[Peace-Maker]

Originally Posted by Spirit_12 PHP Code: int g_SurvivorCountsOffset = -1; char* SurvCounts=((char*)this)+g_SurvivorCountsOffset; g_pGameConf->GetOffset("SurvivorCounters",&g_SurvivorCountsOffset);  These are the 3 incidents where this offset is being used. Am I looking at the wrong function then? Extension Thread: https://forums.alliedmods.net/showthread.php?t=121945

"SurvivorCounters" != "CTerrorGameRules::CalculateSurvivalMultiplie r" ?!

[Spirit_12]

Originally Posted by Miu You were talking about "CTerrorGameRules::CalculateSurvivalMultiplie r" before, not "SurvivorCounters", and it looks like it's not a virtual method, but the offset of a member of CTerrorGameRules

Like I said, I'm clueless to the whole offset idea. Can you give me more information on how to tackle this problem ?

[Miu]

How to find the offset? You find some place it's referenced in the disassembly of the methods of the class. You should ask the person who created the extension, ideally.

[Spirit_12]

Originally Posted by Miu How to find the offset? You find some place it's referenced in the disassembly of the methods of the class. You should ask the person who created the extension, ideally.

He has been inactive, so chances of that are not ideal. I'm just looking for an overview and not the exacts. Like if I knew what I was finding that would have helped.

[Dr!fter]

First, you haven't exactly asked what you need help with, second this is probably not the right thread for it. However, from looking at the gamedata, the offsets are offsets into a certain function. There is very little overview we can give (without looking at the code) since its all dependent on what it is that the offset is for, which we probably dont know since we didnt write the extension.

[Spirit_12]

How can one find the offsets in a certain function? I followed your tutorial and I can find the offsets from the vtables, but like you said the offsets are offsets into a certain function. Is there a tutorial to figure that out?

[Miu]

it looks like a member variable of cterrorgamerules, so references to it would show up like ds:[ecx + offset] on windows and I think something like ds[ebp + offset] on linux since gcc puts this on the stack iirc, but it might be offset by other things on the stack in that case

if calculatesurvivalmultiplier needs to use the survivor count, I'd assume it'd be referenced there

[Spirit_12]

This is what I found by searching.

