Post: Addresses, Structs, Scrips & Tutorials 1.11
Options
10-31-2014, 11:57 PM
#1
Swaqq
Professional Thanker
Welcome to my Thread.
This has C# Scripts, and Tutorials, and some structures.
//I don't have time to update the addresses, I've made a tutorial provided below.
Here are Some Addresses for 1.11: You must login or register to view this content. and You must login or register to view this content.
Tutorials:
Basic Addresses(FPS/Cbuff_AddText/G_Spawn/G_LocalizedString) //Tut by Me
Porting Addresses from Older Updates:
Structures
Stats: //Swiss + Eddie Mac + br0wniiez
StatEntry = 0x2AC7E6C, //Thanks to LeBigKilleur :3
Score = StatEntry + 0xE2,
Name = 0x0298fbe8,
Prestige = StatEntry + 0x9,
Kills = StatEntry + 0xBA,
Deaths = StatEntry + 0x91,
Wins = StatEntry + 0x10E,
Losses = StatEntry + 0xC1,
Xp = StatEntry + 0xA5,
TimePlayed = StatEntry + 0xFE,
Games_played = StatEntry + 0xA9,
UnlockAll = StatEntry + 0x573C,
CustomClass = StatEntry + 0x4DE5,
Headshots = StatEntry + 0x8A2F,
Saviors = StatEntry + 0x8A3F,
LongShots = StatEntry + 0x8A43,
OneShots = StatEntry + 0x8AA7,
FirstBloods = StatEntry + 0x8A97,
Stabs = StatEntry + 0x8AD7,
Confirms = StatEntry + 0x8402,
Denies = StatEntry + 0x8406,
Uplinks = StatEntry + 0x83EA, // also Captures and hardpoint Caps
Returns = StatEntry + 0x83EE,
Plants = StatEntry + 0x83F6,
Defuses = StatEntry + 0x83FA,
SnR_Caps = StatEntry + 0x8402,
SnR_Rescue = StatEntry + 0x8406,
Defends = StatEntry + 0x83F2,
Weapon_Kills = StatEntry + 0x69A, // 0x1AC for next weapon [url=https://pastebin.com/AmKmBnaT]found by brOwniiez **SCORESTREAK EARN/KILLS** EARNED UAV 0x29D661F War - Pastebin.com[/url] for details
Killstreaks_Earned = StatEntry + 0x89BB,
Killstreak_Warbird_Kills = StatEntry + 0x898B,
Killstreak_Paladin_Kills = StatEntry + 0x898F,
Killstreak_Vulcan_Kills = StatEntry + 0x8993,
Killstreak_Goliath_Kills = StatEntry + 0x8997,
Killstreak_MissleStrike_Kills = StatEntry + 0x89A3,
Killstreak_RemoteTurret_Kills = StatEntry + 0x89A7,
Killstreak_BombingRun_Kills = StatEntry + 0x89AB,
Killstreak_AssultDrone_Kills = StatEntry + 0x89AF,
G_Client //Thanks to xCSBKx and RatchetBooty
G_Client = 0x1A75C00,
Client Interval: 0x3900
Buttons = Addresses.G_Client + 0x3DBE
Red Boxes: G_Client + 0x5F On: 0x10 Off: 0x00
Heat Vision: G_Client + 0x5F On: 0x1C Off: 0x00
Invisibility: G_Client + 0x5B On: 0xF3 Off: 0x00
Ping: G_Client + 0x58 On: 0x01 Off: 0x00
Primary Akimbo: G_Client + 0x3E5 On: 0x01 Off: 0x00
Secondary Akimbo: G_Client + 0x3AD On: 0x90 Off: 0x00
Laser: G_Client + 0x59 On: 0x01 Off: 0x00
Red Laser: G_Client + 0xD On: 0x00
Yellow Laser Color: G_Client + 0xD On: 0x01
Blue Laser Color: G_Client + 0xD On: 0x04
Scrambler: G_Client + 0x59 On: 0x40 Off: 0x00
mFlag: G_Client + 0x3DAF Normal: 0x00 No Clip: 0x01 UFO Mode: 0x02 Freeze: 0x04
System Hack: G_Client + 0x38C9 On: 0x01 Off: 0x00
Third Person: G_Client + 0x5F On: 0x07 Off: 0x00
Heat Chams: G_Client + 0x5F On: 0x1F Off: 0x00
Player Speed: G_Client + 0x3ADC Normal: 0x3F, 0x88 Fast: 0x3F, 0xFF Slow: 0x3F, 0x00
No Friction (Skate Mod): G_Client + 0x56 On: 0x01 Off: 0x00
In-Game Name: G_Client + 0x3B3C
In-Game Clan Tag: G_Client + 0x3BA0
Advanced UAV: G_Client + 0x3C2F On: 0x01 G_Client + 0x3C3F On: 0x00 Off: 0x01
Infinite Ammo:
G_Client + 0x58F On: 0xFF, 0xFF Off: 0x00, 0x00
G_Client + 0x5A6 On: 0xFF, 0xFF Off: 0x00, 0x00
G_Client + 0x65A On: 0xFF, 0xFF Off: 0x00, 0x00
G_Client + 0x642 On: 0xFF, 0xFF Off: 0x00, 0x00
Exo Cloak: G_Client + 0x58 On: 0x11 Off: 0x00
Kill Client: G_Client + 0x3ADC Kill: 0xFF, 0xFF
Fake Lag: G_Client + 0x3A1B On: 0x00 Off: 0x02
Kick Client: G_Client + 0x5A Kick: 0x3F
Invisible Gun: G_Client + 0x3AE1 On: 0x01 Off: 0x00
Exo Screen: G_Client + 0x3880 On: 0x01 Off: 0x00
Instant Drop: G_Client + 0x54 On: 0x01 Off: 0x00
Injured Breathing: G_Client + 0x3AC9 On: 0x01 Off: 0x00
Exo Stim: G_Client + 0x323 On: 0x01 Off: 0x02
Gun View: G_Client + 0x563 Default: 0x00 Launcher: 0x02
Rabbit Man: G_Client + 0x3ADC On: 0x2F, 0x88 Off: 0x3F 0x88
Fake Blood: G_Client + 0x1F3 On: 0xFF Off: 0x64
Stuck in Mud: G_Client + 0x3ADC On: 0x3D, 0x88 Off: 0x3F, 0x88
UAV: G_Client + 0x3948 On: 0x01 Off: 0x00
Border Screen: G_Client + 0x3850 On: 0x01 Off: 0x00
Missile Vision: G_Client + 0x380B On: 0x01 Off: 0x00
Goliath Vision: G_Client + 0x38E8 On: 0x01 Off: 0x02
In-Game Leaderboard spoof: Prestige: G_Client + 0x30C3 Rank: G_Client + 0x30BF Kills: G_Client + 0x3C1B Deaths: G_Client + 0x3C1D Objective: G_Client + 0x3C21 Defends: G_Client + 0x3C23 Score: G_Client + 0x3C19 Assists: G_Client + 0x3C1F
G_Entity :
G_Entity = 0x1985C00,//Thanks to LeBigKilleur
Size = 0x280 //Thanks to xCSBKx
0x158 = Pointer to G_Client // Thanks to Shark
0x1AC = Health
Scripts
Super ForceHost: //Creds to me
public void ForceHostON()
{
Cbuf_AddText("ds_serverConnectTimeout 1000");
Cbuf_AddText("ds_serverConnectTimeout 1");
Cbuf_AddText("party_minplayers 1");
Cbuf_AddText("party_maxplayers 16");
}
//Addresses thanks to RachetBooty 
party_minplayers: 0x02624F84
party_maxplayers: 0x02624FCC
ds_serverConnectTimeout : 0x0262BBCC
BTW: The length is 4 bytes, add 0x3 to each address and then change it's value.
