[Tutorial] Reversing Console Commands [UNDETECTED]

[Big Dave]

This is a pretty easy way to reverse console commands. And since it's modifying the .data section of the game code it should be 100% undetected. (Unless VAC start doing CVAR consistency checks)

NOTE: BY FOLLOWING THIS TUTORIAL YOU ARE AGREEING TO POST EVERY SINGLE ADDRESS YOU FIND. OR FACE TEH LAW. Lols not really. But it would be great and very kind of you if you could. I'll rep you for it

Apps used.
1. L.Spiro's Memory Hacking Software. HERE
2. OllyDBG HERE
3. A compiler HERE


First things first, as there is no console you need to use your own way to send commands to the game. Like this..

As most commands are cheat protected you need to remove that protection. There are 2 you need to remove.

Read/Write/Cheat protected
00646009  |. 83F8 01        CMP EAX,1

To

00646009  |. 83F8 00        CMP EAX,0

AND

"%s cannot be changed" 
006461F1  |. 74 47          JE SHORT 172_iw4m.0064623A

To

006461F1  |. EB 47          JMP SHORT 172_iw4m.0064623A

In C++ that would be:

Assign key
Patch protections
Do command
Unpatch protections

Then to set it back to normal do the same


if(GetAsyncKeyState(VK_F1)&1) //sets fog off
{
    WriteProcessMemory(GetCurrentProcess(),(void*)0x0064600B,(PBYTE)"\x00",1,0);
    WriteProcessMemory(GetCurrentProcess(),(void*)0x006461F1,(PBYTE)"\xEB",1,0);

    SendCommandToConsole(1,1,"r_fog 0");

    WriteProcessMemory(GetCurrentProcess(),(void*)0x6461F1,(PBYTE)"\x74",1,0);
    WriteProcessMemory(GetCurrentProcess(),(void*)0x64600B,(PBYTE)"\x01",1,0);
}
if(GetAsyncKeyState(VK_F2)&1) //sets fog on
{
    WriteProcessMemory(GetCurrentProcess(),(void*)0x0064600B,(PBYTE)"\x00",1,0);
    WriteProcessMemory(GetCurrentProcess(),(void*)0x006461F1,(PBYTE)"\xEB",1,0);

    SendCommandToConsole(1,1,"r_fog 1");

    WriteProcessMemory(GetCurrentProcess(),(void*)0x6461F1,(PBYTE)"\x74",1,0);
    WriteProcessMemory(GetCurrentProcess(),(void*)0x64600B,(PBYTE)"\x01",1,0);
}

Compile that in a DLL and start MW2. Then also start up MHS and file > open process and attach it to iw4mp.exe

Go into a PRIVATE SERVER!!! then go back into MHS. Press the first magnifying glass under found addresses. Make sure the data type is Byte and the value is 1. Press OK.

Go back into MW2 and press F1 (Setting the fog to 0)

Go back into MHS and this time press the button with the 2 magnifying glasses (the second one) make sure the value to find is 0 and search type is Exact Value.

Then go back to MW2 and press F2 (Setting the fog to 1)

Go back into MHS and do the same as before but this time set the value to find to 1.

Repeat this over and over until you're left with just a few values. If one of them is 064xxxx0 then you've found what you're looking for. There should be 2 ALWAYS take the first which should be -10 bytes from the second one. If there is more than 2 add them all to the right window. If there is way more than than 2 or so keep searching.

Right click the value you have on the right and click modify selected enter 0 as your "Cur Value" and click OK.

Go back to MW2 and see if the fog has gone. If so then you have found the address you need. YAY

To use those addresses in a C++ project do this

*(__int8*)0xaddress = 0; //rfog 0

*(__int8*)0xaddress = 1; //rfog 1

That's it really. Some commands are 4 bytes long and some are floats. Up to you to figure it out. Basically if you are able to set a value to higher than 255 it's not 1 byte long.
Also before anyone comments on why I patch the cvar protections then unpatch them straight after sending the command it's because i'm unsure if VAC is enabled in private servers. Also Steam complains when changing servers if any of the .code memory is edited.


