CLTClient Hooks

VMT

Code:

class VMT
{
public:

    VMT(PDWORD* ppdwClassBase)
    {
        this->m_ClassBase = ppdwClassBase;

        for (int i = 0; i < 400; i++)
            if (reinterpret_cast<signed int*>(ppdwClassBase)[i])
                method_count++;

        m_OldVT = new DWORD[method_count];
        memcpy(m_OldVT, ppdwClassBase, sizeof(DWORD) * method_count);

        m_NewVT = new DWORD[method_count];
        memcpy(m_NewVT, ppdwClassBase, sizeof(DWORD) * method_count);
    }

    void HookVTBL(DWORD dwNewFunc, size_t iIndex)
    {
        m_NewVT[iIndex] = dwNewFunc;
        this->AddToArray(iIndex);
    }

    template<typename Fn>
    Fn GetOriginalFunction(size_t methodIndex)
    {
        return reinterpret_cast<Fn>(m_OldVT[methodIndex]);
    }

    void UnHook()
    {
        for (int i = 0; i < this->patchcount; i++)
        {
            DWORD dwAddress = (DWORD)this->m_ClassBase + (sizeof(DWORD) * vtblindexes[i]);
            *(DWORD*)dwAddress = this->m_OldVT[vtblindexes[i]];
        }
    }

    void Hook()
    {
        for (int i = 0; i < this->patchcount; i++)
        {
            DWORD dwAddress = (DWORD)this->m_ClassBase + (sizeof(DWORD) * vtblindexes[i]);
            *(DWORD*)dwAddress = this->m_NewVT[vtblindexes[i]];
        }
    }

protected:

    int patchcount = 0;
    int vtblindexes[100];
    void AddToArray(int iIndex)
    {
        vtblindexes[patchcount] = iIndex;
        patchcount += 1;
    }

private:  

    PDWORD*    m_ClassBase;
    PDWORD m_NewVT, m_OldVT;

    size_t method_count = 0;
};

Declare

Code:

VMT* ILTCSBase;

using End3DFn = unsigned int(__cdecl*)(unsigned int);
using FlipScreenFn = unsigned int(__cdecl*)(unsigned int);
using IntersectSegment = bool(__cdecl*)(CIntersectQuery& rQuery, CIntersectInfo *rInfo);

Class

Code:

class ILTCSBase : public ICLTClient
{
public:
    ICLTClient*, GetICLTClient
public:
    static ILTCSBase* Instance()
    {
        return (ILTCSBase*)0x11B3890;
    }
};

Hook

Code:

ILTCSBase = new VMT((DWORD**)ILTCSBase::Instance());

ILTCSBase->HookVTBL((DWORD)MyRemoteKill, 31);
ILTCSBase->HookVTBL((DWORD)MyFlipScreen, 45); 
ILTCSBase->HookVTBL((DWORD)MyEnd3D, 56);

ILTCSBase->Hook();

