Aliens vs Predator 2010 (avp 3 / avp 2010) - hacks & hacking

[paraxxxito::]

nope, not for me. i took brightness address and substracted 10, nothing, but the contrast.
i use fraps too, but you need to compress the file, fraps makes uncompressed. i use camtasia for that purpose.
plz no further discussion about video or screenshot tools here.

yo sethioz just in case i know you gotta right but. you have to substract 10 from you actual brightness address to get the wireframe addy not sunstract 10 from you brightness address value

2C6DDD0 <-----------------------brightness addy
-10
2C6DDC0<------------------------wireframe addy

you also know you have the right addy cause when you change it from 1byte to float it automatically will display value 7

[Sethioz]

i definetly have wrong one, because my value is not 7 on float. it is something with 0.
i will test again today.
can you post all 3 values for that address ?
normal, heat and alien vision, i'll try to search it instead.

[T-R-O-N]

wow, this is all sooo cool stuff here, but on my computer works nothing.
I have windows 7 ultimate 64 Bit
8GB Ram
nvidia geforce gtx 285 with 2GB Ram
i have this version of the Game :
(steam version) not cracked, i have original purchase

http://www.bravenewgamer.com/wp-content ... 7x1024.jpg

and nothing Trainer works and this cool hacks from this site here works not.

I am so Sad

Sorry for Bad English

[Sethioz]

has nothing to do with having windows 7, game still works the same way. values are still values and they don't magically change. however there indeed is a difference between 32bit and 64bit FLOAT, but it doesn't matter.
you must have done something wrong.
DO NOT use some freehosting. use the attachment box for images.

here's something to make things easier for you guys, use olly and set the memory dump view to float > 32bit.

[T-R-O-N]

cool, the predator energy Hack works now perfect.

[Sethioz]

I took another look into brightness and visions with paraxxxito and it seems that memory mapping aint same. so scratch the -10 thing. only way is to search for it or go to that memory location and look for values.
i updated first post. its all there.

[PinPoint]

k heres a little tutorial on how to get ammo, clip size, spread and rate of fire without searching for values 1st.

have your game open and the pulse with 99 bullets in current clip.

open up t-search and open process AVP.exe.

next click on hex editor button in t-search. one open click on the little magnifying glass in the hex editor and make sure the value is on hex. copy and paste this:

Code: Select all

00 00 00 00 8F C2 F5 3D 88 C3 E4

into the find what box and hit find.

now the string you are looking at will be the pulse area.

now move up twice.(click the up arrow on the scroll bar 2 time)

now the top line should read like:

Code: Select all

001D83E9C0  00 00 C6 42 00 00 C6 42..blah!

keep this open and open up ollydbg and attach it to AVP.exe

now in the top left window right click/goto/ expression (or just push ctrl+G)
and in the box that appears type the address at the start of the line we got in t-search.

so in this case we would type 1D83E9C0 the click ok.

now the top line in the upper left window will be the address you. now right click that address and choose follow in dump/selection and now in the main bottom window you will see the memory stored at this address aswell as the corresponding addresses. including spread, rate of fire and ammo and clip size.

now you can edit the values here or you can use my edited hex string.


to use these have the dump view on HEX 16bytes and highlight from
00 00 C6 42 to 01 00 00 00

the 01 00 00 00 should be on the 6th line from the top in the 2nd section then right click and choose binary/edit and a box should appear. make sure keep size is not checked and delite the current hex string that is there and replace with what ever of these ones you want.



string for 0 spread, 300 rate of fire and LOTS of ammo(without needing to reload)

Code: Select all

28 6B 6E 4E  28 6B 6E 4E  85 F1 2C C9  00 00 00 00 
3A D1 0D A0  00 00 00 00  D2 A7 01 00  D2 A7 01 00 
00 00 00 00  8F C2 F5 3D  00 00 80 BF  A6 92 2B 3D 
CD CC CC 3D  00 00 C8 42  00 00 96 43  00 00 C0 3F 
00 00 80 3F  00 00 80 3F  00 00 00 00  01 00 00 00 
00 00 00 00  01 00 00 00

string for lots of spread, 300 rate of fire and LOTS of ammo (without needing to reload)

