Help/Support help to make zoom-out with IDA

L O V A · August 2, 2020

Hi all. i have been trying to hack an online game and i want to make zoom out for better view to see enemies. such as like Agario zoom hack

but this one looks hard for me cuz im not that pro cheater with IDA Pro.

So here is the function that i need it to be hacked.

.il2cpp:0000000102875048 var_18          = -0x18
.il2cpp:0000000102875048 var_10          = -0x10
.il2cpp:0000000102875048 var_s0          =  0
.il2cpp:0000000102875048
.il2cpp:0000000102875048                 SUB             SP, SP, #0x30
.il2cpp:000000010287504C                 STP             X20, X19, [SP,#0x20+var_10]
.il2cpp:0000000102875050                 STP             X29, X30, [SP,#0x20+var_s0]
.il2cpp:0000000102875054                 ADD             X29, SP, #0x20
.il2cpp:0000000102875058                 MOV             X19, X0
.il2cpp:000000010287505C                 ADRP            X20, #qword_104D8EC30@PAGE
.il2cpp:0000000102875060                 LDR             X1, [X20,#qword_104D8EC30@PAGEOFF]
.il2cpp:0000000102875064                 CBNZ            X1, loc_10387508C
.il2cpp:0000000102875068                 ADRP            X0, #aUnityengineCam@PAGE ; "Cam::get_View()"
.il2cpp:000000010287506C                 ADD             X0, X0, #aUnityengineCam@PAGEOFF ; "Cam::get_View()"
.il2cpp:0000000102875070                 BL              sub_101124E8C
.il2cpp:0000000102875074                 MOV             X1, X0
.il2cpp:0000000102875078                 CBNZ            X0, loc_103875088
.il2cpp:000000010287507C                 ADRP            X0, #aUnityengineCam@PAGE ; "Cam::get_View()"
.il2cpp:0000000102875080                 ADD             X0, X0, #aUnityengineCam@PAGEOFF ; "Cam::get_View()"
.il2cpp:0000000102875084                 STR             X1, [SP,#0x20+var_18]
.il2cpp:0000000102875088                 BL              sub_1011216EC
.il2cpp:000000010287508C                 MOV             X1, #0
.il2cpp:0000000102875090                 BL              sub_101120410
.il2cpp:0000000102875094 ; ---------------------------------------------------------------------------
.il2cpp:0000000102875094                 LDR             X1, [SP,#0x20+var_18]
.il2cpp:0000000102875098
.il2cpp:0000000102875098 loc_103875088                           ; CODE XREF: Cam$$get_View+30↑j
.il2cpp:0000000102875098                 STR             X1, [X20,#qword_104D8EC30@PAGEOFF]
.il2cpp:000000010287509C
.il2cpp:000000010287509C loc_10387508C                           ; CODE XREF: Cam$$get_View+1C↑j
.il2cpp:000000010287509C                 MOV             X0, X19
.il2cpp:0000000102875100                 LDP             X29, X30, [SP,#0x20+var_s0]
.il2cpp:0000000102875104                 LDP             X20, X19, [SP,#0x20+var_10]
.il2cpp:0000000102875108                 ADD             SP, SP, #0x30 ; '0'
.il2cpp:000000010287510C                 BR              X1
.il2cpp:000000010287510C ; End of function Cam$$get_View

this is the right function of camera view

all what i want is to make slide switch hack "the slide is to custom the zoom in/out"

all what i can do is to zoom-in i couldn't find out how to zoom-out.

all what i did is take the offset: 102875048 change to fmov s0, #31

now fmove s0, #10 super zoom-in if we increase the number we go zoom out until fmov s0, #31 the max value

but the game original zoom is #29 if change to #31 not a big difference it's like useless.

i tried everything i know only (fmove s0, #31) worked,

Any possible way/method to zoom out more?

Updated August 2, 2020 by L O V A

bR34Kr · August 2, 2020

Unity is in a 3D environment as far as I know, so basically you want to find the function to set the Camera location. This way you can move it up or down or whatever. The reason it does that is because of ARM's way of handling floating point. I think in the Club "IDA tips" there should be something detailing your issue. But for the set location you'd want to call that function by making a function pointer to it. If it's too complicated you can find the GetCameraLocation and move on an axis but again, you are limited by the floats in ARM

Max-Q · August 2, 2020

Or just find the fov in the player class or in camera class from the dump and modify the float value(slider or just simple modification). Or search field of view inside dump and find the right class, if there isn't in player class or camera class. Example of a camera class where fov can be modified

