[Release] Engine LTC / Alt. LTC!

Mr.Magicman · 2010-10-31T12:22:15.000Z

[quote=anaestheist;3042223]You forgot something, i don't care.[/quote] Why replying if you dont care?

Originally Posted by anaestheist

You forgot something, i don't care.

Why replying if you dont care?

Originally Posted by Mr.Magicman

Why replying if you dont care?

successfully anally raped by Mr.Magicman

/yea

Originally Posted by SNal2F

Fuckin obvioulsy how would i have gotten that without knowing the jmp to the real .......

real +208

Code:

0046FA40   A1 3C001037      MOV EAX,DWORD PTR DS:[3710003C]
0046FA45   8B88 2C001037    MOV ECX,DWORD PTR DS:[EAX+3710002C]
0046FA4B   8B1424           MOV EDX,DWORD PTR SS:[ESP]
0046FA4E   05 00001037      ADD EAX,37100000
0046FA53   81C1 00001037    ADD ECX,37100000
0046FA59   3BD1             CMP EDX,ECX
0046FA5B   72 0E            JB SHORT Engine.0046FA6B
0046FA5D   8B40 50          MOV EAX,DWORD PTR DS:[EAX+50]
0046FA60   03C1             ADD EAX,ECX
0046FA62   3BD0             CMP EDX,EAX
0046FA64   73 05            JNB SHORT Engine.0046FA6B
0046FA66   E9 A5630100      JMP Engine.00485E10 //1st one
0046FA6B   C3               RETN

Code:

00485E10   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]//can see szcommand parameter moved and pushed below
00485E14   50               PUSH EAX
00485E15   68 F0038000      PUSH Engine.008003F0
00485E1A   E8 A1EDFFFF      CALL Engine.00484BC0 //sub function can do here (unsigned long, szCommand)
00485E1F   83C4 08          ADD ESP,8
00485E22   C3               RETN

O no wai another way to do ooooooo itttttt

Code:

00484BC0   8B4424 08        MOV EAX,DWORD PTR SS:[ESP+8]
00484BC4   8B4C24 04        MOV ECX,DWORD PTR SS:[ESP+4]
00484BC8   6A 00            PUSH 0
00484BCA   6A 00            PUSH 0
00484BCC   50               PUSH EAX
00484BCD   51               PUSH ECX
00484BCE   E8 2DF8FFFF      CALL Engine.00484400(unsigned long,szcommand,int,int) //can do here
00484BD3   83C4 10          ADD ESP,10
00484BD6   C3               RETN

Code:

00484AB0   8B4424 0C        MOV EAX,DWORD PTR SS:[ESP+C]
00484AB4   8B4C24 08        MOV ECX,DWORD PTR SS:[ESP+8]
00484AB8   8B5424 04        MOV EDX,DWORD PTR SS:[ESP+4]
00484ABC   6A 00            PUSH 0
00484ABE   50               PUSH EAX
00484ABF   51               PUSH ECX
00484AC0   52               PUSH EDX
00484AC1   E8 3AF9FFFF      CALL Engine.00484400
00484AC6   83C4 10          ADD ESP,10
00484AC9   C3               RETN

pfffffffff stupid shit bro. also all of thos are faster since they are all wrapped anyways ...many more ways to do it.

what do you mean by real+208?
and how did you get 0046FA40 to begin with?
i want to try to find it myself next time.

real 208 is

IltClient + 0x208, its a table of pointers and at index 0x208 is where it calls it in the engine @ 0046FA40.

Notice that you use that offset to push things to the console in gellins method.

Originally Posted by Mr.Magicman

Notice that you use that offset to push things to the console in gellins method.

what are you talking about when you call Iltclient + 0x208 it is caling the 0046FA40.......

also everything i posted i dont use i hook the function on the table and fix it.Then call the fixed function , hooked function. /

Originally Posted by anaestheist

You forgot something, i don't care.

Please kid, I really don't give a shit by ANYTHING you say.

You going areound like you are a pro coder.

Code off?

Me vs. You

I will win.

Originally Posted by Stephen

Please kid, I really don't give a shit by ANYTHING you say.

You going areound like you are a pro coder.

Code off?

Me vs. You

I will win.

K you two code me up a sammich biches.

Then we'll see who is better.

