Finding virtual offsets - Revision history

Imlunalol: Fix the link title

2025-07-09T20:00:29Z

Fix the link title

Imlunalol: Replace the script link with an archive.org mirror

2025-07-09T19:57:41Z

Replace the script link with an archive.org mirror

Darthninja: /* Introduction */

2011-07-27T04:33:36Z

‎Introduction

Wazz: /* Finding Offsets */

2010-06-14T16:34:13Z

‎Finding Offsets

DaFox: /* Windows Info */

2009-07-21T01:51:26Z

‎Windows Info

DaFox at 01:51, 21 July 2009

2009-07-21T01:51:05Z

GH0sTy: /* Introduction */

2009-07-14T11:39:14Z

‎Introduction

Neico: /* Conclusion */

2008-12-03T14:10:29Z

‎Conclusion

DJ Tsunami: /* Introduction */

2008-12-01T10:44:00Z

‎Introduction

CrimsonGT at 03:07, 12 November 2008

2008-11-12T03:07:07Z

@@ Line 2: / Line 2: @@
 Finding virtual offsets provides us a way to access functions in the games that we otherwise would not be able access. Using either SDKCalls, Extensions, or MM:S Plugins, we can make use of these virtual offsets to give us a massive amount of functionality that is not included with Sourcemod out of the box.
-For this example, you will need a copy of IDA Disassembler. We will be using IDA Pro 5.2 but any of the more recent versions should work fine (will not work with the free version). You will also need to grab this [https://web.archive.org/web/20140529073108/https://hg.alliedmods.net/sourcemod-central/file/5f0dcfc72e44/editor/ida/linux_vtable_dump.idc] file and install it into your IDA/idc/ directory. Lastly, you will need to get a copy of the Linux server file for the game you want to find the offsets for. This will generally be in the 'bin' directory of your game folder and the file will be named server.so (use server_i486.so for older games that do not have server.so) along with some other similar files.
+For this example, you will need a copy of IDA Disassembler. We will be using IDA Pro 5.2 but any of the more recent versions should work fine (will not work with the free version). You will also need to grab this [https://web.archive.org/web/20140529073108/https://hg.alliedmods.net/sourcemod-central/file/5f0dcfc72e44/editor/ida/linux_vtable_dump.idc linux_vtable_dump.idc] file and install it into your IDA/idc/ directory. Lastly, you will need to get a copy of the Linux server file for the game you want to find the offsets for. This will generally be in the 'bin' directory of your game folder and the file will be named server.so (use server_i486.so for older games that do not have server.so) along with some other similar files.
 =Finding Offsets=

@@ Line 2: / Line 2: @@
 Finding virtual offsets provides us a way to access functions in the games that we otherwise would not be able access. Using either SDKCalls, Extensions, or MM:S Plugins, we can make use of these virtual offsets to give us a massive amount of functionality that is not included with Sourcemod out of the box.
-For this example, you will need a copy of IDA Disassembler. We will be using IDA Pro 5.2 but any of the more recent versions should work fine (will not work with the free version). You will also need to grab this [http://hg.alliedmods.net/sourcemod-central/file/5f0dcfc72e44/editor/ida/linux_vtable_dump.idc linux_vtable_dump.idc] file and install it into your IDA/idc/ directory. Lastly, you will need to get a copy of the Linux server file for the game you want to find the offsets for. This will generally be in the 'bin' directory of your game folder and the file will be named server.so (use server_i486.so for older games that do not have server.so) along with some other similar files.
+For this example, you will need a copy of IDA Disassembler. We will be using IDA Pro 5.2 but any of the more recent versions should work fine (will not work with the free version). You will also need to grab this [https://web.archive.org/web/20140529073108/https://hg.alliedmods.net/sourcemod-central/file/5f0dcfc72e44/editor/ida/linux_vtable_dump.idc] file and install it into your IDA/idc/ directory. Lastly, you will need to get a copy of the Linux server file for the game you want to find the offsets for. This will generally be in the 'bin' directory of your game folder and the file will be named server.so (use server_i486.so for older games that do not have server.so) along with some other similar files.
 =Finding Offsets=

@@ Line 2: / Line 2: @@
 Finding virtual offsets provides us a way to access functions in the games that we otherwise would not be able access. Using either SDKCalls, Extensions, or MM:S Plugins, we can make use of these virtual offsets to give us a massive amount of functionality that is not included with Sourcemod out of the box.
-For this example, you will need a copy of IDA Disassembler. We will be using IDA Pro 5.2 but any of the more recent versions should work fine (will not work with the free version). You will also need to grab this [http://hg.alliedmods.net/sourcemod-central/file/5f0dcfc72e44/editor/ida/linux_vtable_dump.idc linux_vtable_dump.idc] file and install it into your IDA/idc/ directory. Lastly, you will need to get a copy of the Linux server file for the game you want to find the offsets for. This will generally be in the 'bin' directory of your game folder and the file will be named server_i486.so along with some other similar files.
+For this example, you will need a copy of IDA Disassembler. We will be using IDA Pro 5.2 but any of the more recent versions should work fine (will not work with the free version). You will also need to grab this [http://hg.alliedmods.net/sourcemod-central/file/5f0dcfc72e44/editor/ida/linux_vtable_dump.idc linux_vtable_dump.idc] file and install it into your IDA/idc/ directory. Lastly, you will need to get a copy of the Linux server file for the game you want to find the offsets for. This will generally be in the 'bin' directory of your game folder and the file will be named server.so (use server_i486.so for older games that do not have server.so) along with some other similar files.
 =Finding Offsets=

