[Coding] Rainbow Six Siege Reversal, Structs and Offsets

[cxtgirl]

Originally Posted by ftpzion

-snip

afaik you cant do player outlines like that

entity -> actor -> component + 0xB0 = 0x20748000

[unFairFightCPP]

Originally Posted by ftpzion

anyone know what I am doing wrong? I can read/write fine as I tested with nosky and ambient color.

constexpr uint64_t kNetworkableManagerOffset = 0x6CE6178;
 
 
const auto networkableManager = Driver::read<UINT64>(pid, BaseAddr + kNetworkableManagerOffset);
		printf("networkableManager: 0x%llX\n", networkableManager);
		if (networkableManager == 0)
			break;
		const auto networkedObjectsList = Driver::read<UINT64>(pid, networkableManager + 0x40);
		printf("networkedObjectsList: 0x%llX\n", networkedObjectsList);
		const auto networkedObjectsSize = Driver::read<UINT64>(pid, networkableManager + 0x48) & 0x3fffffff;
	printf("networkedObjectsSize: 0x%llX\n", networkedObjectsSize);
		if (networkedObjectsSize == 0)
			Sleep(3000);
		for (std::uint32_t i{}; i < networkedObjectsSize; ++i) {
			const auto networkedObject = Driver::read<UINT64>(pid, networkedObjectsList + (i * 8));
			/*if (!networkedObject) continue;*/
			printf("networkedObject: 0x%llX\n", networkedObject);
			const auto entity = Driver::read<UINT64>(pid, networkedObject + 0x60);
			/*if (!entity) continue;*/
			printf("entity: 0x%llX\n", entity);
			const auto component = __ROL8__(Driver::read<uint64_t>(pid, entity + 0x1C8) ^ 0xAE43C62F812A63B0ui64, 41) - 0x5E838FF784FCE781i64;
			if (component < 0x0001000 || component > 0x7FFFFFFEFFFF) {
				return;
			}
 
			if (Driver::read<uint64_t>(pid, component + 0xB0) == 0 || Driver::read<uint64_t>(pid, entity + 0x1C8) == 0x5E838FF784FCE781i64) {
				return;
			}
 
			Driver::write<uint32_t>(pid, component + 0xB0, 0x20748000);

It outlines everything if I shoot at it, including walls etc.

But my goal is to make it only outline players.

You are using the wrong Array. There is one reserved for players only in GameManager, which you have actually posted. In order to enable Outlines you need to use actor, meaning Entity->Pawn->Actor->OutlineComponent->OutlineState (0xB0) = 0x20748000

[2858357545]

Originally Posted by althainside

for pasters out there having hard time for cam decs.