Originally Posted by SNal2F

Fuckin obvioulsy how would i have gotten that without knowing the jmp to the real .......

real +208

Code:

0046FA40   A1 3C001037      MOV EAX,DWORD PTR DS:[3710003C]
0046FA45   8B88 2C001037    MOV ECX,DWORD PTR DS:[EAX+3710002C]
0046FA4B   8B1424           MOV EDX,DWORD PTR SS:[ESP]
0046FA4E   05 00001037      ADD EAX,37100000
0046FA53   81C1 00001037    ADD ECX,37100000
0046FA59   3BD1             CMP EDX,ECX
0046FA5B   72 0E            JB SHORT Engine.0046FA6B
0046FA5D   8B40 50          MOV EAX,DWORD PTR DS:[EAX+50]
0046FA60   03C1             ADD EAX,ECX
0046FA62   3BD0             CMP EDX,EAX
0046FA64   73 05            JNB SHORT Engine.0046FA6B
0046FA66   E9 A5630100      JMP Engine.00485E10 //1st one
0046FA6B   C3               RETN

Code:

00485E10   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]//can see szcommand parameter moved and pushed below
00485E14   50               PUSH EAX
00485E15   68 F0038000      PUSH Engine.008003F0
00485E1A   E8 A1EDFFFF      CALL Engine.00484BC0 //sub function can do here (unsigned long, szCommand)
00485E1F   83C4 08          ADD ESP,8
00485E22   C3               RETN

O no wai another way to do ooooooo itttttt

Code:

00484BC0   8B4424 08        MOV EAX,DWORD PTR SS:[ESP+8]
00484BC4   8B4C24 04        MOV ECX,DWORD PTR SS:[ESP+4]
00484BC8   6A 00            PUSH 0
00484BCA   6A 00            PUSH 0
00484BCC   50               PUSH EAX
00484BCD   51               PUSH ECX
00484BCE   E8 2DF8FFFF      CALL Engine.00484400(unsigned long,szcommand,int,int) //can do here
00484BD3   83C4 10          ADD ESP,10
00484BD6   C3               RETN

Code:

00484AB0   8B4424 0C        MOV EAX,DWORD PTR SS:[ESP+C]
00484AB4   8B4C24 08        MOV ECX,DWORD PTR SS:[ESP+8]
00484AB8   8B5424 04        MOV EDX,DWORD PTR SS:[ESP+4]
00484ABC   6A 00            PUSH 0
00484ABE   50               PUSH EAX
00484ABF   51               PUSH ECX
00484AC0   52               PUSH EDX
00484AC1   E8 3AF9FFFF      CALL Engine.00484400
00484AC6   83C4 10          ADD ESP,10
00484AC9   C3               RETN

pfffffffff stupid shit bro. also all of thos are faster since they are all wrapped anyways ...many more ways to do it.

Any of these work to pushtoconsole?

I tryed a few diffrent ways and trying to convert your C++ to delphi and failed, also trying to mimic the assembly to Delphi but no success so far

Example that I failed with

Code:

00485E10   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]//can see szcommand parameter moved and pushed below
00485E14   50               PUSH EAX
00485E15   68 F0038000      PUSH Engine.008003F0
00485E1A   E8 A1EDFFFF      CALL Engine.00484BC0 //sub function can do here (unsigned long, szCommand)
00485E1F   83C4 08          ADD ESP,8
00485E22   C3               RETN

Tryed with Delphi

Code:

function PushIt(command: PChar):boolean;cdecl;
begin
   asm
   Pushad               //Save all current registers to stack
    mov eax, command    //Move command to eax
    mov ecx, $00484BC0  //Move function address to ecx
    Push eax            //Push command to stack
    Push $008003F0      //Push Engine Address to stack
    call ecx           //Call ecx (our address)
    add esp, $00000008  //esp + 8
   Popad                //Replace all orginal Registers
   end;
   result := true;
end;

and your C++ example I tryed to convert..

Code:

type
  TRunConsoleCommand = function(cmd : pchar) : Integer; cdecl;
  PRunConsoleCommand = ^TRunConsoleCommand;

procedure RunConsoleCommand(Const command : String);
var
 RCC : PRunConsoleCommand;
begin
 New(RCC);     //Allocate Mem
 RCC:= pointer($00485E10);
 RCC^(Pchar(command));
 Dispose(RCC);  //Free Mem
end;

That one just shut down the game without warning

Code:

procedure RunConsoleCommand(Const command : String);
var
 RCC : TRunConsoleCommand;
begin
 RCC:= TRunConsoleCommand($00485E10);
 RCC(Pchar(command));
end;

Did nothing

SO i need someone who can help me create a PushToConsole Function Something undersatanable like Assembly or simple C++ as im not C++ programmers and C++ skills is limited, Also im new to game hacking and this forum so I need someone to give me details about PushToConsole and how it works..

Similar Threads

Tags for this Thread