@@ Line 37: / Line 37: @@
 File -> IDC File
-and browse to the linux_vtable_dump.idc file that we placed in the IDA directory earlier. Load this file and click OK, and it will now ask you to enter a number for VTable's entries to ingore indexing. We will leave this alone and just click OK again. It will run your IDC script file, and give you another dialog box. This time it wants you to choose the location for the dump file. Browse to your desktop, and enter anything for the File Name box, and click Save.
+and browse to the linux_vtable_dump.idc file that we placed in the IDA directory earlier. Load this file and click OK, and it will now ask you to enter a number for VTable's entries to ingore indexing. Setting this to 0 will output a file listing the exact Linux offsets, setting this to 1 will output a file which '''estimates''' the windows offsets (general rule is ''windows offset = linux offset - 1'' but this isn't always the case). It will run your IDC script file, and give you another dialog box. This time it wants you to choose the location for the dump file. Browse to your desktop, and enter anything for the File Name box, and click Save.
 You now have a text file on your desktop will all of the CBaseEntity offsets inside of it that you can use.

@@ Line 45: / Line 45: @@
 =Windows Info=
-[07:38pm] <DaFox> dvander word it in such a way that I can copy/paste it into the wiki
+ [07:38pm] <DaFox> dvander word it in such a way that I can copy/paste it into the wiki
-[07:38pm] <dvander> lol, i dunno if i can do that in IRC.  basically, there are two tricks
+ [07:38pm] <dvander> lol, i dunno if i can do that in IRC.  basically, there are two tricks
-[07:39pm] <dvander> the first is if you know assembly really well
+ [07:39pm] <dvander> the first is if you know assembly really well
-[07:39pm] <dvander> you can look at the SDK for a function that calls something you are interested in
+ [07:39pm] <dvander> you can look at the SDK for a function that calls something you are interested in
-[07:39pm] <dvander> find a string in that function, or a string in a function in its cross-reference graph
+ [07:39pm] <dvander> find a string in that function, or a string in a function in its cross-reference graph
-[07:40pm] <dvander> for the former case, find the same string in the windows binary and use the xref graph to find the right function
+ [07:40pm] <dvander> for the former case, find the same string in the windows binary and use the xref graph to find the right function
-[07:40pm] <dvander> for the latter case, say a function with a string in it calls the function that has what you want
+ [07:40pm] <dvander> for the latter case, say a function with a string in it calls the function that has what you want
-[07:40pm] <dvander> you find the first function, then read through it until you get to what you want
+ [07:40pm] <dvander> you find the first function, then read through it until you get to what you want
-[07:41pm] <dvander> once you have the actual function you're looking for
+ [07:41pm] <dvander> once you have the actual function you're looking for
-[07:41pm] <dvander> you use the xref graph to find its reference in the data section
+ [07:41pm] <dvander> you use the xref graph to find its reference in the data section
-[07:41pm] <dvander> it will be in a large table - the virtual table
+ [07:41pm] <dvander> it will be in a large table - the virtual table
-[07:41pm] <dvander> and you can compute its offset from the base of that table
+ [07:41pm] <dvander> and you can compute its offset from the base of that table
-[07:42pm] <dvander> the other trick is a bit easier, sometimes
+ [07:42pm] <dvander> the other trick is a bit easier, sometimes
-[07:42pm] <dvander> you compile the SDK on windows
+ [07:42pm] <dvander> you compile the SDK on windows
-[07:42pm] <dvander> turn on the MSVC feature that dumps assembly
+ [07:42pm] <dvander> turn on the MSVC feature that dumps assembly
-[07:42pm] <dvander> and poke around, using educated guessing
+ [07:42pm] <dvander> and poke around, using educated guessing

← Older revision		Revision as of 01:51, 21 July 2009
Line 43:		Line 43:

	That is all there is to it. Keep in mind that even though this is the Linux server file, the offsets listed in the dump file are for windows. You will just need to add +1 to these offsets to obtain the Linux offset. Make sure that you are using the Linux server file when you disassemble as well, because the Windows server does not have symbols or readable names, and you will not be able to find the offsets with it (unless you have the .pdb files for it, which only the Developers of the Game / Mod should have).		That is all there is to it. Keep in mind that even though this is the Linux server file, the offsets listed in the dump file are for windows. You will just need to add +1 to these offsets to obtain the Linux offset. Make sure that you are using the Linux server file when you disassemble as well, because the Windows server does not have symbols or readable names, and you will not be able to find the offsets with it (unless you have the .pdb files for it, which only the Developers of the Game / Mod should have).
		+
		+	=Windows Info=
		+	[07:38pm] <DaFox> dvander word it in such a way that I can copy/paste it into the wiki
		+	[07:38pm] <dvander> lol, i dunno if i can do that in IRC. basically, there are two tricks
		+	[07:39pm] <dvander> the first is if you know assembly really well
		+	[07:39pm] <dvander> you can look at the SDK for a function that calls something you are interested in
		+	[07:39pm] <dvander> find a string in that function, or a string in a function in its cross-reference graph
		+	[07:40pm] <dvander> for the former case, find the same string in the windows binary and use the xref graph to find the right function
		+	[07:40pm] <dvander> for the latter case, say a function with a string in it calls the function that has what you want
		+	[07:40pm] <dvander> you find the first function, then read through it until you get to what you want
		+	[07:41pm] <dvander> once you have the actual function you're looking for
		+	[07:41pm] <dvander> you use the xref graph to find its reference in the data section
		+	[07:41pm] <dvander> it will be in a large table - the virtual table
		+	[07:41pm] <dvander> and you can compute its offset from the base of that table
		+	[07:42pm] <dvander> the other trick is a bit easier, sometimes
		+	[07:42pm] <dvander> you compile the SDK on windows
		+	[07:42pm] <dvander> turn on the MSVC feature that dumps assembly
		+	[07:42pm] <dvander> and poke around, using educated guessing

← Older revision		Revision as of 14:10, 3 December 2008
Line 42:		Line 42:
	=Conclusion=		=Conclusion=

−	That is all there is to it. Keep in mind that even though this is the Linux server file, the offsets listed in the dump file are for windows. You will just need to add +1 to these offsets to obtain the Linux offset. Make sure that you are using the Linux server file when you disassemble as well, because the Windows server does not have symbols or readable names, and you will not be able to find the offsets with it.	+	That is all there is to it. Keep in mind that even though this is the Linux server file, the offsets listed in the dump file are for windows. You will just need to add +1 to these offsets to obtain the Linux offset. Make sure that you are using the Linux server file when you disassemble as well, because the Windows server does not have symbols or readable names, and you will not be able to find the offsets with it (unless you have the .pdb files for it, which only the Developers of the Game / Mod should have).

@@ Line 1: / Line 1: @@
 =Introduction=
-Finding virtual offsets provides us a way to access functions in the games that we otherwise would not be able access. Using either SDKCalls, Extentions, or MM:S Plugins, we can make use of these virtual offsets to give us a massive amount of functionality that is not included with Sourcemod out of the box.
+Finding virtual offsets provides us a way to access functions in the games that we otherwise would not be able access. Using either SDKCalls, Extensions, or MM:S Plugins, we can make use of these virtual offsets to give us a massive amount of functionality that is not included with Sourcemod out of the box.
-For this example, you will need a copy of IDA Disassembler. We will be using IDA Pro 5.2 but any of the more recent versions should work fine. You will also need to grab this [http://hg.alliedmods.net/sourcemod-central/file/5f0dcfc72e44/editor/ida/linux_vtable_dump.idc linux_vtable_dump.idc] file and install it into your IDA/idc/ directory. Lastly, you will need to get a copy of the linux server file for the game you want to find the offsets for. This will generally be in the 'bin' directory of your game folder and the file will be named server_i486.so along with some other similar files.
+For this example, you will need a copy of IDA Disassembler. We will be using IDA Pro 5.2 but any of the more recent versions should work fine. You will also need to grab this [http://hg.alliedmods.net/sourcemod-central/file/5f0dcfc72e44/editor/ida/linux_vtable_dump.idc linux_vtable_dump.idc] file and install it into your IDA/idc/ directory. Lastly, you will need to get a copy of the Linux server file for the game you want to find the offsets for. This will generally be in the 'bin' directory of your game folder and the file will be named server_i486.so along with some other similar files.
 =Finding Offsets=

← Older revision		Revision as of 03:07, 12 November 2008
Line 28:		Line 28:


−	[[Image:Ida ~~changeteamscreen~~.png]]	+	[[Image:Ida crossjump.png]]
		+
		+
		+	'''Save the Virtual Table file:''':
		+
		+	Now double click the line that says `vtable for'CBasePlayer and you will be brought back to the IDA View-A window. This time your cursor will be on the line with the VTable information. You have now successfully located the file you need, and you are ready to get the offsets. Making sure that your cursor is still somewhere in that line, go to...
		+
		+	File -> IDC File
		+
		+	and browse to the linux_vtable_dump.idc file that we placed in the IDA directory earlier. Load this file and click OK, and it will now ask you to enter a number for VTable's entries to ingore indexing. We will leave this alone and just click OK again. It will run your IDC script file, and give you another dialog box. This time it wants you to choose the location for the dump file. Browse to your desktop, and enter anything for the File Name box, and click Save.
		+	You now have a text file on your desktop will all of the CBaseEntity offsets inside of it that you can use.
		+
		+	=Conclusion=
		+
		+	That is all there is to it. Keep in mind that even though this is the Linux server file, the offsets listed in the dump file are for windows. You will just need to add +1 to these offsets to obtain the Linux offset. Make sure that you are using the Linux server file when you disassemble as well, because the Windows server does not have symbols or readable names, and you will not be able to find the offsets with it.