Bypass Client Error 31_0

This bypass works by detouring the client error checks to a backuped piece of memory

Things needed to backup weapons

Code:

typedef struct _WEAPON
{
    unsigned char Data[0x4000];
} WEAPON, *PWEAPON;

PWEAPON pOldWeapons[1600];

Creating the backup to detour the client error check

Code:

void CreateBackup(DWORD dwCShell, DWORD dwWeaponMgr)
{
    DWORD pWeaponMgr = *(DWORD*)(dwCShell + dwWeaponMgr );
    for(int i = 0; i < 1600; i++)
    {
        DWORD dwWeapon = *(DWORD*)(pWeaponMgr + (4 * i));
        if (dwWeapon)
        {
            pOldWeapons[i] = new WEAPON;
            memcpy(pOldWeapons[i], (void*)(dwWeapon), sizeof(WEAPON));
        }
    }
}

Our custom GetWeaponByIndex function to return a pointer to the weapon backup instead of the modified one

Code:

PWEAPON GetWeaponByIndex(int index)
{
    return pOldWeapons[index];
}

Calling our custom GetWeaponByIndex instead of the one in CShell

Code:

DWORD dwBypassWeaponHack = FindPattern(dwCShellBase, 0xFFFFFF, (PBYTE)"\xE8\x00\x00\x00\x00\x83\xC4\x04\x85\xC0\x74\x48\x8B\x0D\x00\x00\x00\x00\x8B\x11", "x????xxxxxxxxx????xx");

DWORD dwOldProtect;
VirtualProtect((void*)(dwBypassWeaponHack + 0x1), sizeof(DWORD), PAGE_EXECUTE_READWRITE, &dwOldProtect);
*(DWORD*)(dwBypassWeaponHack + 0x1) = (DWORD)GetWeaponByIndex - dwBypassWeaponHack - 5;
VirtualProtect((void*)(dwBypassWeaponHack + 0x1), sizeof(DWORD), dwOldProtect, NULL);

asm

Code:

1053A94A | 50                       | push eax                                |
1053A94B | C7 44 24 14 00 00 00 00  | mov dword ptr ss:[esp+14],0             |
1053A953 | E8 F8 95 DD FF           | call cshell.10313F50                    |
1053A958 | 83 C4 04                 | add esp,4                               |
1053A95B | 85 C0                    | test eax,eax                            |
1053A95D | 74 48                    | je cshell.1053A9A7                      |
1053A95F | 8B 0D D8 22 A1 10        | mov ecx,dword ptr ds:[10A122D8]         |
1053A965 | 8B 11                    | mov edx,dword ptr ds:[ecx]              |
1053A967 | 8D 5C 24 10              | lea ebx,dword ptr ss:[esp+10]           |
1053A96B | 05 FC 15 00 00           | add eax,15FC                            |
1053A970 | 53                       | push ebx                                |
1053A971 | 50                       | push eax                                |
1053A972 | 8B 42 2C                 | mov eax,dword ptr ds:[edx+2C]           |
1053A975 | FF D0                    | call eax                                |

You can now edit the PViewSkinFileName of weapons without getting 31_0