t1f7 / scp-internal-il2cpp

il2cpp internal cheat for SCP SL
58 stars 15 forks source link

Player info. #3

Closed oeant closed 4 years ago

oeant commented 4 years ago

Hello, how can i get player name, class (mtf, chaos, etc..), and also i tried to do 914 esp, i tried to find object „914_use” but it looks like showed possision is wrong.

t1f7 commented 4 years ago

v0.2 uploaded with example for "location esp"

I don't know how to get player class without hooks. Use any hook at player::update method for example.

oeant commented 4 years ago

Are you planning to release example of il2cpp method hooking in this base?

t1f7 commented 4 years ago

Are you planning to release example of il2cpp method hooking in this base?

It's not il2cpp hooking, it's basically hooking. For example, midfunction hooks or vmt hooks. I don't know if I will release one, devs (scpsl team) would probably fix it. You should find your way.

oeant commented 4 years ago

What about making "listen all" cheat? Do i need to hook functions to make it?

t1f7 commented 4 years ago

What about making "listen all" cheat? Do i need to hook functions to make it?

You can hook or you can find pointer to static Radio class to manually write memory.

Tracersboy commented 4 years ago

Hello, how can i get player name, class (mtf, chaos, etc..), and also i tried to do 914 esp, i tried to find object „914_use” but it looks like showed possision is wrong.

vec3 get_transform_room(uint64_t entity) {
    auto transform = ((t_unity_get_transform*)unity_get_transform)(entity);
    if (!transform) return vec3{};
    auto posdata = Read<uint64_t>((uint64_t)transform + offset::transform_room_1);
    if (!posdata) return vec3{};
    posdata = Read<uint64_t>((uint64_t)posdata + offset::transform_room_2);
    if (!posdata) return vec3{};
    posdata = Read<uint64_t>((uint64_t)posdata + offset::transform_room_3);
    return Read<vec3>(posdata + offset::transform_room_4);
}

//most GameObject whose tag is “room“ have offset for position like this except HID room ,ammo room and HCZ_EZ_Checkpoint room

constexpr ::std::uint64_t transform_room_1 = 0x10;
constexpr ::std::uint64_t transform_room_2 = 0x30;
constexpr ::std::uint64_t transform_room_3 = 0x218;
constexpr ::std::uint64_t transform_room_4 = 0xE0;
oeant commented 4 years ago

@Tracersboy do you know any way to find all available tags so i can use them in this cheat?

Tracersboy commented 4 years ago

@Tracersboy您知道找到所有可用标签的任何方法,以便我可以在此作弊中使用它们吗?

hhhhh,I just finished it https://github.com/chrysls/scp-internal-il2cpp/issues/1

oeant commented 4 years ago

Thank you very much!

oeant commented 4 years ago

After some testing (original version, i didnt made any changes to code) the game just crashes after few minutes of playing.

Tracersboy commented 4 years ago

经过一些测试(原始版本,我没有对代码进行任何更改),游戏在玩了几分钟后便崩溃了。

Uninstalling and installing might be a good idea

oeant commented 4 years ago

I assume that you are talking about reinstalling game, okay i will try that.

Tracersboy commented 4 years ago

I assume that you are talking about reinstalling game, okay i will try that.

sry,I misunderstood your meaning, and I also encountered the same problem. I think this is caused by frequent acquisition of player coordinates. Maybe the coordinate offset address of the player who just entered the server is unreadable. For this reason, it reported an error, but it's just my guess. The error log may have prompts, but I don't know how to read it (I only use it for room ESP, read it once a round)

oeant commented 4 years ago

It seems that nothing has changed, still crashing.

Tracersboy commented 4 years ago

It seems that nothing has changed, still crashing.

https://github.com/chrysls/scp-internal-il2cpp/issues/2
same question

oeant commented 4 years ago

SCPSL.gc.log: Collecting from unknown thread

Tracersboy commented 4 years ago

SCPSL.gc.log: Collecting from unknown thread

The author said:

Invalid address access problem. Try to move il2cpp::Init(); into the loop (after gui::text("il2cpp plague : v0.1", 15, 15, 255, 0, 0);) to check if error disappears.

Probably address of something changes in runtime, I'm not sure what is that.

oeant commented 4 years ago

This is already fixed in v0.2, which im trying to use, error is still existing

Tracersboy commented 4 years ago

v0.2已修复该问题,我正在尝试使用,错误仍然存​​在

If vs is installed, you can use VS to open DMP file for debugging. You can copy the stack information at the time of crash to see where the crash started. If it is caused by its own DLL, loading its own PDB symbol file can locate the place where its code crashes

C:\Users\your username\AppData\Local\Temp\Hubert Moszka\SCPSL\Crashes\

oeant commented 4 years ago

Yeah, i opened it, i have also "error.log" and "Player.log"

oeant commented 4 years ago

One of the errors: "ERROR: SymGetSymFromAddr64, GetLastError: 'Attempt to access invalid address.' (Address: 00007FF889B1D4FA)"

t1f7 commented 4 years ago

SCPSL.gc.log: Collecting from unknown thread

I will add fix to this in v0.3, that's il2cpp garbage collector (GC) issue.

oeant commented 4 years ago

Okay, when can we expect it to be out?

t1f7 commented 4 years ago

Okay, when can we expect it to be out?