RPC: //Credit to Choco, and Shark for fixing it
public class RPC
{
static uint function_address = Addresses.R_SetFrameFog; // R_SetFrameFog
public static int Init()
{
if (function_address == 0) return -1;
Enable_RPC();
return 0;
}
public static void Enable_RPC()
{
PS3.SetMemory(function_address, new byte[] { 0x4E, 0x80, 0x00, 0x20 });
System.Threading.Thread.Sleep(20);
byte[] func = new byte[] { 0x7C, 0x08, 0x02, 0xA6, 0xF8, 0x01, 0x00, 0x80, 0x3C, 0x60, 0x10, 0x05, 0x81, 0x83, 0x00, 0x4C, 0x2C, 0x0C, 0x00, 0x00, 0x41, 0x82, 0x00, 0x64, 0x80, 0x83, 0x00, 0x04, 0x80, 0xA3, 0x00, 0x08, 0x80, 0xC3, 0x00, 0x0C, 0x80, 0xE3, 0x00, 0x10, 0x81, 0x03, 0x00, 0x14, 0x81, 0x23, 0x00, 0x18, 0x81, 0x43, 0x00, 0x1C, 0x81, 0x63, 0x00, 0x20, 0xC0, 0x23, 0x00, 0x24, 0xC0, 0x43, 0x00, 0x28, 0xC0, 0x63, 0x00, 0x2C, 0xC0, 0x83, 0x00, 0x30, 0xC0, 0xA3, 0x00, 0x34, 0xC0, 0xC3, 0x00, 0x38, 0xC0, 0xE3, 0x00, 0x3C, 0xC1, 0x03, 0x00, 0x40, 0xC1, 0x23, 0x00, 0x48, 0x80, 0x63, 0x00, 0x00, 0x7D, 0x89, 0x03, 0xA6, 0x4E, 0x80, 0x04, 0x21, 0x3C, 0x80, 0x10, 0x05, 0x38, 0xA0, 0x00, 0x00, 0x90, 0xA4, 0x00, 0x4C, 0x90, 0x64, 0x00, 0x50, 0xE8, 0x01, 0x00, 0x80, 0x7C, 0x08, 0x03, 0xA6, 0x38, 0x21, 0x00, 0x70, 0x4E, 0x80, 0x00, 0x20 };
PS3.SetMemory(function_address + 0x4, func);
PS3.SetMemory(0x10050000, new byte[0x2854]);
PS3.SetMemory(function_address, new byte[] { 0xF8, 0x21, 0xFF, 0x91 });
}
public static int Call(uint func_address, params object[] parameters)
{
int num_params = parameters.Length;
uint num_floats = 0;
for (uint i = 0; i < num_params; i++)
{
if (parameters[i] is int)
{
byte[] val = BitConverter.GetBytes((int)parameters[i]);
Array.Reverse(val);
PS3.SetMemory(0x10050000 + (i + num_floats) * 4, val);
}
else if (parameters[i] is uint)
{
byte[] val = BitConverter.GetBytes((uint)parameters[i]);
Array.Reverse(val);
PS3.SetMemory(0x10050000 + (i + num_floats) * 4, val);
}
else if (parameters[i] is string)
{
byte[] str = Encoding.UTF8.GetBytes(Convert.ToString(parameters[i]) + "\0");
PS3.SetMemory(0x10050054 + i * 0x400, str);
uint addr = 0x10050054 + i * 0x400;
byte[] address = BitConverter.GetBytes(addr);
Array.Reverse(address);
PS3.SetMemory(0x10050000 + (i + num_floats) * 4, address);
}
else if (parameters[i] is float)
{
num_floats++;
byte[] val = BitConverter.GetBytes((float)parameters[i]);
Array.Reverse(val);
PS3.SetMemory(0x10050024 + ((num_floats - 1) * 0x4), val);
}
}
byte[] fadd = BitConverter.GetBytes(func_address);
Array.Reverse(fadd);
PS3.SetMemory(0x1005004C, fadd);
System.Threading.Thread.Sleep(20);
byte[] ret = PS3.Extension.ReadBytes(0x10050050, 4);
Array.Reverse(ret);
return BitConverter.ToInt32(ret, 0);
}
}
All Clients Button Monitering: //Thanks to Me and iTnDm
public class Buttons
{
public static class Buttonz
{
public static Int32
Cross = 67108864,
Crouch = 33557732,
Prone = 16777216,
Start = 128,
L1 = 134217736,
L2 = -2147483648,
L3 = 537001984,
R1 = 65536,
R2 = 1107296256,
R3 = 33817600;
}
}
public static bool ButtonPressed(int client, int Buttons)
{
if (PS3.Extension.ReadInt32(Offsets.Buttons + ((uint)client * 0x4180)) == Buttons)
return true;
else return false;
}
Jetpack: //Thanks again to Black Panther
public void JetPack(int client)
{
float jH = PS3.Extension.ReadFloat(G_Client + ((uint)client * 0x4180));
jH += 100;
PS3.Extension.WriteFloat(G_Client + ((uint)client * 0x4180), jH);
}
//How to use it in a timer or backgroundworker
if(ButtonPressed(0, Buttons.Cross))
{
JetPack(0);
}
Unlock All Trophies: //Thanks to SC58
{
string[] Achievements = new string[50];
Achievements[0] = "4 CARMA";
Achievements[1] = "4 CAMPAIGN_COMPLETE";
Achievements[2] = "4 CAMPAIGN_HARDENED";
Achievements[3] = "4 CAMPAIGN_VETERAN";
Achievements[4] = "4 BOOST_DASH_STOMP";
Achievements[5] = "4 GRENADE_DODGE";
Achievements[6] = "4 SONIC_KILL";
Achievements[7] = "4 OVERDRIVE_KILL";
Achievements[8] = "4 SMART_GRENADE_KILL";
Achievements[9] = "4 THREAT_GRENADE_KILL";
Achievements[10] = "4 EMP_DRONE";
Achievements[11] = "4 EMP_AST";
Achievements[12] = "4 INTEL_HALF";
Achievements[13] = "4 INTEL_ALL";
Achievements[14] = "4 COVER_DRONE_KILL";
Achievements[15] = "4 EXO_UPGRADE";
Achievements[16] = "4 EXO_UPGRADE_10";
Achievements[17] = "4 EXO_UPGRADE_20";
Achievements[18] = "4 EXO_UPGRADE_FULL";
Achievements[19] = "4 LEVEL_1";
Achievements[20] = "4 LEVEL_1A";
Achievements[21] = "4 LEVEL_2A";
Achievements[22] = "4 LEVEL_2B";
Achievements[23] = "4 LEVEL_2";
Achievements[24] = "4 LEVEL_3A";
Achievements[25] = "4 LEVEL_3";
Achievements[26] = "4 LEVEL_4A";
Achievements[27] = "4 LEVEL_4";
Achievements[28] = "4 LEVEL_5";
Achievements[29] = "4 LEVEL_5A";
Achievements[30] = "4 LEVEL_6A";
Achievements[31] = "4 LEVEL_6";
Achievements[32] = "4 LEVEL_7";
Achievements[33] = "4 LEVEL_8A";
Achievements[34] = "4 LEVEL_8";
