Aimbot - How to find the PlayerBase?

Question

So I'm trying to create an aimbot for a game but I'm having some trouble here, how can I find the player base? If I find the player base then I can get all the information needed such as X, Y positions, current money, ammo, health, armor etc... I'm using CheatEngine 6.4 for this.

Answer 1

The term "PlayerBase" refers to the dynamic address of the player object. Variables like health, armor etc... will typically be member variables of the player class. Variables such as ammo can also be member variables of the weapon class, so not all offsets will be relative to the address of the player object. But you will often seen pointers in the player object that point to the current weapon object.

When the game is created the compiler creates instructions to access the variables by address and relative offset using the class that's been defined. Your goal is to replicate the game logic in accessing these variables.

To find a variable that you assume is a member of the player class, scan for it in cheat engine, then use "Find What Accesses" on the address of the variable. This lists all instructions that access that variable. Hopefully you will see something like "mov eax [ebx+14c]". In this case the address held in ebx is the address of the player object and 0x14c is the offset to the health variable. This is typically a dynamic address, which will be different each time you run the game. Next you would want to find a pointer to this address that you can use that will always point to the correct address. To do this you would trace backwards in the code and hopefully see where ebx gets it's value either inside the current function or in a previous function in the call stack. You will either find a static address which is a global variable or an address that is relative to the base address of a module(such as a DLL or exe) which you can calculate at runtime.

I typically do the same thing in every game and dumb this down to: Find a good health pointer and remove the last offset. This is a pointer to the "playerbase"

Answer 2

Find Y axis, search unknown initial value, float type. Walk up ladder, and search for increased value. Walk down and decreased value, and keep doing this until you find your Y address. Right Click and press " Memory View for this value". Disect new data structure. Now you should have structure, there you have an array of memory addresses, type the Y address - 8, now you should get all XYZ, and the addresses, type the x address that is on top now, and "-" 4. The address on top is now your PlayerBase. When you need XYZ now, you take "PlayerBase + XOffset", X will be 4 bytes infront of Base, since you took X - 4. and Z will be 4 bytes infront of X, so PlayerBase + 8, and Y will be "+" 0x0C. Cheat Engine shows you the offset behind the address.