Signatures Research #2
Replies: 29 comments 22 replies
-
|
Script Threads |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
add(1).rip().as<types::get_renderer_info>();
using get_renderer_info = uint64_t(*)();
call save ret if ((int)*(BYTE*)(ptr + 9) == 3)
//VULKAN in use
else if ((int)*(BYTE*)(ptr + 9) == 1)
//DX12 in use |
Beta Was this translation helpful? Give feedback.
-
E8 ? ? ? ? 42 8B 9C FE add(1).rip()
using get_native_addr = uint64_t(*)(uint64_t hash); |
Beta Was this translation helpful? Give feedback.
-
4C 8D 05 68 44 CA FE 8B 15
add(9).rip().as<uint32_t*>();frame count |
Beta Was this translation helpful? Give feedback.
-
40 53 48 83 EC 20 8B 41 08 4C 8D 44 24 ? 89 44 24 30 48 8B DA 8B 01 48 8D 54 24 ? 48 8D 4C 24 ? 89 44 24 40 E8 ? ? ? ? 48 8B 44 24 ? 4C 8D 05 ? ? ? ? 48 8B D3 48 89 44 24 ? 48 8D 4C 24 ? E8 ? ? ? ? 48 83 C4 20 5B C3 CC A5
PVOID ptr
static uint32_t frame_count{};
bool hooks::STAT_ID_GET_INT(int* a1, uint64_t a2)
{
if (frame_count != *g_patterns.m_frame_count) {
g_logger.insert(log_class::GENERAL, "Ticked");
frame_count = *g_patterns.m_frame_count;
}
return get_original<decltype(&hooks::STAT_ID_GET_INT)>("SIGI")(a1, a2);
}Not sure if natives are integ checked but it works fine. |
Beta Was this translation helpful? Give feedback.
-
|
All natives are integrity checked |
Beta Was this translation helpful? Give feedback.
-
E8 ? ? ? ? B2 01 8B CB 48 8B F8
add(1).rip()
using get_network_player = uint64_t* /*class*/ (__fastcall*)(int player);get network player from index |
Beta Was this translation helpful? Give feedback.
-
48 8B 58 60 48 8B 0D + 7 ripswapchain (IDXGISwapChain1) |
Beta Was this translation helpful? Give feedback.
-
48 8D 15 ? ? ? ? 48 8D 0D ? ? ? ? FF D0 + 1 rip
D3D Factory1 (win7 i guess)
49 8B CD E8 ? ? ? ? 4C 8D 05 + 9 rip
D3D Factory2 |
Beta Was this translation helpful? Give feedback.
-
|
g_IDXGISwapChain1 = ("48 8D 15 ? ? ? ? 4C 8B 05 ? ? ? ? 4C 8D 0D").add(3).rip() |
Beta Was this translation helpful? Give feedback.
-
48 8D 15 ? ? ? ? 4C 8B 0E begin of the instruction //ID3D12GraphicsCommandList
83 63 20 00 4C 8D 05 + 4 for the beginning of the instruction //ID3D12DescriptorHeapSigs to the UUIDs (Thanks to Faint for pointing the obvious out, thought the last arg was heap size instead of the ptr itself ;P ) |
Beta Was this translation helpful? Give feedback.
-
|
"48 8B 05 51 C4 05 03 48 8B 8B 30 CC 00 00 48 89 44 24 20", ID3D12DescriptorHeap**, back buffers namespace rage
{
#pragma pack(push, 8)
//Contains more info, needs to be expanded
class grcRender
{
public:
virtual ~grcRender() = default;
char pad_0000[80]; //0x0000
ID3D12GraphicsCommandList* m_command_list; //0x0058
char pad_0060[1704]; //0x0060
}; //Size: 0x0708
#pragma pack(pop)
} |
Beta Was this translation helpful? Give feedback.
-
|
Update: 0x18 from grcRender is FenceEvent HANDLE and 0x10 is the ID3D12Fence |
Beta Was this translation helpful? Give feedback.
-
4C 8B 05 ? ? ? ? 4C 8D 0D ? ? ? ? 48 89 54 24 + 3 rip HWND ptr. (You can just get it from the swapchain too) |
Beta Was this translation helpful? Give feedback.
-
|
WndProc = 48 89 5C 24 ? 4C 89 4C 24 ? 48 89 4C 24 ? 55 56 57 41 54 41 55 41 56 41 57 48 8B EC 48 83 EC 60 |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for all the contributions to get HorseMenu working! |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
How so? Are you not able to fetch data from the pointer? |
Beta Was this translation helpful? Give feedback.
