Overriding password checks (by hooking ConnectClient) used for Discord integration

[AshleighAdams]

Hey everyone, I help run some CS2 servers for the CS:GALS community, for which I've been working on Discord integration, and I'd like to share the crucial parts of the CounterStrikeSharp plugin that allowed this to happen.

In short, when a player from our Discord wants to connnect, things follow this flow:

On the supporting web server:

1. OAuth is used to check for membership of our Discord server, and query their roles
2. Generate a single use temporary cookie (random string)
3. Send the cookie, to the CS2 server via a webhook, with the player's Discord nickname, and roles
4. Redirect the player's browser to steam://connect/ip:port/password where the password is the generated cookie

In the CS# plugin:

5. Receives the cookie from the submitted password
6. Retrieves the player details from the cookie
7. Renames the player to their Discord nickname
8. Replaces the password with the actual sv_password so the password is not rejected
9. Extracts the IP and port to later apply desired permissions (admin etc)

Interesting parts of code, minus specific integrations (e.g. webhooks, role granting):

[MinimumApiVersion(314)]
public class AuthPlugin : BasePlugin
{
	public override string ModuleName => "CS:GALS Auth";
	public override string ModuleVersion => Verlite.Version.Full;
	public override string ModuleAuthor => "Ashleigh Adams";
	public override string ModuleDescription => "Integration with CS:GALS Discord";

	private ConVar SvPassword { get; set; } = null!;
	private CancellationTokenSource Cts { get; set; } = null!;

	public override void Load(bool hotReload)
	{
		Logger.LogInformation($"ConnectClient: {ExtraFunctions.ConnectClientFunc.Handle}");
		Logger.LogInformation($"NetAddrToString: {ExtraFunctions.NetAddrToStringFunc.Handle}");

		Cts = new CancellationTokenSource();
		SvPassword = ConVar.Find("sv_password") ?? throw new NotSupportedException("Couldn't find sv_password cvar");

		PasswordBuffer = Marshal.StringToCoTaskMemUTF8(new string('\0', StringBufferLength));
		NameBuffer = Marshal.StringToCoTaskMemUTF8(new string('\0', StringBufferLength));

		ExtraFunctions.ConnectClientFunc.Hook(ConnectClientHook, HookMode.Pre);

		Task.Run(RequestAuthCookies);
	}
	public override void Unload(bool hotReload)
	{
		Cts.Cancel();

		ExtraFunctions.ConnectClientFunc.Unhook(ConnectClientHook, HookMode.Pre);
		Marshal.FreeCoTaskMem(PasswordBuffer);
		Marshal.FreeCoTaskMem(NameBuffer);

		PasswordBuffer = nint.Zero;
		NameBuffer = nint.Zero;
	}

	private const int StringBufferLength = 128;
	private static nint PasswordBuffer { get; set; } = nint.Zero;
	private static nint NameBuffer { get; set; } = nint.Zero;
	private static unsafe void StrCpy(nint dst, string src)
	{
		Span<byte> buffer = stackalloc byte[StringBufferLength];

		int length = Encoding.UTF8.GetBytes(src, buffer[..(buffer.Length - 1)]);
		buffer[length] = (byte)'\0';

		var dstBuffer = new Span<byte>((byte*)dst, StringBufferLength);
		buffer.CopyTo(dstBuffer);
	}

	private struct AuthCookie
	{
		public required string PlayerName { get; set; }
		public required string[] Roles { get; set; }
	}

	private Dictionary<string, AuthCookie> AuthCookies { get; } = new();
	private ConcurrentDictionary<string, AuthCookie> ConnectingClients = new();

	private unsafe HookResult ConnectClientHook(DynamicHook hook)
	{
		var steamName = hook.GetParam<string>(1);
		var netAddr = hook.GetParam<nint>(2);
		var password = hook.GetParam<string>(5);

		Logger.LogInformation($"Player {steamName} (steam) connecting with password {password}");

		if (!AuthCookies.TryGetValue(password, out var cookie))
			return HookResult.Continue;

		// prevent the cookie from being used again
		AuthCookies.Remove(password);

		Span<byte> ipBuffer = stackalloc byte[64]; // ipv4 max length: 255.255.255.255:65535, ipv6 when supported: [0000:0000:0000:0000:0000:ffff:255.255.255.255]:65535
		fixed (byte* ipBufferPtr = ipBuffer)
		{
			ExtraFunctions.NetAddrToString(netAddr, (nint)ipBufferPtr, (uint)ipBuffer.Length, false);
		}
		var ip = Encoding.UTF8.GetString(ipBuffer);

		var roles = cookie.Roles.Length == 0 ? string.Empty : $" ({string.Join(", ", cookie.Roles)})";
		Logger.LogInformation($"Player {steamName} ({ip}) authenticated as {cookie.PlayerName}{roles}");

