Home › Forum › MultiPlayer Game Hacks & Cheats › Other First Person Shooter Hacks › Homefront Hacks › Only Chams
Only Chams
Bugged Chams
this game is such a buggy pile of shit that I tried 4 different bases and they all come up with the same result, the game *eventually* crashes at vorbisfile.dll or the hack itself... usually on a map load...
EDIT: IT IS THE GENERATESHADER FUNCTION 100 PERCENT POSITIVE (that causes the crashing)... Im looking right now into a different one, also Ive rebuilt most of it on MagicMan's base, and remains stable for many many games
EDIT: I have fixed the crashing issue and am currently doing model recognition for each team (any suggestions for colors? I was thinking KPA visible YELLOW, obscured RED and USA visible GREEN and obscured BLUE
so whatever here it is, good luck NOT crashing constantly.
EDIT: AND ITS THE GAME FOR SOME REASON!:
this is what it looks like although Im not gonna get serious with the model recognition until I can fix this crash! I know it has to do with the pixel shaders messing up the game's ability to load textures as the pure empty MagicMan base works for hours and hours, with the only function being to write a string of text on the upper left of the screen... this JoshRose base does run longer than the magicman one with the same code added however... must be the VirtualMethodTableRepatchingLoopToCounterExtension Repatching
VirusTotal
Virscan
and for you COMPLETE noobs out there who dont even know what do do with a DLL file here is a link to many INJECTORS
http://www.mpgh.net/forum/292-combat...s-updated.html
EDIT: IT IS THE GENERATESHADER FUNCTION 100 PERCENT POSITIVE (that causes the crashing)... Im looking right now into a different one, also Ive rebuilt most of it on MagicMan's base, and remains stable for many many games
EDIT: I have fixed the crashing issue and am currently doing model recognition for each team (any suggestions for colors? I was thinking KPA visible YELLOW, obscured RED and USA visible GREEN and obscured BLUE
so whatever here it is, good luck NOT crashing constantly.
EDIT: AND ITS THE GAME FOR SOME REASON!:
this is what it looks like although Im not gonna get serious with the model recognition until I can fix this crash! I know it has to do with the pixel shaders messing up the game's ability to load textures as the pure empty MagicMan base works for hours and hours, with the only function being to write a string of text on the upper left of the screen... this JoshRose base does run longer than the magicman one with the same code added however... must be the VirtualMethodTableRepatchingLoopToCounterExtension Repatching
VirusTotal
Virscan
and for you COMPLETE noobs out there who dont even know what do do with a DLL file here is a link to many INJECTORS
http://www.mpgh.net/forum/292-combat...s-updated.html
its ur first release lol ... relax... look forward to trying this out though... thanks for the effort
Ive been reading and reading so many different websites to try and figure out how to do a WorldToScreen ESP for this but no luck so far its all just snippets that are sabotaged to prevent people like me from copy and pasting them
using the VTable Hook Base I found in the C++ section off the "other" site:
main.h:
main.cpp:
too bad external links arent allowed... on the beyondunreal wiki it has a whole page based on Object Structs for the UE3 engine...
using the VTable Hook Base I found in the C++ section off the "other" site:
main.h:
Code:
#define WIN32_LEAN_AND_MEAN #ifndef _MAIN_H #define _MAIN_H char *GetDirectoryFile(char *filename); void __cdecl add_log (const char * fmt, ...); void *DetourFunc(BYTE *src, const BYTE *dst, const int len); bool RetourFunc(BYTE *src, BYTE *restore, const int len); #endif
Code:
//-----------------------------------------------------------------------------------------------------------------------------------
/****************************************************************
Coded by: JoshRose
Type: D3D VTable Base Hook
Credits: Strife, R4z8r, Zoomgod, Roverturbo and MSDN. Thanks all
for helping me when i got stuck.
