├── README.md
└── Source
    ├── Includes
        ├── GameFunctions.h
        ├── UnityEngine.CoreModule.h
        └── Utils.h
    ├── Obfuscate.h
    └── main.cpp


/README.md:
--------------------------------------------------------------------------------
 1 | # Bullet-Force-Source-Code
 2 | Bullet Force Source Code for iOS & Android
 3 | 
 4 | 
 5 | # Note
 6 | Offsets are outdated, so update them or otherwise use ByNameModding for Auto-Offsets-Update.
 7 | 
 8 | # Features
 9 | Aimbot
10 | 
11 | Telekill
12 | 
13 | Trigger Bot
14 | 
15 | Many more.
16 | 


--------------------------------------------------------------------------------
/Source/Includes/Utils.h:
--------------------------------------------------------------------------------
  1 | typedef unsigned long DWORD;
  2 | static DWORD libBase;
  3 | 
  4 | DWORD findLibrary(const char *library);
  5 | DWORD getAbsoluteAddress(const char* libraryName, DWORD relativeAddr);
  6 | DWORD getRealOffset(DWORD offset);
  7 | bool isLibraryLoaded(const char *libraryName);
  8 | void hook(void *orig_fcn, void* new_fcn, void **orig_fcn_ptr);
  9 | 
 10 | DWORD findLibrary(const char *library) {
 11 |     char filename[0xFF] = {0},
 12 |             buffer[1024] = {0};
 13 |     FILE *fp = NULL;
 14 |     DWORD address = 0;
 15 | 
 16 |     sprintf( filename, "/proc/self/maps");
 17 |     fp = fopen( filename, "rt" );
 18 |     if( fp == NULL ){
 19 |         perror("fopen");
 20 |         goto done;
 21 |     }
 22 | 
 23 |     while( fgets( buffer, sizeof(buffer), fp ) ) {
 24 |         if( strstr( buffer, library ) ){
 25 |             address = (DWORD)strtoul( buffer, NULL, 16 );
 26 |             goto done;
 27 |         }
 28 |     }
 29 | 
 30 |     done:
 31 | 
 32 |     if(fp){
 33 |         fclose(fp);
 34 |     }
 35 | 
 36 |     return address;
 37 | }
 38 | DWORD getAbsoluteAddress(const char* libraryName, DWORD relativeAddr) {
 39 |     if(libBase == 0)
 40 |         libBase = findLibrary(libraryName);
 41 |     if (libBase != 0)
 42 |         return (reinterpret_cast<DWORD>(libBase + relativeAddr));
 43 |     else
 44 |         return 0;
 45 | }
 46 | DWORD getRealOffset(DWORD offset) {
 47 |     if(libBase == 0)
 48 |         libBase = findLibrary("libil2cpp.so");
 49 |     if (libBase != 0)
 50 |         return (reinterpret_cast<DWORD>(libBase + offset));
 51 |     else
 52 |         return 0;
 53 | }
 54 | 
 55 | bool isLibraryLoaded(const char *libraryName) {
 56 |     char line[512] = {0};
 57 |     FILE *fp = fopen("/proc/self/maps", "rt");
 58 |     if (fp != NULL) {
 59 |         while (fgets(line, sizeof(line), fp)) {
 60 |             if (strstr(line, libraryName))
 61 |                 return true;
 62 |         }
 63 |         fclose(fp);
 64 |     }
 65 |     return false;
 66 | }
 67 | 
 68 | uintptr_t string2Offset(const char *c) {
 69 |     int base = 16;
 70 |     // See if this function catches all possibilities.
 71 |     // If it doesn't, the function would have to be amended
 72 |     // whenever you add a combination of architecture and
 73 |     // compiler that is not yet addressed.
 74 |     static_assert(sizeof(uintptr_t) == sizeof(unsigned long)
 75 |                   || sizeof(uintptr_t) == sizeof(unsigned long long),
 76 |                   "Please add string to handle conversion for this architecture.");
 77 | 
 78 |     // Now choose the correct function ...
