Raised This Month: $51 Target: $400
 12% 

Dumping Virtual Offsets?


Post New Thread Reply   
 
Thread Tools Display Modes
Author Message
Spirrwell
Member
Join Date: Jul 2013
Old 11-10-2014 , 20:40   Dumping Virtual Offsets?
Reply With Quote #1

Alright, this mod I play, Pirates, Vikings, and Knights II, recently updated to Source SDK 2013 from Source 2007. I'm not very familiar at all with dumping offsets and whatnot. I did have some "success" with using IDA, however I could only get it to work with the server_i486.so, which unfortunately seems to be from back when it was still on the Source 2007 engine. I was unable to do this with the server.so that is from the current engine.

However, I did happen to have a Mac and had read that you can do the same thing with .dylib files. It seems to work, however I don't know exactly what I'm supposed to dump. It's quite confusing. Currently in game using the slay and burn commands causes the server to crash, so I figured that these are the two I should use to know that everything's working. These would be the CommitSuicide and Ignite functions.

Basically, I've dumped things over and over and have gotten different offsets, and when I input them some cause a server crash, some just don't work, and so on. I haven't gotten anything. I'm aware of the whole Windows typically = Linux\Max offset - 1. Sometimes these can also be the same before the class destructor.

I just don't get it. Where exactly in a server.dylib should I dump vtable offsets? I'm quite confused. If somebody has any information that could help me, it'd be much appreciated.
Spirrwell is offline
psychonic

BAFFLED
Join Date: May 2008
Old 11-10-2014 , 20:50   Re: Dumping Virtual Offsets?
Reply With Quote #2

SM needs more than just those updated for it, but since I still have it sitting here open from a few days ago,
CBasePlayer offsets
psychonic is offline
Spirrwell
Member
Join Date: Jul 2013
Old 11-10-2014 , 21:20   Re: Dumping Virtual Offsets?
Reply With Quote #3

I assume that by it needing more than just those updated you were referring to the gamedata like switching it to the sdk2013 engine? A guy over at the PVKII forums already did a git pull request on that already, so I have that updated.

Either way, that worked perfectly! Though I almost had it. I managed to dump the offsets that you had up to

323 CBaseCombatCharacter::NetworkStateChanged_m_i Ammo(void *)

Just so in the future I know how to do this, if I were to get the offsets higher than that, how would I do it?
Spirrwell is offline
WildCard65
Veteran Member
Join Date: Aug 2013
Location: Canada
Old 11-11-2014 , 08:53   Re: Dumping Virtual Offsets?
Reply With Quote #4

Quote:
Originally Posted by Spirrwell View Post
I assume that by it needing more than just those updated you were referring to the gamedata like switching it to the sdk2013 engine? A guy over at the PVKII forums already did a git pull request on that already, so I have that updated.

Either way, that worked perfectly! Though I almost had it. I managed to dump the offsets that you had up to

323 CBaseCombatCharacter::NetworkStateChanged_m_i Ammo(void *)

Just so in the future I know how to do this, if I were to get the offsets higher than that, how would I do it?
If you want to get a dump that looks exactly like psychonic's then you need to install idapython for your ida version(Tested and it does work with the eval version of IDA), if you using IDA 6.5 or up, you'll need the vtable_dump.py script in the master branch of github.com/alliedmodders/sourcemod otherwise the one in the 1.6-dev branch will work for versions of IDA < 6.5(haven't tested, only tested the one in the master branch against IDA demo 6.6, which does work.)
__________________
WildCard65 is offline
psychonic

BAFFLED
Join Date: May 2008
Old 11-11-2014 , 08:54   Re: Dumping Virtual Offsets?
Reply With Quote #5

Quote:
Originally Posted by Spirrwell View Post
I assume that by it needing more than just those updated you were referring to the gamedata like switching it to the sdk2013 engine? A guy over at the PVKII forums already did a git pull request on that already, so I have that updated.
As noted in my comment on that pull request, it is missing a ton of necessary changes.
psychonic is offline
Spirrwell
Member
Join Date: Jul 2013
Old 11-11-2014 , 11:35   Re: Dumping Virtual Offsets?
Reply With Quote #6

Quote:
Originally Posted by WildCard65 View Post
If you want to get a dump that looks exactly like psychonic's then you need to install idapython for your ida version(Tested and it does work with the eval version of IDA), if you using IDA 6.5 or up, you'll need the vtable_dump.py script in the master branch of github.com/alliedmodders/sourcemod otherwise the one in the 1.6-dev branch will work for versions of IDA < 6.5(haven't tested, only tested the one in the master branch against IDA demo 6.6, which does work.)
Oh, I had read of that but had also read about it not being compatible with IDA 5 which is what I was using. I'll try it out with the newer demo version.

Quote:
Originally Posted by psychonic View Post
As noted in my comment on that pull request, it is missing a ton of necessary changes.
Ah, I hadn't read your comment on it. I got the update he posted as soon as he did, it was all we had to get it in a working state. But I read it now. I had uploaded my server *.so files for him, and my only guess is that he had success with the server_i486.so, which seemed to be from when it was still on the 2007 engine. That one offset I guess was supposedly one that was broken from back then.

Anyway it definitely does seem that there's other things that need to be updated. The whole signature scanning is a bit beyond me at this point. But this has been really cool, this is my first attempt at anything related to disassembly. This has all been some useful information, thank you so much!
Spirrwell is offline
Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -4. The time now is 09:19.


Powered by vBulletin®
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Theme made by Freecode