bool R6S::WorldToScreen(uintptr_t pCamera, Vector2 vecResolution, Vector3 vecTargetPosition, Vector2* vecScreenPosition)
{
	Vector2 vecCameraViewFoV = GetCameraViewFoV(pCamera);
	vecCameraViewFoV.X *= -1.0f;
	vecCameraViewFoV.Y *= -1.0f;
	//
	uint64_t v1 = 0xD31271C53E45CA8E, v2 = 0xD515A9C6F8FF5327;
	//
	__m128i pRight = Memory::ReadProcessMemoryEx<__m128i>(R6SVars.dwProcessId, pCamera + 0x80 + 0x0);
	pRight.m128i_i64[0] = __ROL8__(pRight.m128i_i64[0] ^ v1, 0x16) ^ v2;
	v1 -= 0xE7E116AC94E36CF;
	v2 += 0x1B77911D5B1428B3;
	pRight.m128i_i64[1] = __ROL8__(pRight.m128i_i64[1] ^ v1, 0x16) ^ v2;
	v1 -= 0xE7E116AC94E36CF;
	v2 += 0x1B77911D5B1428B3;
	Vector3 vecRight = *(Vector3*)&(pRight);
	printf("vecRight : (%f, %f, %f)\n", vecRight.X, vecRight.Y, vecRight.Z);
	__m128i pUp = Memory::ReadProcessMemoryEx<__m128i>(R6SVars.dwProcessId, pCamera + 0x80 + 0x10);
	pUp.m128i_i64[0] = __ROL8__(pUp.m128i_i64[0] ^ v1, 0x16) ^ v2;
	v1 -= 0xE7E116AC94E36CF;
	v2 += 0x1B77911D5B1428B3;
	pUp.m128i_i64[1] = __ROL8__(pUp.m128i_i64[1] ^ v1, 0x16) ^ v2;
	v1 -= 0xE7E116AC94E36CF;
	v2 += 0x1B77911D5B1428B3;
	Vector3 vecUp = *(Vector3*)&(pUp);
	printf("vecUp : (%f, %f, %f)\n", vecUp.X, vecUp.Y, vecUp.Z);
	__m128i pForward = Memory::ReadProcessMemoryEx<__m128i>(R6SVars.dwProcessId, pCamera + 0x80 + 0x10 + 0x10);
	pForward.m128i_i64[0] = __ROL8__(pForward.m128i_i64[0] ^ v1, 0x16) ^ v2;
	v1 -= 0xE7E116AC94E36CF;
	v2 += 0x1B77911D5B1428B3;
	pForward.m128i_i64[1] = __ROL8__(pForward.m128i_i64[1] ^ v1, 0x16) ^ v2;
	v1 -= 0xE7E116AC94E36CF;
	v2 += 0x1B77911D5B1428B3;
	Vector3 vecForward = *(Vector3*)&(pForward);
	printf("vecForward : (%f, %f, %f)\n", vecForward.X, vecForward.Y, vecForward.Z);
	__m128i pTranslation = Memory::ReadProcessMemoryEx<__m128i>(R6SVars.dwProcessId, pCamera + 0x80 + 0x10 + 0x10 + 0x10);
	pTranslation.m128i_i64[0] = __ROL8__(pTranslation.m128i_i64[0] ^ v1, 0x16) ^ v2;
	v1 -= 0xE7E116AC94E36CF;
	v2 += 0x1B77911D5B1428B3;
	pTranslation.m128i_i64[1] = __ROL8__(pTranslation.m128i_i64[1] ^ v1, 0x16) ^ v2;
	v1 -= 0xE7E116AC94E36CF;
	v2 += 0x1B77911D5B1428B3;
	Vector3 vecTranslation = *(Vector3*)&(pTranslation);
	printf("vecTranslation : (%f, %f, %f)\n", vecTranslation.X, vecTranslation.Y, vecTranslation.Z);
	//
	R6SVars.vecCameraViewTranslation = vecTranslation;
	Vector3 vecDelta = vecTargetPosition - vecTranslation;
	float X = vecDelta.Dot(vecRight);
	float Y = vecDelta.Dot(vecUp);
	float Z = vecDelta.Dot(vecForward * -1.0f);
	vecScreenPosition->X = (vecResolution.X / 2.0f) * (1.0f + X / vecCameraViewFoV.X / Z);
	vecScreenPosition->Y = (vecResolution.Y / 2.0f) * (1.0f - Y / vecCameraViewFoV.Y / Z);
	return Z >= 1.0f ? true : false;
}

What is your GetCameraViewFoV code?

[EmilyButGay]

uintptr_t BulletPerShot(uintptr_t Weapon)
	{
		__int64 v15; // rax
		__int64 v16; // rdi
		__int64 v17; // r13
		__int64 v19; // rcx
		__int64 v20; // rcx
		uintptr_t BulletPerShotAddr = 0;
		v15 = (__ROL8__(memclass.Read<uint64>(Weapon + 0x28), 50) ^ 0x244563E6F384CD00i64) - 106;
		if (!v15)
			return v15;
		if (((memclass.Read<uint64>(v15 + 8i64 * memclass.Read<unsigned int>(v15 + 632) + 448) - 0x424674B789805CE4i64) ^ 0x2B) == 0x884575CC2EE60179ui64)
		{
			v16 = memclass.Read<uint64>(v15 + 472);
			if (v16)
			{
			LABEL_4:
				v17 = memclass.Read<uint64>(v16);
				if (v17)
				{
					v19 = memclass.Read<uint64>(v17 + 344);
					if (v19)
					{
						v20 = memclass.Read<uint64>(v19);
						if (v20) {
							BulletPerShotAddr = (v20 + 80);
							return BulletPerShotAddr;
						}
					}
				}
			}
		}
		else
		{
			v16 = __ROL8__(
				memclass.Read<uint64>(((memclass.Read<uint64>(v15 + 8i64 * memclass.Read<unsigned int>(v15 + 632) + 448) - 0x424674B789805CE4i64) ^ 0x2B)
					+ 0x77BA8A33D119FE9Fi64) ^ 0xFD715BD5CDF4E11Aui64,
				28)
				- 6i64;
			if (v16)
				goto LABEL_4;
		}
	}

memclass.Write<int>(Game::BulletPerShot(weapon), 100);

