Map Hack

[blah1970]

I thought I'd have a look at the map hack for bf2, not worried about the tags I find them distracting in bfv (plus the hassle to make it look like your not hacking lol). Anyways I did the same as bfv, used tsearch and search for 1-MEC 2-USMC, I got down to the address that changes the teams. Then I set a breakpoint on it, funny tho I only get 2 address (one straight away, the other after I change teams), so I figure I'll nop to find the address I need to jump and bang bf2 crashes back to desktop.
I know I have the right team addy but I cant find the addy to nop and therefore set up my hack. I though this would be a peice of piss but I've tried this a few times with no success. Cheers all!

[xollox]

This has been discussed quite a bit. Read the other threads.

Hint: GetTeam()

[caliber1942]

This has been discussed quite a bit. Read the other threads.

Hint: GetTeam()

xollox, can you check the other thread and see if i am heading in the right direction or perhaps pm me more hints if possible regarding the minimap. i think i am going in the right direction but i usually don't have this much trouble....

best,
cal

[blah1970]

This has been discussed quite a bit. Read the other threads.

Hint: GetTeam()

Thanks, I have read the other threads including that one, I was wondering why everyone was going into these insane detailed verses about what they were doing. The reason I posted this is because in my search I noticed caliber had got the map hack working using the same technique I explained, therefore I was wondering if there was something I was overlooking. Even to have a map hack that only shows the enemy (without teamswap, which everyone can tell your hackin!) would be a level above where I'm at.

[xollox]

The basic premise:
The code that draws the minimap calls the GetTeam function twice (one of the addresses you found that reads your team number)
It then CMPares the two together, and draws (or not) accordingly.

What you need to do:
Find out what addresses are calling GetTeam.
Look for suspicious conditional jumps shortly after they are called.
NOP or set conditional jump to JMP.

Check the "insane detailed verses" for more info (:

[blah1970]

LMAO, why didnt anyone say that before......
I will check it out, thanks for the reply.
;)

[caliber1942]

xollox,

i think it makes a difference for the MINIMAP if you have to NOP, reverse the conditional jump, or make it into a JMP. which is it?

for the tags, you hade to make a JE into a JMP. later in the code for tags, you had to change a JE to JNZ (or vice versa i forget).

anyways, maybe this is what i have been doing wrong all this time. i assumed i had to NOP a conditional jump (JE or JNZ) but maybe i am supposed to be NOP'ping a JMP or maybe changing the conditional to a JMP or reversing the conditional (JE to JNZ or vice versa).

Sorry this has taken so long, but i think i was going about this with the understanding of NOP'pin a conditional...

thanks for the help-
best,
cal

[xollox]

I don't remember off the top of my head...but what I did is BP in Olly after the second GetTeam() call and step through until the CMP. See what it's CMParing (should be 1 to 2, 2 to 2, something like that.) Step again to see what the conditional jump does. Make it always do whatever it does when it CMPares the same team value.

For example, if when it CMPares 2 to 2, it jumps, change the conditional jump to a jump. If when if CMPares 2 to 2, it doesn't jump, NOP the conditional jump.

There are 2 places to edit...one for infantry, one for vehicles. If I remember correctly (which I might not...) the infantry hack is a NOP, the vehicle hack is a conditional jump -> JMP. Don't take my word on that one though, just follow the logic (:

[caliber1942]

thanks.... this is what i have been trying to weed out. also, it seems there are several (more than two) places that need this done, is this correct? or did you just change two lines of code total (for inf. for veh.)?

thanks-
cal-

[xollox]

I'm pretty sure it's just 2 lines, one for each.

If you have aim or msn messenger, feel free to drop me a line and we can chat. AIM name is in my profile, MSN available upon request (:

[caliber1942]

i can't believe i am either this stupid or can't see what i am doing.... i have tried changing the jumps after the compares for all of the following addresses:

71fad5
71fae1

718011
71801d

717FEB
717FF7

71f8bc
7178c8

7182a0
7182ac

718275
718282

71fa9c
71fab3

71fa9c

in various ways and fashions after following the code, and etc. unfortunately i haven't seen one red dot on the minimap show up. i did tags rather easily. i just can't understand why i can't get this. i am obviously not changin the correct code, but i cannot see why. is the code for showing inf. and veh. on the minimap in fact near the above addressses (one of them)? can someone please PM the code changes to make this work so i can see wtf i am doing wrong. i have spent literally hours and hours with just this one thing. it was so freaking easy with bf and bfv, i cannot understand why i am having such a problem...

xollox and everyone i appreciate the help but if i could get the answer maybe i can work my way to it and see what i did wrong. i did find these addresses by breakpointing and etc.. just can't believe that this is this hard. maybe i am in the wrong place altogether.

struggling,
cal-

[chilli]

caliber how did you get those addresses?

