p3n1
21st June 2005, 17:25
Now here it is, the first pb proof (hopefully) version of the ITC.
A FEW NOTES, EVERYBODY SHOULD READ:
- THIS HACK CAN LEAD TO HARDWARE/CD-KEY BANS IN ALL ACTUAL PB GAMES!!! PLEASE USE IT AT YOUR OWN RISK!
- YOU CAN GET TK'S LOCALLY, SO YOU'LL GET KICKED FOR THEM!
- IT SIMPLY CHANGES YOUR TEAM VAR LOCALLY, SO U CAN SEE THE ENEMIES ON MINIMAP AND THEIR NAMETAGS. B4 SPAWNING YOU NEED TO CHANGE IT BACK, BETTER B4 SHOOTING TOO!
- EDIT: I AM USING THIS FOR ABOUT TWO WEEKS NOW, I DO NOT CHANGE BACK TEAMS EXCEPT I CAN'T SPAWN AT MY *NORMAL* SPAWN POINT. SO I GET TEAMKILLS OVER AND OVER, MY NAME STANDS ON THE WRONG TEAM AFTER THE ROUND, BUT THATS ALL FINE, BECAUSE THE SERVER THINKS WHAT HE HAS TO THINK -> THAT I AM ON THE NORMAL TEAM AND DID'T TEAMKILL ANYBODY!!! BUT THERE ARE A FEW BUGS KNOWN:
- YOU HEAR THE SOUNDS OF THE OTHER TEAM
- YOU RECEIVE NO ENEMY SIGHTED OR OTHER TEAM MESSAGES FROM THE TEAM THE SERVER THINKS YOU'RE ON
- YOU CANNOT VOTE ON COMMANDER MUTINY VOTES
...
IT HAS NOT BEEN TESTED FOR THE FULL RETAIL BY MYSELF, SO I THINK THE FULL RETAIL WILL CRASH. THERE IS A ITC RETAIL FOR THE NO-CD VERSION, BUT THAT HAS NEVER BEEN TESTED ON MULTIPLAYER BY ME - PLEASE DON'T ASK ABOUT THAT *SPECIAL* VERSION, OR YOU WILL BE SOON ON MY INGNORE LIST!!!
ChangeLog:
June, 25th
-removed some bugs
-better hotkey recognition
-pb memory scan evasion
-EDIT: Now the hotkey is "+"/ADD on NUMBLOCK
June, 21st
-completly rewritten in delphi (40kb in size, can be upx'd to about 20kb)
-improved the injected code
-if trainer is closed, memory is realigned
-2 versions, one for the demo, one for the retail (read .nfo!)
note: if BF2 is closed and the trainer stays open, the "game not found" message appears 5 times, this is to be changed in the next version.
all previous versions have been deleted!
The only things i wanna read, are:
1) thx
2) detected by pb (with id if possible)
3) can i get the source?
ad 3)
Source isn't available any longer/ old Source below
now have phun, ch33taz!
Edit: the retail does not work, i don't know why, could be something with the offsets...
but i am working on it...
2nd EDIT: Now everything should work fine, even the retail version!
3rd EDIT: Maybe the retail doesn't work, had no time to test yet.
THE SOURCE OF 0.99 / DELPHI
program itc_demo;
{$APPTYPE CONSOLE}
// BF2 (demo) Instant Team Changer v0.99 by p3n1/2k5
// Source for all fellas @ MPC
// Don't give it away or use it for anything else than
// educational purposes!!!