Achievements[35] = "4 LEVEL_9";
Achievements[36] = "4 LEVEL_10A";
Achievements[37] = "4 LEVEL_10";
Achievements[38] = "4 LEVEL_11";
Achievements[39] = "4 LEVEL_12A";
Achievements[40] = "4 LEVEL_12";
Achievements[41] = "4 LEVEL_13A";
Achievements[42] = "4 LEVEL_13";
Achievements[43] = "4 LEVEL_14A";
Achievements[44] = "4 LEVEL_14";
Achievements[45] = "4 COOP_VETERAN";
Achievements[46] = "4 COOP_WARFARE";
Achievements[47] = "4 COOP_UNDEAD_SURVIVOR";
Achievements[48] = "4 COOP_EXO_SURVIVOR";
Achievements[49] = "4 COOP_FLIP_FLOP";
for (int i = 0; i < 50; i++)
{
RPC.Call(Addresses.SV_GameSendServerCommand, -1, 1, Achievements[i]);
System.Threading.Thread.Sleep(25);
RPC.Call(Addresses.SV_GameSendServerCommand, -1, 1, Achievements[i]);
}
}
SV_GameSendServerCommand // Credits to me
public void SV_GameSendServerCommand(int client, string command)
{
RPC.Call(Addresses.SV_GameSendServerCommand, client, 0, command + "\"");
}
iPrintln Funcs: //Credits to Me
iPrintlnBold(Center Screen)
public void iPrintlnBold(int client, string text)
{
SV_GameSendServerCommand(client, "c \"" + text + "\"");
}
iPrintln(Killfeed)
public void iPrintln(int client, string text)
{
SV_GameSendServerCommand(client, "e \"" + text + "\"");
}
CBuf_AddText // Ported from BO2(Shark's)
public void Cbuf_AddText(string CMD)
{
RPC.Call(Addresses.Cbuf_AddText, 0, Command);
}
Hud Elements: //Thanks to Shark for the struct, BLB for making setShader and setText, Mega for fixing it somehow, and me for MoveOverTime
https://pastebin.com/D7yj9N1u
Aimbot: // Thanks to Bee el Bee (1.04)
https://pastebin.com/YTnXukEu
Spawning Entities: //Thanks to xReaperV3 (1.04)
public static float[] getPlayerOrigin(int clientIndex)
{
return RPC.ReadSingle(G_Client(clientIndex, 0x7
, 3);
}
public static float[] getPlayerAngles(int clientIndex)
{
return RPC.ReadSingle(G_Client(clientIndex, 0x1B4), 3);
}
public static uint spawnEntity(string ModelName, float[] Origin, float[] Angles)
{
uint Entity = (uint)RPC.Call(0x3669B0);
RPC.WriteSingle(Entity + 0x138, Origin);
RPC.WriteSingle(Entity + 0x148, Angles);
RPC.Call(0x365738, Entity, ModelName);
RPC.Call(0x35B6C4, Entity);
return Entity;
}
Clone Player: //Thanks to xReaperV3
public static void ClonePlayer(int clientIndex)
{
RPC.Call(Addresses.PlayerCMD_ClonePlayer, new object[] { clientIndex });
}
Keyboard: // Thanks to iTnDM (1.04)
uint kb_Result = 0x03080E22;
uint kb_cb = 0x988F98;
uint keyboardPrompt = 0x498828;
uint kb_active = 0x0099E42C;
string runKeyboard(string title = "Your title", string presetText = "text here", int maxLength = 20)
{
RPC.Call(keyboardPrompt, new object[] { 0, title, presetText, maxLength, 0, 0, kb_cb });
System.Threading.Thread.Sleep(10);
while (PS3.Extension.ReadInt32(kb_active) == 0) { }
return PS3.Extension.ReadString(kb_Result);
}
Unlock All: //Thanks to RachetBooty
byte[] buffer = new byte[0x1770];
for (int i = 0; i < 0x1770; i++)
{
buffer[i] = 0xFE;
}
PS3.SetMemory(Addresses.UnlockAll, buffer);
The following 48 users say thank you to Swaqq for this useful post:
@XM7MD_VX, One, ALI ALHILFI, Antonio96C, Azus, BISOON, Boliberrys, CoLsh2R, Confusing, Creepzoid 0___0, dolby1, Drughi, FusionIsDaName, G-T-A-5, Hunter926, ImAzazel, Items, Welsh, Krypton, Kryptus, LcGamingHD, Marco_Legend, MODZ4FUN420, ModzIsCoot, NotALegitPlayer, OLDSCHOOLMODZHD, Prom1ses, RTE, SaberNGU, Smoky420, SONYS✮NIGHTMARE, Stunz, Synergy, top_top, TotalModzHD, tyronS, Laser, xCLS, xDebugKiller, xKrazy SicknesS, XM7MD_VX, xSlinkeyy, xso1id, Xx-GIPPI-xX, yomen9, zAlbanianModder, zRayz-
11-24-2014, 09:40 PM
#201
Confusing
Climbing up the ladder
Originally posted by Swaqq
Hi fegs 
since SC58's thread only has addresses, I've decided to make my own thread 
!
Feel free to post your addresses and or scripts in the reply section and I will update the thread ASAP!
Addresses
Stats: // 1.03
Non-Host: // MegaMister (1.04)
Offsets
G_Client : Size = 0x4180 //Thanks to xCSBKx
G_Entity : Size = 0x280 //Thanks to xCSBKx
Scripts
RPC: //Credit to SC58
All Clients Button Monitering: //Thanks to iTnDM
Jetpack: //Thanks again to Black Panther
Unlock All Trophies: //Thanks to SC58
SV_GameSendServerCommand // Credits to me
iPrintln Funcs: //Credits to Me
iPrintlnBold(Center Screen)
iPrintln(Killfeed)
Local Button Monitering //Thanks to xCSBKx (1.02)
CBuf_AddText // Ported from BO2(Shark's)
Hud Elements: //(1.03) Thanks to Shark for the struct, BLB for making setShader and setText, and me for the rest
Aimbot: // Thanks to Bee el Bee (1.02)
Spawning Entities: //Thanks to xReaperV3 (1.03)
Clone Player: //Thanks to xReaperV3(1.03)
since SC58's thread only has addresses, I've decided to make my own thread !Feel free to post your addresses and or scripts in the reply section and I will update the thread ASAP!
Addresses
--Found by xReaperV3-- //1.04
//Standard Shit
TOC = 0x994F68,
G_Client = 0x1950880,
G_Entity = 0x1860880,
//Functions
TeleportPlayer = 0x31A010,
G_Spawn = 0x3669B0,
G_SetModel = 0x365738,
SetClientViewAngles = 0x2F4530,
G_ExplodeMissile = 0x31D638,
G_FireGrenade = 0x323568,
G_FireRocket = 0x323928,
G_SpawnTurret = 0x37B4F8,
Weapon_RocketLauncherFire = 0x3697B8,
G_GivePlayerWeapon = 0x36A6A0,
Add_Ammo = 0x3101C0,
BG_FindWeaponIndexForName = 0x168074,
Com_Sprintf = 0x4C7548,
Dvar_GetBool = 0x4BF0F8,
SV_GameSendServerCommand = 0x42D9A4,
//RPC
R_SetFrameFog = 0x5FCBF0,
//Hud Elems
G_HudElems = 0x17B9670,
G_LocalizedStringIndex = 0x4C9A8,
LevelTime = 0x17E8680,
//Anti-Ban
(Set all to 0x60, 0x00, 0x00, 0x00)
- 0x590DBC
- 0x590DC4
- 0x5912A0
- 0x5931F0
- 0x593274
- 0x593280
- 0x593288
Stats: // 1.03
//Thanks to NotALegitPlayer
0x029092C6 - Score
0x0290929D - Kills
0x02909275 - Deaths
0x0290928D - Games Played
0x029091ED - Prestige
0x29092F2 - Wins
0x29092A5 - Losses
0x29092E2 - Time Played
Class 1 Offsets
Class Interval: 0x80
Class Name: 0x290DFC9
Primary: 0x290DFA9
Prim. Attachment 1: 0x290DFAB
Prim. Attachment 2: 0x290DFAD
Prim. Attachment 3: 0x290DFAF
Prim. Camo: 0x290DFB1
Secondary: 0x290DFB5
Sec. Attachment 1: 0x290DFB7
Sec. Attachment 2: 0x290DFB9
Sec. Camo: 0x290DFBD
Wildcard 1: 0x290DFEA
Wildcard 2: 0x290DFEC
Wildcard 3: 0x290DFEE
Perk 1: 0x290DFDE
Perk 2: 0x290DFE2
Perk 3: 0x290DFE6
Exo Ability: 0x290DFC4
Exo Launcher: 0x290DFC1
Scorestreak 1: 0x290DFF2
Scorestreak 2: 0x290DFFA
Scorestreak 3: 0x290E002
SCorestreak 4: 0x290E00A
Non-Host: // MegaMister (1.04)
Red Boxes : 0x0019610b (01 on / 00 off)
No Recoil : 0x0020c8a3 (nop on / 00 41 82 00 off)
Green Players : 0x005d60d3 (01 on / 00 off)
High Light Players : 0x001ff6f3 (04 red / 00 off) (change bytes for other colours)
Laser : 0x001ff703 ( 01 on / 00 off)
Explosive Bullets : 0x0016fe9f (01 on / 00 off)
Steady Aim : 0x0016e96f ( 00 on / 02 off)
Offsets
G_Client : Size = 0x4180 //Thanks to xCSBKx
G_Client + 0x78 = Origin
G_Client + 0x1b4 = Angles
G_Client + 0x0562 = Weapon Flags // {0x8, 0x0} = Disable Switching, {0x0, 0x80} = Disable Weapons, {0x0, 0x20} = Disable Zoom, {0x04, 0x0} = NoRecoil
G_Client + 0x58C = Secondary Ammo
G_Client + 0x5A4 = Primary Ammo
G_Client + 0x640 = Secondary Clip
G_Client + 0x658 = Primary Clip
G_Client + 0xa64 = Button Monitoring
G_Client + 0xB3c = Name
G_Client + 0x3da7 = mFlag //0x1 = Ufo, 0x2 = NoClip, 0x4 = Freeze
G_Entity : Size = 0x280 //Thanks to xCSBKx
0x158 = Pointer to G_Client // Thanks to Shark
0x1AC = Health
Scripts
RPC: //Credit to SC58
public class RPC
{
static uint function_address = 0x5FCBF0; // R_SetFrameFog
public static int Init()
{
if (function_address == 0) return -1;
Enable_RPC();
return 0;
}
public static void Enable_RPC()
{
PS3.SetMemory(function_address, new byte[] { 0x4E, 0x80, 0x00, 0x20 });
System.Threading.Thread.Sleep(20);
byte[] func = new byte[] { 0x7C, 0x08, 0x02, 0xA6, 0xF8, 0x01, 0x00, 0x80, 0x3C, 0x60, 0x10, 0x05, 0x81, 0x83, 0x00, 0x4C, 0x2C, 0x0C, 0x00, 0x00, 0x41, 0x82, 0x00, 0x64, 0x80, 0x83, 0x00, 0x04, 0x80, 0xA3, 0x00, 0x08, 0x80, 0xC3, 0x00, 0x0C, 0x80, 0xE3, 0x00, 0x10, 0x81, 0x03, 0x00, 0x14, 0x81, 0x23, 0x00, 0x18, 0x81, 0x43, 0x00, 0x1C, 0x81, 0x63, 0x00, 0x20, 0xC0, 0x23, 0x00, 0x24, 0xC0, 0x43, 0x00, 0x28, 0xC0, 0x63, 0x00, 0x2C, 0xC0, 0x83, 0x00, 0x30, 0xC0, 0xA3, 0x00, 0x34, 0xC0, 0xC3, 0x00, 0x38, 0xC0, 0xE3, 0x00, 0x3C, 0xC1, 0x03, 0x00, 0x40, 0xC1, 0x23, 0x00, 0x48, 0x80, 0x63, 0x00, 0x00, 0x7D, 0x89, 0x03, 0xA6, 0x4E, 0x80, 0x04, 0x21, 0x3C, 0x80, 0x10, 0x05, 0x38, 0xA0, 0x00, 0x00, 0x90, 0xA4, 0x00, 0x4C, 0x80, 0x64, 0x00, 0x50, 0xE8, 0x01, 0x00, 0x80, 0x7C, 0x08, 0x03, 0xA6, 0x38, 0x21, 0x00, 0x70, 0x4E, 0x80, 0x00, 0x20 };
PS3.SetMemory(function_address + 0x4, func);
PS3.SetMemory(0x10050000, new byte[0x2854]);
PS3.SetMemory(function_address, new byte[] { 0xF8, 0x21, 0xFF, 0x91 });
}
public static int Call(uint func_address, params object[] parameters)
{
int num_params = parameters.Length;
uint num_floats = 0;
for (uint i = 0; i < num_params; i++)
{
if (parameters[i] is int)
{
byte[] val = BitConverter.GetBytes((int)parameters[i]);
Array.Reverse(val);
PS3.SetMemory(0x10050000 + (i + num_floats) * 4, val);
}
else if (parameters[i] is uint)
{
byte[] val = BitConverter.GetBytes((uint)parameters[i]);
Array.Reverse(val);
PS3.SetMemory(0x10050000 + (i + num_floats) * 4, val);
}
else if (parameters[i] is string)
{
byte[] str = Encoding.UTF8.GetBytes(Convert.ToString(parameters[i]) + "\0");
PS3.SetMemory(0x10050054 + i * 0x400, str);
uint addr = 0x10050054 + i * 0x400;
byte[] address = BitConverter.GetBytes(addr);
Array.Reverse(address);
PS3.SetMemory(0x10050000 + (i + num_floats) * 4, address);
}
else if (parameters[i] is float)
{
num_floats++;
byte[] val = BitConverter.GetBytes((float)parameters[i]);
Array.Reverse(val);
PS3.SetMemory(0x10050024 + ((num_floats - 1) * 0x4), val);
}
}
byte[] fadd = BitConverter.GetBytes(func_address);
Array.Reverse(fadd);
PS3.SetMemory(0x1005004C, fadd);
System.Threading.Thread.Sleep(20);
byte[] ret = PS3.GetMemory(0x10050050, 4);
Array.Reverse(ret);
return BitConverter.ToInt32(ret, 0);
}
}
All Clients Button Monitering: //Thanks to iTnDM
class Buttons
{
public static class Buttonz
{
public static Int32
Cross = 1024,
Square = 48,
Crouch = 512,
Prone = 256,
Start = 8388608,
L1 = 526336,
L2 = 32768,
L3 = 8194,
R1 = 1,
R2 = 16384,
R3 = 67108868;
}
public static bool ButtonPressed(int client, int Buttons)
{
if (PS3.Extension.ReadInt32(G_Client + 0x3DB4 + ((uint)client * 0x4180)) == Buttons)
return true;
else return false;
}
Jetpack: //Thanks again to Black Panther
public void JetPack(int client)
{
float jH = PS3.Extension.ReadFloat(G_Client + ((uint)client * 0x4180));
jH += 100;
PS3.Extension.WriteFloat(G_Client + ((uint)client * 0x4180), jH);
}
//How to use it in a timer or backgroundworker
if(ButtonPressed(0, Buttons.Cross))
{
JetPack(0);
}
Unlock All Trophies: //Thanks to SC58
{
string[] Achievements = new string[50];
Achievements[0] = "4 CARMA";
Achievements[1] = "4 CAMPAIGN_COMPLETE";
Achievements[2] = "4 CAMPAIGN_HARDENED";
Achievements[3] = "4 CAMPAIGN_VETERAN";
Achievements[4] = "4 BOOST_DASH_STOMP";
Achievements[5] = "4 GRENADE_DODGE";
Achievements[6] = "4 SONIC_KILL";
Achievements[7] = "4 OVERDRIVE_KILL";
Achievements[8] = "4 SMART_GRENADE_KILL";
Achievements[9] = "4 THREAT_GRENADE_KILL";
Achievements[10] = "4 EMP_DRONE";
Achievements[11] = "4 EMP_AST";
Achievements[12] = "4 INTEL_HALF";
Achievements[13] = "4 INTEL_ALL";
Achievements[14] = "4 COVER_DRONE_KILL";
Achievements[15] = "4 EXO_UPGRADE";
Achievements[16] = "4 EXO_UPGRADE_10";
Achievements[17] = "4 EXO_UPGRADE_20";
Achievements[18] = "4 EXO_UPGRADE_FULL";
Achievements[19] = "4 LEVEL_1";
Achievements[20] = "4 LEVEL_1A";
Achievements[21] = "4 LEVEL_2A";
Achievements[22] = "4 LEVEL_2B";
Achievements[23] = "4 LEVEL_2";
Achievements[24] = "4 LEVEL_3A";
Achievements[25] = "4 LEVEL_3";
Achievements[26] = "4 LEVEL_4A";
Achievements[27] = "4 LEVEL_4";
Achievements[28] = "4 LEVEL_5";
Achievements[29] = "4 LEVEL_5A";
Achievements[30] = "4 LEVEL_6A";
Achievements[31] = "4 LEVEL_6";
Achievements[32] = "4 LEVEL_7";
Achievements[33] = "4 LEVEL_8A";
Achievements[34] = "4 LEVEL_8";
Achievements[35] = "4 LEVEL_9";
Achievements[36] = "4 LEVEL_10A";
Achievements[37] = "4 LEVEL_10";
Achievements[38] = "4 LEVEL_11";
Achievements[39] = "4 LEVEL_12A";
Achievements[40] = "4 LEVEL_12";
Achievements[41] = "4 LEVEL_13A";
Achievements[42] = "4 LEVEL_13";
Achievements[43] = "4 LEVEL_14A";
Achievements[44] = "4 LEVEL_14";
Achievements[45] = "4 COOP_VETERAN";
Achievements[46] = "4 COOP_WARFARE";
Achievements[47] = "4 COOP_UNDEAD_SURVIVOR";
Achievements[48] = "4 COOP_EXO_SURVIVOR";
Achievements[49] = "4 COOP_FLIP_FLOP";
for (int i = 0; i < 50; i++)
{
RPC.Call(0x42D9A4, -1, 1, Achievements[i]);
System.Threading.Thread.Sleep(25);
RPC.Call(0x42D9A4, -1, 1, Achievements[i]);
}
}
SV_GameSendServerCommand // Credits to me
public void SV_GameSendServerCommand(int client, string command)
{
RPC.Call(0x42D9A4, client, 0, command + "\"");
}
iPrintln Funcs: //Credits to Me
iPrintlnBold(Center Screen)
public void iPrintlnBold(int client, string text)
{
SV_GameSendServerCommand(client, "c \"" + text + "\"");
}
iPrintln(Killfeed)
public void iPrintln(int client, string text)
{
SV_GameSendServerCommand(client, "e \"" + text + "\"");
}
Local Button Monitering //Thanks to xCSBKx (1.02)
public enum Key : uint
{
Cross = 0,
Circle = 1,
Square = 2,
Triangle = 3,
L1 = 4,
R1 = 5,
Start = 13,
Select = 14,
L3 = 15,
R3 = 16,
DPAD_UP = 19,
DPAD_DOWN = 20,
DPAD_LEFT = 21,
DPAD_RIGHT = 22,
STICK_UP = 27,
STICK_DOWN = 28,
STICK_LEFT = 29,
STICK_RIGHT = 30,
}
public static bool LocalKeyIsDown(Key k)
{
return PS3.Extension.ReadBool(0x00cee543 + ((uint)k * 0xC));
}
CBuf_AddText // Ported from BO2(Shark's)
public void Cbuf_AddText(string CMD)
{
RPC.Call(0x38AEA4, 0, Command);
}
Hud Elements: //(1.03) Thanks to Shark for the struct, BLB for making setShader and setText, and me for the rest
class Huds
{
static PS3API PS3 = new PS3API();
public static void enableHUDS()
{
byte[] StringPrecacher_PPC = new byte[] { 0x3C, 0x60, 0x02, 0x10, 0x88, 0x83, 0x00, 0x00, 0x2C, 0x04, 0x00, 0x00, 0x41, 0x82, 0x02, 0xDC, 0x4B, 0xBB, 0x14, 0x31, 0x3C, 0x80, 0x02, 0x10, 0x90, 0x64, 0x50, 0x00, 0x38, 0x60, 0x00, 0x00, 0x90, 0x64, 0x00, 0x00, 0x48, 0x00, 0x02, 0xC4, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0xE8, 0x01, 0x05, 0x20, 0x7C, 0x08, 0x03, 0xA6 };
// PS3.Pause(); //safety first 
PS3.SetMemory(0x49B638, StringPrecacher_PPC); //its being called in the fps function
// PS3.Continue();
}
public static class Addresses
{ //1.02
public static uint hudElem_s = 0x176E6E8;
}
public static class HUDS
{
public static class hud
{
public static uint active = 0x00,
font = 0x04,
alignOrg = 0x08,
alignScreen = 0x0C,
x = 0x10,
y = 0x14,
z = 0x18,
type = 0x1C,
clientNum = 0xB0, //Incorrect
fontScale = 0x20,
color = 0x30,
fromColor = 0x34,
fadeStartTime = 0x38,
fadeTime = 0x3C,
width = 0x44,
height = 0x48,
material = 0x4C,
fromWidth = 0x50,
fromHeight = 0x54,
scaleStartTime = 0x58,
scaleTime = 0x5C,
fromX = 0x60,
fromY = 0x64,
fromAlignOrg = 0x68,
fromAlignScreen = 0x6C,
moveStartTime = 0x70,
moveTime = 0x74,
value = 0x80,
text = 0x84,
glowColor = 0x8C;
}
public static int precacheString(string txt)
{
while (PS3.Extension.ReadByte(0x2100000) != 0) { }//wait if it's being used...