// Namespace: 
[RequireComponent] // RVA: 0x1002C437C Offset: 0x2C437C
[VoodooPresetSourceAttribute] // RVA: 0x1002C437C Offset: 0x2C437C
public class vp_FPCamera : vp_Component // TypeDefIndex: 14388
{
	// Fields
	public vp_FPController FPController; // 0x98
	private vp_FPInput m_FPInput; // 0xA0
	[CompilerGeneratedAttribute] // RVA: 0x1002F1C0C Offset: 0x2F1C0C
	private IAimController <AimController>k__BackingField; // 0xA8
	public Vector2 MouseSensitivity; // 0xB0
	public int MouseSmoothSteps; // 0xB8
	public float MouseSmoothWeight; // 0xBC
	public bool MouseAcceleration; // 0xC0
	public float MouseAccelerationThreshold; // 0xC4
	public float MouseAccelerationForce; // 0xC8
	protected Vector2 m_MouseMove; // 0xCC
	protected List<Vector2> m_MouseSmoothBuffer; // 0xD8
	public float RenderingFieldOfView; // 0xE0
	public float RenderingZoomDamping; // 0xE4
	protected float m_FinalZoomTime; // 0xE8
	public Vector3 PositionOffset; // 0xEC
	public float PositionGroundLimit; // 0xF8
	public float PositionSpringStiffness; // 0xFC
	public float PositionSpringDamping; // 0x100
	public float PositionSpring2Stiffness; // 0x104
	public float PositionSpring2Damping; // 0x108
	public float PositionKneeling; // 0x10C
	public int PositionKneelingSoftness; // 0x110
	protected vp_Spring m_PositionSpring; // 0x118
	protected vp_Spring m_PositionSpring2; // 0x120
	protected bool m_DrawCameraCollisionDebugLine; // 0x128
	public Vector2 RotationPitchLimit; // 0x12C
	public Vector2 RotationYawLimit; // 0x134
	public float RotationSpringStiffness; // 0x13C
	public float RotationSpringDamping; // 0x140
	public float RotationKneeling; // 0x144
	public int RotationKneelingSoftness; // 0x148
	public float RotationStrafeRoll; // 0x14C
	protected float m_Pitch; // 0x150
	protected float m_Yaw; // 0x154
	protected vp_Spring m_RotationSpring; // 0x158
	protected Vector2 m_InitialRotation; // 0x160
	public float ShakeSpeed; // 0x168
	public Vector3 ShakeAmplitude; // 0x16C
	protected Vector3 m_Shake; // 0x178
	public Vector4 BobRate; // 0x184
	public Vector4 BobAmplitude; // 0x194
	public float BobInputVelocityScale; // 0x1A4
	public float BobMaxInputVelocity; // 0x1A8
	public bool BobRequireGroundContact; // 0x1AC
	protected float m_LastBobSpeed; // 0x1B0
	protected Vector4 m_CurrentBobAmp; // 0x1B4
	protected Vector4 m_CurrentBobVal; // 0x1C4
	protected float m_BobSpeed; // 0x1D4
	public vp_FPCamera.BobStepDelegate BobStepCallback; // 0x1D8
	public float BobStepThreshold; // 0x1E0
	protected float m_LastUpBob; // 0x1E4
	protected bool m_BobWasElevating; // 0x1E8
	protected Vector3 m_CameraCollisionStartPos; // 0x1EC
	protected Vector3 m_CameraCollisionEndPos; // 0x1F8
	protected RaycastHit m_CameraHit; // 0x204
	public float HeadImpactMultiplier; // 0x230
	[ObsoleteAttribute] // RVA: 0x1002F1C1C Offset: 0x2F1C1C
	public Vector2 AttackRecoil; // 0x234
	[CompilerGeneratedAttribute] // RVA: 0x1002F1C2C Offset: 0x2F1C2C
	private Vector2 <AttackRecoilNew>k__BackingField; // 0x23C
	private vp_FPAutoAimFovHelper autoAimHelper; // 0x248
	private FOVRecalculator fovRecalculator; // 0x250
	private vp_FPMSPlayerEventHandler m_Player; // 0x258
	private ShellShockEffectController m_ShellShock; // 0x260
	private Camera cachedCamera; // 0x268
	private int shakeIndex; // 0x270

	// Properties
	public bool IsMouseMoved { get; }
	public IAimController AimController { get; set; }
	public Vector2 AttackRecoilNew { get; set; }
	private float renderingFieldOfViewWithAutoAim { get; }
	public bool DrawCameraCollisionDebugLine { get; set; }
	private vp_FPMSPlayerEventHandler Player { get; }
	public Vector2 Angle { get; set; }
	public Vector3 Forward { get; }
	public float Pitch { get; set; }
	public float Yaw { get; set; }
	protected virtual Vector2 OnValue_Rotation { get; set; }
	protected virtual Vector3 OnValue_Forward { get; }

