diff --git a/components/CS_loadDLL/.gitignore b/components/CS_loadDLL/.gitignore new file mode 100644 index 0000000..71ec0d1 --- /dev/null +++ b/components/CS_loadDLL/.gitignore @@ -0,0 +1,226 @@ +# The following command works for downloading when using Git for Windows: +# curl -LOf http://gist.githubusercontent.com/kmorcinek/2710267/raw/.gitignore +# +# Download this file using PowerShell v3 under Windows with the following comand: +# Invoke-WebRequest https://gist.githubusercontent.com/kmorcinek/2710267/raw/ -OutFile .gitignore +# +# or wget: +# wget --no-check-certificate http://gist.githubusercontent.com/kmorcinek/2710267/raw/.gitignore + +# User-specific files +*.suo +*.user +*.sln.docstates + +# Build results +[Dd]ebug/ +[Rr]elease/ +x64/ +[Bb]in/ +[Oo]bj/ +# build folder is nowadays used for build scripts and should not be ignored +#build/ + +# NuGet Packages +*.nupkg +# The packages folder can be ignored because of Package Restore +**/packages/* +# except build/, which is used as an MSBuild target. +!**/packages/build/ +# Uncomment if necessary however generally it will be regenerated when needed +#!**/packages/repositories.config + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +*_i.c +*_p.c +*.ilk +*.meta +*.obj +*.pch +*.pdb +*.pgc +*.pgd +*.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*.log +*.vspscc +*.vssscc +.builds +*.pidb +*.scc + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opensdf +*.sdf +*.cachefile + +# Visual Studio profiler +*.psess +*.vsp +*.vspx + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# NCrunch +*.ncrunch* +.*crunch*.local.xml + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.Publish.xml + +# Windows Azure Build Output +csx +*.build.csdef + +# Windows Store app package directory +AppPackages/ + +# Others +*.Cache +ClientBin/ +[Ss]tyle[Cc]op.* +~$* +*~ +*.dbmdl +*.[Pp]ublish.xml +*.pfx +*.publishsettings +modulesbin/ +tempbin/ + +# EPiServer Site file (VPP) +AppData/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file to a newer +# Visual Studio version. Backup files are not needed, because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm + +# vim +*.txt~ +*.swp +*.swo + +# Temp files when opening LibreOffice on ubuntu +.~lock.* + +# svn +.svn + +# CVS - Source Control +**/CVS/ + +# Remainings from resolving conflicts in Source Control +*.orig + +# SQL Server files +**/App_Data/*.mdf +**/App_Data/*.ldf +**/App_Data/*.sdf + + +#LightSwitch generated files +GeneratedArtifacts/ +_Pvt_Extensions/ +ModelManifest.xml + +# ========================= +# Windows detritus +# ========================= + +# Windows image file caches +Thumbs.db +ehthumbs.db + +# Folder config file +Desktop.ini + +# Recycle Bin used on file shares +$RECYCLE.BIN/ + +# OS generated files # +Icon? + +# Mac desktop service store files +.DS_Store + +# SASS Compiler cache +.sass-cache + +# Visual Studio 2014 CTP +**/*.sln.ide + +# Visual Studio temp something +.vs/ + +# dotnet stuff +project.lock.json + +# VS 2015+ +*.vc.vc.opendb +*.vc.db + +# Rider +.idea/ + +# Visual Studio Code +.vscode/ + +# Output folder used by Webpack or other FE stuff +**/node_modules/* +**/wwwroot/* + +# SpecFlow specific +*.feature.cs +*.feature.xlsx.* +*.Specs_*.html + +# UWP Projects +AppPackages/ + +##### +# End of core ignore list, below put you custom 'per project' settings (patterns or path) +##### \ No newline at end of file diff --git a/components/CS_loadDLL/Program.cs b/components/CS_loadDLL/Program.cs new file mode 100644 index 0000000..9e08726 --- /dev/null +++ b/components/CS_loadDLL/Program.cs @@ -0,0 +1,82 @@ +// dotnet build ; dotnet run + +using System; +using System.Diagnostics; +using System.Runtime.InteropServices; + +class Program +{ + [DllImport("kernel32.dll")] + public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId); + + [DllImport("kernel32.dll", SetLastError = true)] + public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesRead); + + [DllImport("kernel32.dll")] + public static extern bool