Thread: [Solved] [CS:GO] CBaseAnimating
View Single Post
hmmmmm
Great Tester of Whatever
Join Date: Mar 2017
Location: ...
Old 07-13-2018 , 04:14   Re: [CS:GO] CBaseAnimating
Reply With Quote #2

I'll go through this one and try to explain how I did it, but only because it isn't as straightforward as most functions are with strings where you can directly search for inside the function. One thing that you need to understand however is that there isn't just "a way" to find the functions you're looking for. Think of it as a puzzle where all the function names are gone and you need to use your head to find out where the function you're looking for is. More often than not this is done with strings since they are the easiest to find, but it can also be done in other ways, for example using references to globals or using the vtable.

The easiest way to do this in CS:GO is to find an old binary that has symbols so you can easily find the function. You can find CS:GO binaries with symbols here: https://users.alliedmods.net/~asherk.../csgo_symbols/

In this example I'll use server.so to find the functions, then use the info I get from there to find them in an up-to-date server.dll where I'll get the signature.

So to start you open the server.so file with symbols and then click File->New Instance to open the server.dll simultaneously in another window and wait for the autoanalysis to finish. We'll be working out of server.so from here on and only using server.dll in case we need to check things. Click View->Open Subviews->Names to open the Names window. Do the same to open the Strings window. To keep things clean you can close all windows except for IDA View, Names window and Strings window, they're (usually) all you need.

I'll also be using IDA Pro which has the pseudocode view, but that isn't a must. You can find all the strings and info you need in the assembly view but it might be a bit harder to navigate. To open the pseudocode view, go to the IDA view and press Tab. You can press it again to switch back.

Next, open the Names window and press Ctrl+F to do a search for the function you want. In this case I'll do a search for CBaseAnimating::GetAttachment. This specific function has about 5 different overloads, each with a different set of parameters. Looking at the thread you linked, Pelipoika seems to use the one that takes (char *, Vector &, QAngle &) so double click on that one to go into it. Should look something like this:



The first thing you should be looking for is strings so that you can identify the function, but clearly this function doesn't have any so we'll have to find another way to do this. To do this we'll find cross-references to the function and try to find something to go off of from there. Cross-references (or xrefs for short) are places where the function or variable or string are referenced. For example if function X was used in functions Y and Z, the xrefs for X would show me Y and Z. IDA lets you see the xrefs by pressing your 'X' key on a function, variable or string. Finding xrefs is one of the tools you'll use the most in IDA so try to remember it and understand it. Let's try to use it on the CBaseAnimating::GetAttachment function.



Open the first function and you'll find that there are lots of strings that we can use here. In fact CBaseAnimating::GetAttachment is called with a string "Muzzle".



To make sure this string is unique and can be used to easily find our function, press X on it to see the xrefs. You'll see it is only used twice and both times with the GetAttachment function, so this string should work fine. Let's switch over to server.dll and open the Strings window to do a quick search for "Muzzle".



Unfortunately our "Muzzle" doesn't show up. You might think that the top result "muzzle" is the same, but the casing matters and if you look at the xrefs you'll see it's used in a different function. We still have a lot of other xrefs to GetAttachment we can look at so let's look for others in server.so again. After skimming through the list I found that it's used in CBaseServerVehicle::GetPassengerExitPoint (second last function) with the string "vehicle_driver_exit" which has only 1 xref, so it's unique. Once again, switch over to server.dll and do a string search for "vehicle_driver_exit".



There's only 1 result, so double click on it to go to it. IDA will take you to the rdata section which looks like this:



To find where the string is used click on aVehicleDriverE and press X. There's only 1 xref, go to it.



This should look familiar, it's the same CBaseServerVehicle::GetPassengerExitPoint function from server.so but without symbols. For comparison this is what it looks like in server.so with symbols.



Clearly sub_101A50D0 is CBaseAnimating::GetAttachment. To make things clearer, press N on it to rename it. This will also let you find it easily in the future in case you need it again. Now all you have to do is use the makesig.idc script (replace dtyp with dtype in the script if it fails on IDA 7 for you).

This generates the signature:
\x56\x04\x85\xC0\x74\x2A\x8B\xCF\xE8\x2A\x2A\ x2A\x2A\x8B\x8F\x9C\x04\x00\x00\x85\xC9\x74\x 2A\x83\x39\x00\x74\x2A\x8B\x55\x08

A similar process can be used to find LookupAttachment, try to find it yourself. Hope this helps.

Last edited by hmmmmm; 07-13-2018 at 04:22.
hmmmmm is offline