Signatures Research

[DayibBaba]

Since the base has yet to be functional, we need some legwork. Post any signature that will aid in getting this menu on its feet.

[DayibBaba]

Script Threads 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 41 56 41 57 48 83 EC 20 0F B7 15
Script Programs 48 8B 1D ? ? ? ? 41 83 F8 FF
Script globals 48 8D 15 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 8B 3D
Script Manager 48 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 C0 74 05 40 32 FF
Handle to ptr 44 8B C9 83 F9
is_online 73 16 80 3D (add 5 rip)

[DayibBaba]

E8 ?? ?? ?? ?? F6 43 28 01 74 05 8B 7B 0C EB 03 8B 7B 14 48 8B CB E8 ?? ?? ?? ?? 2B F8 83 FF 28 0F 8D C9 FE FF FF Call to Received Event

[MarkEcza]

E8 ? ? ? ? 38 58 09

add(1).rip().as<types::get_renderer_info>();
using get_renderer_info = uint64_t(*)();
call save ret

	if ((int)*(BYTE*)(ptr + 9) == 3)
             //VULKAN in use
	else 	if ((int)*(BYTE*)(ptr + 9) == 1)
             //DX12 in use

[MarkEcza]

E8 ? ? ? ? 42 8B 9C FE  add(1).rip()
using get_native_addr = uint64_t(*)(uint64_t hash);

[MarkEcza]

4C 8D 05 68 44 CA FE 8B 15
add(9).rip().as<uint32_t*>();

frame count

[MarkEcza]

40 53 48 83 EC 20 8B 41 08 4C 8D 44 24 ? 89 44 24 30 48 8B DA 8B 01 48 8D 54 24 ? 48 8D 4C 24 ? 89 44 24 40 E8 ? ? ? ? 48 8B 44 24 ? 4C 8D 05 ? ? ? ? 48 8B D3 48 89 44 24 ? 48 8D 4C 24 ? E8 ? ? ? ? 48 83 C4 20 5B C3 CC A5
PVOID ptr

static uint32_t frame_count{};
	bool hooks::STAT_ID_GET_INT(int* a1, uint64_t a2)
	{
		if (frame_count != *g_patterns.m_frame_count) {
			g_logger.insert(log_class::GENERAL, "Ticked");

			frame_count = *g_patterns.m_frame_count;
		}
	
		return get_original<decltype(&hooks::STAT_ID_GET_INT)>("SIGI")(a1, a2);
	}

Not sure if natives are integ checked but it works fine.

[maybegreat48]

All natives are integrity checked

[MarkEcza]

E8 ? ? ? ? B2 01 8B CB 48 8B F8
add(1).rip()
using get_network_player = uint64_t* /*class*/ (__fastcall*)(int player);

get network player from index

[MarkEcza]

48 8B 58 60 48 8B 0D + 7 rip

swapchain (IDXGISwapChain1)

[MarkEcza]

48 8D 15 ? ? ? ? 48 8D 0D ? ? ? ? FF D0 + 1 rip 
D3D Factory1 (win7 i guess)

49 8B CD E8 ? ? ? ? 4C 8D 05 + 9 rip
D3D Factory2 

[DaniTRDev]

g_IDXGISwapChain1 = ("48 8D 15 ? ? ? ? 4C 8B 05 ? ? ? ? 4C 8D 0D").add(3).rip()
g_dx12Device = ("8A 48 09 33 C0 ").add(0xA).add(3).rip();
g_vulkanDevice = ("4C 8D 0D ? ? ? ? B8 ? ? ? ? 44 89 A5").add(3).rip();
g_fxrDevice = ("03 F3 48 83 EC 28").add(0x74).add(3).rip();

[MarkEcza]

48 8D 15 ? ? ? ? 4C 8B 0E begin of the instruction //ID3D12GraphicsCommandList
83 63 20 00 4C 8D 05 + 4 for the beginning of the instruction //ID3D12DescriptorHeap

Sigs to the UUIDs (Thanks to Faint for pointing the obvious out, thought the last arg was heap size instead of the ptr itself ;P )