CloseHandle(IntPtr hObject); + + const int PROCESS_VM_READ = 0x0010; + const int PROCESS_QUERY_INFORMATION = 0x0400; + + // given "hl2" it will find the process ID for Counter Strike Source + static int getProcessID(string targetProcessName) { + Process[] processMain = Process.GetProcessesByName(targetProcessName); + + if (processMain.Length == 0) { + Console.WriteLine($"{targetProcessName}.exe wasn't found."); + return -1; + } + Console.WriteLine($"Process ID: {processMain[0].Id}, Process Name: {processMain[0].ProcessName}.exe"); // assume there is only 1 process + return processMain[0].Id; + } + + // If a dll is loaded from steamapps, check if it is the modulo from the function parameter + static int getModuleBaseAddress(int processID, string moduleName) { + Process process = Process.GetProcessById(processID); + foreach (ProcessModule module in process.Modules) { + if (module.FileName.Contains("steamapps") && module.ModuleName.EndsWith(moduleName, StringComparison.OrdinalIgnoreCase)) { + Console.WriteLine($"name = {module.FileName}, Base Address = 0x{module.BaseAddress.ToString("x")}"); + return module.BaseAddress.ToInt32(); + } + } + Console.WriteLine($"{moduleName} wasn't found."); + return 0; + } + + static (bool, int) ReadMemory32(int processID, int address) { + IntPtr hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, processID); + byte[] buffer = new byte[4]; + int bytesRead; + + if (ReadProcessMemory(hProcess, (IntPtr)address, buffer, (uint)buffer.Length, out bytesRead) && bytesRead == buffer.Length) { + int playerPointer = BitConverter.ToInt32(buffer, 0); + CloseHandle(hProcess); + return (true, playerPointer); + } + Console.WriteLine($"Failed to read memory on ProcessID: {processID} at address {address.ToString("x")}"); + CloseHandle(hProcess); + return (false, 0); + } + + static void Main(string[] args) + { + int CSS_id = getProcessID("hl2"); + if (CSS_id == -1) { return; } + + // Get location of Client.dll + int clientDllBaseAddress = getModuleBaseAddress(CSS_id, "client.dll"); + if (clientDllBaseAddress == 0) { return; } + + // Read player pointer location + int playerPointerLocation = clientDllBaseAddress + 0x4C88E8; + var infoFromRead = ReadMemory32(CSS_id, playerPointerLocation); + if (infoFromRead.Item1 == false) { return; } + Console.WriteLine($"Player Pointer Location: 0x{playerPointerLocation.ToString("x")}, Player Pointer: 0x{infoFromRead.Item2.ToString("x")}"); + + // Read health as a test + int healthAddress = infoFromRead.Item2 + 0x0094; + var healthFromRead = ReadMemory32(CSS_id, healthAddress); + if (healthFromRead.Item1 == false) { return; } + Console.WriteLine($"Health Address: 0x{healthAddress.ToString("x")}, Health: {healthFromRead.Item2}"); + } +} \ No newline at end of file diff --git a/components/CS_loadDLL/runner.csproj b/components/CS_loadDLL/runner.csproj new file mode 100644 index 0000000..2150e37 --- /dev/null +++ b/components/CS_loadDLL/runner.csproj @@ -0,0 +1,10 @@ + + + + Exe + net8.0 + enable + enable + + + diff --git a/components/runner.cpp b/components/runner.cpp deleted file mode 100644 index e69de29..0000000 diff --git a/doc/MemoryCSSource.md b/doc/MemoryCSSource.md index 414976c..366a167 100644 --- a/doc/MemoryCSSource.md +++ b/doc/MemoryCSSource.md @@ -2,47 +2,60 @@ | Offset | Type | Variable | Description | | --------------- | --------------- | -------------------- | -------------------- | -| engine.dll + 0x616A7 | 4 Byte Integer (Unsigned?) | sv_cheats | If not 0, you can change more parameters about the server running. THIS VALUE SHOWN IN THE TERMINAL IS SAVED ELSEWHERE | +| engine.dll + 0x0616A7 | 4 Byte Integer (Unsigned?) | sv_cheats | If not 0, you can change more parameters about the server running. THIS VALUE SHOWN IN THE TERMINAL IS SAVED ELSEWHERE | | engine.dll + 0x47C33C | 32 bit Float | m_angRotation | Handles Player's Camera in the "up/down" direction | | engine.dll + 0x47C340 | 32 bit Float | m_angRotation | Handles Player's Camera in the "left/right" direction | | engine.dll + 0x47C344 | 32 bit Float | m_angRotation | Handles Player's Camera in the "Illegal" direction | | engine.dll + 0x5EC82C | Integer | m_iNumPlayers | Number of players on the server. If larger than actual amount, a crash occurs. If lower and excluding bots, it can work but is unstable. If lower on a player, they are disconnected. | | -- | | | | | client.dll + 0x4C88E8 | 32 bit Pointer | m_dwLocalPlayer | Player Pointer to the user's current player | +| client.dll + 0x4D5AE4 | 1 6 byte struct. 32 bit pointer, and 12 other bytes | Array_Of_Players | Contains all players in the match in an array separated by 0x10 bytes each starting at this address. Fixed Size. Will only be allocated once at start of game to max player limit. | | client.dll + 0x4F5D24 | 1 Byte (Array Of Booleans) | m_dwForceJump | `2^0` bit will cause the player to simulate pressing the spacebar. So keeping the value at 1 won't work. `2^1` but is cleared often, but not sure on purpose, and `2^2` bit is usually always active, not sure on purpose either. All other bits are irrelevant. | | client.dll + 0x4F5D30 | 1 Byte (Array Of Booleans) | m_dwForceAttack | Same rules as `client.dll + 0x4F5D24` | -| client.dll + 0x4F5D6C | 1 Byte (Array Of Booleans) | m_dwForceReload | Same rules as `client.dll + 0x4F5D24` | | client.dll + 0x4F5D60 | 1 Byte (Array Of Booleans) | m_dwForceCrouch | Same rules as `client.dll + 0x4F5D24` | -| client.dll + 0x4D5AE4 | 16 byte struct. 32 bit pointer, and 12 other bytes | Array_Of_Players | Contains all players in the match in an array separated by 0x10 bytes each starting at this address. Fixed Size. Will only be allocated once at start of game to max player limit. | +| client.dll + 0x4F5D6C | 1 Byte (Array Of Booleans) | m_dwForceReload | Same rules as `client.dll + 0x4F5D24` | +| -- | | | | +| server.dll + 0x4F615C | 16 byte struct. 32 bit pointer, and 12 other bytes | Array_Of_players | Server-side array that contains all players in the match. look above for more info | +| server.dll + 0x4F750C | 16 byte struct. 32 bit pointer, and 12 other bytes | Array_Of_Weapons | Around here is the start of the array for every weapon in the game. To get pointer for weapon you picked up, use a breakpoint on `Server.dll + 275CE0` and pick it up| +| server.dll + 0x54EACC | 32 bit float | Pistol_Starting_Reserve | Starting Reserve ammo for 9x19MM Sidearm (maybe for all pistols??) | -# Player pointer +# Player Pointer (from client.dll) | Offset | Type | Variable | Description | | --------------- | --------------- | -------------------- | -------------------- | | + 0x0094 | 4 byte Integer | m_iHealth | health as displayed on screen (can't be changed though) | | + 0x009C | 4 byte Integer | m_iTeamNum | 0 if deciding, 1 Spectate, 2 Terrorist, 3 Counter Terrorist | +| + 0x00F4 | 4 Byte Float | X-pos Velocity | Velocity in X-pos. Not sure what units are. | +| + 0x00F8 | 4 Byte Float | Y-pos Velocity | Velocity in Y-pos. Not sure what units are. | +| + 0x00FC | 4 Byte Float | Z-pos Velocity | Velocity in Z-pos. Not sure what units are. | +| + 0x0290 | 4 Byte Float | X-position | Doesn't seem to be the same as the value in "cl_showpos", but only changes when x-position changes. | +| + 0x0294 | 4 Byte Float | Y-position | Doesn't seem to be the same as the value in "cl_showpos", but only changes when y-position changes. | +| + 0x0298 | 4 Byte Float | Z-position | Doesn't seem to be the same as the value in "cl_showpos", but only changes when z-position changes. | | + 0x0350 | Boolean (1 byte)| m_fFlags | 0 if in air, 1 if grounded, (2 if trying to un-crouch but environment prevents it?), 3 if un-crouching (not fully), 5 if crouching (not fully), 6 if crouched in air, 7 if fully crouched | +| + 0x0C56 | Array of 2 byte Integers (52 in length) | Reserve Ammo | An Array initially set to 0 in ever index. The weapon picked up in this slot index (look at 'Player Inventory') reserve ammo is stored here. Not sure why lengths don't match up...... | +| + 0x0CC0 | Array of 4 byte ?Values? (48 in length) | Player Inventory | An Array initially set to -1 in every index. The next picked up weapon takes the first slot that = -1 and puts a pointer to the weapon there. | +| + 0x0D80 | 3 bytes (booleans?)