CFPH vTable address ILTCSBase

vTable[0]: 0x72D094
vTable[1]: 0x69FD80
vTable[2]: 0x69C540
vTable[3]: 0x69C520
vTable[4]: 0x69C4F0
vTable[5]: 0x69C4D0
vTable[6]: 0x69C4B0
vTable[7]: 0x69C490
vTable[8]: 0x69C560
vTable[9]: 0x667EE0
vTable[10]: 0x69E360
vTable[11]: 0x69E390
vTable[12]: 0x6A3720
vTable[13]: 0x69C450
vTable[14]: 0x69C410
vTable[15]: 0x6A2730
vTable[16]: 0x69E300
vTable[17]: 0x69E2E0
vTable[18]: 0x69E0A0
vTable[19]: 0x69E2B0
vTable[20]: 0x69E280
vTable[21]: 0x69E260
vTable[22]: 0x69E1A0
vTable[23]: 0x69E150
vTable[24]: 0x69E060
vTable[25]: 0x69E020
vTable[26]: 0x6A0830
vTable[27]: 0x6A35D0
vTable[28]: 0x6A34D0
vTable[29]: 0x69C3E0
vTable[30]: 0x69F820
vTable[31]: 0x69B760
vTable[32]: 0x69B730
vTable[33]: 0x69DF40
vTable[34]: 0x69DEF0
vTable[35]: 0x6A3320
vTable[36]: 0x69F2B0
vTable[37]: 0x6A22F0
vTable[38]: 0x69C600
vTable[39]: 0x6A5750
vTable[40]: 0x69C5A0
vTable[41]: 0x6A4C90
vTable[42]: 0x69C580
vTable[43]: 0x69F980
vTable[44]: 0x69E3C0
vTable[45]: 0x605E00
vTable[46]: 0x603F90
vTable[47]: 0x603E90
vTable[48]: 0x6075F0
vTable[49]: 0x604010
vTable[50]: 0x607480
vTable[51]: 0x603D90
vTable[52]: 0x603CD0
vTable[53]: 0x603BC0
vTable[54]: 0x603B00
vTable[56]: 0x605D20
vTable[58]: 0x603A40
vTable[59]: 0x66E9F0
vTable[60]: 0x66E9C0
vTable[61]: 0x66E5F0
vTable[62]: 0x66DED0
vTable[63]: 0x66EA70
vTable[64]: 0x66EA20
vTable[65]: 0x617DE0
vTable[66]: 0x618060
vTable[67]: 0x617D80
vTable[68]: 0x617D20
vTable[69]: 0x6A07C0
vTable[70]: 0x6A0730
vTable[71]: 0x69DED0
vTable[72]: 0x602C80
vTable[73]: 0x602C70
vTable[74]: 0x603580
vTable[75]: 0x603550
vTable[76]: 0x604DB0
vTable[77]: 0x604CC0
vTable[78]: 0x604C20
vTable[79]: 0x602C50
vTable[80]: 0x604990
vTable[81]: 0x607360
vTable[82]: 0x602C20
vTable[83]: 0x618BB0
vTable[84]: 0x603910
vTable[85]: 0x6048A0
vTable[86]: 0x602C00
vTable[87]: 0x602BE0
vTable[88]: 0x604770
vTable[89]: 0x604630
vTable[90]: 0x617FC0
vTable[91]: 0x618CA0
vTable[92]: 0x602B90
vTable[93]: 0x606290
vTable[94]: 0x606130
vTable[95]: 0x6061D0
vTable[96]: 0x6060C0
vTable[97]: 0x606030
vTable[98]: 0x6072F0
vTable[99]: 0x607260
vTable[100]: 0x6071F0
vTable[101]: 0x605FC0
vTable[102]: 0x605F30
vTable[103]: 0x605E70
vTable[104]: 0x607170
vTable[105]: 0x6070C0
vTable[106]: 0x604400
vTable[107]: 0x6043A0
vTable[108]: 0x604310
vTable[109]: 0x667E40
vTable[110]: 0x667E20
vTable[111]: 0x69C3C0
vTable[112]: 0x6A4AE0
vTable[113]: 0x69C390
vTable[114]: 0x69C360
vTable[115]: 0x69C320
vTable[116]: 0x69C2C0
vTable[117]: 0x69C260
vTable[118]: 0x69C200
vTable[119]: 0x69C1B0
vTable[120]: 0x69C180
vTable[121]: 0x69C150
vTable[122]: 0x69C100
vTable[123]: 0x69C0C0
vTable[124]: 0x69C070
vTable[125]: 0x69C060
vTable[126]: 0x69C050
vTable[127]: 0x69C040
vTable[128]: 0x69C030
vTable[129]: 0x69C020
vTable[130]: 0x69BFF0
vTable[131]: 0x69BFC0
vTable[132]: 0x672AE0
vTable[133]: 0x69BFA0
vTable[134]: 0x69BF80
vTable[135]: 0x6A34B0
vTable[136]: 0x69DEA0
vTable[137]: 0x69BF40
vTable[138]: 0x69BDF0
vTable[139]: 0x69DD30
vTable[140]: 0x6A4DB0
vTable[141]: 0x69F800
vTable[142]: 0x6A23B0
vTable[143]: 0x6A4CB0
vTable[144]: 0x6A5670
vTable[145]: 0x69BD50
vTable[146]: 0x69BC80
vTable[147]: 0x69BC60
vTable[148]: 0x69BC40
vTable[149]: 0x6A03E0
vTable[150]: 0x69BBF0
vTable[151]: 0x69BB00
vTable[152]: 0x69BA70
vTable[153]: 0x69BA00
vTable[154]: 0x69B9A0
vTable[155]: 0x69B940
vTable[156]: 0x6A3F10
vTable[157]: 0x69F7A0
vTable[158]: 0x69B8F0
vTable[159]: 0x69F760
vTable[160]: 0x6A3930
vTable[161]: 0x6A3440
vTable[162]: 0x6A0370
vTable[163]: 0x65F970
vTable[164]: 0x65FA70
vTable[165]: 0x65FB80
vTable[166]: 0x65FAA0
vTable[167]: 0x65F9F0
vTable[168]: 0x6A4010
vTable[169]: 0x6A0300
vTable[170]: 0x69B8C0
vTable[171]: 0x69B890
vTable[172]: 0x69B870
vTable[173]: 0x69B850
vTable[174]: 0x6A24A0
vTable[175]: 0x6A3E50
vTable[176]: 0x6A37D0
vTable[177]: 0x6A01F0
vTable[178]: 0x6A0140
vTable[179]: 0x6A0090
vTable[180]: 0x6A0020
vTable[181]: 0x6A4A70
vTable[182]: 0x69DBE0
vTable[183]: 0x6A2440
vTable[184]: 0x69FDE0
vTable[185]: 0x69B7A0
vTable[186]: 0x69B780
vTable[187]: 0x6A4A20
vTable[188]: 0x69F710
vTable[189]: 0x6A4970
vTable[190]: 0x6A4850
vTable[191]: 0x6C22F0
vTable[192]: 0x6C21B0
vTable[193]: 0x69B700
vTable[194]: 0x69DD10
vTable[195]: 0x69DCB0
vTable[196]: 0x69B820
vTable[197]: 0x6A33E0
vTable[198]: 0x69DC60
vTable[199]: 0x69B7F0
vTable[200]: 0x69DC00
vTable[201]: 0x69FE40
vTable[202]: 0x69B7C0
vTable[203]: 0x604200
vTable[204]: 0x6033D0
vTable[205]: 0x6033B0
vTable[206]: 0x602B80
vTable[207]: 0x603320
vTable[209]: 0x607A40
vTable[210]: 0x603300
vTable[211]: 0x6032E0
vTable[212]: 0x6032B0
vTable[213]: 0x603290
....

