Latest update breaks hack

[lordflacko]

The hack fails with this message:

Found client_client.so [e713b000]
Unable to find glow pointer call reference

[lordflacko]

Patch set in question:

https://www.reddit.com/r/GlobalOffensive/comments/3scfmp/counterstrike_global_offensive_update_for_111015/

[foreverska]

Confirmed. Anyone have access to an unpatched copy of the game? Likelihood the bulk of the code is the same and the signature is all that needs updating.

[ericek111]

Same here. Yep, it only needs to fix searched signature.

[bryantwilliam]

Anyone have access to an unpatched copy of the game?

What do I do if we do have access? I think my other computer has the last version of csgo on it. I don't think it's been updated.

[laazyboy13]

What do I do if we do have access? I think my other computer has the last version of csgo on it. I don't think it's been updated.

I sent an email to your email. gogobebe2@gmail.com. from laazyboy13@gmail.com

But can you upload the client_client.so file located at "csgo dir"/csgo/bin/client_client.so ?
Need that file to find the old offset to make it easier to find the new offset and build a new sig for it.

Doesn't need to be exactly last version. Any version from Feb '15 till before this last patch is fine.

[bryantwilliam]

Just to check, where can I see what version of csgo I have?

[foreverska]

Uploading client_client.so would be very nice. Although WITH STEAM IN OFFLINE MODE you could try running the exploit and seeing if it still finds the function. Just join a game with bots. If so a quick little hack that may lead to something would be to output the code directly after the signature. I wrote some quick code which appears to work tested on an different signature (my .so is patched so it's useless on my machine). Starting with remote.cpp:29 (should be, the if statement should line up) replace the if statement with:

if(matches == len) {
    printf("\n\nDebug Output:\n\n");
    for(int i = 0; i < readsize-b; i++)
    {
         printf("%x ",(unsigned char)buffer[b+i]);
     }
     printf("\n\n");
     return (char*) (readaddr + b);
}

If they haven't changed the actual function we may be able to use the code directly after the signature, search for it in the new patch and get a similar signature from just before it.

[laazyboy13]

Just to check, where can I see what version of csgo I have?

Steam client -> Library -> CSGO -> rclick -> properties -> local files

853433 is what mine shows, but that's with the latest patch.

Or you can also run "ls -lt client_client.so" and it'll dump you the last modified date.

Start up CSGO and try to join a casual game, I don't think you can if you have an outdated version.

That'll warrant an unintended update. Unless steam is in offline mode. Since the update isn't optional, its required.

Uploading client_client.so would be very nice. Although WITH STEAM IN OFFLINE MODE you could try running the exploit and seeing if it still finds the function. Just join a game with bots. If so a quick little hack that may lead to something would be to output the code directly after the signature. I wrote some quick code which appears to work tested on an different signature (my .so is patched so it's useless on my machine). Starting with remote.cpp:29 (should be, the if statement should line up) replace the if statement with:

if(matches == len) {
    printf("\n\nDebug Output:\n\n");
    for(int i = 0; i < readsize-b; i++)
    {
         printf("%x ",(unsigned char)buffer[b+i]);
     }
     printf("\n\n");
     return (char*) (readaddr + b);
}

If they haven't changed the actual function we may be able to use the code directly after the signature, search for it in the new patch and get a similar signature from just before it.

Yeah, dumping the bytes is nice. Also the glow_object struct has increased in size from 0x34 to 0x38.

         void*           m_pEntity;                      //0000
         float           m_flGlowRed;                    //0004
         float           m_flGlowGreen;                  //0008
         float           m_flGlowBlue;                   //000C
         float           m_flGlowAlpha;                  //0010
         unsigned char   unk0;                           //0014
         unsigned char   unk1[3];                        //0015 (align padding)
         float           m_flUnknown;                    //0018
         float           m_flBlurAmount;                 //001C
         unsigned int    unk2;                           //0020
         bool            m_bRenderWhenOccluded : 8;      //0024
         bool            m_bRenderWhenUnoccluded : 8;    //0025
         bool            m_bFullBloomRender : 8;         //0026
         unsigned char   unk5;                           //0027 (align padding?)
         int             m_nFullBloomStencilTestValue;   //0028
         int             m_nSplitScreenSlot;             //002C
         int             m_nNextFreeSlot;                //0030
         unsigned char   unk6[4];                        //0038

