By default MW3 doesn't have a console where you can take advantage of, like in most of the previous CoD's:
Changing dvars. MW3 on the other hand features a 'rcon' when you are in-game. Which acts as an remote console to send commands to the server. Since this console is copy-pasted from the previous CoDs. It isn't limited to rcon functionality only.
First off lets try to open the console at the main menu.
There is a byte thats stores the consoles state, which for 1.4.382 (TeknoMW3) is 0x0106020C.
When in-game and the rcon is closed. This byte has a value of 0.
When you press the ` key. The rcon pops up and this byte changes to 1.
Lets try to do that at the main menu.
Well that doesn't really work out that well so lets check the default value of that byte at the main menu.
It turned out to be 16. 0 to 1 is an increment of one.
Lets try 17.
Also we want to open the outputbox at the main menu.
Which is done by setting 0x00B35498 to 1.
Now lets try to remove that ugly 'rcon ' prefix.
Since our console will not work as an rcon for much longer.
A quick search in IDA results in this:
So lets just set that to nothing. You can set it to everything you want including color codes. As the prefix is not processed later on.
Lets move on to printing.
MW3 has a main printing function via which you can print to our rcon.
In order to find it switch to the strings view in IDA. (Shift+F12 for the hot-key type of guys)
Then to CTRL+F and type in the box an example string that the rcon might print.
Example: 'rcon login cleared.'
Double click on your string. And open up the function responsible for it.
This is our function:
As you can see it only calls one function. So this function must call the function responsible for printing. Or its the function responsible for printing.
In both scenarios using this function will work because if it isn't the function thats responsible for printing. it will simply forward our print request to the correct function.
So to use this function use:
typedef void(__cdecl * ConPrint_0x0417D20)(int controller, int channel, const char* string, int a4, int a5, float a6);
ConPrint_0x0417D20 ConPrint = (ConPrint_0x0417D20)0x417D20;
Lets make a function that prints to the rcon for us.
channel & controller: this is the channel you want to print to. The rcon is 0.
string: The string we want to print to the rcon.
all the others don't matter and we can feed them with a 0.