Merhaba, GF serverinde wall hack deniyorum, pointer offset her şeyi buldum fakat oyun beni bir engelden geçtikten sonra (örneğin 2. köyde dağdan geçiyorum) eski konumuna geri ışınlıyor. bunu hangi yöntemlerle çözdünüz ? Bunun için benimle c++ kaynak kodu paylaşabilir misiniz fikir olması açısından ? Walk boost uygulayarak bu işlemi yapmaya çalışıyorum, walk boost yaptığım zaman oyun beni geri konumuna atmıyor fakat wall hack açtığım zaman oyun beni geri ışınlıyor sürekli olarak. (2 haftadır bununla uğraşıyorum yardımları bekliyorum:d)
Yapman gereken şey engele geldigin zaman sunucuya konum bilgisi vs göndermeyeceksin engeli geçtikten sonra konum bilgisini göndereceksin örnegin a noktasından engele girdin b noktasından çıktın a noktasından b noktasına 2500 adım sınırıı var bunu geçmeden paketleri gönderecek sunucuya ve bu sayede geri atmayacak engeli geçtikten sonra normal şekilde devam etmiş olacaksın.
Yapman gereken şey engele geldigin zaman sunucuya konum bilgisi vs göndermeyeceksin engeli geçtikten sonra konum bilgisini göndereceksin örnegin a noktasından engele girdin b noktasından çıktın a noktasından b noktasına 2500 adım sınırıı var bunu geçmeden paketleri gönderecek sunucuya ve bu sayede geri atmayacak engeli geçtikten sonra normal şekilde devam etmiş olacaksın.
Kod:
// walk_boost6.cpp — WallPass v1: engelden gecis + speed boost
// F2 ON = engele girerken bas (paketleri bloklar, noclip acar)
// F2 OFF = engelden ciktiktan sonra bas (server'a sync, Goto terrain bakmaz)
// Server limit: max 2500 unit/paket. Altindaysa tek paket, ustundeyse adimla.
#include <windows.h>
#include <cstdio>
#include <cstdint>
#include <cmath>
#include <psapi.h>
#pragma comment(lib, "psapi.lib")
#define O_GX 0x7C4
#define O_GY 0x7C8
#define O_ROT 0x834
#define O_NOCLIP 0x8F0
#define O_SRC_X 0x894
#define O_SRC_Y 0x898
#define O_DST_X 0x8AC
#define O_DST_Y 0x8B0
static uintptr_t* g_pCharMgr = nullptr;
static uintptr_t* g_pNet = nullptr;
static uint8_t* g_pSendState = nullptr;
static float g_Boost = 15.f;
static bool g_BoostOn = false;
static bool g_WallhackOn = false;
static bool g_SendPatched = false;
static uint8_t g_SendOrig[5];
static float g_EntryX = 0, g_EntryY = 0;
static uint8_t* Scan(uint8_t* b, size_t sz, const uint8_t* p, const char* m, size_t l) {
for (size_t i = 0; i + l <= sz; i++) {
bool ok = true;
for (size_t j = 0; j < l; j++) if (m[j] == 'x' && b[i+j] != p[j]) { ok = false; break; }
if (ok) return &b[i];
}
return nullptr;
}
static uintptr_t GetInst() {
if (!g_pCharMgr || IsBadReadPtr(g_pCharMgr, 4)) return 0;
uintptr_t mgr = *(uintptr_t*)g_pCharMgr;
if (!mgr || IsBadReadPtr((void*)(mgr + 0x0C), 4)) return 0;
uintptr_t inst = *(uintptr_t*)(mgr + 0x0C);
if (!inst || IsBadReadPtr((void*)(inst + O_GX), 8)) return 0;
return inst;
}
static void PatchSendState(bool block) {
if (!g_pSendState || block == g_SendPatched) return;
DWORD old;
VirtualProtect(g_pSendState, 5, PAGE_EXECUTE_READWRITE, &old);
if (block) {
memcpy(g_SendOrig, g_pSendState, 5);
g_pSendState[0] = 0x33; g_pSendState[1] = 0xC0;
