|
1 | 1 | "Games" |
2 | 2 | { |
3 | | - // A guide to find most of these signatures and offsets: https://www.youtube.com/watch?v=ekyLf6hu4qI |
| 3 | + // A guide to find most of these signatures and offsets: https://www.youtube.com/watch?v=ekyLf6hu4qI and another https://www.youtube.com/watch?v=J7eHgK_UYOk |
4 | 4 |
|
5 | 5 | "#default" |
6 | 6 | { |
|
15 | 15 | { |
16 | 16 | "library" "server" |
17 | 17 | "windows" "@CreateInterface" |
| 18 | + "windows64" "@CreateInterface" |
18 | 19 | "linux" "@CreateInterface" |
| 20 | + "linux64" "@CreateInterface" |
19 | 21 | } |
20 | 22 |
|
21 | 23 | "CreateInterface_Engine" |
22 | 24 | { |
23 | 25 | "library" "engine" |
24 | 26 | "windows" "@CreateInterface" |
| 27 | + "windows64" "@CreateInterface" |
25 | 28 | "linux" "@CreateInterface" |
| 29 | + "linux64" "@CreateInterface" |
26 | 30 | } |
27 | 31 | } |
28 | 32 |
|
|
31 | 35 | "OS" |
32 | 36 | { |
33 | 37 | "windows" "1" |
| 38 | + "windows64" "1" |
34 | 39 | "linux" "2" |
| 40 | + "linux64" "2" |
| 41 | + } |
| 42 | + |
| 43 | + "X64" |
| 44 | + { |
| 45 | + "windows" "0" |
| 46 | + "windows64" "1" |
| 47 | + "linux" "0" |
| 48 | + "linux64" "1" |
35 | 49 | } |
36 | 50 |
|
37 | 51 | "ProcessMovement" |
38 | 52 | { |
39 | 53 | "windows" "1" |
| 54 | + "windows64" "1" |
40 | 55 | "linux" "2" |
| 56 | + "linux64" "2" |
41 | 57 | } |
42 | 58 | } |
43 | 59 | } |
|
74 | 90 | "linux" "78" |
75 | 91 | "mac" "78" |
76 | 92 | } |
77 | | - // can be found inside BotAddCommand |
78 | | - "WEAPONTYPE_UNKNOWN" |
79 | | - { |
80 | | - "windows" "19" |
81 | | - "linux" "19" |
82 | | - "mac" "19" |
83 | | - } |
84 | 93 | // search string: "Can't find specific footstep sound!" to find CBasePlayer::PlayStepSound. |
85 | 94 | // then find the vtable from references and CBasePlayer::UpdateStepSound is right before PlayStepSound |
86 | 95 | "CBasePlayer::UpdateStepSound" |
|
122 | 131 | "windows" "\x55\x8B\xEC\x83\xEC\x14\x89\x4D\x2A\xFF\x15" |
123 | 132 | "linux" "\x55\x89\xE5\x57\x56\x53\x83\xEC\x2C\xE8\x2A\x2A\x2A\x2A\x84\xC0\x74\x2A\xA1" |
124 | 133 | } |
125 | | - // search string: "Error - no profile for '%s' exists." |
126 | | - "CCSBotManager::BotAddCommand" |
127 | | - { |
128 | | - "windows" "\x55\x8B\xEC\xA1\x2A\x2A\x2A\x2A\x53\x56\x57\x80\x78\x2A\x00" |
129 | | - "linux" "\x55\x89\xE5\x57\x56\x53\x83\xEC\x1C\x8B\x45\x2A\x89\x45\x2A\xA1\x2A\x2A\x2A\x2A\x0F\xB6\x70" |
130 | | - } |
131 | 134 | // search string: "remove 0x%p: %s-%s" to find PhysicsRemoveToucher. |
132 | 135 | // Find PhysicsCheckForEntityUntouch by checking the functions that call PhysicsRemoveToucher. |
133 | 136 | // This sucks to find. |
|
164 | 167 | { |
165 | 168 | "Addresses" |
166 | 169 | { |
167 | | - "m_surfaceFriction" |