[Vali0004]

"48 8B 05 51 C4 05 03 48 8B 8B 30 CC 00 00 48 89 44 24 20", ID3D12DescriptorHeap**, back buffers
"FF 50 10 48 8B 0D ? ? ? ? 48 8B 01", ID3D12CommandQueue**
"4C 8B 05 ? ? ? ? 41 8B 88 ? ? ? ?", rage::grcRender**
rage::grcRender holds ID3D12GraphicsCommandList* at 0x58 and ID3D12CommandAllocator* at 0x258
Hydra-Source aka Marcezsa's pointers are to the UUIDs of the pointers.
We worked on this together. Huge thanks to him

namespace rage
{
	#pragma pack(push, 8)
	//Contains more info, needs to be expanded
	class grcRender
	{
	public:
		virtual ~grcRender() = default;
		char pad_0000[80]; //0x0000
		ID3D12GraphicsCommandList* m_command_list; //0x0058
		char pad_0060[1704]; //0x0060
	}; //Size: 0x0708
	#pragma pack(pop)
}

[MarkEcza]

Update: 0x18 from grcRender is FenceEvent HANDLE and 0x10 is the ID3D12Fence

[MarkEcza]

4C 8B 05 ? ? ? ? 4C 8D 0D ? ? ? ? 48 89 54 24 + 3 rip HWND ptr. (You can just get it from the swapchain too)

[MarkEcza]

WndProc = 48 89 5C 24 ? 4C 89 4C 24 ? 48 89 4C 24 ? 55 56 57 41 54 41 55 41 56 41 57 48 8B EC 48 83 EC 60

[DayibBaba]

Thanks for all the contributions to get HorseMenu working!

[who-care123]

[DayibBaba]

How so? Are you not able to fetch data from the pointer?

[who-care123]

What your mean?I can try, and if u can fetch it can u say something?

[MarkEcza]

I also heard some pointers were encrypted

[maybegreat48]

Requesting ragdoll on player peds is patched

[tyackman]

@TSYiMa Have you had any luck with pool pointers?

[tyackman]

"E8 ? ? ? ? 84 C0 74 ? B0 ? EB ? 32 C0 48 83 C4 ? 5B C3 48 89 5C 24 ? 48 89 6C 24 ? 48 89 74 24 ? 57 41 54" Call to write_join_response_data I reckon. Maybe not, but maybe so 😎

[tyackman]

Sorry for the LONG ahh signature but here's send net info to lobby. Not sure you can spoof rid/ip here but name works:
48 8B C4 48 89 58 ? 48 89 68 ? 56 57 41 54 41 56 41 57 48 83 EC ? 4D 8B F1 48 8B F9 48 81 C1 ? ? ? ? 4C 8D 48 ? 41 8B E8 4C 8B FA 33 DB E8 ? ? ? ? 84 C0 0F 84 ? ? ? ? 8B B4 24 ? ? ? ? 4C 8D 8C 24 ? ? ? ? 44 8B C5 48 8B CF 44 2B C6 49 8D 14 37 E8 ? ? ? ? 84 C0 0F 84 ? ? ? ? 44 8B A4 24 ? ? ? ? 48 8D 8F ? ? ? ? 44 8B C5 4C 8D 8C 24 ? ? ? ? 45 2B C4 44 2B C6 41 8D 14 34 49 03 D7 E8 ? ? ? ? 84 C0 74 ? 8B 9C 24 ? ? ? ? 48 8D 4C 24 ? 41 03 DC 03 DE E8 ? ? ? ? 8B D3 48 8D 4C 24 ? 2B EB 49 03 D7 44 8B C5 E8 ? ? ? ? 48 8D 97 ? ? ? ? 41 B8 ? ? ? ? 48 8D 4C 24 ? E8 ? ? ? ? 84 C0 74 ? 8B 97

[tyackman]

48 8B C4 48 89 58 ? 48 89 68 ? 48 89 70 ? 48 89 48 ? 57 41 54 41 55 41 56 41 57 48 83 EC ? 4C 8B A9 - WriteVehicleProximityMigrationData

48 8B C4 48 89 58 ? 48 89 68 ? 48 89 70 ? 48 89 78 ? 41 54 41 56 41 57 48 83 EC ? 65 4C 8B 0C 25 - Migrate object/CGiveControlEvent::Trigger

[tyackman]

48 8B 0D 42 CD 20 03 48 85 C9 - Should be able to patch this to force your connection through r* relay servers.

