simple bunnyhop not working, can't get modulehandle

[nikooo777]

Hello, i found a bunnyhop source on uc forum and decided to try it out, i got a serious issue now, right here:

do
     {    
     Clientdll = GetModuleHandleA("client.dll");
	 cout << "getting it... \n";
     Sleep(20);
     }while(!Clientdll);

it keeps returning a null value and won't continue. i seriously do not understand why it gets stuck there.
i would really appreciate if somebody would tell me what's going wrong in this code.

the full source is the following: (btw the onground address is checked (25.6.2011) and it's working)

#include "stdafx.h"
#include <windows.h>
#include <iostream>

using namespace std;
void bunnyhop()
{
     HMODULE Clientdll;

     do
     {    
     Clientdll = GetModuleHandleA("client.dll");
	 cout << "getting it... \n";
     Sleep(20);
     }while(!Clientdll);
		cout << "got the module handle!!!";
                if( (*(int*)((DWORD)Clientdll + 0x53D9D8) == 0) && (GetAsyncKeyState(VK_MENU)<0) ) // VK_MENU = Alt, offset can change after updates
                {
                    keybd_event(VK_SPACE, 0x39, 0, 0);
                    Sleep(60);
                    keybd_event(VK_SPACE, 0x39, KEYEVENTF_KEYUP, 0);
                }
                Sleep(1);
  }
int main ()
{
	while (!GetAsyncKeyState(VK_F10)) 
	{
		bunnyhop();
	}
	return 0;
}

thanks for your attenction!

[mencore]

Re: simple bunnyhop not working, can't get modulehandle

GetModuleHandle on an external cheat? :x
You cant call GetModuleHandle incase you're not inside the process. Inject your cheat as a DLL or use external GetModuleHandle solution ( preferable at this case )

I'm not sure who has originally done this but credits to him:

HMODULE GetModuleHandleExtern( char *szModuleName, DWORD dwProcessId ) // GetMoguleHandle recode for external processes
{
   if( !szModuleName || !dwProcessId ) { return NULL; } // invalid input
   HANDLE hSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessId );
   if( hSnap == INVALID_HANDLE_VALUE ) { return NULL; }
   MODULEENTRY32 me;
   me.dwSize = sizeof( MODULEENTRY32 );
   if( Module32First( hSnap, &me ) ) // we go now
   {
      while( Module32Next( hSnap, &me ) ) // through all modules in the target process
      {
         if( !strcmp( me.szModule, szModuleName ) ) // is this the model we are looking for?
         {
            CloseHandle( hSnap );
            return me.hModule; // this is our module, return it.
         }
      }
   }
   CloseHandle( hSnap );
   return NULL; // counldn't find module
}

[nikooo777]

Re: simple bunnyhop not working, can't get modulehandle

thanks a lot for the answer! i really appreciate it to be helped :)

now i worked on it and got it compiling and working in release mode.

the only problem left is that it crashes when it tried to read the value of the memory address. unluckily i couldn't find a solution on google.
I'm then asking again this big community if anyone knows what i have to add to solve this issue,
the actual error is:

First-chance exception at 0x004012d6 in bunnyhopping.exe: 0xC0000005: Access violation reading location 0x1b440a0c.
Unhandled exception at 0x004012d6 in bunnyhopping.exe: 0xC0000005: Access violation reading location 0x1b440a0c.
The program '[1132] bunnyhopping.exe: Native' has exited with code -1073741819 (0xc0000005).

looks like it has no access to the process. (I'm starting it as Administrator!)

the whole code (i optimized it for better understanding) is:

#include "stdafx.h"
#include <windows.h>
#include <iostream>
#include <Tlhelp32.h>

using namespace std;
HMODULE Clientdll = NULL;
/*HWND hwnd;
HANDLE phandle;
DWORD pid;*/

DWORD GetProcessIDFromName(LPSTR szProcName)				//this function gets the id of a process using a name (hl2.exe for instance)
{
	PROCESSENTRY32 procEntry;
	HANDLE hSnapshot;
	BOOL bFound;

	if(!(hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0))) return 0;	
	procEntry.dwSize = sizeof(PROCESSENTRY32);

	bFound = Process32First(hSnapshot, &procEntry);
	while(bFound) 
	{
		if(!lstrcmp(procEntry.szExeFile, szProcName)) 
		{
			CloseHandle(hSnapshot);
			return procEntry.th32ProcessID;
		}
		bFound = Process32Next(hSnapshot, &procEntry);
	}
	CloseHandle(hSnapshot);
	return 0;
}