g_pSendState[2] = 0xC2; g_pSendState[3] = 0x10; g_pSendState[4] = 0x00;
} else {
memcpy(g_pSendState, g_SendOrig, 5);
}
VirtualProtect(g_pSendState, 5, old, &old);
g_SendPatched = block;
}
static void SetNoClip(bool on) {
uintptr_t inst = GetInst();
if (inst) *(DWORD*)(inst + O_NOCLIP) = on ? 1 : 0;
}
struct Vec3 { float x, y, z; };
// eFunc=1 → FUNC_MOVE → server calls Goto(x,y) which has NO terrain validation
static void SendMove(float px, float py) {
if (!g_pNet || !g_pSendState) return;
uintptr_t net = *(uintptr_t*)g_pNet;
if (!net) return;
bool wasPatch = g_SendPatched;
if (wasPatch) PatchSendState(false);
void* pN = (void*)net;
uint8_t* ca = g_pSendState;
Vec3 pos = { px, -py, 0.f };
Vec3* pp = &pos;
__try {
__asm { pushad }
__asm { mov ecx, pN }
__asm { push 0 } // uArg
__asm { push 1 } // eFunc=1 (FUNC_MOVE → Goto, no terrain check)
__asm { push 0 } // rotation
__asm { push pp } // position
__asm { call ca }
__asm { popad }
} __except (EXCEPTION_EXECUTE_HANDLER) {}
if (wasPatch) PatchSendState(true);
}
static bool Init() {
MODULEINFO mi = {};
GetModuleInformation(GetCurrentProcess(), GetModuleHandleA(NULL), &mi, sizeof(mi));
uint8_t* base = (uint8_t*)mi.lpBaseOfDll;
size_t sz = mi.SizeOfImage;
uint8_t* h;
uint8_t p1[] = {0xA1,0,0,0,0,0x89,0x85,0xF8,0xFE,0xFF,0xFF,0x8A,0x0D,0,0,0,0,0x88,0x8D,0xFC,0xFE,0xFF,0xFF,0x68};
h = Scan(base, sz, p1, "x????xxxxxxxx????xxxxxxx", sizeof(p1));
if (h) g_pCharMgr = *(uintptr_t**)(h + 1);
uint8_t p2[] = {0x8B,0x0D,0,0,0,0,0x89,0x4D,0x00,0x8B,0x4D,0x00,0xE8,0,0,0,0,0x8B,0xE5};
h = Scan(base, sz, p2, "xx????xx?xx?x????xx", sizeof(p2));
if (h) g_pNet = *(uintptr_t**)(h + 2);
uint8_t p3[] = {0x55,0x8B,0xEC,0x83,0xEC,0x28,0xA1,0,0,0,0,0x33,0xC5,0x89,0x45,0xFC,0x89,0x4D,0x00,0xC6,0x45,0x00,0x0B,0x8D,0x45};
h = Scan(base, sz, p3, "xxxxxxx????xxxxxxx?xx?xxx", sizeof(p3));
if (h) g_pSendState = h;
printf("[INIT] CharMgr:%s Net:%s SendState:%s\n",
g_pCharMgr?"OK":"X", g_pNet?"OK":"X", g_pSendState?"OK":"X");
return g_pCharMgr && g_pNet && g_pSendState;
}
DWORD WINAPI MainThread(LPVOID hMod) {
AllocConsole(); FILE* f; freopen_s(&f, "CONOUT$", "w", stdout);
SetConsoleTitleA("WallPass v1");
printf("==========================================\n");
printf(" WallPass v1\n");
printf("==========================================\n");
printf(" F2 = Wallhack toggle\n");
printf(" ON: engele girerken bas\n");
printf(" OFF: engelden cikinca bas\n");
printf(" (A->B < 2500 = aninda kabul)\n");
printf(" F1 = Speed Boost\n");
printf(" Num8/2 = Hiz +/-\n");
printf(" F10 = Eject\n");
printf("==========================================\n\n");
if (!Init()) { printf("[!] FAIL\n"); Sleep(2000); FreeConsole(); FreeLibraryAndExitThread((HMODULE)hMod,1); return 1; }
float prevX = 0, prevY = 0;
uintptr_t inst = GetInst();
if (inst) { prevX = *(float*)(inst + O_GX); prevY = *(float*)(inst + O_GY); }
DWORD lastPkt = 0;
while (true) {
if (GetAsyncKeyState(VK_F10) & 1) break;
inst = GetInst();
if (!inst) { Sleep(100); continue; }
// F2: Wallhack
if (GetAsyncKeyState(VK_F2) & 1) {
if (!g_WallhackOn) {
g_EntryX = *(float*)(inst + O_GX);
