A YouTube channel called "Cheat The Game" has a video on creating a "Wall Hack" using Cheat Engine (which is a particularly useful type of hack in multiplayer first person shooter games). The video:
A key element in this wall hack is the OpenGl glDepthFunc()
function - used for checking how far away an object is from the player. This function takes in a "depth comparison function" argument which is used to determine whether or not to render stuff - such as enemies. If you're able to pass in a different argument (GL_ALWAYS
) it may render things it wouldn't normally.
With this knowledge I made a quick and dirty wall hack for OpenGL Quake 1, using the Steam version of Quake and manually running glquake.exe
in the game's folder:
- with the game running open Cheat Engine (hint: you may want to run
glquake.exe -window
to avoid it messing with your desktop resolution) - have Cheat Engine open
glquake.exe
- click the
Memory View
button on the near the bottom left (you'll probably need Cheat Engine 7.3 or higher) - select the
View
menu thenEnumerate DLL's and Symbols
- search for
opengl32.glDepthFunc
(CTRL+F) - double click on the result
- right click and
Break and trace
and allow it to attach the debugger - when it's finished scanning, right click on the results and choose
Expand all
- scroll down a little to the first
glquake.exe
result, below theOPENGL32.glDepthFunc
results - this is the Quake code just after the OpenGL code - double click on it (it should be
glquake.exe+FFFF8 - fld dword ptr [glquake.exe+430c70]
) to view the code - two lines above this is
push 00000203
, this number is theGL_LEQUAL
"depth-comparison function" argument that is passed to theglDepthFunc()
function - double click this line to change it to
push 00000207
(soGL_ALWAYS
is used, as shown in the video)
Now stuff is rendered that wouldn't normally be visible:
I did say this was a quick and dirty hack... ideally only enemy and player models should be rendered, rather than all parts of the level, but this is just a global patch to force everything to render.
This can also be done as a Cheat Engine address/table and saved for re-use later without having to repeat the above steps:
The full line of the code changed is:
glquake.exe+FFED - 68 03020000 - push 00000203
The address is given (glquake.exe+FFED
), the code starts with the byte 68
(which is the push
instruction), the second byte is the 03
(part of the 0x203
) which gets changed to 0x07
for the above to work. The address to add in Cheat Engine is the address above plus 1 byte (to skip over the push
), giving us glquake.exe+FFEE
.
Adding this in Cheat Engine as a single byte should show its value as 3
, which can then be changed to 7
to apply the hack, and back to 3
to undo it.
The above can also be done in Quake 3:
Though the YouTube covers "Return to Castle Wolfenstein" which is based on the Quake 3 engine, so the same enemies-only wall hack should be similar.