JKA/Q3Engine CvarHack (Brief Explanation)

[eVc]

If your curious how CvarHacks work...i basically disassembled JAMP.EXE using IDA
(You can use any win32 dissasembler) and searched part of the string which was displayed
in console saying i cant change the cvar ("cheat protected").
Then i looked for the last conditional jump before that string was pushed and inversed it.

Heres The Cvar Protection Function Which It Patches (ASM)


.text:004398A2 test ah, 2
.text:004398A5 jz short loc_0_4398E0
.text:004398A7 mov ecx, dword_0_B5148C
.text:004398AD mov eax, [ecx+20h]
.text:004398B0 test eax, eax
.text:004398B2 jnz short loc_0_4398E0 <------- jump if its allowed ;)
.text:004398B4 mov edx, [esp+8+arg_0]
.text:004398B8 push edx
.text:004398B9 push offset aSIsCheatProtec ; "%s is cheat protected.\n"
.text:004398BE call sub_0_437080
.text:004398C3 add esp, 8
.text:004398C6 pop esi
.text:004398C7 pop ebx
.text:004398C8 pop edi
.text:004398C9 mov eax, ebp
.text:004398CB pop ebp
.text:004398CC retn



NOTE:

.text:004398B2 jnz short loc_0_4398E0 <------- jump if its allowed ;)
^ the address to patch will be 004398B2 (0x4398B2)

-----------------------
PSEUDO PATCH ROUTINE:
-----------------------
if

// If It Reads JNE/JNZ (If you want...Search For JNZ <LOCATION> to be more accurate)
ReadProcessMemory(jamp.exe, 0x4398B2, 75, 1, 1);

then

// Change From JNE [Jump If Not Equal] (x75) to JE [Jump If Equal] (x74)
WriteProcessMemory(jamp.exe, 0x4398B2, 74, 1, 1);

else

// Didn't Read The JNZ Value..So its already patched or incorrect binary version
MessageBox(0,"Incorrect JKA version or its already patched.","CvarHack Error",0);
-------------------------

Always patch a few seconds after the process has been created (bcos the engine does some sort of CRC checks before it creates the window).

Now using this you should be able to write your own cvarhacks when theres updates without waiting for a release by someone else :classic:

[After ~ Shock]

if you enabled the cheat protected cvars, you proably have a whole list of them, so can you pls post em here :D


:bunny:

[BiGmAc]

nice find eVc =)

[eVc]

:)

[Poograny]

Oh lord, I have asked this question so many times After ~ Shock ... I don't think they even know, and if they do they show no plans on telling anyone.

[eVc]

I only use it for "r_fullbright 1" other than that i have no use unless someone can enlighten me in a few other cool features.

btw heres the source code with basic example screenshots of howto make a cvarhack without knowing howto code.

utilizes teh power of tsearch and trainer maker kit so anyone of any ability can accomplish such a task. (Yes noobs can use this method)

Link (http://www.figdev.com/cheats/CvarHack/)

[houdini]

I've tried just about every cheat protected cvar in the past year of playing this game. I highly doubt there is anything other than these semi-helpful hax..

I might have missed one that would be really neat and an actual 'hack' but here is what i use

This one i use as kind of a lamer watch. I love to tempt people by turning this on and then pretending i am chatting. I just wait for the first lamer to come running up behind me and then close chat and bs them first. It is pretty hilarious. People think you are the shit too...LOL. I love to bait people in like this. They think there is no way i can see them run up from behind.... they think wrong :)

I guess this is kinda like FOV (which i never change) only better and slightly more useful

//thirdview cvar hack
set watch "vstr watch_1"
set watch_1 "cg_thirdpersonrange 450; set watch vstr watch_0"
set watch_0 "cg_thirdpersonrange 80; set watch vstr watch_1"

of course you need to have this in your autoexec.cfg file or whatever setup you chose. Then bind a key to the vstr watch. Same goes for these other two.

//znear hack
set znear "vstr znear_1"
set znear_1 "r_znear 150; set znear vstr znear_0"
set znear_0 "r_znear 4; set znear vstr znear_1"

//light hack

set light "vstr light_1"
set light_1 "r_lightmap 1; set light vstr light_0"
set light_0 "r_lightmap 0; set light vstr light_1"

//bright hack
set bright "vstr bright_1"
set bright_1 "r_fullbright 1; set bright vstr bright_0"
set bright_0 "r_fullbright 0; set bright vstr bright_1"


Is this one cheat protected? I forget..but here it is anyway. It will turn off the sky which can help with fps. It does on my system anyway. Not a hack, but useful for a slow machine. Every frame helps.

// Sky Hack

set sky "vstr skyl_1"
set sky_1 "r_fastsky 1; set sky vstr sky_0"
set sky_0 "r_fastsky 0; set sky vstr sky_1"

Well, there you are. Rest are useless. Don't bother