UnKnoWnCheaTs - Multiplayer Game Hacking and Cheats (https://www.unknowncheats.me/forum/index.php)
-   Escape from Tarkov (https://www.unknowncheats.me/forum/escape-from-tarkov/)
-   -   [Coding] Escape from Tarkov Reversal, Structs and Offsets (https://www.unknowncheats.me/forum/escape-from-tarkov/226519-escape-tarkov-reversal-structs-offsets.html)

pinefin 13th January 2022 02:22 AM

those of you internal people that are getting optic camera through the list have another more "stable" way of getting it

- \uE77A & \uE77B (you can find this really easily after the update)

Code:

// pseudo code

//this will return \uE77A (our "object" manager)
//(this will be static (does not change (you only need to get it once)) and no parameters need to be passed)
void* object_manager = \uE77A.get_Instance(); //i am calling this the "object" manager, idk what to call it
if (!object_manager) return false;

// this will return \uE77B
void* optic_camera_manager = \uE77A.get_OpticCameraManager(object_manager);
if (!optic_camera_manager) return false;

//this will return OpticSight
void* optic_sight = \uE77B.get_CurrentOpticSight(optic_camera_manager);
if (!optic_sight) return false; //this is our "aiming" check (I HAVENT DONE IN DEPTH RESEARCH BUT THIS WILL USUALLY WORK)

//this will return Camera
void* optic_camera = \uE77B.get_Camera(optic_camera_manager);
if (!optic_camera) return false;

//camera matrix = optic_camera + 0x10 ] 0x2E4 ]

//if you want to get the fov from here do Camera.get_fieldOfView(optic_camera);

you can probably remake this externally but if you're already getting objects from list theres no need to go and remake this fully.

you may also need some extra checks for if you're aiming but from what i've tested it works perfectly

vendeta228 13th January 2022 05:10 AM

tell me what's wrong I output the outputs the name is correct but the position does not show correctly
https://ibb.co/sHdCBFb
https://ibb.co/1Q1WwDk
https://ibb.co/Krdzb1c
https://ibb.co/WK1ZJPh
https://ibb.co/QChJRzM

ecthirune 13th January 2022 06:21 AM

Quote:

Originally Posted by niceone1 (Post 3343463)
This obfuscated class holds a table with the experience/level values.



Oh yea? I'll try to look. Thanks

EliteProducer 13th January 2022 12:17 PM

https://i.imgur.com/o61Fndw.png

Does anyone have any ideas as to why writing to _shotDirection is somewhat incorrect? ^

Here's a vid of what i mean: https://streamable.com/gak1si

cxtgirl 13th January 2022 12:38 PM

Quote:

Originally Posted by EliteProducer (Post 3343805)
https://i.imgur.com/o61Fndw.png

Does anyone have any ideas as to why writing to _shotDirection is somewhat incorrect? ^

Here's a vid of what i mean: https://streamable.com/gak1si

im pretty sure you have to set the direction of each shot individually

EliteProducer 13th January 2022 12:42 PM

Quote:

Originally Posted by cxtgirl (Post 3343815)
im pretty sure you have to set the direction of each shot individually

What in the world...
Is there a shotlist or something?

cxtgirl 13th January 2022 01:07 PM

Quote:

Originally Posted by EliteProducer (Post 3343819)
What in the world...
Is there a shotlist or something?

local game world -> ballistics calculator -> shots

EliteProducer 13th January 2022 01:35 PM

Quote:

Originally Posted by cxtgirl (Post 3343841)
local game world -> ballistics calculator -> shots

https://i.imgur.com/vmFUHDn.png

I put this together real quick, and it looks like writing to "[A8] Direction : Vec3" doesn't work.
Unless i'm doing something wrong?
In which case, could someone correct me?

Edit: It seems that the bullets direction is always 0 by default, aside from every 3rd bullet.

BukkyTheBaka 13th January 2022 01:36 PM

Quote:

Originally Posted by EliteProducer (Post 3343875)
https://i.imgur.com/vmFUHDn.png

I put this together real quick, and it looks like writing to "[A8] Direction : Vec3" doesn't work.
Unless i'm doing something wrong?
In which case, could someone correct me?

how about you check what you are doing wrong instead of begging help in here?

EliteProducer 13th January 2022 01:41 PM

Quote:

Originally Posted by BukkyTheBaka (Post 3343877)
how about you check what you are doing wrong instead of begging help in here?

Pretty sure this is the first time i've asked for anything on this thread in a few months. No need to be so rude.