168 | | - { |
169 | | - "signature" "CBasePlayer->m_surfaceFriction" |
170 | | - "read" "2" // skip the first 2 bytes |
171 | | - } |
172 | 170 | } |
173 | 171 |
|
174 | 172 | "Offsets" |
175 | 173 | { |
176 | 174 | // https://asherkin.github.io/vtable/ |
| 175 | + // search string: "func_pushable" and you can find CBaseTrigger::PassesTriggerFilters / CBaseVPhysicsTrigger::PassesTriggerFilters. Follow references to these functions to find the vtable and then calculate the offset... |
177 | 176 | "CBaseTrigger::PassesTriggerFilters" |
178 | 177 | { |
179 | | - "windows" "197" |
180 | | - "linux" "198" |
| 178 | + "windows" "203" |
| 179 | + "windows64" "203" |
| 180 | + "linux" "204" |
| 181 | + "linux64" "204" |
181 | 182 | } |
182 | | - // https://asherkin.github.io/vtable/ |
| 183 | + // https://asherkin.github.io/vtable/ (if updated) |
| 184 | + // search string: "start %f %f %f" and then check the function call offsets above it and convert them to vtable offsets (divide by 4 most likely or whatever) |
183 | 185 | "CCSPlayer::GetPlayerMaxSpeed" |
184 | 186 | { |
185 | | - "windows" "438" |
186 | | - "linux" "439" |
187 | | - "mac" "439" |
| 187 | + "windows" "445" |
| 188 | + "windows64" "445" |
| 189 | + "linux" "446" |
| 190 | + "linux64" "446" |
188 | 191 | } |
189 | 192 | // https://asherkin.github.io/vtable/ |
| 193 | + // search string: "Invalid counterterrorist spawnpoint" and then look for the first function call in each iteration of the loop |
190 | 194 | "CGameRules::IsSpawnPointValid" |
191 | 195 | { |
192 | 196 | "windows" "76" |
| 197 | + "windows64" "77" // yes, same as linux64 (according to vtable site) |
193 | 198 | "linux" "77" |
194 | | - "mac" "77" |
195 | | - } |
196 | | - // can be found inside BotAddCommand |
197 | | - "WEAPONTYPE_UNKNOWN" |
198 | | - { |
199 | | - "windows" "9" |
200 | | - "linux" "9" |
201 | | - "mac" "9" |
| 199 | + "linux64" "77" |
202 | 200 | } |
203 | 201 | // https://asherkin.github.io/vtable/ |
| 202 | + // search string: "water" to find CBasePlayer::UpdateStepSound. At the bottom there's a vtable call to ::PlayStepSound. Grab that, divide by 4, subtract 1. Bam, UpdateStepSound... |
204 | 203 | "CBasePlayer::UpdateStepSound" |
205 | 204 | { |
206 | | - "windows" "358" |
207 | | - "linux" "359" |
| 205 | + "windows" "364" |
| 206 | + "windows64" "364" |
| 207 | + "linux" "365" |
| 208 | + "linux64" "365" |
208 | 209 | } |
209 | 210 | // find in CCSGameMovement::CheckForLadders which references CCSPlayer::CanGrabLadder |
| 211 | + // |
| 212 | + // Find CCSPlayer::CanGrabLadder by searching for 4096.0f, finding functions that reference... |
| 213 | + // It might look like this |