g_EntryY = *(float*)(inst + O_GY);
PatchSendState(true);
SetNoClip(true);
g_WallhackOn = true;
printf("[WALL] ON | entry=(%.0f,%.0f)\n", g_EntryX, g_EntryY);
} else {
float exitX = *(float*)(inst + O_GX);
float exitY = *(float*)(inst + O_GY);
float dx = exitX - g_EntryX, dy = exitY - g_EntryY;
float dist = sqrtf(dx*dx + dy*dy);
SetNoClip(false);
if (dist < 2400.f) {
// Under limit — direct sync
PatchSendState(false);
SendMove(exitX, exitY);
*(float*)(inst + O_SRC_X) = exitX;
*(float*)(inst + O_SRC_Y) = exitY;
*(float*)(inst + O_DST_X) = exitX;
*(float*)(inst + O_DST_Y) = exitY;
printf("[WALL] OFF | dist=%.0f < 2400 → SYNC OK!\n", dist);
} else {
// Over limit — step sync
int steps = (int)(dist / 2000.f) + 1;
printf("[WALL] OFF | dist=%.0f > 2400, %d steps...\n", dist, steps);
for (int i = 1; i <= steps; i++) {
if (GetAsyncKeyState(VK_F10) & 1) break;
float t = (float)i / (float)steps;
SendMove(g_EntryX + dx*t, g_EntryY + dy*t);
if (i < steps) {
int waitMs = (int)((dist/steps) / 250.f * 1000.f) + 300;
DWORD t0 = GetTickCount();
while ((int)(GetTickCount()-t0) < waitMs) {
if (GetAsyncKeyState(VK_F10) & 1) break;
Sleep(50);
}
}
}
Sleep(300);
PatchSendState(false);
*(float*)(inst + O_GX) = exitX;
*(float*)(inst + O_GY) = exitY;
*(float*)(inst + O_SRC_X) = exitX;
*(float*)(inst + O_SRC_Y) = exitY;
*(float*)(inst + O_DST_X) = exitX;
*(float*)(inst + O_DST_Y) = exitY;
printf("[WALL] SYNCED (multi-step)\n");
}
g_WallhackOn = false;
}
}
// F1: Boost
if (GetAsyncKeyState(VK_F1) & 1) {
g_BoostOn = !g_BoostOn;
prevX = *(float*)(inst + O_GX); prevY = *(float*)(inst + O_GY);
printf("[BOOST] %s (%.0f)\n", g_BoostOn?"ON":"OFF", g_Boost);
}
if (GetAsyncKeyState(VK_NUMPAD8) & 1) { g_Boost += 5; if (g_Boost > 80) g_Boost = 80; printf("[SPD] %.0f\n", g_Boost); }
if (GetAsyncKeyState(VK_NUMPAD2) & 1) { g_Boost -= 5; if (g_Boost < 5) g_Boost = 5; printf("[SPD] %.0f\n", g_Boost); }
// Noclip guard
if (g_WallhackOn && *(DWORD*)(inst + O_NOCLIP) != 1)
*(DWORD*)(inst + O_NOCLIP) = 1;
// Boost logic
if (g_BoostOn) {
float cx = *(float*)(inst + O_GX), cy = *(float*)(inst + O_GY);
float ddx = cx-prevX, ddy = cy-prevY;
if (sqrtf(ddx*ddx+ddy*ddy) > 2.f) {
float rot = *(float*)(inst + O_ROT), rad = rot * 0.017453292f;
float nx = cx + g_Boost*sinf(rad), ny = cy - g_Boost*cosf(rad);
*(float*)(inst + O_GX) = nx;
*(float*)(inst + O_GY) = ny;
if (!g_WallhackOn) {
DWORD now = GetTickCount();
if (now - lastPkt >= 200) { SendMove(nx, ny); lastPkt = now; }
}
prevX = nx; prevY = ny;
} else { prevX = cx; prevY = cy; }
}
Sleep(10);
}
SetNoClip(false);
PatchSendState(false);
printf("[*] Ejecting...\n");
Sleep(200); if (f) fclose(f); FreeConsole();
FreeLibraryAndExitThread((HMODULE)hMod, 0); return 0;
}
BOOL APIENTRY DllMain(HMODULE h, DWORD r, LPVOID) {
if (r == DLL_PROCESS_ATTACH) { DisableThreadLibraryCalls(h); CreateThread(NULL,0,MainThread,h,0,NULL); }
return TRUE;
}
bu kodu çalıştırdım fakat 2400'ün üzerindeyse yine geri atıyor dediğini yapmaya çalıştım fakat olmadı. Acaba bana gösterebileceğin veya yardımcı olabileceğini düşündüğün bir cpp kodu paylaşabilir misin?
