i__h4x programming?

Medal of Honour Allied Assault Basic Hacks.

I got bored a while back and made some basic hacks for MoHAA.

I made a class (Well a few classes) that I used to read the console, send text to the console, and a few memory hacks.

I then stuck this into a global key hook and set up the hotkeys.

The classes are all contained inside Public Class MoHFunctions

Public Class WindowFunctions

<DllImport(“user32.dll”, SetLastError:=True, CharSet:=CharSet.Auto)> Private Shared Function ShowWindow(ByVal hwnd As IntPtr, ByVal nCmdShow As Int32) As Boolean

End Function

Private Enum WindowShowStyle As UInteger

Hide = 0

ShowMinimized = 2

Minimize = 6

ShowMinNoActivate = 7

ForceMinimized = 11

End Enum

Private Declare Auto Function FindWindow Lib “user32″ (ByVal lpClassName As String, ByVal lpWindowName As String) As IntPtr

Public Shared Sub MinimiseWindow()

Dim MoHWnd As IntPtr = FindWindow(0, “Medal of Honor Allied Assult”)

ShowWindow(MoHWnd, WindowShowStyle.Minimize)

End Sub

End Class

That class is basically for minimising the MoHAA Window, I never got round to adding anything else to it. Maybe one day…

Now for a long class, the console stuff.

Public Class Console

<DllImport(“User32.dll”)> Private Shared Function EnumChildWindows(ByVal WindowHandle As IntPtr, ByVal Callback As EnumWindowProcess, ByVal lParam As IntPtr) As Boolean

End Function

<DllImport(“user32.dll”, CharSet:=CharSet.Auto)> Private Shared Sub GetClassName(ByVal hWnd As System.IntPtr, ByVal lpClassName As System.Text.StringBuilder, ByVal nMaxCount As Integer)

End Sub

Private Shared Function GetChildWindows(ByVal ParentHandle As IntPtr) As IntPtr()

Dim ChildrenList As New List(Of IntPtr)

Dim ListHandle As GCHandle = GCHandle.Alloc(ChildrenList)

Try

EnumChildWindows(ParentHandle, AddressOf EnumWindow, GCHandle.ToIntPtr(ListHandle))

Finally

If ListHandle.IsAllocated Then ListHandle.Free()

End Try

Return ChildrenList.ToArray

End Function

Private Shared Function EnumWindow(ByVal Handle As IntPtr, ByVal Parameter As IntPtr) As Boolean

Dim ChildrenList As List(Of IntPtr) = GCHandle.FromIntPtr(Parameter).Target

If ChildrenList Is Nothing Then Throw New Exception(“GCHandle Target could not be cast as List(Of IntPtr)”)

ChildrenList.Add(Handle)

Return True

End Function

Private Declare Auto Function SendMessage Lib “user32″ (ByVal hwnd As IntPtr, ByVal wMsg As Integer, ByVal wparam As Integer, ByVal lparam As System.Text.StringBuilder) As IntPtr

Private Declare Auto Function SendMessage Lib “user32″ (ByVal hWnd As IntPtr, ByVal msg As Integer, ByVal wParam As IntPtr, ByVal lParam As String) As IntPtr

Private Declare Auto Function FindWindow Lib “user32″ (ByVal lpClassName As String, ByVal lpWindowName As String) As IntPtr

Private Delegate Function EnumWindowProcess(ByVal Handle As IntPtr, ByVal Parameter As IntPtr) As Boolean

Private Const WM_GETTEXT = &HD

Private Const WM_GETTEXTLENGTH As Integer = &HE

Private Const WM_SETTEXT = &HC

Private Const WM_CHAR = &H102

These functions are to get a list of the windows inside of the MoHAA console, and to get the text from it.

Private Shared Function FindMoH() As IntPtr

FindMoH = FindWindow(“mohaa winconsole”, vbNullString)

End Function

This function gets the window handle for the MoHAA console, which is then used to get the consoles edit controls handle.

Now, for the sending to the console:

Public Shared Function SendText(ByVal Text As String) As Boolean

Dim handle As IntPtr = FindMoH()

If handle = 0 Then

MessageBox.Show(“Medal of Honor Allied Assult Console not found.”, “Error:”, MessageBoxButtons.OK, MessageBoxIcon.Error)

Return “Error;”

Exit Function

End If

For Each child As IntPtr In GetChildWindows(handle)

Dim sClassName As New System.Text.StringBuilder(“”, 256)

Call GetClassName(child, sClassName, 256)

If sClassName.ToString = “Edit” Then

Dim sb As New System.Text.StringBuilder(Text)

SendMessage(child, WM_SETTEXT, 0, sb)

SendMessage(child, WM_CHAR, 13, 1)

Return True

End If

Next

End Function

This finds the Edit control by looping through the handles until if finds one with the class name “Edit”. It then uses SendMessage to set the text in the window, and then sends the Return character to the window to set it

(child, WM_CHAR, 13, 1)

Reading text from the console isnt much different:

Public Shared Function ReadText() As String

ReadText = “”

Dim handle As IntPtr = FindMoH()

