𝗦𝗥𝗖 𝗭𝗢𝗡𝗘 𓆈

constexpr uintptr_t Player_MainCamera       = 0x3F0;
constexpr uintptr_t Player_ViewRotation      = 0x214;
constexpr uintptr_t Player_AimRotation       = 0x61C;
constexpr uintptr_t Player_FollowCamera      = 0x698;

constexpr uintptr_t Player_HeadTF             = 0x6A8;
constexpr uintptr_t Player_RootTF             = 0x6B0;
constexpr uintptr_t Player_FootTF             = 0x6D0;

constexpr uintptr_t Player_HeadCollider       = 0x740;
constexpr uintptr_t Player_InventoryManager   = 0x748;
constexpr uintptr_t Player_Attributes         = 0x770;
constexpr uintptr_t Player_AvatarManager      = 0x778;

constexpr uintptr_t Player_Name               = 0x4A0;
constexpr uintptr_t Player_IsClientBot        = 0x4A8;

constexpr uintptr_t Player_FiringState        = 0x850;
constexpr uintptr_t Player_CallSetAimRotation = 0x818;

constexpr uintptr_t Player_ActiveWeapon       = 0x608;
constexpr uintptr_t Player_ReloadInstance     = 0x708;

Damn your life if you share it without my name, you damned child!

Up- @XAnouar anwarxdevs.dpdns.org

FFMAX 2.132.1

This file is a shell script designed to run on rooted Android devices. Its primary purpose is to attempt to bypass the anti-cheat system in the game Free Fire. Here's a step-by-step technical breakdown of what the code does: 1. Tampering with game files and security systems Disabling Reports: Deletes the crash report folders (GarenaExperience and report) and then recreates them and strips them of any privileges (by setting them to 000), preventing the game from sending reports about modifications. Freezing the security system: Targets the security system folders (Tencent ACE), where it scans their contents, changes their owner to root, and removes all read and write privileges from them (chmod -R 000), to prevent the game from running system scanning tools. 2. Network and communication manipulation (DNS Spoofing & Redirection) Server blocking: Creates a configuration file for the dnsmasq program to block or redirect internet addresses (domains) used by the game for security verification, such as anticheatexpert.com servers, tracking systems like crashlytics and appsflyer, and some of the developer company's (Garena) servers. Traffic redirection: The Android firewall (iptables) is used to intercept any connection request via the DNS port (port 53) and force it to pass through the fake local server created by the script. 3. Creating a fake web server (Fake HTTP Server) It creates a simple local web page that contains only the word "OK". A fake server is run using busybox httpd on port 8888 to respond to some rerouted requests, in order to trick the game into thinking it is connecting to its servers normally. Where should this file be placed? Based on the written code, yes, the script primarily relies on the /data/local/tmp/ path in the Android system. Why this path? The /data/local/tmp/ path is a temporary folder in Android that usually allows writing files and executing scripts without strict restrictions if the user has root privileges. هذا الملف عبارة عن سكربت (Shell Script) مخصص للعمل على أجهزة الأندرويد التي تمتلك صلاحيات الروت (Root). الهدف الرئيسي منه هو محاولة تجاوز أنظمة مكافحة الغش (Anti-Cheat Bypass) الخاصة بلعبة Free Fire. ​إليك تفصيل فني لما يفعله الكود خطوة بخطوة: ​1. العبث بملفات اللعبة وأنظمة الحماية ​تعطيل التقارير: يقوم بحذف المجلدات الخاصة بتقارير الأعطال (GarenaExperience و report) ثم يعيد إنشاءها ويجردها من أي صلاحيات (بجعلها 000)، مما يمنع اللعبة من إرسال تقارير عن التعديلات. ​تجميد نظام الحماية: يستهدف مجلدات نظام الحماية (Tencent ACE)، حيث يقوم بمسح محتوياتها وتغيير مالكها إلى root وإزالة جميع صلاحيات القراءة والكتابة منها (chmod -R 000)، لمنع اللعبة من تشغيل أدوات فحص النظام. ​2. التلاعب بالشبكة والاتصالات (DNS Spoofing & Redirection) ​حجب الخوادم: ينشئ ملف إعدادات لبرنامج dnsmasq ليقوم بحجب أو إعادة توجيه عناوين الإنترنت (Domains) التي تستخدمها اللعبة للتحقق من الأمان، مثل خوادم anticheatexpert.com، وأنظمة التتبع مثل crashlytics و appsflyer، وبعض خوادم الشركة المطورة (Garena). ​إعادة توجيه حركة المرور: يستخدم جدار حماية الأندرويد (iptables) لاعتراض أي طلب اتصال عبر منفذ DNS (المنفذ 53) وإجباره على المرور عبر الخادم المحلي الوهمي الذي أنشأه السكربت. ​3. إنشاء خادم ويب وهمي (Fake HTTP Server) ​يقوم بإنشاء صفحة ويب محلية بسيطة تحتوي على كلمة "OK" فقط. ​يشغل خادم وهمي باستخدام busybox httpd على المنفذ 8888 للرد على بعض الطلبات التي تم تحويل مسارها، وذلك لإيهام اللعبة بأنها تتصل بخوادمها بشكل طبيعي. ​أين يتم وضع هذا الملف؟ ​بناءً على الأكواد المكتوبة، نعم، السكربت يعتمد بشكل أساسي على مسار /data/local/tmp/ في نظام الأندرويد. ​لماذا هذا المسار؟ مسار /data/local/tmp/ هو مجلد مؤقت في الأندرويد يسمح عادةً بكتابة الملفات وتنفيذ السكربتات (Execution) دون قيود صارمة إذا كان المستخدم يمتلك صلاحيات الروت.