//
// EasyWrite stuff:
// offset 010cff
// mov eax,[ecx+0xd8]
// push eax
// mov eax,ecx
// add eax,0d8h
// cmp byte ptr[010c10],1
// jne 010eff
// mov byte ptr[010c10],0
// cmp byte ptr[eax],1
// jne 010dff
// mov byte ptr[eax],2
// pop eax
// retn
//
// offset 010dff
// mov byte ptr[eax],1
// pop eax
// retn
//
// offset 010eff
// pop eax
// retn
//
// offset 0x55A8A0
// jmp 00010cff
//
// Poke Stuff
// POKE 10c10 00
// Poke 10CFF 8B 81 D8 00 00 00 50 8B C1 05 D8
// Poke 10D0A 00 00 00 82 3D 10 0C 01 00 01 0F
// Poke 10D15 85 E5 01 00 00 C6 05 10 0C 01 00
// Poke 10D20 00 82 38 01 0F 85 D5 00 00 00 C6
// Poke 10D2B 00 02 58 C3
// Poke 10DFF C6 00 01 58 C3
// Poke 10EFF 58 C3
// Poke 55A8A0 E9 5A 64 AB FF
//
// Trigger (Minus on NumLock)
// POKE 00010c10 01
//
uses
SysUtils,
Windows,
Messages;
var
s1,s2,s3:String;
counter:integer;
quit:boolean;
// This is a function to convert Strings to PAnsiChar - Delphi Sux
FUNCTION Str2PChar (VAR S : String) : PChar;
BEGIN
IF (S <> '')
THEN BEGIN
IF (S[Length(S)]<>#0) { It has to end with a zero byte... }
THEN S := S + #0;
END;
Str2PChar := @S[1];
END;
// This is the dialog box's message procedure.
procedure Poke(Address: Cardinal; Bytes: Array Of Byte);
var
hWin: hWnd;
ProcId: Cardinal;
hProc: THandle;
NBW: Cardinal;
begin
s1:='BF2 (v1.0.2446.12, pid: ';
s2:=')';
counter:=0;
repeat //brute-force the caption ;)
s3:=s1+inttostr(counter)+s2;
hWin:= FindWindow(nil,str2pchar(s3));
if not (hWin=0) then break; // break if found
inc (counter);
until (counter>99999); // maximum process id
if hWin = 0 then begin // If we cant find the window...
// Display "game not running" message.
MessageBox(0, 'The game is not running.', 'BF2 DEMO ITC v0.99 Error', MB_ICONERROR);
Exit; // Exit the <poke> procedure.
quit:=true;
end;
GetWindowThreadProcessId(hWin, @ProcId); // Get the game's process id.
hProc:= OpenProcess(PROCESS_ALL_ACCESS, False, ProcId); // Open the game process.
// Write to the game's memory!
WriteProcessMemory(hProc, Ptr(Address), @Bytes[0], Length(Bytes), NBW);
CloseHandle(hProc); // Close the game process handle.
end;
procedure DoTimer;
begin
// The line below checks if minus on numpad is pressed, then Poke the memory if it's been
// pressed.
If (GetAsyncKeyState(VK_SUBTRACT) and 1) = 1 Then Poke($10c10, [$01]); //send the ITC cmd ;)
end;
begin
quit:=false;
// write the Code Cave to BF2
Poke($10c10, [$00]);
Poke($10cff, [$8B, $81, $D8, $00, $00, $00, $50, $8B, $C1, $05, $D8]);
Poke($10d0a, [$00, $00, $00, $82, $3D, $10, $0C, $01, $00, $01, $0F]);
Poke($10d15, [$85, $E5, $01, $00, $00, $C6, $05, $10, $0C, $01, $00]);
Poke($10d20, [$00, $82, $38, $01, $0F, $85, $D5, $00, $00, $00, $C6]);
Poke($10d2b, [$00, $02, $58, $C3]);
Poke($10dff, [$C6, $00, $01, $58, $c3]);
Poke($10eff, [$58, $C3]);
Poke($55a8a0, [$E9, $5A, $64, $AB, $FF]);
SetTimer(0, 0, 250, @DoTimer); // Set the hotkey checking timer.
// Show the dialog box.
if not (quit) then begin // Wait for Hotkey
MessageBox(0, 'Game found!'+#13#10+'Use the Minus key on Numpad to Change Teams!'+#13#10+'Press OK to Quit.', 'BF2 DEMO ITC v0.99', MB_ICONERROR);
// Clear Up the Games Memory, after closing trainer
Poke($10c10, [$00]);
Poke($10cff, [$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00]);
Poke($10d0a, [$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00]);
Poke($10d15, [$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00]);
Poke($10d20, [$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00]);
Poke($10d2b, [$00, $00, $00, $00]);
Poke($10dff, [$00, $00, $00, $00, $00]);
Poke($10eff, [$00, $00]);
Poke($55a8a0, [$8B, $81, $D8, $00, $00, $00]);
end;
ExitProcess(hInstance); // Exit the program when the message box closes.
end.