IntPtr 13th January 2022 02:05 PM

Quote:

Originally Posted by pinefin (Post 3343545)
those of you internal people that are getting optic camera through the list have another more "stable" way of getting it

- \uE77A & \uE77B (you can find this really easily after the update)

Code:

// pseudo code

//this will return \uE77A (our "object" manager)
//(this will be static (does not change (you only need to get it once)) and no parameters need to be passed)
void* object_manager = \uE77A.get_Instance(); //i am calling this the "object" manager, idk what to call it
if (!object_manager) return false;

// this will return \uE77B
void* optic_camera_manager = \uE77A.get_OpticCameraManager(object_manager);
if (!optic_camera_manager) return false;

//this will return OpticSight
void* optic_sight = \uE77B.get_CurrentOpticSight(optic_camera_manager);
if (!optic_sight) return false; //this is our "aiming" check (I HAVENT DONE IN DEPTH RESEARCH BUT THIS WILL USUALLY WORK)

//this will return Camera
void* optic_camera = \uE77B.get_Camera(optic_camera_manager);
if (!optic_camera) return false;

//camera matrix = optic_camera + 0x10 ] 0x2E4 ]

//if you want to get the fov from here do Camera.get_fieldOfView(optic_camera);

you can probably remake this externally but if you're already getting objects from list theres no need to go and remake this fully.

you may also need some extra checks for if you're aiming but from what i've tested it works perfectly

You're using game's worldtoscreen aswell ?

pinefin 13th January 2022 02:22 PM

Quote:

Originally Posted by IntPtr (Post 3343901)
You're using game's worldtoscreen aswell ?

no, you will have to transpose.

cxtgirl 13th January 2022 03:55 PM

Quote:

Originally Posted by EliteProducer (Post 3343875)
https://i.imgur.com/vmFUHDn.png

I put this together real quick, and it looks like writing to "[A8] Direction : Vec3" doesn't work.
Unless i'm doing something wrong?
In which case, could someone correct me?

Edit: It seems that the bullets direction is always 0 by default, aside from every 3rd bullet.

seems correct to me but im not actually sure if its possible that way, just something i heard someone say before

Quote:

Originally Posted by BukkyTheBaka (Post 3343877)
how about you check what you are doing wrong instead of begging help in here?

no need to be rude hes not even doing anything wrong

Schokk2016 13th January 2022 07:05 PM

Guys, please help me figure out W2S, all the viewMatrix data is correct, I checked it in debugging, but the WorldToScreen function itself is not correct for some reason .. here is my code
Code:

bool WorldToScreenv2(Vector3 point3D, Vector2& point2D)
{
        Vector3 view_right = Vector3(viewMatrix._11, viewMatrix._12, viewMatrix._13);
        Vector3 view_up = Vector3(viewMatrix._21, viewMatrix._22, viewMatrix._23);
        Vector3 view_translation = Vector3(viewMatrix._41,viewMatrix._42,viewMatrix._43);



        Vector3 temp = point3D - view_translation;
        float x = temp.dot(view_right);
        float y = temp.dot(view_up);
        float z = temp.dot(view_translation) + viewMatrix._44;
 
        if (z < 0.1f)
                return false;

        point2D.x = ScreenSizeX / 2 * (1.f + (x / z));
        point2D.y = ScreenSizeY / 2  * (1.f - (y / z));

        return TRUE;
}

I will be glad for any information and code, thanks in advance, here is what happens with the given code
VIDEO - https://files.fm/f/v7mjfg9yk

numagomedov 13th January 2022 07:18 PM

Quote:

Originally Posted by EliteProducer (Post 3343875)
https://i.imgur.com/vmFUHDn.png

I put this together real quick, and it looks like writing to "[A8] Direction : Vec3" doesn't work.
Unless i'm doing something wrong?
In which case, could someone correct me?