PS3.Extension.WriteString(0x2100000, txt);
System.Threading.Thread.Sleep(25);
return PS3.Extension.ReadInt32(0x2105000);
}
public static void hudDestroy(int index)
{
byte[] eraser = new byte[0xBC];
PS3.SetMemory(Addresses.hudElem_s + (uint)index * 0xBC, eraser);
}
public static void spawnText(int clientIndex, int index, string text, float x, float y, int font, float fontScale, int r, int g, int b, int a, int r1, int g1, int b1, int a1)
{
uint elem = Addresses.hudElem_s + (uint)index * 0xBC;
PS3.Extension.WriteInt32(elem + hud.clientNum, clientIndex);
PS3.Extension.WriteInt32(elem + hud.text, precacheString(text));
PS3.Extension.WriteFloat(elem + hud.x, x);
PS3.Extension.WriteFloat(elem + hud.y, y);
PS3.Extension.WriteInt32(elem + hud.font, font);
PS3.Extension.WriteFloat(elem + hud.fontScale, fontScale);
PS3.SetMemory(elem + hud.color, new byte[] { Convert.ToByte(r), Convert.ToByte(g), Convert.ToByte(b), Convert.ToByte(a) });
PS3.SetMemory(elem + hud.glowColor, new byte[] { Convert.ToByte(r1), Convert.ToByte(g1), Convert.ToByte(b1), Convert.ToByte(a1) });
PS3.Extension.WriteInt32(elem + hud.type, 1);
PS3.Extension.WriteInt32(elem + hud.active, 1);
}
public static void spawnShader(int clientIndex, int index, int material, float x, float y, int width, int height, int r, int g, int b, int a)
{
uint elem = Addresses.hudElem_s + (uint)index * 0xBC;
PS3.Extension.WriteInt32(elem + hud.clientNum, clientIndex);
PS3.Extension.WriteInt32(elem + hud.material, material);
PS3.Extension.WriteFloat(elem + hud.x, x);
PS3.Extension.WriteFloat(elem + hud.y, y);
PS3.Extension.WriteInt32(elem + hud.width, width);
PS3.Extension.WriteInt32(elem + hud.height, height);
PS3.Extension.WriteInt32(elem + hud.height, height);
PS3.Extension.WriteInt32(elem + hud.height, height);
PS3.SetMemory(elem + hud.color, new byte[] { Convert.ToByte(r), Convert.ToByte(g), Convert.ToByte(b), Convert.ToByte(a) });
PS3.Extension.WriteInt32(elem + hud.type, 4);
PS3.Extension.WriteInt32(elem + hud.active, 1);
}
public static void changeText(int Elem, string text)
{
uint elem = Addresses.hudElem_s + (uint)Elem * 0xBC;
PS3.Extension.WriteInt32(elem + hud.text, precacheString(text));
}
public static uint GetLevelTime()
{
return PS3.Extension.ReadUInt32(0x179D700 /*Thanks to Shark for the Level_Local_t*/ + 0x4C0);
}
public static uint MoveOverTime(int Elem, short Time, float X, float Y)
{
uint elem = Addresses.hudElem_s + ((uint)Elem) * 0xBC;
PS3.Extension.WriteFloat(elem + hud.fromX, PS3.Extension.ReadFloat(elem + hud.x));
PS3.Extension.WriteFloat(elem + hud.fromY, PS3.Extension.ReadFloat(elem + hud.y));
PS3.Extension.WriteInt32(elem + hud.moveTime, Time);
PS3.Extension.WriteInt32(elem + hud.moveStartTime, (Int32)GetLevelTime());
PS3.Extension.WriteFloat(elem + hud.x, X);
PS3.Extension.WriteFloat(elem + hud.y, Y);
return (uint)Elem;
}
public static uint MoveYOverTime(int Elem, short Time, float Y)
{
uint elem = Addresses.hudElem_s + ((uint)Elem) * 0xBC;
PS3.Extension.WriteFloat(elem + hud.fromY, PS3.Extension.ReadFloat(elem + hud.y));
PS3.Extension.WriteInt32(elem + hud.moveTime, Time);
PS3.Extension.WriteInt32(elem + hud.moveStartTime, (Int32)GetLevelTime());
PS3.Extension.WriteFloat(elem + hud.y, Y);
return (uint)Elem;
}
}
}
Aimbot: // Thanks to Bee el Bee (1.02)
https://pastebin.com/YTnXukEu
Spawning Entities: //Thanks to xReaperV3 (1.03)
public static float[] getPlayerOrigin(int clientIndex)
{
return RPC.ReadSingle(G_Client(clientIndex, 0x7, 3);
}
public static float[] getPlayerAngles(int clientIndex)
{
return RPC.ReadSingle(G_Client(clientIndex, 0x1B4), 3);
}
public static uint spawnEntity(string ModelName, float[] Origin, float[] Angles)
{
uint Entity = (uint)RPC.Call(0x36366;
RPC.WriteSingle(Entity + 0x138, Origin);
RPC.WriteSingle(Entity + 0x148, Angles);
RPC.Call(0x36241C, Entity, ModelName);
RPC.Call(0x3584EC, Entity);
return Entity;
}
Clone Player: //Thanks to xReaperV3(1.03)
public static void ClonePlayer(int clientIndex)
{
RPC.Call(0x303C68, new object[] { clientIndex });
}
Advanced Uav: 0x18DB73, On: 0x00 Off: 0x01
add this to you're non-host
The following user thanked Confusing for this useful post:
11-25-2014, 01:21 PM
#204
Eddie Mac
At least I can fight
Originally posted by Swaqq
Finally Updated 
Here is all the Non-Host stuff from my 1.02 tool and more idk.
NON-HOST 1.04
======================================
bg_compassShowEnemies (UAV) = 0x025b5614 ON = 0x01
Advanced UAV = 0x018DB73 ON = 0x00
No recoil = 0x020C8FC = nop off = 4B F6 16 5D
steady aim = 0x016E96f = 0x00
RedBoxes = 0x019610C = nop
r_znear (Wall Hack) = 0x02598bec - off = 40 on = 42
compassMaxRange = 0x025b580c - off = 44 bb on = 45 2f
cg_fov = 0x025b607c - 0ff = 42, 82 on = 42, d2
chrome players = 0x05D60D3 - off = 0x00 on = 0x01
camera_thirdPerson = 0x025b502c - 0ff = 00 on = 01
laser = 0x01FF703 - 0ff = 00 on = 01
Real Wallhack = 0x01C3424 On - 0x38, 0xC0, 0x00, 0x09 Off - 0x63, 0xC6, 0x00, 0x00
Player Outline = 0x01FF6F3 0n = 08 off = 00
======================================
11-25-2014, 01:47 PM
#205
xReaperv3
Bounty hunter
Originally posted by Swaqq
Hello Guys!
Welcome to my Updated version of this Addresses/Offsets/Scripts Thread
Everything on this Thread has credits, so be sure to check those people out !
Please feel free to add scripts/addresses in the reply section
Last Updated: 11/24/14 7:55PM EST - Changed Themes and Updated Addresses !