| 214 | + // undefined4 __thiscall CCSPlayer::CanGrabLadder(int param_1_00,float *param_1,float *param_2) |
| 215 | + // { |
| 216 | + // float10 extraout_ST0; |
| 217 | + // float fVar1; |
| 218 | + // float fVar2; |
| 219 | + // |
| 220 | + // (*(code *)**(undefined4 **)(param_1_00 + 0x1790))(); |
| 221 | + // if ((float10)0 < (float10)*(float *)(param_1_00 + 0x1798) - extraout_ST0) { |
| 222 | + // fVar1 = *param_1 - *(float *)(param_1_00 + 0x17a8); |
| 223 | + // fVar2 = param_1[1] - *(float *)(param_1_00 + 0x17ac); |
| 224 | + // if (fVar2 * fVar2 + fVar1 * fVar1 < 4096.0) { |
| 225 | + // return 0; |
| 226 | + // } |
| 227 | + // if ((((NAN(*(float *)(param_1_00 + 0x179c)) || NAN(*param_2)) != |
| 228 | + // (*(float *)(param_1_00 + 0x179c) == *param_2)) && |
| 229 | + // ((NAN(*(float *)(param_1_00 + 0x17a0)) || NAN(param_2[1])) != |
| 230 | + // (*(float *)(param_1_00 + 0x17a0) == param_2[1]))) && |
| 231 | + // ((NAN(*(float *)(param_1_00 + 0x17a4)) || NAN(param_2[2])) != |
| 232 | + // (*(float *)(param_1_00 + 0x17a4) == param_2[2]))) { |
| 233 | + // return 0; |
| 234 | + // } |
| 235 | + // } |
| 236 | + // return 1; |
| 237 | + // } |
210 | 238 | "CCSPlayer::m_lastStandingPos" |
211 | 239 | { |
212 | | - "windows" "5684" |
213 | | - "linux" "5704" // +20 wow that's easy! |
| 240 | + "windows" "6016" |
| 241 | + "windows64" "6640" |
| 242 | + "linux" "6036" // +20 wow that's easy! |
| 243 | + "linux64" "6688" // +48 wow that's easy! |
214 | 244 | } |
215 | 245 | // find CCSPlayer::CanGrabLadder via 4096.0f or symbols on linux... |
216 | 246 | "CCSPlayer::m_ladderSurpressionTimer" |
217 | 247 | { |
218 | | - "windows" "5700" |
219 | | - "linux" "5720" // +20 wow that's easy! |
| 248 | + "windows" "6032" |
| 249 | + "windows64" "6668" |
| 250 | + "linux" "6052" // +20 wow that's easy! |
| 251 | + "linux64" "6716" // +48 wow that's easy! |
220 | 252 | } |
221 | 253 | // find CCSPlayer::CanGrabLadder via 4096.0f or symbols on linux... |
222 | 254 | "CCSPlayer::m_lastLadderNormal" |
223 | 255 | { |
224 | | - "windows" "5712" |
225 | | - "linux" "5732" // +20 wow that's easy! |
| 256 | + "windows" "6044" |
| 257 | + "windows64" "6672" |
| 258 | + "linux" "6064" // +20 wow that's easy! |
| 259 | + "linux64" "6720" // +48 wow that's easy! |
226 | 260 | } |
227 | 261 | // find CCSPlayer::CanGrabLadder via 4096.0f or symbols on linux... |
228 | 262 | "CCSPlayer::m_lastLadderPos" |
229 | 263 | { |
230 | | - "windows" "5724" |
231 | | - "linux" "5744" // +20 wow that's easy! |
| 264 | + "windows" "6056" |
| 265 | + "windows64" "6684" |
| 266 | + "linux" "6076" // +20 wow that's easy! |
| 267 | + "linux64" "6732" // +48 wow that's easy! |
232 | 268 | } |
233 | 269 | // TODO |
234 | 270 | "GetClusterForOrigin" |
