Gamerz Online

What it be:

• Take in a string with the interface version
• Locate that string
• Locate references to that string
• Offset and dereference for the interface

Example:

PHP Code:

    //Fill out client.dll's ME32 profile so we can get at its base address and size
    MODULEENTRY32 clientme = GetModuleStats("client.dll", processHandle, false);

    //Allocate space for a whole client module
    PDWORD clientmodule = (PDWORD)malloc(clientme.modBaseSize);

    //Effectively copy client.dll into our own address space so we can use old fasioned FindPattern.
    ReadProcessMemory(processHandle, clientme.modBaseAddr, clientmodule, clientme.modBaseSize, NULL);

    //Search our local copy of client.dll for the string "VClientEntity". szVCEL_offset holds the local offset of the string.
    DWORD szVCEL_offset = Utils::FindPattern((DWORD)clientmodule, clientme.modBaseSize, (BYTE*)"VClientEntity", "xxxxxxxxx");
    
    //Adjust offset to the loaded module's address space.
    DWORD RA = (DWORD)clientme.modBaseAddr + (szVCEL_offset-(DWORD)clientmodule);

    //Look for references to RA (real address of the string we searched for)
    DWORD szVCEL_ref = Utils::FindPattern((DWORD)clientmodule, clientme.modBaseSize, (BYTE*)&RA, "xxxx");
    szVCEL_ref += sizeof(BYTE) + sizeof(DWORD); //1 opcode (mov) + operand

    //Dereference szVCEL_ref, which points to a function which is used to load the list into EAX.
    //It points to the beginning of the function, so we jump over the mov opcode right into the operand
    //which is a pointer to the list and read that into our own variable.
    ReadProcessMemory(processHandle, (PVOID)(*(PDWORD)ref2 + 0x01), &g_pClientEntityList, sizeof(DWORD), NULL);
    
    free(clientmodule);
    clientmodule = NULL; 

I commented it for you. I can then readprocessmemory g_pClientEntityList into a large enough array to use it like this:

PHP Code:

typedef DWORD _CBaseEntity;
_CBaseEntity dwReturnBaseEntity ( PDWORD table, int iIndex )
{
    _CBaseEntity dwBaseEntity = 0;
    if ( iIndex == 0 )
        return 0;

    DWORD index = 40 + (8*iIndex);
    dwBaseEntity = *(PDWORD)((DWORD)table + index);

    return dwBaseEntity;
}
//oh... and
template<typename T> T ReadNetworkedVar( HANDLE processHandle, _CBaseEntity ent, DWORD offset )
{
    T ret;
    DWORD err = 0;
    ReadProcessMemory ( processHandle, ( PVOID )( ( DWORD )ent + offset ), &ret, sizeof(T), NULL );
    err = GetLastError();
    if (err)
        return 0;
    else
        return ret;
} //<-- my first time creating a template. 

Hopefully this lends a hand to someone looking to start with this. I know external ESP has been developed. I'm not too sure where to continue from here, but I'm working with someone who might... Maybe