{"version":"https://jsonfeed.org/version/1.1","title":"sipacid's blog","home_page_url":"https://sipacid.com/","feed_url":"https://sipacid.com/posts.rss","description":"Where I put my thoughts","language":"en","authors":[{"name":"sipacid","url":"https://sipacid.com"}],"items":[{"id":"https://sipacid.com/blog/writing-a-phasmophobia-cheat/","url":"https://sipacid.com/blog/writing-a-phasmophobia-cheat/","title":"writing a phasmophobia cheat","authors":[{"name":"sipacid","url":"https://sipacid.com"}],"content_html":"

okay, so you've decided you wanna cheat in a co-op horror game, fucking weirdo. anyway before we start we need some info about the game, like what game engine is it using, is it x64 or x86 and does it have an anticheat? phasmophobia is made in unity, x64 and does not have an anticheat which makes our job a lot easier.

\n

setting up the project

\n

ight, open up visual studio and create a new dll c++ project. i am kinda really fucking lazy so instead of writing our own hook functions we'll just use ms-detours for this project. to add detours to our project head into project properties -> Linker -> Input then add your detours.lib file to additional dependencies. you'll also need to include the detours.h header file, how the fuck do i do this?. also set the c++ language standard and the c language standard to latest or something similar.

\n

getting function addresses and structs

\n

phasmophobia uses something called il2cpp which means we can't just throw the dll in something like dnspy and look at the code. to get past this i normally would just use il2cppinspector but that project has been dead for quite some time and doesn't work with the newer unity version that phasmophobia is using, so we'll be using cpp2il instead.

\n

to use this, all you have to do is run this command:

\n
.\\Cpp2IL.exe --game-path="C:\\Program Files (x86)\\Steam\\steamapps\\common\\Phasmophobia" --parallel --analyze-all\n
\n

or wherever you have installed your phasmophobia. once this is finished you can open up something like dnspy, i'll be using jetbrains dotpeek for this however.

\n

now that we have our decompiler open we can start looking for things we want, like the ghost type. most things will be located in the Assembly-CSharp.dll file, so open that up and look for the GhostAI class. to get the ghostai object we can hook the GhostAI::Start function.

\n
[Address(RVA = "0x158C940", Offset = "0x158B740", VA = "0x18158C940")]\nprivate void Start()\n{\n}\n
\n

we can see that the function is located at base address + rva (0x158F920). that's great and all but how do we get the ghost type? below are all the fields of the GhostAI class.

