[Scag]

Hi. I wrote an extension that exposes midfunc/inline hooks for SourceMod.

Sometimes, you have a function you want to hook. And sometimes, the logic you want to fiddle with is way far down under deep in there, and it would be really, really hard to work to get what you want with just a hook. Sometimes, you can recreate the function yourself, but that might not work if it's super big and complicated. Sometimes, you might be able to patch over it, but if you want to execute more logic, then that also might not work. In those some times, you may need to deploy a midfunc hook.

By hand, it isn't very fun, you have to patch in a jump that goes somewhere that contains your own assembly, and then that assembly jump back when you're done. That stinks even more if you need to execute some bonus code.

And thus, that's why I wrote this extension. Here's how it works.

How it works and a test case:

Spoiler

The problem:

For this test case scenario, I have picked a situation in TF2. When you have the Sydney Sleeper equipped (or any sniper rifle with the jarate_duration attribute), you add the jarate effect to players you hit while scoped. How do you detect when this happens?

You won't be able to use TFCond_Jarate with TF2_OnConditionAdded, because that also catches regular jarate. So the only way to actually figure this out is to either recreate the logic from CTFPlayer::OnTakeDamage_Alive or do a bunch of hook hierarchy shenanigans.

A better way would be to deploy a midhook where the jarate effect is added under CTFPlayer::OnTakeDamage_Alive.

The setup:

Setting up this hook will take a bit of elbow grease (as you are still dealing with assembly regardless). Fortunately, IDA has gifted us x86 decompilers so this becomes a bit easier.

Here is the decompiled code that issues the jarate TE effect and adds the jarate condition:


It would make the most sense to hook after the condition is added, but before that weird debug message further below it.

From within a midhook, we will have access to the memory around where the hook is, including the registers, the stack, frame pointer, etc. So, if we wanted to retrieve or change something in the CTakeDamageInfo parameter, we absolutely could. We just need to load it up from EBP +- its offset and then load up any member offsets from there.

Yes, this is slightly more advanced than you run-of-the-mill detour. Viewer discretion is advised.

The nitty gritty:

Let's say we want to get the m_vecDamagePosition of the damage instance. We could of course use the victim's m_vecOrigin but this is more fun.

We can deploy a midhook like mentioned before, but we need to get the address (and thus value of) CTakeDamageInfo::m_vecDamagePosition.

There are a few rules with deploying a midhook.

1. Midhooks are always 5 bytes in size
2. Do not ever emplace a midhook where it will run over a label address (putting it at the start of one is fine).
3. E8/E9 instructions that the midhook jmp overwrites are fixed up automagically, so there is no need to worry about those.

Right here (0xF73452) is a nice place to insert the midhook. Any leftover bytes beyond the 5 used in the jmp are replaced with NOPs.


We set up the address to hook with the "Addresses" section in a gamedata file.

While we're here let's quickly grab the offset of the CTakeDamageInfo parameter from EBP. IDA pseudocode graciously gives this to us by hovering over the variable:


Pawnography:

Creating a midhook is pretty straightforward. We get an address from somewhere and call new MidHook().

PHP Code:

MidHook g_Hook;
public void OnPluginStart()
{
    GameData conf = new GameData("tf2.sleeper");
    // Frankly, you don't need to cache the handle unless you plan on disabling the hook later at some point
    g_Hook = new MidHook(conf.GetAddress("CTFPlayer::OnTakeDamage_Alive_jarate"), OnSydneySleeperJarate);
    delete conf;
} 


In the OnSydneySleeperJarate callback, as mentioned before, you have a snapshot of all of the register values right where your midhook was deployed.

To get the CTakeDamageInfo parameter address, we use MidHookRegisters.Load(DHookRegister_EBP, 0xC).

To reach m_vecDamagePosition, we add 0xC to that pointer then load x, y, and z.

And our code will look like this:

PHP Code:

public void OnSydneySleeperJarate(MidHookRegisters regs)
{
    PrintToServer("Hello World!");

    Address pInfo = regs.Load(DHookRegister_EBP, 0xC);
    float vecPosition[3];
    vecPosition[0] = LoadFromAddress(pInfo + view_as< Address >(0xC), NumberType_Int32);
    vecPosition[1] = LoadFromAddress(pInfo + view_as< Address >(0x10), NumberType_Int32);
    vecPosition[2] = LoadFromAddress(pInfo + view_as< Address >(0x14), NumberType_Int32);

    PrintToServer("Took damage at %.2f %.2f %.2f", vecPosition[0], vecPosition[1], vecPosition[2]);

    // Make an explosion or something with vecPosition
} 


And it works! (Trust me).

SOURCE
RELEASES

[fdxx]

Server crashes after trying, what am I doing wrong?

