Results 1 to 7 of 7
  1. #1
    imaginarysss's Avatar
    Join Date
    May 2013
    Gender
    male
    Location
    SG
    Posts
    9
    Reputation
    10
    Thanks
    0

    How to find offset of GetSFXMgr within GCS?

    As title states, i would like to learn how to find the position of getsfxmgr within gcs but i cant seem to find.Please dont just post to me the updated GCS class cos i want to know how to find it myself . Searched around the forum with quite many keywords but still cant find a thread on it


    Thanks in adv.

  2. #2
    Ch40zz-C0d3r's Avatar
    Join Date
    Apr 2011
    Gender
    male
    Posts
    839
    Reputation
    44
    Thanks
    400
    My Mood
    Twisted
    Pointers are marked with red in reclass (*-> 0xDEADBEEF)
    But I made an easier way to update it some years ago:

    Code:
    //The pattern of the virtual function, we gonna hook it so do this as early as possible so we dont miss the call!
    dwTmp = cMisc.FindPattern(dwCShellEntryPoint, dwCShellCodeSize, (PBYTE)"\x83\xC4\x0C\x88\x5E\x3F\xA1\x00\x00\x00\x00\x8B\x08\x8B\x51\x18", "xxxxxxx????xxxxx");
    dwAdrTbl[24] = dwTmp + 0x70; //- 0x40; //GetSFXMgr virtual
    dwJumpbackGetSfxMgr = dwAdrTbl[24] + 0x6;
    sfxMgrECXOffset = (DWORD)*(DWORD*)(dwAdrTbl[24] + 0x2);
    
    //Saving the original bytes before hooking
    ReadProcessMemory(GetCurrentProcess(), (void*)cMisc.dwAdrTbl[24], &origGetSFXMgrbytes, 6, 0); //GetSFXMgr virtual
    cMisc.CreateDetour((PBYTE)dwAdrTbl[24], (PBYTE)hkVGetSfxMgr, 6); //Hooking :|
    
    __declspec(naked) HRESULT WINAPI hkVGetSfxMgr()
    {
    	//Finally our hook, cMisc.sfxMgrECXPointer is your final offset - NOT ADDRESS
    	__asm pushad;
    	__asm MOV cMisc.sfxMgrECXPointer, ECX
    	__asm popad;
    	__asm LEA EAX, DWORD PTR DS:[ECX + 0x24B28]
    	__asm JMP dwJumpbackGetSfxMgr
    }
    
    if(!detouredGetSFXMgr && cMisc.sfxMgrECXPointer) //ReCopy the old bytes if our offset is valid
    {
    	cMisc.memcpy_s((void*)cMisc.dwAdrTbl[24], (void*)cMisc.origGetSFXMgrbytes, 6);
    	detouredGetSFXMgr = true;
    }
    
    //And Finally - Lets add the offset to the base and set our pointer to the class
    pSFXMgr = (cSFXMgr*)(cMisc.sfxMgrECXPointer + cMisc.sfxMgrECXOffset);
    Please, please read my comments and dont be stupid. The sigscan COULD be wrong or the static offset 0x24B28 in the hook has to be updated before using. Always take a look @ Olly
    Last edited by Ch40zz-C0d3r; 12-02-2013 at 06:46 AM.

    Progress with my game - "Disbanded"
    • Fixed FPS lag on spawning entities due to the ent_preload buffer!
    • Edit the AI code to get some better pathfinding
    • Fixed the view bug within the sniper scope view. The mirror entity is invisible now!
    • Added a new silencer for ALL weapons. Also fixed the rotation bugs
    • Added a ton of new weapons and the choice to choose a silencer for every weapon
    • Created a simple AntiCheat, noobs will cry like hell xD
    • The name will be Disbanded, the alpha starts on the 18th august 2014



    Some new physics fun (Serversided, works on every client)



    My new AI
    http://www.youtube.com/watch?v=EMSB1GbBVl8

    And for sure my 8 months old gameplay with 2 friends
    http://www.youtube.com/watch?v=Na2kUdu4d_k

