 1.0.182

JackODoo — Tue, 17 Aug 2010 15:28:00 GMT

Hey guys, does anyone have the correct CG_Trace function for 1.0.182?
I've tried typedef'ing it with this address: 4e9f70 but the IsVisible always returns false ..

Thanks!

EDIT:

Code:



typedef void (__cdecl *CG_Trace_t)(trace_t *, vec3_t, vec3_t, vec3_t, int, int);

CG_Trace_t CG_Trace = (CG_Trace_t)0x4E9F70;

 

void CMath::Trace(trace_t *t, vec3_t start, vec3_t end, int skip, int mask)

{

    CG_Trace(t, start, end, nullvec, skip, mask);

}

 

bool IsVisible(vec3_t End)

{

    trace_t t;

    Math.Trace(&t, refdef->Vieworg, End, cg->clientNum, 0x803003);

    return (t.fraction == 1.0f);

}

Now it crashes ...

HELP - RenderScene and SendCommand for 1.0.182

JackODoo — Mon, 16 Aug 2010 08:31:29 GMT

Does anyone know how to find SendCommandToConsole and Renderscene offset for MW2 1.0.182 (alteriwnet 1.3.3.7a)?
I have EndFrame already. (0x586E00) and CG_init (0x4C4DA0), and i think SendCommandtoConsole is 0x4CA0F0 but thats not working..

Thanks,
JackoDoo

Aim-bot Issue

Alexak92 — Fri, 13 Aug 2010 08:47:36 GMT

I've never created an aim-bot before so i figured ill give it a shot, once I've looked at a few sources i put together some code and then I've stumbled on to a problem, the aim-bot aims perfectly on the X axis but does not compensate for the Y axis usually i am fairly good at problem solving but stuck on this one.

PHP Code:

  
float *ViewAngleX = (float *)0xB359C4;
float *ViewAngleY = (float *)0xB359C0;

PHP Code:

  
int AimBot()
{
    vec3_t vOrg;
    float aX, aY;

    for( int i = 0; i < 18; i++ )
    {
        WORD Helmet  = RegisterTag( "j_helmet" );
        GetPlayerTag(Helmet, &cg_entities[i], vOrg);
    
        if((cg_entities[i].typ == ET_PLAYER_MP) && (cg_entities[i].clientnum != cg->ClientNum ))
        {
            if ( cg_entities[i].alive == 17 || cg_entities[i].alive == 49 )
            {               
                if (clientInfo[cg->ClientNum].team =! clientInfo[i].team )
                {
                    Math.VectorToViewangles(vOrg, aX, aY);

                    *ViewAngleY    += aY;
                    *ViewAngleX    += aX;
                   return true;

                }
            }
        }
    }
return false;
}

EndScene:

PHP Code:

  
    if((GetAsyncKeyState(VK_LBUTTON) & 0x8000) == 0x8000 ) AimBot();

Finding structs and making them

Wieter20 — Mon, 09 Aug 2010 09:38:18 GMT

Okay... this gonna be a long one, i feel it in my bones.
THIS IS A UC-FORUM ONLY RELEASE!!!
there only may be linked back to this thread!

if you fully understand this u could make it work for every Q3 based game!!!
===REQUIRED===
- Ida Pro + Hex Rays
- Quake 3 SDK
- Olly DBG
- Basic understanding of windows
=============

i've seen allot of people asking how do i find this how do i find that?
well the quick answer is; SDK

i wont be handing you the links since a lil self work doesnt harm you but go ahead and download the Quake 3 SDK.

After you've done that go and download Ida Pro + hex rays somewere

when done downloading and installing open up Ida and hit 'Go work on your own' or something like that.

Following u gotta do is explained using screenshots;

Opening Iw4mp.exe in Ida;

Haveing done that, browse to the iw4mp.exe no need to explain how, else you shouldnt even be trying this.

Now when it is opened, u'll have to wait some time for it to be fully loaded, u'll know when its done if you get such a screen;

now what you're gonna do next is;

Go to: File -> Produce File -> 'Create C File'

go ahead and click that, u will be presented with a pop up on where to save the c file, choose a good place for it where its easy to acces, you'll be needing it.
(DONT CLOSE IDA)

That was the easy part!

Now comes the somewhat harder part.

Go to the folder where u installed the SDK and do as following -> Go into -> Source -> Code -> CGame -> and then open up 'cgame.dsp'
u will need vc++ 6 or higher to open it.

now thats opened open up another copy of visual studio (BLANK)
and go ahead and do -> file -> open -> browse to the C File it created being called 'iw4mp.c'

ok, now go ahead and go in the SDK and go into ;
cg_main.c (Its under the map Source Files in visual studio)
now go ahead and search for "CG_Init"
keep on hitting next untill u find the function itsself

Code:

void CG_Init( int serverMessageNum, int serverCommandSequence, int clientNum ) {

    const char    *s;



    // clear everything

    memset( &cgs, 0, sizeof( cgs ) );

    memset( &cg, 0, sizeof( cg ) );

    memset( cg_entities, 0, sizeof(cg_entities) );

    memset( cg_weapons, 0, sizeof(cg_weapons) );

    memset( cg_items, 0, sizeof(cg_items) );



    cg.clientNum = clientNum;



    cgs.processedSnapshotNum = serverMessageNum;

    cgs.serverCommandSequence = serverCommandSequence;