\n
[Token(Token = "0x20000E9")]\npublic class GhostAI : MonoBehaviour\n{\n  [Cpp2IlInjected.FieldOffset(Offset = "0x20")]\n  [Token(Token = "0x40005D2")]\n  private readonly ഠദവടസളഠഺദ മപജജഫലസഞട;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x28")]\n  [Token(Token = "0x40005D3")]\n  public GhostAI.വബബരരറമഞഥ \\u0D3Bഺര\\u0D3Bപഠനളസ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x30")]\n  [Token(Token = "0x40005D4")]\n  public PhotonView ശനടധലപണഴവ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x38")]\n  [Token(Token = "0x40005D5")]\n  public GhostInfo ഝറഴജഴഫഹഥജ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x40")]\n  [Token(Token = "0x40005D6")]\n  public NavMeshAgent ലഠഴഺമഫമ\\u0D3Bഠ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x48")]\n  [Token(Token = "0x40005D7")]\n  public GhostAudio വദറതയല��മഝ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x50")]\n  [Token(Token = "0x40005D8")]\n  public GhostInteraction ഷഥഴഡണഫഞഢഺ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x58")]\n  [Token(Token = "0x40005D9")]\n  public GhostActivity യഞമഡശദദനണ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x60")]\n  [Token(Token = "0x40005DA")]\n  [HideInInspector]\n  public GhostModel നഢനനഴബഞസത;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x68")]\n  [Token(Token = "0x40005DB")]\n  [SerializeField]\n  private GhostModel eventModel;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x70")]\n  [Token(Token = "0x40005DC")]\n  public GhostModel[] സയഠഝഷഠറഭബ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x78")]\n  [Token(Token = "0x40005DD")]\n  public GhostModel[] നറഫളശഴശഠണ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x80")]\n  [Token(Token = "0x40005DE")]\n  private bool \\u0D3Bടധഢദജഞയധ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x84")]\n  [Token(Token = "0x40005DF")]\n  [HideInInspector]\n  public ShadowCastingMode തശപളഠളതഡവ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x88")]\n  [Token(Token = "0x40005E0")]\n  [HideInInspector]\n  public List<Vector3> മനഥഴഴണഢഺജ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x90")]\n  [Token(Token = "0x40005E1")]\n  private float ഭജ\\u0D3Bഢഴബശഹഫ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x98")]\n  [Token(Token = "0x40005E2")]\n  public SanityDrainer \\u0D3Bഺഝഷബഷഩണഩ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xA0")]\n  [Token(Token = "0x40005E3")]\n  [HideInInspector]\n  public bool ണഺശഥശഥധതറ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xA4")]\n  [Token(Token = "0x40005E4")]\n  public LayerMask ജഥഭടജഞലഹപ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xA8")]\n  [Token(Token = "0x40005E5")]\n  public Transform പനതദയഢഠശസ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xB0")]\n  [Token(Token = "0x40005E6")]\n  public Transform ജളഠദഹളഝദഝ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xB8")]\n  [Token(Token = "0x40005E7")]\n  public Transform ബഺപടഫബധസഭ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xC0")]\n  [Token(Token = "0x40005E8")]\n  [HideInInspector]\n  public float പഫപഞഺദഴദഷ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xC4")]\n  [Token(Token = "0x40005E9")]\n  [HideInInspector]\n  public float ഢറഴഝണബനഭസ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xC8")]\n  [Token(Token = "0x40005EA")]\n  [HideInInspector]\n  public float ജ\\u0D3Bഹ\\u0D3Bമഭ\\u0D3Bശബ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xCC")]\n  [Token(Token = "0x40005EB")]\n  [HideInInspector]\n  public bool ജയമടയഩപമഞ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xCD")]\n  [Token(Token = "0x40005EC")]\n  [HideInInspector]\n  public bool ടലഡഹഫഢയമഩ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xD0")]\n  [Token(Token = "0x40005ED")]\n  [HideInInspector]\n  public Vector3 ലന\\u0D3Bസതഷ\\u0D3Bഴഹ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xE0")]\n  [Token(Token = "0x40005EE")]\n  public GameObject ധഺമലയളടണഥ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xE8")]\n  [Token(Token = "0x40005EF")]\n  [HideInInspector]\n  public bool ഥനള\\u0D3B\\u0D3Bഝശവഭ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xE9")]\n  [Token(Token = "0x40005F0")]\n  [HideInInspector]\n  public bool ഭമഫവഫസഢഞണ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xEA")]\n  [Token(Token = "0x40005F1")]\n  [HideInInspector]\n  public bool ണഷഺവദഠഭഹസ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xEB")]\n  [Token(Token = "0x40005F2")]\n  [HideInInspector]\n  public bool യഫവമളവറഺമ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xF0")]\n  [Token(Token = "0x40005F3")]\n  [HideInInspector]\n  public WhiteSage ഷഹഴശരഥധഩപ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xF8")]\n  [Token(Token = "0x40005F4")]\n  private float പഴളണഞഞഷഹഥ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xFC")]\n  [Token(Token = "0x40005F5")]\n  [HideInInspector]\n  public bool ണഩഞബഹമഝഝന;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xFD")]\n  [Token(Token = "0x40005F6")]\n  [HideInInspector]\n  public bool ഷധ\\u0D3Bതതഩലളത;\n  [Cpp2IlInjected.FieldOffset(Offset = "0xFE")]\n  [Token(Token = "0x40005F7")]\n  [HideInInspector]\n  public bool രഠ\\u0D3Bലതബബനജ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x100")]\n  [Token(Token = "0x40005F8")]\n  [HideInInspector]\n  public Player ദഫഥഩഩഭഹഩമ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x108")]\n  [Token(Token = "0x40005F9")]\n  [HideInInspector]\n  public int റഹവധനലഷ\\u0D3Bള;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x10C")]\n  [Token(Token = "0x40005FA")]\n  [HideInInspector]\n  public Vector3 ഭണഺവഢഞരഹ\\u0D3B;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x118")]\n  [Token(Token = "0x40005FB")]\n  private readonly float[] ജഡജസഠമററല;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x120")]\n  [Token(Token = "0x40005FC")]\n  private readonly float[] നസഩണഥവവരഭ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x128")]\n  [Token(Token = "0x40005FD")]\n  private readonly float[] ഝയഩബതഥഥശയ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x130")]\n  [Token(Token = "0x40005FE")]\n  private int ഡലടഫഡണഭഢഷ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x134")]\n  [Token(Token = "0x40005FF")]\n  private int ധശഷണനരളളഹ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x138")]\n  [Token(Token = "0x4000600")]\n  private int ഩഞബഴഝഥഺദധ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x13C")]\n  [Token(Token = "0x4000601")]\n  private int മഹധശതദഫഫഷ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x140")]\n  [Token(Token = "0x4000602")]\n  private int ഩധഝഭളഠയശര;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x148")]\n  [Token(Token = "0x4000603")]\n  private readonly float[] ണഭബധബശവ\\u0D3Bണ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x150")]\n  [Token(Token = "0x4000604")]\n  private readonly float[] ഹഡ\\u0D3Bറനഫഫഝന;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x158")]\n  [Token(Token = "0x4000605")]\n  private readonly float[] വബശഠജണളഠഺ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x160")]\n  [Token(Token = "0x4000606")]\n  private float ഩളഢരറരധ\\u0D3Bഴ;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x168")]\n  [Token(Token = "0x4000607")]\n  private readonly int[] ഭഢഝഭതഫദവ\\u0D3B;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x170")]\n  [Token(Token = "0x4000608")]\n  private readonly int[] ശയഹഡറഡഥടല;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x178")]\n  [Token(Token = "0x4000609")]\n  private readonly int[] ധലഢപബഡമഭല;\n  [Cpp2IlInjected.FieldOffset(Offset = "0x180")]\n  [Token(Token = "0x400060A")]\n  private readonly int[] \\u0D3Bണഫസഫയഠസന;\n}\n
\n

