m0d_sa Self Zombie

Hello UGBASE,
Just wanted to share a C++ snippet for enabling zombie mode on the local player.

For those who don’t know what zombie mode is (mostly used with RakNet bots):
It’s when a player or bot appears with a ping of 4294967295, an “unbannable” IP address, and remains in a semi-disconnected state — for lack of a better term.

I managed to get it working for the local player.
Not sure if this has already been released somewhere — I’m pretty sure it has,
since there’s not much difference between this version and the typical bot zombie mode.

// TERakClient pointer, GetInterface() method returns original g_SAMP->pRakClientInterface
if (te_sdk::LocalClient)
{
    static unsigned int binaryAddress = 0;
    static unsigned short port = 0;
    static char newRandomNumber[20] = { 0 };
    static char fakeEncryptedRandom[32] = { 0 }; // RSA_BIT_SIZE

    ImGui::InputScalar("IP (binAddr)", ImGuiDataType_U32, &binaryAddress);
    ImGui::InputScalar("Port", ImGuiDataType_U16, &port);
    ImGui::InputText("newRandomNumber", newRandomNumber, 20); // Could be empty, it does same effect. (Keep initialization value => {0})
    ImGui::InputText("FakeEncryptedRand", fakeEncryptedRandom, 32);

    if (ImGui::Button("Update PlayerID"))
    {
        binaryAddress = te_sdk::LocalClient->GetInterface()->GetPlayerID().binaryAddress;
        port = te_sdk::LocalClient->GetInterface()->GetPlayerID().port;

        AppendCheatStateText(ImVec4(0.0f, 1.0f, 0.0f, 1.0f), "PlayerID updated: %u:%hu", binaryAddress, port);
    }

    if (ImGui::Button("Send Spoofed Handshake (SelfZombie)"))
    {
        BitStream bs;

        CSHA1 sha1;
        sha1.Reset();
        sha1.Update(reinterpret_cast<unsigned char*>(&binaryAddress), sizeof(binaryAddress));
        sha1.Update(reinterpret_cast<unsigned char*>(&port), sizeof(port));
        sha1.Update(reinterpret_cast<unsigned char*>(newRandomNumber), 20);
        sha1.Final();

        unsigned char* hash = sha1.GetHash();

        bs.Write(static_cast<unsigned char>(ID_SECURED_CONNECTION_CONFIRMATION));
        bs.Write(reinterpret_cast<char*>(hash), 20);
        bs.Write(reinterpret_cast<char*>(fakeEncryptedRandom), 32);

        te_sdk::LocalClient->SendPacket(&bs, SYSTEM_PRIORITY, RELIABLE_ORDERED);

        AppendCheatStateText(ImVec4(1.0f, 1.0f, 0.0f, 1.0f), "[DEV] Spoofed handshake sent! SYN-cookie: %02X%02X...", hash[0], hash[1]);
    }
}

To use it:

1. Connect to a server.
2. Press "Update PlayerID" to fetch your current PlayerID.
3. Then press "Send Spoofed Handshake (SelfZombie)" to make yourself a zombie.

Warning: This will put you into spectator mode and eventually disconnect you.
However, a copy of your player will remain on the server in a semi-disconnected state.​