Guide Cube 2 Sauerbraten Hacks

[Rake]

Game Name

Sauerbraten

Anticheat

None

How long you been coding/hacking?

7 years

Coding Language

N/A

Cube 2 Sauerbraten can be considered as a successor to Assault Cube. Assault Cube used the Cube engine and Sauerbraten uses the Cube 2 Engine. Like Assault Cube it's a native C++ game that is fun to hack and it's source code is relatively easy to understand. For this reason it's a great game to learn game hacking on, and a number of GH members have chosen to make hacks for it to practice what they've been learning.

You can find the Sauerbraten source code here: Cube 2: Sauerbraten (game engine & FPS). Believe it or not, the last major release was 2013 but people are still updating the source code. The source code for Cube 1& 2 is honestly pretty cool if you want to learn 3d game programming.

Cube 2 is very similar to the Assault Cube source code, most tutorials and source codes for Assault Cube will also be helpful if you're working on Cube 2.

This guide, which was updated in 2020 should give you everything you need to get started making hacks for Sauerbraten, there are also posts following this one which also have good information.

Sauerbraten Offsets & Addresses

//General Info:
teamPtr = new GHPointer(moduleBase+0x216454,0x354);
healthPtr  = new GHPointer(moduleBase+0x216454,0x15c);

shieldOnePtr  = new GHPointer(moduleBase+0x216454,0x168);
shieldTwoPtr  = new GHPointer(moduleBase+0x216454,0x164);
shieldThreePtr  = new GHPointer(moduleBase+0x216454,0x160);

posXPtr = new GHPointer(moduleBase+0x216454,0x30);
posYPtr = new GHPointer(moduleBase+0x216454,0x34);
posZPtr = new GHPointer(moduleBase+0x216454,0x38);

rotXPtr = new GHPointer(moduleBase+0x216454, 0x40);
rotYPtr = new GHPointer(moduleBase+0x216454, 0x3c);

//Weapon Ammo:
chainSawAmmoPtr = new GHPointer(moduleBase+0x216454,0x178);
shotGunAmmoPtr = new GHPointer(moduleBase+0x216454,0x17C);
miniGunAmmoPtr = new GHPointer(moduleBase+0x216454,0x180);
rpgAmmoPtr = new GHPointer(moduleBase+0x216454,0x184);
huntingRifleAmmoPtr = new GHPointer(moduleBase+0x216454,0x188);
grenadeAmmoPtr = new GHPointer(moduleBase+0x216454,0x18C);
pistolAmmoPtr = new GHPointer(moduleBase+0x216454,0x190);

//Misc:
weaponCooldownPtr = new GHPointer(moduleBase+0x216454,0x174);
quadDamagePtr = new GHPointer(moduleBase+0x216454,0x16C);
isShooting = new GHPointer(moduleBase+0x216454,0x1E0);

Pistol Ammo: PlayerBase+0x190
Shotgun Ammo: PlayerBase+0x17C
Minigun Ammo: PlayerBase+0x180
RPG Ammo: PlayerBase+0x184
Rifle Ammo: PlayerBase+0x188
Grenade Ammo: PlayerBase+0x18C
Blue Amor: PlayerBase+0x164
Health: PlayerBase+0x15c
Speed: PlayerBase+0x48)
Quad Damage: PlayerBase+0x16c

#define ADDY_ENTITY_LIST         0x29CD34 // sauerbraten.exe
#define ADDY_LOCAL_PLAYER         0x2074A4 // sauerbraten.exe
#define ADDY_PLAYER_COUNT       0x29CD3C // sauerbraten.exe
#define ADDY_MATRIX             0x13E71C // sauerbraten.exe
#define ADDY_SCREEN               0x29C1E8 // sauerbraten.exe
#define ADDY_GAMEMODE             0x1E5C28 // sauerbraten.exe

Unlimited Ammo:
sauerbraten.exe+A7F18 - FF 8C 8E 78010000 - dec [esi+ecx*4+00000178]

