Guide idTech Engine Hacking & Reversing Info

[timb3r]

Historical Information
Recent idTech games are made with the newer idTech 5, 6 & 7 engines.

idTech 1 = Doom Engine
idTech 2 = Quake Engine
idTech 3 = Quake III Arena Engine
idTech 4 = Doom 3
idTech 5 = RAGE
idTech 6 = Doom 2016
idTech 7 = Doom Eternal

All newer versions are iterations of idTech3, the Quake III Arena Engine which is open source. There will be many parallels between this version and newer versions, therefore studying the open source version will give you an excellent insight into the core engine. The Call of Duty engine and even Source Engine are based on Quake Engine also.

Even the Doom 3 idTech 4 source code is available on idTech's Github

We have an excellent guide on how to hack Quake Engine / COD base games available here which will teach you exactly what structures, objects and pointers you will need.
Guide - How to Hack Call of Duty Games & Quake Engine Games

After idTech 4 the newer versions are getting farther and farther away from the original Quake III Arena source code.

idTech 5 information:

Rendering Tech: OpenGL

Games using idTech 5:

1. RAGE
2. Wolfenstein - The New Order
3. Wolfenstein - The Old Blood
4. Dishonored 2
5. Dishonored 2 - The Death of the Outsider
6. The Evil Within
7. The Evil Within 2

idTech 6 Information:

Rendering Tech: Vulkan & OpenGL

Games using idTech 6:

1. Doom 2016
2. Wolfenstein II
3. Wolfenstein - Young Blood

idTech 7

Rendering Tech: Vulkan (only)

Games using idTech7:

1. Doom Eternal

General:

Enabling the console:

+set com_allowconsole 1

Game Specific [Wolfenstein - The New Order]:

Enable Dev Console:

cvaradd devgui 1
bind F8 cvaradd devgui 1

Cheat Table for Locating the Entity List and Base Pointer:

<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="28">
  <CheatEntries>
    <CheatEntry>
      <ID>1</ID>
      <Description>"Base pointer game"</Description>
      <ShowAsHex>1</ShowAsHex>
      <VariableType>8 Bytes</VariableType>
      <Address>wolfneworder_x64.exe+1da60E0</Address>
    </CheatEntry>
    <CheatEntry>
      <ID>2</ID>
      <Description>"Entity List"</Description>
      <ShowAsHex>1</ShowAsHex>
      <VariableType>8 Bytes</VariableType>
      <Address>wolfneworder_x64.exe+1da60E0</Address>
      <Offsets>
        <Offset>1AAC8</Offset>
      </Offsets>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

Game Specific [Doom 2016]:

Writing to the Console (internal):

typedef void (*Doom4ConsoleMsg_t)(const char *, const char *);
Doom4ConsoleMsg_t fnD4Msg = NULL;
uintptr_t baseAddress = 0;

baseAddress = (uintptr_t)GetModuleHandle(NULL);
fnD4Msg = (Doom4ConsoleMsg_t)(baseAddress + 0x161BDC0);

fnD4Msg("%s\n", "------- timb3r's Vulkan Proxy v0.1 -------");

Misc Resources

Configuring Development Environments for Vulkan
Development environment - Vulkan Tutorial

Vulkan Hooking:
Vulkan Hooking (ProxyDLL).

Member created projects:

• Kleon742 Doom 2016 Hack
• Timb3r's Dev Console for Dishonored 2
• Tutorial - How to Find Entity List - Wolfenstein Hack Tutorial

Other Resources:

• SunBeam's Dishonored 2 post on Fearless

 

[Rake]

Dank, thank you