-
|
What your mean?I can try, and if u can fetch it can u say something? |
Beta Was this translation helpful? Give feedback.
-
|
I also heard some pointers were encrypted |
Beta Was this translation helpful? Give feedback.
-
|
Requesting ragdoll on player peds is patched |
Beta Was this translation helpful? Give feedback.
-
|
@TSYiMa Have you had any luck with pool pointers? |
Beta Was this translation helpful? Give feedback.
-
|
"E8 ? ? ? ? 84 C0 74 ? B0 ? EB ? 32 C0 48 83 C4 ? 5B C3 48 89 5C 24 ? 48 89 6C 24 ? 48 89 74 24 ? 57 41 54" Call to write_join_response_data I reckon. Maybe not, but maybe so 😎 |
Beta Was this translation helpful? Give feedback.
-
|
Sorry for the LONG ahh signature but here's send net info to lobby. Not sure you can spoof rid/ip here but name works: |
Beta Was this translation helpful? Give feedback.
-
|
48 8B C4 48 89 58 ? 48 89 68 ? 48 89 70 ? 48 89 48 ? 57 41 54 41 55 41 56 41 57 48 83 EC ? 4C 8B A9 - WriteVehicleProximityMigrationData 48 8B C4 48 89 58 ? 48 89 68 ? 48 89 70 ? 48 89 78 ? 41 54 41 56 41 57 48 83 EC ? 65 4C 8B 0C 25 - Migrate object/CGiveControlEvent::Trigger |
Beta Was this translation helpful? Give feedback.
-
|
48 8B 0D 42 CD 20 03 48 85 C9 - Should be able to patch this to force your connection through r* relay servers. E8 ? ? ? ? 84 C0 74 ? 48 B8 ? ? ? ? ? ? ? ? 48 89 03 - Generate UUID |
Beta Was this translation helpful? Give feedback.
-
|
Based on @tyackman 's very long sig he posted above |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
Thank you so much. |
Beta Was this translation helpful? Give feedback.
-
|
@imstash I will try to find some bad events. Do you know if kicks are sent through this? |
Beta Was this translation helpful? Give feedback.
-
I have them all mapped out but sent this on phone as I sent it to someone else earlier. I'll post the enum tomorrow. As for kicks, join requests etc you need another hook. This one is mainly for annoying message spams, crew abuse etc. You can find the join handler by xrefing "d" and seeing where it reads 16 bytes (rid). Kicks are something else, haven't looked into that shit yet. |
Beta Was this translation helpful? Give feedback.
-
Thank you. I have a PR going right now with a lot of good shit in it that I will open as a draft once I get a feature working. I am currently in the process of porting one kick. Do you have discord? I would like to discuss a little bit more, if you do. |
Beta Was this translation helpful? Give feedback.
-
user769953 |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
Really? What do you mean blacklist? |
Beta Was this translation helpful? Give feedback.
-
Doesn't let them join |
Beta Was this translation helpful? Give feedback.
-
|
WritePlayerGameStateDataNode: WritePlayerAppearanceDataNode: WritePlayerCameraDataNode: |
Beta Was this translation helpful? Give feedback.
-
|
ScriptVirtualMachine: HasRosPrivilege: GetNetworkObjectFromPlayer: |
Beta Was this translation helpful? Give feedback.
-
|
ReadNetArrayUpdate: WriteNetArrayUpdate: |
Beta Was this translation helpful? Give feedback.
-
|
WriteNode: WriteNodeData (probably): GetSectorData: CanSendNodeToPlayer: |
Beta Was this translation helpful? Give feedback.
-
|
Local Peer ID: Host Token: |
Beta Was this translation helpful? Give feedback.
-
|
GivePickupReward: GetPedFromNetworkObject: FindPeerByCxnID: GetScriptProgram: |
Beta Was this translation helpful? Give feedback.
-
|
WriteVehicleGadgetDataNode: GetNumberOfVehicleGadgets: AddVehicleGadget: GetVehicleWeaponMgr: CVehicle::CreateVehicleWeaponMgr: CSyncDataReaderSerialiser: Loading Screen State: Game Script Handle Manager |
Beta Was this translation helpful? Give feedback.
-
|
GetCPedFromNetObject: GetCVehicleFromNetObject: GetSeatManager: CVehicle::GetPedInSeat: |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Since the base has yet to be functional, we need some legwork. Post any signature that will aid in getting this menu on its feet.
Beta Was this translation helpful? Give feedback.
All reactions