E8 ? ? ? ? 84 C0 74 ? 48 B8 ? ? ? ? ? ? ? ? 48 89 03 - Generate UUID

[Rxann]

E8 ?? ?? ?? ?? 32 DB 84 C0 74 1B 44 8B 84 24 40 01 00 00 - SendNetInfoToLobby.

Based on @tyackman 's very long sig he posted above

[ghost]

[Rxann]

Thank you so much.

[Rxann]

@imstash I will try to find some bad events. Do you know if kicks are sent through this?

[ghost]

@imstash I will try to find some bad events. Do you know if kicks are sent through this?

I have them all mapped out but sent this on phone as I sent it to someone else earlier. I'll post the enum tomorrow. As for kicks, join requests etc you need another hook. This one is mainly for annoying message spams, crew abuse etc. You can find the join handler by xrefing "d" and seeing where it reads 16 bytes (rid). Kicks are something else, haven't looked into that shit yet.

[Rxann]

@imstash I will try to find some bad events. Do you know if kicks are sent through this?

I have them all mapped out but sent this on phone as I sent it to someone else earlier. I'll post the enum tomorrow. As for kicks, join requests etc you need another hook. This one is mainly for annoying message spams, crew abuse etc. You can find the join handler by xrefing "d" and seeing where it reads 16 bytes (rid). Kicks are something else, haven't looked into that shit yet.

Thank you. I have a PR going right now with a lot of good shit in it that I will open as a draft once I get a feature working. I am currently in the process of porting one kick. Do you have discord? I would like to discuss a little bit more, if you do.

[ghost]

@imstash I will try to find some bad events. Do you know if kicks are sent through this?

I have them all mapped out but sent this on phone as I sent it to someone else earlier. I'll post the enum tomorrow. As for kicks, join requests etc you need another hook. This one is mainly for annoying message spams, crew abuse etc. You can find the join handler by xrefing "d" and seeing where it reads 16 bytes (rid). Kicks are something else, haven't looked into that shit yet.

Thank you. I have a PR going right now with a lot of good shit in it that I will open as a draft once I get a feature working. I am currently in the process of porting one kick. Do you have discord? I would like to discuss a little bit more, if you do.

user769953

[ghost]

[Rxann]

Really? What do you mean blacklist?

[ghost]

Really? What do you mean blacklist?

Doesn't let them join

[Rxann]

WritePlayerGameStateDataNode: 48 8B C4 48 89 58 ? 48 89 68 ? 48 89 70 ? 48 89 78 ? 41 54 41 56 41 57 48 83 EC ? 48 8B A9 ? ? ? ? 48 8B F1

WritePlayerAppearanceDataNode: 40 55 53 56 57 41 55 41 56 41 57 48 8B EC 48 83 EC 50 4C 8B B9

WritePlayerCameraDataNode: 40 55 53 56 57 41 54 41 55 41 56 41 57 48 8B EC 48 83 EC 78 4C 8B A9

[tyackman]

ScriptVirtualMachine: E8 ? ? ? ? 65 48 8B 0C 25 ? ? ? ? 48 85 F6.Add(1).Rip()

HasRosPrivilege: 83 B9 ? ? ? ? ? 4C 8B C9 76

GetNetworkObjectFromPlayer: 48 8B C4 48 89 58 ? 48 89 68 ? 48 89 70 ? 48 89 78 ? 41 56 48 83 EC ? 48 8D B1 ? ? ? ? 48 8B F9 48 8B CE 41 8A E9

[tyackman]

ReadNetArrayUpdate: 48 89 5C 24 ? 55 56 57 41 54 41 55 41 56 41 57 48 8B EC 48 83 EC ? 48 8B D9 45 8B E9

