Question Combat Arms — Fly Hack Pointer Chain & PlayerManager Offsets

[byte_corvus]

Anyone still messing with the CABR binaries? Trying to get the vertical movement logic back online but the old offsets for the fly hack are completely cooked after the recent changes. We're looking at the standard PlayerManager pointer chain—classic LithTech garbage—but finding the exact member for the gravity/Z-velocity float is becoming a headache.

The logic used targets the manager and tries to write to the verticality float. Here is the current state of the code being used:

#define PlayerManager 0x3845CE7C // cabr address

if (FlyHack)
{
    *(FLOAT*)(*(DWORD*)(*(DWORD*)(PlayerManager) + Offset1) + Offset2) = 1100.0f;
}
else
{
    *(FLOAT*)(*(DWORD*)(*(DWORD*)(PlayerManager) + Offset1) + Offset2) = -1100.0f;
}

Technical Context
This method usually hooks into the local player's movement state. If Offset1 (usually the player base pointer) or Offset2 (the specific attribute offset) are mismatched, you're either going to hit a null pointer and BSOD or just do absolutely nothing.

Spoiler: Notes for Reversing

1. Check CShell.dll first—most of the movement logic is handled there.
2. Be careful with WPM—if the anti-cheat is actually monitoring these regions, writing 1100.0f is a red flag for movement anomalies.
3. Engine limits—Setting these values too high often triggers a disconnect due to server-side position validation.

If anyone has managed to dump the latest binary or has the updated hex for these offsets, let’s see them. Anyone else experiencing crashes when trying to write to this memory region lately?