A FEW NOTES, EVERYBODY SHOULD READ:
- THIS HACK CAN LEAD TO HARDWARE/CD-KEY BANS IN ALL ACTUAL PB GAMES!!! PLEASE USE IT AT YOUR OWN RISK!
- YOU CAN GET TK'S LOCALLY, SO YOU'LL GET KICKED FOR THEM!
- IT SIMPLY CHANGES YOUR TEAM VAR LOCALLY, SO U CAN SEE THE ENEMIES ON MINIMAP AND THEIR NAMETAGS. B4 SPAWNING YOU NEED TO CHANGE IT BACK, BETTER B4 SHOOTING TOO!
- EDIT: I AM USING THIS FOR ABOUT TWO WEEKS NOW, I DO NOT CHANGE BACK TEAMS EXCEPT I CAN'T SPAWN AT MY *NORMAL* SPAWN POINT. SO I GET TEAMKILLS OVER AND OVER, MY NAME STANDS ON THE WRONG TEAM AFTER THE ROUND, BUT THATS ALL FINE, BECAUSE THE SERVER THINKS WHAT HE HAS TO THINK -> THAT I AM ON THE NORMAL TEAM AND DID'T TEAMKILL ANYBODY!!! BUT THERE ARE A FEW BUGS KNOWN:
- YOU HEAR THE SOUNDS OF THE OTHER TEAM
- YOU RECEIVE NO ENEMY SIGHTED OR OTHER TEAM MESSAGES FROM THE TEAM THE SERVER THINKS YOU'RE ON
- YOU CANNOT VOTE ON COMMANDER MUTINY VOTES
...
IT HAS NOT BEEN TESTED FOR THE FULL RETAIL BY MYSELF, SO I THINK THE FULL RETAIL WILL CRASH. THERE IS A ITC RETAIL FOR THE NO-CD VERSION, BUT THAT HAS NEVER BEEN TESTED ON MULTIPLAYER BY ME - PLEASE DON'T ASK ABOUT THAT *SPECIAL* VERSION, OR YOU WILL BE SOON ON MY INGNORE LIST!!!
ChangeLog:
June, 25th
-removed some bugs
-better hotkey recognition
-pb memory scan evasion
-EDIT: Now the hotkey is "+"/ADD on NUMBLOCK
June, 21st
-completly rewritten in delphi (40kb in size, can be upx'd to about 20kb)
-improved the injected code
-if trainer is closed, memory is realigned
-2 versions, one for the demo, one for the retail (read .nfo!)
note: if BF2 is closed and the trainer stays open, the "game not found" message appears 5 times, this is to be changed in the next version.
all previous versions have been deleted!
The only things i wanna read, are:
1) thx
2) detected by pb (with id if possible)
3) can i get the source?
ad 3)
Source isn't available any longer/ old Source below
now have phun, ch33taz!
Edit: the retail does not work, i don't know why, could be something with the offsets...
but i am working on it...
2nd EDIT: Now everything should work fine, even the retail version!
3rd EDIT: Maybe the retail doesn't work, had no time to test yet.
THE SOURCE OF 0.99 / DELPHI
program itc_demo;
{$APPTYPE CONSOLE}
// BF2 (demo) Instant Team Changer v0.99 by p3n1/2k5
// Source for all fellas @ MPC
// Don't give it away or use it for anything else than
// educational purposes!!!
