Esp 'Checker'

[a1tl4]

I did it 1 year ago but never finish it, so i have no reason to keep it hides..
Its take a screenshot of a player and send to server..
I make it to get print.jpg of my folder (screentest.jpg) and send to server.. you can easily get a picture of a player using packets..
You might use the own function of the source to take a screenshot and saves in any folder (i prefer to use %temp%, after send to server and delete it automatically)

Function to take screenshot:

void ZGameInterface::SaveScreenShot()
{
    static unsigned long int st_nLastTime = 0;
    unsigned long int nNowTime = timeGetTime();
#define SCREENSHOT_DELAY        2000

    // 2ÃÊ µô·¹ÀÌ
    if ((nNowTime - st_nLastTime) < SCREENSHOT_DELAY)    return;
    st_nLastTime = nNowTime;


    //HDC dc;

    char szPath[_MAX_PATH];
    char szFilename[_MAX_PATH];
    char szFilenameSafe[_MAX_PATH];

    TCHAR szMyDocPath[MAX_PATH];
    if (GetMyDocumentsPath(szMyDocPath)) {
        strcpy(szPath, szMyDocPath);
        strcat(szPath, GUNZ_FOLDER);
        CreatePath(szPath);
        strcat(szPath, SCREENSHOT_FOLDER);
        CreatePath(szPath);
        strcat(szPath, "/");
    }

    // ÇöÀç °ÔÀÓ Á¤º¸·Î ÆÄÀϸíÀ» ±¸¼º
    SYSTEMTIME t;
    GetLocalTime(&t);
    char szCharName[MATCHOBJECT_NAME_LENGTH];
    ValidateFilename(szCharName, ZGetMyInfo()->GetCharName(), '_');

    sprintf(szFilename, "%s_%4d%02d%02d_%02d%02d%02d",
        szCharName, t.wYear, t.wMonth, t.wDay, t.wHour, t.wMinute, t.wSecond);

    sprintf(szFilenameSafe, "nocharname_%4d%02d%02d_%02d%02d%02d",
        t.wYear, t.wMonth, t.wDay, t.wHour, t.wMinute, t.wSecond);    // ij¸¯¸íÀ» »ý·«ÇÑ ¹öÀü

    char szFullPath[_MAX_PATH];
    char szFullPathToNotify[_MAX_PATH];

    sprintf(szFullPath, "%s%s", szPath, szFilename);
    sprintf(szFullPathToNotify, GUNZ_FOLDER SCREENSHOT_FOLDER"/""%s.jpg", szFilename);

    int cx = GetSystemMetrics(SM_CXSCREEN);
    int cy = GetSystemMetrics(SM_CYSCREEN);

    IDirect3DSurface9* surface;
    D3DDISPLAYMODE mode;
    LPDIRECT3DDEVICE9 pDevice = RGetDevice();
    pDevice->CreateOffscreenPlainSurface(cx, cy, D3DFMT_A8R8G8B8, D3DPOOL_SYSTEMMEM, &surface, NULL);
    if (pDevice->GetFrontBufferData(0, surface) == D3D_OK)
    {
        D3DXSaveSurfaceToFile(strcat(szFullPath, ".jpg"), D3DXIFF_JPG, surface, NULL, NULL);

        char szOutput[_MAX_PATH * 2];
        ZTransMsg(szOutput, MSG_SCREENSHOT_SAVED, 1, szFullPathToNotify);
        ZChatOutput(MCOLOR(ZCOLOR_CHAT_SYSTEM), szOutput);
        surface->Release();
    }
} 

Now my code ..

void ChatCmd_AdminScreenShot(const char* line, const int argc, char **const argv)
{
    FILE *f = fopen("screenshot.jpg", "rb");
    if (!f) ZCustomOutput("Erro ao ler o arquivo screenshot.jpg");
    fseek(f, 0, SEEK_END);
    long fsize = ftell(f);
    fseek(f, 0, SEEK_SET);

    char *string = (char*)malloc(fsize + 1);
    fread(string, fsize, 1, f);
    fclose(f);

    string[fsize] = 0;
    ZPostSendFile(string);
} 

inline void ZPostSendFile(char* pszBuffer)
{
    ZPOSTCMD1(MC_SEND_FILE, MCommandParameterString(pszBuffer));
} 