 79 |     if (sizeof(uintptr_t) == sizeof(unsigned long)) {
 80 |         return strtoul(c, nullptr, base);
 81 |     }
 82 | 
 83 |     // All other options exhausted, sizeof(uintptr_t) == sizeof(unsigned long long))
 84 |     return strtoull(c, nullptr, base);
 85 | }
 86 | 
 87 | void hook(void *orig_fcn, void* new_fcn, void **orig_fcn_ptr)
 88 | {
 89 | #if defined(__aarch64__)
 90 |     A64HookFunction(orig_fcn, new_fcn, orig_fcn_ptr);
 91 | #else
 92 |     MSHookFunction(orig_fcn, new_fcn, orig_fcn_ptr);
 93 | #endif
 94 | }
 95 | void LogAddress(void *object, const char *objectname)
 96 | {
 97 |     std::string whatever(objectname);
 98 |     whatever.append(": %p");
 99 |     LOGD(whatever.c_str(), object);
100 | }
101 | 


--------------------------------------------------------------------------------
/Source/Obfuscate.h:
--------------------------------------------------------------------------------
  1 | /* --------------------------------- ABOUT -------------------------------------
  2 | Original Author: Adam Yaxley
  3 | Website: https://github.com/adamyaxley
  4 | License: See end of file
  5 | Obfuscate
  6 | Guaranteed compile-time string literal obfuscation library for C++14
  7 | Usage:
  8 | Pass string literals into the AY_OBFUSCATE macro to obfuscate them at compile
  9 | time. AY_OBFUSCATE returns a reference to an ay::obfuscated_data object with the
 10 | following traits:
 11 | 	- Guaranteed obfuscation of string
 12 | 	The passed string is encrypted with a simple XOR cipher at compile-time to
 13 | 	prevent it being viewable in the binary image
 14 | 	- Global lifetime
 15 | 	The actual instantiation of the ay::obfuscated_data takes place inside a
 16 | 	lambda as a function level static
 17 | 	- Implicitly convertable to a char*
 18 | 	This means that you can pass it directly into functions that would normally
 19 | 	take a char* or a const char*
 20 | Example:
 21 | const char* obfuscated_string = AY_OBFUSCATE("Hello World");
 22 | std::cout << obfuscated_string << std::endl;
 23 | ----------------------------------------------------------------------------- */
 24 | #ifndef PROJECT_X_Obfuscate_H
 25 | #define PROJECT_X_Obfuscate_H
 26 | namespace ay
 27 | {
 28 |     // Obfuscates a string at compile time
 29 |     template <std::size_t N, char KEY>
 30 |     class obfuscator
 31 |     {
 32 |     public:
 33 |         // Obfuscates the string 'data' on construction
 34 |         constexpr obfuscator(const char* data)
 35 |         {
 36 |             static_assert(KEY != '\0', "KEY must not be the null character.");
 37 | 
 38 |             // On construction each of the characters in the string is
 39 |             // obfuscated with an XOR cipher based on KEY
 40 |             for (std::size_t i = 0; i < N; i++)
 41 |             {
 42 |                 m_data[i] = data[i] ^ KEY;
 43 |             }
 44 |         }
 45 | 
 46 |         constexpr const char* getData() const
 47 |         {
 48 |             return &m_data[0];
 49 |         }
 50 | 
 51 |         constexpr std::size_t getSize() const
 52 |         {
 53 |             return N;
 54 |         }
 55 | 
 56 |         constexpr char getKey() const
 57 |         {
 58 |             return KEY;
 59 |         }
 60 | 
 61 |     private:
 62 | 
 63 |         char m_data[N]{};
 64 |     };
 65 | 
 66 |     // Handles decryption and re-encryption of an encrypted string at runtime
 67 |     template <std::size_t N, char KEY>
 68 |     class obfuscated_data
 69 |     {
 70 |     public:
 71 |         obfuscated_data(const obfuscator<N, KEY>& obfuscator)