|
246 | 282 |
|
247 | 283 | "Signatures" |
248 | 284 | { |
249 | | - // search string: "ReloadEffect" to find CWeaponCSBase::SendReloadEvents and then DoAnimationEvent is probably the second to last function called there. |
| 285 | + // search string: "ReloadEffect" to find CWeaponCSBase::SendReloadEvents and then CCSPlayer::DoAnimationEvent is probably the second to last function called there. |
250 | 286 | "Player::DoAnimationEvent" |
251 | 287 | { |
252 | | - "windows" "\x55\x8B\xEC\x83\xEC\x10\x89\x4D\xFC\x83\x7D\x08\x02" |
| 288 | + "windows" "\x55\x8B\xEC\x83\xEC\x0C\x89\x4D\x2A\x83\x7D\x2A\x02" |
| 289 | + "windows64" "\x44\x89\x44\x24\x2A\x89\x54\x24\x2A\x48\x89\x4C\x24\x2A\x48\x83\xEC\x38\x83\x7C\x24\x2A\x02" |
253 | 290 | "linux" "@_ZN9CCSPlayer16DoAnimationEventE17PlayerAnimEvent_ti" |
| 291 | + "linux64" "@_ZN9CCSPlayer16DoAnimationEventE17PlayerAnimEvent_ti" |
254 | 292 | } |
255 | | - // search string: "-nobots" |
| 293 | + // search string: "-nobots" (and then look for the function that also references "fill" and "match" (or just the function with 0 or 1 parameters...)) |
256 | 294 | "BotManager::MaintainBotQuota" |
257 | 295 | { |
258 | 296 | "windows" "\x55\x8B\xEC\x83\xEC\x14\xFF\x15" |
| 297 | + "windows64" "\x48\x83\xEC\x78\xFF\x15" |
259 | 298 | "linux" "@_ZN13CCSBotManager16MaintainBotQuotaEv" |
| 299 | + "linux64" "@_ZN13CCSBotManager16MaintainBotQuotaEv" |
260 | 300 | } |
261 | 301 | // search string: "Server is hibernating" to find SetHibernating and then go its references |
| 302 | + // NOTE 2025-02-19: Function has been inlined on Windows into SV_Think... |
262 | 303 | "CGameServer::UpdateHibernationState" |
263 | 304 | { |
264 | 305 | "library" "engine" |
265 | 306 | "windows" "\x55\x8B\xEC\x83\xEC\x08\x57\x8B\xF9\x8B\x07\x8B\x40\x2A\xFF\xD0\x84\xC0\x0F\x84" |
266 | | - "linux" "@_ZN11CGameServer22UpdateHibernationStateEv" |
267 | | - } |
268 | | - // search string: "Error - no profile for '%s' exists." |
269 | | - "CCSBotManager::BotAddCommand" |
270 | | - { |
271 | | - "windows" "\x55\x8B\xEC\xA1\x2A\x2A\x2A\x2A\x80\x78\x2A\x00\x75\x2A\x83\xB8\x2A\x2A\x2A\x2A\x00" |
272 | | - "linux" "@_ZN13CCSBotManager13BotAddCommandEibPKc12CSWeaponType17BotDifficultyType" |
| 307 | + "windows64" "\x48\x89\x5C\x24\x2A\x56\x48\x83\xEC\x40\x8B\x05" |
| 308 | + "linux" "@_ZN11CGameServer22UpdateHibernationStateEv.part.0" |
| 309 | + "linux64" "@_ZN11CGameServer14SetHibernatingEb" |
273 | 310 | } |
274 | 311 | // search string: "remove 0x%p: %s-%s" to find PhysicsRemoveToucher. |
275 | 312 | // Find PhysicsCheckForEntityUntouch by checking the functions that call PhysicsRemoveToucher. |
| 313 | + // (should be the function with one argument (this ptr)) |