****************************************************************/
//----------------------------------------------------------------------------------------------------------------------------------
#include <windows.h>
//----------------------------------------------------------------------------------------------------------------------------------
#include "Main.h"
//-----------------------------------------------------------------------------------------------------------------------------------
#include <mmsystem.h>
#pragma comment(lib, "winmm.lib")
//-----------------------------------------------------------------------------------------------------------------------------------
#include <stdio.h>
//-----------------------------------------------------------------------------------------------------------------------------------
#include <fstream>
//-----------------------------------------------------------------------------------------------------------------------------------
#include "detours.h"
#pragma comment(lib,"detours.lib")
//-----------------------------------------------------------------------------------------------------------------------------------
#include <d3d9.h>
#include <d3dx9.h>
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
//-----------------------------------------------------------------------------------------------------------------------------------
using namespace std;
//---------------------------------------------------------------------------------------------------------------------------------
#define HOOK(func,addy) o##func = (t##func)DetourFunction((PBYTE)addy,(PBYTE)hk##func) //Quick Hook using MS Detour
#define UNHOOK(func,addy) o##func = (t##func)DetourFunction((PBYTE)addy,(PBYTE)o##func) //Quick Unook using MS Detour
//---------------------------------------------------------------------------------------------------------------------------------
#define ES 0 //EndScene
#define DIP 1 //DrawIndexedPrimitive
#define RES 2 //Reset
#define CQ 3 //CreateQuery
#define SSS 4 //SetStreamSource
//---------------------------------------------------------------------------------------------------------------------------------
LPDIRECT3DDEVICE9 npDevice; //pDevice is stored here so we can hook through the VTable
//---------------------------------------------------------------------------------------------------------------------------------
LPD3DXFONT g_pFont = NULL; //D3D Font
LPD3DXLINE g_pLine = NULL; //D3D Line
D3DVIEWPORT9 g_ViewPort; //ViewPort
//---------------------------------------------------------------------------------------------------------------------------------
//LPDIRECT3DVERTEXBUFFER9 Stream_Data;
//UINT Offset = 0;
//UINT Stride = 0;
unsigned int m_Stride;
bool Chams;
IDirect3DPixelShader9 *shaderRed;
IDirect3DPixelShader9 *shaderBlue;
//---------------------------------------------------------------------------------------------------------------------------------
//---------------------------------------------------------------------------------------------------------------------------------
typedef HRESULT (WINAPI* tSetStreamSource)(LPDIRECT3DDEVICE9 pDevice,UINT StreamNumber,IDirect3DVertexBuffer9* pStreamData,UINT OffsetInBytes,UINT Stride);
tSetStreamSource oSetStreamSource;
typedef HRESULT (WINAPI* tEndScene)(LPDIRECT3DDEVICE9 pDevice);
tEndScene oEndScene = NULL;
typedef HRESULT (WINAPI* tDrawIndexedPrimitive)(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE PrimType,INT BaseVertexIndex,UINT MinVertexIndex,UINT NumVertices,UINT startIndex,UINT primCount);
tDrawIndexedPrimitive oDrawIndexedPrimitive = NULL;
typedef HRESULT(WINAPI* tReset)(LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters);
tReset oReset = NULL;
typedef HRESULT (WINAPI* tCreateQuery)(LPDIRECT3DDEVICE9 pDevice, D3DQUERYTYPE Type,IDirect3DQuery9** ppQuery);
tCreateQuery oCreateQuery;