PHP Code:

/*
"Games"
{
    "left4dead2"
    {
        "Addresses"
        {
            "CLunge::IsAbilityReadyToFire"
            {
                "linux"
                {
                    "signature"    "CLunge::IsAbilityReadyToFire"
                    "offset"    "0xC8"
                }
            }
        }

        "Signatures"
        {
            "CLunge::IsAbilityReadyToFire"
            {
                "library"    "server"
                "linux"        "@_ZNK6CLunge20IsAbilityReadyToFireEv"
            }
        }
    }
}
*/

#pragma semicolon 1
#pragma newdecls required

#include <sourcemod>
#include <sdktools>
#include <midhook>

public void OnPluginStart()
{
    GameData hGameData = new GameData("midhook_test");

    Address addr = hGameData.GetAddress("CLunge::IsAbilityReadyToFire");
    MidHook midhook = new MidHook(addr, OnMidHook);
    if (!midhook)
        SetFailState("Failed to create midhook");
    delete hGameData;
}

void OnMidHook(MidHookRegisters regs)
{
    PrintToServer("--- OnMidHook ---"); // Server crashes immediately after printing
} 


[Scag]

Originally Posted by fdxx Spoiler Server crashes after trying, what am I doing wrong? PHP Code: /* "Games" {     "left4dead2"     {         "Addresses"         {             "CLunge::IsAbilityReadyToFire"             {                 "linux"                 {                     "signature"    "CLunge::IsAbilityReadyToFire"                     "offset"    "0xC8"                 }             }         }         "Signatures"         {             "CLunge::IsAbilityReadyToFire"             {                 "library"    "server"                 "linux"        "@_ZNK6CLunge20IsAbilityReadyToFireEv"             }         }     } } */ #pragma semicolon 1 #pragma newdecls required #include <sourcemod> #include <sdktools> #include <midhook> public void OnPluginStart() {     GameData hGameData = new GameData("midhook_test");     Address addr = hGameData.GetAddress("CLunge::IsAbilityReadyToFire");     MidHook midhook = new MidHook(addr, OnMidHook);     if (!midhook)         SetFailState("Failed to create midhook");     delete hGameData; } void OnMidHook(MidHookRegisters regs) {     PrintToServer("--- OnMidHook ---"); // Server crashes immediately after printing }

Please provide an Accelerator crash dump if possible. At a glance, it appears that short jumps (the 74 0B) cannot be fixed up in the trampoline of a midhook. Try hooking somewhere that doesn't have a short jump within ~5 bytes of the target address. If that's the problem, then that is a limitation of the API but something I could consider working on in the future.

[fdxx]

Originally Posted by Scag Please provide an Accelerator crash dump if possible. At a glance, it appears that short jumps (the 74 0B) cannot be fixed up in the trampoline of a midhook. Try hooking somewhere that doesn't have a short jump within ~5 bytes of the target address. If that's the problem, then that is a limitation of the API but something I could consider working on in the future.

https://crash.limetech.org/pw6nmzpo53dp

[Scag]

Originally Posted by fdxx https://crash.limetech.org/pw6nmzpo53dp

Yes, looks like that's exactly what happened.

Originally Posted by Scag At a glance, it appears that short jumps (the 74 0B) cannot be fixed up in the trampoline of a midhook.

The disassembly in the crash dump provides the tail end bytes of the following movzx instruction. The jz was fortunately short.

Anyways, for now, try to avoid emplacing midhooks where there are short (2-3 byte-long) jmp instructions that the midhook will run over. E8 and E9 jumps should be okay. I can work on getting short jumps to remap/work but that will take some finesse. I'll update the main post to reflect that fact.

[Vit_amin]

Game: Counter-Strike: Source
OS: Linux (Linux Admin 5.15.153.1-microsoft-standard-WSL2 #1 SMP Fri Mar 29 23:14:13 UTC 2024 x86_64 GNU/Linux)

Extension output, when try loaded plugin:

L 09/29/2024 - 00:53:06: [SM] Unable to load extension "midhooks.ext": bin/libstdc++.so.6: version `GLIBCXX_3.4.20' not found (required by .../cstrike/addons/sourcemod/extensions/midhooks.ext.so)

[Scag]

Originally Posted by Vit_amin Game: Counter-Strike: Source OS: Linux (Linux Admin 5.15.153.1-microsoft-standard-WSL2 #1 SMP Fri Mar 29 23:14:13 UTC 2024 x86_64 GNU/Linux) Extension output, when try loaded plugin: L 09/29/2024 - 00:53:06: [SM] Unable to load extension "midhooks.ext": bin/libstdc++.so.6: version `GLIBCXX_3.4.20' not found (required by .../cstrike/addons/sourcemod/extensions/midhooks.ext.so)

Weird. I'm building on Debian 10 which I think is usually pretty compatible. I've now statically linked glibc so please try using the latest release and let me know if it works.

[Vit_amin]

All work corrected, check on CentOS and Debian, many thanks

[blueblur]

Hi, just one more question I've been wondering these days, can I detour and midhook a same function at the same time? (I guess probably not?)

[donrevan]

in theory yes, as long as there is enough room for the detour and enough bytes for a midhook