Addresses
Stats: //Unknown Credits
Non-Host: // MegaMister (1.04)
Offsets
G_Client : Size = 0x4180 //Thanks to xCSBKx
G_Entity : Size = 0x280 //Thanks to xCSBKx
Scripts
RPC: //Credit to SC58
All Clients Button Monitering: //Thanks to iTnDM
Jetpack: //Thanks again to Black Panther
Unlock All Trophies: //Thanks to SC58
SV_GameSendServerCommand // Credits to me
iPrintln Funcs: //Credits to Me
iPrintlnBold(Center Screen)
iPrintln(Killfeed)
CBuf_AddText // Ported from BO2(Shark's)
Hud Elements: //Tvhanks to Shark for the struct, BLB for making setShader and setText, and me for the rest
Aimbot: // Thanks to Bee el Bee
Spawning Entities: //Thanks to xReaperV3
Clone Player: //Thanks to xReaperV3
Other Useful Things
Welcome to my Updated version of this Addresses/Offsets/Scripts Thread
Everything on this Thread has credits, so be sure to check those people out !
Please feel free to add scripts/addresses in the reply section
Last Updated: 11/24/14 7:55PM EST - Changed Themes and Updated Addresses !
Addresses
--Found by xReaperV3-- //1.04
//Standard Shit
TOC = 0x994F68,
G_Client = 0x1950880,
G_Entity = 0x1860880,
//Functions
TeleportPlayer = 0x31A010,
G_Spawn = 0x3669B0,
G_SetModel = 0x365738,
SetClientViewAngles = 0x2F4530,
G_ExplodeMissile = 0x31D638,
G_FireGrenade = 0x323568,
G_FireRocket = 0x323928,
G_SpawnTurret = 0x37B4F8,
Weapon_RocketLauncherFire = 0x3697B8,
G_GivePlayerWeapon = 0x36A6A0,
Add_Ammo = 0x3101C0,
BG_FindWeaponIndexForName = 0x168074,
Com_Sprintf = 0x4C7548,
Dvar_GetBool = 0x4BF0F8,
SV_GameSendServerCommand = 0x42D9A4,
//RPC
R_SetFrameFog = 0x5FCBF0,
//Hud Elems
G_HudElems = 0x17B9670,
G_LocalizedStringIndex = 0x4C9A8,
LevelTime = 0x17E8680,
//Anti-Ban
(Set all to 0x60, 0x00, 0x00, 0x00)
- 0x590DBC
- 0x590DC4
- 0x5912A0
- 0x5931F0
- 0x593274
- 0x593280
- 0x593288
Stats: //Unknown Credits
Score : 0x295c746
Name : 0x28e60e0
Prestige : 0x295c66d
Kills : 0x295c71e
Deaths : 0x295c6f5
Wins : 0x295c772
Losses : 0x295c725
Xp : 0x295c709
Time played : 0x295c762
Games played : 0x295c70d
Non-Host: // MegaMister (1.04)
Advanced UAV : 0x18DB73, On: 0x00 Off: 0x01
Red Boxes : 0x0019610b (01 on / 00 off)
No Recoil : 0x0020c8a3 (nop on / 00 41 82 00 off)
Green Players : 0x005d60d3 (01 on / 00 off)
High Light Players : 0x001ff6f3 (04 red / 00 off) (change bytes for other colours)
Laser : 0x001ff703 ( 01 on / 00 off)
Explosive Bullets : 0x0016fe9f (01 on / 00 off)
Steady Aim : 0x0016e96f ( 00 on / 02 off)
Offsets
G_Client : Size = 0x4180 //Thanks to xCSBKx
G_Client + 0x78 = Origin
G_Client + 0x1b4 = Angles
G_Client + 0x0562 = Weapon Flags // {0x8, 0x0} = Disable Switching, {0x0, 0x80} = Disable Weapons, {0x0, 0x20} = Disable Zoom, {0x04, 0x0} = NoRecoil
G_Client + 0x58C = Secondary Ammo
G_Client + 0x5A4 = Primary Ammo
G_Client + 0x640 = Secondary Clip
G_Client + 0x658 = Primary Clip
G_Client + 0xa64 = Button Monitoring
G_Client + 0xB3c = Name
G_Client + 0x3da7 = mFlag //0x1 = Ufo, 0x2 = NoClip, 0x4 = Freeze
G_Entity : Size = 0x280 //Thanks to xCSBKx
0x158 = Pointer to G_Client // Thanks to Shark
0x1AC = Health
Scripts
RPC: //Credit to SC58
public class RPC
{
static uint function_address = 0x5FCBF0; // R_SetFrameFog
public static int Init()
{
if (function_address == 0) return -1;
Enable_RPC();
return 0;
}
public static void Enable_RPC()
{
PS3.SetMemory(function_address, new byte[] { 0x4E, 0x80, 0x00, 0x20 });
System.Threading.Thread.Sleep(20);
byte[] func = new byte[] { 0x7C, 0x08, 0x02, 0xA6, 0xF8, 0x01, 0x00, 0x80, 0x3C, 0x60, 0x10, 0x05, 0x81, 0x83, 0x00, 0x4C, 0x2C, 0x0C, 0x00, 0x00, 0x41, 0x82, 0x00, 0x64, 0x80, 0x83, 0x00, 0x04, 0x80, 0xA3, 0x00, 0x08, 0x80, 0xC3, 0x00, 0x0C, 0x80, 0xE3, 0x00, 0x10, 0x81, 0x03, 0x00, 0x14, 0x81, 0x23, 0x00, 0x18, 0x81, 0x43, 0x00, 0x1C, 0x81, 0x63, 0x00, 0x20, 0xC0, 0x23, 0x00, 0x24, 0xC0, 0x43, 0x00, 0x28, 0xC0, 0x63, 0x00, 0x2C, 0xC0, 0x83, 0x00, 0x30, 0xC0, 0xA3, 0x00, 0x34, 0xC0, 0xC3, 0x00, 0x38, 0xC0, 0xE3, 0x00, 0x3C, 0xC1, 0x03, 0x00, 0x40, 0xC1, 0x23, 0x00, 0x48, 0x80, 0x63, 0x00, 0x00, 0x7D, 0x89, 0x03, 0xA6, 0x4E, 0x80, 0x04, 0x21, 0x3C, 0x80, 0x10, 0x05, 0x38, 0xA0, 0x00, 0x00, 0x90, 0xA4, 0x00, 0x4C, 0x80, 0x64, 0x00, 0x50, 0xE8, 0x01, 0x00, 0x80, 0x7C, 0x08, 0x03, 0xA6, 0x38, 0x21, 0x00, 0x70, 0x4E, 0x80, 0x00, 0x20 };
PS3.SetMemory(function_address + 0x4, func);
PS3.SetMemory(0x10050000, new byte[0x2854]);
PS3.SetMemory(function_address, new byte[] { 0xF8, 0x21, 0xFF, 0x91 });
}
public static int Call(uint func_address, params object[] parameters)
{
int num_params = parameters.Length;
uint num_floats = 0;
for (uint i = 0; i < num_params; i++)
{
if (parameters[i] is int)
{
byte[] val = BitConverter.GetBytes((int)parameters[i]);
Array.Reverse(val);
PS3.SetMemory(0x10050000 + (i + num_floats) * 4, val);
}
else if (parameters[i] is uint)
{
byte[] val = BitConverter.GetBytes((uint)parameters[i]);
Array.Reverse(val);
PS3.SetMemory(0x10050000 + (i + num_floats) * 4, val);
}
else if (parameters[i] is string)
{
byte[] str = Encoding.UTF8.GetBytes(Convert.ToString(parameters[i]) + "\0");
PS3.SetMemory(0x10050054 + i * 0x400, str);
uint addr = 0x10050054 + i * 0x400;
byte[] address = BitConverter.GetBytes(addr);
Array.Reverse(address);
PS3.SetMemory(0x10050000 + (i + num_floats) * 4, address);
}
else if (parameters[i] is float)
{
num_floats++;
byte[] val = BitConverter.GetBytes((float)parameters[i]);