ghost type is probably an enum but where is it? you can find it in the GhostTraits class, to get there, go the GhostInfo class then go the first type that is being used in the GhostInfo class, in this case it is പദഴലടഫഺഷവ.

\n
[Token(Token = "0x20000F7")]\npublic class GhostInfo : MonoBehaviourPun\n{\n  [FieldOffset(Offset = "0x28")]\n  [Token(Token = "0x4000652")]\n  [HideInInspector]\n  public പദഴലടഫഺഷവ ളവയഥസരഹഥട;\n  [FieldOffset(Offset = "0x68")]\n  [Token(Token = "0x4000653")]\n  [SerializeField]\n  private GhostAI ghost;\n  [FieldOffset(Offset = "0x70")]\n  [Token(Token = "0x4000654")]\n  [HideInInspector]\n  public LevelRoom ഹഷഹധതജഺലള;\n  [FieldOffset(Offset = "0x78")]\n  [Token(Token = "0x4000655")]\n  [HideInInspector]\n  public float ഫഥമതഹഷഫഩബ;\n  [FieldOffset(Offset = "0x7C")]\n  [Token(Token = "0x4000656")]\n  private bool ണടറളശഥസറപ;\n}\n
\n

which will bring us to this struct, the first field (ബണജഷസഷണഞഴ) is the ghost type and the second one (ഹഭഴഞഴന\\u0d3bഥഝ) is the mimic type.

