Help with PushToConsole

[Apoc91]

Ok, well I spent the past few days just going through all the threads trying to gather as much information as I could about CA. I have found in my ventures (roughly) how to start looking for LTClient (Well, really I just know how to search for LTClient.Default and go from there). Anyway, I then ventured on to using PushToConsole and I saw the ASM that someone posted, and then I, instead, used a function pointer to do my dirty deeds.

Anyway, when I use this function, CA doesn't crash or close or anything, but instead nothing happens. I know the function is actually being called because I put a MessageBox in there displaying what it was sending as an argument to PushToConsole and it displayed everything correct (e.g. ShowFps 1)

Here's my Engine::PushToConsole method:

	void Engine::PushToConsole(const std::string& szCommand) const
	{
		PushToConsole_T ptc;
		if(GetModuleHandle(L"cshell.dll") == NULL)
			return;
	
		ptc = *(PushToConsole_T *) (*((int*) LT_CLIENT_ADDR) + 0x208);
		ptc(szCommand.c_str());
	}

Here's the value I have for LT_CLIENT_ADDR:

const static int LT_CLIENT_ADDR = 0x3780AB70;

(I haven't checked lately, it may be outdated now (or possibly even wrong), I'm not honestly sure. As I said, I found where to start looking for LTClient, I didn't actually found how to distinguish it thoroughly)


Would any of you be so kind as to enlighten me on what I'm doing wrong? If you need more of the code posted, I can upload my MSVC++ project.

[Apoc91]

With further looking through the forums; I've discovered that the way I'm trying to do it is patched. So I tried to call the function at address 0x485E10 which I've assumed to be the PushToClient method in Engine.exe

Still a no-go =(

EDIT: Added my CAHack project to the main post.

[CodeDemon]

With further looking through the forums; I've discovered that the way I'm trying to do it is patched. So I tried to call the function at address 0x485E10 which I've assumed to be the PushToClient method in Engine.exe

Still a no-go =(

EDIT: Added my CAHack project to the main post.

You do realize that since there was a patch, the address most likely changed from 0x485E10?

[Apoc91]

Oh, I thought this was it:

00485E10   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]
00485E14   50               PUSH EAX
00485E15   68 F0138000      PUSH Engine.008013F0
00485E1A   E8 A1EDFFFF      CALL Engine.00484BC0
00485E1F   83C4 08          ADD ESP,8
00485E22   C3               RETN