//
// EasyWrite stuff:
// offset 010cff
// mov eax,[ecx+0xd8]
// push eax
// mov eax,ecx
// add eax,0d8h
// cmp byte ptr[010c10],1
// jne 010eff
// mov byte ptr[010c10],0
// cmp byte ptr[eax],1
// jne 010dff
// mov byte ptr[eax],2
// pop eax
// retn
//
// offset 010dff
// mov byte ptr[eax],1
// pop eax
// retn
//
// offset 010eff
// pop eax
// retn
//
// offset 0x55A8A0
// jmp 00010cff
//
// Poke Stuff
// POKE 10c10 00
// Poke 10CFF 8B 81 D8 00 00 00 50 8B C1 05 D8
// Poke 10D0A 00 00 00 82 3D 10 0C 01 00 01 0F
// Poke 10D15 85 E5 01 00 00 C6 05 10 0C 01 00
// Poke 10D20 00 82 38 01 0F 85 D5 00 00 00 C6
// Poke 10D2B 00 02 58 C3
// Poke 10DFF C6 00 01 58 C3
// Poke 10EFF 58 C3
// Poke 55A8A0 E9 5A 64 AB FF
//
// Trigger (Minus on NumLock)
// POKE 00010c10 01
//
uses
SysUtils,
Windows,
Messages;
var
s1,s2,s3:String;
counter:integer;
quit:boolean;
// This is a function to convert Strings to PAnsiChar - Delphi Sux
FUNCTION Str2PChar (VAR S : String) : PChar;
BEGIN
IF (S <> '')
THEN BEGIN
IF (S[Length(S)]<>#0) { It has to end with a zero byte... }
THEN S := S + #0;
END;
Str2PChar := @S[1];
END;
// This is the dialog box's message procedure.
procedure Poke(Address: Cardinal; Bytes: Array Of Byte);
var
hWin: hWnd;
ProcId: Cardinal;
hProc: THandle;
NBW: Cardinal;
begin
s1:='BF2 (v1.0.2446.12, pid: ';
s2:=')';
counter:=0;
repeat //brute-force the caption ;)
s3:=s1+inttostr(counter)+s2;
hWin:= FindWindow(nil,str2pchar(s3));
if not (hWin=0) then break; // break if found
inc (counter);
until (counter>99999); // maximum process id
if hWin = 0 then begin // If we cant find the window...
// Display "game not running" message.
MessageBox(0, 'The game is not running.', 'BF2 DEMO ITC v0.99 Error', MB_ICONERROR);
Exit; // Exit the <poke> procedure.
quit:=true;
end;
GetWindowThreadProcessId(hWin, @ProcId); // Get the game's process id.
hProc:= OpenProcess(PROCESS_ALL_ACCESS, False, ProcId); // Open the game process.
// Write to the game's memory!
WriteProcessMemory(hProc, Ptr(Address), @Bytes[0], Length(Bytes), NBW);
CloseHandle(hProc); // Close the game process handle.
end;
procedure DoTimer;
begin
// The line below checks if minus on numpad is pressed, then Poke the memory if it's been
// pressed.
If (GetAsyncKeyState(VK_SUBTRACT) and 1) = 1 Then Poke($10c10, [$01]); //send the ITC cmd ;)
end;
begin
quit:=false;
// write the Code Cave to BF2
Poke($10c10, [$00]);
Poke($10cff, [$8B, $81, $D8, $00, $00, $00, $50, $8B, $C1, $05, $D8]);
Poke($10d0a, [$00, $00, $00, $82, $3D, $10, $0C, $01, $00, $01, $0F]);
Poke($10d15, [$85, $E5, $01, $00, $00, $C6, $05, $10, $0C, $01, $00]);
Poke($10d20, [$00, $82, $38, $01, $0F, $85, $D5, $00, $00, $00, $C6]);
Poke($10d2b, [$00, $02, $58, $C3]);
Poke($10dff, [$C6, $00, $01, $58, $c3]);
Poke($10eff, [$58, $C3]);
Poke($55a8a0, [$E9, $5A, $64, $AB, $FF]);
SetTimer(0, 0, 250, @DoTimer); // Set the hotkey checking timer.
// Show the dialog box.
if not (quit) then begin // Wait for Hotkey
MessageBox(0, 'Game found!'+#13#10+'Use the Minus key on Numpad to Change Teams!'+#13#10+'Press OK to Quit.', 'BF2 DEMO ITC v0.99', MB_ICONERROR);
// Clear Up the Games Memory, after closing trainer
Poke($10c10, [$00]);
Poke($10cff, [$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00]);
Poke($10d0a, [$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00]);
Poke($10d15, [$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00]);
Poke($10d20, [$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00]);
Poke($10d2b, [$00, $00, $00, $00]);
Poke($10dff, [$00, $00, $00, $00, $00]);
Poke($10eff, [$00, $00]);
Poke($55a8a0, [$8B, $81, $D8, $00, $00, $00]);
end;
ExitProcess(hInstance); // Exit the program when the message box closes.
end.