Code: Select all

28 6B 6E 4E  28 6B 6E 4E  85 F1 2C C9  00 00 00 00 
3A D1 0D A0  00 00 00 00  D2 A7 01 00  D2 A7 01 00 
00 00 00 00  8F C2 F5 3D  00 00 48 42  48 42 2B 3D 
CD CC CC 3D  00 00 C8 42  00 00 96 43  00 00 C0 3F 
00 00 80 3F  00 00 80 3F  00 00 00 00  01 00 00 00 
00 00 00 00  01 00 00 00

i will hopefully have a way with just ollydbg soon, but for now this is the only whay to do this i know of.
Olly doesnt let you scan whole of memory, only what is in the dump, so we cant just search for the 1st string of hex there. thats why we use t-search

[Sethioz]

you are on right track, but doesn't work.
your method is right, but the string you gave to search, is from middle of weapon and it exist more than once in the memory. i did found it, but wrong place. it was one of the ones that shows ammo, but won't freeze/change it.

also in olly you do not have to use edit, you can simply use "binary paste"

what i also noticed before, when you pasted it into my msn, is that our pulse's wasn't same at beginning, here's mine for comparizon. mine is default with 97 bullets, but it doesn't matter, because values are in FLOAT, not in bytes.

Code: Select all

00 00 C0 42 00 00 C6 42 85 F1 2C C9 00 00 00 00 3A D1 0D A0 00 00 00 00 D2 A7 01 00 D2 A7 01 00 00 00 00 00 8F C2 F5 3D 88 C3 E4 3A A6 92 2B 3D CD CC CC 3D 00 00 C8 42 00 00 20 41 00 00 C0 3F 00 00 80 3F 00 00 80 3F 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 B9 4A 95 E5 9A 99 19 3F 02 00 00 00 04 00 00 00 08 00 00 00 00 00 00 3F 9A 99 99 3F 00 00 80 3F 00 00 80 3F 00 00 00 00 03 00 00 00 00 00 00 00

UPDATE:
it doesn't really matter if its in float or not, because you can write float values in hex view too, even tho it says 00, if you put like 28 there, then it overwrites the float too.
my only problem was that i found wrong memory location.

[Sethioz]

ey guys, i came up with another brilliant idea, but honostly i can't be bothered myself.
here's some tips and awesome stuff. im using filemon to look what files does avp.exe accesses on my HDD. with this method you can find out where the info is stored, i mean in what file. you need to exclude the obvious files, like sounds and such, where the info is not stored. takes a while, but should give results.

procmon works fine too, think it might even be better, but in general its same.

[PinPoint]

it does work. well for me.

from start and from restarting checkpoints. and ive tried like 5 times each


just tried it in multi player haha it worked. tried in survivor and a species tdm

it was quite funny

[paraxxxito::]

Custom crosshairs

4bytes search

search value 1 with the weapon that has you favorite crosshair in my case flamethrower change to another weapon search 0 repeat the process until you get 6, 7 addys if you filter 4 times should be enough after you get right addy find breakpoint for it and make a hotkeys to nop and set it back to normal values
nop the full intruction not just the first byte or game will crash on you

[Sethioz]

@PinPoint: yes your method works and i was right. it occurs more than once in memory. i had to do 3 searches (i put the string into HEX and then i had to click that next mag glass twice to get to the right place). but it takes like 2-3 seconds. so fast enought.

Crosshairs:
yes it works as paraxxxito described, but here's explanation how it works and why it is so confusing.
game has one address for each weapon/crosshair.
1000 - pulse
2000 - pistol
3000 - shotgun
4000 - flamethrower
etc..
if you have shotgun out, then value on shotgun's address will be 1 and rest are 0. if you take out pistol, then value on pistol's address will be 1 and rest 0. this is why you have to search 1 and 0 on same weapon, depending on what crosshair you want. just follow what he said and you'll find it (1 on weapon's crosshair you want and 0 on others).
i updated first post too.