eski kodumda kalmış bulamadım bulsaydım direkt atacaktım zaten adım boyutunu 1800 yapKod:// walk_boost6.cpp — WallPass v1: engelden gecis + speed boost // F2 ON = engele girerken bas (paketleri bloklar, noclip acar) // F2 OFF = engelden ciktiktan sonra bas (server'a sync, Goto terrain bakmaz) // Server limit: max 2500 unit/paket. Altindaysa tek paket, ustundeyse adimla. #include <windows.h> #include <cstdio> #include <cstdint> #include <cmath> #include <psapi.h> #pragma comment(lib, "psapi.lib") #define O_GX 0x7C4 #define O_GY 0x7C8 #define O_ROT 0x834 #define O_NOCLIP 0x8F0 #define O_SRC_X 0x894 #define O_SRC_Y 0x898 #define O_DST_X 0x8AC #define O_DST_Y 0x8B0 static uintptr_t* g_pCharMgr = nullptr; static uintptr_t* g_pNet = nullptr; static uint8_t* g_pSendState = nullptr; static float g_Boost = 15.f; static bool g_BoostOn = false; static bool g_WallhackOn = false; static bool g_SendPatched = false; static uint8_t g_SendOrig[5]; static float g_EntryX = 0, g_EntryY = 0; static uint8_t* Scan(uint8_t* b, size_t sz, const uint8_t* p, const char* m, size_t l) { for (size_t i = 0; i + l <= sz; i++) { bool ok = true; for (size_t j = 0; j < l; j++) if (m[j] == 'x' && b[i+j] != p[j]) { ok = false; break; } if (ok) return &b[i]; } return nullptr; } static uintptr_t GetInst() { if (!g_pCharMgr || IsBadReadPtr(g_pCharMgr, 4)) return 0; uintptr_t mgr = *(uintptr_t*)g_pCharMgr; if (!mgr || IsBadReadPtr((void*)(mgr + 0x0C), 4)) return 0; uintptr_t inst = *(uintptr_t*)(mgr + 0x0C); if (!inst || IsBadReadPtr((void*)(inst + O_GX), 8)) return 0; return inst; } static void PatchSendState(bool block) { if (!g_pSendState || block == g_SendPatched) return; DWORD old; VirtualProtect(g_pSendState, 5, PAGE_EXECUTE_READWRITE, &old); if (block) { memcpy(g_SendOrig, g_pSendState, 5); g_pSendState[0] = 0x33; g_pSendState[1] = 0xC0; g_pSendState[2] = 0xC2; g_pSendState[3] = 0x10; g_pSendState[4] = 0x00; } else { memcpy(g_pSendState, g_SendOrig, 5); } VirtualProtect(g_pSendState, 5, old, &old); g_SendPatched = block; } static void SetNoClip(bool on) { uintptr_t inst = GetInst(); if (inst) *(DWORD*)(inst + O_NOCLIP) = on ? 1 : 0; } struct Vec3 { float x, y, z; }; // eFunc=1 → FUNC_MOVE → server calls Goto(x,y) which has NO terrain validation static void SendMove(float px, float py) { if (!g_pNet || !g_pSendState) return; uintptr_t net = *(uintptr_t*)g_pNet; if (!net) return; bool wasPatch = g_SendPatched; if (wasPatch) PatchSendState(false); void* pN = (void*)net; uint8_t* ca = g_pSendState; Vec3 pos = { px, -py, 0.f }; Vec3* pp = &pos; __try { __asm { pushad } __asm { mov ecx, pN } __asm { push 0 } // uArg __asm { push 1 } // eFunc=1 (FUNC_MOVE → Goto, no terrain check) __asm { push 0 } // rotation __asm { push pp } // position __asm { call ca } __asm { popad } } __except (EXCEPTION_EXECUTE_HANDLER) {} if (wasPatch) PatchSendState(true); } static bool Init() { MODULEINFO mi = {}; GetModuleInformation(GetCurrentProcess(), GetModuleHandleA(NULL), &mi, sizeof(mi)); uint8_t* base = (uint8_t*)mi.lpBaseOfDll; size_t sz = mi.SizeOfImage; uint8_t* h; uint8_t p1[] = {0xA1,0,0,0,0,0x89,0x85,0xF8,0xFE,0xFF,0xFF,0x8A,0x0D,0,0,0,0,0x88,0x8D,0xFC,0xFE,0xFF,0xFF,0x68}; h = Scan(base, sz, p1, "x????xxxxxxxx????xxxxxxx", sizeof(p1)); if (h) g_pCharMgr = *(uintptr_t**)(h + 1); uint8_t p2[] = {0x8B,0x0D,0,0,0,0,0x89,0x4D,0x00,0x8B,0x4D,0x00,0xE8,0,0,0,0,0x8B,0xE5}; h = Scan(base, sz, p2, "xx????xx?xx?x????xx", sizeof(p2)); if (h) g_pNet = *(uintptr_t**)(h + 2); uint8_t p3[] = {0x55,0x8B,0xEC,0x83,0xEC,0x28,0xA1,0,0,0,0,0x33,0xC5,0x89,0x45,0xFC,0x89,0x4D,0x00,0xC6,0x45,0x00,0x0B,0x8D,0x45}; h = Scan(base, sz, p3, "xxxxxxx????xxxxxxx?xx?xxx", sizeof(p3)); if (h) g_pSendState = h; printf("[INIT] CharMgr:%s Net:%s SendState:%s\n", g_pCharMgr?"OK":"X", g_pNet?"OK":"X", g_pSendState?"OK":"X"); return g_pCharMgr && g_pNet && g_pSendState; } DWORD WINAPI MainThread(LPVOID hMod) { AllocConsole(); FILE* f; freopen_s(&f, "CONOUT$", "w", stdout); SetConsoleTitleA("WallPass v1"); printf("==========================================\n"); printf(" WallPass v1\n"); printf("==========================================\n"); printf(" F2 = Wallhack toggle\n"); printf(" ON: engele girerken bas\n"); printf(" OFF: engelden cikinca bas\n"); printf(" (A->B < 2500 = aninda kabul)\n"); printf(" F1 = Speed Boost\n"); printf(" Num8/2 = Hiz +/-\n"); printf(" F10 = Eject\n"); printf("==========================================\n\n"); if (!Init()) { printf("[!] FAIL\n"); Sleep(2000); FreeConsole(); FreeLibraryAndExitThread((HMODULE)hMod,1); return 1; } float prevX = 0, prevY = 0; uintptr_t inst = GetInst(); if (inst) { prevX = *(float*)(inst + O_GX); prevY = *(float*)(inst + O_GY); } DWORD lastPkt = 0; while (true) { if (GetAsyncKeyState(VK_F10) & 1) break; inst = GetInst(); if (!inst) { Sleep(100); continue; } // F2: Wallhack if (GetAsyncKeyState(VK_F2) & 1) { if (!g_WallhackOn) { g_EntryX = *(float*)(inst + O_GX); g_EntryY = *(float*)(inst + O_GY); PatchSendState(true); SetNoClip(true); g_WallhackOn = true; printf("[WALL] ON | entry=(%.0f,%.0f)\n", g_EntryX, g_EntryY); } else { float exitX = *(float*)(inst + O_GX); float exitY = *(float*)(inst + O_GY); float dx = exitX - g_EntryX, dy = exitY - g_EntryY; float dist = sqrtf(dx*dx + dy*dy); SetNoClip(false); if (dist < 2400.f) { // Under limit — direct sync PatchSendState(false); SendMove(exitX, exitY); *(float*)(inst + O_SRC_X) = exitX; *(float*)(inst + O_SRC_Y) = exitY; *(float*)(inst + O_DST_X) = exitX; *(float*)(inst + O_DST_Y) = exitY; printf("[WALL] OFF | dist=%.0f < 2400 → SYNC OK!