Function

Code:

bool MyRemoteKill(CIntersectQuery *iQuery, CIntersectInfo *qInfo)
{
    // do your job
    return ILTCSBase->GetOriginalFunction<IntersectSegment>(31)(*iQuery, qInfo);
}

unsigned int __cdecl MyFlipScreen(unsigned int flags)
{
    // draw your stuff
    return ILTCSBase->GetOriginalFunction<FlipScreenFn>(45)(flags);
}

unsigned int __cdecl MyEnd3D(unsigned int flags)
{
    // draw your stuff
    return ILTCSBase->GetOriginalFunction<End3DFn>(56)(flags);
}

END

HIT THANKS

Originally Posted by uNdExEd_CheAtEr

ok, 2 things

i think you got it wrong, at the SDK you can clearly see

Code:

class ILTClient : public ILTCSBase

when you're actually doing

Code:

class ILTCSBase : public ICLTClient

and those functions:

Code:

 LTRESULT (*FlipScreen)(uint32 flags);
bool (*IntersectSegment)(ClientIntersectQuery *pQuery, ClientIntersectInfo *pInfo);
	bool (*IntersectSweptSphere)(const LTVector& vStart, const LTVector& vEnd, float fRadius, LTVector& vFinalPos, LTVector& vNormal);

etc..

are not virtuals but class members functions.

ok secondly, you're harcoding the indexes

Code:

int vtblindexes[100];

where you can grab them using a simple loop with VirtualQuery.

anyway, i just wanna say that's not a virtual hook but you're actually just changing the ptr to your function.

virtuals functions are inside CLTClient, for example

Code:

   virtual LTRESULT SetObjectPos(HLOCALOBJ hObj, const LTVector *pPos, bool bForce=true) = 0;

straight from the sdk..

thanks for the info

- - - Updated - - -

ILTCSBase::Instance()->GetICLTClient. vtable..

FlipScreen End3D is in Iltcsbase
and SetObjectPos GetObjectPos GetBoxMax GetBoxMin is in cltclient

- - - Updated - - -

*this->m_ClassBase = m_NewVT <- result send error report

CLTClient Hooks

Post a Reply

Similar Threads

Tags for this Thread