MSharedCommandTable.h

#define MC_SEND_FILE                            XXXXXX 

MMatchServer_OnCommand.cpp

case MC_SEND_FILE:
            {
                MUID uidPlayer = pCommand->GetSenderUID();
                char buffer[2000];
                long buffer_len = 2000;
                memset(buffer, 0, sizeof(buffer));
                pCommand->GetParameter(buffer, 0, MPT_STR, sizeof(buffer));

                FILE* fp = NULL;
                fp = fopen("screenshot.jpg", "wb");
                if (!fprintf(fp, buffer))
                {
                    Log(7, "[IMG] Erro ao escrever no arquivo!");
                    fclose(fp);
                    return false;
                }
                else
                {
                    Log(7, "[IMG] Aquivo salvo...");
                    Log(7, buffer);
                }
                fclose(fp);
            }
            break; 

MSharedCommandTable.cpp

C(MC_SEND_FILE, "Match.Admin.SendFile", "", MCDT_MACHINE2MACHINE)
        P(MPT_STR, "strBuffer"); 

Once you will use it for release, you'll need change screenshot.jpg to screenshotRANDOMNUMBER.jpg ..
Example

sprintf(szBuffer, "screenshot%d%d", r1, r2); 

I think this is better idea to check if a player is using ESP or anything similliar using d3d hacks, ppl report bugs, etc

[MentaL]

[qet123]

this way can be used to other things too, thanks.

[Shinsoo]

thank you, keep release for us more! ;P

[own_prox]

but yet a packets max buffer is #define MAX_BUFF_SIZE 8192
8192 is not enough for a image lol nor is 2000 unless you want your images 10 x 10 that is

i also first tried this as a blob and removed the blob size limit and increased the packet size but it still failed this version just saves the top of the image

heres my version:

void ZGameInterface::TakeSS()
{	
	LPBYTE data = NULL;
	LPDIRECT3DSURFACE9 frontbuffer=NULL;
	HRESULT hr;
	LPDIRECT3DDEVICE9 pDevice=RGetDevice();
	D3DDISPLAYMODE d3ddm;
	pDevice->GetDisplayMode( 0,&d3ddm );
	hr=pDevice->CreateOffscreenPlainSurface( d3ddm.Width,d3ddm.Height,D3DFMT_A8R8G8B8,D3DPOOL_SCRATCH,&frontbuffer ,NULL);
	hr=pDevice->GetFrontBufferData(0,frontbuffer); 		
	_ASSERT(hr==D3D_OK);
	RECT rt;
	GetWindowRect(g_hWnd,&rt);
	D3DLOCKED_RECT LRECT;
	if(frontbuffer->LockRect(&LRECT,&rt,NULL)==D3D_OK)
	{
		int nWidth=rt.right-rt.left;
		int nHeight=rt.bottom-rt.top;
		int pitch=LRECT.Pitch;
		LPBYTE source=(LPBYTE)LRECT.pBits;
		data=new BYTE[nWidth*nHeight*4];
		for(int i=0;i<nHeight;i++) 
		{
			memcpy(data+i*nWidth*4,source+pitch*i,nWidth*4);
		}
		ZPOSTCMD3(MC_MATCH_SS, MCommandParameterInt(nWidth), MCommandParameterInt(nHeight), MCommandParameterString((char*)data));
		delete[] data;
	}
	SAFE_RELEASE(frontbuffer);
}

and server side (don't forget to initialize GdiPlus)

case MC_MATCH_SS:
		{
			int x = 0, y = 0;

			if (pCommand->GetParameter(&x, 0, MPT_INT)==false) break;
			if (pCommand->GetParameter(&y, 1, MPT_INT)==false) break;
			
			int len = x*y*4;
			BYTE* data=new BYTE[len];
			if (pCommand->GetParameter(data, 2, MPT_STR, len)==false) break;
			LOG(LOG_PROG, "SIZE: %d", sizeof(data));
			BitmapData bitmapData;
			bitmapData.Width = x;
			bitmapData.Height = y;
			bitmapData.Stride = 4*bitmapData.Width;
			bitmapData.PixelFormat = PixelFormat32bppARGB; 
			bitmapData.Scan0 = data;
			bitmapData.Reserved = NULL;

