[1.298, 1.310] Server command to reload any EVT (/reload_evt)

tarafından **Hello EMO** Çarş. Şub. 23, 2011 8:28 am

[quote name='twostars' timestamp='1296419989' post='155']
ere's a server command I wrote a while back to reload any given EVT.
Usage: /reload_evt

So, to reload 21.evt, you'd use: /reload_evt 21

[size="5"]1.298[/size]

Kod:: 004256B8 > E9 6B600400 JMP 0046B728 004256BD 90 NOP Code-cave: 0046B71C . 2F 72 65 6C 6F 61 64 5F 65 76 74 00 ASCII "/reload_evt",0 0046B728 > 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124] 0046B72E . 68 1CB74600 PUSH 0046B71C ; ASCII "/reload_evt" 0046B733 . 50 PUSH EAX 0046B734 . E8 2A87F9FF CALL 00403E63 0046B739 . 59 POP ECX 0046B73A . 85C0 TEST EAX,EAX 0046B73C . 59 POP ECX 0046B73D 75 6A JNZ SHORT 0046B7A9 0046B73F . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 0046B742 . 36:8D8428 5CFDFFFF LEA EAX,DWORD PTR SS:[EAX+EBP-2A4] 0046B74A . 50 PUSH EAX 0046B74B . 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124] 0046B751 . 50 PUSH EAX 0046B752 . E8 7F5FF9FF CALL 004016D6 0046B757 . 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124] ; | 0046B75D . 50 PUSH EAX ; |Arg1 0046B75E . E8 1D600900 CALL 00501780 ; \00501780 0046B763 . 83C4 0C ADD ESP,0C 0046B766 . 85C0 TEST EAX,EAX 0046B768 74 3F JE SHORT 0046B7A9 0046B76A . 60 PUSHAD 0046B76B . 9C PUSHFD 0046B76C . BF 80276800 MOV EDI,00682780 0046B771 . 57 PUSH EDI ; /pCriticalSection => Ebenezer.00682780 0046B772 . 8BD8 MOV EBX,EAX ; | 0046B774 . FF15 18996800 CALL DWORD PTR DS:[689918] ; \EnterCriticalSection 0046B77A . 8BCE MOV ECX,ESI 0046B77C . 53 PUSH EBX 0046B77D . 81C1 98140000 ADD ECX,1498 0046B783 . E8 475CF9FF CALL 004013CF 0046B788 . 57 PUSH EDI ; /pCriticalSection 0046B789 . 8BC8 MOV ECX,EAX ; | 0046B78B . FF15 14996800 CALL DWORD PTR DS:[689914] ; \LeaveCriticalSection 0046B791 . 85C9 TEST ECX,ECX 0046B793 74 0D JE SHORT 0046B7A2 0046B795 51 PUSH ECX 0046B796 E8 206BF9FF CALL 004022BB 0046B79B 59 POP ECX 0046B79C 53 PUSH EBX 0046B79D E8 DE6EF9FF CALL 00402680 0046B7A2 9D POPFD 0046B7A3 61 POPAD 0046B7A4 ^E9 8FA7FBFF JMP 00425F38 0046B7A9 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124] 0046B7AF ^E9 0A9FFBFF JMP 004256BE

[size="5"]1.310/1.351/2.0[/size]

Kod:: 0050227F . 2F 72 65 6C 6F>ASCII "/reload_evt",0 005023AD > 8D85 D8FEFFFF LEA EAX,DWORD PTR SS:[EBP-128] 005023B3 . 68 7F225000 PUSH 0050227F ; ASCII "/reload_evt" 005023B8 . 50 PUSH EAX 005023B9 . E8 0BA7F1FF CALL 0041CAC9 005023BE . 59 POP ECX 005023BF . 85C0 TEST EAX,EAX 005023C1 . 59 POP ECX 005023C2 . 75 68 JNZ SHORT 0050242C 005023C4 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 005023C7 . 36:8D8428 D8FD>LEA EAX,DWORD PTR SS:[EAX+EBP-228] 005023CF . 50 PUSH EAX 005023D0 . 8D85 D8FEFFFF LEA EAX,DWORD PTR SS:[EBP-128] 005023D6 . 50 PUSH EAX 005023D7 . E8 83A6F1FF CALL 0041CA5F 005023DC . 8D85 D8FEFFFF LEA EAX,DWORD PTR SS:[EBP-128] 005023E2 . 50 PUSH EAX ; /s 005023E3 . E8 1EF4FBFF CALL _atoi ; \_atoi 005023E8 . 83C4 0C ADD ESP,0C 005023EB . 85C0 TEST EAX,EAX 005023ED 74 38 JE SHORT 00502427 005023EF . 60 PUSHAD 005023F0 . BF F8BC5200 MOV EDI,52BCF8 005023F5 . 8BD8 MOV EBX,EAX 005023F7 . 57 PUSH EDI ; /pCriticalSection => OFFSET ?g_map_critical@@3U_RTL_CRITICAL_SECTION@@A 005023F8 . FF15 04335000 CALL DWORD PTR DS:[503304] 005023FE . 8BCE MOV ECX,ESI 00502400 . 53 PUSH EBX 00502401 . 81C1 98140000 ADD ECX,1478 ; ; ?????? 00502407 . E8 746AFAFF CALL 004A8E80 0050240C . 57 PUSH EDI ; /pCriticalSection 0050240D . 8BC8 MOV ECX,EAX ; | 0050240F . FF15 00335000 CALL DWORD PTR DS:[503300] 00502415 . 85C9 TEST ECX,ECX 00502417 . 74 0D JE SHORT 00502426 00502419 . 51 PUSH ECX 0050241A . E8 781DF3FF CALL 00434197 0050241F . 59 POP ECX 00502420 . 53 PUSH EBX 00502421 . E8 A819F3FF CALL 00433DCE 00502426 > 61 POPAD 00502427 .^E9 CDA5F1FF JMP 0041C9F9 0050242C > 8D85 D8FEFFFF LEA EAX,DWORD PTR SS:[EBP-128] 00502432 .^E9 A498F1FF JMP 0041BCDB 0041BCD5 E9 D3660E00 JMP 005023AD 0041BCDA 90 NOP

Edit:
Replaced Olly's attempt at making life simple (naming functions from the IAT) with the actual addresses of the functions, so you can just copy & paste those lines in and assemble. You will still, however, need to select the bytes you'll need for /reload_evt, right-click & use "Binary edit" and patch in those bytes as you see them on the left.
[/quote]