And finally. CODE!!!111one

#include <windows.h> 
//cg_forcelaseron 0/1 
bool Laser = false;
DWORD WINAPI MyThread(LPVOID) 
{ 
	for(;;Sleep(200)) 
	{
		if(GetAsyncKeyState(VK_F1)&1) Laser =! Laser; 
		if(Laser)*(__int8*)0x640AF40 = 1; 
		if(!Laser)*(__int8*)0x640AF40 = 0; 
	}
	return 0; 
}

BOOL WINAPI DllMain( HMODULE hMod, DWORD dwReason, LPVOID lpvReserved ) 
{ 
	if( dwReason == DLL_PROCESS_ATTACH ) 
	{             
		CreateThread( 0, 0, MyThread, 0, 0, 0 ); 
		return TRUE; 
	} 
	return FALSE; 
}

Reveal the spoiler if you are too lazy and want to see the ones I currently have. (will result in me hating you.)

If you're reading this I AM DISAPPOINTED!

 *(__int8*)0x6404FF0 = 0; //shellshock
 *(__int8*)0x640AF40 = 1; //forcelaser
 *(__int8*)0x6406490 = 1; //con_minicon
//  *(float*)0x6407D90 = 1.0f; //radarjamdistmax (doesn't work)
//  *(float*)0x6407D40 = 800.0f; //radarjamdistmin (doesn't work)
 *(__int8*)0x64010D0 = 0; //rfog
 *(__int8*)0x64038D0 = 0; //fxdraw
*(__int32*)0x6406B20 = 0; //enemytagfadein
*(__int32*)0x6406B70 = 999999; //enemytagfadeout (sorta works. The tag disappears when they die.)
 *(__int8*)0x6406C60 = 1; //drawfriendlytagsthruwalls
 *(__int8*)0x64095A0 = 1; //enemycompassenabled

If that makes no sense to anyone it's possibly because it's almost 2AM and i'm tired as shit

[Mack R]

Very nice tutorial, thanks for the share.

[Sfab1]

once again great tutorial with nice explanations by Big Dave

+reps

[Alkatraz]

Nice tutorial dave, very well written. I am actually going ahead and getting the game for shits n giggles. Anyways props man

! L0v3 ur l33t c0de, !t !$ $0 und3t3ct@bl3. N0 @C Can catch this sh!t. Props bish
ps... martin sucks

[smaller]

i dunno much about COD6 but the spaghetti look tasty. +rep

[x2v]

Nice reverse :=)..+rep

ps;anyone has the box esp offset?:/

[ReUnioN]

Good work dave! Think this would fit into the topic. If not move it into a new thread pls.

I've tried finding a sig to access some cvars dynamically cause of the stupid updates.
Therefore i put a memory bp on access at the cvars address e.G. 640AF40 for forceLaserOn

//forceLaserOn 640AF40 is the addy

00483EE0   A1 508A7D00      MOV EAX,DWORD PTR DS:[7D8A50]
00483EE5   8A40 10          MOV AL,BYTE PTR DS:[EAX+10]

This came up.. 7D8A50 is what i searched for..

After i fired up ida and searched for the value 7D8A50. Following came up

.text:00445870                 push    offset aForceLaserSigh ; "Force laser sights on in all possible p"...
.text:00445875                 push    4
.text:00445877                 push    0
.text:00445879                 push    offset aLaserforceon ; "laserForceOn"
.text:0044587E                 call    sub_4DCBB0
.text:00445883                 fld     ds:flt_724CEC
.text:00445889                 add     esp, 10h
.text:0044588C                 push    offset aTheMaximumRang ; "The maximum range of a laser beam"
.text:00445891                 push    4               ; int
.text:00445893                 sub     esp, 0Ch
.text:00445896                 fstp    [esp+14h+var_C]
.text:0044589A                 mov     dword_7D8A50, eax        <- here

If we put a nicely signature on the track we could access our cvar as long as the signature fits.
Havnt tried it yet due i am limited @ time atm but wouldnt that method even work after an gameupdate?

Could somebody updload an old version of the iw4mp.exe so i can have a look if the cvar addresses are
accessed through the same way?


Here are some other researches

//r_fog                64010D0 is the addy

0054F84E   8B15 5CDB9E06    MOV EDX,DWORD PTR DS:[69EDB5C]           ; iw4mp.06401DE0
0054F854   807A 10 00       CMP BYTE PTR DS:[EDX+10],0

.text:005116D0                 sub     esp, 18h
.text:005116D3                 movzx   ecx, word ptr [ecx]
.text:005116D6                 mov     edx, [esp+18h+arg_0]
.text:005116DA                 push    ebx
.text:005116DB                 push    ebp
.text:005116DC                 push    esi
.text:005116DD                 mov     esi, dword_69EDB5C        <- here



//conMinicon            6406490 is the addy

0043000B   8B15 ACA37E00    MOV EDX,DWORD PTR DS:[7EA3AC]            ; iw4mp.06406480
00430011   807A 10 00       CMP BYTE PTR DS:[EDX+10],0

.text:00419A1A                 push    0
.text:00419A1C                 push    0
.text:00419A1E                 mov     dword_9F8E78, eax
.text:00419A23                 push    offset aCon_minicon ; "con_minicon"
.text:00419A28                 call    sub_4DCBB0
.text:00419A2D                 fld     ds:flt_724CEC
.text:00419A33                 add     esp, 40h
.text:00419A36                 push    offset aTheMinimumTime ; "The minimum time that the subtitles are"...
.text:00419A3B                 push    1               ; int
.text:00419A3D                 sub     esp, 0Ch
.text:00419A40                 fstp    [esp+14h+var_C]
.text:00419A44                 mov     dword_7EA3AC, eax        <- here



//drawfriendlytagsthruwalls    6406C60 is the addy 

004B953C   A1 2CA19B01      MOV EAX,DWORD PTR DS:[19BA12C]
004B9544   8078 10 00       CMP BYTE PTR DS:[EAX+10],0

.text:00496110                 mov     eax, dword_19BA12C        <- here
.text:00496115                 cmp     byte ptr [eax+10h], 0
.text:00496119                 push    esi
.text:0049611A                 mov     esi, [esp+4+arg_0]
.text:0049611E                 jz      short loc_496147
.text:00496120                 mov     ecx, [esi+158h]
.text:00496126                 mov     edx, dword_1A80054
.text:0049612C                 mov     [ecx+314Ch], edx
.text:00496132                 mov     eax, [esi+158h]
.text:00496138                 add     eax, 314Ch

[uNrEaL]

Originally Posted by ReUnioN

Good work dave! Think this would fit into the topic. If not move it into a new thread pls.

I've tried finding a sig to access some cvars dynamically cause of the stupid updates.
Therefore i put a memory bp on access at the cvars address e.G. 640AF40 for forceLaserOn

//forceLaserOn 640AF40 is the addy

00483EE0   A1 508A7D00      MOV EAX,DWORD PTR DS:[7D8A50]
00483EE5   8A40 10          MOV AL,BYTE PTR DS:[EAX+10]

This came up.. 7D8A50 is what i searched for..

After i fired up ida and searched for the value 7D8A50. Following came up

.text:00445870                 push    offset aForceLaserSigh ; "Force laser sights on in all possible p"...
.text:00445875                 push    4
.text:00445877                 push    0
.text:00445879                 push    offset aLaserforceon ; "laserForceOn"
.text:0044587E                 call    sub_4DCBB0
.text:00445883                 fld     ds:flt_724CEC
.text:00445889                 add     esp, 10h
.text:0044588C                 push    offset aTheMaximumRang ; "The maximum range of a laser beam"
.text:00445891                 push    4               ; int
.text:00445893                 sub     esp, 0Ch
.text:00445896                 fstp    [esp+14h+var_C]
.text:0044589A                 mov     dword_7D8A50, eax        <- here

If we put a nicely signature on the track we could access our cvar as long as the signature fits.
Havnt tried it yet due i am limited @ time atm but wouldnt that method even work after an gameupdate?

Could somebody updload an old version of the iw4mp.exe so i can have a look if the cvar addresses are
accessed through the same way?


Here are some other researches

//r_fog                64010D0 is the addy

0054F84E   8B15 5CDB9E06    MOV EDX,DWORD PTR DS:[69EDB5C]           ; iw4mp.06401DE0
0054F854   807A 10 00       CMP BYTE PTR DS:[EDX+10],0

.text:005116D0                 sub     esp, 18h
.text:005116D3                 movzx   ecx, word ptr [ecx]
.text:005116D6                 mov     edx, [esp+18h+arg_0]
.text:005116DA                 push    ebx
.text:005116DB                 push    ebp
.text:005116DC                 push    esi
.text:005116DD                 mov     esi, dword_69EDB5C        <- here



//conMinicon            6406490 is the addy

0043000B   8B15 ACA37E00    MOV EDX,DWORD PTR DS:[7EA3AC]            ; iw4mp.06406480
00430011   807A 10 00       CMP BYTE PTR DS:[EDX+10],0

.text:00419A1A                 push    0
.text:00419A1C                 push    0
.text:00419A1E                 mov     dword_9F8E78, eax
.text:00419A23                 push    offset aCon_minicon ; "con_minicon"
.text:00419A28                 call    sub_4DCBB0
.text:00419A2D                 fld     ds:flt_724CEC
.text:00419A33                 add     esp, 40h
.text:00419A36                 push    offset aTheMinimumTime ; "The minimum time that the subtitles are"...
.text:00419A3B                 push    1               ; int
.text:00419A3D                 sub     esp, 0Ch
.text:00419A40                 fstp    [esp+14h+var_C]
.text:00419A44                 mov     dword_7EA3AC, eax        <- here



//drawfriendlytagsthruwalls    6406C60 is the addy 

004B953C   A1 2CA19B01      MOV EAX,DWORD PTR DS:[19BA12C]
004B9544   8078 10 00       CMP BYTE PTR DS:[EAX+10],0

.text:00496110                 mov     eax, dword_19BA12C        <- here
.text:00496115                 cmp     byte ptr [eax+10h], 0
.text:00496119                 push    esi
.text:0049611A                 mov     esi, [esp+4+arg_0]
.text:0049611E                 jz      short loc_496147
.text:00496120                 mov     ecx, [esi+158h]
.text:00496126                 mov     edx, dword_1A80054
.text:0049612C                 mov     [ecx+314Ch], edx
.text:00496132                 mov     eax, [esi+158h]
.text:00496138                 add     eax, 314Ch

Just a side note on how he's getting the value that Dave is getting, while using OllyDbg to get the address:

This can be done through code, as I've just explained to Dave via IRC. *( PDWORD )0x19BA12C (for the last example), will return the address that Dave's method is finding. As such:

*( PBYTE )*( PDWORD )0x19BA12C = 1;

This does it all automatically. However, I would recommend doing some checks to make sure that the pointer is valid, before you go nuts and start modifying. Meaning:

if ( *( PDWORD )0x19BA12C )
	*( PBYTE )*( PDWORD )0x19BA12C = 1;

[Big Dave]

Originally Posted by uNrEaL

Just a side note on how he's getting the value that Dave is getting, while using OllyDbg to get the address:

This can be done through code, as I've just explained to Dave via IRC. *( PDWORD )0x19BA12C (for the last example), will return the address that Dave's method is finding. As such:

*( PBYTE )*( PDWORD )0x19BA12C = 1;

This does it all automatically. However, I would recommend doing some checks to make sure that the pointer is valid, before you go nuts and start modifying. Meaning:

if ( *( PDWORD )0x19BA12C )
	*( PBYTE )*( PDWORD )0x19BA12C = 1;

Yeah. It was all a deep thought out plan to manipulate the pros into finding a better and much easier way to do it. I SUCCEEDED
Thanks guys. Will save me (and everyone) alot of time.