//---------------------------------------------------------------------------------------------------------------------------------
PBYTE HookVTableFunction( PDWORD* dwVTable, PBYTE dwHook, INT Index )
{
DWORD dwOld = 0;
VirtualProtect((void*)((*dwVTable) + (Index*4) ), 4, PAGE_EXECUTE_READWRITE, &dwOld);
PBYTE pOrig = ((PBYTE)(*dwVTable)[Index]);
(*dwVTable)[Index] = (DWORD)dwHook;
VirtualProtect((void*)((*dwVTable) + (Index*4)), 4, dwOld, &dwOld);
return pOrig;
}
//-----------------------------------------------------------------------------------------------------------------------------------
HRESULT GenerateShader( IDirect3DDevice9 *pDevice, IDirect3DPixelShader9 **pShader, float r, float g, float b )
{
char szShader[ 256 ];
ID3DXBuffer *pShaderBuf = NULL;
sprintf_s( szShader, "ps_3_0\ndef c0, %f, %f, %f, %f\nmov oC0,c0", r, g, b, 1.0f );
if( D3DXAssembleShader( szShader, sizeof( szShader ), NULL, NULL, 0, &pShaderBuf, NULL ) == D3D_OK )
pDevice->CreatePixelShader( ( const DWORD* )pShaderBuf->GetBufferPointer(), pShader );
else
return E_FAIL;
return S_OK;
}
//-----------------------------------------------------------------------------------------------------------------------------------
HRESULT WINAPI hkCreateQuery(LPDIRECT3DDEVICE9 pDevice, D3DQUERYTYPE Type,IDirect3DQuery9** ppQuery)
{
if (m_Stride = 36)
{
if( Type == D3DQUERYTYPE_OCCLUSION )
{
Type = D3DQUERYTYPE_EVENT;
}
}
return oCreateQuery( pDevice, Type, ppQuery );
}
//-----------------------------------------------------------------------------------------------------------------------------------
HRESULT WINAPI hkSetStreamSource(LPDIRECT3DDEVICE9 pDevice,UINT StreamNumber,IDirect3DVertexBuffer9* pStreamData,UINT OffsetInBytes,UINT Stride)
{
if(StreamNumber == 0){
m_Stride = Stride;
}
return oSetStreamSource(pDevice, StreamNumber, pStreamData, OffsetInBytes, Stride);
}
//-----------------------------------------------------------------------------------------------------------------------------------
HRESULT WINAPI hkEndScene(LPDIRECT3DDEVICE9 pDevice)
{
while(!npDevice) {
npDevice = pDevice; //Here we store pDevice so we can re-hook with a VTable hook later.
}
if (GetAsyncKeyState(VK_INSERT)&1)
{
Chams = !Chams;
}
if(g_pFont == NULL) D3DXCreateFont(pDevice, 15, 0, FW_BOLD, 1, 0, DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, ANTIALIASED_QUALITY, DEFAULT_PITCH | FF_DONTCARE, "Verdana", &g_pFont); //Create fonts
if(g_pLine == NULL) D3DXCreateLine(pDevice, &g_pLine); //Create lines
pDevice->GetViewport(&g_ViewPort);
GenerateShader(pDevice, &shaderBlue, 0.0f, 0.0f, 1.0f);
GenerateShader(pDevice, &shaderRed, 1.0f, 0.0f, 0.0f);
return oEndScene(pDevice);
}
//---------------------------------------------------------------------------------------------------------------------------------
HRESULT WINAPI hkDrawIndexedPrimitive(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE PrimType,INT BaseVertexIndex,UINT MinVertexIndex,UINT NumVertices,UINT startIndex,UINT primCount)
{
//if(pDevice->GetStreamSource(0, &Stream_Data, &Offset, &Stride) == D3D_OK)
//Stream_Data->Release();
if (Chams)
{
if ((m_Stride == 36 && ((primCount >= 1000))))//FIX THIS
{
pDevice->SetRenderState((D3DRENDERSTATETYPE)0x28, FALSE);
pDevice->SetRenderState(D3DRS_LASTPIXEL, TRUE);
pDevice->SetRenderState(D3DRS_SPECULARENABLE, TRUE);
pDevice->SetRenderState(D3DRS_LIGHTING, FALSE);
pDevice->SetRenderState(D3DRS_COLORVERTEX, TRUE);
//
pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
pDevice->SetPixelShader( shaderBlue ); //behind color
oDrawIndexedPrimitive(pDevice, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_TRUE );
pDevice->SetPixelShader( shaderRed ); //isvisible color
//pDevice->SetRenderState(D3DRS_FILLMODE,D3DFILL_WIREFRAME);
oDrawIndexedPrimitive(pDevice, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
//pDevice->SetRenderState(D3DRS_FILLMODE,D3DFILL_SOLID);
}
}
return oDrawIndexedPrimitive(pDevice, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
}