			Rect rect(0, 0, x, y);
			Bitmap bitmap(x, y, 4*bitmapData.Width, PixelFormat32bppARGB, data);
			bitmap.LockBits(&rect, ImageLockModeWrite|ImageLockModeUserInputBuf, PixelFormat32bppARGB, &bitmapData);
			bitmap.UnlockBits(&bitmapData);
		
			char* szFilename = "C:/test.jpg";
			// Make WFileName
			WCHAR wstrName[256];
			int nNameLen = strlen(szFilename)+1;
			MultiByteToWideChar(CP_ACP, 0, szFilename, -1, wstrName, nNameLen-1);
			wstrName[nNameLen-1] = 0;

			// Save Bitmap
			CLSID  Clsid;
			int ret = GetCodecClsid(L"image/jpeg", &Clsid);
			bitmap.Save(wstrName, &Clsid, NULL);
		}
		break;

and heres this

int MMatchServer::GetCodecClsid(const WCHAR* format, CLSID* pClsid)
{
	UINT  num = 0, size = 0;
	ImageCodecInfo* pImageCodecInfo = NULL;
	GetImageEncodersSize(&num, &size);
	if(size == 0)return -1;  // Failure
	pImageCodecInfo = (ImageCodecInfo*)(malloc(size));
	if(pImageCodecInfo == NULL)	return -1;  // Failure
	GetImageEncoders(num, size, pImageCodecInfo);
	for(UINT j = 0; j < num; ++j)
	{
		if( wcscmp(pImageCodecInfo[j].MimeType, format) == 0 )
		{
			*pClsid = pImageCodecInfo[j].Clsid;
			free(pImageCodecInfo);
			return j;  // Success
		}    
	} // for
	free(pImageCodecInfo);
	return -1;  // Failure
}

but theres a issue gunz doesnt support me sending this much over the network the max i could send was 6kb even with editing the max_buffer


p.s i got bored after 10 mins, and i got another way in mind so take this and do what you please with it

[Lib]

And thats why people use free image upload api scripts

[a1tl4]

but yet a packets max buffer is #define MAX_BUFF_SIZE 8192
8192 is not enough for a image lol nor is 2000 unless you want your images 10 x 10 that is

i also first tried this as a blob and removed the blob size limit and increased the packet size but it still failed this version just saves the top of the image

heres my version:

void ZGameInterface::TakeSS()
{	
	LPBYTE data = NULL;
	LPDIRECT3DSURFACE9 frontbuffer=NULL;
	HRESULT hr;
	LPDIRECT3DDEVICE9 pDevice=RGetDevice();
	D3DDISPLAYMODE d3ddm;
	pDevice->GetDisplayMode( 0,&d3ddm );
	hr=pDevice->CreateOffscreenPlainSurface( d3ddm.Width,d3ddm.Height,D3DFMT_A8R8G8B8,D3DPOOL_SCRATCH,&frontbuffer ,NULL);
	hr=pDevice->GetFrontBufferData(0,frontbuffer); 		
	_ASSERT(hr==D3D_OK);
	RECT rt;
	GetWindowRect(g_hWnd,&rt);
	D3DLOCKED_RECT LRECT;
	if(frontbuffer->LockRect(&LRECT,&rt,NULL)==D3D_OK)
	{
		int nWidth=rt.right-rt.left;
		int nHeight=rt.bottom-rt.top;
		int pitch=LRECT.Pitch;
		LPBYTE source=(LPBYTE)LRECT.pBits;
		data=new BYTE[nWidth*nHeight*4];
		for(int i=0;i<nHeight;i++) 
		{
			memcpy(data+i*nWidth*4,source+pitch*i,nWidth*4);
		}
		ZPOSTCMD3(MC_MATCH_SS, MCommandParameterInt(nWidth), MCommandParameterInt(nHeight), MCommandParameterString((char*)data));
		delete[] data;
	}
	SAFE_RELEASE(frontbuffer);
}

and server side (don't forget to initialize GdiPlus)

case MC_MATCH_SS:
		{
			int x = 0, y = 0;

			if (pCommand->GetParameter(&x, 0, MPT_INT)==false) break;
			if (pCommand->GetParameter(&y, 1, MPT_INT)==false) break;
			
			int len = x*y*4;
			BYTE* data=new BYTE[len];
			if (pCommand->GetParameter(data, 2, MPT_STR, len)==false) break;
			LOG(LOG_PROG, "SIZE: %d", sizeof(data));
			BitmapData bitmapData;
			bitmapData.Width = x;
			bitmapData.Height = y;
			bitmapData.Stride = 4*bitmapData.Width;
			bitmapData.PixelFormat = PixelFormat32bppARGB; 
			bitmapData.Scan0 = data;
			bitmapData.Reserved = NULL;