[DjOsiris]

Originally Posted by Big Dave

Yeah. It was all a deep thought out plan to manipulate the pros into finding a better and much easier way to do it. I SUCCEEDED
Thanks guys. Will save me (and everyone) alot of time.

don't you just love it when a plan comes together? ahaha the good ol a-team

[ReUnioN]

Originally Posted by Big Dave

Yeah. It was all a deep thought out plan to manipulate the pros into finding a better and much easier way to do it. I SUCCEEDED
Thanks guys. Will save me (and everyone) alot of time.

I wouldnt have found these without ur tutorial man.. U lay down the basics

[win_]

hey this looks nice, im trying to do this myself, but it doesnt seem to work when im disabling the protection.

first, im using ollybdg obviously to find the lines you specified, this is pretty much my first time ever getting into "hacking" games so i tried real hard to comprehend, so what i got was that there were columns im suppose to match up in my iw4mp.exe that i opend with ollydbg.

so first, i look for the first column "00646009", i got close, infact so close at 00646000 all the way to 00646010, it has almost everything in between except the 9 in the last digit...

so i instead try looking to match the third column, i first search for referenced strings called "cheat protected" which i found, so i look all around those lines and find two that match up both of the last columns (first one didnt match as i already tried looking and couldnt find that column number at all), i change the letters and numbers like you said from 1 to 0.

then i went to change the "%s cannot be changed". i pretty much followed the same process and found:

CPU Disasm
Address Hex dump Command Comments
00646C71 /74 47 JE SHORT 00646CBA

as you can see it matches pretty well except the first and last column, i couldnt find anything around the referenced string "cannot be changed" with what you specified: "172_iw4m.0064623A" it matches the je short, but the numbers and letters after that obviously dont match...

so i changed it to JMP anyway, and coincidentally the 74 47 changes to EB 47 like you said it should too

not completely satisfied i try debugging anyway, and without a doubt it it froze up when it started running...

what am i doing wrong?

and btw, apparently my .exe has a console that opens up when i run? im actually using a cracked version of the game i got from thepiratebay (lol), so idk if thats any different.

with that said as well, would i need to send commands to the game via c++ even though i already have a console in which i can send commands directly?

heres of pic of the console :S


anyway, im pretty damn new at this sorry if im doing anything wrong, if you could (as i will myself) get me started with this hacking stuff? is there anything i should read prior to doing this tut? because obviously its missing lots of info i had to figure out myself

[adolfososa]

I'm sorry if I sound way too noobish here but where do I have to put the first code in the .dll project in C++?

[Darryl1610]

Thanks alot for this Tutorial Gonna try it out now.

[sugarlp]

Thanks Dave! You really now how to explain stuff

For anyone interested, current (1.2.208) offsets for disabling Dvars protection:

DWORD dvarsReadWriteCheat = 0x00647A09;
DWORD dvarsCannotBeChanged = 0x00647BF1;
BYTE onDvarsReadWriteCheat[3] = {0x83, 0xF8, 0x00};
BYTE offDvarsReadWriteCheat[3] = {0x83, 0xF8, 0x01};
BYTE onDvarsCannotBeChanged[2] = {0xEB,0x47};
BYTE offDvarsCannotBeChanged[2] = {0x74,0x47};

[-swift-]

Very nice man much props and yes that pasta looks yummy..;..

[sugarlp]

I'm gonna update this list with new offsets as I go:

DWORD laserForceOn = 0x646E7B0; //byte
DWORD cg_fov = 0x60684A0;  //float
DWORD cg_drawDamageFlash = 0x60688B0; //byte
DWORD cg_drawShellshock = 0x6068860; //byte
DWORD cg_drawCrosshair = 0x6057240; //byte

Anything else interesting I should find?