[xollox]

caliber how did you get those addresses?
The basic premise:
The code that draws the minimap calls the GetTeam function twice (one of the addresses you found that reads your team number)
It then CMPares the two together, and draws (or not) accordingly.

What you need to do:
Find out what addresses are calling GetTeam.
Look for suspicious conditional jumps shortly after they are called.
NOP or set conditional jump to JMP.

Check the "insane detailed verses" for more info (:
Seriously...

[Sparten]

you just need to nop the lines, no jumping. for the demo i nop:
00717FD9
00717FFF
00718025
007180AB
007180CE
007180F1
for the maphack to be perfect you will need to nop em all, 2 is enaugh to have it show up in the small minimap, but then it will not be active when you make it large or press enter.
this should help you guys out.

[chilli]

xollox you didnt answer my question..what tool/procedure do you use to get those addresses that call getteam

[Sparten]

xollox you didnt answer my question..what tool/procedure do you use to get those addresses that call getteam

read around and make a search, he allready posted all the info you need.

[caliber1942]

but then it will not be active when you make it large or press enter.
this should help you guys out.


argghh!!!! this is what my problem has been for several days...... YOU HAVE GOT TO BE KIDDING ME!!! i just had the game paused and would make the change and tab back to the game and look (left it paused) and if no change then would tab back and try again. never thought about having to make it large/press enter.... THIS WAS THE PROBLEM- GEEZ-

NOW, wonder why it doesn't change until you make it large or press enter. i mean, the map is being updated while paused and stuff (being drawn to) and so i wonder why it doesn't change right away (like tags do).....

anyways, thanks-
this should help-

best,
cal

ps.- i don't think it was a problem posting this for the demo (the addresses) as it helped me to make sure i was doing things right for when i do this on the retail.

thanks again all- i'll let you know when i test it and have it working. can't believe it was something this damn simple....

best,
cal

[alquemist]

xollox What ur msn s/n?

[xollox]

xollox What ur msn s/n?
sorry, I don't give that out to just anyone...

[alquemist]

sorry, I don't give that out to just anyone...


I whanted to chat with u on my msn about some help and stuff.... :classic:

[Sparten]

keep on topic!!

[blah1970]

you just need to nop the lines, no jumping. for the demo i nop:

May seem like a stupid question, but.... if your are noping 7 addy's are you poking nops and doesnt pb detect this straight away. I was hoping just to reconfigure the seh/detours dll I have been using on bfv but with a limit of 4 hardware breakpoints this doesnt seem possible!

[Sparten]

May seem like a stupid question, but.... if your are noping 7 addy's are you poking nops and doesnt pb detect this straight away. I was hoping just to reconfigure the seh/detours dll I have been using on bfv but with a limit of 4 hardware breakpoints this doesnt seem possible!

i have other ways to get by PB's memoryscan then SEH, as a matter of facts SEH wont work right off the book with the original(retrail) BF2.exe, its has a protection against this.(the demo dont)

but yes its easy for PB to detect nops.

[scruie]

i have other ways to get by PB's memoryscan then SEH, as a matter of facts SEH wont work right off the book with the original(retrail) BF2.exe, its has a protection against this.(the demo dont)

but yes its easy for PB to detect nops.


these other ways wouldn't be the ones discussed here (http://www.mpcforum.com/showthread.php?t=93385&page=2&pp=15) ?

[Sparten]

these other ways wouldn't be the ones discussed here (http://www.mpcforum.com/showthread.php?t=93385&page=2&pp=15) ?

you got it right.

[scruie]

wow...thanks for quick response. thats what i'm gonna try for normal bf first. since cal and spont pointed some 'easier' targets to experiment with. and all the info mcmike, others and your good self have hinted to.
this seems to be the future...

[blah1970]

thanks for lighting the way guys! This shall keep me busy for a few days lol