 72 |         {
 73 |             for (std::size_t i = 0; i < N; i++)
 74 |             {
 75 |                 m_data[i] = obfuscator.getData()[i];
 76 |             }
 77 |         }
 78 | 
 79 |         ~obfuscated_data()
 80 |         {
 81 |             // Zero m_data to remove it from memory
 82 |             for (std::size_t i = 0; i < N; i++)
 83 |             {
 84 |                 m_data[i] = 0;
 85 |             }
 86 |         }
 87 | 
 88 |         // Returns a pointer to the plain text string, decrypting it if
 89 |         // necessary
 90 |         operator char*()
 91 |         {
 92 |             decrypt();
 93 |             return m_data;
 94 |         }
 95 | 
 96 |         // Manually decrypt the string
 97 |         void decrypt()
 98 |         {
 99 |             if (is_encrypted())
100 |             {
101 |                 for (std::size_t i = 0; i < N; i++)
102 |                 {
103 |                     m_data[i] ^= KEY;
104 |                 }
105 |             }
106 |         }
107 | 
108 |         // Manually re-encrypt the string
109 |         void encrypt()
110 |         {
111 |             if (!is_encrypted())
112 |             {
113 |                 for (std::size_t i = 0; i < N; i++)
114 |                 {
115 |                     m_data[i] ^= KEY;
116 |                 }
117 |             }
118 |         }
119 | 
120 |         // Returns true if this string is currently encrypted, false otherwise.
121 |         bool is_encrypted() const
122 |         {
123 |             return m_data[N - 1] != '\0';
124 |         }
125 | 
126 |     private:
127 | 
128 |         // Local storage for the string. Call is_encrypted() to check whether or
129 |         // not the string is currently obfuscated.
130 |         char m_data[N];
131 |     };
132 | 
133 |     // This function exists purely to extract the number of elements 'N' in the
134 |     // array 'data'
135 |     template <std::size_t N, char KEY = '.'>
136 |     constexpr auto make_obfuscator(const char(&data)[N])
137 |     {
138 |         return obfuscator<N, KEY>(data);
139 |     }
140 | }
141 | 
142 | // Obfuscates the string 'data' at compile-time and returns a reference to a
143 | // ay::obfuscated_data object with global lifetime that has functions for
144 | // decrypting the string and is also implicitly convertable to a char*
145 | #define STRING_OBFUSCATE(data) STRING_OBFUSCATE_KEY(data, '2')
146 | 
147 | // Obfuscates the string 'data' with 'key' at compile-time and returns a
148 | // reference to a ay::obfuscated_data object with global lifetime that has
149 | // functions for decrypting the string and is also implicitly convertable to a
150 | // char*
151 | #define STRING_OBFUSCATE_KEY(data, key) \
152 | 	[]() -> ay::obfuscated_data<sizeof(data)/sizeof(data[0]), key>& { \
153 | 		constexpr auto n = sizeof(data)/sizeof(data[0]); \
154 | 		static_assert(data[n - 1] == '\0', "String must be null terminated"); \
155 | 		constexpr auto obfuscator = ay::make_obfuscator<n, key>(data); \
156 | 		static auto obfuscated_data = ay::obfuscated_data<n, key>(obfuscator); \
157 | 		return obfuscated_data; \
158 | 	}()
159 | 
160 | /* -------------------------------- LICENSE ------------------------------------
161 | Public Domain (http://www.unlicense.org)
162 | This is free and unencumbered software released into the public domain.
163 | Anyone is free to copy, modify, publish, use, compile, sell, or distribute this
164 | software, either in source code form or as a compiled binary, for any purpose,
165 | commercial or non-commercial, and by any means.
