Kawe Mazidjatari 51ea9c7c4f CUserCmd hardening
Fix several exploitable bugs in the CUserCmd class. Some of these have been used to exploit/cheat in-game. Fixes contain:
- Camera position clamping (the only patch that hasn't been tested yet!)
- Weapon activity exploit, allowing player to infinitely throw ordnances, and perform other 'cheats'.
- Akimbo exploit + server crasher, allowing client to set multiple inventory weapons as active. The active weapon index bounds were also not checked, a properly crafter CUserCmd message would therefore be able to crash the server.

Note that this does not fix all issues related to the UserCmd class; further reversing and testing revealed there is more to be fixed, these fixes will get implemented with a future commit.
2023-06-13 17:43:32 +02:00

48 lines
1.7 KiB
C++

#ifndef CLIENT_INPUT_H
#define CLIENT_INPUT_H
#include "game/client/iinput.h"
class CInput : public IInput
{
public:
static void SetCustomWeaponActivity(CInput* pInput, int weaponActivity);
private:
};
inline CMemory p_CInput__SetCustomWeaponActivity;
inline auto v_CInput__SetCustomWeaponActivity = p_CInput__SetCustomWeaponActivity.RCast<void (*)(CInput* pInput, int weaponActivity)>();
inline IInput* g_pInput_VFTable = nullptr;
inline CInput* g_pInput = nullptr;
///////////////////////////////////////////////////////////////////////////////
class VInput : public IDetour
{
virtual void GetAdr(void) const
{
LogConAdr("CInput::`vftable'", reinterpret_cast<uintptr_t>(g_pInput_VFTable));
LogFunAdr("CInput::SetCustomWeaponActivity", p_CInput__SetCustomWeaponActivity.GetPtr());
LogVarAdr("g_Input", reinterpret_cast<uintptr_t>(g_pInput));
}
virtual void GetFun(void) const
{
p_CInput__SetCustomWeaponActivity = g_GameDll.
FindPatternSIMD("89 91 ?? ?? ?? ?? C3 CC CC CC CC CC CC CC CC CC F3 0F 11 89 ?? ?? ?? ?? C3 CC CC CC CC CC CC CC F3 0F 10 81 ?? ?? ?? ??");
v_CInput__SetCustomWeaponActivity = p_CInput__SetCustomWeaponActivity.RCast<void (*)(CInput*, int)>();
}
virtual void GetVar(void) const
{
g_pInput = g_GameDll.FindPatternSIMD("E8 ?? ?? ?? ?? 48 8B 5D 57").FollowNearCallSelf().
FindPatternSelf("48 8B 05").ResolveRelativeAddressSelf(0x3, 0x7).RCast<CInput*>();
}
virtual void GetCon(void) const
{
g_pInput_VFTable = g_GameDll.GetVirtualMethodTable(".?AVCInput@@").RCast<IInput*>();
}
virtual void Attach(void) const;
virtual void Detach(void) const;
};
///////////////////////////////////////////////////////////////////////////////
#endif // CLIENT_INPUT_H