HP Pointer:
sauerbraten.exe+27A710 +0 +340

Armor Pointer:
sauerbraten.exe+27A710 +0 +348

Fly Hack:
sauerbraten.exe+B4F94 - 89 46 38 - mov [esi+38],eax

Entity Class

class playerent
{
public:
    char pad_0x0000[0xC]; //0x0000
    float m_velocityX; //0x000C
    float m_velocityY; //0x0010
    float m_velocityZ; //0x0014
    char pad_0x0018[0x18]; //0x0018
    float m_posX; //0x0030
    float m_posY; //0x0034
    float m_posZ; //0x0038
    float m_yaw; //0x003C
    float m_pitch; //0x0040
    char pad_0x0044[0x118]; //0x0044
    __int32 m_health; //0x015C
    char pad_0x0160[0x4]; //0x0160
    __int32 m_armor; //0x0164
    char pad_0x0168[0x14]; //0x0168
    __int32 m_ammo_wp_1; //0x017C
    __int32 m_ammo_wp_2; //0x0180
    __int32 m_ammo_wp_3; //0x0184
    __int32 m_ammo_wp_4; //0x0188
    __int32 m_ammo_wp_5; //0x018C
    __int32 m_ammo_wp_6; //0x0190
    char pad_0x0194[0x20]; //0x0194
    __int32 m_id; //0x01B4
    char pad_0x01B8[0x28]; //0x01B8
    bool m_shooting; //0x01E0
    char pad_0x01E1[0x6F]; //0x01E1
    char m_name[16]; //0x1587888
    char pad_0x0260[0xF4]; //0x0260
    char m_team[4]; //0x1587888
};

struct entlist
{
    playerent* entities[128];
};

Traceline

typedef bool (__cdecl * tRaycubelos)(Vector& o, Vector& dest, Vector& hitpos);  // sauerbraten.exe + 0xEDB70

Sauerbraten Hacks

These are the best source codes for Sauerbraten hacks that we have available:
Source Code - C++ Internal Cube 2: Sauerbraten Aimbot (Simple)
Source Code - Shitty Cube 2: Sauerbraten Console C++ Trainer

Some other Sauerbraten resources
Source Code - Cube 2: Sauerbraten stuff
Source Code - Shitty Cube 2: Sauerbraten Console Trainer
Source Code - Cube 2: Sauerbraten - Simple Teleport Hack
Source Code - [WIP] Cube 2: Sauerbraten Aimbot
C# Sauerbraten x64 +7 Trainer + Source Code

Sauerbraten Hack Releases (no source code)
Download - Internal Cube2 : Sauerbraten Aimbot + ESP
Download - Cube 2: Sauerbraten Aimbot | Smoothing | FOV | Box ESP | (GoodGameSauer)
Download - Cube 2: Sauerbraten Cheat - Multi Hack
Download - Cube 2 Sauerbraten Teleport Hack
Download - Internal Cube 2: Sauerbraten Trainer

Java Hack Source Code by @Erarnitox
Source Code - Java Hacking Library (+ example Hack)

External Resources
jmagi98/Cube2InternalTrainer

Question Threads

Solved - How to make Sauerbraten Cheats - Cube 2 Trainer
Solved - Loop through Entities (Cube 2: Sauerbraten)
Solved - Cant write to static address
Solved - Help me with my 1st trainer ( Sauerbraten )
Solved - Can't attach Sauerbraten Cube 2 to Immunity Debugger
Solved - sauerbraten cube 2 health pointer cheat engine god mod

How to run Sauerbraten as x64

Overwrite sauerbraten.bat with this:

@ECHO OFF

set SAUER_BIN=bin

IF /I "%PROCESSOR_ARCHITECTURE%" == "amd64" (
    set SAUER_BIN=bin64
)
IF /I "%PROCESSOR_ARCHITEW6432%" == "amd64" (
    set SAUER_BIN=bin64
)

FOR /f "tokens=4-7 delims=[.] " %%i IN ('ver') DO (
    IF %%i==Version (
        set major_version=%%j
        set minor_version=%%k
        set patch_version=%%l
    ) ELSE (
        set major_version=%%i
        set minor_version=%%j
        set patch_version=%%k
    )
)

IF %major_version% GTR 10 (
    set SAUER_BIN=bin64
) else (
    IF %major_version% EQU 10 (
        IF %minor_version% GTR 0 (
            set SAUER_BIN=bin64
        ) else (
            IF %patch_version% GEQ 16299 (
                set SAUER_BIN=bin64
            )
        )
    )
)

start %SAUER_BIN%\sauerbraten.exe "-q$HOME\My Games\Sauerbraten" -glog.txt %*

Credits: @SystemX32 @Erarnitox @iPower

Continue reading for more info and offsets

 

[iPower]

Seeing @SystemX32 and @Erarnitox hacking this game made me want to hack it too. Here's some stuff I found in like 1 hour playing with this game.

======================================================================================================

RVAs

print_msg   -> 0x1668E0 (gonna explain how to use)
map_entlist_ptr  -> 0x17C841
rapid_fire   -> 0x18EE37 (NOP the instruction)
localplayer_ptr  -> 0x216454
num_map_ents   -> 0x29CD2C
num_players   -> 0x29CD3C
entlist_ptr   -> 0x29CD64

======================================================================================================

playerent class (used the same name as assaultcube) and entity list:

class playerent
{
public:
    char pad_0x0000[0xC]; //0x0000
    float m_velocityX; //0x000C
    float m_velocityY; //0x0010
    float m_velocityZ; //0x0014
    char pad_0x0018[0x18]; //0x0018
    float m_posX; //0x0030
    float m_posY; //0x0034
    float m_posZ; //0x0038
    float m_yaw; //0x003C
    float m_pitch; //0x0040
    char pad_0x0044[0x118]; //0x0044
    __int32 m_health; //0x015C
    char pad_0x0160[0x4]; //0x0160
    __int32 m_armor; //0x0164
    char pad_0x0168[0x14]; //0x0168
    __int32 m_ammo_wp_1; //0x017C
    __int32 m_ammo_wp_2; //0x0180
    __int32 m_ammo_wp_3; //0x0184
    __int32 m_ammo_wp_4; //0x0188
    __int32 m_ammo_wp_5; //0x018C
    __int32 m_ammo_wp_6; //0x0190
    char pad_0x0194[0x20]; //0x0194
    __int32 m_id; //0x01B4
    char pad_0x01B8[0x28]; //0x01B8
    bool m_shooting; //0x01E0
    char pad_0x01E1[0x6F]; //0x01E1
    char m_name[16]; //0x1587888
    char pad_0x0260[0xF4]; //0x0260
    char m_team[4]; //0x1587888
};

struct entlist
{
    playerent* entities[128];
};

======================================================================================================

mapent class:

class mapent
{
public:
    float m_posX; //0x0000
    float m_posY; //0x0004
    float m_posZ; //0x0008
    char pad_0x000C[0xA]; //0x000C
    __int8 m_id; //0x0016
    char pad_0x0017[0x1]; //0x0017
    bool m_spawned; //0x0018
};

======================================================================================================

Using print_msg

using f_printMsg = int(__cdecl*)(const char* format, const char* string1, const char* string2);

... your code...
f_printMsg printMsg = reinterpret_cast<f_printMsg>((uintptr_t)GetModuleHandle(nullptr) + 0x1668E0);

printMsg("Testing", nullptr, nullptr);

Going to update this when I get more time to hack this game.