UPDATE:
you can disable crosshair permanently or get all of them at once (looks awesome)
check my first post, i updated it on how to do it, here's a shot of it :)
you can play around, like swap the crosshairs or change shotgun's crosshair to anything else you want, without effecting others. it is basics of debugging and using register, won't post about it here, its basically how you disable it and enable all of them.

msn_screenshot_397.jpg (20.42 KiB) Viewed 249654 times

[paraxxxito::]

this stream 00 00 C6 42 00 00 C6 42 appears twice in memory taking me to 2 addys when i replace the stream of them first one dont take effect the second
gave me some wack effect clip of pulse appears empty with 200 of total ammo remaining when i press the trigger the ammo dissapears [wrong memory location]


info
///////////////
related to visions i found a few interesting things and effects yesterday 1st i called clear visions cause basically thats what it its you wont see the opaque texture either on heat or alien vision also alien green color is removed too. 2nd one looks nice, changing the colors of alien skin while in alien vision mode heat vision got totally changed too showing darker heat colors i uploaded two videos showing the effects

<------------------------clear visions
<------------------------blue on bugs

search method
float value type
///////////////////
the search method is pretty much like the custom crosshairs first do a search of 1 while on heat vision mode the rest search 0 once you get a few addies 6,or 8
if you filter 5 times should be enought when right address located frezee it and change from value 1 to value 2 to get the dark blue and red colors on heat vision. the clear visions is obtained with the breakpoint of the address once you get the breakpoint make a hotkeys to set value from 16 to 17 or 18 after that no matter how hight you set it up you wont get any other effect too low will blind you, also dont nop it youll crash you game thats pretty much it folks!

[Sethioz]

fun part is that you can mix all those found things together and get weird effects. like bright black vision.
could use a vision that highlights predators, need to be done online. there's no place in SP where you can stand and look at the predator.

UPDATE:
since those vision addresses never change, you can search for alien vision too. after loading, quit..etc addresses are still same. im sure its possible to find the alien aura vision and also the wallhacked vision (alien).

[PinPoint]

in your screenshot of all the crosshairs mixed up. the smartgun one isnt there. so you think the smartgun crosshair IS the autoaim? so if you can use that crosshair on other guns youll have an aimbot?

[paraxxxito::]

in your screenshot of all the crosshairs mixed up. the smartgun one isnt there. so you think the smartgun crosshair IS the autoaim? so if you can use that crosshair on other guns youll have an aimbot?

negative crosshair uses 1 address wallhack uses another 1 and so on

[Sethioz]

Scratch that, totally messed up, NO, don't look at this post, look my next reply

as some of you already know, i made rate of fire work with a simple ASM script. ..well more or less. i can't make it come off. there's some "anomaly" in the code, which i couldn't figure out atm. in Tsearch use easywrite and put the following values there:

upper box

Code: Select all

offset 0x10F5D
mov dword ptr ds:[edi+48],0x43960000
ret
offset 0x7B7706
call 0x10F5D

bottom box

Code: Select all

offset 0x7B7706
hex F30F104748F30F5905F4E2A200

change addresses if they are not same.

//////////////////////////////////////////////////////////////////////////////////////

I also made ammo using ASM, which is better i think. it sets ammo to 999999 and freezes, when taken off, it goes to 99, because clip can't hold more than 99.
upper box

Code: Select all

offset 0x10FAD
mov DWORD PTR DS:[ECX+10],0x4CBEBC20
ret
offset 0x7AC572
call 0x10FAD

bottom box

Code: Select all

offset 0x7AC572
hex F30F114110

//////////////////////////////////////////////////////////////////////////////////////

PinPoint is right about not having that smartgun's crosshair in there. so value must be different. also predator's laser cannot be found in that way. 1 and 0.

