[Code]model stuff for Warez

**Hell_Demon** · 06-18-2010

TEAMS!

Search for -> All referenced text strings -> TEAM
Skip lines untill you get something that has nothing to do with steam:

Code:

0040C5D9   > B8 CC756D00    MOV EAX,iw4mp_AL.006D75CC                ;  ASCII "TEAM_ALLIES"; Case 1 of switch 0040C5C4
0040C5DE   . C3             RETN
0040C5DF   > B8 D4B27000    MOV EAX,iw4mp_AL.0070B2D4                ;  ASCII "TEAM_AXIS"; Case 2 of switch 0040C5C4
0040C5E4   . C3             RETN

Yay teams!
Continue your search, but with TEAM_ instead

TEAM_FREE =D

Code:

00424A1B   > B8 A83E7300    MOV EAX,iw4mp_AL.00733EA8                ;  ASCII "TEAM_FREE"
00424A20   . 5E             POP ESI
00424A21   . C3             RETN
00424A22   > A1 887B7F00    MOV EAX,DWORD PTR DS:[7F7B88]
00424A27   . 69C0 2C050000  IMUL EAX,EAX,52C				; 0x52C - ClientInfo size
00424A2D   . 05 48B28E00    ADD EAX,iw4mp_AL.008EB248			; 0x8EB248 - ClientInfo Addy
00424A32   . 8338 00        CMP DWORD PTR DS:[EAX],0
00424A35   . 75 06          JNZ SHORT iw4mp_AL.00424A3D
00424A37   . B8 A83E7300    MOV EAX,iw4mp_AL.00733EA8                ;  ASCII "TEAM_FREE"
00424A3C   . C3             RETN
00424A3D   > 8B48 1C        MOV ECX,DWORD PTR DS:[EAX+1C]		; EAX is ClientInfo, +0x1C = team offset
00424A40   . 894C24 04      MOV DWORD PTR SS:[ESP+4],ECX
00424A44   . E9 87BB0600    JMP iw4mp_AL.004905D0

so now we got

Code:

struct CClientInfo
{
    char Unknown000[28]; 	//0x0
    int team;            	//0x1C
    char Unknown001[1292]; 	//0x20
};

TEAM_SPECTATOR

Code:

004905D0  /$ 8B4424 04      MOV EAX,DWORD PTR SS:[ESP+4]
004905D4  |. 83F8 03        CMP EAX,3                                ;  Switch (cases 0..3)
004905D7  |. 77 1F          JA SHORT iw4mp_AL.004905F8
004905D9  |. FF2485 0006490>JMP DWORD PTR DS:[EAX*4+490600]
004905E0  |> B8 A83E7300    MOV EAX,iw4mp_AL.00733EA8                ;  ASCII "TEAM_FREE"; Case 0 of switch 004905D4
004905E5  |. C3             RETN
004905E6  |> B8 D4B27000    MOV EAX,iw4mp_AL.0070B2D4                ;  ASCII "TEAM_AXIS"; Case 1 of switch 004905D4
004905EB  |. C3             RETN
004905EC  |> B8 CC756D00    MOV EAX,iw4mp_AL.006D75CC                ;  ASCII "TEAM_ALLIES"; Case 2 of switch 004905D4
004905F1  |. C3             RETN
004905F2  |> B8 BC197100    MOV EAX,iw4mp_AL.007119BC                ;  ASCII "TEAM_SPECTATOR"; Case 3 of switch 004905D4
004905F7  |. C3             RETN
004905F8  |> B8 7C4A6F00    MOV EAX,iw4mp_AL.006F4A7C                ;  Default case of switch 004905D4
004905FD  \. C3             RETN

zomg teamtable!

Code:

#define TEAM_FREE 0
#define TEAM_ALLIES 1
#define TEAM_AXIS 2
#define TEAM_SPECTATOR 3

now I got lazy, you'll probably be able to find these from reversing too, but I decided to launch the game along with Structbuilder(google it)
char BodyModel[64]; //0x040
char HeadModel[64]; //0x080
char WeaponModel[64]; //0x0C0
char WeaponModel2[64]; //0x100

so my current struct:

Code:

struct CClientInfo
{
    char Unknown000[28];    //0x0
    int team;               //0x1C
    char Unknown001[32];    //0x20
    char BodyModel[64];     //0x040  
    char HeadModel[64];     //0x080  
    char WeaponModel[64];   //0x0C0
    char WeaponModel2[64];  //0x100
    char Unknown002[1004];  //0x140
}; //size=0x52C

Now we're able to recognize models and get people's team.
Clientinfo addy: 0x8EB248
Have fun