 

[SystemX32]

=======================================================================================================
Typedefs
=======================================================================================================

typedef bool (__cdecl * tRaycubelos)      (Vector& o, Vector& dest, Vector& hitpos);    // sauerbraten.exe + 0xEDB70
typedef void (__cdecl * tToserver)        (char * text);    // sauerbraten.exe + 0x1979C0
typedef void (__cdecl * tsendservmsg)     (const char * s); // sauerbraten.exe + 0x19FE00
typedef void (__cdecl * tconoutf)         (int type, const char *fmt, ...);    // sauerbraten.exe + 0x166930
typedef void (__cdecl * tswitchname)      (const char * name);    // sauerbraten.exe + 0x196580

=======================================================================================================
Structs
=======================================================================================================

struct fpsstate
{
    int health, maxhealth;
    int armour, armourtype;
    int quadmillis;
    int gunselect, gunwait;
    int ammo[NUMGUNS];
    int aittype, skill;
};

struct physent
{
    vec o, vel, falling;
    vec deltapos, newpos;
    float yaw, pitch, roll;
    float maxspeed;
    int timeinair;
    float radius, eyeheight, aboveeye;
    float xradius, yradius, zmargin;
    vec floor;
    int inwater;
    bool jumping;
    char move, strafe;
    uchar physstate;
    uchar state, editstate;
    uchar type;
    uchar collidetype;
    bool blocked;
};

struct fpsent
{
    int weight;                 
    int clientnum, privilege, lastupdate, plag, ping;
    int lifesequence;       
    int respawned, suicided;
    int lastpain;
    int lastaction, lastattackgun;
    bool attacking;
    int attacksound, attackchan, idlesound, idlechan;
    int lasttaunt;
    int lastpickup, lastpickupmillis, lastbase, lastrepammo, flagpickup, tokens;
    vec lastcollect;
    int frags, flags, deaths, totaldamage, totalshots;
    char unknown01[0x20];
    char name[16];
    char unknown02[0xF4];
    byte team;
};

=======================================================================================================
Addresses
=======================================================================================================

#define ADDY_ENTITY_LIST         0x29CD34 // sauerbraten.exe
#define ADDY_LOCAL_PLAYER         0x2074A4 // sauerbraten.exe
#define ADDY_PLAYER_COUNT       0x29CD3C // sauerbraten.exe
#define ADDY_MATRIX             0x13E71C // sauerbraten.exe
#define ADDY_SCREEN               0x29C1E8 // sauerbraten.exe
#define ADDY_GAMEMODE             0x1E5C28 // sauerbraten.exe

=======================================================================================================
Enums
=======================================================================================================

enum
{
    GUN_FIST = 0,
    GUN_SG, GUN_CG,
    GUN_RL,
    GUN_RIFLE,
    GUN_GL,
    GUN_PISTOL,
    GUN_FIREBALL,
    GUN_ICEBALL,
    GUN_SLIMEBALL,
    GUN_BITE,
    GUN_BARREL,
    NUMGUNS
};

enum
{
    CS_ALIVE = 0,
    CS_DEAD,
    CS_SPAWNING,
    CS_LAGGED,
    CS_EDITING,
    CS_SPECTATOR
};

enum
{
    PHYS_FLOAT = 0,
    PHYS_FALL,
    PHYS_SLIDE,
    PHYS_SLOPE,
    PHYS_FLOOR,
    PHYS_STEP_UP,
    PHYS_STEP_DOWN,
    PHYS_BOUNCE
};

enum
{
    ENT_PLAYER = 0,
    ENT_AI,
    ENT_INANIMATE,
    ENT_CAMERA,
    ENT_BOUNCE
};

enum
{
    COLLIDE_AABB = 0,
    COLLIDE_OBB,
    COLLIDE_ELLIPSE
};

enum
{
    GOOD = 103,
    EVIL = 101
};

enum
{
    FFA,
    COOP_EDIT,
    TEAMPLAY,
    INSTAGIB,
    INSTAGIB_TEAM,
    EFFICIENCY,
    EFFICIENCY_TEAM,
    TACTICS,
    TACTICS_TEAM,
    CAPTURE,
    REGEN_CAPTURE,
    CTF,
    INSTA_CTF,
    EFFICIENCY_CTF,
    PROTECT,
    INSTA_PROTECT,
    EFFICIENCY_PROTECT,
    HOLD,
    INSTA_HOLD,
    EFFICIENCY_HOLD,
    COLLECT,
    INSTA_COLLECT,
    EFFICIENCY_COLLECT
};

=======================================================================================================
Other
=======================================================================================================

#define TEAMGAME(a)        (a == FFA      || a == INSTAGIB      || a == COOP_EDIT || a == EFFICIENCY    || a == TACTICS)                          ? false : true
#define INSTAGAME(a)    (a == INSTAGIB || a == INSTAGIB_TEAM || a == INSTA_CTF || a == INSTA_PROTECT || a == INSTA_HOLD || a == INSTA_COLLECT) ? true  : false

 

[Soulreaper93]

It's a multi-level pointer; Fleep discussed these in one of his tutorials and showed you how to get the the actual "Static" address.