WriteNetArrayUpdate: 48 89 5C 24 ? 48 89 54 24 ? 55 56 57 41 54 41 55 41 56 41 57 48 83 EC ? 48 8B 81 ? ? ? ? 4C 8B F1

[tyackman]

WriteNode: E8 ? ? ? ? 84 C0 0F 95 C0 48 83 C4 ? C3 CC 85 7F

WriteNodeData (probably): 48 8B 89 ? ? ? ? 48 8B 01 48 FF 60 ? CC E8

GetSectorData: 48 83 EC ? F3 0F 6F 29 4C 8B DA

CanSendNodeToPlayer: 48 89 5C 24 ? 48 89 6C 24 ? 56 57 41 56 48 83 EC ? 41 0F B6 E8

[tyackman]

Local Peer ID: 48 39 05 ? ? ? ? 75 ? B0 ? C3 32 C0 .Add(3).Rip()

Host Token: 48 8B 05 ? ? ? ? 48 83 F8 ? 75 .Add(3).Rip()

[tyackman]

GivePickupReward: 48 8B C4 48 89 58 ? 48 89 70 ? 89 50 ? 57 48 83 EC ? 33 DB 48 8B F1 38 1D

GetPedFromNetworkObject: E9 ? ? ? ? CC ED 3B 48

FindPeerByCxnID: 48 89 5C 24 ? 48 89 74 24 ? 57 48 83 EC ? 33 DB 8D 42

GetScriptProgram: E9 ? ? ? ? CC 71 ? 8B C4 48 89 58 ? 48 89 68 ? 48 89 70 ? 48 89 78

[tyackman]

WriteVehicleGadgetDataNode: 48 89 5C 24 ? 48 89 6C 24 ? 48 89 74 24 ? 57 41 54 41 55 41 56 41 57 48 83 EC ? 48 8B B9 ? ? ? ? 33 ED

GetNumberOfVehicleGadgets: 48 8B 81 ? ? ? ? 8B D2 48 8B 04 D0 C3 90

AddVehicleGadget: 48 89 5C 24 ? 57 48 83 EC ? 33 FF 48 8B D9 83 EA

GetVehicleWeaponMgr: 48 8B 81 ? ? ? ? C3 48 89 5C 24 ? 57 48 83 EC ? 0F 29 74 24

CVehicle::CreateVehicleWeaponMgr: 40 53 48 83 EC ? 48 83 B9 ? ? ? ? ? 48 8B D9 75 ? 80 B9

CSyncDataReaderSerialiser: 48 8D 05 ? ? ? ? 48 89 6C 24 ? 48 89 44 24 .Add(3).Rip()

Loading Screen State: 83 3D ? ? ? ? ? 0F 95 C0 C3 CC 80 B9 .Add(3).Rip()

Game Script Handle Manager 48 8B 0D ? ? ? ? E8 ? ? ? ? 48 85 C0 74 ? 40 32 FF .Add(3).Rip()

[tyackman]

GetCPedFromNetObject: E8 ? ? ? ? 48 8B D8 48 85 C0 74 ? 48 8B C8 E8 ? ? ? ? 48 85 C0 74 ? 48 8B CB E8 ? ? ? ? 48 85 C0 74 ? 48 8B CB ptr.Add(1).Rip().As<Functions::GetCPedFromNetObject>();

GetCVehicleFromNetObject: E8 ? ? ? ? 4C 8B F8 48 85 C0 0F 84 ? ? ? ? 48 8B C8 E8 ? ? ? ? 4C 8B C0 ptr.Add(1).Rip().As<Functions::GetCVehicleFromNetObject>();

GetSeatManager: 8B 89 ? ? ? ? 48 8B 05 ? ? ? ? 81 E1 ? ? ? ? 2B 0D ? ? ? ? 48 C1 E1 ? 48 8B 54 01 ? 48 8B CA 48 83 E1 ? 48 F7 DA 48 1B C0 48 23 C1 C3 90 8A 05

CVehicle::GetPedInSeat: 83 FA ? 73 ? 48 63 C2 48 8B 84 C1