	// Methods
	public bool get_IsMouseMoved() { } // RVA: 0x101EED8E4 Offset: 0x1EED8E4
	[CompilerGeneratedAttribute] // RVA: 0x10033A490 Offset: 0x33A490
	public IAimController get_AimController() { } // RVA: 0x101EEDA90 Offset: 0x1EEDA90
	[CompilerGeneratedAttribute] // RVA: 0x10033A4A0 Offset: 0x33A4A0
	private void set_AimController(IAimController value) { } // RVA: 0x101EEDA98 Offset: 0x1EEDA98
	[CompilerGeneratedAttribute] // RVA: 0x10033A4B0 Offset: 0x33A4B0
	public Vector2 get_AttackRecoilNew() { } // RVA: 0x101EEDAA0 Offset: 0x1EEDAA0
	[CompilerGeneratedAttribute] // RVA: 0x10033A4C0 Offset: 0x33A4C0
	public void set_AttackRecoilNew(Vector2 value) { } // RVA: 0x101EEDAAC Offset: 0x1EEDAAC
	private float get_renderingFieldOfViewWithAutoAim() { } // RVA: 0x101EEDAB8 Offset: 0x1EEDAB8
	public bool get_DrawCameraCollisionDebugLine() { } // RVA: 0x101EEDB80 Offset: 0x1EEDB80
	public void set_DrawCameraCollisionDebugLine(bool value) { } // RVA: 0x101EEDB88 Offset: 0x1EEDB88
	private vp_FPMSPlayerEventHandler get_Player() { } // RVA: 0x101EEDB90 Offset: 0x1EEDB90
	public Vector2 get_Angle() { } // RVA: 0x101EEDCF0 Offset: 0x1EEDCF0
	public void set_Angle(Vector2 value) { } // RVA: 0x101EEDD24 Offset: 0x1EEDD24
	public Vector3 get_Forward() { } // RVA: 0x101EEDDCC Offset: 0x1EEDDCC
	public float get_Pitch() { } // RVA: 0x101EED96C Offset: 0x1EED96C
	public void set_Pitch(float value) { } // RVA: 0x101EED974 Offset: 0x1EED974
	public float get_Yaw() { } // RVA: 0x101EEDE00 Offset: 0x1EEDE00
	public void set_Yaw(float value) { } // RVA: 0x101EEDD4C Offset: 0x1EEDD4C
	protected override void Awake() { } // RVA: 0x101EEDE08 Offset: 0x1EEDE08
	protected override void OnEnable() { } // RVA: 0x101EEEAAC Offset: 0x1EEEAAC
	protected override void OnDisable() { } // RVA: 0x101EEEE00 Offset: 0x1EEEE00
	protected override void Start() { } // RVA: 0x101EEEEC0 Offset: 0x1EEEEC0
	protected override void Init() { } // RVA: 0x101EEEF18 Offset: 0x1EEEF18
	public void ManualUpdate() { } // RVA: 0x101EEEF1C Offset: 0x1EEEF1C
	protected override void FixedUpdate() { } // RVA: 0x101EEEFD4 Offset: 0x1EEEFD4
	protected override void LateUpdate() { } // RVA: 0x101EEF06C Offset: 0x1EEF06C
	private void UpdateCameraRotation() { } // RVA: 0x101EEF070 Offset: 0x1EEF070
	protected virtual void DoCameraCollision() { } // RVA: 0x101EEF5D0 Offset: 0x1EEF5D0
	public virtual void AddForce(Vector3 force) { } // RVA: 0x101EEFAEC Offset: 0x1EEFAEC
	public virtual void AddForce(float x, float y, float z) { } // RVA: 0x101EEFB44 Offset: 0x1EEFB44
	public virtual void AddForce2(Vector3 force) { } // RVA: 0x101EEFB98 Offset: 0x1EEFB98
	public void AddForce2(float x, float y, float z) { } // RVA: 0x101EEFBF0 Offset: 0x1EEFBF0
	public virtual void AddRollForce(float force) { } // RVA: 0x101EEFC44 Offset: 0x1EEFC44
	public virtual void AddRotationForce(Vector3 force) { } // RVA: 0x101EEFCFC Offset: 0x1EEFCFC
	public void AddRotationForce(float x, float y, float z) { } // RVA: 0x101EEFD54 Offset: 0x1EEFD54
	public void UpdateCamera(float mouseX, float mouseY) { } // RVA: 0x101EEEFA4 Offset: 0x1EEEFA4
	protected virtual void UpdateMouseLook(float mouseX, float mouseY) { } // RVA: 0x101EEFDA8 Offset: 0x1EEFDA8
	protected virtual void UpdateZoom() { } // RVA: 0x101EF0434 Offset: 0x1EF0434