Fleep: MultiLevel Pointers

 

[CyberDuck]

I've just watched this tutorial, but I was able to find the GREEN address already, but they still change their values after a reboot :/

Also, what is the correct offset here ??

I SUCCESSFULLY FOUND THE RIGHT POINTER OF THE HEALT!! I've done the same things that I've done with the ammo, but this time with healt it works ! (I've rebooted the game but the pointer still point to the healt value correctly )

I've just realized that the health pointer changed after some game reboots ((((

So *Green* addr can also be dynamic ?

I've tried other two games, and I was able to find the static address within minutes (Snake Deluxe and SuperTux), with that two games it was very easy..

Well I'll try again with sauerbraten and I'll try the pointer scanner

Thanks mates In the meantime I'm writing the C++ code to hack the other 2 games (supertux and snake deluxe) ... thanks for the help

You are welcome. Was the URL of the website sauerbraten.org correct?

Do you want to release the trainer? Which features do you want it to have?

Yes the link is correct. Well since I'm just learning, I'd like to freeze the ammo and the healt value for the moment

Also I need another hint:

In SuperTux I've this:

Now, I'm 100% sure that the STATIC address is: 0x004C26E8 but since I'm following the Fleep trainer tutorial I need the base address and the offset.
The offset looks like to be C26E8, but how can I calculate the base address ?
Since the ptr is supertux.exe+C26E8, I think that there is a fast way to calculate the base address.. sorry if this question is dumb

 

[Soulreaper93]

Sorry for the late response, was at work, what you might need to do is to retry and find the addresses and this time go a little further and see if it has more levels.

 

[Syperus]

You could also try using the pointer scanner. I've always preferred to do multilevel pointers by hand though. From the looks of your screenshot it looks like you either didn't look for a multilevel or yiu didn't go though enough levels of pointers. Keep going until you get your static address.

 

[jamesst20]

Hi,

I'm downloading the game right now, hopefully i'm downloading the right one (https://sauerbraten.org/) good URL? I will be looking for this tonight once I get back from school I will definitively try to find those static pointer and tell you how I figured out

 

[till0sch]

I will also take a look (I'm currently downloading it )

 

[till0sch]

Thanks mates In the meantime I'm writing the C++ code to hack the other 2 games (supertux and snake deluxe) ... thanks for the help

You are welcome. Was the URL of the website sauerbraten.org correct?

Do you want to release the trainer? Which features do you want it to have?

 

[till0sch]

Yes the link is correct. Well since I'm just learning, I'd like to freeze the ammo and the healt value for the moment


Also I need another hint:

In SuperTux I've this:


Now, I'm 100% sure that the STATIC address is: 0x004C26E8 but since I'm following the Fleep trainer tutorial I need the base address and the offset.
The offset looks like to be C26E8, but how can I calculate the base address ?
Since the ptr is supertux.exe+C26E8, I think that there is a fast way to calculate the base address.. sorry if this question is dumb

Since there is a "supertux.exe+C26E8" and the baseaddress is 0x400000 by default, your address is 0x004C26E8 actually..

And the question is not dumb

EDIT: Which programming language are you using?

 

[CyberDuck]

Damn, still doesn't work :/

Here is my code:

bool ScoreFreezeStatus;
BYTE ScoreValue[] ={0x0,0x0,0x0,0x0};
DWORD ScoreBaseAddress = {0x00400000};
DWORD ScoreOffsets[] = {0xC26E8};

But when I active it nothing changed.. it seems that I'm out of luck :/

 

[till0sch]

Damn, still doesn't work :/

Here is my code:


But when I active it nothing changed.. it seems that I'm out of luck :/

Oh you are coding C++?