[ MD ] Aim hook

Both hooks are in aim360.txt. Include Helper/va.h. Two steps. No DobbyHook. Only GetAimRotation and GetAuxAimRotation.
StaticInlineHook(vaddr, patch) in aimva.h is StaticInlineHookPatch. The trampoline step below is StaticInlineHookPatchInMemory with an empty patch, so it builds the trampoline and does not write hex over the function.
Hook(vaddr, fn) in aimva.h is the runtime call. It is StaticInlineHookFunction. It writes your function into the slot and returns the trampoline. Call that pointer to run the original.
1. Trampoline (once)
UnityFramework must be decrypted. Run this on the mach-o, save the file, put it back in the app, re-sign.
#include "va.h"

StaticInlineHookPatchInMemory(macho, 0x5624594, (char *)""); // GetAimRotation
StaticInlineHookPatchInMemory(macho, 0x56A55E8, (char *)""); // GetAuxAimRotation
PlantAimTrampoline in aim360.txt is those two lines. slots_ze.txt is the same list.
2. Runtime (every launch)
After that UnityFramework is the one loaded in the process:
#include "va.h"

// Hook(vaddr, fn) -> StaticInlineHookFunction
orig_GetAimRotation    = (Aim360Fn)Hook(0x5624594, hook_GetAimRotation);
orig_GetAuxAimRotation = (Aim360Fn)Hook(0x56A55E8, hook_GetAuxAimRotation);
A null return means step 1 did not plant that RVA in this binary. The replacement calls the pointer Hook returned. That is the original function.
hook_GetAimRotation and hook_GetAuxAimRotation return the armed quaternion for the local player. The rest of both bodies is in aim360.txt. this will help always be seen from localplayer to Enemy when visible with eyes

0x2A0    IsCadet    
0x2A8    MHGFKKALMDK    PlayerID (BEADLMGGGGL)
0x2C0    JKACLOCKKPH    IsBot?    
0x2C8    FNDJBHILEOD    Account UID (ulong)
0x2E0    \<FJCMAOOGEMJ>    PlayerID backing field
0x2F8    \<KGOJOGNIEGP>    TeamID (uint)
0x2FC    \<JEJDLLGJOKH>    Nickname (string)
0x300    \<MJNNBGIKMHG>    Alt Nickname
0x304    \<IOBEKFKJOOI>    Level (uint)
0x308    \<DJPJJDLHHDL>    AvatarID (uint)
0x320    OriginalNickName    
0x324    IsClientBot    
0x500    IODLOCEJIOK    PlayerAttributes 
0x28C    MainCameraTransform
0x494    AHNCPOJPPCL    FollowCamera


0x348    DFLDHLFENGD    CharacterController
0x388    TeamMapMark    Named    
0x3BC    Speed            Player Speed    
0x3C8    ACount           Accumulated count
0x41C    lockTransformMusicWhenUpdate
0x434    ActiveUISightingWeapon


0x4FC    NLENBNNCDMC    NewPlayerAnimationSystemComponent
0x500    IODLOCEJIOK    PlayerAttributes (HP/Shield) 
0x504    GGJOLDEEIEN    AvatarManager
0x508    JMMBPPGHEPB    AvatarDynamicEffectManager
0x50C    LBNGKDFKONH    AvatarPropManager
0x510    KGMHJLLMHJG    PropertyData
0x514    IEMJKIBBBKL    BigHeadComponent
0x518    CMHOCKPICLM    PlayerAdminAbuseShapeComponent
0x51C    KHEIEKHGPBD    BigHeadDataConfig
0x520    FHCPBJPAFJE    BigHead scale (float)
0x528    CFMFECAHCAE    (GameObject) IceWall
0x52C    ICCOFLNKMCM    IceWallMakerData
0x534    FGLDCGAEAJI    NavMeshAgent
0x538    \<FGEHGKMOEFN>    NetworkPet
0x53D    PetForceHide    

0x1A0    InventoryMap3P
0x1A4    TriggerBombModeBomb
0x1A8    BMNJHINMPKO    CurrentWeapon 
0x1AC    LHPKANKLJNF    WeaponDict (per player)    
0x1B0    NEELOLJHAMJ    CurrentWeaponResourceID
0x1B4    CIKHKHDEDEE    CurrentWeaponAmmo
0x1B8    MNMEALNFGML    WeaponModel GameObject
0x1BC    FPDGCILPLNK    WeaponSkin ResourceID
0x238    AJMHEMKGLKJ    WeaponSkinRightDesc dict


0x434    ActiveUISightingWeapon
0x43C    NextFireActionFromAuxButton
0x464    m_AimAssist    
0x468    m_AimAssistForIceWall
0x47C    ADMMKBGOLJL    EAimAssist state
0x480    NKABFKBIMOI    DCIDAEHLHPI (aim target?)
0x488    DPGBCFDANCE    OCCDFDMPBAC (weapon related)


0x17C    UGCRequestJump
0x17D    UGCStartFiring
0x180    JumpCount
0x208    UseAimForwardAsForward
0x20D    IsPersonaEPDown
0x20E    IsPersonaEPUp
0x210    LateUpdateFunc
0x2D4    TeamModeID
0x2D8    IsShowEquip