RE Toolkit

Every fact PoZoUSEMS knows about the shipped binaries came out of these scripts. No SDK headers, no leaked symbols — just PE parsing, capstone, and the scientific method. Each tool documents how its conclusion was reached so any offset can be re-derived or refuted.

Tools

tools/scan_dlls.py

PE/export scanner: enumerates modules, dumps exports (found CreateInterface RVAs in all four DLLs) and rodata strings (interface version names like VEngineCvar004 live as plain strings).

py -3.14 tools/scan_dlls.py "D:\...\Portal\bin\vstdlib.dll"
# engine.dll CreateInterface RVA 0x273570
# vstdlib.dll CreateInterface RVA 0x9d90
# ...

tools/find_reghead2.py

The key tool. Resolves each module’s CreateInterface export (including its jmp thunk), disassembles the walker loop, and extracts the s_rgInterfaces head global — the pointer every registry walk starts from. Decoding by eye first established the layout:

mov esi, [HEAD]        ; head node
loop: mov ecx, [esi+4] ; node->Name
      strcmp ...
      mov esi, [esi+8] ; node->Next   → InterfaceReg = {CreateFn, Name, Next}

py -3.14 tools/find_reghead2.py vstdlib.dll engine.dll client.dll server.dll
# vstdlib.dll  0x8fbcc
# engine.dll   0x687e94
# client.dll   0x555f40
# server.dll   0x775e18

tools/walk_interfaces.py

Standalone file-only registry walker. Educational caveat: chains only exist at runtime (CRT constructors link them), so on-disk walks come up empty — that failure is exactly why regwalk runs in-process. Kept as the layout reference implementation.

tools/find_icvar_vtable.py, tools/find_ftable.py

Early RTTI/vftable experiments from the pre-regwalk era. Superseded, kept for history.

In-process: regwalk + usems_hook_profile

The runtime half of the toolkit:

[USEMS] regwalk: engine.dll exposes 46 interface(s)
[USEMS] hook:   slot 5   called 541 times   (server: 66/s → GameFrame)

One injection yields the full interface map and vtable call histograms for both interfaces (usems_hook_profile client|server [seconds]); offline disassembly then names the interesting slots (see Hook Engine for the HudUpdate and GameFrame worked examples).

The method, as rules

1. Data before code. Prefer facts readable from structures (strings, registry chains, vtables) over instruction-level patching.
2. Measure, then name. Profile call frequencies before guessing what a slot is; disassemble only the shortlist.
3. Fingerprint-gate every offset. A fact enters usems-cap only with its engine_size fingerprint; mismatched builds refuse the offset rather than crash.
4. Log the derivation. If a tool can’t reproduce a number, the number doesn’t ship.

Worked examples in these docs

• Finding HudUpdate + gpGlobals
• The InterfaceReg layout
• VClient017 singleton from CreateFn

Requirements

pip install pefile capstone   # py -3.14 on this machine