Edit: It seems that the bullets direction is always 0 by default, aside from every 3rd bullet.

if it works every 3rd bullet, most likely your wpm speed is not good enough

Quote:

Originally Posted by vendeta228 (Post 3343608)
tell me what's wrong I output the outputs the name is correct but the position does not show correctly
https://ibb.co/sHdCBFb
https://ibb.co/1Q1WwDk
https://ibb.co/Krdzb1c
https://ibb.co/WK1ZJPh
https://ibb.co/QChJRzM

i have pretty much same issue, on some maps work fine on other don't, seem to be transform issue idk

oq1337 13th January 2022 08:17 PM

is there something wrong with my GetBoneLocation? my boxes draw nowhere near the player and are huge


Vector3 GetBoneLocation(uintptr_t entity_ptr, int bone)
{
auto body = memory::read<int64_t>(entity_ptr + 0xA8);
auto root = memory::read<int64_t>(body + 0x28);
auto bone_enum = memory::read<int64_t>(root + 0x28);

if (!bone_enum)
return Vector3(0, 0, 0);

auto transform = memory::read<int64_t>(bone_enum + 0x10);


if (!transform)
return Vector3(0, 0, 0);

uint64_t m_TransformA = memory::read<int64_t>(transform + 0x20 + (bone * 0x8));

if (!m_TransformA)
return Vector3(0, 0, 0);

return GetPosition(m_TransformA);
}

ecthirune 13th January 2022 08:30 PM

Quote:

Originally Posted by oq1337 (Post 3344200)
~

offsets looks good, transform is fucked, or w2s. Dig in that way.

Quote:

Originally Posted by Schokk2016 (Post 3344148)
~

compare your code with other w2s code presented here 100500 times. Use search button.

oq1337 13th January 2022 08:51 PM

Quote:

Originally Posted by ecthirune (Post 3344205)
offsets looks good, transform is fucked, or w2s. Dig in that way.


compare your code with other w2s code presented here 100500 times. Use search button.

its transform as my w2s is working fine

EliteProducer 13th January 2022 09:10 PM

Quote:

Originally Posted by numagomedov (Post 3344162)
if it works every 3rd bullet, most likely your wpm speed is not good enough

Nvm, turns out i was enumerating wrong.

But writing to it doesn't actually take any effect on the bullet.

oq1337 14th January 2022 01:58 AM

How does no recoil work now?


All times are GMT. The time now is 12:25 PM.
UnKnoWnCheaTs - Multiplayer Game Hacking and Cheats - [Coding] Escape from Tarkov Reversal, Structs and Offsets

UnKnoWnCheaTs - Multiplayer Game Hacking and Cheats (https://www.unknowncheats.me/forum/index.php)
-   Escape from Tarkov (https://www.unknowncheats.me/forum/escape-from-tarkov/)
-   -   [Coding] Escape from Tarkov Reversal, Structs and Offsets (https://www.unknowncheats.me/forum/escape-from-tarkov/226519-escape-tarkov-reversal-structs-offsets.html)

ZeusLord 14th January 2022 02:52 AM

Quote:

Originally Posted by oq1337 (Post 3344381)
How does no recoil work now?

Same way it always has you can change your mask in weapon anims and write the intensity to 0.

Artur1338 14th January 2022 12:40 PM

@oq1337
You will need to fix the mask and set the intensity of the shot effector to zero.
It's enough to set the mask to the default value.

Gesendet von meinem IN2013 mit Tapatalk

LoneSurvivor88 14th January 2022 02:39 PM

Question - I'm looking at my dump, and I'm trying to find out if there is a way to tell when a Player has exfil'd from the raid?

Artur1338 14th January 2022 02:43 PM

Do you when he has or when he is at the extract and the timer is ticking? Because then a player exfiled he gets removed from the array, as he isn't in the game any more.

Gesendet von meinem IN2013 mit Tapatalk

LoneSurvivor88 14th January 2022 02:52 PM

Quote:

Originally Posted by Artur1338 (Post 3344754)
Do you when he has or when he is at the extract and the timer is ticking? Because then a player exfiled he gets removed from the array, as he isn't in the game any more.

Gesendet von meinem IN2013 mit Tapatalk

I see that now. Thanks!

icetencer 14th January 2022 04:37 PM

Quote:

Originally Posted by BukkyTheBaka (Post 3343877)
how about you check what you are doing wrong instead of begging help in here?

who tf are you to speak lmaoo the poor guy has done nothing but help people out and the one time he needs help you attack him?? no wonder your in rep debt.

also begging?? you call that begging he didn't beg once LMAOO all he did was ask a few questions how about you go back to begging transvestites for code or even better keep paying them :laughing: shall we talk about bypass? your completely hysterical project :laughing: :laughing: :laughing: you spent more money on code than the business made in profit correct me if I'm wrong( I'm not :) )
goodbye uc from icetencer account number 5 of mine this account will now be banned perm if you ever wanna chat here's my discord damien#6019

johngus 14th January 2022 06:36 PM

Hello, I'm just getting into my first external and managed to do some simple things.

