引用第0楼莎仕芘亞于2007-06-28 21:15发表的 使作弊器适用于任意版本 :
打开client.cpp,找到下面这段----------------------------------struct cl_enginefuncs_s gEngfuncs;struct cl_enginefuncs_s gHookedEngfuncs;struct efx_api_s gHookEfxApi;engine_studio_api_t IEngineStudio;engine_studio_api_t* pIEngineStudio=0;cl_enginefuncs_s *pEngfuncs = (cl_enginefuncs_s*) 0x01EB72D8;playermove_s *ppmove = (playermove_s*) 0x02D5FE20;engine_studio_api_s *pstudio = (engine_studio_api_s*) 0x01ED3520;------------------------------------替换为----------------------------------struct cl_enginefuncs_s gEngfuncs;struct cl_enginefuncs_s gHookedEngfuncs;struct efx_api_s gHookEfxApi;engine_studio_api_t IEngineStudio;engine_studio_api_t* pIEngineStudio=0;cl_enginefuncs_s* pEngfuncs;engine_studio_api_s* pstudio;playermove_s *ppmove;-----------------------------------查找下面这段[offsets不一定相同,直接查找DWORD* slots]---------------------------------DWORD* slots = (DWORD*)0x01EB74E8;------------------------------------改为---------------------DWORD* slots;------------------------查找-----------------------------void OnlyHook(LARGE_INTEGER *lp, bool force = true)------------------------------在这个区间上方加入----------------------------------DWORD FindPattern(char *pattern, int len, DWORD dwStart, DWORD dwLen){ char *m = (char *)dwStart; for(; (DWORD)m < (dwStart + dwLen); m++) if(!memcmp(m, pattern, len)) return (DWORD)m; return NULL;}-----------------------------------在onlyhook区间内加入------------------------------------ char engine_sig[] = "x89x74x24x5Cx89x74x24x60x89x74x24x64x89x74x24x68x89x74x24x6Cx89x74x24x70x89x74x24x74x89x74x24x78x89x74x24x7C"; DWORD dwEngine = FindPattern(engine_sig, strlen(engine_sig), 0x01D60000, 0x01000000); DWORD Slots_sig = (*(DWORD*)(dwEngine - 0x74)); DWORD* slots = (DWORD*)Slots_sig; static bool NotPatched = true; if (NotPatched) { int a; for(a=0x01D00000;a<0x01D0FFFF;a++) { if(*(PBYTE)(a) == 0x68 && *(PBYTE)(a + 0x05) == 0xE8 && *(PBYTE)(a + 0x0A) == 0x6A && *(PBYTE)(a + 0x0B) == 0x07 && *(PBYTE)(a + 0x0C) == 0x68 && *(PBYTE)(a + 0x11) == 0xFF && *(PBYTE)(a + 0x12) == 0x15 && *(PBYTE)(a + 0x17) == 0x68) { pEngfuncs = (cl_enginefunc_t*)*(DWORD*)(a+0x0D); break; } } int b; for(b=0x01D00000;b<0x01D0FFFF;b++) { if(*(PBYTE)(b) == 0xE8 && *(PBYTE)(b + 0x05) == 0x6A && *(PBYTE)(b + 0x06) == 0x07 && *(PBYTE)(b + 0x07) == 0x68 && *(PBYTE)(b + 0x0C) == 0xFF && *(PBYTE)(b + 0x0D) == 0x15 && *(PBYTE)(b + 0x12) == 0x68 && *(PBYTE)(b + 0x1C) == 0x81) { ppmove = (playermove_s*)*(DWORD*)(b+0x13); break; } } int c; for(c=0x01D00000;c<0x01D0FFFF;c++) { if(*(PBYTE)(c) == 0x68 && *(PBYTE)(c + 0x05) == 0x68 && *(PBYTE)(c + 0x0A) == 0x6A && *(PBYTE)(c + 0x0B) == 0x01 && *(PBYTE)(c + 0x0C) == 0xFF && *(PBYTE)(c + 0x0D) == 0xD0 && *(PBYTE)(c + 0x0E) == 0x83 && *(PBYTE)(c + 0x27) == 0xC3) { pstudio = (engine_studio_api_s*)*(DWORD*)(c+0x01); break; } } NotPatched = false; }------------------------------------------------步骤一完成Credits: Unknown (Came from somewhere on Game-Deception)Tutorial: Robert步骤二打开main.cpp找到------------------------detour_S_DynamicSound------------------------在区间上加入-------------------------------bool bDataCompare(const BYTE* pData, const BYTE* bMask, const char* szMask){ for(;*szMask;++szMask,++pData,++bMask) if(*szMask=='x' && *pData!=*bMask ) return false; return (*szMask) == NULL;}DWORD dwFindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask){ for(DWORD i=0; i < dwLen; i++) if( bDataCompare( (BYTE*)( dwAddress+i ),bMask,szMask) ) return (DWORD)(dwAddress+i); return 0;}---------------------------------然后在detour_S_DynamicSound区间内找到----------------------------------BYTE* offs = (BYTE*)0x01D96920;------------------------------替换为------------------------------BYTE* offs = (BYTE*) SOUND_ADDR;----------------------------------在这一行上方加入--------------------------DWORD SOUND_ADDR = dwFindPattern(0x1D90000,0x30000,(BYTE*)"x83xECx48xA1x00x00x00x00","xxxx???");----------------------------找到-------------------------sound patch applied successfully------------------------整行替换为----------------------------------------------------------------------OGCmessage( "&gsound patch applied successfully: 0x%X",SOUND_ADDR);---------------------------------------------------------------全部完成保存修改,然后用VC++重新编译生成DLL即可
不是很懂。。。 
