Raised This Month: $32 Target: $400
 8% 

The art of signature scanning


Post New Thread Reply   
 
Thread Tools Display Modes
TheAvenger
Junior Member
Join Date: May 2012
Old 05-04-2012 , 02:52   Re: The art of signature scanning
Reply With Quote #11

Quote:
Originally Posted by joaquimandrade View Post
The thing is: the offset of the pev member in classes is compilation dependent and maybe mod dependent. If you check hamdata.ini in an amxmodx installation you can see:
Code:
@section cstrike linux
    pev 0
@section cstrike windows
    pev 4
So, if you plan on doing stuff only for cstrike linux is ok to assume 0.
Aa that explains it! Thought it was a bit counter-intuitive at first, but I guess it all makes
sense in the end. I also wanted to ask you a bit about you're detouring implementation though.

Right now my detouring implementation works flawlessly (for _cdecl and _thiscall, haven't
tried _stdcall) but there is one improvement I want to implement. I program in pure C++;
I use no globals and enclose everything in classes (what a bitch to program in the HLSDK )

The problem is that I haven't been able to implement my 'hook' (jmp call) to supply a 'this'
pointer, which would enable class methods as 'hooks' instead of using static/global functions.

I could just skim through the Orpheu source, but I wanted to ask you in person. How have
you dealt with the problem? I'm not sure if I can just push a this pointer (as the last argument
since it's GCC convention) or if I need to solve the problem with a completely different approach?

EDIT: And I also must ask; do you prefer AT&T or Intel ASM syntax ?

Last edited by TheAvenger; 05-04-2012 at 03:53.
TheAvenger is offline
joaquimandrade
Veteran Member
Join Date: Dec 2008
Location: Portugal
Old 05-04-2012 , 22:45   Re: The art of signature scanning
Reply With Quote #12

Quote:
Originally Posted by TheAvenger View Post
Aa that explains it! Thought it was a bit counter-intuitive at first, but I guess it all makes
sense in the end. I also wanted to ask you a bit about you're detouring implementation though.

Right now my detouring implementation works flawlessly (for _cdecl and _thiscall, haven't
tried _stdcall) but there is one improvement I want to implement. I program in pure C++;
I use no globals and enclose everything in classes (what a bitch to program in the HLSDK )

The problem is that I haven't been able to implement my 'hook' (jmp call) to supply a 'this'
pointer, which would enable class methods as 'hooks' instead of using static/global functions.

I could just skim through the Orpheu source, but I wanted to ask you in person. How have
you dealt with the problem? I'm not sure if I can just push a this pointer (as the last argument
since it's GCC convention) or if I need to solve the problem with a completely different approach?

EDIT: And I also must ask; do you prefer AT&T or Intel ASM syntax ?
It depends on how you are doing your code but what I would do would be to make a jump to a static function, have the object of your class in a global, and call it from the function, because if you want to make assembly code to make a thiscall you would need to provide the address of the function but I think that compilers don't allow to do that for non static member functions if you know what I mean. Anyway answering to the question of "i can just push a this pointer", of course you can that's what calling conventions are for.

About the syntax of question I haven't really created much code with them. In fact I only did it for orpheu and it was small code and the greater difference would be related to how compilers handle inline assembly than assembly itself so I don't have an answer sorry
joaquimandrade is offline
TheAvenger
Junior Member
Join Date: May 2012
Old 05-06-2012 , 18:02   Re: The art of signature scanning
Reply With Quote #13

Quote:
Originally Posted by joaquimandrade View Post
It depends on how you are doing your code but what I would do would be to make a jump to a static function, have the object of your class in a global, and call it from the function, because if you want to make assembly code to make a thiscall you would need to provide the address of the function but I think that compilers don't allow to do that for non static member functions if you know what I mean. Anyway answering to the question of "i can just push a this pointer", of course you can that's what calling conventions are for.

About the syntax of question I haven't really created much code with them. In fact I only did it for orpheu and it was small code and the greater difference would be related to how compilers handle inline assembly than assembly itself so I don't have an answer sorry
After hours of work I managed to create a fully (to the looks) object oriented implementation. I use no static
functions nor global objects, just some JIT-code (ASM) which works perfect! The best part is; it's even cross-platform
Although the rest of my code is not, if I decide to port to Windows...

Too bad... If you're going serious choose AT&T
Now I'm going to continue my quest for CS offsets!

Last edited by TheAvenger; 05-06-2012 at 18:02.
TheAvenger is offline
Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -4. The time now is 23:25.


Powered by vBulletin®
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Theme made by Freecode