- Game Name
- N/A
- Anticheat
- N/A
- Coding Language
- C++
Guide to Calling Game Functions
This is another GUIDE in a series of topic based guides in which the general information regarding a topic is given and all the tutorials scattered across the forum are organized into one place.
Do this guide first:
Guide - GHB2 - Beginners Guide To Reverse Engineering
Calling game functions is typically done in internal hacks, which are hacks in which you inject a DLL with your hack code in it. Essentially what you're doing is calling a function by address, the same way the game would. Calling a function by address via a function pointer is a common thing to do in a C++ program, we're just doing it after the game has been compiled, at runtime
What functions would you want to call? Any functionality that the game provides that is too difficult or time consuming to implement yourself can be called by you. Common functions you would call are RayTrace, TraceLine, chat send message or prediction functions as these are too complex to implement yourself. Traceline/RayTrace is used in aimbots, it draws a line between your player and another player and checks if there are objects in the way, if there are no collisions between you and your target, your aimbot should aim and shoot at that target.
Sometimes just changing a variable isn't gonna work, and calling a game function can easily solve your problem.
If you're a noob go to Guide - START HERE Beginners Guide to Learning Game Hacking and learn the basics first
What do are the per-requisites to calling a game function?
- Intermediate Knowledge of internal hacks
- Intermediate experience with C++
- Intermediate assembly reversing
- Knowledge of calling conventions
- calling convention
- return type
- arguments
- address of the function
How to call a game function:
Reverse engineer the function, IDA is the best for this, then do like this example:
C++:
//typedef the function prototype
typedef cvar_t*(__cdecl * _Cvar_Get)(const char *var_name, const char *var_value, int flags);
//Create an instance of the function and assign it to an address
_Cvar_Get Cvar_Get = (_Cvar_Get)0x043F688;
//Call it like this
Cvar_Get("cl_gamepath", "OpenArena", 0);
//typedef the function prototype
typedef clipHandle_t(__cdecl *_CM_InlineModel)(int index);
//Create an instance of the function and assign it to an address
_CM_InlineModel CM_InlineModel = (_CM_InlineModel)0x00426a5c;
//Call it like this
CM_InlineModel(5);
Tutorial - How to Call a Game Function
Tutorial - Calling Functions Externally - The Definitive Guide
Video Tutorial - How to Find dwGetAllClasses & Netvar Manager
Video Tutorial - CSGO How to Find TraceRay - Call Traceline Tutorial
Best Related Threads:
x86 Calling Conventions · destructure.io
Tutorial - How to Call a Game Function
Tutorial - Output to Assault Cube in game console
Tutorial - Calling Conventions, and why you need to know them!
Source Code - Calling traceline with inline ASM
Tutorial - Gathering Function Parameters [Part 1]
Solved - Game chat function
Tutorial - Call functions of another process with DLL
Other Resources:
7.8 — Function Pointers
Calling Conventions
Reverse Engineering and Function Calling by Address - CodeProject
Calling Conventions Demystified - CodeProject
x86 Disassembly/Functions and Stack Frames - Wikibooks, open books for an open world
Call stack - Wikipedia
https://www.cs.cornell.edu/courses/cs412/2008sp/lectures/lec20.pdf
Inside Calling Conventions - CodeProject
Anything we need to add to this guide?
Last edited: