volvo archived csgo and made it available as a separate app on steam:
the problem: if you own a community server, clients using the archived build cant connect.
the auth ticket comes in with a mismatched appid and the server rejects it.
S3: Client connected with ticket for the wrong game
RejectConnection: STEAM validation rejected
to fix it: you need to make a runtime patch to the engine.
instead of patching the entire switch dispatch, we just redirect one jump table entry.
find the jmp dispatch in ida (via sigmaker):
Linux: FF 24 85 ? ? ? ? 8D B4 26 ? ? ? ? 31 F6
Windows: FF 24 85 ? ? ? ? FF 75 ? 68
that's `jmp ds:jpt[eax*4]`.
open the jump table:
Linux (.rodata:jpt_18A2BA):
[0] default <- status ok
[4] loc_18A3D8 <- thats what we need to patch
copy jt[0] into jt[4].
Windows (.text:jpt_1BF138):
compiler emits `dec eax` before the dispatch, so case 4 -> index 3
[3] loc_1BF189 <- thats what we need to patch
the success path (def_1BF138) is reached via `ja` and is NOT in the table
compute its address from the `ja rel32` instruction sitting 6 bytes before the jmp
write that address into jt[3].
the table address is embedded in the instruction itself (FF 24 85 [addr]),
so you don't need a separate sig for the table.
OR
you can use the SourceMod extension i've uploaded here.
it loads automatically on server start, works on both Linux and Windows,
and restores the original jump table entry on unload.
2.1 changes:
- fixed compatibility issues on both linux, windows
- fixed crashes on windows
- code cleanup
if it works, you'll see something like this:
Linux (server console):
[steamfix] sig hit rva=0x18a2ba
[steamfix] jt[4]: 0xf359b3d8 -> 0xf359b498
[steamfix] engine patched!
Windows (steamfix.log next to srcds.exe):
[steamfix] sig hit rva=0x1bf138
[steamfix] jt[3]: 0x781DF189 -> 0x781DF1B9
[steamfix] engine patched!
after it, everyone can connect to the server
NOTE: the old method was a Linux-only shared lib loaded via LD_PRELOAD:
LD_PRELOAD=/home/container/csgo_steamfix.so ./srcds_run -game csgo
that still works if you prefer it, but the SM extension is easier and cross-platform.
should work on any version, just find the jmp dispatch and check which table index is the wrong game case.
i hope i wont have to update it anymore, and i hope i made it good enough
credits: few people from my reddit post for making me work on this again, and for helping me test it on a windows server.
You must be registered for see links
the problem: if you own a community server, clients using the archived build cant connect.
the auth ticket comes in with a mismatched appid and the server rejects it.
S3: Client connected with ticket for the wrong game
RejectConnection: STEAM validation rejected
to fix it: you need to make a runtime patch to the engine.
instead of patching the entire switch dispatch, we just redirect one jump table entry.
find the jmp dispatch in ida (via sigmaker):
Linux: FF 24 85 ? ? ? ? 8D B4 26 ? ? ? ? 31 F6
Windows: FF 24 85 ? ? ? ? FF 75 ? 68
that's `jmp ds:jpt[eax*4]`.
open the jump table:
Linux (.rodata:jpt_18A2BA):
[0] default <- status ok
[4] loc_18A3D8 <- thats what we need to patch
copy jt[0] into jt[4].
Windows (.text:jpt_1BF138):
compiler emits `dec eax` before the dispatch, so case 4 -> index 3
[3] loc_1BF189 <- thats what we need to patch
the success path (def_1BF138) is reached via `ja` and is NOT in the table
compute its address from the `ja rel32` instruction sitting 6 bytes before the jmp
write that address into jt[3].
the table address is embedded in the instruction itself (FF 24 85 [addr]),
so you don't need a separate sig for the table.
OR
you can use the SourceMod extension i've uploaded here.
it loads automatically on server start, works on both Linux and Windows,
and restores the original jump table entry on unload.
2.1 changes:
- fixed compatibility issues on both linux, windows
- fixed crashes on windows
- code cleanup
if it works, you'll see something like this:
Linux (server console):
[steamfix] sig hit rva=0x18a2ba
[steamfix] jt[4]: 0xf359b3d8 -> 0xf359b498
[steamfix] engine patched!
Windows (steamfix.log next to srcds.exe):
[steamfix] sig hit rva=0x1bf138
[steamfix] jt[3]: 0x781DF189 -> 0x781DF1B9
[steamfix] engine patched!
after it, everyone can connect to the server
NOTE: the old method was a Linux-only shared lib loaded via LD_PRELOAD:
LD_PRELOAD=/home/container/csgo_steamfix.so ./srcds_run -game csgo
that still works if you prefer it, but the SM extension is easier and cross-platform.
should work on any version, just find the jmp dispatch and check which table index is the wrong game case.
i hope i wont have to update it anymore, and i hope i made it good enough
credits: few people from my reddit post for making me work on this again, and for helping me test it on a windows server.
Last edited:
