Post: [C#][1.10] Spawning Solid Models
03-23-2014, 11:33 AM #1
VezahMoDz
Do a barrel roll!
(adsbygoogle = window.adsbygoogle || []).push({}); As Some people still dont know how to replace the offsets xD and I havent seen that Seb updated his Thread for 1.09 + i got asked a lot for it

Credits to Seb for the Original release :P

    
public static uint
G_SpawnAddress = 0x28EAB8,
G_SetModel = 0x28D6AC,
SP_Script_Model = 0x2843C0,
SV_UnlinkEntity = 0x329D10,
SV_LinkEntity = 0x329D90,
G_EntityAddress = 0xE04480,
SV_SetBrushModel = 0x4CE068;

public static Int32 G_Spawn()
{
return RPC.Call(G_SpawnAddress);
}
public static Int32 SpawnCrate(String MapName, Single X, Single Y, Single Z, Single Forward = 0, Single Yaw = 0, Single Pitch = 0)
{
return SpawnModel(MapName, "carepackage_friendly_iw6", X, Y, Z, Forward, Yaw, Pitch);
}
public static void MoveEnt(int ent, float x, float y, float z)
{
Byte[] buffer = new Byte[24];
ArrayBuilder Build = new ArrayBuilder(buffer);
Build.Write.SetFloat(0, x);
Build.Write.SetFloat(4, y);
Build.Write.SetFloat(8, z);
PS3.Extension.WriteBytes((UInt32)ent + 0x138, buffer);
}
public static Int32 SpawnModel(String MapName, String ModelName, Single X, Single Y, Single Z, Single Forward = 0, Single Yaw = 0, Single Pitch = 0)
{
Int32 Ent = G_Spawn();
Byte[] buffer = new Byte[24];
ArrayBuilder Build = new ArrayBuilder(buffer);
Build.Write.SetFloat(0, X);
Build.Write.SetFloat(4, Y);
Build.Write.SetFloat(8, Z);
Build.Write.SetFloat(12, Forward);
Build.Write.SetFloat(16, Yaw);
Build.Write.SetFloat(20, Pitch);
PS3.Extension.WriteBytes((UInt32)Ent + 0x138, buffer);
RPC.Call(G_SetModel, Ent, ModelName);
RPC.Call(SP_Script_Model, Ent);
MakeSolid(Ent, MapName);
return Ent;
}
public static void MakeSolid(Int32 Entity, String Mapname)
{
RPC.Call(SV_UnlinkEntity, Entity);
PS3.Extension.WriteByte((UInt32)Entity + 0x101, 4);
UInt32 Brush = 0;
switch (Mapname)
{
case "mp_prisonbreak":
Brush = G_Entity(0x3Cool Man (aka Tustin);
break;
case "mp_dart":
Brush = G_Entity(0x6B);
break;
case "mp_lonestar":
Brush = G_Entity(0x6A);
break;
case "mp_frag":
Brush = G_Entity(0x55);
break;
case "mp_snow":
Brush = G_Entity(0x56);
break;
case "mp_fahrenheit":
Brush = G_Entity(0xACool Man (aka Tustin);
break;
case "mp_hasima":
Brush = G_Entity(0x63);
break;
case "mp_warhawk":
Brush = G_Entity(0x45);
break;
case "mp_sovereign":
Brush = G_Entity(0x72);
break;
case "mp_zebra":
Brush = G_Entity(0x44);
break;
case "mp_skeleton":
Brush = G_Entity(0x3A);
break;
case "mp_chasm":
Brush = G_Entity(0x49);
break;
case "mp_flooded":
Brush = G_Entity(0x57);
break;
case "mp_strikezone":
Brush = G_Entity(0x57);
break;
}
PS3.Extension.WriteUInt32((UInt32)Entity + 0x8C, PS3.Extension.ReadUInt32(Brush + 0x8C));
RPC.Call(SV_SetBrushModel, Entity);
Or_Int32((UInt32)Entity + 0x11C, PS3.Extension.ReadInt32((UInt32)Entity + 0x11C));
RPC.Call(SV_LinkEntity, Entity);
}
public static UInt32 G_Entity(Int32 clientIndex)
{
return G_EntityAddress + ((UInt32)clientIndex * 0x280);
}

public static void Or_Int32(UInt32 address, Int32 input)
{
Int32 or = PS3.Extension.ReadInt32(address);
or |= input;
PS3.Extension.WriteInt32(address, or);
}


Also here's getOrigin for those who need it :
    
public static uint G_Client(int clientIndex, uint Mod)
{
return (0xF44480 + (UInt32)Mod) + ((uint)clientIndex * 0x3700);
}
public static float[] getOrigin(int clientIndex)
{
return ReadSingle(G_Client(clientIndex, 0x1C), 3);
}


And For those who dont have ReadSingle:
    
public static float[] ReadSingle(uint address, int length)
{
byte[] mem = PS3.Extension.ReadBytes(address, length * 4);
ReverseBytes(mem);
float[] numArray = new float[length];
for (int index = 0; index < length; ++index)
numArray[index] = BitConverter.ToSingle(mem, (length - 1 - index) * 4);
return numArray;
}

public static byte[] ReverseBytes(byte[] inArray)
{
Array.Reverse(inArray);
return inArray;
}
(adsbygoogle = window.adsbygoogle || []).push({});

The following 12 users say thank you to VezahMoDz for this useful post:

-SuperMan, $ticky, BuC-ShoTz, coreconfusion, D3skm, FusionIsDaName, ItsLollo1000, Mango_Knife, MrKiller261, Notorious, ThePaaqoHD, Fatality
03-23-2014, 01:12 PM #2
Notorious
Caprisuns Is Back
Originally posted by VezahMoDz View Post
As Some people still dont know how to replace the offsets xD and I havent seen that Seb updated his Thread for 1.09 + i got asked a lot for it

Credits to Seb for the Original release :P

    
public static uint
G_SpawnAddress = 0x28CB70,
G_SetModel = 0x28B764,
SP_Script_Model = 0x282428,
SV_UnlinkEntity = 0x327C10,
SV_LinkEntity = 0x327C90,
G_EntityAddress = 0xE03B00,
SV_SetBrushModel = 0x59B7D8;

public static Int32 G_Spawn()
{
return RPC.Call(G_SpawnAddress);
}
public static Int32 SpawnCrate(String MapName, Single X, Single Y, Single Z, Single Forward = 0, Single Yaw = 0, Single Pitch = 0)
{
return SpawnModel(MapName, "carepackage_friendly_iw6", X, Y, Z, Forward, Yaw, Pitch);
}
public static void MoveEnt(int ent, float x, float y, float z)
{
Byte[] buffer = new Byte[24];
ArrayBuilder Build = new ArrayBuilder(buffer);
Build.Write.SetFloat(0, x);
Build.Write.SetFloat(4, y);
Build.Write.SetFloat(8, z);
PS3.Extension.WriteBytes((UInt32)ent + 0x138, buffer);
}
public static Int32 SpawnModel(String MapName, String ModelName, Single X, Single Y, Single Z, Single Forward = 0, Single Yaw = 0, Single Pitch = 0)
{
Int32 Ent = G_Spawn();
Byte[] buffer = new Byte[24];
ArrayBuilder Build = new ArrayBuilder(buffer);
Build.Write.SetFloat(0, X);
Build.Write.SetFloat(4, Y);
Build.Write.SetFloat(8, Z);
Build.Write.SetFloat(12, Forward);
Build.Write.SetFloat(16, Yaw);
Build.Write.SetFloat(20, Pitch);
PS3.Extension.WriteBytes((UInt32)Ent + 0x138, buffer);
RPC.Call(G_SetModel, Ent, ModelName);
RPC.Call(SP_Script_Model, Ent);
MakeSolid(Ent, MapName);
return Ent;
}
public static void MakeSolid(Int32 Entity, String Mapname)
{
RPC.Call(SV_UnlinkEntity, Entity);
PS3.Extension.WriteByte((UInt32)Entity + 0x101, 4);
UInt32 Brush = 0;
switch (Mapname)
{
case "mp_prisonbreak":
Brush = G_Entity(0x3Cool Man (aka Tustin);
break;
case "mp_dart":
Brush = G_Entity(0x6B);
break;
case "mp_lonestar":
Brush = G_Entity(0x6A);
break;
case "mp_frag":
Brush = G_Entity(0x55);
break;
case "mp_snow":
Brush = G_Entity(0x56);
break;
case "mp_fahrenheit":
Brush = G_Entity(0xACool Man (aka Tustin);
break;
case "mp_hasima":
Brush = G_Entity(0x63);
break;
case "mp_warhawk":
Brush = G_Entity(0x45);
break;
case "mp_sovereign":
Brush = G_Entity(0x72);
break;
case "mp_zebra":
Brush = G_Entity(0x44);
break;
case "mp_skeleton":
Brush = G_Entity(0x3A);
break;
case "mp_chasm":
Brush = G_Entity(0x49);
break;
case "mp_flooded":
Brush = G_Entity(0x57);
break;
case "mp_strikezone":
Brush = G_Entity(0x57);
break;
}
PS3.Extension.WriteUInt32((UInt32)Entity + 0x8C, PS3.Extension.ReadUInt32(Brush + 0x8C));
RPC.Call(SV_SetBrushModel, Entity);
Or_Int32((UInt32)Entity + 0x11C, PS3.Extension.ReadInt32((UInt32)Entity + 0x11C));
RPC.Call(SV_LinkEntity, Entity);
}
public static UInt32 G_Entity(Int32 clientIndex)
{
return G_EntityAddress + ((UInt32)clientIndex * 0x280);
}

