[Sappykun]

As the title suggests, I want to remove the hard-coded scale limit for env_sprite entities to go above 64.
This is a maximum value that's defined in the entity's netprops, but the maximum is only initialized on the server when it's networked to the client, and I think it may be possible to remove this limit.

gubka did a similar modification of server datatables for CS:GO's HUD elements: https://forums.alliedmods.net/showthread.php?t=314962
I was trying to copy what gubka did, but I am having troubles figuring out how he managed to get the server to recognize that the tables have changed and push updates accordingly.

I made my own gamedata file for the TF2 server/engine binaries. The signature and offsets for ServerClassInit<DT_Sprite::ignored> are correct, but I am not sure what offset gubka uses to send a new CRC value in SendTable_Init.

I am fairly new to server binary analysis in IDA. Would anybody be able to help me find the proper offset?

spritescale.sp is a small script I wrote that is essentially what I'm trying to accomplish.

[BHaType]

You can use interface to find SendProps and change their bits property, the last one is CRC since i don't have tf2 binaries i will make example on l4d2.

To get this variable you need to dereference 4 bytes which represents absolute address of this variable (like a pointer to some variable).

Spoiler

but before that we need to find an offset by which we will find a pointer to this variable (in most cases this is the signature of some function + offset or module base + offset)
so create signature for the function and subtract the pointer offset from the signature address and this is will be offset to your variable ptr off signature

At the end

PHP Code:

"Games"
{
    "left4dead2"
    {
        "Addresses"
        {
            "g_SendTableCRC"
            {
                "signature" "SendTable_Init"
                
                /* 0x145D4F - 0x145CA0 = 0xAF = 175 */
                "linux" 
                {
                    "read" "176"
                }
            }
        }
        
        "Signatures"
        {
            "SendTable_Init"
            {
                "library" "engine"
                "linux"    "@_Z14SendTable_InitPP9SendTablei"
            }
        }
    }
} 


Now you can pass any dummy value to break CRC and force server to send full tables update

PHP Code:

StoreToAddress(data.GetAddress("g_SendTableCRC"), 666, NumberType_Int32); 


A long time ago I already wrote plugin which uses interface to find sendprops. You can use it as a reference.
https://pastebin.com/hb5J6XuR

Code example:

PHP Code:

native bool Proxy_FindSendProp(const char[] netclass, const char[] propname, SendProp out);

bool ChangePropBits(const char[] netclass, const char[] propname, int bits)
{
    SendProp prop;
    
    if ( !Proxy_FindSendProp(netclass, propname, prop) )
        return false;
        
    StoreToAddress(prop.me + view_as<Address>(12), bits, NumberType_Int32);
    return true;
}

bool result = ChangePropBits("CSprite", "m_fScale", 12); 


[Sappykun]

Originally Posted by BHaType A long time ago I already wrote plugin which uses interface to find sendprops. You can use it as a reference. https://pastebin.com/hb5J6XuR Code example: PHP Code: native bool Proxy_FindSendProp(const char[] netclass, const char[] propname, SendProp out); bool ChangePropBits(const char[] netclass, const char[] propname, int bits) {     SendProp prop;          if ( !Proxy_FindSendProp(netclass, propname, prop) )         return false;              StoreToAddress(prop.me + view_as<Address>(12), bits, NumberType_Int32);     return true; } bool result = ChangePropBits("CSprite", "m_fScale", 12);

Thank you for the detailed response.

I edited your plugin to call ChangePropBits("CSprite", "m_flSpriteScale", 12) on plugin load, but it makes my client crash when I try to join.

I also am unable to join the server after I change the class table CRC, regardless of whether or not I have sv_sendtables set to 1. If I don't change the value, I get the expected "Server uses different class tables" error.
If I do change the value, I get a different, rather amusing error:



Also, would you be able to explain to me what 12 is supposed to represent? I see it referred in gubka's code as well, but it looks like an arbitrary number.

[BHaType]

Originally Posted by Sappykun crash when I try to join.

it looks like it's broken in l4d2

Originally Posted by Sappykun Also, would you be able to explain to me what 12 is supposed to represent? I see it referred in gubka's code as well, but it looks like an arbitrary number.

This is offset to m_nBits property

[Sappykun]

Originally Posted by BHaType it looks like it's broken in l4d2

It seems to be broken in TF2 as well. If I try to send the updated tables, I hang on the Sending client info... screen, and opening the console shows this line:

Netchannel: failed reading message svc_CreateStringTable

If I start the server without setting sv_sendtables to 1, let it finish starting, set the convar, then try joining, my client crashes instead.
Is there something else I need to do to get this working? Am I missing something? I'd say it's a CS:GO only thing, but apparently gubka was able to get his plugin working in CS:S.

I've attached a super-simple plugin that replicates the issue.

[asherkin]

Have you ensured that sv_sendtables is working fine without any memory patches?

[Sappykun]

Originally Posted by asherkin Have you ensured that sv_sendtables is working fine without any memory patches?

Yes I have, sv_sendtables has no effect if the CRC hasn't changed. I can join a server with sv_sendtables enabled just fine.