Getting ClientCMD offset/Executing Console Command Externally

Imma Split this up into two parts because they relate to each other. im trying to get the ClientCMD offset for csgo so i can use it for writing console commands externally. Im using the public Source for Yetti's Dumper to accomplish this.

Part 1.

this is the code i added into the dumper to make it "work"

Code:

            DumpPatternOffset( "Extra", "ClientCMD", "engine.dll",
                               "55 8B EC A1 ? ? ? ? 81 EC ? ? ? ? 80 B8",
                               Remote::SignatureType_t::READ | Remote::SignatureType_t::SUBTRACT, 0x1, 0x0, ss );

that is supposed to be the correct sig for the ClientCMD offset (cant remember where i found it, UC probably)
anyways, as of 8/2/2016 it returns 0xA7E4EC8B. VS also doesn't give errors or warnings if anyone was gonna ask.

Part 2.

so this part is simple, i need a way to execute a console command externally.
This is what i have (this should theoretically work with the correct offset, which according to the sig above is 0xA7E4EC8B) in my code ClientCMD = 0xA7E4EC8B

Code:

WPM(ClientDLL + ClientCMD, "say L33T H4CKS");

any help would be greatly appreciated

Originally Posted by ImWhacky

WPM(ClientDLL + ClientCMD, "say L33T H4CKS");

bad.

use this:

Code:

void ClientCMD(const char* command)
{
	LPVOID addr = ( LPVOID )Offsets->m_ClientCMD;
	LPVOID vCommand = ( LPVOID )VirtualAllocEx( mem->GetHandle, NULL, strlen( command ) + 1, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE );
	WriteProcessMemory( mem->GetHandle, vCommand, command, strlen( command ), NULL );
	HANDLE hThread = CreateRemoteThread( mem->GetHandle, NULL, NULL, ( LPTHREAD_START_ROUTINE )addr, vCommand, NULL, NULL );
	WaitForSingleObject( hThread, INFINITE );
	VirtualFreeEx( mem->GetHandle, vCommand, strlen( command ) + 1, MEM_RELEASE );
}

ClientCMD("say L33T H4CKS")

Originally Posted by maxtvm

bad.

use this:

Code:

void ClientCMD(const char* command)
{
	LPVOID addr = ( LPVOID )Offsets->m_ClientCMD;
	LPVOID vCommand = ( LPVOID )VirtualAllocEx( mem->GetHandle, NULL, strlen( command ) + 1, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE );
	WriteProcessMemory( mem->GetHandle, vCommand, command, strlen( command ), NULL );
	HANDLE hThread = CreateRemoteThread( mem->GetHandle, NULL, NULL, ( LPTHREAD_START_ROUTINE )addr, vCommand, NULL, NULL );
	WaitForSingleObject( hThread, INFINITE );
	VirtualFreeEx( mem->GetHandle, vCommand, strlen( command ) + 1, MEM_RELEASE );
}

ClientCMD("say L33T H4CKS")

ok i have that set up, now how do i get the ClientCMD offset, im almost 100% sure my sig is messing it up

Not sure if this will help.

Originally Posted by ActualCheats

Not sure if this will help.

kinda, it confirmed that my sig was right i think. i think the problem is that in

Code:

Remote::SignatureType_t::READ | Remote::SignatureType_t::SUBTRACT, 0x1, 0x0, ss );

the 0x1, 0x0, ss is supposed to be something else... any idea?

its work

Code:

void COffsets::updateClientCMD() {
    m_ClientCMD = mem->FindPatternArr(modEngine.dwBase, modEngine.dwSize, "xxxx????xx????xx", 16, 0x55 ,0x8B ,0xEC ,0xA1 ,0x0 ,0x0 ,0x0 ,0x0 ,0x81 ,0xEC ,0x0 ,0x0 ,0x0 ,0x0 ,0x80 ,0xB8);
}

Update:
Valve today fix ClientCMD, mb need find new sign...

Originally Posted by maxtvm

its work

Code:

void COffsets::updateClientCMD() { m_ClientCMD = mem->FindPatternArr(modEngine.dwBase, modEngine.dwSize, "xxxx????xx????xx", 16, 0x55 ,0x8B ,0xEC ,0xA1 ,0x0 ,0x0 ,0x0 ,0x0 ,0x81 ,0xEC ,0x0 ,0x0 ,0x0 ,0x0 ,0x80 ,0xB8); }

Update:
Valve today fix ClientCMD, mb need find new sign...

Valve did not fix clientcmd lol.. You just need to figure out what they changed.

Originally Posted by Azay

Valve did not fix clientcmd lol.. You just need to figure out what they changed.

Do you know what changed? Or can you tell me how to get the correct sig?

they changed VEngineClient013 -> VEngineClient014 if u ment that.

This might help you, this is a sig someone posted on another profile.

Code:

ClientCMD_Unrestricted: 55 8B EC 8B 0D ? ? ? ? 81 F9 ? ? ? ? 75 0C A1 ? ? ? ? 35 ? ? ? ? EB 0B

ExecuteClientCMD sig for function in post #2

Code:

m_ClientCMD = mem->FindPatternArr(modEngine.dwBase, modEngine.dwSize, "xxxxxxxxxxxxx????xx", 19, 0x55, 0x8B, 0xEC, 0x8B, 0x55, 0x08, 0x33, 0xC9, 0x6A, 0x00, 0x6A, 0x00, 0xE8, 0x00, 0x00, 0x00,  0x00, 0x83, 0xC4);

Been over a week since last update/bump, assuming solved.

/Closed.

Getting ClientCMD offset/Executing Console Command Externally

Post a Reply

Similar Threads

Tags for this Thread