\n
[Token(Token = "0x200015E")]\n[SerializeField]\npublic struct പദഴലടഫഺഷവ\n{\n  [FieldOffset(Offset = "0x0")]\n  [Token(Token = "0x400086D")]\n  public പദഴലടഫഺഷവ.ഝഡശഭഡഡഷഴജ ബണജഷസഷണഞഴ;\n  [FieldOffset(Offset = "0x4")]\n  [Token(Token = "0x400086E")]\n  public പദഴലടഫഺഷവ.ഝഡശഭഡഡഷഴജ ഹഭഴഞഴന\\u0D3Bഥഝ;\n  [FieldOffset(Offset = "0x8")]\n  [Token(Token = "0x400086F")]\n  public List<ദസഫനഠശഢപവ> ഠഥളഡഠലഹമത;\n  [FieldOffset(Offset = "0x10")]\n  [Token(Token = "0x4000870")]\n  public List<ദസഫനഠശഢപവ> ഭടഞ\\u0D3Bറഝമനത;\n  [FieldOffset(Offset = "0x18")]\n  [Token(Token = "0x4000871")]\n  public int \\u0D3Bദഞന\\u0D3Bഫഺടഡ;\n  [FieldOffset(Offset = "0x1C")]\n  [Token(Token = "0x4000872")]\n  public bool ഥഭദടബശനദവ;\n  [FieldOffset(Offset = "0x20")]\n  [Token(Token = "0x4000873")]\n  public string തണവബഝഝഹവഹ;\n  [FieldOffset(Offset = "0x28")]\n  [Token(Token = "0x4000874")]\n  public int തഺറഡദഠഹരജ;\n  [FieldOffset(Offset = "0x2C")]\n  [Token(Token = "0x4000875")]\n  public int സയഡലരണഷദന;\n  [FieldOffset(Offset = "0x30")]\n  [Token(Token = "0x4000876")]\n  public bool ദജഷനജഭധജദ;\n  [FieldOffset(Offset = "0x34")]\n  [Token(Token = "0x4000877")]\n  public int ബഭഞപരയധഠണ;\n  [FieldOffset(Offset = "0x38")]\n  [Token(Token = "0x4000878")]\n  public int യലളനഹഝയതഠ;\n  [FieldOffset(Offset = "0x3C")]\n  [Token(Token = "0x4000879")]\n  public bool ല\\u0D3Bസഺഢവസളഫ;\n\n  [Token(Token = "0x200015F")]\n  public enum ഝഡശഭഡഡഷഴജ\n  {\n    [Token(Token = "0x400087B")] Spirit,\n    [Token(Token = "0x400087C")] Wraith,\n    [Token(Token = "0x400087D")] Phantom,\n    [Token(Token = "0x400087E")] Poltergeist,\n    [Token(Token = "0x400087F")] Banshee,\n    [Token(Token = "0x4000880")] Jinn,\n    [Token(Token = "0x4000881")] Mare,\n    [Token(Token = "0x4000882")] Revenant,\n    [Token(Token = "0x4000883")] Shade,\n    [Token(Token = "0x4000884")] Demon,\n    [Token(Token = "0x4000885")] Yurei,\n    [Token(Token = "0x4000886")] Oni,\n    [Token(Token = "0x4000887")] Yokai,\n    [Token(Token = "0x4000888")] Hantu,\n    [Token(Token = "0x4000889")] Goryo,\n    [Token(Token = "0x400088A")] Myling,\n    [Token(Token = "0x400088B")] Onryo,\n    [Token(Token = "0x400088C")] TheTwins,\n    [Token(Token = "0x400088D")] Raiju,\n    [Token(Token = "0x400088E")] Obake,\n    [Token(Token = "0x400088F")] Mimic,\n    [Token(Token = "0x4000890")] Moroi,\n    [Token(Token = "0x4000891")] Deogen,\n    [Token(Token = "0x4000892")] Thaye,\n  }\n}\n
\n

creating our sdk

\n

back in visual studio we are, let's start by creating a simple sdk that we can use. i'll create a new header file called sdk.h and add a base address and a macro to define functions. i'll also create another header file GhostAI.h and add the ghostai structs to it and define the ghostai::start function.\nbecause ghostai derives from monobehaviour and ghostinfo from monobehaviourpun we'll have to add those fields to the GhostAIFields struct too, i'll give you the MonoBehaviour and the MonoBehaviourPun structs. we won't need to add every field from the actual ghostai class, just the ones we need; so up until the ghostinfo field.

\n
// sdk.h\n#pragma once\n\n#define DECLARE_FUNCTION_POINTER(NAME, TYPE, ADDRESS) \\\nusing NAME = TYPE; \\\ninline NAME NAME##_ptr = reinterpret_cast<NAME>(BASE_ADDRESS + ADDRESS);\n\nnamespace SDK\n{\n  const auto BASE_ADDRESS = reinterpret_cast<uintptr_t>(GetModuleHandleW(L"GameAssembly.dll"));\n}\n\n// MonoBehaviour.h\nnamespace SDK\n{\n  struct __declspec(align(8)) Object1Fields\n  {\n    void* m_CachedPtr;\n    void* m_CancellationTokenSource;\n  };\n\n  struct Component1Fields\n  {\n    Object1Fields _;\n  };\n\n  struct BehaviourFields\n  {\n    Component1Fields _;\n  };\n\n  struct MonoBehaviourFields\n  {\n    BehaviourFields _;\n  };\n\n  struct MonoBehaviour\n  {\n    void* Clazz; // MonoBehaviourClass\n    void* Monitor; // MonitorData\n    MonoBehaviourFields Fields;\n  };\n\n  struct MonoBehaviourPunFields\n  {\n    MonoBehaviourFields _;\n    void* pvCache;\n  };\n\n  struct MonoBehaviourPunCallbacksFields\n  {\n    MonoBehaviourPunFields _;\n  };\n}\n\n// GhostAI.h\n#pragma once\n#include "sdk.h"\n\nnamespace SDK\n{\n  struct GhostAIFields\n  {\n    MonoBehaviourFields _;\n    void* Field0;\n    int32_t Field1;\n    void* Field2;\n    GhostInfo* GhostInfo; // Only field we care about\n  };\n\n  struct GhostAI\n  {\n    void* Clazz; // GhostAI class\n    void* Monitor; // Monitor Data\n    GhostAIFields Fields;\n  };\n\n  DECLARE_FUNCTION_POINTER(GhostAI_Start, void(*)(GhostAI* ghostAI, void* methodInfo), 0x158C940);\n}\n
\n