HMODULE GetModuleHandleExtern( char *szModuleName, DWORD dwProcessId )			//GetMoguleHandle recode for external processes
{
   if( !szModuleName || !dwProcessId ) { return NULL; }					//invalid input
   HANDLE hSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessId );
   if( hSnap == INVALID_HANDLE_VALUE ) { return NULL; }
   MODULEENTRY32 me;
   me.dwSize = sizeof( MODULEENTRY32 );
   if( Module32First( hSnap, &me ) )							//we go now
   {
      while( Module32Next( hSnap, &me ) )						//through all modules in the target process
      {
         if( !strcmp( me.szModule, szModuleName ) )					//is this the model we are looking for?
         {
            CloseHandle( hSnap );
            return me.hModule;								//this is our module, return it.
         }
      }
   }
   CloseHandle( hSnap );
   return NULL;										//counldn't find module
}

int main ()
{
	cout << "waiting for counter strike source...\n";
	while( FindWindowA( "Valve001", NULL ) == NULL )				//before getting the module handle i wait for css
	{
		Sleep( 100 );
	}

	/*
	while (!hwnd)									//this is a test trying to fix the actual issue
	{
		hwnd = FindWindowA( "Valve001", NULL );
	}
	GetWindowThreadProcessId(hwnd, &pid);
    phandle = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
	*/

	cout << "found the game!\n";
	cout << "the id of process is: " << GetProcessIDFromName("hl2.exe") << "\n";		//showing the id to debug better
	cout << "getting the module handle of client.dll\n";
	do
	{    
		Clientdll = GetModuleHandleExtern("client.dll", GetProcessIDFromName("hl2.exe"));	//at this point we get the module handle from an ext process
		Sleep(20);						//thanks a lot to mencore
	}
	while(Clientdll == NULL);					//just looping it until we get it even if this shouldn't be needed
	
	cout << "got the module handle!!!";	
	cout << "the base is: " << Clientdll << "\n";							//showing it to debug it

	while (!GetAsyncKeyState(VK_F10))								//loops the bhop code untill f10 is pressed
	{
		if( (*(int*)((DWORD)Clientdll + 0x590A0C) == 0) && (GetAsyncKeyState(VK_MENU)<0) )	//checks for OnGround->yes and ALT->pressed
		{
			keybd_event(VK_SPACE, 0x39, 0, 0);						//simulates jump...
			Sleep(60);
			keybd_event(VK_SPACE, 0x39, KEYEVENTF_KEYUP, 0);
		}
		Sleep(1);									//this value could be changed to a greater one to fit slower pc's
	}
	return 0;
}

a copy on pastebin:

http://pastebin.com/Q5cLWD7F

thanks already for your time!
Once i understood well how it works I'll make a tutorial with all explanations on this forum!

[mencore]

Re: simple bunnyhop not working, can't get modulehandle

thanks a lot for the answer! i really appreciate it to be helped :)

now i worked on it and got it compiling and working in release mode.

the only problem left is that it crashes when it tried to read the value of the memory address. unluckily i couldn't find a solution on google.
I'm then asking again this big community if anyone knows what i have to add to solve this issue,
the actual error is:

looks like it has no access to the process. (I'm starting it as Administrator!)

the whole code (i optimized it for better understanding) is:

#include "stdafx.h"
#include <windows.h>
#include <iostream>
#include <Tlhelp32.h>

using namespace std;
HMODULE Clientdll = NULL;
/*HWND hwnd;
HANDLE phandle;
DWORD pid;*/

