[quasemago]

I'm trying to generate a unique signature for two small functions.

Gamedata with old symbols:

PHP Code:

"Games"
{
    "csgo"
    {
        "Signatures"
        {
            "operator new()"
            {
                "library"    "server"
                "linux"    "@_Znwj"
            }

            "operator delete()"
            {
                "library"    "server"
                "linux"    "@_ZdlPv"
            }
        }
    }
} 


Analyzing sdk I could see that these functions call MemAlloc internally, but I could not find any related functions in binarie.
- https://github.com/alliedmodders/hl2...emalloc.h#L177

[psychonic]

What are you trying to accomplish?

[quasemago]

Originally Posted by psychonic What are you trying to accomplish?

Trying remove particle system from ParticleSystemDictionary tree, because csgo does not clear the cache at the end of the map. (The code worked correctly before csgo lost the symbols)

I also need the signature of another small function: "CParticleSystemDefinition::GetName"

There is another topic that deals with the same subject in more detail (so I do not need to explain): https://forums.alliedmods.net/showthread.php?t=247897

[Dr!fter]

You have two options to get the function you want. Get a sig to a function that calls the one you want then get the address of the function from there. Or just get more bytes that are not within the function. Option one is better but hardest to do, option 2 risks sig breaking often.

[quasemago]

@Solved with help of the _Phoenix_.

[Bacardi]

[quasemago]

Originally Posted by Bacardi

Secret revealed

PHP Code:

"Games"  
{ 
    "csgo"  
    { 
        "Signatures"  
        { 
            "operator new()"  
            {
                "library"    "server"  
                "linux"    "\x55\x89\xE5\x83\xEC\x18\xA1\x2A\x2A\x2A\x2A\x8B\x4D\x08\x8B\x10\x89\x04\x24\x89\x4C\x24\x04\xFF\x12"  
            }
            "operator delete()"  
            {
                "library"    "server"  
                "linux"    "\x55\x89\xE5\x83\xEC\x18\xA1\x2A\x2A\x2A\x2A\x8B\x4D\x08\x8B\x10\x89\x04\x24\x89\x4C\x24\x04\xFF\x52\x08\xC9\xC3\x83\xC2\x01\x89\x04\x24"  
            }
        } 
    } 
}