166 | In jurisdictions that recognize copyright laws, the author or authors of this
167 | software dedicate any and all copyright interest in the software to the public
168 | domain. We make this dedication for the benefit of the public at large and to
169 | the detriment of our heirs and successors. We intend this dedication to be an
170 | overt act of relinquishment in perpetuity of all present and future rights to
171 | this software under copyright law.
172 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
173 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
174 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS BE
175 | LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
176 | CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
177 | SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
178 | ----------------------------------------------------------------------------- */
179 | #endif


--------------------------------------------------------------------------------
/Source/main.cpp:
--------------------------------------------------------------------------------
  1 | void *Camera;
  2 | bool shooting;
  3 | 
  4 | monoArray<void **> *(*PhotonNetwork_get_OtherPlayers)();
  5 | void* GetClosestPlayer()
  6 | {
  7 |     float closestDistance = 999999.0f;
  8 |     void* closestEnemy;
  9 |     auto playerlist = PhotonNetwork_get_OtherPlayers();
 10 |     for (int i = 0; i < playerlist->getLength(); ++i) {
 11 |         auto player = playerlist->getPointer()[i];
 12 |         auto playerscript = *(void**)((uint64_t)player + 0x10);
 13 |         auto myplayerscript = *(void**)((uint64_t)PhotonNetwork.get_player() + 0x10);
 14 |         LOGD("playerscript: %p", playerscript);
 15 |         if(player == 0x0 || playerscript == 0x0 || myplayerscript == 0x0 || (long)playerscript < 0x50000000)
 16 |         {
 17 |             LOGD("PLAYER WASN'T INSTANTIATED YET SKIPPING");
 18 |             continue;
 19 |         }
 20 |         if(!PlayerUtils.IsPlayerOnTeam(playerscript, myplayerscript) && PlayerScript.PlayerAlive(playerscript, false))
 21 |         {
 22 |             auto mypos = UnityEngine::Transform.get_position(UnityEngine::Component.get_transform(myplayerscript));
 23 |             LogAddress(&mypos, "My Pos");
 24 |             auto enemyPos = UnityEngine::Transform.get_position(UnityEngine::Component.get_transform(playerscript));
 25 |             LogAddress(&enemyPos, "Enemy Pos");
 26 |             auto enemyDistance = Vector3::Distance(enemyPos, mypos);
 27 |             if(closestDistance > enemyDistance) {
 28 |                 LogAddress(playerscript, "New Closest Enemy");
 29 |                 closestDistance = enemyDistance;
 30 |                 closestEnemy = playerscript;
 31 |             }
 32 |         }
 33 |     }
 34 |     return closestEnemy;
 35 | }
 36 | void DoAimBot()
 37 | {
 38 |     auto myPlayerScript = *(void**)((uint64_t)PhotonNetwork.get_player() + 0x10);
 39 |     if(myPlayerScript == 0x0) return;
 40 |     void* closestEnemy = GetClosestPlayer();
 41 |     LogAddress(closestEnemy, "Closest Enemy");
 42 |     if(closestEnemy == 0x0 || (long)closestEnemy < 0x50000000)
 43 |     {
 44 |         return;
 45 |     }
 46 |     auto myPos = UnityEngine::Transform.get_position(UnityEngine::Component.get_transform(myPlayerScript));
 47 |     LogAddress(&myPos, "My Aimbot Pos");
 48 |     if (!PlayerScript.PlayerAlive(closestEnemy, true)) return;