DWORD GetProcessIDFromName(LPSTR szProcName)				//this function gets the id of a process using a name (hl2.exe for instance)
{
	PROCESSENTRY32 procEntry;
	HANDLE hSnapshot;
	BOOL bFound;

	if(!(hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0))) return 0;	
	procEntry.dwSize = sizeof(PROCESSENTRY32);

	bFound = Process32First(hSnapshot, &procEntry);
	while(bFound) 
	{
		if(!lstrcmp(procEntry.szExeFile, szProcName)) 
		{
			CloseHandle(hSnapshot);
			return procEntry.th32ProcessID;
		}
		bFound = Process32Next(hSnapshot, &procEntry);
	}
	CloseHandle(hSnapshot);
	return 0;
}

HMODULE GetModuleHandleExtern( char *szModuleName, DWORD dwProcessId )			//GetMoguleHandle recode for external processes
{
   if( !szModuleName || !dwProcessId ) { return NULL; }					//invalid input
   HANDLE hSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessId );
   if( hSnap == INVALID_HANDLE_VALUE ) { return NULL; }
   MODULEENTRY32 me;
   me.dwSize = sizeof( MODULEENTRY32 );
   if( Module32First( hSnap, &me ) )							//we go now
   {
      while( Module32Next( hSnap, &me ) )						//through all modules in the target process
      {
         if( !strcmp( me.szModule, szModuleName ) )					//is this the model we are looking for?
         {
            CloseHandle( hSnap );
            return me.hModule;								//this is our module, return it.
         }
      }
   }
   CloseHandle( hSnap );
   return NULL;										//counldn't find module
}

int main ()
{
	cout << "waiting for counter strike source...\n";
	while( FindWindowA( "Valve001", NULL ) == NULL )				//before getting the module handle i wait for css
	{
		Sleep( 100 );
	}

	/*
	while (!hwnd)									//this is a test trying to fix the actual issue
	{
		hwnd = FindWindowA( "Valve001", NULL );
	}
	GetWindowThreadProcessId(hwnd, &pid);
    phandle = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
	*/

	cout << "found the game!\n";
	cout << "the id of process is: " << GetProcessIDFromName("hl2.exe") << "\n";		//showing the id to debug better
	cout << "getting the module handle of client.dll\n";
	do
	{    
		Clientdll = GetModuleHandleExtern("client.dll", GetProcessIDFromName("hl2.exe"));	//at this point we get the module handle from an ext process
		Sleep(20);						//thanks a lot to mencore
	}
	while(Clientdll == NULL);					//just looping it until we get it even if this shouldn't be needed
	
	cout << "got the module handle!!!";	
	cout << "the base is: " << Clientdll << "\n";							//showing it to debug it

	while (!GetAsyncKeyState(VK_F10))								//loops the bhop code untill f10 is pressed
	{
		if( (*(int*)((DWORD)Clientdll + 0x590A0C) == 0) && (GetAsyncKeyState(VK_MENU)<0) )	//checks for OnGround->yes and ALT->pressed
		{
			keybd_event(VK_SPACE, 0x39, 0, 0);						//simulates jump...
			Sleep(60);
			keybd_event(VK_SPACE, 0x39, KEYEVENTF_KEYUP, 0);
		}
		Sleep(1);									//this value could be changed to a greater one to fit slower pc's
	}
	return 0;
}

a copy on pastebin:

http://pastebin.com/Q5cLWD7F

thanks already for your time!
Once i understood well how it works I'll make a tutorial with all explanations on this forum!

Since you're doing this externally with a *.exe, you cant just use pointers like that, you need to RPM the value of the address. ( client.dll + 0x590A0C ).
Making sure you enable debug privileges is also a good thing to do.

[nikooo777]

Re: simple bunnyhop not working, can't get modulehandle

okay i understand that i cannot use the pointers like that but actually i didn't understand the RPM thing, what does it mean?
i googled a bit but couldn't find anything programming related.

by the way, i am doing this externally because this wouldn't trigger VAC, i guess that doing it as a dll and then injecting it into the game would get you a nice ban, am i right?

I didn't know that reading a value from a memory address would be so hard to do externally. and by the way, it doesn't compile in debug mode, this only compiles in release, which is fine anyway.

btw, i found an outdated old bunnyhop hack for cs and csz done the way i'm trying to do:

http://elxdraco.net/forum/viewtopic.php?f=28&t=6679

but it looks quite weird because he's also checking for something else than onground which i didn't understand.

E: lol it compiles on debug... unicode thingy was on.