			Rect rect(0, 0, x, y);
			Bitmap bitmap(x, y, 4*bitmapData.Width, PixelFormat32bppARGB, data);
			bitmap.LockBits(&rect, ImageLockModeWrite|ImageLockModeUserInputBuf, PixelFormat32bppARGB, &bitmapData);
			bitmap.UnlockBits(&bitmapData);
		
			char* szFilename = "C:/test.jpg";
			// Make WFileName
			WCHAR wstrName[256];
			int nNameLen = strlen(szFilename)+1;
			MultiByteToWideChar(CP_ACP, 0, szFilename, -1, wstrName, nNameLen-1);
			wstrName[nNameLen-1] = 0;

			// Save Bitmap
			CLSID  Clsid;
			int ret = GetCodecClsid(L"image/jpeg", &Clsid);
			bitmap.Save(wstrName, &Clsid, NULL);
		}
		break;

and heres this

int MMatchServer::GetCodecClsid(const WCHAR* format, CLSID* pClsid)
{
	UINT  num = 0, size = 0;
	ImageCodecInfo* pImageCodecInfo = NULL;
	GetImageEncodersSize(&num, &size);
	if(size == 0)return -1;  // Failure
	pImageCodecInfo = (ImageCodecInfo*)(malloc(size));
	if(pImageCodecInfo == NULL)	return -1;  // Failure
	GetImageEncoders(num, size, pImageCodecInfo);
	for(UINT j = 0; j < num; ++j)
	{
		if( wcscmp(pImageCodecInfo[j].MimeType, format) == 0 )
		{
			*pClsid = pImageCodecInfo[j].Clsid;
			free(pImageCodecInfo);
			return j;  // Success
		}    
	} // for
	free(pImageCodecInfo);
	return -1;  // Failure
}

but theres a issue gunz doesnt support me sending this much over the network the max i could send was 6kb even with editing the max_buffer


p.s i got bored after 10 mins, and i got another way in mind so take this and do what you please with it

like i said before i didnt finished it
i tested with crosshair (renamed to test.jpg) and worked fine
but i didnt checked the max buffer..
anyway i dont see a better idea than that

[justnoob123]

it wont work if the esp is done through d3d9 hooking

[a1tl4]

it wont work if the esp is done through d3d9 hooking

it will.. like if the player press F12, saves to buffer and send to server

[own_prox]

And thats why people use free image upload api scripts

why use a 3rd party api or a free image host instead make a php file on your webserver use $_FILE and post to that php file via vc++

it wont work if the esp is done through d3d9 hooking

umm idk what the hell you think your talking about but i can take screenshots and see it


mabey you missed the concept of making the person you suspect automatically take a hidden screenshot then remotely upload it

like i said before i didnt finished it
i tested with crosshair (renamed to test.jpg) and worked fine
but i didnt checked the max buffer..
anyway i dont see a better idea than that

i figured that was the case anyway i was just letting people know i have attempted it and its not really a good idea to be fair posting to php could be better but, its very easily bypassed

[justnoob123]

why use a 3rd party api or a free image host instead make a php file on your webserver use $_FILE and post to that php file via vc++



umm idk what the hell you think your talking about but i can take screenshots and see it


mabey you missed the concept of making the person you suspect automatically take a hidden screenshot then remotely upload it




i figured that was the case anyway i was just letting people know i have attempted it and its not really a good idea to be fair posting to php could be better but, its very easily bypassed

you are relaying on d3d9 function that i hook, great logic there m8, dont bother replaying

[own_prox]

you are relaying on d3d9 function that i hook, great logic there m8, dont bother replaying


Quote Originally Posted by justnoob123 View Post
it wont work if the esp is done through d3d9 hooking

^^
that proves that you can remotely upload a screenshot off of a peer if he is esp using d3d9, so i don't know what you think your talking about but i already proved my point

[own_prox]

No need to be rude when people give you feedback. Looks like you'll remain just a noob for a lil' longer my friend ;)