public static void Or_Int32(UInt32 address, Int32 input)
{
Int32 or = PS3.Extension.ReadInt32(address);
or |= input;
PS3.Extension.WriteInt32(address, or);
}


Nice Job Vezah :yes:
03-23-2014, 01:18 PM #3
Mango_Knife
In my man cave
Originally posted by VezahMoDz View Post
As Some people still dont know how to replace the offsets xD and I havent seen that Seb updated his Thread for 1.09 + i got asked a lot for it

Credits to Seb for the Original release :P

    
public static uint
G_SpawnAddress = 0x28CB70,
G_SetModel = 0x28B764,
SP_Script_Model = 0x282428,
SV_UnlinkEntity = 0x327C10,
SV_LinkEntity = 0x327C90,
G_EntityAddress = 0xE03B00,
SV_SetBrushModel = 0x59B7D8;

public static Int32 G_Spawn()
{
return RPC.Call(G_SpawnAddress);
}
public static Int32 SpawnCrate(String MapName, Single X, Single Y, Single Z, Single Forward = 0, Single Yaw = 0, Single Pitch = 0)
{
return SpawnModel(MapName, "carepackage_friendly_iw6", X, Y, Z, Forward, Yaw, Pitch);
}
public static void MoveEnt(int ent, float x, float y, float z)
{
Byte[] buffer = new Byte[24];
ArrayBuilder Build = new ArrayBuilder(buffer);
Build.Write.SetFloat(0, x);
Build.Write.SetFloat(4, y);
Build.Write.SetFloat(8, z);
PS3.Extension.WriteBytes((UInt32)ent + 0x138, buffer);
}
public static Int32 SpawnModel(String MapName, String ModelName, Single X, Single Y, Single Z, Single Forward = 0, Single Yaw = 0, Single Pitch = 0)
{
Int32 Ent = G_Spawn();
Byte[] buffer = new Byte[24];
ArrayBuilder Build = new ArrayBuilder(buffer);
Build.Write.SetFloat(0, X);
Build.Write.SetFloat(4, Y);
Build.Write.SetFloat(8, Z);
Build.Write.SetFloat(12, Forward);
Build.Write.SetFloat(16, Yaw);
Build.Write.SetFloat(20, Pitch);
PS3.Extension.WriteBytes((UInt32)Ent + 0x138, buffer);
RPC.Call(G_SetModel, Ent, ModelName);
RPC.Call(SP_Script_Model, Ent);
MakeSolid(Ent, MapName);
return Ent;
}
public static void MakeSolid(Int32 Entity, String Mapname)
{
RPC.Call(SV_UnlinkEntity, Entity);
PS3.Extension.WriteByte((UInt32)Entity + 0x101, 4);
UInt32 Brush = 0;
switch (Mapname)
{
case "mp_prisonbreak":
Brush = G_Entity(0x3Cool Man (aka Tustin);
break;
case "mp_dart":
Brush = G_Entity(0x6B);
break;
case "mp_lonestar":
Brush = G_Entity(0x6A);
break;
case "mp_frag":
Brush = G_Entity(0x55);
break;
case "mp_snow":
Brush = G_Entity(0x56);
break;
case "mp_fahrenheit":
Brush = G_Entity(0xACool Man (aka Tustin);
break;
case "mp_hasima":
Brush = G_Entity(0x63);
break;
case "mp_warhawk":
Brush = G_Entity(0x45);
break;
case "mp_sovereign":
Brush = G_Entity(0x72);
break;
case "mp_zebra":
Brush = G_Entity(0x44);
break;
case "mp_skeleton":
Brush = G_Entity(0x3A);
break;
case "mp_chasm":
Brush = G_Entity(0x49);
break;
case "mp_flooded":
Brush = G_Entity(0x57);
break;
case "mp_strikezone":
Brush = G_Entity(0x57);
break;
}
PS3.Extension.WriteUInt32((UInt32)Entity + 0x8C, PS3.Extension.ReadUInt32(Brush + 0x8C));
RPC.Call(SV_SetBrushModel, Entity);
Or_Int32((UInt32)Entity + 0x11C, PS3.Extension.ReadInt32((UInt32)Entity + 0x11C));
RPC.Call(SV_LinkEntity, Entity);
}
public static UInt32 G_Entity(Int32 clientIndex)
{
return G_EntityAddress + ((UInt32)clientIndex * 0x280);
}

public static void Or_Int32(UInt32 address, Int32 input)
{
Int32 or = PS3.Extension.ReadInt32(address);
or |= input;
PS3.Extension.WriteInt32(address, or);
}


Greate :yes:
Very Helpfull =D
By the way, how do i get the origin? Like the location?

The following user thanked Mango_Knife for this useful post:

Notorious
03-23-2014, 01:21 PM #4
Notorious
Caprisuns Is Back
Originally posted by Knife View Post
Greate :yes:
Very Helpfull =D
By the way, how do i get the origin? Like the location?


I was thinking the same
03-23-2014, 01:24 PM #5
RatchetBooty
Former Staff
Originally posted by Prime
I was thinking the same


You use the g_entity origin offset, find it in debugger it's right beside g_entity.
03-23-2014, 01:28 PM #6
Notorious
Caprisuns Is Back
Originally posted by RatchetBooty View Post
You use the g_entity origin offset, find it in debugger it's right beside g_entity.


i have it :troll:
03-23-2014, 01:50 PM #7
VezahMoDz
Do a barrel roll!
Added getOrigin Cool Troll

The following user thanked VezahMoDz for this useful post:

Notorious
03-23-2014, 08:02 PM #8
Mango_Knife
In my man cave
Originally posted by VezahMoDz View Post
As Some people still dont know how to replace the offsets xD and I havent seen that Seb updated his Thread for 1.09 + i got asked a lot for it

Credits to Seb for the Original release :P

    
public static uint
G_SpawnAddress = 0x28CB70,
G_SetModel = 0x28B764,
SP_Script_Model = 0x282428,
SV_UnlinkEntity = 0x327C10,
SV_LinkEntity = 0x327C90,
G_EntityAddress = 0xE03B00,
SV_SetBrushModel = 0x59B7D8;

public static Int32 G_Spawn()
{
return RPC.Call(G_SpawnAddress);
}
public static Int32 SpawnCrate(String MapName, Single X, Single Y, Single Z, Single Forward = 0, Single Yaw = 0, Single Pitch = 0)
{
return SpawnModel(MapName, "carepackage_friendly_iw6", X, Y, Z, Forward, Yaw, Pitch);
}
public static void MoveEnt(int ent, float x, float y, float z)
{
Byte[] buffer = new Byte[24];
ArrayBuilder Build = new ArrayBuilder(buffer);
Build.Write.SetFloat(0, x);
Build.Write.SetFloat(4, y);
Build.Write.SetFloat(8, z);
PS3.Extension.WriteBytes((UInt32)ent + 0x138, buffer);
}
public static Int32 SpawnModel(String MapName, String ModelName, Single X, Single Y, Single Z, Single Forward = 0, Single Yaw = 0, Single Pitch = 0)
{
Int32 Ent = G_Spawn();
Byte[] buffer = new Byte[24];
ArrayBuilder Build = new ArrayBuilder(buffer);
Build.Write.SetFloat(0, X);
Build.Write.SetFloat(4, Y);
Build.Write.SetFloat(8, Z);
Build.Write.SetFloat(12, Forward);
Build.Write.SetFloat(16, Yaw);
Build.Write.SetFloat(20, Pitch);
PS3.Extension.WriteBytes((UInt32)Ent + 0x138, buffer);
RPC.Call(G_SetModel, Ent, ModelName);
RPC.Call(SP_Script_Model, Ent);
MakeSolid(Ent, MapName);
return Ent;
}
public static void MakeSolid(Int32 Entity, String Mapname)
{
RPC.Call(SV_UnlinkEntity, Entity);
PS3.Extension.WriteByte((UInt32)Entity + 0x101, 4);
UInt32 Brush = 0;
switch (Mapname)
{
case "mp_prisonbreak":
Brush = G_Entity(0x3Cool Man (aka Tustin);
break;
case "mp_dart":
Brush = G_Entity(0x6B);
break;
case "mp_lonestar":
Brush = G_Entity(0x6A);
break;
case "mp_frag":
Brush = G_Entity(0x55);
break;
case "mp_snow":
Brush = G_Entity(0x56);
break;
case "mp_fahrenheit":
Brush = G_Entity(0xACool Man (aka Tustin);
break;
case "mp_hasima":
Brush = G_Entity(0x63);
break;
case "mp_warhawk":
Brush = G_Entity(0x45);
break;
case "mp_sovereign":
Brush = G_Entity(0x72);
break;
case "mp_zebra":
Brush = G_Entity(0x44);
break;
case "mp_skeleton":
Brush = G_Entity(0x3A);
break;
case "mp_chasm":
Brush = G_Entity(0x49);
break;
case "mp_flooded":
Brush = G_Entity(0x57);
break;
case "mp_strikezone":
Brush = G_Entity(0x57);
break;
}
PS3.Extension.WriteUInt32((UInt32)Entity + 0x8C, PS3.Extension.ReadUInt32(Brush + 0x8C));
RPC.Call(SV_SetBrushModel, Entity);
Or_Int32((UInt32)Entity + 0x11C, PS3.Extension.ReadInt32((UInt32)Entity + 0x11C));
RPC.Call(SV_LinkEntity, Entity);
}
public static UInt32 G_Entity(Int32 clientIndex)
{
return G_EntityAddress + ((UInt32)clientIndex * 0x280);
}

public static void Or_Int32(UInt32 address, Int32 input)
{
Int32 or = PS3.Extension.ReadInt32(address);
or |= input;
PS3.Extension.WriteInt32(address, or);
}


Also here's getOrigin for those who need it :
    
public static uint G_Client(int clientIndex, uint Mod)
{
return (0xF43B00 + (UInt32)Mod) + ((uint)clientIndex * 0x3700);
}
public static float[] getOrigin(int clientIndex)
{
return ReadSingle(G_Client(clientIndex, 0x1C), 3);
}


