AlliedModders - [INFO] Hooking without extension

Introduction

I think many people think that it is impossible to create a hook from a plugin without extension but in fact this is not the case and in this topic I will show you how to hook a normal function without using extension

Notes

This method is simply as information and is not as an alternative
It is very difficult to make such a hook and you need to understand ASM very well
If the hook will crash it is very difficult to understand what exactly is causing the crash which is also a minus
This topic uses Source Scramble but this hook can also be done without it
There is also a great replacement for Source Scramble that will save you from the first stage

Stages

You need to get the base addresses of server.dll and sourcemod.logic.dll
Get the plugin's callback address
Create a hook
Create an original function (optional)

Getting base addresses

There is already a topic on the forum about how to get a PEB so we will skip this part.
PEB stores modules in a ladder order, so we need to go through all the steps to find the necessary modules.

This is C++ code and we need to do the same via sourcemod.

Spoiler

And we should get something like this (This is just an example and you can rewrite it as you want).

Spoiler

Now we need to get the module name and its address but the problem is that the module names are stored in Unicode format so I created a function that allows reading Unicode but it's not perfect

Spoiler

It remains to add StrEqual and save the found modules so we go to the next stage

Getting callback address

Now We need to create a callback through which you can get another callback that will already be set to Hook
You can use any sourcemod function to do this
I chose SortFloats

The offset of this function is 33C0

Spoiler

To pass an argument to callback you need to write sending the argument and calling the function manually using ASM
I have already written a ready made ASM that should work on any sourcemod function

Code:

 8B 44 24 08 56 57 8B 7C 24 0C 8B CF FF 70 08 8B 17 FF 92 88 00 00 00 8B F0 57 8B CE 8B 16 FF 12 8B 16 8D 44 24 0C 50 8B CE FF 52 20 5F 33 C0 5E C3

Which is the same as function below
The second argument of this function will take the index of callback which will be passed via the plugin

PHP Code:


		
			
cell_t context (IPluginContext *pContext, const cell_t *params)
{
    cell_t result;

    pFunc->PushCell((cell_t)pContext);
    pFunc->Execute(&result);

    return 0;
}

It's time to start getting callback

Spoiler

PHP Code:


		
			
void CreateCallback()
{
    static const int g_iContext[] = { 0x8B, 0x44, 0x24, 0x08, 0x56, 0x57, 0x8B, 0x7C, 0x24, 0x0C, 0x8B, 0xCF, 0xFF, 0x70, 0x08, 0x8B, 0x17, 0xFF, 0x92, 0x88, 0x00, 0x00, 0x00, 0x8B, 0xF0, 0x57, 0x8B, 0xCE, 0x8B, 0x16, 0xFF, 0x12, 0x8B, 0x16, 0x8D, 0x44, 0x24, 0x0C, 0x50, 0x8B, 0xCE, 0xFF, 0x52, 0x20, 0x5F, 0x33, 0xC0, 0x5E, 0xC3 };
    
    Address pSMBase = ADDRESS(LoadFromAddress(g_pSourcemod + ADDRESS(8), NumberType_Int32)); /* Getting sourcemod base address */
    Address pFunc = pSMBase + ADDRESS(0x33C0); /* adding base address to offset of SortFloat function */
    
    int iSaved[sizeof g_iContext]; /* Creating array to save original bytes */
    
    for (int i; i < sizeof g_iContext; i++)
    {
        /* Loading original byte and replacing it */
        
        iSaved[i] = LoadFromAddress(pFunc + ADDRESS(i), NumberType_Int8); 
        StoreToAddress(pFunc + ADDRESS(i), g_iContext[i], NumberType_Int8);        
    }
    
    /* Call a patched function that calls CreateHandleCallback in which we get a callback */
    
    float floats[1];
    SortFloats (floats, INT(CreateHandleCallback), Sort_Random); 
    
    /* Restore original bytes of SortFloats function*/
    
    for (int i; i < sizeof g_iContext; i++) 
        StoreToAddress(pFunc + ADDRESS(i), iSaved[i], NumberType_Int8);
}

void CreateHandleCallback (Address IPluginContext)
{
    /* Here we got the context of our plugin as an argument */
    /* Now You need to create an SDKCall using a context */
    
    StartPrepSDKCall(SDKCall_Raw);
    
    /* 136 is offset to GetFunctionById which is located in virtual method table */
    /* https://www.sourcemod.net/sp-dox/class_source_pawn_1_1_i_plugin_context.html */
    
    PrepSDKCall_SetAddress(ADDRESS(LoadFromAddress(ADDRESS(LoadFromAddress(IPluginContext, NumberType_Int32)) + ADDRESS(136), NumberType_Int32)));
    