	public virtual void Zoom() { } // RVA: 0x101EF05A4 Offset: 0x1EF05A4
	public virtual void SnapZoom() { } // RVA: 0x101EF05D4 Offset: 0x1EF05D4
	protected virtual void UpdateShakes() { } // RVA: 0x101EF069C Offset: 0x1EF069C
	protected virtual void UpdateBob() { } // RVA: 0x101EF081C Offset: 0x1EF081C
	protected virtual void DetectBobStep(float speed, float upBob) { } // RVA: 0x101EF0DC0 Offset: 0x1EF0DC0
	protected virtual void UpdateSwaying() { } // RVA: 0x101EF1128 Offset: 0x1EF1128
	protected virtual void UpdateSprings() { } // RVA: 0x101EF127C Offset: 0x1EF127C
	public virtual void DoBomb(Vector3 positionForce, float minRollForce, float maxRollForce) { } // RVA: 0x101EF12E8 Offset: 0x1EF12E8
	public override void Refresh() { } // RVA: 0x101EF1360 Offset: 0x1EF1360
	public virtual void SnapSprings() { } // RVA: 0x101EF169C Offset: 0x1EF169C
	public virtual void StopSprings() { } // RVA: 0x101EF1860 Offset: 0x1EF1860
	public virtual void Stop() { } // RVA: 0x101EF18C0 Offset: 0x1EF18C0
	public virtual void SetRotation(Vector2 eulerAngles, bool stop = True, bool resetInitialRotation = True) { } // RVA: 0x101EF1910 Offset: 0x1EF1910
	protected virtual void OnMessage_FallImpact(float impact) { } // RVA: 0x101EF19E8 Offset: 0x1EF19E8
	protected virtual void OnMessage_HeadImpact(float impact) { } // RVA: 0x101EF1BB8 Offset: 0x1EF1BB8
	public void BombShake(BombShakeArgs args) { } // RVA: 0x101EF1CF0 Offset: 0x1EF1CF0
	protected virtual void OnStart_Zoom() { } // RVA: 0x101EF1DC4 Offset: 0x1EF1DC4
	protected virtual bool CanStart_Run() { } // RVA: 0x101EF1E7C Offset: 0x1EF1E7C
	protected virtual Vector2 get_OnValue_Rotation() { } // RVA: 0x101EF1F78 Offset: 0x1EF1F78
	protected virtual void set_OnValue_Rotation(Vector2 value) { } // RVA: 0x101EF1FAC Offset: 0x1EF1FAC
	protected virtual void OnMessage_Stop() { } // RVA: 0x101EF1FD4 Offset: 0x1EF1FD4
	protected virtual Vector3 get_OnValue_Forward() { } // RVA: 0x101EF1FE4 Offset: 0x1EF1FE4
	private void OnMouseControllerChanged() { } // RVA: 0x101EEEB74 Offset: 0x1EEEB74
	public void ResetSmoothBuffer() { } // RVA: 0x101EF1FE8 Offset: 0x1EF1FE8
	public void .ctor() { } // RVA: 0x101EF2048 Offset: 0x1EF2048
}

This float can be modified to get fov modification : "private float get_renderingFieldOfViewWithAutoAim() { } // RVA: 0x101EEDAB8 Offset: 0x1EEDAB8"

Updated August 2, 2020 by Max-Q

L O V A · August 3, 2020

@Max-Q i have been doing that but when i make package no luck or i picked wrong class

can i share the work with you?

Updated August 3, 2020 by L O V A

Max-Q · August 3, 2020

5 hours ago, L O V A said:

@Max-Q i have been doing that but when i make package no luck or i picked wrong class

can i share the work with you?

How you want. But you can just post the ss with the error compile, then if need you can send over.

You can use also live offset patcher to do much faster things in a game, and test offsets, to avoid compiling everytime.

Updated August 3, 2020 by Max-Q

L O V A · August 3, 2020

18 minutes ago, Max-Q said:

How you want. But you can just post the ss with the error compile, then if need you can send over.

You can use also live offset patcher to do much faster things in a game, and test offsets, to avoid compiling everytime.

ok i will PM everything