		// store the client ip to cookie so it can later be retreived once the player has authenticated with steam
		ConnectingClients[ip] = cookie;

		// update the player's name, and replace the password so srcds doesn't kick them
		StrCpy(NameBuffer, cookie.PlayerName);
		StrCpy(PasswordBuffer, SvPassword.StringValue);

		hook.SetParam(1, NameBuffer);
		hook.SetParam(5, PasswordBuffer);

		// notify the auth server we ate this cookie, preventing use on other servers
		var ms = new MemoryStream();
		var writer = new Utf8JsonWriter(ms);
		writer.WriteStartObject();
		writer.WriteString("type"u8, "ate"u8);
		writer.WriteString("cookie"u8, password);
		writer.WriteEndObject();
		writer.Flush();
		UpstreamWebhookChannel.Writer.TryWrite(ms.ToArray());

		return HookResult.Continue;
	}
}

internal static class ExtraFunctions
{
	// near "CNetworkGameServerBase::ConnectClient( name=\'%s\', remote=\'%s\' )\n"
	private static string ConnectClientSignature => RuntimeInformation.IsOSPlatform(OSPlatform.Linux) switch
	{
		true => "55 48 89 E5 41 57 41 56 41 89 CE 41 55 41 54 4D 89 CC 53 48 89 D3 48 81 EC ? ? ? ? 8B 45 20",
		false => "48 89 5C 24 ? 44 89 4C 24 ? 55 56 57 41 54 41 55 41 56 41 57 48 8D AC 24",
	};

	/// <summary>
	/// <c>
	/// virtual CServerSideClientBase* CNetworkGameServerBase::ConnectClient(
	/// 	const char* name,
	/// 	ns_address* address,
	/// 	void* netInfo,
	/// 	C2S_CONNECT_Message* connectMsg,
	/// 	const char* password,
	/// 	const byte* authTicket,
	/// 	int authTicketLength,
	/// 	bool isLowViolence);
	/// </c>
	/// </summary>
	public static MemoryFunctionWithReturn<nint, nint, nint, nint, nint, nint, nint, int, bool, nint> ConnectClientFunc = new(ConnectClientSignature, Addresses.EnginePath);
	public static Func<nint, nint, nint, nint, nint, nint, nint, int, bool, nint> ConnectClient = ConnectClientFunc.Invoke;

	// void netadr_t::ToString(char* buffer, uint32_t bufferSize, bool ipOnly) // _ZNK8netadr_t8ToStringEPcjb
	// near string "%i.%i.%i.%i:%i"
	private static string NetAddrToStringSignature => RuntimeInformation.IsOSPlatform(OSPlatform.Linux) switch
	{
		true => "48 89 F8 48 89 F7 89 D6 8B 10 83 FA 01 ? ? 83 FA 02 ? ? ? ? ? ? 83 FA 03 ? ? 55 48 89 E5",
		false => "48 89 5C 24 ? 48 89 74 24 ? 57 48 83 EC ? 8B 01",
	};

	/// <summary>
	/// <c>void netadr_t::ToString(char* buffer, uint32_t bufferSize, bool ipOnly)</c> _ZNK8netadr_t8ToStringEPcjb
	/// </summary>
	public static MemoryFunctionVoid<nint, nint, uint, bool> NetAddrToStringFunc = new(NetAddrToStringSignature, Addresses.Tier0Path);
	public static Action<nint, nint, uint, bool> NetAddrToString = NetAddrToStringFunc.Invoke;
}

Those signatures could maybe do with some improvement, the comments have some unique strings to help you find them again in Ghidra/IDA Pro, I didn't feel like grabbing the Windows binaries either to get the Windows function signatures, but it shouldn't be too hard to find

Update

Thanks to @Cruze03 and @Vauff, you can get the unsafe and unauthenticated steam id like so:

var authTicket = hook.GetParamArray<byte>(6, 7);
var steamId = MemoryMarshal.Read<ulong>(authTicket[..8]);

internal static class Extensions
{
	public static unsafe Span<T> GetParamArray<T>(this DynamicHook hook, int paramIndex, int lengthParamIndex)
	{
		var value = hook.GetParam<nint>(paramIndex);
		var length = hook.GetParam<int>(lengthParamIndex);
		return new Span<T>((void*)value, length);
	}
}

