Guide BO2 Plutonium Zombies — ESP Offsets & WorldToScreen Logic

[byte_corvus]

If you are messing with the Plutonium client for Black Ops 2, you know their internal AC is a pain even in solo play. I have been digging into the bootstrapper and mapped out the necessary pointers for a clean external ESP. Be warned: this is highly detectable if you are playing online — stick to LAN or stay wary of the ban hammer.

Base Process: plutonium-bootstrapper-win32.exe

Entity Management
The zombie entity list is located at base + 0x1F30470. To iterate properly, start at the first pointer and increment by 0x8C. I usually loop through 256 entities to ensure I am catching everything on the map.

uint32_t entity;
ReadProcessMemory(pHandle, (LPCVOID)(moduleBase + elistaddress + (0x8C * i)), &entity, sizeof(entity), nullptr);
if (entity == NULL) continue;

Technical Offsets
Once you have the entity pointer, these are the offsets you need to pull the data:

1. Health: 0x1A8
2. Position (Vector3): 0x134
3. Junk Filter / State: 0x228

Pro-tip: The list contains a lot of garbage entities. Check offset 0x228. If the value equals 9999 or 666, it is usually a valid zombie. I have not tested this against Panzers yet, so your mileage may vary there.

WorldToScreen & Logic
To render anything useful, you need the View Matrix. Pull it from 0x0103AD40.

Spoiler: Matrix Struct & W2S

struct viewMatrix {
 float m1, m2, m3, m4;
 float m5, m6, m7, m8;
 float m9, m10, m11, m12;
 float m13, m14, m15, m16;
};

vec2 worldToScreen(viewMatrix m, float x, float y, float z, int w, int h) {
 float clip_w = x * m.m13 + y * m.m14 + z * m.m15 + m.m16;
 if (clip_w < 0.01) return { -99, -99 };

 float clip_x = x * m.m1 + y * m.m2 + z * m.m3 + m.m4;
 float clip_y = x * m.m5 + y * m.m6 + z * m.m7 + m.m8;

 float ndc_x = clip_x / clip_w;
 float ndc_y = clip_y / clip_w;

 return { (ndc_x + 1.0) * 0.5 * w, (1.0 - ndc_y) * 0.5 * h };
}

Local Player Data
Your own data is at base + 0x8A4EEC. Read that pointer, then find your own origin at offset 0x18. This is vital if you want to calculate distance for your ESP or aimbot logic.

Keep in mind that Plutonium updates can shift these offsets, so keep your signatures ready for scanning if the client bumps its version.

Post your findings if you manage to filter out the Panzer entities more reliably.