Finding Virtual Offsets

Introduction

Finding virtual offsets provides us a way to access functions in the games that we otherwise would not be able access. Using either SDKCalls, Extentions, or MM:S Plugins, we can make use of these virtual offsets to give us a massive amount of functionality that is not included with Sourcemod out of the box.

For this example, you will need a copy of IDA Disassembler. We will be using IDA Pro 5.2 but any of the more recent versions should work fine. You will also need to grab this linux_vtable_dump.idc file and install it into your IDA/idc/ directory. Lastly, you will need to get a copy of the linux server file for the game you want to find the offsets for. This will generally be in the 'bin' directory of your game folder and the file will be named server_i486.so along with some other similar files.

Finding Offsets

Disassemble the Linux Server:

Now that your files are setup appropriately, you can start the IDA Disassembler. On the Welcome to IDA box that opens initially, you will want to click the "New" button. This will allow us to add a new file for it to disassemble. After you initially disassemble the file, you will be able to reload it without any hassle by using the 'Previous' button and selecting the file on this screen.

After you click the New Button, the application will open. It will prompt you to choose a specific type of file from a box, however you can just close this as we do not need it. The screen should now say "Drag a File Here to disassemble". Open your folder containing the server_i486.so and drag drop this file in now. This will start the disassembling process, and depending on hardware, can take anywhere from 15-30 minutes to completely finish.

Find the Virtual Table::

You will want to be in IDA View-A and make sure you can see both the IDA View-A window as well as the Names window to make this easier on yourself. For this example, we will be finding the Virtual Offset for the function CBasePlayer::ChangeTeam. Our first step is to locate this function in the Names window. (The search hotkey combination is Alt+T) Now once you find this function, in the Names window, double click it, and it should select a line in the IDA View-A window that looks something similar to this.