Current PTC method

Current CA EU method of executing console commands:

ltc: 0x378E0B70
ConsoleFunction: [ltc+208]: 0x46fb90
Unwrapped(bare console):[ConsoleFunction[26]]: 0x485F60

Creds for this ptc method go to our brothers in arms at ****, nice and easy.

Creds for the ltc/unwrapped console go to me.

Code:

typedef int (__cdecl * RunConsoleCommand_T)(char* szCommand);
RunConsoleCommand_T RunConsoleCommand = (RunConsoleCommand_T) 0x485F60;

RunConsoleCommand("ShowFps 1");

ps: I'm not sure, but I think you can run the unwrapped console from everywhere in your code

EDIT:

You still have to call from within engine's threads (try hooking present, that works for me this way)

@HellSpider

I still have to try your method of bypassing the thread check. Maybe it works

Originally Posted by .::SCHiM::.

@HellSpider

I still have to try your method of bypassing the thread check. Maybe it works

Trust me, it does.

PM me if you need the pointer where the real thread ID is and where you need to move your thread ID to.

Originally Posted by HellSpider

Trust me, it does.

PM me if you need the pointer where the real thread ID is and where you need to move your thread ID to.

No need, no need

Code:

void CallConsoleWithBypass(char* Command){
	_asm{

mov eax, fs:[0x24] 
mov SaveCurrentThreadID, eax                   // save our threadID

mov eax, fs:[0x04]
mov eax, [eax-0x0C]
mov SaveCurrentThreadEntryPoint, eax           // save our entrypoint

mov eax, EngineThreadID                        // replace our threadID with that of engines.exe
mov fs:[0x24], eax

mov eax, EngineEntryPoint
mov ebx, fs:[0x04]
mov [ebx-0x0C], eax                            // replace our entrypoint with that of engine.exe 
	}


RunConsoleCommand(Command);

_asm{

mov eax, SaveCurrentThreadID                        // put everything back in place
mov fs:[0x24], eax

mov eax, SaveCurrentThreadEntryPoint
mov ebx, fs:[0x04]
mov [ebx-0x0C], eax     

}

	return;
}

Only one problem though, you still have to hook an engine function to find it's stack & threadid. I have function that searches all TEB's in a process, but then we still wouldn't know which TEB is the one we seek.

Originally Posted by .::SCHiM::.

No need, no need

Code:

void CallConsoleWithBypass(char* Command){
	_asm{

mov eax, fs:[0x24] 
mov SaveCurrentThreadID, eax                   // save our threadID

mov eax, fs:[0x04]
mov eax, [eax-0x0C]
mov SaveCurrentThreadEntryPoint, eax           // save our entrypoint

mov eax, EngineThreadID                        // replace our threadID with that of engines.exe
mov fs:[0x24], eax

mov eax, EngineEntryPoint
mov ebx, fs:[0x04]
mov [ebx-0x0C], eax                            // replace our entrypoint with that of engine.exe 
	}


RunConsoleCommand(Command);

_asm{

mov eax, SaveCurrentThreadID                        // put everything back in place
mov fs:[0x24], eax

mov eax, SaveCurrentThreadEntryPoint
mov ebx, fs:[0x04]
mov [ebx-0x0C], eax     

}

	return;
}

Well yeah, you did it a bit different than I expected, just be carefull with editing the TEB as it's supposed to be an information block. When you execute the command you will at that moment have two different threads with the same ID, that can cause abnormalities if something external tries to enumerate threads.

My way of doing this is changing the EP in stack permanently (as it doesn't change thread behavior in any way).

Then there is a global DWORD reserved where the Engine thread ID is stored upon startup. When I run a console cmd, I move my thread ID to that DWORD buffer and when the cmd has executed I move the real ID back to the buffer.

Code:

PushToConsole				PROC argCommand:DWORD

LOCAL ThreadPreserve:DWORD

;============ PRESERVE ACCEPTED THREAD ID ==============
mov edx,REAL_THREAD_ID
mov eax,dword ptr [edx]
mov ThreadPreserve,eax

;=========== MAKE CURRENT THREAD ACCEPTED ===========
mov eax,dword ptr fs:[24h]
mov dword ptr [edx],eax

;============== CHANGE CONSOLE CMD ================
mov eax,CONSOLE_ADDRESS
push argCommand
call eax
add esp,4

;============ RESTORE ACCEPTED THREAD ID ============
mov edx,REAL_THREAD_ID
mov eax,ThreadPreserve
mov dword ptr [edx],eax

ret

PushToConsole				ENDP

Current PTC method

Post a Reply

Tags for this Thread