Array.Reverse(val);
PS3.SetMemory(0x10050024 + ((num_floats - 1) * 0x4), val);
}
}
byte[] fadd = BitConverter.GetBytes(func_address);
Array.Reverse(fadd);
PS3.SetMemory(0x1005004C, fadd);
System.Threading.Thread.Sleep(20);
byte[] ret = PS3.GetMemory(0x10050050, 4);
Array.Reverse(ret);
return BitConverter.ToInt32(ret, 0);
}
}
All Clients Button Monitering: //Thanks to iTnDM
class Buttons
{
public static class Buttonz
{
public static Int32
Cross = 1024,
Square = 48,
Crouch = 512,
Prone = 256,
Start = 8388608,
L1 = 526336,
L2 = 32768,
L3 = 8194,
R1 = 1,
R2 = 16384,
R3 = 67108868;
}
public static bool ButtonPressed(int client, int Buttons)
{
if (PS3.Extension.ReadInt32(G_Client + 0x3DB4 + ((uint)client * 0x4180)) == Buttons)
return true;
else return false;
}
Jetpack: //Thanks again to Black Panther
public void JetPack(int client)
{
float jH = PS3.Extension.ReadFloat(G_Client + ((uint)client * 0x4180));
jH += 100;
PS3.Extension.WriteFloat(G_Client + ((uint)client * 0x4180), jH);
}
//How to use it in a timer or backgroundworker
if(ButtonPressed(0, Buttons.Cross))
{
JetPack(0);
}
Unlock All Trophies: //Thanks to SC58
{
string[] Achievements = new string[50];
Achievements[0] = "4 CARMA";
Achievements[1] = "4 CAMPAIGN_COMPLETE";
Achievements[2] = "4 CAMPAIGN_HARDENED";
Achievements[3] = "4 CAMPAIGN_VETERAN";
Achievements[4] = "4 BOOST_DASH_STOMP";
Achievements[5] = "4 GRENADE_DODGE";
Achievements[6] = "4 SONIC_KILL";
Achievements[7] = "4 OVERDRIVE_KILL";
Achievements[8] = "4 SMART_GRENADE_KILL";
Achievements[9] = "4 THREAT_GRENADE_KILL";
Achievements[10] = "4 EMP_DRONE";
Achievements[11] = "4 EMP_AST";
Achievements[12] = "4 INTEL_HALF";
Achievements[13] = "4 INTEL_ALL";
Achievements[14] = "4 COVER_DRONE_KILL";
Achievements[15] = "4 EXO_UPGRADE";
Achievements[16] = "4 EXO_UPGRADE_10";
Achievements[17] = "4 EXO_UPGRADE_20";
Achievements[18] = "4 EXO_UPGRADE_FULL";
Achievements[19] = "4 LEVEL_1";
Achievements[20] = "4 LEVEL_1A";
Achievements[21] = "4 LEVEL_2A";
Achievements[22] = "4 LEVEL_2B";
Achievements[23] = "4 LEVEL_2";
Achievements[24] = "4 LEVEL_3A";
Achievements[25] = "4 LEVEL_3";
Achievements[26] = "4 LEVEL_4A";
Achievements[27] = "4 LEVEL_4";
Achievements[28] = "4 LEVEL_5";
Achievements[29] = "4 LEVEL_5A";
Achievements[30] = "4 LEVEL_6A";
Achievements[31] = "4 LEVEL_6";
Achievements[32] = "4 LEVEL_7";
Achievements[33] = "4 LEVEL_8A";
Achievements[34] = "4 LEVEL_8";
Achievements[35] = "4 LEVEL_9";
Achievements[36] = "4 LEVEL_10A";
Achievements[37] = "4 LEVEL_10";
Achievements[38] = "4 LEVEL_11";
Achievements[39] = "4 LEVEL_12A";
Achievements[40] = "4 LEVEL_12";
Achievements[41] = "4 LEVEL_13A";
Achievements[42] = "4 LEVEL_13";
Achievements[43] = "4 LEVEL_14A";
Achievements[44] = "4 LEVEL_14";
Achievements[45] = "4 COOP_VETERAN";
Achievements[46] = "4 COOP_WARFARE";
Achievements[47] = "4 COOP_UNDEAD_SURVIVOR";
Achievements[48] = "4 COOP_EXO_SURVIVOR";
Achievements[49] = "4 COOP_FLIP_FLOP";
for (int i = 0; i < 50; i++)
{
RPC.Call(0x42D9A4, -1, 1, Achievements[i]);
System.Threading.Thread.Sleep(25);
RPC.Call(0x42D9A4, -1, 1, Achievements[i]);
}
}
SV_GameSendServerCommand // Credits to me
public void SV_GameSendServerCommand(int client, string command)
{
RPC.Call(0x42D9A4, client, 0, command + "\"");
}
iPrintln Funcs: //Credits to Me
iPrintlnBold(Center Screen)
public void iPrintlnBold(int client, string text)
{
SV_GameSendServerCommand(client, "c \"" + text + "\"");
}
iPrintln(Killfeed)
public void iPrintln(int client, string text)
{
SV_GameSendServerCommand(client, "e \"" + text + "\"");
}
CBuf_AddText // Ported from BO2(Shark's)
public void Cbuf_AddText(string CMD)
{
RPC.Call(0x38AEA4, 0, Command);
}
Hud Elements: //Tvhanks to Shark for the struct, BLB for making setShader and setText, and me for the rest
https://pastebin.com/igYGgxQt
Aimbot: // Thanks to Bee el Bee
https://pastebin.com/YTnXukEu
Spawning Entities: //Thanks to xReaperV3
public static float[] getPlayerOrigin(int clientIndex)
{
return RPC.ReadSingle(G_Client(clientIndex, 0x7, 3);
}
public static float[] getPlayerAngles(int clientIndex)
{
return RPC.ReadSingle(G_Client(clientIndex, 0x1B4), 3);
}
public static uint spawnEntity(string ModelName, float[] Origin, float[] Angles)
{
uint Entity = (uint)RPC.Call(0x3669B0);
RPC.WriteSingle(Entity + 0x138, Origin);
RPC.WriteSingle(Entity + 0x148, Angles);
RPC.Call(0x365738, Entity, ModelName);
RPC.Call(0x35B6C4, Entity);
return Entity;
}
Clone Player: //Thanks to xReaperV3
public static void ClonePlayer(int clientIndex)
{
RPC.Call(0x38AEA4, new object[] { clientIndex });
}
Other Useful Things
https://www.nextgenupdate.com/forums/call-duty-advanced-warfare-modding/776607-advanced-warfare-c-script-thread.html - C++ Scripts
The G_Client Button Monitoring looks wrong, use this one: 0x3DB4, im unsure if yours work
11-25-2014, 10:21 PM
#208
xReaperv3
Bounty hunter
Originally posted by gsrclans
If you can find me 3 address please :$ ? ( SV_SetBrushModel / SV_LinkEntity / SV_UnLinkEntity ) , thanks
SV_LinkEntity = 0x448B10
SV_UnlinkEntity = 0x448A90
SV_SetBrushModel = 0x42DC44
SP_Script_BrushModel = 0x35B658
client_s = 0x212F710 #DWORD (Found in SV_GameSendServerCommand | Thanks to Bitwise)
Should be in there
The following user thanked xReaperv3 for this useful post:
Copyright © 2026, NextGenUpdate.
All Rights Reserved.