//---------------------------------------------------------------------------------------------------------------------------------
HRESULT WINAPI hkReset(LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters)
{
if( g_pFont )
g_pFont->OnLostDevice();
if( g_pLine )
g_pLine->OnLostDevice();
HRESULT iReturnValue = oReset(pDevice, pPresentationParameters);
if(iReturnValue == D3D_OK) {
if( g_pFont )
g_pFont->OnResetDevice();
if( g_pLine )
g_pLine->OnResetDevice();
}
return iReturnValue;
}
//-----------------------------------------------------------------------------------------------------------------------------------
LRESULT CALLBACK MsgProc(HWND hwnd,UINT uMsg,WPARAM wParam,LPARAM lParam){return DefWindowProc(hwnd, uMsg, wParam, lParam);}
void DX_Init(DWORD* table)
{
WNDCLASSEX wc = {sizeof(WNDCLASSEX),CS_CLASSDC,MsgProc,0L,0L,GetModuleHandle(NULL),NULL,NULL,NULL,NULL,"DX",NULL};
RegisterClassEx(&wc);
HWND hWnd = CreateWindow("DX",NULL,WS_OVERLAPPED,100,100,300,300,GetDesktopWindow(),NULL,wc.hInstance,NULL);
LPDIRECT3D9 pD3D = Direct3DCreate9( D3D_SDK_VERSION );
D3DPRESENT_PARAMETERS d3dpp;
ZeroMemory( &d3dpp, sizeof(d3dpp) );
d3dpp.Windowed = TRUE;
d3dpp.SwapEffect = D3DSWAPEFFECT_DISCARD;
d3dpp.BackBufferFormat = D3DFMT_UNKNOWN;
LPDIRECT3DDEVICE9 pd3dDevice;
pD3D->CreateDevice(D3DADAPTER_DEFAULT,D3DDEVTYPE_HAL,hWnd,D3DCREATE_SOFTWARE_VERTEXPROCESSING,&d3dpp,&pd3dDevice);
DWORD* pVTable = (DWORD*)pd3dDevice;
pVTable = (DWORD*)pVTable[0];
table[ES] = pVTable[42]; //EndScene address
table[DIP] = pVTable[82]; //DrawIndexedPrimitive address
table[RES] = pVTable[16]; //Reset address
table[CQ] = pVTable[118]; //CreateQuery address
table[SSS] = pVTable[100]; //SetStreamSource address
DestroyWindow(hWnd);
}
//------------------------------------------------------------------------------------------------------------------------------------
DWORD WINAPI VirtualMethodTableRepatchingLoopToCounterExtensionRepatching( LPVOID Param )
{
while(1) {
Sleep(100);
HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkDrawIndexedPrimitive, 82); //Hook DrawIndexedPrimitive
HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkEndScene, 42); //Hook EndScene
HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkReset, 16); //Hook Reset
HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkCreateQuery, 118); //Hook CreateQuery
HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkSetStreamSource, 100); //Hook SetStreamSource
}
return 1;
}
//------------------------------------------------------------------------------------------------------------------------------------
bool hooked = false;
DWORD WINAPI LoopFunction( LPVOID lpParam )
{
if( hooked == false) {
DWORD VTable[5] = {0};
while(GetModuleHandle("d3d9.dll")==NULL) {
Sleep(250);
}
DX_Init(VTable);
HOOK(EndScene,VTable[ES]); //Hook EndScene as a device discovery hook
while(!npDevice) {
Sleep(50); //Sleep until npDevice is not equal to NULL
}
UNHOOK(EndScene, VTable[ES]); //Unhook as soon as we have a valid pointer to pDevice
*(PDWORD)&oDrawIndexedPrimitive = VTable[DIP];
*(PDWORD)&oEndScene = VTable[ES];
*(PDWORD)&oReset = VTable[RES];
*(PDWORD)&oCreateQuery = VTable[CQ];
*(PDWORD)&oSetStreamSource = VTable[SSS];
CreateThread(NULL,0,&VirtualMethodTableRepatchingLoopToCounterExtensionRepatching,NULL,0,NULL); //Create hooking thread
hooked = true;
Sleep(200);
}
return 0;
}
//------------------------------------------------------------------------------------------------------------------------------------
BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpvReserved)
{
if(dwReason == DLL_PROCESS_ATTACH) {
CreateThread(0, 0, LoopFunction, 0, 0, 0);
}
else if(dwReason == DLL_PROCESS_DETACH) {
}
return TRUE;
}
//------------------------------------------------------------------------------------------------------------------------------------
too bad external links arent allowed... on the beyondunreal wiki it has a whole page based on Object Structs for the UE3 engine...