You obviously didn't understand: 0x004C26E8 is already the address. No Pointer! It doesn't have offsets obviously - it's saved directly in 0x004C26E8 ..

 

[CyberDuck]

Edit: Ok it works

I've modified the source to write directly to that address and it works

Well.. tonight I'll try again with Sauerbraten

 

[till0sch]

Edit: Ok it works

I've modified the source to write directly to that address and it works

Well.. tonight I'll try again with Sauerbraten

Just installed the game.. Will take a look

 

[CyberDuck]

Just installed the game.. Will take a look

Okay many thanks, both for Sauerbraten and for the hint of the addr

 

[Syperus]

So *Green* addr can also be dynamic ?

I've tried other two games, and I was able to find the static address within minutes (Snake Deluxe and SuperTux), with that two games it was very easy..

Well I'll try again with sauerbraten and I'll try the pointer scanner

The Green addresses you see is cheat engine's best guess estimate that the address is static. Since it's a best guess estimate it is most likely a static address, but is not 100% guaranteed. If you see a "static address" that changes on game restart or reboot then it's not a static address. Cheat engine does an excellent job of determining static addresses, however nothing is 100% guaranteed.

 

[till0sch]

So I took a look now (I'm playing the newest x32 Sauerbraten, 1971712 Bytes)

Unlimited Ammo:
sauerbraten.exe+A7F18 - FF 8C 8E 78010000 - dec [esi+ecx*4+00000178]

HP Pointer:
sauerbraten.exe+27A710 +0 +340

Armor Pointer:
sauerbraten.exe+27A710 +0 +348

Fly Hack:
sauerbraten.exe+B4F94 - 89 46 38 - mov [esi+38],eax



I've got a wallhack, which stops drawing walls with just replacing 1 opcode but since this wasn't your goal I won't post it


Try them out and say me whether it works or not, please

 

[jamesst20]

So I took a look now (I'm playing the newest x32 Sauerbraten, 1971712 Bytes)

Unlimited Ammo:
sauerbraten.exe+A7F18 - FF 8C 8E 78010000 - dec [esi+ecx*4+00000178]

HP Pointer:
sauerbraten.exe+27A710 +0 +340

Armor Pointer:
sauerbraten.exe+27A710 +0 +348

Fly Hack:
sauerbraten.exe+B4F94 - 89 46 38 - mov [esi+38],eax



I've got a wallhack, which stops drawing walls with just replacing 1 opcode but since this wasn't your goal I won't post it


Try them out and say me whether it works or not, please

Just installed the game today and your ammo pointer isn't working for me. On my side it is

sauerbraten.exe+CB907 - 41 FF 8C 8C 9C010000 - dec [r12+rcx*4+0000019C]

Edit 2 : This game is really odd, even static pointers are different on other PCs

 

[Rake]

Here I hope that one of these works for you!

"sauerbraten.exe"+00297828 + 180

"sauerbraten.exe"+00297C40 + 180

"sauerbraten.exe"+003249A8 + 0 + 180

Here is a small list I got. I figured that other people could finish it off.

Health - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 180

Max Health - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 184

Armor - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 188

Shotgun Ammo - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 1a0

Machine Gun Ammo - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 1a4

Rocket Launcher Ammo - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 1a8

Hunting Rifle Ammo - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 1ac

Grenade Launcher Ammo - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 1b0

Pistol Ammo - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 1b4

Fire Delay - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 198

Auto Fire - Byte

"sauerbraten.exe"+003249A8 + 0 + 204

Number of Frags - 4 Bytes

"sauerbraten.exe"+003249A8 + 0 + 240

Change Weapon - Byte

"sauerbraten.exe"+003249A8 + 0 + 194

0 - Chainsaw
1 - Shotgun
2 - Machine Gun
3 - Rocket Launcher
4 - Hunting Rifle
5 - Grenade Launcher
6 - Pistol