daily pastebin goal
17%
SHARE
TWEET

Untitled

a guest Jan 23rd, 2018 46 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. int* base = (int*) dlopen("tf/bin/server.so", RTLD_LAZY);
  2. if(base == 0) {
  3.         Msg("[PLR] Could not find server.so\n");
  4.         return false;
  5. }
  6. dlclose((void*)base);
  7.  
  8. FILE* output = popen("nm tf/bin/server.so | grep _ZNK18CServerGameClients15GetPlayerLimitsERiS0_S0_", "r");
  9. if(output == NULL) {
  10.         Msg("[PLR] Could not parse server.so\n");
  11.         return false;
  12. }
  13.  
  14. char line [32];
  15. if(fgets(line, sizeof(line), output) == NULL) {
  16.         Msg("[PLR] Could not find GetPlayerLimits\n");
  17.         return false;
  18. }
  19. fclose(output);
  20.  
  21. int offset = strtoul(line, NULL, 16);
  22. if(offset == 0) {
  23.         Msg("[PLR] Failed to parse GetPlayerLimits address: %s\n", line);
  24.         return false;
  25. }
  26.  
  27. void (*GetPlayerLimits)(void*,int&,int&,int&) = (void(*)(void*,int&,int&,int&)) (*base + offset);
  28.  
  29. /*
  30. mov eax, [esp+8]
  31. mov dword [eax], 1
  32. mov eax, [esp+12]
  33. mov dword [eax], 255
  34. mov eax, [esp+16]
  35. mov dword [eax], 24
  36. ret
  37. */
  38.  
  39. char GetPlayerLimitsReplacement[] =
  40. "\x8b\x44\x24\x08\xc7\x00\x01\x00\x00\x00"
  41. "\x8b\x44\x24\x0c\xc7\x00\xff\x00\x00\x00"
  42. "\x8b\x44\x24\x10\xc7\x00\x18\x00\x00\x00"
  43. "\xc3";
  44.  
  45. unsigned int pagesize = sysconf(_SC_PAGE_SIZE);
  46. unsigned int pagemask = ~(pagesize-1);
  47. unsigned int page = (unsigned int)GetPlayerLimits;
  48.  
  49. Msg("%i\n", mprotect((void*)(page & pagemask), pagesize, PROT_READ|PROT_WRITE|PROT_EXEC));
  50. Msg("%x %x %i %i\n", page&pagemask, page, pagesize, sizeof(GetPlayerLimitsReplacement));
  51. memcpy((void*)GetPlayerLimits, (void*)GetPlayerLimitsReplacement, sizeof(GetPlayerLimitsReplacement));
  52.  
  53. int a = -1;
  54. int b = -2;
  55. int c = -3;
  56. GetPlayerLimits(0,a,b,c);
  57. Msg("Player Limits: %i %i %i\n", a,b,c);
RAW Paste Data
Top