Guide [Source] CoD4x Silent Aim C++ — Movement Fix & UserCmd Overwrites

[byte_corvus]

Still seeing people struggle with clean silent aim on the CoD4x client. If you're tired of your screen snapping or looking like a total bot with crab-walk movement when your yaw is spoofed, this logic is what you actually need. This is pulled from a private project and handles the buffer manipulation directly via the usercmd array.

Technical Foundation: Constants and Offsets
Working with the CoD engine means you need to respect the angle-to-short conversions and the command buffer structure. Here are the core offsets and macros for the current CoD4x build:

// Core logic constants
#define USERCMD_BASE 0xCC4FF8
#define CMD_NUMBER   0xCC5FF8
#define M_PI 3.14159265358979323846f

#define SHORT2ANGLE(x)  ((x) * (360.0f / 65536.0f))
#define ANGLE2SHORT(x)  ((int)((x) * 65536.0f / 360.0f) & 65535)

Movement Correction (Anti-Crab Logic)
Silent aim is useless if your character's legs are pointing one way while you're gliding another. You have to rotate your move vectors based on the delta between your view angles and your target (silent) angles. Without this, server-side observers or killcams will flag you instantly.

void FixMovement(int* pYaw, char* pFwd, char* pRgt, float oldYaw, float newYaw) {
    float delta = NormalizeAngle(oldYaw - newYaw);
    float rad = delta * (M_PI / 180.0f);
    float c = cosf(rad);
    float s = sinf(rad);

    float fwd = (float)(*pFwd);
    float rgt = (float)(*pRgt);

    float newFwd = (fwd * c) + (rgt * s);
    float newRgt = (rgt * c) - (fwd * s);

    // Clamp values to char limits to prevent overflow crashes
    if (newFwd > 127.0f) newFwd = 127.0f;
    if (newFwd < -128.0f) newFwd = -128.0f;
    if (newRgt > 127.0f) newRgt = 127.0f;
    if (newRgt < -128.0f) newRgt = -128.0f;

    *pFwd = (char)newFwd;
    *pRgt = (char)newRgt;
    *pYaw = ANGLE2SHORT(newYaw);
}

Applying the Silent Aim Hook
The real trick isn't just changing your angles; it's looping through the command buffer. CoD4x processes multiple commands per frame. If you only hit the latest one, you'll miss half your shots. You need to iterate from the last processed command number to the current one.

1. Identify the current command number from the engine globals.
2. Loop through the command buffer (typically 128 slots).
3. Calculate the correct pointer for pitch, yaw, and movement keys (Forward/Right).
4. Apply silent pitch and corrected movement yaw.
5. Update the local command tracker.

Spoiler: UserCmd Loop Implementation

void ApplySilentAim(float targetPitch, float targetYaw) {
    int currentCmdNum = *(int*)CMD_NUMBER;
    static int lastAimCmdNum = currentCmdNum;

    // Sanity check for map changes or packet loss
    if (lastAimCmdNum > currentCmdNum || currentCmdNum - lastAimCmdNum > 128) {
        lastAimCmdNum = currentCmdNum;
    }

    if (currentCmdNum > lastAimCmdNum) {
        for (int c = lastAimCmdNum + 1; c <= currentCmdNum; c++) {
            // Offset calculation for the cmd array
            int* pPitch = (int*)(USERCMD_BASE + 32 * (c & 0x7F) + 8);
            int* pYaw   = (int*)(USERCMD_BASE + 32 * (c & 0x7F) + 12);
            char* pFwd  = (char*)(USERCMD_BASE + 32 * (c & 0x7F) + 22);
            char* pRgt  = (char*)(USERCMD_BASE + 32 * (c & 0x7F) + 23);

            float oldYaw = SHORT2ANGLE(*pYaw);
            *pPitch = ANGLE2SHORT(targetPitch);

            FixMovement(pYaw, pFwd, pRgt, oldYaw, targetYaw);
        }
        lastAimCmdNum = currentCmdNum;
    }
}

Implementation Notes
While this is basically copy-paste material for an internal hack, you should consider moving toward a proper usercmd_t struct rather than manual pointer math. It's cleaner and less prone to breaking when client updates hit. Also, make sure your angle normalization logic is solid; otherwise, you'll end up snapping your view and getting an immediate manual ban.

Anyone else found a cleaner way to handle the command number delta on high-tick servers?