Solved Blacklight Retribution (Not requesting hack)

[mepath]

Hey guys!

Has anyone else here hacked BLR? I've made some discoveries, but I'm not sure if they're true or not. I'm also having a hard time debugging as well.

Memory Addresses

First, I discovered that BLR's ammo, and health offsets CHANGE with EVERY MAP! My offsets work for the trainer map.
Secondly, using same methods on the multi-player map fails. I'm thinking the reason behind this is due to some sort of communal check. Other players probably have data on how much ammo I'm carrying, health, and etc, so when I change the value to something that isn't something they have, then their value takes precedence.

OllyDBG

I've used the values for the primary gun ammo display to determine the instruction memory location, to be used for OllyDBG. I've successfully arrived at a section that I assume to be in charge of drawing stuff. I'm trying to get to recoil, more nifty things, but I'm having difficult.

Ultimate Goal

1. I'm hoping to find the health, so I can find the struct responsible for the player class, and see if I can alter the speed, to grab the x,y,z player coords, and mouse x,y coords, but I feel like I've reached some sort of dead-end.
2. I'm also doing OllyDBG in hopes that maybe I can implement no recoil, but the only function I got was the drawing one. How would I get from the drawing function to the no recoil function?

Solutions will be great, but I'll take hints as well. I've spent more time hacking the game than I've spent playing it. Also, I'm more than happy to share the offsets I've obtained.

Thanks in Advance.

P.S. Feel free to change the thread title to a more descriptive name. I think "BLR - Hacking Assistance" might be better suited.

 

[Crazywink]

As far as your first problem, odds are that information is stored by the host of the game, whether that is a player or a dedicated server they have set up.

I usually don't use OllyDBG for things like no recoil and such, although you can. If you get your struct with your ammo and other features of your gun, you can often find your recoil by watching numbers that change when you shoot.

Your problem is you just need more practice and experience, do the tutorials
https://guidedhacking.com/starthere

 

[mepath]

It turns out that the addresses only change for two mode one is training, and the other is online. So I've successfully frozen the address and essentially found other addresses relating to the gun, such as the bullets shot counter. Freezing this value allows me to have infinite ammo. Unfortunately, after a period of time, BLR locks up. I can probably address this by nopping the assembly function at various places. Still... couldn't find no recoil.

At this point, I pretty much gave up on it. I've also been trying to find the x, y, z coordinates as well, spending hours moving left, checking value, moving right, checking value and etc. Still couldn't find it. Maybe it's because I'm in training mode, or maybe the value isn't available... I don't know. I do recall one of the tutorials I didn't feel like I was ready for yet, covering the topic of how chams and wallhacks work. How it's a man-in-the-middle interception of what the game sends the video card. I recalled that a lot info is sent. I'm thinking maybe the x,y,z coordinates, and enemy addresses would be easier to obtain, once I figure out via that route.

Thoughts?

 

[mepath]

I've found the player x,y,z coordinates. It turns out that the x,y coordinates are really hard to find, and it's easiest to focus on the z-coordinate first. The z-coordinate is also stored as a 4 byte value, while the x, and y are stored as floats. I've also confirmed that the values for the offline training map, and the online multiplayer maps have different value. Soon, I'll be using the coordinates, and health to figure out the damage function, and use that to find coordinates. Wish me luck.

Also, I learned that chams and enemy addresses don't have much to do with each other. That being said, I do have a working cham now

 

[xploiitz]

I wonder why Z is 4bytes and X Y are floats... doesnt make sense hmm. are they still near each other in memory atleast?