STW easy way

Hello MPGH I'm here again and today I'll share an easier way to do Shoot Through Walls ('STW').

With this method you can do RemoteKill too...

First way to use

Code:

#define ADDR_STW 0x7294C8 

void YourFunction(){
*(float*)(ADDR_STW + 0xC) = 100.0f;
}

Second way

Code:

class CrossFire_Texture
{
public:
	char pad_0000[12]; //0x0000
	float STW; //0x000C
}; //Size: 0x0040


void CALL_STW()
{
	CrossFire_Texture *pCF_texture = (CrossFire_Texture*)ADDR_STW;
	if (pCF_texture != NULL) {
		pCF_texture->STW = 100.0f;
	}
}

How to get ADDR?

Code:

DC 1D ?? ?? ?? ?? DF E0 F6 C4 05 7A ?? D9 EE D9 5D ?? EB

0044D4C0  |. 83EC 08        SUB ESP,8
0044D4C3  |. DD1C24         FSTP QWORD PTR SS:[ESP]
0044D4C6  |. E8 D9531700    CALL crossfir.005C28A4
0044D4CB  |. 83C4 08        ADD ESP,8
0044D4CE  |. D95D 94        FSTP DWORD PTR SS:[EBP-6C]
0044D4D1  |. D945 94        FLD DWORD PTR SS:[EBP-6C]
0044D4D4  |. DC1D C8947200  FCOMP QWORD PTR DS:[7294C8]
0044D4DA  |. DFE0           FSTSW AX
0044D4DC  |. F6C4 05        TEST AH,5
0044D4DF  |. 7A 07          JPE SHORT crossfir.0044D4E8
0044D4E1  |. D9EE           FLDZ
0044D4E3  |. D95D F0        FSTP DWORD PTR SS:[EBP-10]
0044D4E6  |. EB 23          JMP SHORT crossfir.0044D50B
0044D4E8  |> D945 10        FLD DWORD PTR SS:[EBP+10]
0044D4EB  |. 8B45 1C        MOV EAX,DWORD PTR SS:[EBP+1C]
0044D4EE  |. 8B4D 08        MOV ECX,DWORD PTR SS:[EBP+8]
0044D4F1  |. D82481         FSUB DWORD PTR DS:[ECX+EAX*4]
0044D4F4  |. 8B55 1C        MOV EDX,DWORD PTR SS:[EBP+1C]
0044D4F7  |. 8B45 0C        MOV EAX,DWORD PTR SS:[EBP+C]
0044D4FA  |. D90490         FLD DWORD PTR DS:[EAX+EDX*4]

Code:

\xDC\x1D\x00\x00\x00\x00\xDF\xE0\xF6\xC4\x05\x7A\x00\xD9\xEE\xD9\x5D\x00\xEB

Code:

xx????xxxxxx?xxxx?x

Very Useful Thanks

Originally Posted by dreek1

Hello MPGH I'm here again and today I'll share an easier way to do Shoot Through Walls ('STW').

With this method you can do RemoteKill too...

First way to use

Code:

#define ADDR_STW 0x7294C8 

void YourFunction(){
*(float*)(ADDR_STW + 0xC) = 100.0f;
}

Second way

Code:

class CrossFire_Texture
{
public:
	char pad_0000[12]; //0x0000
	float STW; //0x000C
}; //Size: 0x0040


void CALL_STW()
{
	CrossFire_Texture *pCF_texture = (CrossFire_Texture*)ADDR_STW;
	if (pCF_texture != NULL) {
		pCF_texture->STW = 100.0f;
	}
}

How to get ADDR?

Code:

DC 1D ?? ?? ?? ?? DF E0 F6 C4 05 7A ?? D9 EE D9 5D ?? EB

0044D4C0  |. 83EC 08        SUB ESP,8
0044D4C3  |. DD1C24         FSTP QWORD PTR SS:[ESP]
0044D4C6  |. E8 D9531700    CALL crossfir.005C28A4
0044D4CB  |. 83C4 08        ADD ESP,8
0044D4CE  |. D95D 94        FSTP DWORD PTR SS:[EBP-6C]
0044D4D1  |. D945 94        FLD DWORD PTR SS:[EBP-6C]
0044D4D4  |. DC1D C8947200  FCOMP QWORD PTR DS:[7294C8]
0044D4DA  |. DFE0           FSTSW AX
0044D4DC  |. F6C4 05        TEST AH,5
0044D4DF  |. 7A 07          JPE SHORT crossfir.0044D4E8
0044D4E1  |. D9EE           FLDZ
0044D4E3  |. D95D F0        FSTP DWORD PTR SS:[EBP-10]
0044D4E6  |. EB 23          JMP SHORT crossfir.0044D50B
0044D4E8  |> D945 10        FLD DWORD PTR SS:[EBP+10]
0044D4EB  |. 8B45 1C        MOV EAX,DWORD PTR SS:[EBP+1C]
0044D4EE  |. 8B4D 08        MOV ECX,DWORD PTR SS:[EBP+8]
0044D4F1  |. D82481         FSUB DWORD PTR DS:[ECX+EAX*4]
0044D4F4  |. 8B55 1C        MOV EDX,DWORD PTR SS:[EBP+1C]
0044D4F7  |. 8B45 0C        MOV EAX,DWORD PTR SS:[EBP+C]
0044D4FA  |. D90490         FLD DWORD PTR DS:[EAX+EDX*4]

Code:

\xDC\x1D\x00\x00\x00\x00\xDF\xE0\xF6\xC4\x05\x7A\x00\xD9\xEE\xD9\x5D\x00\xEB

Code:

xx????xxxxxx?xxxx?x

Thanks for Sharing ♥

This AOB does not work with CFVN, do you have a way to find this AOB at CFVN, I have a CShell.dll Dump file at CFVN

Originally Posted by janeth0123

This AOB does not work with CFVN, do you have a way to find this AOB at CFVN, I have a CShell.dll Dump file at CFVN

oww sh*t. why cshell....

0044D4DF |. 7A 07 JPE SHORT crossfir.0044D4E8

Originally Posted by janeth0123

This AOB does not work with CFVN, do you have a way to find this AOB at CFVN, I have a CShell.dll Dump file at CFVN

crossfire module

Originally Posted by jayjay153

oww sh*t. why cshell....

0044D4DF |. 7A 07 JPE SHORT crossfir.0044D4E8

can you guide me

Originally Posted by janeth0123

can you guide me

He means to find it in crossfire.exe dump not in cshell.
the reason why he fontred the crossfir. is for you to see that the module is crossfire.exe

search the aob in crossfire.exe dump not in cshell.

Code:

0044D4D4  |. DC1D C8947200  FCOMP QWORD PTR DS:[7294C8]  <---this is still what you need to find.
0044D4DA  |. DFE0           FSTSW AX
0044D4DC  |. F6C4 05        TEST AH,5
0044D4DF  |. 7A 07          JPE SHORT crossfir.0044D4E8 <--- Crossfire.exe not CShell

Great job

So It causes CF Client error 18_1 ?

Originally Posted by [K]akashi

Great job

So It causes CF Client error 18_1 ?

yeah, because this check is server-side

Originally Posted by CaiozinhoFC1

yeah, because this check is server-side

hmmm Thanks bro

Example

Any example to use Remote Kill with this?

Originally Posted by DepHax

Any example to use Remote Kill with this?

conditional with the weapon

Originally Posted by DepHax

Any example to use Remote Kill with this?

Just make Hook on function with your function of RemoteKill/ Silent Aim... It's undetected

STW easy way

Post a Reply

Similar Threads

Tags for this Thread