276 | 314 | "PhysicsCheckForEntityUntouch" |
277 | 315 | { |
278 | | - "windows" "\x55\x8B\xEC\x83\xEC\x08\x56\x8B\xF1\x8B\x86" |
| 316 | + "windows" "\x55\x8B\xEC\x83\xEC\x08\x57\x8B\xF9\x8B\x87" |
| 317 | + "windows64" "\x40\x57\x48\x83\xEC\x20\x8B\x81" |
279 | 318 | "linux" "@_ZN11CBaseEntity28PhysicsCheckForEntityUntouchEv" |
| 319 | + "linux64" "@_ZN11CBaseEntity28PhysicsCheckForEntityUntouchEv" |
280 | 320 | } |
281 | | - // search string: "Could not add bot to the game: Team is full" |
| 321 | + // search string: "Could not add bot to the game: Team is full" to find CCSBotManager::BotAddCommand and then follow the if-statement up to find the function call that was fall (because TeamFull()) |
282 | 322 | // protip: on csgo we just use mp_randomspawn instead. |
283 | 323 | "CCSGameRules::TeamFull" |
284 | 324 | { |
285 | 325 | "windows" "\x55\x8B\xEC\x56\x8B\xF1\xE8\x2A\x2A\x2A\x2A\x8B\x45\x2A\x83\xE8\x02" |
| 326 | + "windows64" "\x48\x89\x5C\x24\x2A\x57\x48\x83\xEC\x20\x8B\xFA\x48\x8B\xD9\xE8\x2A\x2A\x2A\x2A\x83\xEF\x02" |
286 | 327 | "linux" "@_ZN12CCSGameRules8TeamFullEi" |
| 328 | + "linux64" "@_ZN12CCSGameRules8TeamFullEi" |
287 | 329 | } |
288 | 330 | // search string: "remove 0x%p: %s-%s (%d-%d) [%d in play, %d max]\n". |
289 | 331 | // function with one argument is PhysicsRemoveTouchedList |
290 | 332 | "PhysicsRemoveTouchedList" |
291 | 333 | { |
292 | | - "windows" "\x55\x8B\xEC\x83\xEC\x08\x57\x8B\x7D\x08\x8B\x87\x2A\x2A\x2A\x2A\xD1\xE8\xA8\x01\x0F\x84" |
| 334 | + "windows" "\x55\x8B\xEC\x83\xEC\x08\x53\x8B\x5D\x2A\x8B\x83" |
| 335 | + "windows64" "\x40\x55\x56\x48\x83\xEC\x58" |
293 | 336 | "linux" "@_ZN11CBaseEntity24PhysicsRemoveTouchedListEPS_" |
| 337 | + "linux64" "@_ZN11CBaseEntity24PhysicsRemoveTouchedListEPS_" |
294 | 338 | } |
295 | | - // look for function CGameMovement::CategorizePosition |
296 | | - // and you will see something something *(_DWORD*)(a1[1] + some_offset) = 0x3F800000 |
| 339 | + // look for CGameMovement::CategorizePosition by searching for 140.0f |
| 340 | + // and you will see something something `*(_DWORD*)(a1[1] + some_offset) = 0x3F800000` right at the top |
297 | 341 | // make a signature at "mov dword ptr[eax+some_offset], 3F800000h" |
298 | 342 | "CBasePlayer->m_surfaceFriction" |
299 | 343 | { |
300 | | - "windows" "\xC7\x80\x2A\x2A\x2A\x2A\x2A\x2A\x2A\x2A\x8B\x07\xFF\x90" |
301 | | - "linux" "\xC7\x80\x2A\x2A\x2A\x2A\x2A\x2A\x2A\x2A\x8B\x03\x89\x1C\x24\xFF\x90\x2A\x2A\x2A\x2A\x8B\x53\x04" |
| 344 | + "windows" "\xC7\x80\x2A\x2A\x2A\x2A\x00\x00\x80\x3F\x8B\x07" |
| 345 | + "windows64" "\xC7\x80\x2A\x2A\x2A\x2A\x00\x00\x80\x3F\x48\x8B\x01" |
| 346 | + "linux" "\xC7\x80\x2A\x2A\x2A\x2A\x00\x00\x80\x3F\x8B\x03" |