 49 |     auto enemyComponent = UnityEngine::Component.get_transform(closestEnemy);
 50 |     LogAddress(enemyComponent, "Enemy Component");
 51 |     if(enemyComponent == 0x0) return;
 52 |     auto enemyPos = UnityEngine::Transform.get_position(enemyComponent);
 53 |     LogAddress(&myPos, "Enemy Aimbot Pos");
 54 |     auto rotation = Quaternion::LookRotation(enemyPos - Vector3(0, 1, 0) - myPos);
 55 |     *(Quaternion*)((uint64_t)myPlayerScript + 0x7C4) = rotation;
 56 | 
 57 | }
 58 | void Telekill()
 59 | {
 60 |     auto myPlayerScript = *(void**)((uint64_t)PhotonNetwork.get_player() + 0x10);
 61 |     if(myPlayerScript == 0x0) return;
 62 |     void* closestEnemy = GetClosestPlayer();
 63 |     if(closestEnemy == 0x0|| (long)closestEnemy < 0x50000000)
 64 |     {
 65 |         return;
 66 |     }
 67 |     auto enemyPos = UnityEngine::Transform.get_position(UnityEngine::Component.get_transform(closestEnemy)) - Vector3(0, 0, -1);
 68 |     UnityEngine::Transform.set_position(UnityEngine::Component.get_transform(myPlayerScript), enemyPos);
 69 | 
 70 | }
 71 | void TriggerBot()
 72 | {
 73 |     auto myPlayerScript = *(void**)((uint64_t)PhotonNetwork.get_player() + 0x10);
 74 |     if(myPlayerScript == 0x0) return;
 75 |     auto aimingat = PlayerScript.GetPlayerAimingAt(myPlayerScript);
 76 |     if(aimingat && !PlayerUtils.IsPlayerOnTeam(aimingat, myPlayerScript) && PlayerScript.PlayerAlive(aimingat, true))
 77 |     {
 78 |         PlayerScript.Shoot(myPlayerScript);
 79 |     }
 80 | }
 81 | void NoSpread()
 82 | {
 83 |     auto myPlayerScript = *(void**)((uint64_t)PhotonNetwork.get_player() + 0x10);
 84 |     if(myPlayerScript == 0x0) return;
 85 |     *(float *) ((uint64_t) myPlayerScript + 0x828) = 0;
 86 | }
 87 | bool (*old_IsMine)(void* instance);
 88 | bool IsMine(void *instance)
 89 | {
 90 |     if (instance && PhotonNetwork.get_player() != 0x0)
 91 |     {
 92 |         auto photonplayer = PhotonView.get_owner(instance);
 93 |         auto otherPlayerScript = *(void**)((uint64_t)photonplayer + 0x10);
 94 |         auto myPlayerScript = *(void**)((uint64_t)PhotonNetwork.get_player() + 0x10);
 95 |         if (old_IsMine(instance))
 96 |         {
 97 | 
 98 |         } else if(PhotonNetwork.get_player() != 0x0 && photonplayer != 0x0)
 99 |         {
100 |             if(!PlayerUtils.IsPlayerOnTeam(otherPlayerScript, myPlayerScript))
101 |             {
102 |                 if(isAimbot)
103 |                 {
104 |                     DoAimBot();
105 |                 }
106 |                 if(isTriggerBot)
107 |                 {
108 |                     TriggerBot();
109 |                 }
110 |                 if(isNoSpread)
111 |                 {
112 |                     NoSpread();
113 |                 }
114 |                 if(isTelekill)
115 |                 {
116 |                     Telekill();
117 |                 }
118 |             }
119 |         }
120 |     }
121 |     return old_IsMine(instance);
122 | }
123 | void nop(DWORD offset)
124 | {
125 |     Patch::Setup((void*)offset,  STRING_OBFUSCATE("\x00\x00\xa0\xe3\x1e\xff\x2f\xe1"), 8)->Apply();
126 | }
127 | void CustomMatchMakerUI_PromptPassword(void *instance)
128 | {
129 |     if(instance)
130 |     {
131 |         CustomMatchMakerUI.SetTypedPassword(instance, *(monoString**)((uint64_t)instance + 0xD4));
132 |         CustomMatchMakerUI.TryPassword(instance);
133 |     }
134 | }
135 | 


--------------------------------------------------------------------------------