Cheat Engine

[TsTg]

Just want to ask how generally how's the aimbot hack being done, what values to search for.

from what i guess: it's about the crosshair position x and y, but for the enimies, what values do i need to find?, their position?(as if i'm doing a teleport hack), or what else?, and are there a difference between doing this for an FPS game rather than 3D person ones?

[lprulzcrossover]

I don't know if you can get an aimbot to work only with cheat engine, but there's a quiet good tutorial on this on youtube (you need a bit of c# to understand this...):

/watch?v=NUeifQK7ukM

hope it helps you

[++METHOS]

It really depends on the game; whether or not there is a targeting system, if that targeting system has lock-on capabilities, what method(s) of attack are available and how they are handled, how the coordinates are handled for both, enemy and ammo etc.

Once you have determined the best approach based on how the game is coded, you may still have multiple, viable methods, depending on your skill/comfort level etc. Using Cheat Engine, solely, is very doable.

[Dark Byte]

Late reply, kinda forgot about it after I read it on my phone

The basic method of making an aimbot is find your eye position and the player position. And figure out how your eye direction is done. (e.g ut2k4 uses a 2 byte in the range of 0 to 65536 for horizontal and vertical rotation)

Then just do some basic trigonometry to find out how to change your eye rotattion to point to the closes player coords. (or nearest to the center of your eyes if you don't want to do 180 degree turns)


Also, check this:
http://forum.cheatengine.org/download.php?id=37465
It's a hybrid between auto assembler and dll injection

In this aimbot (ut2k4, I used he same framework for ut3) I use the code that renders the players and store their coordinates.
Then when the whole scene is rendered I check if the "aimbot" key is down, and if so, pick a target, change the eye position to that target, and press the fire button

It also makes use of the object speed, your own speed, and the lag variable to calculate where the player will be when you shoot

[++METHOS]

The most common method would be to match your weapon crosshairs or reticle to the enemy coordinates. However, how would you realistically go about targeting a single enemy at a time on a game that randomly spawns multiple enemies? Furthermore, how would you force the bot to be selective, so that it targets the closest enemy first?

Thanks.

[Dark Byte]

Since you have the coordinates of all the targets, and your own (X, Y and Z), you can just calculate which target has the shortest distance, and pick that target to shoot at.

You can combine that with saving a pointer to the target struct you shot at last time and check if it's still in the target list so you don't randomly switch while the key is down even if somene else comes closer. (reset the pointer when the key goes up or target health becomes 0)

As for the smallest distance from lookat direction calculate for every target how much you should change the horizontal and vertical aim direction. That leaves you with a simple square triangle that you can calculate the size of the 3th line, and thus pick the one with the smallest distance to move

[++METHOS]

[Dark Byte]

Look at the ut2k4 source. I did the calculations and list handling inside a dll,and used the autoassembler to hook the code to the dll function entrypoints

[++METHOS]

ut2k4.CEA and ut2k4.CES appear to be empty. Where should I be looking?

[Dark Byte]

ut2k42.cea

[++METHOS]

Thanks. Looking at this, I don't see where you calculated enemy position to target closest enemy...or did you?

I think, an easier way to do this would be to just load one set of enemy coordinates at a time. Just compare enemy health to 0 and je to originalcode, otherwise je aimbot. Then, compare [x], [y], or [z] values to 0, and jne to originalcode. Then, just program a controller button to reset those values to zero (e.g. when the target is dead or out of your line of sight), so that everything gets reset again, and the next set of enemy coordinates are naturally loaded in to [x], [y] & [z], respectively.

However, it might become a hassle to always have to switch to a different target because the enemy isn't viewable...and that's assuming that it would even switch to a different target without establishing another conditional jump. For all I know, it may just keep trying to load the same coordinate values back in to [x][y][z]. In your script it looks like you avoid this by finding the address that determines whether or not the target is visible...is that correct? Maybe other games are coded similarly...I don't know.

Needless to say, I think it might be necessary to have a way to determine if a target is 'shootable', at the very least, so that it doesn't become too tedious. I don't know if I can fully make sense of how you went about it...even looking at your script.

[Dark Byte]

check helperfunctions.pas which is the actual code.

when a player is rendered to the screen it calls aim_addtarget which adds it to the list

When a gametick is done(One frame fully rendered) it calls aim_ticker, where the list is checked and calculated which one to shoot at (smallest distance)

When aim_ticker is done, the list is cleared, restarting the whole cycle

[++METHOS]

That looks complicated.

Can something like this be done, solely with assembly?:

[Dark Byte]

It can be done in assembly but that's really not needed in my opinion. It's very easy to make DLL's

It's usually a function called more if it's visible or not so the game engine renders it or a secondary thing like the name (in some games if you're close enough to someone you see their name above their head)

So if you can pinpoint that function (start with the x,y, z coordinates and check what accesses it when visible and not visible) you can use that to mark it as visible or not.
Of course, if their body is visible, but their head is behind an object that won't work. In those cases you have to do more specific coding or don't care and shoot for the body with a secondary key specifically for body. (E.g in the ut2k4 aimbot I call their own internal method to see if the head bone is in line of sight but not many games are that nice to show all the symbols)

[++METHOS]

Thanks. When you put it that way, it makes a lot of sense.

I still can't +rep you until I +rep someone else. I guess I owe you +2, now.