Module: Okapi
2 Attachment(s)
Hello. I've spent the last weeks working a new module built around a new idea to avoid using signatures. I've also took the chance to add it features based on the experience with the making of orpheu. So this module should be more funnier to use but more powerful than orpheu. The new idea, is about to identify a function, in an easy manner, hopefully resistant to game updates. It consists on the following notions: Half-Life functions are an interconnected tree around a core of engine and dll functions. Each function has a great chance of being connected to the core functions, and for each connection, there is a minimal length path between the points. The idea is to identify a function, based on a group of minimal path length between that function and the core functions. The tree is built with simple parsing of the assembly call instructions (for example, indirect calls are not parsed) in the libraries, but the results are solid, from my testing. Trees vary a great deal between mod's and operative systems but for the main purpose of providing a way of identifying a function in a manner resistant to game updates, they seem quite ok. So let's see an example. Remember that the purpose of this kind of identifier is to resist to game updates, so I will use and old version of half life dedicated server, against the latest version. This is to see if identifiers for one of them, find the same function on the other and vice-versa. I don't know if there is a legal way of testing this for an old cs server, but if you know I would like you to tell me. I had to pick a name for this identifier and I chose "treemap". From now on I will use this name to refer to them. hlds versions used: Code:
Protocol version 46, Exe version 4.1.1.1, Exe build: 10:25:33 Apr 30 2003 (2379) This is a function present in the engine library of the old HLDS server: http://oi59.tinypic.com/2vci89f.jpg Below, it has this portion that will make easy to identify it, in the other HLDS, to verify that we are dealing with the same function. http://oi58.tinypic.com/in63o4.jpg The first step now is to get it's treemap. This is done executing in the console the command: Code:
okapi desc 0x550F0 This part: Code:
Map values {4,4,4,4,4,5,5,4,4,5,6,4,6,6,4,4,4,4,4,5,4,0,4,2,4,6,5,5,5,3,4,5,5,5,5,5,4,3,5,4,0,4,5,5,5,6,3,3,3,3,3,3,3,3,3,3,0,6,5,5,5,3,4,5,0,4,0,6,0,0,0,3,4,0,4,0,0,4,4,4,4,4,5,4,4,4,4,4,0,4,4,4,4,5,4,4,4,4,6,5,0,4,4,4,4,0,4,6,3,5,5,5,4,0,4,5,5,0,5,4,4,4,4,4,4,4,0,5,5,5,0,4,4,0,0,0,0,5,4,4,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0} This: Code:
"jp='.BU*&.B8u{.N#,#.Q'Z$.z=F'.uYU{.#dJ$. 2I$.T\F'.-)V{.Mp/$.RXS{.00}&.;WU{.!eu{.u~V{.UP_(.c:B.+5 &. 8u{.7,V{.*+w&.j+w&...&~3" This string is what I refer to as "treemap". Now, we will use try to use it as identifier to search it in the new hlds. Code:
okapi search "jp='.BU*&.B8u{.N#,#.Q'Z$.z=F'.uYU{.#dJ$. 2I$.T\F'.-)V{.Mp/$.RXS{.00}&.;WU{.!eu{.u~V{.UP_(.c:B.+5 &. 8u{.7,V{.*+w&.j+w&...&~3" In this image we can see a order list of the function that best match the given treemap. The wanted case is that the first one is the same function in this hlds version as 0x550F0 is in the old one. We can verify that it is the case in IDA: http://oi60.tinypic.com/29qocv5.jpg Now we can do the inverse: http://oi61.tinypic.com/aayele.jpg Now I will exemplify the use of a treemap in CS, with the InstallGameRules functions. This would be the code to use the treemap, and create and hook the function. PHP Code:
it just takes that time when the server is put on. I will extend the talk about treemaps on a later ocasion. Now, to show more of the module, I will continue from the previous code to show how to generically hook virtual functions. PHP Code:
The module supports also searching for signatures with the functions PHP Code:
The signatures should look like this: Code:
{0x51,0x56,"𐌻","𐌻",0x8B,0x86} You can hook any function that uses a combination of these types: PHP Code:
The only exceptions is that when the function return a Vector. That is because when the function returns a Vector, a pointer is passed in the beginning of the stack, so to handle that situation I would have to make a messy code so I prefered to ignore it. Still, if you really need to hook or use a function that returns a Vector, it can be made with some lines of code using some tricks. use "int" for long or for any value that you want to ignore. Other thing present in the module are natives to handle memory directly. You can use them to change any value in memory and for example to use structures not exposed via an API like playermove_s. Example of replacing a string that was painful to do with orpheu, now takes one line: PHP Code:
PHP Code:
Notes: I tested the module alone since I wanted to make it a surprise so I expect it to need some enhancements or have some bugs. When you use signatures to use functions, after you attach the module to a function, it modifies the bytes of the functions. That means that if you use the same signature twice, the second will fail. This means that if you use the same signature in two plugins, it will fail in one. To avoid this you can as an example, just to signature search in plugin_precache and hooking in plugin_init. Again, I invite you to check the include files, I'm sure you will find there information that you will put to good use. Also check the server console commands available, within the command okapi. :twisted: |
Re: Module: Okapi
God, this name sucks. So weird I was hesitating to continue to read. :twisted:
The idea is interesting, but I'm rather skeptical on the reliability, as I remember depending binaries version, calls order are not always the same ; though this should be ok for most of things (probably!). I'm not sure to like having a plugin more verbose, hardcoded and less readable. Also, even if dealing with config files is a pain, you can easily share them and build references index ; losing this might not a good point. I think it would be worth to add a parser for those whom want to use a config file ; something where we could use specify an alias for a treemap for example. Same for virtual functions offsets ; that's really not something which should be hardcoded. Another thing, in your example with InstallGameRules, you're using "_Z16InstallGameRulesv", but that's not going to work for older binaries. So either you need to check x symbols name, or you need to use a treemap like you do ; but for the latter is it going to work properly for windows/linux/osx ? Oh, where is the OSX support ? :twisted: Except that, I guess it could be useful ; I like the idea to have something more 'universal' but I hate it will be stucked like Orpheu to some structures. Well, I guess there is Rage for that. It's promising, and I would wish you improve usability in a more friendly way to have plugin more easy to maintain and more readable. Well, good job, anyway, eheh. :) |
Re: Module: Okapi
Just, amazing.
I think that we would need to see some examples of many natives (I've read them :mrgreen:) with some kind of explanations, I'm just impressed :D |
Re: Module: Okapi
Hi, can you write a tutorial how to patch value in mod dll using this module?
Ok i try to patch max roundtime: PHP Code:
Server/client details
|
Re: Module: Okapi
Quote:
PHP Code:
You would do PHP Code:
PHP Code:
After you patch the value by using a signature, remember that after map restart, the signature will be searched again, but now will not be found in the same memory location since it was altered. So be sure to check if the result from okapi_mod_find sig is not null, and be sure to confirm that your signature is unique. |
Re: Module: Okapi
Another userfriendly module.
|
Re: Module: Okapi
Doesn't this work in listen server?
Quote:
|
Re: Module: Okapi
You mf, I like it. :twisted:
|
Re: Module: Okapi
nice module; too bad i can use it or undrestand it.
|
Re: Module: Okapi
Quote:
Quote:
Quote:
|
All times are GMT -4. The time now is 07:36. |
Powered by vBulletin®
Copyright ©2000 - 2024, vBulletin Solutions, Inc.