Right now.

oeant commented 4 years ago

Thank you, seems to work. I found a bool "roundEnded" in radio class, can i somehow offset it and change to true??

t1f7 commented 4 years ago

Thank you, seems to work. I found a bool "roundEnded" in radio class, can i somehow offset it and change to true??

Why not? bool is [1 byte], 1 or 0.

oeant commented 4 years ago

How can i get the offset? I know that the field offset in Radio class is 0x9

totorowldox commented 4 years ago

How can i get the offset? I know that the field offset in Radio class is 0x9

roundEnded Here is 0x9,right?

then open script.json and find the Class$Radio Class$Radio So you can know the radio class offset.

totorowldox commented 4 years ago

One more thing the roundended is STATIC Soooo the radioclass must add 0xB8 then add 0x9

oeant commented 4 years ago

so 0x30785144 + 0xB8 + 0x9?

totorowldox commented 4 years ago

so 0x30785144 + 0xB8 + 0x9?

30785144 not HEX that is DEC

so 0x1D5BE78

oeant commented 4 years ago

And now with some WriteMemory function i can change value of this bool to 1?

totorowldox commented 4 years ago

You'd better make a judgment (Don't care about C#)

                long Radio = Memory.ReadMemory<long>((long)Memory.GameAssemblyModule.BaseAddress + Offset.RadioOffset);
                if (Radio != 0)
                {
                    long RadioClass = Memory.ReadMemory<long>(Radio + 0xB8);   //static
                    if (RadioClass != 0)
                    {
                        Memory.WriteMemory<bool>(RadioClass + 0x9, Settings.AllRadio);
                    }
                }

And now with some WriteMemory function i can change value of this bool to 1?

YEP

oeant commented 4 years ago

cool, thank you for help

Tracersboy commented 4 years ago

How can i get the offset? I know that the field offset in Radio class is 0x9

roundEnded Here is 0x9,right?

then open script.json and find the Class$Radio Class$Radio So you can know the radio class offset.

I really want to know where “ script.json” is,cloud you tell me how to get it :)

totorowldox commented 4 years ago

How can i get the offset? I know that the field offset in Radio class is 0x9

roundEnded Here is 0x9,right? then open script.json and find the Class$Radio Class$Radio So you can know the radio class offset.

I really want to know where “ script.json” is,cloud you tell me how to get it :)

il2cppdumper

oeant commented 4 years ago

Screenshot_71 Will this function work?

totorowldox commented 4 years ago

Screenshot_71 Will this function work?

IDK about that but you can try

Tracersboy commented 4 years ago

How can i get the offset? I know that the field offset in Radio class is 0x9

roundEnded Here is 0x9,right? then open script.json and find the Class$Radio Class$Radio So you can know the radio class offset.

I really want to know where “ script.json” is,cloud you tell me how to get it :)

il2cppdumper

I've seen this project before, but I never found global- metadata.dat,forgive my stupidity

totorowldox commented 4 years ago

I've seen this project before, but I never found global- metadata.dat,forgive my stupidity

SCP Secret Laboratory\SCPSL_Data\il2cpp_data\Metadata\global-metadata.dat

Tracersboy commented 4 years ago

I've seen this project before, but I never found global- metadata.dat,forgive my stupidity

SCP Secret Laboratory\SCPSL_Data\il2cpp_data\Metadata\global-metadata.dat

thank you bro,You helped me a lot. I used to think that all data file in this game like assembly- CSharp.dll was exist in the dedicated server, but I am wrong

Tracersboy commented 4 years ago

I've seen this project before, but I never found global- metadata.dat,forgive my stupidity

SCP Secret Laboratory\SCPSL_Data\il2cpp_data\Metadata\global-metadata.dat

Can't use auto mode to process file, try manual mode. CodeRegistration= MetadataRegistration= what is it?

totorowldox commented 4 years ago

I've seen this project before, but I never found global- metadata.dat,forgive my stupidity

SCP Secret Laboratory\SCPSL_Data\il2cpp_data\Metadata\global-metadata.dat

Can't use auto mode to process file, try manual mode. CodeRegistration= MetadataRegistration= what is it?

executable-file must be GameAssembly.dll

Tracersboy commented 4 years ago

GameAssembly.dll

You are full of wisdom,I love you bro

totorowldox commented 4 years ago

GameAssembly.dll

You are full of wisdom,I love you bro

you are so politely

totorowldox commented 4 years ago

Screenshot_71 Will this function work?

Is that worked? Have you tried?

Tracersboy commented 4 years ago

One more thing the roundended is STATIC Soooo the radioclass must add 0xB8 then add 0x9

I can't understand “0xB8”,I didn't find it

oeant commented 4 years ago

I tried and it didnt worked, i think that this is my function issue

totorowldox commented 4 years ago

One more thing the roundended is STATIC Soooo the radioclass must add 0xB8 then add 0x9

I can't understand “0xB8”,I didn't find it

Can i say idk that too? I also listen to others. I heard one way is to use CE

totorowldox commented 4 years ago

I tried and it didnt worked, i think that this is my function issue

i guess you can use WriteProcessMemory