[ftpzion]

Originally Posted by unFairFightCPP

You are using the wrong Array. There is one reserved for players only in GameManager, which you have actually posted. In order to enable Outlines you need to use actor, meaning Entity->Pawn->Actor->OutlineComponent->OutlineState (0xB0) = 0x20748000

Hmm. Weird since it was working before this latest update.

[2858357545]

Does anyone have the latest WS2 decryption? Can you share?

[ftpzion]

Originally Posted by unFairFightCPP

You are using the wrong Array. There is one reserved for players only in GameManager, which you have actually posted. In order to enable Outlines you need to use actor, meaning Entity->Pawn->Actor->OutlineComponent->OutlineState (0xB0) = 0x20748000

At first I did this:

constexpr uint64_t kNetworkableManagerOffset = 0x6CE6178;
constexpr uint64_t kCharacterComponentIndexOffset = 0x20D + 0x7;
const auto decryptEntityShape = [](const uint64_t x) noexcept {return _rotl64(x + 0xCD6372C55BE4EF33, 0x19) + 0xEC7EB90CCD1BAD7F; };
 
 
 
	const auto networkableManager = Driver::read<UINT64>(pid, Base + kNetworkableManagerOffset);
		printf("networkableManager: 0x%llX\n", networkableManager);
		if (networkableManager == 0)
			break;
		const auto networkedObjectsList = Driver::read<UINT64>(pid, networkableManager + 0x40);
		printf("networkedObjectsList: 0x%llX\n", networkedObjectsList);
		const auto networkedObjectsSize = Driver::read<UINT64>(pid, networkableManager + 0x48) & 0x3fffffff;
		printf("networkedObjectsSize: 0x%llX\n", networkedObjectsSize);
		if (networkedObjectsSize == 0)
			Sleep(3000);
		for (std::uint32_t i{}; i < networkedObjectsSize; ++i) {
			const auto networkedObject = Driver::read<UINT64>(pid, networkedObjectsList + (i * 8));
			/*if (!networkedObject) continue;*/
			printf("networkedObject: 0x%llX\n", networkedObject);
			const auto entity = Driver::read<UINT64>(pid, networkedObject + 0x60);
			/*if (!entity) continue;*/
			printf("entity: 0x%llX\n", entity);
			const auto componentIndex = Driver::read<std::uint8_t>(pid, entity + kCharacterComponentIndexOffset);
			/*if (componentIndex == 0xff) continue;*/
			printf("componentIndex: 0x%llX\n", componentIndex);
			const UINT64 shape = decryptEntityShape(Driver::read<UINT64>(pid, entity + 0x1C8));
			/*if (!shape) continue;*/
			printf("shape: 0x%llX\n", shape + 0xB3);
			Driver::write<UINT64>(pid, shape + 0xB3, 0xB0);
		}

But I was not getting any results, because ComponentIndex was returning 0.

So then I changed the code to this:

constexpr uint64_t kNetworkableManagerOffset = 0x6CE6178;
 
 
const auto networkableManager = Driver::read<UINT64>(pid, BaseAddr + kNetworkableManagerOffset);
		printf("networkableManager: 0x%llX\n", networkableManager);
		if (networkableManager == 0)
			break;
		const auto networkedObjectsList = Driver::read<UINT64>(pid, networkableManager + 0x40);
		printf("networkedObjectsList: 0x%llX\n", networkedObjectsList);
		const auto networkedObjectsSize = Driver::read<UINT64>(pid, networkableManager + 0x48) & 0x3fffffff;
	printf("networkedObjectsSize: 0x%llX\n", networkedObjectsSize);
		if (networkedObjectsSize == 0)
			Sleep(3000);
		for (std::uint32_t i{}; i < networkedObjectsSize; ++i) {
			const auto networkedObject = Driver::read<UINT64>(pid, networkedObjectsList + (i * 8));
			/*if (!networkedObject) continue;*/
			printf("networkedObject: 0x%llX\n", networkedObject);
			const auto entity = Driver::read<UINT64>(pid, networkedObject + 0x60);
			/*if (!entity) continue;*/
			printf("entity: 0x%llX\n", entity);
			const auto component = __ROL8__(Driver::read<uint64_t>(pid, entity + 0x1C8) ^ 0xAE43C62F812A63B0ui64, 41) - 0x5E838FF784FCE781i64;
			if (component < 0x0001000 || component > 0x7FFFFFFEFFFF) {
				return;
			}
 
