Check if You are in game and Call them in Any hooked Directx Function ( Present, Endscene ect )
I hear that for a console command to work you need to call from somewhere in engine.exe and you need to be in the correct thread.
Can someone tell me what the requirements are for calling console commands?
Last edited by .::SCHiM::.; 05-27-2011 at 01:12 PM.
I'm SCHiM
Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.
Polymorphic engine
Interprocess callback class
SIN
Infinite-precision arithmetic
Hooking dynamic linkage
(sloppy)Kernel mode Disassembler!!!
Semi debugger
Check if You are in game and Call them in Any hooked Directx Function ( Present, Endscene ect )
I'm SCHiM
Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.
Polymorphic engine
Interprocess callback class
SIN
Infinite-precision arithmetic
Hooking dynamic linkage
(sloppy)Kernel mode Disassembler!!!
Semi debugger
Any commands that are working surely working at the moment?
I'm SCHiM
Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.
Polymorphic engine
Interprocess callback class
SIN
Infinite-precision arithmetic
Hooking dynamic linkage
(sloppy)Kernel mode Disassembler!!!
Semi debugger
I'm SCHiM
Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.
Polymorphic engine
Interprocess callback class
SIN
Infinite-precision arithmetic
Hooking dynamic linkage
(sloppy)Kernel mode Disassembler!!!
Semi debugger
Nx Chams should be working....
Are you calling your PTC from a DirectX function?
You can do as others have told you, but it's possible to change the console commands without calling them from a D3D function.
There is a check for the thread ID and a check for the thread EP, it must be in range of Engine.exe code section.
To bypass the thread check, find the pointer where the real thread ID is stored and store the value, then change the DWORD to your thread ID before you change the console command, and then restore the real ID (just so that Engine.exe internal commands work again, otherwise only your DLL commands would work).
To bypass the range check you can change the EP located in the stack to a random address in the range of Engine.exe code section. To find the EP value:
Code:mov eax,dword ptr fs:[18h] // TEB mov eax,dword ptr ds:[eax+4h] // TEB.TopOfStack mov dword ptr ds:[eax-0Ch],SOME_ADDRESS // TEB.TopOfStack.ThreadEP
Last edited by HellSpider; 05-27-2011 at 01:47 PM.