| 347 | + "linux64" "\xC7\x80\x2A\x2A\x2A\x2A\x00\x00\x80\x3F\x48\x8B\x07" |
302 | 348 | } |
303 | 349 | } |
304 | 350 | } |
|
331 | 377 | { |
332 | 378 | // search string: "BumperCar.Jump" to find CTFGameMovement::CheckJumpButton. |
333 | 379 | // Then the call to PreventBunnyJumping is right above the string reference somewhere... |
| 380 | + // Update 2024-04-18: This fucking bitch got inlined on Windows so this signature is now to the first jump instruction of it to gtfo of doing the velocity stuff. https://i.imgur.com/LDq6Ubo.png |
334 | 381 | "CTFGameMovement::PreventBunnyJumping" |
335 | 382 | { |
336 | | - "windows" "\x56\x8B\xF1\x6A\x52\x8B\x8E\x2A\x2A\x2A\x2A\x81\xC1\xE0\x1A\x00\x00\xE8\x2A\x2A\x2A\x2A\x84\xC0\x75" |
| 383 | + "windows" "\x75\x2A\x8B\x47\x2A\x8D\x77\x2A\x0F\x57\xC0" |
337 | 384 | "linux" "@_ZN15CTFGameMovement19PreventBunnyJumpingEv" |
338 | 385 | } |
339 | 386 | // search string: "Usage: setang_exact pitch yaw" to find setang_exact's handler. Then the last function call in the handler is DoAnimationEvent. |
|
345 | 392 | // search string: "match" |
346 | 393 | "BotManager::MaintainBotQuota" |
347 | 394 | { |
348 | | - "windows" "\x55\x8B\xEC\x81\xEC\x14\x01\x00\x00\xA1" |
| 395 | + "windows" "\x55\x8B\xEC\xA1\x2A\x2A\x2A\x2A\x81\xEC\x10\x01\x00\x00\x83\xB8\x2A\x2A\x2A\x2A\x00" |
349 | 396 | "linux" "@_ZN13CTFBotManager16MaintainBotQuotaEv" |
350 | 397 | } |
351 | | - // search string: "CreatePlayerBot: Unable to create bot" |
352 | | - "NextBotCreatePlayerBot<CTFBot>" |
353 | | - { |
354 | | - "windows" "\x55\x8B\xEC\x56\x57\x68\x2A\x2A\x2A\x2A\xE8" |
355 | | - "linux" "@_Z22NextBotCreatePlayerBotI6CTFBotEPT_PKcb" |
356 | | - } |
357 | 398 | // search string: "remove 0x%p: %s-%s" to find PhysicsRemoveToucher. |
358 | 399 | // Find PhysicsCheckForEntityUntouch by checking the functions that call PhysicsRemoveToucher. |
359 | 400 | "PhysicsCheckForEntityUntouch" |
360 | 401 | { |
361 | | - "windows" "\x55\x8B\xEC\x51\x56\x8B\xF1\x8B\x86\x2A\x2A\x2A\x2A\xD1\xE8\xA8\x01" |
| 402 | + "windows" "\x55\x8B\xEC\x83\xEC\x08\x57\x8B\xF9\x8B\x87\x2A\x2A\x2A\x2A\xD1\xE8" |
362 | 403 | "linux" "@_ZN11CBaseEntity28PhysicsCheckForEntityUntouchEv" |
363 | 404 | } |
364 | 405 | // search string: "scoreboard_minigame" |
365 | 406 | "CTFGameRules::CalcPlayerScore" |
366 | 407 | { |
367 | | - "windows" "\x55\x8B\xEC\x56\x8B\x75\x2A\x85\xF6\x75\x2A\x33\xC0\x5E\x5D\xC3\x8B\x56" |
| 408 | + "windows" "\x55\x8B\xEC\x57\x8B\x7D\x2A\x85\xFF\x75\x2A\x33\xC0\x5F\x5D\xC3\x8B\x57" |
368 | 409 | "linux" "@_ZN12CTFGameRules15CalcPlayerScoreEP12RoundStats_tP9CTFPlayer" |
369 | 410 | } |
370 | 411 | // search string: "remove 0x%p: %s-%s (%d-%d) [%d in play, %d max]\n". |
|
0 commit comments