| Weapon Held | The three bytes here only change when swapping weapons. First byte seems to be Entity ID. Not sure on other two bytes | | + 0x0E48 | 4 Byte Float | m_vecPunchAngle | ???? Always 0 ?????? | | + 0x144C | 4 Byte Float | Total Flash Time | A float that increases per time flashed. If a strong flash it increases a lot (up to 10), if weak it increases less (like 2) | | + 0x1450 | 4 Byte Float | m_flFlashMaxDuration | Either 255 or 200. Not sure what it means | | + 0x1454 | 4 Byte Float | Last Flash's Strength | A float between 0-7 representing the strength of the flash | | + 0x14F0 | 4 byte Integer | m_iCrosshairId | ?? unchangeable ?? | -| + 0x0d80 | 3 bytes (booleans?)| Weapon Held | The three bytes here only change when swapping weapons. First byte seems to be Entity ID. Not sure on other two bytes | -| + 0xf4 | 4 Byte Float | X-pos Velocity | Velocity in X-pos. Not sure what units are. | -| + 0xf8 | 4 Byte Float | Y-pos Velocity | Velocity in Y-pos. Not sure what units are. | -| + 0xfC | 4 Byte Float | Z-pos Velocity | Velocity in Z-pos. Not sure what units are. | -| + 0x290 | 4 Byte Float | X-position | Doesn't seem to be the same as the value in "cl_showpos", but only changes when x-position changes. | -| + 0x294 | 4 Byte Float | Y-position | Doesn't seem to be the same as the value in "cl_showpos", but only changes when y-position changes. | -| + 0x298 | 4 Byte Float | Z-position | Doesn't seem to be the same as the value in "cl_showpos", but only changes when z-position changes. | -| + 0xCC0 | Array of 4 byte ?Values? (48 in length) | Player Inventory | An Array initially set to -1 in every index. The next picked up weapon takes the first slot that = -1 and puts a pointer to the weapon there. | -| + 0xC56 | Array of 2 byte Integers (52 in length) | Reserve Ammo | An Array initially set to 0 in ever index. The weapon picked up in this slot index (look at 'Player Inventory') reserve ammo is stored here. Not sure why lengths don't match up...... | -# Function in the code +# Weapon Pointer (from server.dll) -Client.dll + 0x189150 is a function run when switching weapons, picking them up, and dropping them +| Offset | Type | Variable | Description | +| --------------- | --------------- | -------------------- | -------------------- | +| + 0x570 | 4 byte Integer | Reserve Ammo | The reserve ammo within the weapon. 0 if held, set to a value once dropped | +# Function in the code -Server.dll + 0xC91C0 is a function run when reloading a gun (specifically when your reserve and magazine ammo swap) - + 0xC91DC - EDI value is weapon slot it takes up in player inventory? It changes what weapon actually loses its reserve ammo - - ESI is amount of ammo to remove - TO LOOK INTO: `mov eax,[ebx+edi*4+000006A4]` which gets the current weapons reserve ammo!!!!!!!!!!! \ No newline at end of file +| dll file | Offset | Information | +| -------- | ------ | ----------- | +| Client.dll | + 0x189150 | is a function run when switching weapons, picking them up, and dropping them | +| | | | +| Server.dll | + 0xC91C0 | is a function run when reloading a gun (specifically when your reserve and magazine ammo swap) | +| | + 0xC91DC | - EDI value is weapon slot it takes up in player inventory? It changes what weapon actually loses its reserve ammo
- ESI is amount of ammo to remove | +| | + N/A, line looks like following | `mov eax,[ebx+edi*4+000006A4]` is the same as `[Pointer value of player in server.dll + 0x4F615C] + (Weapon inventory slot within player * 4) + 0x6A4` | +| | | | +| Server.dll | + CA0B0 | is a function that deals with setting the reserve ammo for a weapon when dropping/picking one up | +| Server.dll | + 275CE0 | is a getter for the ammo within a weapon (at least when its on the ground and just picked up) | \ No newline at end of file