Code:
Structs
Array_Mirror
pointer Data
int ArrayNum
int ArrayMax
BitArray_Mirror
pointer IndirectData
int InlineData[4]
int NumBits
int MaxBits
BoneAtom
Bone Atom definition
Quat Rotation
Vector Translation
float Scale
Box
Modifiers: immutable
Vector Min
Vector Max
byte IsValid
BoxSphereBounds
Vector Origin
Vector BoxExtent
float SphereRadius
Color
Modifiers: immutable
byte B
byte G
byte R
byte A
Cylinder
float Radius
float Height
double
int A
int B
Guid
Modifiers: immutable
int A
int B
int C
int D
IndirectArray_Mirror
pointer Data
int ArrayNum
int ArrayMax
InterpCurveFloat
array<InterpCurvePointFloat> Points
EInterpMethodType InterpMethod
InterpCurveLinearColor
array<InterpCurvePointLinearColor> Points
EInterpMethodType InterpMethod
InterpCurvePointFloat
float InVal
float OutVal
float ArriveTangent
float LeaveTangent
EInterpCurveMode InterpMode
InterpCurvePointLinearColor
float InVal
LinearColor OutVal
LinearColor ArriveTangent
LinearColor LeaveTangent
EInterpCurveMode InterpMode
InterpCurvePointQuat
float InVal
Quat OutVal
Quat ArriveTangent
Quat LeaveTangent
EInterpCurveMode InterpMode
InterpCurvePointTwoVectors
float InVal
TwoVectors OutVal
TwoVectors ArriveTangent
TwoVectors LeaveTangent
EInterpCurveMode InterpMode
InterpCurvePointVector
float InVal
Vector OutVal
Vector ArriveTangent
Vector LeaveTangent
EInterpCurveMode InterpMode
InterpCurvePointVector2D
float InVal
Vector2D OutVal
Vector2D ArriveTangent
Vector2D LeaveTangent
EInterpCurveMode InterpMode
[edit] InterpCurveQuat
array<InterpCurvePointQuat> Points
EInterpMethodType InterpMethod
InterpCurveTwoVectors
array<InterpCurvePointTwoVectors> Points
EInterpMethodType InterpMethod
InterpCurveVector
array<InterpCurvePointVector> Points
EInterpMethodType InterpMethod
InterpCurveVector2D
array<InterpCurvePointVector2D> Points
EInterpMethodType InterpMethod
IntPoint
Modifiers: immutable
Screen coordinates
int X
int Y
LinearColor
Modifiers: immutable
float R
float G
float B
float A
Default values:
Property Value
A 1.0
Map_Mirror
Set_Mirror Pairs
Matrix
Modifiers: immutable
Plane XPlane
Plane YPlane
Plane ZPlane
Plane WPlane
MultiMap_Mirror
Set_Mirror Pairs
OctreeElementId
Mirror for FElementId used in generic Octree
pointer Node
int ElementIndex
Plane
Extends: Vector
Modifiers: immutable
float W
pointer
int Dummy
Quat
Modifiers: immutable
float X
float Y
float Z
float W
qword
int A
int B
RawDistribution
byte Type
byte Op
byte LookupTableNumElements
byte LookupTableChunkSize
array<float> LookupTable
float LookupTableTimeScale
float LookupTableStartTime
RenderCommandFence
A fence used to track rendering thread command execution.
int NumPendingFences
RenderCommandFence_Mirror
int NumPendingFences
Rotator
Modifiers: immutable
int Pitch
int Yaw
int Roll
Set_Mirror
SparseArray_Mirror Elements
pointer Hash
int InlineHash
int HashSize
SHVector
A vector of spherical harmonic coefficients.
float V[9]
float Padding[3]
SHVectorRGB
A vector of spherical harmonic coefficients for each color component.