[Sethioz]

ah im an idiot hehe :) you can use same adding method, by using the ammo's breakpoint as base.

this easywrite (asm) script will give you the following:
infinite ammo on 999999
no spread
rate of fire on 500

Code: Select all

offset 0x10FAD
mov DWORD PTR DS:[ECX+48],0x43FA0000
mov DWORD PTR DS:[ECX+10],0x4CBEBC20
mov DWORD PTR DS:[ECX+38],0x00000000
ret
offset 0x7AC572
call 0x10FAD

now i explain, so all of you guys can modify it for your likings

offset 0x7AC572 breakpoint of ammo
mov DWORD PTR DS:[ECX+10],0x4CBEBC20 - writes 999999 bullets into your clip and keeps it (writes every time you shoot).

now more details:

mov - moves the address
ECX+10 - this means that it takes the address in ECX register and adds 10 and gets into the ammo address.
so in order to get to the no spread, rate of fire or such, you need to do the same adding. put +38 to 10 to get rate of fire. so the line will be:
mov DWORD PTR DS:[ECX+48],0x43FA0000

its quite easy if you understand the point of it.


How to find out float values:
very easy, find empty place in game's memory.
add that address into cheat list under FLOAT, now change value to whatever you want to find out.
now refresh the memory location.

NOTE:
in hex, you will get reversed bytes. let me explain.
if you want to write 00 00 FA 43 to an address, you must reverse the bytes (not numbers). so it will look like this > 43 FA 00 00 (< this is what you put into easywrite).

[Sethioz]

whats eeeh :O ?

Code: Select all

removed :)

this overwrites any weapon with pulse, not the whole weapon, but most of it, just testing. wanted to get rapid fire for other weapons, but doesn't seem to be working.
however i like the super pistol, its like a damn desert eagle ! BOOM BOOM. one hit kills.
here, take a look :)
Desert Eagle

[Ritterkreuzträger]

Works. Btw PinPoints method worked too, but you have to found out your own string.
Since everybody started posting shit like crosshairs i want to make small addition too - there are a fire distance, can remember addy, but its 100 for M41A and 20 for flamethrower.
Edit: im not mentioned yet, but it seems like every weapons is using same breakpoint and ESI. After using Sethioz"s first code and small values editing, ive tested it. Its epic hellstorm, you can burn all the fucking map and spread napalm to every fucking hole on the map, thats awesome, even more awesome then barrel stuff in AvP2

[Sethioz]

you mean weapon range ?
but what is M41A ? it's used in other games, but not in avp. since im not idiot, im guessing you meant pulse rifle ?
float ? bytes ?
Nooblet, if you want to write your findings into a blog, like paraxxxito did, then open a blog on main page and PM me, i will link to it in the first post.

yes ppl, i updated first post and linked to paraxxxito's avp hacking blog. he will post his research and findings in there.


NOTE: you CAN replace a whole hex string using Tsearch, you simply need to know the address. easy write can do that. also the method i started to use, using ammo breakpoint as base, in this way you can overwrite whole weapons. just copy the specs from some other weapon, but keep in mind that hex view is reversed. you need to insert it backwards.
example"

00 11 22 33 88 77 44 55 < this is obviously 2 addresses on float, if you want to insert that using easy write, you need to do the following:
33221100
55447788
> im not talking about ASM in overall, it is avp specific. avp uses 4 byte float. it means that it allocates 4 bytes and uses float values there. so if you add first address on float, you will see the whole value on it.
actually 00 11 22 33 IS a float value, it just begins from RIGHT and goes to left.
you can use this calculator to get the values > IEEE-754 Floating-Point Conversion
value 2 in float would be 40000000 and in hew view it would be reversed, like so > 00 00 00 40
you don't reverse the value on byte, but just the bytes itself.

EDIT:
ah, thats what it was ! i found some value saying 100 for pulse, but i didn't know wtf it is, when i replaced my flamethrower with pulse, it gave huge range boost. so yeah, it works. i will modify my ASM code and make range 10000 for all weapons.

