@
l0wb1t:
The story behind the console enabler/toggler is quite extensive. I've started from that BOOL at 0x50 you've seen and progressed bit by bit to various structures and execution of CVar functions. I eventually learned over several sleepless nights that I can swap the Input pointers of the background Console window and the main Window. However, this approach was not a good one, as if you loaded a map or done something that closed the console, I would need to restore a pointer into an offset that belonged to a pointer already destroyed in the reinitialization. Which led to crashes. Then I thought of checking the member functions of the
Console object. And learned that all I needed was there.. You see, the game is designed to use the
HideConsole function whenever a menu is pausing the engine. However, the opposite feature isn't available for showing up the console
But.. if you look for instructions that contain your 0x50 BOOL, you will find one other place in the engine where this happens: "mov [rcx+50],1". Looks familiar, eh? Then if you scan the memory for the function with the 0x0 and the function with 0x1 (the reader and writer), you will notice they are one above or under each other. Meaning they are part of a member-functions table. From that, climb the chain of functions till you find the destructor function (it's the function at offset 0x0 in any pointer you've worked with). Then look for a pointer to that pointer. And you'll find a static. This static is the
pointer to the Console structure.
Putting it in simpler terms: find a static pointer to that address where you enable the BOOL to 0x1. You'll find only one that's static
Then then member-functions at offset 0x38 and 0x40 are the Show and Hide console functions. Write-up a thread that checks 0x50: if 0, run Show; if 1, run Hide. Set it a hotkey, like my F1 in the trainer, and that's that.
BR,
Sun