.::NℰOH4X::.|| Finding LTClient || Tutorial 1 ||
.::NℰOH4X::.|| Finding LTClient || Tutorial 1 ||
.::NℰOH4X::.
Finding LTClient || Tutorial #1 by .::NℰOH4X:: ||
Requirements:
-master131's Module Dumper
-LordPE
-OllyDbg
-------------------------------------------------------------------------------------------
*VIDEO TUTORIAL*
-------------------------------------------------------------------------------------------
*TEXT TUTORIAL*
First off , we will need to dump cshell.dll to access it via Ollydbg .
1.)Follow master131's tutorial here , Thanks @master131: ---->http://www.mpgh.net/forum/207-combat...le-dumper.html
2.)Once you have followed the process of dumping cshell.dll and removing the .dmp extension (Tip : that extension may be hidden and you will need to untick hide extensions in your folder options in control panel / appearance ! )
we can now move forward to the next process , opening it in OllyDbg .
Your screen should now look like this :
Now , once you've opened it and it looks like the above image , right click anywhere , and click on Search for -> All Referenced Text Strings .
Your screen should now look like this :
Ok once you screen looks like the above image , scroll ALL the way up than scroll like two or one arrow key down and find " ASCII "invalid vector<T> subscript" " , once you find it CLICK on it than right click on it and click on search for text and type in "ILTModelClient.Default" , once you do , it'll take you to it , !
Here's an image when finding ( ASCII "invalid vector<T> subscript" ) :
* Don't mind the square the invalid vector string is behind it *
Once you get the ILTModelClient.Default highlighted , Press CTRL + L 2 Times ! on the second time it will highlight the red CPU selection press it again rapidly one more time and it should go back to ILTModelClient.Default ! , *It'll take a few tries to get it right !* ,right click on it and click on "Follow in disassembler ! " .
Here is how it should look after doing CTRL + L 2 Times :
Now keep scrolling up till you see the first black dot !
It should look like this ! :
there should be 8 numbers highlighted in gray in the left . Take those numbers and add a 0x in front of them !
If you did everything right LTClient should be : 0x3781D678
--------------------------------------------------------------------------------------------------------------
~NℰOH4X~
I hope this helped anyone wanting to find the LTClient Address , with this method , it can be used to find other different addresses in cshell.dll .
If this tutorial is too confusing , I will make a video in the afternoon step by step !
Thanks .
~NℰOH4X~
Finding LTClient || Tutorial #1 by .::NℰOH4X:: ||
Requirements:
-master131's Module Dumper
-LordPE
-OllyDbg
-------------------------------------------------------------------------------------------
*VIDEO TUTORIAL*
-------------------------------------------------------------------------------------------
*TEXT TUTORIAL*
First off , we will need to dump cshell.dll to access it via Ollydbg .
1.)Follow master131's tutorial here , Thanks @master131: ---->http://www.mpgh.net/forum/207-combat...le-dumper.html
2.)Once you have followed the process of dumping cshell.dll and removing the .dmp extension (Tip : that extension may be hidden and you will need to untick hide extensions in your folder options in control panel / appearance ! )
we can now move forward to the next process , opening it in OllyDbg .
Your screen should now look like this :
Now , once you've opened it and it looks like the above image , right click anywhere , and click on Search for -> All Referenced Text Strings .
Your screen should now look like this :
Ok once you screen looks like the above image , scroll ALL the way up than scroll like two or one arrow key down and find " ASCII "invalid vector<T> subscript" " , once you find it CLICK on it than right click on it and click on search for text and type in "ILTModelClient.Default" , once you do , it'll take you to it , !
Here's an image when finding ( ASCII "invalid vector<T> subscript" ) :
* Don't mind the square the invalid vector string is behind it *
Once you get the ILTModelClient.Default highlighted , Press CTRL + L 2 Times ! on the second time it will highlight the red CPU selection press it again rapidly one more time and it should go back to ILTModelClient.Default ! , *It'll take a few tries to get it right !* ,right click on it and click on "Follow in disassembler ! " .
Here is how it should look after doing CTRL + L 2 Times :
Now keep scrolling up till you see the first black dot !
It should look like this ! :
there should be 8 numbers highlighted in gray in the left . Take those numbers and add a 0x in front of them !
If you did everything right LTClient should be : 0x3781D678
--------------------------------------------------------------------------------------------------------------
~NℰOH4X~
I hope this helped anyone wanting to find the LTClient Address , with this method , it can be used to find other different addresses in cshell.dll .
If this tutorial is too confusing , I will make a video in the afternoon step by step !
Thanks .
~NℰOH4X~
funny how many times this has been posted and i still can't do it on any other lithtech based game EXCEPT ca
Originally Posted by supercarz1991
funny how many times this has been posted and i still can't do it on any other lithtech based game EXCEPT ca
Originally Posted by supercarz1991
funny how many times this has been posted and i still can't do it on any other lithtech based game EXCEPT ca
find references to it it will point to a push near a call which will be to a virtual function. ( PTC ) find what sets the offset
Register + Offset to virtual function
Register will hold the LTClient. if it points to a function none virtual see what the function does it will show you the LTClient
and using this method you can reverse the entire thing
Originally Posted by ZysorceN
Find a Command String ( Push to console command ) that you are familiar with such as FogEnable SkyFog e.t.c
find references to it it will point to a push near a call which will be to a virtual function. ( PTC ) find what sets the offset
Register + Offset to virtual function
Register will hold the LTClient. if it points to a function none virtual see what the function does it will show you the LTClient
and using this method you can reverse the entire thing
find references to it it will point to a push near a call which will be to a virtual function. ( PTC ) find what sets the offset
Register + Offset to virtual function
Register will hold the LTClient. if it points to a function none virtual see what the function does it will show you the LTClient
and using this method you can reverse the entire thing
oh i've been trying on my own personal FPS game that's on the lithtech Jupiter Engine lol @N3OH4X
Originally Posted by supercarz1991
oh i've been trying on my own personal FPS game that's on the lithtech Jupiter Engine lol @N3OH4X
and if you wanna discuss and get to know each other , you're welcomed to add my MSN , n3oh4x@live.com
Originally Posted by N3OH4X
Oh , what FPS Game would that be ?
and if you wanna discuss and get to know each other , you're welcomed to add my MSN ,
and if you wanna discuss and get to know each other , you're welcomed to add my MSN ,
i gotta sign on through my phone to add you atm, gimme like 5 minutes lol
Originally Posted by supercarz1991
it's called TPS... The Private Server. the whole idea behind it is basically like CS:S... community based models, textures, characters, etc.
i gotta sign on through my phone to add you atm, gimme like 5 minutes lol
i gotta sign on through my phone to add you atm, gimme like 5 minutes lol
Originally Posted by N3OH4X
Sounds nice , I added you but you no respond , good night haha .
This thread is closed for replies.