And For those who dont have ReadSingle:
    
public static float[] ReadSingle(uint address, int length)
{
byte[] mem = PS3.Extension.ReadBytes(address, length * 4);
ReverseBytes(mem);
float[] numArray = new float[length];
for (int index = 0; index < length; ++index)
numArray[index] = BitConverter.ToSingle(mem, (length - 1 - index) * 4);
return numArray;
}

public static byte[] ReverseBytes(byte[] inArray)
{
Array.Reverse(inArray);
return inArray;
}


Here some models if anyone need:
    
Bomb - prop_suitcase_bomb
Vest - prop_ballistic_vest_iw6
Gold Vest - prop_ballistic_vest_iw6_bombsquad
Heavy Ammo Supply - prop_mp_max_ammo_pickup
Gold SATCOM - mp_satcom_obj
Red SATCOM - mp_satcom_obj_red
Intel - com_metal_briefcase_intel
Gold Trophy System - mp_trophy_system_iw6_bombsquad
Trophy System - mp_trophy_system_iw6

Juggernaut:
Heavy Juggernaut - mp_fullbody_juggernaut_heavy_black
Light Juggernaut - mp_body_juggernaut_light_black
Juggernaut Head - head_juggernaut_light_black


Infected Suit - mp_body_infected_a
Infected Head - head_mp_infected
Default - mp_body_us_rangers_assault_a_woodland
Elite Suit - mp_body_us_rangers_assault_a_elite
Small Bomb - mil_tntbomb_mp
Care Package - com_plasticcase_green_big_us_dirt
AC130 - vehicle_ac130_low_mp
Battle Hind - vehicle_battle_hind
Default Vehicle - defaultvehicle
Invisible - none
AAS 72X - vehicle_aas_72x_killstreak
Small Airplane - vehicle_skylark
Ball Drone - vehicle_ball_drone_iw6
Gryphon - vehicle_drone_vanguard
I.M.S - ims_scorpion_body_iw6

Prison Door -
Right Door - pbk_prison_door_right_01
Left Door - pbk_prison_door_left_01


Warthog - vehicle_a10_warthog_iw6_mp
Drone - vehicle_drone_backup_buddy
Gas Baloon - ims_scorpion_explosive_iw6
Wall - placeable_barrier

Natural Flag - prop_flag_neutral
Federation Flag - prop_flag_iw6_federation
Ghosts Flag - prop_flag_iw6_ghost


Dog - mp_fullbody_dog_a
Bomb Belt - mil_semtex_belt
CellPhone - com_cellphone_on

Tree's:
Long Tree - com_woodlog_16_192_d
Broken Tree - foliage_afr_tree_brokentrunk_01a


Gold Sentry - weapon_sentry_chaingun_obj
Red Sentry - weapon_sentry_chaingun_obj_red
Sentry - weapon_sentry_chaingun
Broken Sentry - weapon_sentry_chaingun_destroyed
Orange Sentry (Cant Place Sentry) - weapon_sentry_chaingun_bombsquad


TV - ny_harbor_slava_interior_props_monitor

Chain Saw - vehicle_drone_backup_buddy_gun
Vulture - vehicle_drone_backup_buddy

Juggernaut Care Package - mp_juggernaut_carepackage
Red Jaggernaut Care Package - mp_juggernaut_carepackage_red

Shield - weapon_riot_shield_jug_iw6
Small Airplane - vehicle_skylark

https://www.nextgenupdate.com/forums/call-duty-ghosts-mods-cheats-glitches/720318-how-spawn-change-models-clients-c-tutorial-source.html


Have Fun =D

The following 3 users say thank you to Mango_Knife for this useful post:

coreconfusion, Notorious, VezahMoDz
03-24-2014, 11:01 AM #9
$ticky
Banned
Originally posted by RatchetBooty View Post
You use the g_entity origin offset, find it in debugger it's right beside g_entity.


No its not, origin is located at, g_client + 0x1c :troll:
03-24-2014, 11:37 AM #10
RatchetBooty
Former Staff
Originally posted by ticky View Post
No its not, origin is located at, g_client + 0x1c :troll:


I meant to say G_Client Drack It'd be 0x1b because the g_client origin offset posted is one off :p

Copyright © 2026, NextGenUpdate.
All Rights Reserved.

Gray NextGenUpdate Logo