8dcc / hl-cheat

Linux cheat for goldsrc games (HL1/CS 1.6/DoD/TFC)
GNU General Public License v3.0
6 stars 1 forks source link

hClientDLL not found after 25th anniversary update #5

Open 8dcc opened 10 months ago

8dcc commented 10 months ago

After the update of 17/10/2023, the cheat cannot inject with the following error message:

hl-cheat: Injected.
hl-cheat: globals_init: Can't find hClientDLL
hl-cheat: load: Error loading globals, aborting

This is of course caused by:

https://github.com/8dcc/hl-cheat/blob/c6f9e3826c29452574c1a3f7de84d19593431570/src/globals.c#L43-L53

If we look at the output of readelf (Thanks to @UnkwUsr) and we compare the old vs. new hw.so files, we see:

$ readelf -a hw.so.new | grep hClientDLL
  1434: 007fe6a8     4 OBJECT  LOCAL  DEFAULT   24 hClientDLL
$ readelf -a hw.so.prev | grep hClientDLL
001aec9d  00004801 R_386_32          0081b4a0   hClientDLL
001aed2f  00004801 R_386_32          0081b4a0   hClientDLL
...
001b07b5  00004801 R_386_32          0081b4a0   hClientDLL
0020cf1e  00004801 R_386_32          0081b4a0   hClientDLL
    72: 0081b4a0     4 OBJECT  GLOBAL DEFAULT   22 hClientDLL
  1392: 0081b4a0     4 OBJECT  GLOBAL DEFAULT   22 hClientDLL

I am not sure if the problem is caused by this GLOBAL to LOCAL change, but the disassembly of ClientDLL_Init was pretty similar in both .so files:

rizin

Note
IDA couldn't successfully disassembly the new or the old functions, so I used rizin instead, which worked perfectly.

Since Counter-Strike 1.6 is broken as well, and I imagine it will get fixed in a couple of days, I am going to wait until everything is stable before spending more time into this.

8dcc commented 10 months ago

This is also the case with CL_Move:

$ readelf -s hw.so.new | grep -w CL_Move
  3088: 001391f0  2086 FUNC    LOCAL  DEFAULT   11 CL_Move
$ readelf -s hw.so.prev | grep -w CL_Move
  1765: 00192090  1990 FUNC    GLOBAL DEFAULT   10 CL_Move
  3085: 00192090  1990 FUNC    GLOBAL DEFAULT   10 CL_Move

Which we get in hooks_init():

https://github.com/8dcc/hl-cheat/blob/c6f9e3826c29452574c1a3f7de84d19593431570/src/hooks.c#L38-L45