\n", dist); } else { // Over limit — step sync int steps = (int)(dist / 2000.f) + 1; printf("[WALL] OFF | dist=%.0f > 2400, %d steps...\n", dist, steps); for (int i = 1; i <= steps; i++) { if (GetAsyncKeyState(VK_F10) & 1) break; float t = (float)i / (float)steps; SendMove(g_EntryX + dx*t, g_EntryY + dy*t); if (i < steps) { int waitMs = (int)((dist/steps) / 250.f * 1000.f) + 300; DWORD t0 = GetTickCount(); while ((int)(GetTickCount()-t0) < waitMs) { if (GetAsyncKeyState(VK_F10) & 1) break; Sleep(50); } } } Sleep(300); PatchSendState(false); *(float*)(inst + O_GX) = exitX; *(float*)(inst + O_GY) = exitY; *(float*)(inst + O_SRC_X) = exitX; *(float*)(inst + O_SRC_Y) = exitY; *(float*)(inst + O_DST_X) = exitX; *(float*)(inst + O_DST_Y) = exitY; printf("[WALL] SYNCED (multi-step)\n"); } g_WallhackOn = false; } } // F1: Boost if (GetAsyncKeyState(VK_F1) & 1) { g_BoostOn = !g_BoostOn; prevX = *(float*)(inst + O_GX); prevY = *(float*)(inst + O_GY); printf("[BOOST] %s (%.0f)\n", g_BoostOn?"ON":"OFF", g_Boost); } if (GetAsyncKeyState(VK_NUMPAD8) & 1) { g_Boost += 5; if (g_Boost > 80) g_Boost = 80; printf("[SPD] %.0f\n", g_Boost); } if (GetAsyncKeyState(VK_NUMPAD2) & 1) { g_Boost -= 5; if (g_Boost < 5) g_Boost = 5; printf("[SPD] %.0f\n", g_Boost); } // Noclip guard if (g_WallhackOn && *(DWORD*)(inst + O_NOCLIP) != 1) *(DWORD*)(inst + O_NOCLIP) = 1; // Boost logic if (g_BoostOn) { float cx = *(float*)(inst + O_GX), cy = *(float*)(inst + O_GY); float ddx = cx-prevX, ddy = cy-prevY; if (sqrtf(ddx*ddx+ddy*ddy) > 2.f) { float rot = *(float*)(inst + O_ROT), rad = rot * 0.017453292f; float nx = cx + g_Boost*sinf(rad), ny = cy - g_Boost*cosf(rad); *(float*)(inst + O_GX) = nx; *(float*)(inst + O_GY) = ny; if (!g_WallhackOn) { DWORD now = GetTickCount(); if (now - lastPkt >= 200) { SendMove(nx, ny); lastPkt = now; } } prevX = nx; prevY = ny; } else { prevX = cx; prevY = cy; } } Sleep(10); } SetNoClip(false); PatchSendState(false); printf("[*] Ejecting...\n"); Sleep(200); if (f) fclose(f); FreeConsole(); FreeLibraryAndExitThread((HMODULE)hMod, 0); return 0; } BOOL APIENTRY DllMain(HMODULE h, DWORD r, LPVOID) { if (r == DLL_PROCESS_ATTACH) { DisableThreadLibraryCalls(h); CreateThread(NULL,0,MainThread,h,0,NULL); } return TRUE; }
bu kodu çalıştırdım fakat 2400'ün üzerindeyse yine geri atıyor dediğini yapmaya çalıştım fakat olmadı. Acaba bana gösterebileceğin veya yardımcı olabileceğini düşündüğün bir cpp kodu paylaşabilir misin?
Benzer konular
- Cevaplar
- 182
- Görüntüleme
- 14K
- Sabit
- Cevaplar
- 5
- Görüntüleme
- 5K
- Cevaplar
- 8
- Görüntüleme
- 3K