SHVector R
SHVector G
SHVector B
SparseArray_Mirror
array<int> Elements
BitArray_Mirror AllocationFlags
int FirstFreeIndex
int NumFreeIndices
TAlphaBlend
Structure to encompass Alpha Interpolation.
float AlphaIn
Internal Lerped value for Alpha
float AlphaOut
Resulting Alpha value, between 0.f and 1.f
float AlphaTarget
Target to reach
float BlendTime
Default blend time
float BlendTimeToGo
Time left to reach target
AlphaBlendType BlendType
Type of blending used (Linear, Cubic, etc.)
Default values:
Property Value
BlendTime 0.67
BlendType ABT_Linear
ThreadSafeCounter
int Value
TPOV
Point Of View type.
Vector Location
Location
Rotator Rotation
Rotation
float FOV
FOV angle
Default values:
Property Value
FOV 90.0
TwoVectors
Modifiers: immutable
Vector v1
Vector v2
UntypedBulkData_Mirror
pointer VfTable
int BulkDataFlags
int ElementCount
int BulkDataOffsetInFile
int BulkDataSizeOnDisk
int SavedBulkDataFlags
int SavedElementCount
int SavedBulkDataOffsetInFile
int SavedBulkDataSizeOnDisk
pointer BulkData
int LockStatus
pointer AttachedAr
int bShouldFreeOnEmpty
Vector
Modifiers: immutable
float X
float Y
float Z
Vector2D
Modifiers: immutable
float X
float Y
Vector4
Modifiers: immutable
float X
float Y
float Z
float W
Seems clean.
/approved
/approved
sometimes I think Ive ruined my ability to properly learn this by getting copy and paste results from my first hack (Medal of Honor Singleplayer Chams)... but then I realize that now I understand what and where a function is what VOIDs do and how to declare and what UINTS are and alot of things... what I really missed out on was how to properly debug and reverse... those are so essential to learning the right way how to game hack.
MODEL RECOGNITION IS SO MUCH EASIER THIS WAY!!!!!
Model |NumVerts LODS (1,2,3,4)
---------------------------------------------------
CH_AST 3211,1820,959,181
CH_LMG 3216,1554,862,180
CH_SMG 2504,1258,745,182
CH_SNI 3203,1765,1061,431
US_AST 3119,1735,897,164
US_LMG 2808,1564,960,197
US_SMG 2835,1519,790,157
US_SNI 3994,2347,1100,180
EXCEPT THAT DOESNT WORK AT ALL WTF!!!!!
Model |NumVerts LODS (1,2,3,4)
---------------------------------------------------
CH_AST 3211,1820,959,181
CH_LMG 3216,1554,862,180
CH_SMG 2504,1258,745,182
CH_SNI 3203,1765,1061,431
US_AST 3119,1735,897,164
US_LMG 2808,1564,960,197
US_SMG 2835,1519,790,157
US_SNI 3994,2347,1100,180
EXCEPT THAT DOESNT WORK AT ALL WTF!!!!!
uh wait for my next one Im JUST getting it finished up today....
(trying to prevent the ground pixel shaders from behing drawn ontop of the chams)
for now make sure you're running the game in directx9:
you need to use an injector that will autoinject into the game after its window is established and before the video is initialized somewhere between 2000 and 5000ms
steam library > homefront > properties > Set Launch Options> " -d3d9 " (without quotes)
(trying to prevent the ground pixel shaders from behing drawn ontop of the chams)
for now make sure you're running the game in directx9:
you need to use an injector that will autoinject into the game after its window is established and before the video is initialized somewhere between 2000 and 5000ms
steam library > homefront > properties > Set Launch Options> " -d3d9 " (without quotes)
looking forward to release.... good luck
Looking forward to them as well.
Im looking backward for the release.