  3. The Following 3 Users Say Thank You to Ch40zz-C0d3r For This Useful Post:

    arun823 (12-03-2013),pDevice (12-03-2013),Skaterforeva1 (01-19-2014)

  4. #3
    imaginarysss's Avatar
    Join Date
    May 2013
    Gender
    male
    Location
    SG
    Posts
    9
    Reputation
    10
    Thanks
    0
    Hi, thanks for the reply.
    Right after your find pattern you added "0x70" doesnt that mean you know the offset beforehand? O.o Your method seems to require some already reversed knowledge which i do not have also like when you hooked the function , you needed the offset which i dont have.
    So,is it possible to find it just within IDA via strings or something else.Wish to find it from scratch.Thanks once again

  5. #4
    Ch40zz-C0d3r's Avatar
    Join Date
    Apr 2011
    Gender
    male
    Posts
    839
    Reputation
    44
    Thanks
    400
    My Mood
    Twisted
    I couldnt sigscan the real function cuz it was too small so I took some more bytes from anorher function which means that I have to increase my actual address.
    The problem is that all these functions are dynamic because they are virtuals so they dont refer to any other address.
    Just try out the sigscan and see if you get something valid, I can also post some old bytes later so you understand the hook better.

    Progress with my game - "Disbanded"
    • Fixed FPS lag on spawning entities due to the ent_preload buffer!
    • Edit the AI code to get some better pathfinding
    • Fixed the view bug within the sniper scope view. The mirror entity is invisible now!
    • Added a new silencer for ALL weapons. Also fixed the rotation bugs
    • Added a ton of new weapons and the choice to choose a silencer for every weapon
    • Created a simple AntiCheat, noobs will cry like hell xD
    • The name will be Disbanded, the alpha starts on the 18th august 2014



    Some new physics fun (Serversided, works on every client)



    My new AI
    http://www.youtube.com/watch?v=EMSB1GbBVl8

    And for sure my 8 months old gameplay with 2 friends
    http://www.youtube.com/watch?v=Na2kUdu4d_k

  6. #5
    imaginarysss's Avatar
    Join Date
    May 2013
    Gender
    male
    Location
    SG
    Posts
    9
    Reputation
    10
    Thanks
    0
    I see. Thanks for clarifying the offset part . Tried it out the sig and it didnt return any result
    Do you know of any way to find it manually in ida? Currently i wish to start from scratch and avoid sig scan if possible so in future i can find it myself

  7. #6
    Ch40zz-C0d3r's Avatar
    Join Date
    Apr 2011
    Gender
    male
    Posts
    839
    Reputation
    44
    Thanks
    400
    My Mood
    Twisted
    OK, I downloaded the latest NA CShell and it works perfectly fine.
    Lets do it step-by-step:

    1. Running the sigscan will result in:


    Code:
    dwTmp = cMisc.FindPattern(dwCShellEntryPoint, dwCShellCodeSize, (PBYTE)"\x83\xC4\x0C\x88\x5E\x3F\xA1\x00\x00\x00\x00\x8B\x08\x8B\x51\x18", "xxxxxxx????xxxxx");
    //dwTmp will result in 0x371CA1D0
    2. Adding the offset to reach our wanted Virtual Function:

    Code:
    dwAdrTbl[24] = dwTmp + 0x70; //dwAdrTbl[24] will result in 0x371CA240 => [LEA EAX, 0xADDRESS]
    dwJumpbackGetSfxMgr = dwAdrTbl[24] + 0x6; //dwJumpbackGetSfxMgr will result in 0x371CA246 => [RETN]
    sfxMgrECXOffset = (DWORD)*(DWORD*)(dwAdrTbl[24] + 0x2); //sfxMgrECXOffset will result in 0x1EFA8 => Offset to EAX
    3. Hooking the virtual to get ECX so we can add our already read offset to the base address:
    Code:
    ReadProcessMemory(GetCurrentProcess(), (void*)cMisc.dwAdrTbl[24], &origGetSFXMgrbytes, 6, 0); //Backup Original bytes e.g. memory
    cMisc.CreateDetour((PBYTE)dwAdrTbl[24], (PBYTE)hkVGetSfxMgr, 6); //Hook the function
    4. Reading ECX register value to get base address:
    Code:
    __declspec(naked) HRESULT WINAPI hkVGetSfxMgr()
    {
    	__asm pushad; //Save register
    	__asm MOV cMisc.sfxMgrECXPointer, ECX //Copy ECX (our basepointer) in a variable so we can use it in the hack later
    	__asm popad; //Reload saved register
    
    	//__asm LEA EAX, DWORD PTR DS:[ECX + 0x24B28] //Do the actual code we had overwritten with our hook
    	//Notice: You can see that the offset is clearly old, but you also know that we saved it already so no need to re-update it all the time
    	//Seems like I forgot to change this, it would crash, use instead:
    	__asm LEA EAX, DWORD PTR DS:[ECX + cMisc.sfxMgrECXOffset] //Will work on every update now
    
    	__asm JMP dwJumpbackGetSfxMgr //Jump back to the RETN instruction of the virtual
    }
    5. Use these informations:
    Now that we have all the informations lets use them!

    Code:
    if(!detouredGetSFXMgr && cMisc.sfxMgrECXPointer != NULL)
    {
    	cMisc.memcpy_s((void*)cMisc.dwAdrTbl[24], (void*)cMisc.origGetSFXMgrbytes, 6); //Unpatch the hook (Unhook) so we cant be trapped by an HackShield
    	detouredGetSFXMgr = true;
    }
    
    pSFXMgr = (cSFXMgr*)(cMisc.sfxMgrECXPointer + cMisc.sfxMgrECXOffset);
    This works for every virtual function, and you can easily catch the function also in class, without hooking:
    Code:
    for(int i = 0; i < 120; i++)
    {
    	//We're gonna try 120 virtual functions and see if they are SFXMgr :)
    	//If yes, we're gonna call it and be happy
    
    	if(*(DWORD*)(pGameClientShell + 0x4 * i) == dwAdrTbl[24])
    	{
    		//This should be our virtual, just call it and get in return our lovely sfxMgr.
    		//IDK if this method works, try it if you have time and like experimenting
    	}
    }
    All in all, you can see 2 strings referring to our address:
    Code:
    SetServerVar End
    CCBAGameClientShell
    You will find the function manually from there
    Have fun!
    Last edited by Ch40zz-C0d3r; 12-04-2013 at 12:04 AM.

  8. The Following 6 Users Say Thank You to Ch40zz-C0d3r For This Useful Post:

    arun823 (12-03-2013),DisOwned (01-19-2014),imaginarysss (12-03-2013),supercarz1991 (12-03-2013),Timboy67678 (12-04-2013),zikox (12-03-2013)

  9. #7
    imaginarysss's Avatar
    Join Date
    May 2013
    Gender
    male
    Location
    SG
    Posts
    9
    Reputation
    10
    Thanks
    0
    Thanks alot ch4ozz .You really helped me out

Similar Threads

  1. [Help Request] How to find Offset Bypass
    By asep451 in forum Mission Against Terror Help
    Replies: 1
    Last Post: 10-27-2013, 08:43 AM
  2. How To Find Offset Wallhack
    By Shartob1 in forum CrossFire Hack Coding / Programming / Source Code
    Replies: 5
    Last Post: 08-11-2012, 02:23 AM
  3. [Help] how to find offset in cshell using Olllly in cf ph?
    By GameMaster025 in forum CrossFire Hack Coding / Programming / Source Code
    Replies: 2
    Last Post: 05-27-2012, 12:16 AM
  4. [Tutorial] How to: Find Offsets
    By deoxyribonucleicacid in forum Call of Duty Modern Warfare 2 Coding / Programming / Source Code
    Replies: 24
    Last Post: 10-16-2010, 01:23 AM
  5. [Help] How to find offsets and addresses
    By shad0wboss in forum WarRock Discussions
    Replies: 0
    Last Post: 12-20-2009, 05:47 PM