			if (Driver::read<uint64_t>(pid, component + 0xB0) == 0 || Driver::read<uint64_t>(pid, entity + 0x1C8) == 0x5E838FF784FCE781i64) {
				return;
			}
 
			Driver::write<uint32_t>(pid, component + 0xB0, 0x20748000);

And now it outlines anything I shoot at. I think ComponentIndex in the original code is wrong. Does anyone know what the newest ComponentIndex is? Thanks in advance.

[SoundTheSame]

Originally Posted by EmilyButGay

uintptr_t BulletPerShot(uintptr_t Weapon)
	{
		__int64 v15; // rax
		__int64 v16; // rdi
		__int64 v17; // r13
		__int64 v19; // rcx
		__int64 v20; // rcx
		uintptr_t BulletPerShotAddr = 0;
		v15 = (__ROL8__(memclass.Read<uint64>(Weapon + 0x28), 50) ^ 0x244563E6F384CD00i64) - 106;
		if (!v15)
			return v15;
		if (((memclass.Read<uint64>(v15 + 8i64 * memclass.Read<unsigned int>(v15 + 632) + 448) - 0x424674B789805CE4i64) ^ 0x2B) == 0x884575CC2EE60179ui64)
		{
			v16 = memclass.Read<uint64>(v15 + 472);
			if (v16)
			{
			LABEL_4:
				v17 = memclass.Read<uint64>(v16);
				if (v17)
				{
					v19 = memclass.Read<uint64>(v17 + 344);
					if (v19)
					{
						v20 = memclass.Read<uint64>(v19);
						if (v20) {
							BulletPerShotAddr = (v20 + 80);
							return BulletPerShotAddr;
						}
					}
				}
			}
		}
		else
		{
			v16 = __ROL8__(
				memclass.Read<uint64>(((memclass.Read<uint64>(v15 + 8i64 * memclass.Read<unsigned int>(v15 + 632) + 448) - 0x424674B789805CE4i64) ^ 0x2B)
					+ 0x77BA8A33D119FE9Fi64) ^ 0xFD715BD5CDF4E11Aui64,
				28)
				- 6i64;
			if (v16)
				goto LABEL_4;
		}
	}

good job, though if I may add you don't need like 3/4 of that function lol you just need to get [REDACTED]
then [REDACTED] at +0x158

[REDACTED]->[REDACTED]()->[AMMO]()->setBulletsPerShot(25);

[ftpzion]

Originally Posted by SoundTheSame

this "networkedObjectsList" can suffice perfectly fine you just need to differentiate the "objects"... (i.e get the "objects" entities controller and check it's class name etc)

I did not need to do that before the most recent update.

Here is my current code (does not work atm):
(the commented out code is part of the code FYI)

   constexpr uint64_t kNetworkableManagerOffset = 0x6CE6178;
constexpr uint64_t kLightManager = 0x6CE1E48;
constexpr uint64_t kCharacterComponentIndexOffset = 0x20D + 0x7;
const auto decryptEntityShape = [](const uint64_t x) noexcept {return _rotl64(x + 0xCD6372C55BE4EF33, 0x19) + 0xEC7EB90CCD1BAD7F; }; 
 