okay great, now we'll need to create the GhostInfo struct and the GhostTrait struct. don't forget to include them in the sdk.h. we will need every field from the GhostTrait struct because the GhostType field will only be valid after Name isn't a nullptr anymore.

\n
// GhostInfo.h\n#pragma once\n#include "sdk.h"\n\nnamespace SDK\n{\n  struct GhostInfoFields\n  {\n    MonoBehaviourPunFields _;\n    GhostTraits GhostTraits; // very important 1!!!1\n    // don't care about other fields\n  };\n\n  struct GhostInfo\n  {\n    void* Clazz; // GhostInfo class\n    void* Monitor; // Monitor Data\n    GhostInfoFields Fields;\n  };\n}\n\n// GhostTraits.h\n#pragma once\n#include "sdk.h"\n\nnamespace SDK\n{\n  enum class GhostType: int32_t\n  {\n    Spirit,\n    Wraith,\n    Phantom,\n    Poltergeist,\n    Banshee,\n    Jinn,\n    Mare,\n    Revenant,\n    Shade,\n    Demon,\n    Yurei,\n    Oni,\n    Yokai,\n    Hantu,\n    Goryo,\n    Myling,\n    Onryo,\n    TheTwins,\n    Raiju,\n    Obake,\n    Mimic,\n    Moroi,\n    Deogen,\n    Thaye,\n  };\n\n  struct GhostTraits\n  {\n    GhostType GhostType_;\n    GhostType MimicType;\n    // don't care about the other ones\n    void* Field2;\n    void* Field3;\n    int32_t Field4;\n    bool Field5;\n    void* Name;\n    int32_t Field7;\n    int Field8;\n    bool Field9;\n    int32_t Field10;\n    int32_t Field11;\n    bool Field12;\n  };\n}\n
\n

hooking the ghostai::start function

\n

back in our dllmain.cpp we can create our "hackthread", define our GhostAI_Start function and hook it using detours.

\n
// dllmain.cpp\nHMODULE hHackModule = nullptr;\nHANDLE hHackThread = nullptr;\n\nvoid hkGhostAI_Start(SDK::GhostAI* _ghostAI, void* methodInfo)\n{\n  // Calling original function\n  SDK::GhostAI_Start_ptr(_ghostAI, methodInfo);\n}\n\nDWORD WINAPI HackThread()\n{\n  // Detouring GhostAI.Start\n  DetourTransactionBegin();\n  DetourUpdateThread(GetCurrentThread());\n  DetourAttach(&reinterpret_cast<PVOID&>(SDK::GhostAI_Start_ptr), hkGhostAI_Start);\n  DetourTransactionCommit();\n\n  // No exiting the cheat yet\n  while (true)\n  {\n    if (GetAsyncKeyState(VK_END) & 1)\n    {\n      break;\n    }\n\n    Sleep(100);\n  }\n\n  // Un-detouring GhostAI.Start\n  DetourTransactionBegin();\n  DetourUpdateThread(GetCurrentThread());\n  DetourDetach(&reinterpret_cast<PVOID&>(SDK::GhostAI_Start_ptr), hkGhostAI_Start);\n  DetourTransactionCommit();\n\n  CloseHandle(hHackThread);\n  FreeLibraryAndExitThread(hHackModule, 0);\n}\n\n\nBOOL APIENTRY DllMain(HMODULE hModule, DWORD ulReasonForCall, LPVOID lpReserved)\n{\n  if (ulReasonForCall == DLL_PROCESS_ATTACH)\n  {\n    hHackModule = hModule;\n    hHackThread = CreateThread(nullptr, 0, reinterpret_cast<LPTHREAD_START_ROUTINE>(HackThread), hModule, 0, nullptr);\n  }\n\n  return TRUE;\n}\n
\n

displaying the ghost type

\n

woah almost there, now to display the ghost type i'll just add a simple console using AllocConsole. we'll also need to save the ghostai pointer to a global variable so we can use it.