//        void*              m_pEntity;
//        float              m_flGlowRed;
//        float              m_flGlowGreen;
//        float              m_flGlowBlue;
//        float              m_flGlowAlpha;
//        uint8_t            unk0[16];
//        bool               m_bRenderWhenOccluded : 8;
//        bool               m_bRenderWhenUnoccluded : 8;
//        bool               m_bFullBloomRender : 8;
//        unsigned char      unk1;
//        int                m_nFullBloomStencilTestValue;
//        int                m_nSplitScreenSlot;
//        int                m_nNextFreeSlot;
//        unsigned char      unk2[4];

The commented out struct description works, i just left it there when i was testing some stuff from before.

[frozen794]

That'll warrant an unintended update. Unless steam is in offline mode. Since the update isn't optional, its required.

I completely forgot about that, forget my idea.

[bryantwilliam]

Holy shit, I left my computer running for 1 hour and my sister thought it was a cool idea to do a small botmatch and update the client. Fuck...

[laazyboy13]

Holy shit, I left my computer running for 1 hour and my sister thinks it's a cool idea to do a small botmatch. Fuck...

Well rip having a backup of the old path. Hopefully someone else might have it. Downloading the windows csgo so i can see how much the function changed. (Have a backup for the last windows version client.dll) And see if i can just guesstimate what might have changed in the linux client_client.so

what file do you need?

[laazyboy13]

what file do you need?

Would be client_client.so

"csgo dir"/csgo/bin/client_client.so

Would like for backup and to double check. But I have a nice present for you guys.
https://i.imgur.com/RHKmQhp.png

        void*              m_pEntity;
        float              m_flGlowRed;
        float              m_flGlowGreen;
        float              m_flGlowBlue;
        float              m_flGlowAlpha;
        uint8_t            unk0[16];
        bool               m_bRenderWhenOccluded : 8;
        bool               m_bRenderWhenUnoccluded : 8;
        bool               m_bFullBloomRender : 8;
        unsigned char      unk1;
        int                m_nFullBloomStencilTestValue;
        int                m_nSplitScreenSlot;
        int                m_nNextFreeSlot;
        unsigned char      unk2[4];

Use that for the GlowObjectDefinition_t struct. Haven't tinkered with fixing the old struct, just used the test one I had, as it works.

//New Sig as of 11/10/15
Sig: \xE8\x00\x00\x00\x00\x8B\x78\x14\x6B\xD6\x38
Mask: x????xxxxxx

Have fun cheating with no VAC. God I love valve for being too stupid to actually make VAC for linux. Working on seeing if I can spoof being a linux client on windows, but first gotta figure out if the data is pulled from the Steam client, ingame, or both. That'd be some fun shit.

[foreverska]

Man how'd you find that? Let's get a patch rolling and I'll test it tonight.

+1 for laazyboy13

[laazyboy13]

Man how'd you find that? Let's get a patch rolling and I'll test it tonight.

+1 for laazyboy13

I'll be pushing the patch to my forked version of the repo, with a few extra netvar class functions and few other things. Not super important really though.

And I got the struct update from someone who mentioned it was a 4 byte increase, so I just cleaned up the struct when updating it.

As for the sig, I had a suspicion that there wasn't much changed in terms of last patch to current patch in terms of the function itself. OFC it was literally just the size increase. Had searched for E8 ?? ?? ?? ?? 8B 78 14 6B D6 in IDA. Came up with only one match so I figured just test it.

And having windows sig + and older windows client.dll and sig made it easier to verify.
The current windows sig is: 0xE8 ,0x0, 0x0, 0x0, 0x0, 0x83, 0xC4, 0x04, 0xB8, 0x0, 0x0, 0x0, 0x0, 0xC3, 0xcc and a 0x9 offset. Kinda suspicious in terms of how oddly similar.