    PrepSDKCall_AddParameter(SDKType_PlainOldData, SDKPass_Plain);
    PrepSDKCall_SetReturnInfo(SDKType_PlainOldData, SDKPass_Plain);
    Handle hCall = EndPrepSDKCall();
    
    /* Call our SDK and return OUR callback */
    g_pCallback = ADDRESS(SDKCall(hCall, IPluginContext, INT(UTIL_SetModel))); 
    
    delete hCall;
}

I'll add that I'm using the UTIL_SetModel function as an example

Creating hook

Now the callback has already been found it remains to create a Hook
Our hook is that the UTIL_SetModel function will create a call to our plugin's function and pass parameters to it

Spoiler

Creating SDK which call original code (optional)

As you can see our hook works but the original code is not called which means the UTIL_SetModel function just outputs a message so you need to create an SDK that will call the original code
In General there are two ways to solve this problem the first is to create the SDK and the second is to rewrite the meaning of the original function in our hook

I will follow the path of creating the SDK
Creating an original code call via the SDK is not universal and is not suitable for every function

The best way for me is to create a jump through a relative address

Spoiler

Code

PHP Code:


		
			
void CreateHook()
{
    static const int iCall[] = { 0x55, 0x8B, 0xEC, 0x51, 0x56, 0xFF, 0x75, 0x08, 0xBE, 0x2A, 0x2A, 0x2A, 0x2A, 0x8B, 0xCE, 0x8B, 0x06, 0xFF, 0x10, 0x8B, 0x06, 0x8B, 0xCE, 0xFF, 0x75, 0x0C, 0xFF, 0x10, 0x8B, 0x06, 0x8D, 0x55, 0xFC, 0x52, 0x8B, 0xCE, 0xFF, 0x50, 0x20, 0x8B, 0x45, 0xFC, 0x5E, 0x8B, 0xE5, 0x5D, 0xC3 };
    static const int size = 9;
    
    int[] bytes = new int[size];
    
    MemoryBlock pMemory = new MemoryBlock (sizeof iCall + 4 + size); /* size of OUR patch + JMP + size of original bytes */
    Address pAddr = pMemory.Address;
    
    Address pServerBase = ADDRESS(LoadFromAddress(g_pServer + ADDRESS(8), NumberType_Int32)); /* Getting server base address */
    Address pFunc = pServerBase + ADDRESS(0x207490); /* adding base address to offset of UTIL_SetModel function */
    
    /* just nopping all the place where OUR jump will be located */
    
    for (int i; i < size; i++)
    {
        bytes[i] = LoadFromAddress(pFunc + ADDRESS(i), NumberType_Int8);
        StoreToAddress(pFunc + ADDRESS(i), 0x90, NumberType_Int8);
    }
    
    /* Creating a function that will call our callback */
    
    for (int i; i < sizeof iCall; i++)
        StoreToAddress(pAddr + ADDRESS(i), iCall[i], NumberType_Int8);
    
    /* Calculate relative addres for OUR jump */
    Address relative = (pAddr - pFunc) - ADDRESS(5);

    /* Inserting the jump that jumps from UTIL_SetModel into the function that will call OUR callback */
    StoreToAddress(pFunc, 0xE9, NumberType_Int8);
    StoreToAddress(pFunc + ADDRESS(1), INT(relative), NumberType_Int32);
    
    /* Calculate relative addres for OUR jump */
    relative = (pFunc - pAddr) - ADDRESS(sizeof iCall + size);
    
    /* Inserting the jump that jumps from the function that will call OUR callback into (UTIL_SetModel + 8) */
    for (int i; i < size; i++)
        StoreToAddress(pAddr + ADDRESS(sizeof iCall + i), bytes[i], NumberType_Int8);
    
    StoreToAddress(pAddr + ADDRESS(sizeof iCall + size), 0xE9, NumberType_Int8);
    StoreToAddress(pAddr + ADDRESS(sizeof iCall + size + 1), INT(relative), NumberType_Int32);
    
    /* Insert OUR callback */
    StoreToAddress(pAddr + ADDRESS(9), INT(g_pCallback), NumberType_Int32);
    
    /* Creating OUR SDK which will call original code */
    StartPrepSDKCall(SDKCall_Static);
    PrepSDKCall_SetAddress(pAddr + ADDRESS(sizeof iCall));
    PrepSDKCall_AddParameter(SDKType_PlainOldData, SDKPass_Plain);
    PrepSDKCall_AddParameter(SDKType_String, SDKPass_Pointer);
    g_hOriginal = EndPrepSDKCall();
}

Result

Ending...

I repeat that this is not an alternative
All this can be done without Source Scramble but without it you will have to use gamedata and search for dummy/unused functions/memory

Just some test