CREDITS:dreek1
I'll share an easier way to do Shoot Through Walls ('STW').
With this method you can do RemoteKill too...
First way to use
Second wayCode:#define ADDR_STW 0x7294C8 void YourFunction(){ *(float*)(ADDR_STW + 0xC) = 100.0f; }
How to get ADDR?Code:class CrossFire_Texture { public: char pad_0000[12]; //0x0000 float STW; //0x000C }; //Size: 0x0040 void CALL_STW() { CrossFire_Texture *pCF_texture = (CrossFire_Texture*)ADDR_STW; if (pCF_texture != NULL) { pCF_texture->STW = 100.0f; } }
Code:DC 1D ?? ?? ?? ?? DF E0 F6 C4 05 7A ?? D9 EE D9 5D ?? EB 0044D4C0 |. 83EC 08 SUB ESP,8 0044D4C3 |. DD1C24 FSTP QWORD PTR SS:[ESP] 0044D4C6 |. E8 D9531700 CALL crossfir.005C28A4 0044D4CB |. 83C4 08 ADD ESP,8 0044D4CE |. D95D 94 FSTP DWORD PTR SS:[EBP-6C] 0044D4D1 |. D945 94 FLD DWORD PTR SS:[EBP-6C] 0044D4D4 |. DC1D C8947200 FCOMP QWORD PTR DS:[7294C8] 0044D4DA |. DFE0 FSTSW AX 0044D4DC |. F6C4 05 TEST AH,5 0044D4DF |. 7A 07 JPE SHORT crossfir.0044D4E8 0044D4E1 |. D9EE FLDZ 0044D4E3 |. D95D F0 FSTP DWORD PTR SS:[EBP-10] 0044D4E6 |. EB 23 JMP SHORT crossfir.0044D50B 0044D4E8 |> D945 10 FLD DWORD PTR SS:[EBP+10] 0044D4EB |. 8B45 1C MOV EAX,DWORD PTR SS:[EBP+1C] 0044D4EE |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8] 0044D4F1 |. D82481 FSUB DWORD PTR DS:[ECX+EAX*4] 0044D4F4 |. 8B55 1C MOV EDX,DWORD PTR SS:[EBP+1C] 0044D4F7 |. 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] 0044D4FA |. D90490 FLD DWORD PTR DS:[EAX+EDX*4]
Code:\xDC\x1D\x00\x00\x00\x00\xDF\xE0\xF6\xC4\x05\x7A\x00\xD9\xEE\xD9\x5D\x00\xEBCode:xx????xxxxxx?xxxx?x