If handle = 0 Then

MessageBox.Show(“Medal of Honor Allied Assult Console not found.”, “Error:”, MessageBoxButtons.OK, MessageBoxIcon.Error)

Return “Error;”

Exit Function

End If

For Each child As IntPtr In GetChildWindows(handle)

Dim sClassName As New System.Text.StringBuilder(“”, 256)

Call GetClassName(child, sClassName, 256)

If sClassName.ToString = “Edit” Then

Dim conLength As IntPtr

conLength = SendMessage(child, WM_GETTEXTLENGTH, IntPtr.Zero, IntPtr.Zero)

Dim sbText As New System.Text.StringBuilder(conLength.ToInt32 + 1)

Dim ptrRet As IntPtr

ptrRet = SendMessage(child, WM_GETTEXT, conLength.ToInt32 + 1, sbText)

If Not sbText.ToString = “” Then

Return sbText.ToString

End If

End If

Next

End Function

This again loops through the handles, until it finds the edit control.

It then sends the GETTEXTLENGTH in order to get the length of the text in the console and then sends GETTEXT to the window to the length that was previously returned.

It then builds the string; if it’s not blank then it returns the value.

Now what can we actually do with these functions? Well to be honest, I didn’t use the ReadText function because I figured the only way to use it would be to check it on a loop, then if a specific string came up you could then do whatever, but I couldn’t be bothered with that…

Public Shared Sub SilentShot()

SendText(“echo Silent Shot”)

SendText(“+attackprimary; weapdrop”)

End Sub

Public Shared Sub Time()

SendText(“echo “ & Now.Hour & “:” & Now.Minute & “:” & Now.Second)

SendText(“locationprint 6 29 “ & Now.Hour & “:” & Now.Minute & “:” & Now.Second)

End Sub

Public Shared Sub Connect(ByVal Ip As String)

SendText(“connect “ & Ip)

End Sub

Public Shared Sub Specator()

SendText(“echo Gone Spectator”)

SendText(“spectator”)

End Sub

Public Shared Sub Reconnect()

SendText(“reconnect”)

End Sub

Now, that’s just some basic stuff, but you could create some more advanced scripts such as:

SendText(“+forward”)

System.Threading.Thread.Sleep(50)

SendText(“-forward”)

SendText(“+moveup”)

System.Threading.Thread.Sleep(400)

SendText(“-moveup”)

System.Threading.Thread.Sleep(10)

SendText(“+forward”)

System.Threading.Thread.Sleep(20)

SendText(“+moveup”)

System.Threading.Thread.Sleep(200)

SendText(“-moveup”)

SendText(“+forward”)

System.Threading.Thread.Sleep(200)

SendText(“+moveup”)

System.Threading.Thread.Sleep(100)

SendText(“-moveup”)

System.Threading.Thread.Sleep(20)

SendText(“+moveleft”)

SendText(“-forward”)

SendText(“-moveleft”)

Now I just came up with that and gave it a quick test, so I can’t guarantee that it works every time (It was just a bind that I made and converted, and it was made quickly so there ARE errors)

bind 9 “+forward;wait 50;-forward;+moveup;say jumped;wait 400;-moveup;wait 10;+forward;say forward;wait 20;+moveup;say jumped;+wait 200; -moveup;+forward;wait 200; say jumped;+moveup; wait 100; -moveup;wait 20;+moveleft;-forward;-moveleft;-moveup”

For example, one noticeable error: say jumped;+wait 200;

Now, off of the console stuff, and onto some fun stuff, memory editing!

Public Class Memory

<DllImport(“kernel32.dll”)> Private Shared Function WriteProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As UIntPtr, <Runtime.InteropServices.Out()> ByRef lpNumberOfBytesWritten As IntPtr) As Boolean

End Function

My favourite APIJ, well not really but what you gonna do?

So, anyway, in the main part of the program we have a variable named MoHProchWnd, that’s where I store MoHAA’s PiD using the sub below

Public Shared Sub onLoad()

Try

Dim Processes() As System.Diagnostics.Process

Processes = System.Diagnostics.Process.GetProcessesByName(“MOHAA”)

Main.MoHProchWnd = Processes(0).Handle

Catch ex As Exception

Main.MoHProchWnd = 0

End Try

End Sub

So, anyway below is a basic function for enabling cheats in MoHAA (“Cvars”)

Public Shared Sub EnableCheats()

If Main.MoHProchWnd = 0 Then

onLoad()

End If

Dim bytes As Byte() = New Byte(0) {&H86}

WriteProcessMemory(Main.MoHProchWnd, New IntPtr(&H44F999), bytes, New UIntPtr(CType(bytes.Length, UInt32)), New IntPtr(0))

KeyHook.Cheats = True

End Sub

And then to disable them

Public Shared Sub DisableCheats()

If Main.MoHProchWnd = 0 Then

onLoad()

End If

Dim bytes As Byte() = New Byte(0) {&H85}

WriteProcessMemory(Main.MoHProchWnd, New IntPtr(&H44F999), bytes, New UIntPtr(CType(bytes.Length, UInt32)), New IntPtr(0))

KeyHook.Cheats = False

End Sub

And a quick example of what else can be done:

Public Shared Sub EnableThirdPerson()

If Main.MoHProchWnd = 0 Then

onLoad()

End If

Dim bytes As Byte() = New Byte(0) {&H1}

WriteProcessMemory(Main.MoHProchWnd, New IntPtr(&HECCAF0), bytes, New UIntPtr(CType(bytes.Length, UInt32)), New IntPtr(0))

KeyHook.ThirdPerson = True

Console.SendText(“cg_cameraverticaldisplacement -18″)

Console.SendText(“echo 3rd Person Camera Position Fixed”)

End Sub

Public Shared Sub DisableThirdPerson()

If Main.MoHProchWnd = 0 Then

onLoad()

End If

Dim bytes As Byte() = New Byte(0) {&H0}

WriteProcessMemory(Main.MoHProchWnd, New IntPtr(&HECCAF0), bytes, New UIntPtr(CType(bytes.Length, UInt32)), New IntPtr(0))

KeyHook.ThirdPerson = False

Console.SendText(“cg_cameraverticaldisplacement -2″)

Console.SendText(“echo 1st Person Camera Position Fixed”)

End Sub

That uses the console class to correct the camera position, and edits the programs memory to enable the third person – Note, that since it directly pokes an address, cheats do not need to be enabled to toggle 3^rd person.

Now, onto the usage of these classes further. As I previously stated, I set this up on a global key hook. Below is the sub that I use to carry out the above functions.

Private Shared Sub KeyCheck()

If n0Down = True Then

If Cheats = True Then

Cheats = False

Memory.DisableCheats()

Else

Cheats = True

Memory.EnableCheats()

End If

ElseIf n1Down = True Then

If ThirdPerson = True Then

ThirdPerson = False

Memory.DisableThirdPerson()

Else

ThirdPerson = True

Memory.EnableThirdPerson()

End If

ElseIf n2Down = True Then

Console.SilentShot()

ElseIf n3Down = True Then

Console.Specator()

ElseIf n4Down = True Then

Console.Time()

ElseIf n5Down = True Then

Console.Reconnect()

ElseIf n6Down = True Then

Console.Connect(“213.251.176.208:28305″)

Console.SendText(“Echo Connecting to LCA V2 Sniper only”)

Console.SendText(“Echo IP: 213.251.176.208:28305″)

Exit Sub

ElseIf n7Down = True Then

Console.Connect(“213.251.176.208:12000″)

Console.SendText(“Echo Connecting to LCA Stalingrad Sniper only”)

Console.SendText(“Echo IP: 213.251.176.208:12000″)

ElseIf n8Down = True Then

Console.Connect(“217.79.181.142:27001″)

Console.SendText(“Echo Connecting to [NAG] Stalingrad Sniper only 1″)

Console.SendText(“Echo IP: 217.79.181.142:27001″)

ElseIf n9Down = True Then

Console.Connect(“213.133.101.46:27001″)

Console.SendText(“Echo Connecting to [NAG] Stalingrad Sniper only 2″)

Console.SendText(“Echo IP: 213.133.101.46:27001″)

ElseIf minusDown = True Then

WindowFunctions.MinimiseWindow()

End If

End Sub

As you can see, it just checks what key is down, and then if the specified one is, it carries out the function. n0 and n1 toggle the two memory functions by checking a Boolean to see if the function is enabled or not.

I was playing again earlier and thought about making a more accurate sniper rifle.

I tried to just make a bind:

bind MOUSE1 “+attacksecondary; +attackprimary; -attacksecondary”

However, due to the way that MoHAA works, this would not carry out the zoom out function. So, I looked through the cmdlist, and found the zoomoff function, and made a new bind:

bind MOUSE1 “+attacksecondary; +attackprimary; zoomoff”

Whilst this worked when playing on a local server, I tried it on another server and it did not work.

So now, I have not actually done this, but I would also hook the mouse, then if the mouse is clicked I would send these messages to console, after unbinding Mouse1 in game:

Console.SendText(“+attacksecondary”)

Console.SendText(“+attackprimary”)

Console.SendText(“-attacksecondary”)

But that however would do that for every single gun in the game, so I looked further for a console command that would give me the name of the gun currently in use. I searched both the cmdlist and the cvarslist, to no avail.

I then went searching in the memory, and found a number of helpful addresses:

010EEEF0 – Text[22] – The name of the gun as a string

010EEF40 – 4 Bytes – The gun as an integer

I decided that the best way to do it would be using the integer, and then a list of values to see what gun is currently in use. I tested all the weapons and created this list

Value/Weapon

1 - Papers

2 - Colt 45

3 - Walther P38

4 - Hi Standard Silenced

5 - M1 Garand

6 - Mauser KAR 98K

7 - KAR98 - Sniper

8 - Springfield

9 - Thompson

10 - MP40

11 - BAR

12 - StG 44

13 - Frag Grenade

14 - Stielhandgranate

15 - Bazooka

16 – Panzerschreck

Now, I can read the memory at that address, and if the current weapon is either 7 or 8, it will send the zoom in, shoot, zoom out function for a 100% accurate shot.