Spoiler

align 10h
.text:004DC3A0
.text:004DC3A0 ; =============== S U B R O U T I N E =======================================
.text:004DC3A0
.text:004DC3A0 ; Attributes: bp-based frame
.text:004DC3A0
.text:004DC3A0 ; bool ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)
.text:004DC3A0 _Z19ForEachTerrorPlayerI25SurvivorMultiplierC ounterEbRT_ proc near
.text:004DC3A0 ; CODE XREF: CTerrorGameRules::CalculateSurvivalMultiplier (bool)+8Dp
.text:004DC3A0
.text:004DC3A0 arg_0 = dword ptr 8
.text:004DC3A0
.text:004DC3A0 push ebp
.text:004DC3A1 mov ebp, esp
.text:004DC3A3 push edi
.text:004DC3A4 push esi
.text:004DC3A5 push ebx
.text:004DC3A6 sub esp, 1Ch
.text:004DC3A9 mov eax, ds:gpGlobals
.text:004DC3AE mov edi, [ebp+arg_0]
.text:004DC3B1 mov eax, [eax+14h]
.text:004DC3B4 test eax, eax
.text:004DC3B6 jle short loc_4DC41D
.text:004DC3B8 mov ebx, 1
.text:004DC3BD lea esi, [esi+0]
.text:004DC3C0
.text:004DC3C0 loc_4DC3C0: ; CODE XREF: ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)+7Bj
.text:004DC3C0 mov [esp], ebx ; int
.text:004DC3C3 call _Z18UTIL_PlayerByIndexi ; UTIL_PlayerByIndex(int)
.text:004DC3C8 test eax, eax
.text:004DC3CA mov esi, eax
.text:004DC3CC jz short loc_4DC410
.text:004DC3CE mov edx, [eax+30h]
.text:004DC3D1 mov eax, ds:gpGlobals
.text:004DC3D6 test edx, edx
.text:004DC3D8 jz short loc_4DC415
.text:004DC3DA sub edx, [eax+58h]
.text:004DC3DD sar edx, 4
.text:004DC3E0 test edx, edx
.text:004DC3E2 jz short loc_4DC415
.text:004DC3E4 mov eax, [esi]
.text:004DC3E6 mov [esp], esi
.text:004DC3E9 call dword ptr [eax+168h]
.text:004DC3EF test al, al
.text:004DC3F1 jz short loc_4DC410
.text:004DC3F3 cmp dword ptr [esi+1F8Ch], 2
.text:004DC3FA jz short loc_4DC410
.text:004DC3FC mov eax, [esi]
.text:004DC3FE mov [esp], esi
.text:004DC401 call dword ptr [eax+168h]
.text:004DC407 test al, al
.text:004DC409 jnz short loc_4DC430
.text:004DC40B nop
.text:004DC40C lea esi, [esi+0]
.text:004DC410
.text:004DC410 loc_4DC410: ; CODE XREF: ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)+2Cj
.text:004DC410 ; ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)+51j ...
.text:004DC410 mov eax, ds:gpGlobals
.text:004DC415
.text:004DC415 loc_4DC415: ; CODE XREF: ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)+38j
.text:004DC415 ; ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)+42j
.text:004DC415 add ebx, 1
.text:004DC418 cmp [eax+14h], ebx
.text:004DC41B jge short loc_4DC3C0
.text:004DC41D
.text:004DC41D loc_4DC41D: ; CODE XREF: ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)+16j
.text:004DC41D add esp, 1Ch
.text:004DC420 mov eax, 1
.text:004DC425 pop ebx
.text:004DC426 pop esi
.text:004DC427 pop edi
.text:004DC428 pop ebp
.text:004DC429 retn
.text:004DC429 ; ---------------------------------------------------------------------------
.text:004DC42A align 10h
.text:004DC430
.text:004DC430 loc_4DC430: ; CODE XREF: ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)+69j
.text:004DC430 mov eax, [esi]
.text:004DC432 mov [esp], esi
.text:004DC435 call dword ptr [eax+128h]
.text:004DC43B test al, al
.text:004DC43D jz short loc_4DC410
.text:004DC43F mov [esp], esi ; this
.text:004DC442 call _ZNK11CBaseEntity13GetTeamNumberEv ; CBaseEntity::GetTeamNumber(void)
.text:004DC447 cmp eax, 2
.text:004DC44A jnz short loc_4DC410
.text:004DC44C mov eax, [esi]
.text:004DC44E mov [esp], esi
.text:004DC451 call dword ptr [eax+7E4h]
.text:004DC457 test al, al
.text:004DC459 jnz short loc_4DC461
.text:004DC45B
.text:004DC45B loc_4DC45B: ; CODE XREF: ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)+EAj
.text:004DC45B ; ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)+FAj
.text:004DC45B add dword ptr [edi+4], 1
.text:004DC45F jmp short loc_4DC410
.text:004DC461 ; ---------------------------------------------------------------------------
.text:004DC461
.text:004DC461 loc_4DC461: ; CODE XREF: ForEachTerrorPlayer<SurvivorMultiplierCounter >(SurvivorMultiplierCounter &)+B9j
.text:004DC461 mov eax, [esi]
.text:004DC463 mov [esp], esi
.text:004DC466 call dword ptr [eax+528h]
.text:004DC46C test eax, eax
.text:004DC46E mov esi, eax
.text:004DC470 jz short loc_4DC410
.text:004DC472 test byte ptr [eax+12Dh], 8
.text:004DC479 jz short loc_4DC410
.text:004DC47B mov eax, ds:TheNavMesh
.text:004DC480 mov [esp], eax ; this
.text:004DC483 call _ZNK13TerrorNavMesh20GetInitialCheckpointEv ; TerrorNavMesh::GetInitialCheckpoint(void)
.text:004DC488 test eax, eax
.text:004DC48A jz short loc_4DC45B
.text:004DC48C mov [esp+4], esi
.text:004DC490 mov [esp], eax
.text:004DC493 call _ZNK10Checkpoint12ContainsAreaEP13TerrorNavAr ea ; Checkpoint::ContainsArea(TerrorNavArea *)
.text:004DC498 test al, al
.text:004DC49A jz short loc_4DC45B
.text:004DC49C jmp loc_4DC410
.text:004DC49C _Z19ForEachTerrorPlayerI25SurvivorMultiplierC ounterEbRT_ endp

[donrevan]

Originally Posted by Miu (...) and I think something like ds[ebp + offset] on linux since gcc puts this on the stack iirc (...)

No. It's GPR + offset too.

@Spirit_12
try this offsets(linux): 1040
I don't really know what the function(CalculateSurvivalMultiplier) is supposed to do so this is just a guess.

[Spirit_12]

Originally Posted by donrevan No. It's GPR + offset too. @Spirit_12 try this offsets(linux): 1040 I don't really know what the function(CalculateSurvivalMultiplier) is supposed to do so this is just a guess.

Can I know how did you get to that number?