Question PlanetSide 2 — Finding Offsets for DMA ESP (BattlEye Bypass & IDA)

[byte_corvus]

Been digging into PlanetSide 2 lately and hit the classic wall that most newcomers face when moving from simple memory scanning to actual development. If you're running a DMA setup with Metick's plugin for Cheat Engine, you've likely realized that scanning is the easy part—extracting clean, persistent offsets for a standalone external client is where the real work begins.

The Current Setup & Roadblocks
Currently, the process involves scanning game memory via DMA to find basic variables like coordinates, names, and ammo counts. However, attaching a debugger to the DMA-linked Cheat Engine process usually fails, and trying to bypass BattlEye on the master machine to use DBVM or local debugging is a one-way ticket to a manual ban or a flagged HWID.

Technical Meat: What’s Needed
To build a functional ESP/Aimbot for PlanetSide 2, you need more than just dynamic addresses. You're looking for:

1. Local Player & Enemy Coordinates (XYZ vectors).
2. ViewMatrix (Essential for World-to-Screen logic).
3. Player Name Strings (usually found via the Entity List).
4. Actor/Entity List base pointers.

Static Analysis vs. Live Debugging
If you're stuck on the BattlEye Test Signing bypass, stop. Re-enabling Test Signing and trying to hide it from BE is a cat-and-mouse game you’ll likely lose. Instead, consider these two paths:

Spoiler: Path 1: The IDA Pro Approach (Recommended)

Static analysis is the safest bet. Since you have a DMA card, you can use it to dump the PlanetSide2_x64.exe process memory directly to your second PC.

1. Dump the process using a DMA-based dumper.
2. Load the dump into IDA Pro.
3. Use known signatures or strings (like "Player" or UI-related strings) to find the functions that handle coordinates.
4. PlanetSide 2 uses a fairly standard engine architecture—once you find the ViewMatrix, the rest of the Entity List logic usually follows.

Spoiler: Path 2: DMA-Based Debugging

If you insist on dynamic analysis, don't do it on the game machine. Use a DMA-compatible debugger that runs on the second PC. This allows you to set hardware breakpoints via the PCIe bus without the guest OS (or BattlEye) ever knowing the CPU state was paused. It’s more complex to set up but virtually invisible to software-based AC.

Risks & Preventive Measures
BattlEye is aggressive about kernel-level modifications. If you're messing with Test Signing or unsigned drivers on your gaming rig, you're leaving traces. Static analysis with IDA is 100% secure because the game isn't even running while you're reversing the dump. For DMA users, ensure your firmware is custom; generic LeetDMA or Squirrel firmware is getting flagged more frequently these days.

Anyone here currently maintaining a PS2 offset list or have a preferred method for dumping the latest build without BE interference?

who's run this DMA setup lately?