My question is, can skills be modified in online game, and if so is it the skill or the buffs provided by the skill that need to be modified ?

oq1337 14th January 2022 06:39 PM

Quote:

Originally Posted by johngus (Post 3344923)
Hello, I'm just getting into my first external and managed to do some simple things.

My question is, can skills be modified in online game, and if so is it the skill or the buffs provided by the skill that need to be modified ?

Skills are serversided now you can modify the buffs tho to some extent.
in short you cant modify skills but you can modify the buffs that are provided by skills (sound sstupid righ?)

ecthirune 14th January 2022 06:54 PM

Quote:

Originally Posted by johngus (Post 3344923)
Hello, I'm just getting into my first external and managed to do some simple things.

My question is, can skills be modified in online game, and if so is it the skill or the buffs provided by the skill that need to be modified ?

Quote:

Originally Posted by oq1337 (Post 3344924)
Skills are serversided now you can modify the buffs tho to some extent.
in short you cant modify skills but you can modify the buffs that are provided by skills (sound sstupid righ?)

my 2 cents here:
and not every buff can be modified.. Strenght->jump height can be modified for free, but it's still has server side checks, and doin too high jumps with overweight(or without whatever) will cause to rubberband.
Also some of that buffs doesn't work at all, let's say "instant search" can't be activated externally as far i know.

johngus 14th January 2022 07:30 PM

Understood, just not going to waste my time with it yet then. I'll do fun stuff first

24jared24 14th January 2022 08:05 PM

Quote:

Originally Posted by johngus (Post 3344984)
Understood, just not going to waste my time with it yet then. I'll do fun stuff first

Wouldn't say it's a waste of time. You can change plenty enough stuff to make your character basically a cyborg. And mag load/unload speed and double search are just like huge QOL features

bhehe6813 14th January 2022 08:27 PM

Quote:

Originally Posted by 24jared24 (Post 3345022)
Wouldn't say it's a waste of time. You can change plenty enough stuff to make your character basically a cyborg. And mag load/unload speed and double search are just like huge QOL features


"mag load/unload speed" This causes irrecoverable desync (Bot reload skill tweaking) that is. I've removed it for my cheat.


Unless you mean loading the magazine with bullets / removing the bullets. That works fine, and that one is the mag drills skill.


For reload, instead I just increase timescale while the user is reloading:

Code:

        public static byte[] ReloadingName = new byte[5]
        {
            0xEE, 0x80, 0x9A, 0x00, 0x6D // must be updated each patch most likely
        };
        [StructLayout(LayoutKind.Explicit)]
        public struct AbstractHandsController
        {
            [FieldOffset(0x60)] public IntPtr pItemInHands;
            [FieldOffset(0xE8)] public IntPtr pFirePortTransformWrapper;
            [FieldOffset(0x88)]
            public IntPtr pCurrentOperation;

            public SomeWrapper SomeWrapper => M.Read<SomeWrapper>(this.pFirePortTransformWrapper);
            public Operation CurrentOperation => M.Read<Operation>(pCurrentOperation);
        }

Check to see if the class name of the current operation (in the handscontroller) has those same 5 bytes (its an obfuscated name).

johngus 14th January 2022 08:46 PM

Thanks for the input guys, I'll have to go ahead and implement that since I let does sound nice to have

24jared24 15th January 2022 03:54 AM

Quote:

Originally Posted by hollow (Post 3320901)
inertia is annoying, isn't it? let's disable it :)

most of the settings are stored in a static instance of this class:
https://i.imgur.com/RxH2UDN.png

how do we find the instance? sigscanning, of course!
Code:

inertia = (inertia_settings*)utils::find_mono_class_inst({ 0xCD, 0xCC, 0xCC, 0x3E, 0xC3, 0xF5, 0x88, 0x3F, 0x9A, 0x99, 0x99, 0x3E, 0xA4, 0x70, 0x9D, 0x3F, 0x00, 0x00, 0x00, 0x00, 0x9A, 0x99, 0x99, 0x3E, 0x00, 0x00, 0x80, 0x3F, 0xCD, 0xCC, 0xCC, 0x3D }, -0x4C);
"CD CC CC 3E C3 F5 88 3F 9A 99 99 3E A4 70 9D 3F 00 00 00 00 9A 99 99 3E 00 00 80 3F CD CC CC 3D" - 0x4C will lead you to the beginning of the class.

but there's a slight problem: collisions with data that is most definitely not a mono instance of the class. how do we deal with that? try to get class name!
class + 0 ] + 0 ] + 0x48 ] will give you a pointer to the class name. what you have to do is check if the pointers are valid. class name pointer is valid? great, we have the actual class!

after that, we can just set the following values to remove most of inertia garbage:
Code:

MoveTime = 0
MinDirectionBlendTime = 0
PenaltyPower = 0
BaseJumpPenalty = 0
DurationPower = 0
BaseJumpPenaltyDuration = 0
FallThreshold = 99999


Is this sig broken? Can't seem to find it... If so could you briefly explain how you found the sig in the first place?

