Hello. :)
Wanna show you how to reverse functions in S4 League.
So let's get started;
First you need the address of the pre-kickvote processing function,
which is located in some class(__thiscall). I found out that it's not a vtable entry, so that's not so good because with vftables you can always grab your functions easier.
[Only registered and activated users can see links. Click Here To Register...]
this is the actual kickvote interface invoke, which is ofc in the processing function. you can see it takes five arguments (this ptr, 0x1, an address constant, and eax which is 0x0).
Let's first see how those parameters are accomplished;
- first the this* is passed from another function to this one, then it's going to be copied into a local variable and then processed within another function:
after that the kickvote invoke function ist just called and the function returns 1.
So to get all arguments just follow this:
1. execute sub_562180 with following arguments (0E6D7080h(ds:dword_165E6A0), first passed arg. and second passed argument to the processing function(arg_0 and arg_4 NOT THIS PTR).
2. execute sub_E552E0 and save result into some variable (passed this ptr to processing function)
3. kick invoke implementation:
[For v5 use the result from step 2, then pass 1, then pass just 0]
To gather the this ptr from the processing function just hook it:
(in your hook)
or you can also grab it from the stack because it was pushed before.
just calculate yourself where it should be on the stack.
the class ptr is always saved into the ecx register in case of __thiscall
then you can just make a typdef and invoke it :)
Wanna show you how to reverse functions in S4 League.
So let's get started;
First you need the address of the pre-kickvote processing function,
which is located in some class(__thiscall). I found out that it's not a vtable entry, so that's not so good because with vftables you can always grab your functions easier.
[Only registered and activated users can see links. Click Here To Register...]
PHP Code:
.text:00E5FB12 push eax
.text:00E5FB13 lea ecx, [ebp+arg_0]
.text:00E5FB16 push ecx
.text:00E5FB17 push offset dword_1642368
.text:00E5FB1C push 1
.text:00E5FB1E mov edx, [ebp+var_10]
.text:00E5FB21 mov eax, [edx]
.text:00E5FB23 mov ecx, [ebp+var_10]
.text:00E5FB26 mov edx, [eax+20h]
.text:00E5FB29 call edx
Let's first see how those parameters are accomplished;
- first the this* is passed from another function to this one, then it's going to be copied into a local variable and then processed within another function:
PHP Code:
int __thiscall sub_E552E0(void *this)
{
return (int)((char *)this + 84);
}
So to get all arguments just follow this:
1. execute sub_562180 with following arguments (0E6D7080h(ds:dword_165E6A0), first passed arg. and second passed argument to the processing function(arg_0 and arg_4 NOT THIS PTR).
2. execute sub_E552E0 and save result into some variable (passed this ptr to processing function)
3. kick invoke implementation:
PHP Code:
(*(void (__thiscall **)(int, signed int, _DWORD, int *, char *))(*(_DWORD *)v5 + 32))(v5, 1, dword_1642368, &a2, &a4);
To gather the this ptr from the processing function just hook it:
(in your hook)
PHP Code:
__asm {
mov temp_value,ecx
}
just calculate yourself where it should be on the stack.
the class ptr is always saved into the ecx register in case of __thiscall
then you can just make a typdef and invoke it :)
PHP Code:
typedef void (__thiscall** invoke_Kick_t)(int, signed int, DWORD, int*, char*);
invoke_Kick_t invoke_Kick_p = (*(void(__thiscall **)(int,signed int,DWORD,int*,char*))(*(DWORD*)processed_this + 0x20));