\n
// dllmain.cpp\nSDK::GhostAI* ghostAI = nullptr;\n\nvoid hkGhostAI_Start(SDK::GhostAI* _ghostAI, void* methodInfo)\n{\n  // Saving ghostAI pointer\n  ghostAI = _ghostAI;\n\n  // Calling original function\n  SDK::GhostAI_Start_ptr(ghostAI, methodInfo);\n}\n\nDWORD WINAPI HackThread()\n{\n  // Beep boop I'm a console\n  FILE* f;\n  AllocConsole();\n  freopen_s(&f, "CONOUT$", "w", stdout);\n\n  // other code\n\n  // when exiting after removing hook\n  // Bye bye console\n  FreeConsole();\n}\n
\n

cool, now that we can print stuff to a console, let's print the ghost type. to do this we'll need to convert the enum to a string, i'll just use a switch statement for this because i'm stupid. we will print via the hackthread while loop 'cause ghostInfo can be a nullptr.

\n
// GhostTraits.h\ninline std::string GhostTypeToString(GhostType ghostType)\n{\n  switch (ghostType)\n  {\n  case GhostType::Spirit:\n    return "Spirit";\n  case GhostType::Wraith:\n    return "Wraith";\n  case GhostType::Phantom:\n    return "Phantom";\n  case GhostType::Poltergeist:\n    return "Poltergeist";\n  case GhostType::Banshee:\n    return "Banshee";\n  case GhostType::Jinn:\n    return "Jinn";\n  case GhostType::Mare:\n    return "Mare";\n  case GhostType::Revenant:\n    return "Revenant";\n  case GhostType::Shade:\n    return "Shade";\n  case GhostType::Demon:\n    return "Demon";\n  case GhostType::Yurei:\n    return "Yurei";\n  case GhostType::Oni:\n    return "Oni";\n  case GhostType::Yokai:\n    return "Yokai";\n  case GhostType::Hantu:\n    return "Hantu";\n  case GhostType::Goryo:\n    return "Goryo";\n  case GhostType::Myling:\n    return "Myling";\n  case GhostType::Onryo:\n    return "Onryo";\n  case GhostType::TheTwins:\n    return "The Twins";\n  case GhostType::Raiju:\n    return "Raiju";\n  case GhostType::Obake:\n    return "Obake";\n  case GhostType::Mimic:\n    return "Mimic";\n  case GhostType::Moroi:\n    return "Moroi";\n  case GhostType::Deogen:\n    return "Deogen";\n  case GhostType::Thaye:\n    return "Thaye";\n  default:\n    return "Unknown";\n  }\n}\n\n// dllmain.cpp\nbool shouldPrint = false;\n\nvoid hkGhostAI_Start(SDK::GhostAI* _ghostAI, void* methodInfo)\n{\n  // Saving ghostAI pointer\n  ghostAI = _ghostAI;\n  shouldPrint = true;\n\n  // Calling original function\n  SDK::GhostAI_Start_ptr(ghostAI, methodInfo);\n}\n\nDWORD WINAPI HackThread()\n{\n    // code\n\n    while (true)\n    {\n      /// oooooo spooky ghost\n      if (shouldPrint && ghostAI)\n      {\n        if (const auto ghostInfo = ghostAI->Fields.GhostInfo)\n        {\n          // if name is a nullptr then the ghost type isn't valid yet\n          if (ghostInfo->Fields.GhostTraits.Name)\n          {\n            const auto ghostType = ghostInfo->Fields.GhostTraits.GhostType_;\n            std::cout << "Ghost type: " << GhostTypeToString(ghostType) << std::endl;\n            shouldPrint = false;\n          }\n        }\n      }\n\n      if (GetAsyncKeyState(VK_END) & 1)\n      {\n          break;\n      }\n\n      Sleep(100);\n    }\n\n    // more code\n}\n
\n

anti-kick

\n

during the development of asthmaphobia i found out that you can create an anti-kick hack by just hooking ServerManager_KickPlayerNetworked and then not calling the original function :) have fun.

\n

conclusion

\n

that's it, the basics for creating your own shitty phasmophobia cheat. source code for this project can be found on github. yes i know the code is bad, it isn't meant to be good code.

\n\n","date_published":"2023-12-29T00:00:00.000Z"}]}