 
                //const auto networkableManager = Driver::read<UINT64>(pid, BaseAddr + kNetworkableManagerOffset);
        //printf("networkableManager: 0x%llX\n", networkableManager);
        //if (networkableManager == 0)
        //    break;
        //const auto networkedObjectsList = Driver::read<UINT64>(pid, networkableManager + 0x40);
        //printf("networkedObjectsList: 0x%llX\n", networkedObjectsList);
        //const auto networkedObjectsSize = Driver::read<UINT64>(pid, networkableManager + 0x48) & 0x3fffffff;
        //printf("networkedObjectsSize: 0x%llX\n", networkedObjectsSize);
        //if (networkedObjectsSize == 0)
        //    Sleep(3000);
        //for (std::uint32_t i{}; i < networkedObjectsSize; ++i) {
        //    const auto networkedObject = Driver::read<UINT64>(pid, networkedObjectsList + (i * 8));
        //    /*if (!networkedObject) continue;*/
        //    printf("networkedObject: 0x%llX\n", networkedObject);
        //    const auto entity = Driver::read<UINT64>(pid, networkedObject + 0x60);
        //    /*if (!entity) continue;*/
        //    printf("entity: 0x%llX\n", entity);
        //    const auto componentIndex = Driver::read<std::uint8_t>(pid, entity + kCharacterComponentIndexOffset);
        //    /*if (componentIndex == 0xff) continue;*/
        //    printf("componentIndex: 0x%llX\n", componentIndex);
        //    const UINT64 shape = decryptEntityShape(Driver::read<UINT64>(pid, entity + 0x1C8));
        //    /*if (!shape) continue;*/
        //    printf("shape: 0x%llX\n", shape + 0xB3);
        //    Driver::write<UINT64>(pid, shape + 0xB3, 0xB0);

[Marlondwadwadwa]

What are the offsets for unlock all ? pls help xd

[Lpx4]

Someone can share fov offsets? Thanks

[TonySet]

Anyone have the latest W2S they wouldnt mind sharing
I think mine works im just not sure if my fov is right

[YGWfgigywyg]

Hello, im very very new to coding like i havent even typed a line, but ik what i want to do can someone send caveria reveal offsets and shit so i can make caveria esp?

[Howie420]

Originally Posted by SurgeGotTapped

Field Of View
Base + 0x6995B90 ] 0x4C8

you cant change it

[i6e0]

anyone tryna share all new recent offsets?

[Foxyboiyy]

Does somebody know where to find the clean text api routes?

[InsideExploit]

Originally Posted by Howie420

you cant change it

writable one

/*
    RainbowSix.exe+3B8C0F0 - 48 B8 B817E0C1268136FC - mov rax,FC368126C1E017B8 { -28.01 }
    RainbowSix.exe+3B8C0FA - 48 03 81 78010000     - add rax,[rcx+00000178]
    RainbowSix.exe+3B8C101 - 48 B9 E1B86DAC2BAA39A2 - mov rcx,A239AA2BAC6DB8E1 { -1402095391 }
    RainbowSix.exe+3B8C10B - 48 31 C1              - xor rcx,rax
    RainbowSix.exe+3B8C10E - 48 B8 C50D50915677DC75 - mov rax,75DC775691500DC5 { -1857024571 }
    RainbowSix.exe+3B8C118 - 48 01 C8              - add rax,rcx
*/
 
uintptr_t rcx = *(uintptr_t*)(g_moduleBase + 0x7BCDB50);
 
uintptr_t rax = 0xFC368126C1E017B8;
rax += *(uintptr_t*)(rcx + 0x178);
rcx = 0xA239AA2BAC6DB8E1;
rcx ^= rax;
rax = 0x75DC775691500DC5;
rax += rcx;
 
*(float*)(*(uintptr_t*)(rax) + 0x48) = encryptFov(120.f); /* your pretty fov value */
 
//also
 
*(float*)(*(uintptr_t*)(rax) + 0x48+8) = encryptDistance(0.09f); /* your render distance value */
 
decryptions:
 
// fov ===>
((*(_DWORD *)(v69 + 0x1A1265D0) ^ 0x48)  - 0x3601A46
 
// render distance ====>
((*(_DWORD *)(v56 + 0x50) - 0x7011377F) ^ 0x5857384C) - 0x4D
 
// do encryption urself

[apesex]

can anyone post working outline esp code that DOESN'T use actor? I want one that uses networkmanager.

[InsideExploit]

Originally Posted by apesex

can anyone post working outline esp code that DOESN'T use actor? I want one that uses networkmanager.

Wtf? First of all, actor and NetworkableManager are two different things, one is derived from the entity pawn and the other is a big list of objects, and why not go through the entity actor which is the easiest way,and its how the game does?
If you can explain yourself maybe we can help you

[xfly44037]

anyone has unlock all offsets?
nvm : 20A7D95