WHERE's awesome dynamic memory tutuorial

[zero_tolerance]

By WHERE

OK, ive got CS:S and tsearch (and vb6, but this can be any language really)

here goes nothing....

what we will need:

TSearch

in this tutorial we will be using tsearch's autohack to find the dynamic memory adress of sv_cheats (CS:S)

ok, now that, that is covered...moving on.

start TSearch.

Start CS:S. (make sure the console is enabled, -console in the launch options, or command line.)

find "hl2.exe"



in the CS:S console type "sv_cheats 9929" (no quotes, and on the options screen, not ingame...autohack crashes css for some reason while ingame ive found...the so autohack must be started BEFORE you go ingame, for future referance.)

now, in tsearch, search the "hl2.exe" for a value: 9929




some results will pop up, but to make certain we are choosing the right one, we will use random numbers to narrow it down so there should only be one.

in CS:S set sv_cheats to 2938

then search (use the next search function) and has changed to exact value "2938"




then once more set sv_cheats to 1337

search next -> exact value -> 1337

should only be ONE result by now.

put it into the right bar (click the addy two times) so its editable.

copy the adress to clipboard.

now, to start autohack.

enable the debugger, and autohack window.



a new window should come up.

click the little green arrow, and a new box should come up.



we will want to enter the adress we found in the edit box, then press "set"

(my adress was "153375C")



after we press "set" we will go back to css and set sv_cheats to whatever.

(lets say 293)

we go back to autohack and something new has happened....

do you see: Data BreakPoint at : 0x12989D0 DB5E2C fistp dword ptr [esi+0x2C]

in the console? or something similar?



either way the "esi+(your number)"

is the important part

in your program, it becomes part of an equation.

we do...

&H153375C - &H2C

from there it should return &H1533730 (you can also subtract in a scientific calulator)

add that adress to tsearch...



the value of that adress (for me) is:
21909068

now, search for that value in tsearch.

for one reason or another it returns 403 values.

there are many ways to solve this, trying once at a time, or saving the list and restarting the game.

either way i ended up with:
1533748 (with a value of 21909068)

now, back to the 0x2C

in your program, do (i have a module to simplify this, but..)
WriteDMADword &H1533748, &H2C, Hex(1)

which writes a dword (0x1533748 + 0x2C, to the value of one)

congrats! you have just enabled sv_cheats clientside.

(hope u enjoyed my leet paint skills .....)