Superseb123abc 15th January 2022 04:00 AM

Quote:

Originally Posted by hollow (Post 3320901)
inertia is annoying, isn't it? let's disable it :)

most of the settings are stored in a static instance of this class:
https://i.imgur.com/RxH2UDN.png

how do we find the instance? sigscanning, of course!
Code:

inertia = (inertia_settings*)utils::find_mono_class_inst({ 0xCD, 0xCC, 0xCC, 0x3E, 0xC3, 0xF5, 0x88, 0x3F, 0x9A, 0x99, 0x99, 0x3E, 0xA4, 0x70, 0x9D, 0x3F, 0x00, 0x00, 0x00, 0x00, 0x9A, 0x99, 0x99, 0x3E, 0x00, 0x00, 0x80, 0x3F, 0xCD, 0xCC, 0xCC, 0x3D }, -0x4C);
"CD CC CC 3E C3 F5 88 3F 9A 99 99 3E A4 70 9D 3F 00 00 00 00 9A 99 99 3E 00 00 80 3F CD CC CC 3D" - 0x4C will lead you to the beginning of the class.

but there's a slight problem: collisions with data that is most definitely not a mono instance of the class. how do we deal with that? try to get class name!
class + 0 ] + 0 ] + 0x48 ] will give you a pointer to the class name. what you have to do is check if the pointers are valid. class name pointer is valid? great, we have the actual class!

after that, we can just set the following values to remove most of inertia garbage:
Code:

MoveTime = 0
MinDirectionBlendTime = 0
PenaltyPower = 0
BaseJumpPenalty = 0
DurationPower = 0
BaseJumpPenaltyDuration = 0
FallThreshold = 99999


Why do you do all of this with the signature and subtracting from it?
There is a singleton for a reason, you can simply get the class of both the Singleton instance and the class instance (I find it by searching for a class that contains the method 'UpdateTradersSettings'), and then inflating it.
Then you can just grab the 'Instance' field from the list of statics inside of the 'vtable', then you're inside of the class.

zerohelix 15th January 2022 04:53 AM

Quote:

Originally Posted by Superseb123abc (Post 3345292)
Why do you do all of this with the signature and subtracting from it?
There is a singleton for a reason, you can simply get the class of both the Singleton instance and the class instance (I find it by searching for a class that contains the method 'UpdateTradersSettings'), and then inflating it.
Then you can just grab the 'Instance' field from the list of statics inside of the 'vtable', then you're inside of the class.

It can be found even easier. MainApplication (Parent ClientApplication) -> _backEnd -> \uE00B -> BackEndConfig -> Config -> Inertia. (MainApplication can be found in tagged GameObject "Application (Main Client)".

pinefin 15th January 2022 05:34 AM

Quote:

Originally Posted by Superseb123abc (Post 3345292)
Why do you do all of this with the signature and subtracting from it?
There is a singleton for a reason, you can simply get the class of both the Singleton instance and the class instance (I find it by searching for a class that contains the method 'UpdateTradersSettings'), and then inflating it.
Then you can just grab the 'Instance' field from the list of statics inside of the 'vtable', then you're inside of the class.

its at
Code:

\uE62A.get_InertiaSettings()
for internal people

vZnu 15th January 2022 10:06 AM

Quote:

Originally Posted by Superseb123abc (Post 3345292)
Why do you do all of this with the signature and subtracting from it?
There is a singleton for a reason, you can simply get the class of both the Singleton instance and the class instance (I find it by searching for a class that contains the method 'UpdateTradersSettings'), and then inflating it.
Then you can just grab the 'Instance' field from the list of statics inside of the 'vtable', then you're inside of the class.

he is external

tctno1 15th January 2022 11:57 AM

https://i.imgur.com/Y8mDVvt.jpg
Does anyone know how to fix a ghost container? I don't know if this is duplicated or not. I am using the vector3 coordinates along the chain of 0x30 0x38 0x38 0x90. Is there a way to filter this out?


All times are GMT. The time now is 12:25 PM.