Go To Post

That's the same thing I was trying to do, but with slightly difference.
For example i don't take the VEngineClient via CreateInterface but simply I put directly the address of the pointer.

A lil question is needed, how did you take the various function offset? Because I've hw bp the localplayer address and then Im moved into the second call of 0x68. One problem, 0x68 it's not correct.

Go To Post

Not something like this?

 
MOV ECX,DWORD PTR DS:[Classpoint]
MOV EDX,DWORD PTR DS:[ECX]
MOV EAX,DWORD PTR DS:[EDX+123]
CALL EAX
 

 
MOV ECX,DWORD PTR DS:[Classpoint]
MOV EDX,DWORD PTR DS:[ECX+123]
CALL EDX