EDIT:
updated first post, it is +34 from ammo in clip and breakpoint function would be
mov DWORD PTR DS:[ECX+44],0x42C80000
which sets range to 100. as i said, i had it in my code already, just didn't know what it is. yesterday i tried to replace any weapon with pulse
461C4000 < 10000 in float, use this in ASM to get 10000 range.

[Sethioz]

done, ammo is flying everywhere once again, but i will keep it for use only for now, don't want any idiot like technological hatred stealing it again.
here's the demonstration of Ammo Type Hack

i tried to shoot discs or plasma, but its not happening on some reason. must be something else to it, however i successfully burned the bones out of paraxxxito, using predator. also when i tried to shoot nades with predator, i got a 'self destruct' instead of ammo lol. it like gets stuck into pred.
but "meteor shower" works perfectly.

i also found vectors per round, which is KICK ASS. and ofcourse server crash.

[Ritterkreuzträger]

May be a small hint? :3 Are they integers or not? And finally, are they related to weapon itself or takes from another weapon?

also when i tried to shoot nades with predator, i got a 'self destruct' instead of ammo lol. it like gets stuck into pred.

Have you tried to extend predators wirsblades fire distance\range?

[Sethioz]

stop being silly Nooblet, just ask me in msn.

i wasn't using wristblades, because it doesn't seem to be weapon at all, just like alien's claws and tail. well at least not this kind of weapons. i used predator's disc to shoot fire. it also gave nice effect, but im not sure if others saw it. i saw flames in every place where disc bounced from.

UPDATE
disc and spear works perfectly online, but in single player they have no visible spear/disc. just the impact effect, but it does kill even on single player.

[Sethioz]

> How to use Olly debugger and Tsearch and write ASM scripts <

This is an advanced hacking tutorial. shows you how to use olly to get the right breakpoint, because tsearch breaks in middle of function and makes chaos.
it also shows how lil time it took me to write a working unlimited ammo hack. you can use tsearch as your personal and customized trainer. this is why cheat engine sucks and tsearch rocks. you can turn tsearch into your customized trainer. you can even set a hotkey to select the active process. so you just keep tsearch open and launch game, then you just click your hotkey and your game is selected as process, then you just use the easy write hotkeys and get whatever you put there.

for example i have like over 10 scripts with my code, which i can use. it will put the following things on choice:
NUKE - ammo type set to grenades, vectors set to 50 and spread 0, makes a massive explosion
grenades shower - ammo type set to grenades, vectors on 2, fire rate on 200 and spread on 2. this makes grenades fly everywhere
super weapons v3 - ammo set to 999999 (including max ammo), vectors on 10, rate of fire on 50, spread on 2, ammo type set to sniper, weapon range set to 90000 (default for pulse is 100).
sharpshooter - ammo on 999999 ofcourse, vectors on 1, rate of fire on 50, spread on 0, range 90000
flamer - ammo type set to fire
discs - ammo type set to discs
spears - ammo type set to spears
first i choose which way i want to shoot them, then i press hotkey for the desired ammo type and have it :)

like made my pistol's primary shoot discs in wide area, secondary shoot grenades all over the place, then pulse shooting spears in one line (spread 0) and shotgun shooting nukes and spears as secondary.

all this takes me less than 10 seconds to setup.

[Sethioz]

paraxxxito found cloak. 1 cloaked and 0 decloaked on float. works perfect, but more insteresting is that if you mess with the breakpoints, you can make cloaked preds blink white, instead of cloak and unlocked preds turn white.

from all this, i basically know a way to cloak any character, but can't bother right now, maybe never. bored of this game.
im just not 100% sure how to do that in olly, what i need, is to execute instruction outside of a game, in olly for example.
if i can do that, i can force cloak on any character :)