    // load a few needed things before we do any screen updates

    cgs.media.charsetShader        = trap_R_RegisterShader( "gfx/2d/bigchars" );

    cgs.media.whiteShader        = trap_R_RegisterShader( "white" );

    cgs.media.charsetProp        = trap_R_RegisterShaderNoMip( "menu/art/font1_prop.tga" );

    cgs.media.charsetPropGlow    = trap_R_RegisterShaderNoMip( "menu/art/font1_prop_glo.tga" );

    cgs.media.charsetPropB        = trap_R_RegisterShaderNoMip( "menu/art/font2_prop.tga" );



    CG_RegisterCvars();



    CG_InitConsoleCommands();



    cg.weaponSelect = WP_MACHINEGUN;



    cgs.redflag = cgs.blueflag = -1; // For compatibily, default to unset for

    cgs.flagStatus = -1;

    // old servers



    // get the rendering configuration from the client system

    trap_GetGlconfig( &cgs.glconfig );

    cgs.screenXScale = cgs.glconfig.vidWidth / 640.0;

    cgs.screenYScale = cgs.glconfig.vidHeight / 480.0;



    // get the gamestate from the client system

    trap_GetGameState( &cgs.gameState );



    // check version

    s = CG_ConfigString( CS_GAME_VERSION );

    if ( strcmp( s, GAME_VERSION ) ) {

        CG_Error( "Client/Server game mismatch: %s/%s", GAME_VERSION, s );

    }



    s = CG_ConfigString( CS_LEVEL_START_TIME );

    cgs.levelStartTime = atoi( s );



    CG_ParseServerinfo();



    // load the new map

    CG_LoadingString( "collision map" );



    trap_CM_LoadMap( cgs.mapname );



#ifdef MISSIONPACK

    String_Init();

#endif



    cg.loading = qtrue;        // force players to load instead of defer



    CG_LoadingString( "sounds" );



    CG_RegisterSounds();



    CG_LoadingString( "graphics" );



    CG_RegisterGraphics();



    CG_LoadingString( "clients" );



    CG_RegisterClients();        // if low on memory, some clients will be deferred



#ifdef MISSIONPACK

    CG_AssetCache();

    CG_LoadHudMenu();      // load new hud stuff

#endif



    cg.loading = qfalse;    // future players will be deferred



    CG_InitLocalEntities();



    CG_InitMarkPolys();



    // remove the last loading update

    cg.infoScreenText[0] = 0;



    // Make sure we have update values (scores)

    CG_SetConfigValues();



    CG_StartMusic();



    CG_LoadingString( "" );



#ifdef MISSIONPACK

    CG_InitTeamChat();

#endif



    CG_ShaderStateChanged();



    trap_S_ClearLoopingSounds( qtrue );

}

Now when taken a look at the above code u can see some important structures being set at the top.
Now that u know that CG_Init hold some structures here comes the big question;

HOW TO FUCK DO I FIND IT????!?!?!?

well thats easy my son, just simple open up ollydbg click -> file -> open -> and browse to the iw4mp.exe

now right click -> search for -> All referenced text strings

you'll get something like this->

now when you are there right click and select search for text (Or just hit CTRL+F)

so now u are wondering, why do i have that opened?
well just leave olly for now and go back into the SDK (Dont close olly)
take a good look at the code
*HINT * Thing between quotes are found as strings in olly *HINT*

Ooh so u want me to search for like; fonts/bigdevfont

EXACTLY GOOD BOY.

so go back into olly and search.

NOTE: Make sure Entire block and ignore case is selected.

double click the highlighted line after the search!!

u'll get here;

now scroll up to the top of the functions wich in asm looks like;

Code:

0058AC00  /$  83EC 50       SUB ESP,50

0058AC03  |.  53            PUSH EBX

0058AC04  |.  55            PUSH EBP

0058AC05  |.  56            PUSH ESI

0058AC06  |.  57            PUSH EDI

okayy now get back into the visual studio having the SDK opened.
Look in wich way everything is getting set, il be using the cg struct as example.

Now u'll see it gets set at the second line;

Code:

memset( &cg, 0, sizeof( cg ) );

so its safe to asume that off all the offsets in olly, the one wich holds cg is the second one getting pushed onto the stack ! (Ofcourse inside CG_Init)

so go back into olly

and search for the second push inside cg_init
(Make sure its not just Push ..... but Push Offset)

U'll end up at these lines;

Code:

0058AC34  |.  68 30D70F00   PUSH 0FD730                              ; /Arg3 = 0FD730

0058AC39  |.  56            PUSH ESI                                 ; |Arg2

0058AC3A  |.  68 B8587F00   PUSH OFFSET 007F58B8                     ; |Arg1 = iw4mp.7F58B8

0058AC3F  |.  E8 5CA61200   CALL 006B52A0                            ; \iw4mp.006B52A0

this is the exact line of the memset(cg...) but in asm
look ->
it says

Code:

Arg1 = iw4mp.7F58B8

Arg2                         (Shows nothing because it holds nothing)

Arg3 = 0FD730

now get back into the SDK again and look at this;

Code:

memset( &cg, 0, sizeof( cg ) );

So the offset to CG is being the first argument
Second one has zero zo blank
third one is sizeof( cg ) getting the size of the struct, wich is in arg 3

So to be clear the offset to CG = 7F58B8 and the size = 0FD730.

this is just a simple tutorial showing you how easy it actually is if it gets explained to you.

Big Thanks to;
Cardoow
Alex92

for explaining things to me when i dont get it.

if any1 sees anything that isnt right or something like that, please let me know il fix it.

and dont be to harsh its one of my first real tutorials lol

and another note: i havent used the iw4mp.c file in this tutorial any more

i came to the conclusion it wasnt needed, but if you want to be absolute sure just use the iw4mp.c as crossrefering file with the sdk

edit 2: il do making the struct another time