[Release] Standalone Speedhack

[Skyechang]

sooo. anyone want to help me wtih my fkn problem. trying to help u guys make a fly hack. but no one answering my question

I think it will help to find the Z value of the actual ground, then setting it the value you want to fly at, after all the problem with flight at the moment is Z banding to the value of the ground.

Either that or there is a check for what Z you are at that jumps to a path that forces you to the value of the actual ground, which you could skip, remove or change depending on what you want. There are also Z Velocity values that let you reverse gravity that deserve some play ;3

I hope this helps you out!

[Parog]

mov edx,(float)0.0

I am trying to duplicate this fly hack. tried Z lock but does not really work. is there other places where Z coords are stored?

alright found another value that seems to work except that even when I freeze it something else constantly overwriting it and I end up slowly falling to the ground. what is this and how to figure out a solution?

Overwrite it faster. I'm not kidding.

Freeze overwrites the value, but at a certain rate. What you can do is overwrite the value faster without freezing it through ASM.

This will overwrite it every 10 ms because of the following 2 lines.

push 0a
call kernel32.Sleep


I've been using this for the last 2 weeks and been having a lot of fun. It works, but you will need to modify it unless you want to try setting the Z value manually to test it and then run off a cliff. It won't grab your current Z value, but I left comments to guide you on how to do that.

[enable]


alloc(ConstantlyWrite,1024)
label(StopWritingValueAndExitThread)
label(ScriptDisabled)
label(zLoc)
label(start)
registersymbol(ScriptDisabled)
registersymbol(zLoc)
createthread(ConstantlyWrite)


start:
....  // Script will start here, if you're scanning for an AoB do it here, or specify the address of the Float you want to modify. Replace the dots with your address or the AoBscan that will give that address. 



zLoc: //only to associate zLoc with the proper address from above


ConstantlyWrite:
push 0a
call kernel32.Sleep
cmp [ScriptDisabled],1
je StopWritingValueAndExitThread    //when script disabled, thread will exit




mov eax,zLock    //move address of zLock into register
cmp eax,0
je start
mov edx,(float)0.0    //value to write into another register. Change 0.0 to your value. You could also create a label for the current "currentZLoc" and pass it's value here. I'll let you do that though, this is enough spoon feeding. :) 
mov [eax],edx             //write value
jmp ConstantlyWrite    //loop forever until script disabled


StopWritingValueAndExitThread: //only reached when script is disabled
ret




ScriptDisabled:
dd 0




[disable]


ScriptDisabled:
dd 1

Enjoy. If this is over your head, well... I tried. This is the simplest solution I could give you.

[DirtyDirtyBoy]

Update to the CT file I posted, since the address changed as of the current patch:

<?xml version="1.0" encoding="utf-8"?>

<!-- Modified from Sharps' original code -->
<CheatTable CheatEngineTableVersion="19">
	<CheatEntries>
		<CheatEntry>
			<ID>0</ID>
			<Description>"GroundSpeed"</Description>
			<LastState Value="248" RealAddress="480CC2BC"/>
			<VariableType>Float</VariableType>
			<Address>"bsengine_Shipping.dll"+01FB95AC</Address>
			<Offsets>
				<Offset>2BC</Offset>
				<Offset>E0</Offset>
				<Offset>3B8</Offset>
				<Offset>4C</Offset>
				<Offset>0</Offset>
			</Offsets>
		</CheatEntry>
		<CheatEntry>
			<ID>1</ID>
			<Description>"BeforeDashingGroundSpeed"</Description>
			<LastState Value="248" RealAddress="480CC578"/>
			<VariableType>Float</VariableType>
			<Address>"bsengine_Shipping.dll"+01FB95AC</Address>
			<Offsets>
				<Offset>578</Offset>
				<Offset>E0</Offset>
				<Offset>3B8</Offset>
				<Offset>4C</Offset>
				<Offset>0</Offset>
			</Offsets>
		</CheatEntry>
	</CheatEntries>
	<UserdefinedSymbols/>
</CheatTable>

Now, two questions, for anyone who can answer them...

1) There's another address further down from the GroundSpeed that also shows user speed (offset by 1BD0, so if the first is 4D4FE2BC, then this unknown one is at 4D4FFE8C). Any idea what it controls?
2) Sharps originally posted a picture with adresses, values, and (more importantly to me) descriptions of each address in this post (GameGuard is no longer running.). Does anyone know how Sharps got the descriptions?

[jzapper]

Does it work now with GameGuard enabled?

[tule]

It says client is already running (3001) (183)

[zingpro234]

anyone got a video of the pighack flyhack from the actual users point of view ?