UPDATE:
i successfully managed to disable and enable cloak permanently by editing avp.exe :) however it will result in an sudden crash during loading points.
it was just a test tho, but bad news is that you still need to execute the function.
if i can find the base, which tells the game that predator spawns uncloaked and then change it to cloaked, i would have predator cloaked all the time, most likely even on videos.
XMM5 instruction seem to enable it permanently after cloaking, it won't come off, no matter what. shoot, press uncloak or do a trophy kill, still stays on, but will crash in loading point.
however i know a way to make it cloaked and not crash, set the value to like 900000, because it is like energy or something, it takes a while to go off. i think that 1 = 1 second. i put it on 10 and it took around 10 seconds to run to 0 and then predator decloaked.

i could edit avp.exe and make it add 900000 instead of 1, hihi :)

[Ritterkreuzträger]

Steam won"t launch it if the file is bigger\smaller at least on 1 byte, thats means if you typing in smthng bigger then you have to remove smthng from the file. Or if you remove smtng, you have to add bytest to the file.

but more insteresting is that if you mess with the breakpoints, you can make cloaked preds blink white

Indeed. Ive found once an address and i was able to change color at all, but i thought its a client-side only.

[Sethioz]

i know about filesize, i am not editing exe with hex editor lol. im using olly to modify instructions.
this is why i don't write trainers, its annoying as a fly in your room who you can't just kill.
i was trying to make pred cloaked using easywrite and it fucked up all the times. Tsearch's easy write sucks compared to olly. it doesn't take like "movss" and it doesn't reconize xmm0, xmm1 ..etc either. it is so annoying.
in exe i just replaced xmm3 with xmm5 i think..or other way around. there's 4 offsets with that instruction.
xmm5 seem to be the value for predator's cloak ability.
xmm3 should be cloaked
xmm4 should be uncloaking function (when you press unclock)
xmm2 should be uncloaking with something else than button press, like firing a weapon.

those are just examples, don't belive this :) value sure is xmm something, but not sure about numbers. i was just testing, just to test if it has any effect.

obviously there's nobody who can tell me how to execute instruction inside of olly without using any game buttons. otherwise .. cloaked aliens and marines.
basically it seems that all characters are able to cloak, i would test this theory, but address changes every time i load, so i cant freeze it to 1 for marine.

other way is to totally beat DMA, but i have never done that, its more like for trainer makers and im not one of them. need to find where game loads the files, then find the right address based on that. im 100% sure that alien and marine can be cloaked just like that.

[Ritterkreuzträger]

basically it seems that all characters are able to cloak,

This shall work, because then i was trying things over cloak (i have not found it then, it was like 1 month ago) i have done a very, very buggy(its often crashed) and so i was able to shoot stuff in cloak, so then i did a trophykill to a marine his head became invisible in my hands :) Thats means game putting "cloak" texture over model like in previous games.

[Sethioz]

yes, precisly, but when i did trophykill, marine's head never became invisible.
i will write a script for always cloaked pred today.
instead of poking it or noppig the function, which will result in an crash, i will set it to high value, so it takes like hour to decloak :)

i also wrote a simple infinite ammo trainer, because im sure that all of the other trainers will crash the game. those noobs just can't test.
if somebody can bother. see if cheathappens moron have released one and test, if it will crash after a while or not. somehow i think that they have never tested it and they do not realize that it will crash the game after a while.

[paraxxxito::]

zup all heres another proof of this chaotic engine i found vision mode of sniper rifle scope as you will see on video and still cant see hightlighted enemies cause the stupid funtion is addressed somewhere else got another video on my blog of this vision in action dont know maybe helpful on dark maps and shit but since the entire fuction witch is wallhack is not included its useless to me research continues....

http://www.youtube.com/watch?v=Bu-p9UdFY1s

[TeamRetox]

xmm are floating point registers, they don't contain functions.

[Sethioz]

seems cool. just post them all into your blog. since it is linked in my first post, then there is no need for me to update first post all the time.
most likely this "wallhack" is located near visions and such in memory, but it takes long to find it out.
I don't really have interest in avp3 anymore, i got what i was after > ammo :) enought to bring hell.
im more than sure that you can make god mode too, more or less like it was in avp2.
if not god mode, then disable falling damage at least.