[KillStr3aK]

neat stuff here, thanks for sharing!

here are the windows signatures:

NetAddrToStringFunc (tier0.dll)
48 89 5C 24 ? 48 89 74 24 ? 57 48 83 EC ? 8B 01

ConnectClientFunc (engine2.dll)
48 89 5C 24 ? 44 89 4C 24 ? 55 56 57 41 54 41 55 41 56 41 57 48 8D AC 24

I'd suggest to use a proper gamedata file instead of hardcoding these in production code

[Cruze03]

In windows, it isn't working for me :(

[KillStr3aK]

In windows, it isn't working for me :(

this is my output:

if you can attach these binaries in discord dm I can take a look on it

[Cruze03]

My bad, it works now. It was some other signature that was failing in my code. Do you know how to get steamid from this by any chance?

[AshleighAdams]

@Cruze03 The steamid is not authenticated at this point, you do know the unauthenticated steamid in one of the params I believe, but it should not be trusted. That's why I have the IP tostring sig too, so you can then connect it up in a ClientConnected/ClientFullyConnected event (and be sure to remove the IPs on ClientDisconnect)

[KillStr3aK]

My bad, it works now. It was some other signature that was failing in my code. Do you know how to get steamid from this by any chance?

great!

[qstage]

instead of NetAddrToStringFunc you can use the struct

// var netAddr = Marshal.PtrToStructure<Netadr>(hook.GetParam<nint>(2));

public struct Netadr
{
    public enum NetadrType : int
    {
        NA_NULL = 0,
        NA_LOOPBACK,
        NA_BROADCAST,
        NA_IP
    }

    private readonly NetadrType _type;
    private readonly int _ip;
    private readonly ushort _port;

    public readonly NetadrType Type => _type;
    public readonly string Ip => $"{_ip & 0xFF}.{(_ip >> 8) & 0xFF}.{(_ip >> 16) & 0xFF}.{(_ip >> 24) & 0xFF}";
    public readonly ushort Port => BinaryPrimitives.ReverseEndianness(_port);

    public override readonly string ToString() => _type switch
    {
        NetadrType.NA_LOOPBACK => "loopback",
        NetadrType.NA_BROADCAST => "broadcast",
        NetadrType.NA_IP => Ip,
        _ => "unknown"
    };

    public readonly string ToString(bool onlyBase)
    {
        var @base = ToString();

        if ( !onlyBase && _type == NetadrType.NA_IP )
        {
            return $"{@base}:{Port}";
        }

        return @base;
    }
}

[AshleighAdams]

Yeah, the reason I didn't want to do this is in the case Valve changes the formatting of the IP, such as if they introduce IPv6 support at some point, but @Cruze03 and Vauff pulled the unauth'd steamid out of the auth cookie which is a much better method of correlating the authenticated client after

[lukepolo]

@AshleighAdams thanks for the code! Here is my impetration of it

https://github.com/5stackgg/game-server/blob/main/src/FiveStack.Events/InitConnect.cs

[AshleighAdams]

Updated the Linux signatures, I'm guessing the Windows ones changed too? But maybe not though as I think most the breakages here are from updating the compiler. If anyone wants to take a look at the Windows's sigs, feel free.

New Linux signatures are:

CNetworkGameServerBase::ConnectClient: 55 48 89 E5 41 57 41 56 41 89 CE 41 55 41 54 4D 89 CC 53 48 89 D3 48 81 EC ? ? ? ? 8B 45 20
netadr_t::ToString: 48 89 F8 48 89 F7 89 D6 8B 10 83 FA 01 ? ? 83 FA 02 ? ? ? ? ? ? 83 FA 03 ? ? 55 48 89 E5

[Cruze03]

@KillStr3aK Windows ones also please ;_;

[KillStr3aK]

@KillStr3aK Windows ones also please ;_;

CNetworkGameServerBase::ConnectClient: 48 89 5C 24 ? 44 89 4C 24 ? 55 41 54
netadr_t::ToString: 48 89 5C 24 ? 48 89 74 24 ? 57 48 83 EC ? 8B 01

lmk if ConnectClient is wrong, didnt test that

[Cruze03]

It is correct. Thanks! <3

[Cruze03]

07/12/2025 cs2 update:

CNetworkGameServerBase::ConnectClient:
win: 48 89 5C 24 ? 44 89 4C 24 ? 55 41 54 (unchanged)
linux: 55 48 89 E5 41 57 41 56 41 89 CE 41 55 41 54 4D 89 CC