@TeamRetox: plz stop going offtopic, it has nothing to do with avp3 hacking. "movss [ecx+10],xmm1" < this is a instruction. and i was referring to whole instruction, not saying xmm1 is function. xmm1 is value, in float register it holds a value. stop posting useless shit. if you have anything to add that would actually help ppl to make hacks, then go ahead, but we dont need your "smartass" comments here.

[Ritterkreuzträger]

After today"s steam update i got VAC banned. Well, its not looks like VAC ban itself, more looks like it was a report. Because i was first in leaderboards for a week and wasnt even removed and owned epic bunch of servers. Anyways, i gonna steal someone"s account with AvP3 and use TR"s anti-VAC.

[Sethioz]

further VAC related things goes here > VAC [valve anti cheat on steam] - false positives
i will post my reply about this matter in there too.

just to make it 100% clear, TeamRetox's VAC disabler does NOT work. the part he does not realize is that if VAC can not access/load its modules, it will automatically ban you, by assuming that you hack/cheat.
we have tested it and result was BAN. if it would be that easy to fool VAC, i would have used process explorer to prevent VAC from loading. < no details here, NO MORE discussion about VAC here !!!

[Sethioz]

important update, avp now has VAC, but this does not mean you can't hack. VAC only seem to ban constant hacks, like aimbot.
i am not sure if VAC bans only for using Tsearch on game, but if not, then my hacks are undetectable. i only enable the script for 1 second or less, if VAC does not scan this specific part of memory at that moment, then you wont be banned. chances that it detects that exact change are like none to zero.
if i wont get banned in 1-2 weeks, i will play lil bit with my hacks and see if im right, i stole my game anyways, so who gives a shit if i get banned :)

[paraxxxito::]

in the same stack of addresses there is an addy that enables wallhack i posted a video into my blog also on 4 bytes theres another that enables it but works only on sniper rifle ill keep diggin cause something gotta come out from all this shit we really need an skin hack on bugs

[Sethioz]

several server crash exploits have been made by Luigi. everything is explained and available in wiki. take a look http://wiki.sethioz.com

UPDATE
fake players flooding have been made possible by Luigi. see wiki for details. you can use tcpfp to send joinpackets. i have included avp3joinpacket here, see wiki for tutorial.

[paraxxxito::]

yes thanks alot seth it worked i had to use a cave code finder tool looks like i needed more space where to inject code i replace the offsets with 52 bytes empty space and code injects nice and easy now

[paraxxxito::]

interesting vision values
/////////////////////////

i think i saw a video of seth with similar vision effects but just in case i tested and when you play with values u get almost every possible effect on marine vision even wireframe like texture

float value type
0.1800000072 Normal
0.25 Heat
0.6000000238 Alien

[Sethioz]

UPDATE

i have got few reports that most of the hacks doesn't work anymore, duo the updates of avp, but im sure there is a way around it. also i do not know if my ammo hack still works, im quite sure it does work, that all of the public hacks have been patched.
I can not test at this time, sry for that ppl. i will update my hacks as soon as i get a chance to go over them once again and test what works, what can be remade and what doesn't work.

[KEN]

I would have helped if i would b having that game.....regarding the ammo hack,they cant do much change for it so it must be working.

[Sethioz]

they can patch anything, it is not about chaning the game or the way it works, they can force the value and make it server side, that simple. just like they patched it in avp2 (not company, but those 3rd party patches). However this time i haven't released ammo hack, so we will see if it is patched or not.

if it's patched, it is because game developers are very well aware where it is located and they know exactly how to patch it, so they don't even need to read my tutorial to know which part to patch.

[Venik32]

I've got a question related to the work of ACM script, it looks like

offset 0x100D3
MOV DWORD PTR DS:[ECX+10],0x497423F0
MOV DWORD PTR DS:[ECX+14],0x497423F0
mov DWORD PTR DS:[ECX+48],0x43480000
mov DWORD PTR DS:[ECX+38],0x42480000
mov DWORD PTR DS:[ECX+44],0x461C4000
ret
offset 0x7AC702
call 0x100D3

offset 0x7AC702
hex F30F114110

before the last game update it worked, but now there is, I understand protecting ASProtekt and when start Ollydbg the address of rate and spread of blocking team

275FB5E0 F0:237449 F0 LOCK AND ESI,DWORD PTR DS:[ECX+ECX*2-10] ; LOCK prefix is not allowed

The same happens with the predator's energy and a short time the game quite simply crash



How can you bypass the system and if yes then please explain more in detail. THX.

[Sethioz]

interesting, however i am unable to check into that at this point.
i think they have added a simple edit protection, which can be bypassed by using a stealth memory editor.
read Resident Evil 5 hacks thread, because RE5 had also a check, which crashed the game after few mins with hacks.

for start, try changing any of those values using olly debugger and inside olly use Phant0m Plugin. if you enable right features in phantom, then it should be enought to bypass it. also you can try using one of the stealth memory editors, read my wiki for more info about UCE / stealth memory tools.
however this lock has nothing to do with game protection, it is prefix if you can read. you are making chaos :)

NOTE - DO NOT use image hostings, use attachments features on forum

[Venik32]

interesting, however i am unable to check into that at this point.
i think they have added a simple edit protection, which can be bypassed by using a stealth memory editor.
read Resident Evil 5 hacks thread, because RE5 had also a check, which crashed the game after few mins with hacks.

for start, try changing any of those values using olly debugger and inside olly use Phant0m Plugin. if you enable right features in phantom, then it should be enought to bypass it. also you can try using one of the stealth memory editors, read my wiki for more info about UCE / stealth memory tools.
however this lock has nothing to do with game protection, it is prefix if you can read. you are making chaos :)

NOTE - DO NOT use image hostings, use attachments features on forum

I put on ollydbg plugin phantom, configured it as a post for RE5, but alas, with subsequent editing by ollydbg is the same(

[Sethioz]

i didnt really focus on your post before, i thinked lil bit and realized that it has nothing to do with game having any protection. i did mention that it is prefix in olly, so it has to be some error in olly, which i have never seen before. so it is purely olly, whatever you did, you did it wrong. see my tutorials and guides about olly. i don't have many, but there are few, that teaches you how to breakpoint the addresses in olly. search olly either on wiki or in forum.

i can't even remember olly command from head, the one where you can change the function. i think its press space (assemble), you can always right click the function. you write there, what value you want to have and change it. if it works perfectly, then you can start writing ASM script, but bare in mind that VAC is enabled now and i don't think its enabled only in servers, because vac runs inside of steam.exe, im more than sure that it is active even if you are not inside of game. however it should not detect my trainer or any other self made trainer. name it like msnmsgr.exe (MSN messenger's process name).

[paraxxxito::]

most of the hacks works including infinity ammo breakpoint just changed from 7AC732 to 7AC682

Unlimited health works
Unlimited predator energy Patched!
Speed type works
Vision customizing works
Weapon customizing Patched!
Crosshairs works
Cloak works
See cloaked Predators works
Wallhack works
Auto Focus Mode works
Vision customizing 2 works
Ammo type Patched!
ammo type was not released to public by sethioz but its patched as well

[Sethioz]

what about ammo ? don't tell me that you forgot .. because it was private hack. it was obvious that they patch the rest, because those hacks made huge chaos online.

also are you 100% sure that you are looking into right place, maybe they changed something else, try in single player.

[Venik32]

what about ammo ? don't tell me that you forgot .. because it was private hack. it was obvious that they patch the rest, because those hacks made huge chaos online.

also are you 100% sure that you are looking into right place, maybe they changed something else, try in single player.

I think they introduced a dummy address to confuse, but rights is locked

1.jpg

(193.19 KiB) Downloaded 959 times

2.jpg

(191.21 KiB) Downloaded 959 times

These two photos taken at one time but the address (rounds, scatter, etc.) are located in different places and copying each other. In short solid haemorrhoids.