[TUT] IDA Pro - engfunc offsets
Posted: Fri Sep 11, 2026 5:14 pm
For those who play with IDA over metamod/cs/engine, here's the list of engfunc calls with its offsets numbers (as they appear in IDA).
As an example, you can see this in IDA PseudoCode window:
Then you can check table bellow and look for offset 560.
It's pfnAddServerCommand so this call it's to add some_command console command.
I'm not sure if pfnKeyNameForBinding it's included or not in engine library. I guess not so the offsets at bottom of lists should be fine. If someone knows about that, please let me know and I'll update the list.
As an example, you can see this in IDA PseudoCode window:
Code: Select all
(*(void (__cdecl **)(_DWORD, int (*)()))&g_engfuncs[560])("some_command", command_function);It's pfnAddServerCommand so this call it's to add some_command console command.
I'm not sure if pfnKeyNameForBinding it's included or not in engine library. I guess not so the offsets at bottom of lists should be fine. If someone knows about that, please let me know and I'll update the list.
Code: Select all
Offset Ret Type Name
0 int *pfnPrecacheModel
4 int *pfnPrecacheSound
8 void *pfnSetModel
12 int *pfnModelIndex
16 int *pfnModelFrames
20 void *pfnSetSize
24 void *pfnChangeLevel
28 void *pfnGetSpawnParms
32 void *pfnSaveSpawnParms
36 float *pfnVecToYaw
40 void *pfnVecToAngles
44 void *pfnMoveToOrigin
48 void *pfnChangeYaw
52 void *pfnChangePitch
56 edict_t* *pfnFindEntityByString
60 int *pfnGetEntityIllum
64 edict_t* *pfnFindEntityInSphere
68 edict_t* *pfnFindClientInPVS
72 edict_t* *pfnEntitiesInPVS
76 void *pfnMakeVectors
80 void *pfnAngleVectors
84 edict_t* *pfnCreateEntity
88 void *pfnRemoveEntity
92 edict_t* *pfnCreateNamedEntity
96 void *pfnMakeStatic
100 int *pfnEntIsOnFloor
104 int *pfnDropToFloor
108 int *pfnWalkMove
112 void *pfnSetOrigin
116 void *pfnEmitSound
120 void *pfnEmitAmbientSound
124 void *pfnTraceLine
128 void *pfnTraceToss
132 int *pfnTraceMonsterHull
136 void *pfnTraceHull
140 void *pfnTraceModel
144 constchar* *pfnTraceTexture
148 void *pfnTraceSphere
152 void *pfnGetAimVector
156 void *pfnServerCommand
160 void *pfnServerExecute
164 void *pfnClientCommand
168 void *pfnParticleEffect
172 void *pfnLightStyle
176 int *pfnDecalIndex
180 int *pfnPointContents
184 void *pfnMessageBegin
188 void *pfnMessageEnd
192 void *pfnWriteByte
196 void *pfnWriteChar
200 void *pfnWriteShort
204 void *pfnWriteLong
208 void *pfnWriteAngle
212 void *pfnWriteCoord
216 void *pfnWriteString
220 void *pfnWriteEntity
224 void *pfnCVarRegister
228 float *pfnCVarGetFloat
232 constchar* *pfnCVarGetString
236 void *pfnCVarSetFloat
240 void *pfnCVarSetString
244 void *pfnAlertMessage
248 void *pfnEngineFprintf
252 void* *pfnPvAllocEntPrivateData
256 void* *pfnPvEntPrivateData
260 void *pfnFreeEntPrivateData
264 constchar* *pfnSzFromIndex
268 int *pfnAllocString
272 entvars_s* *pfnGetVarsOfEnt
276 edict_t* *pfnPEntityOfEntOffset
280 int *pfnEntOffsetOfPEntity
284 int *pfnIndexOfEdict
288 edict_t* *pfnPEntityOfEntIndex
292 edict_t* *pfnFindEntityByVars
296 void* *pfnGetModelPtr
300 int *pfnRegUserMsg
304 void *pfnAnimationAutomove
308 void *pfnGetBonePosition
312 uint32 *pfnFunctionFromName
316 constchar* *pfnNameForFunction
320 void *pfnClientPrintf
324 void *pfnServerPrint
328 constchar* *pfnCmd_Args
332 constchar* *pfnCmd_Argv
336 int *pfnCmd_Argc
340 void *pfnGetAttachment
344 void *pfnCRC32_Init
348 void *pfnCRC32_ProcessBuffer
352 void *pfnCRC32_ProcessByte
356 CRC32_t *pfnCRC32_Final
360 int32 *pfnRandomLong
364 float *pfnRandomFloat
368 void *pfnSetView
372 float *pfnTime
376 void *pfnCrosshairAngle
380 byte* *pfnLoadFileForMe
384 void *pfnFreeFile
388 void *pfnEndSection
392 int *pfnCompareFileTime
396 void *pfnGetGameDir
400 void *pfnCvar_RegisterVariable
404 void *pfnFadeClientVolume
408 void *pfnSetClientMaxspeed
412 edict_t* *pfnCreateFakeClient
416 void *pfnRunPlayerMove
420 int *pfnNumberOfEntities
424 char* *pfnGetInfoKeyBuffer
428 char* *pfnInfoKeyValue
432 void *pfnSetKeyValue
436 void *pfnSetClientKeyValue
440 int *pfnIsMapValid
444 void *pfnStaticDecal
448 int *pfnPrecacheGeneric
452 int *pfnGetPlayerUserId
456 void *pfnBuildSoundMsg
460 int *pfnIsDedicatedServer
464 cvar_t* *pfnCVarGetPointer
468 unsignedint *pfnGetPlayerWONId
472 void *pfnInfo_RemoveKey
476 constchar* *pfnGetPhysicsKeyValue
480 void *pfnSetPhysicsKeyValue
484 constchar* *pfnGetPhysicsInfoString
488 unsignedshort *pfnPrecacheEvent
492 void *pfnPlaybackEvent
496 unsignedchar* *pfnSetFatPVS
500 unsignedchar* *pfnSetFatPAS
504 int *pfnCheckVisibility
508 void *pfnDeltaSetField
512 void *pfnDeltaUnsetField
516 void *pfnDeltaAddEncoder
520 int *pfnGetCurrentPlayer
524 int *pfnCanSkipPlayer
528 int *pfnDeltaFindField
532 void *pfnDeltaSetFieldByIndex
536 void *pfnDeltaUnsetFieldByIndex
540 void *pfnSetGroupMask
544 int *pfnCreateInstancedBaseline
548 void *pfnCvar_DirectSet
552 void *pfnForceUnmodified
556 void *pfnGetPlayerStats
560 void *pfnAddServerCommand
564 qboolean *pfnVoice_GetClientListening
568 qboolean *pfnVoice_SetClientListening
572 constchar* *pfnGetPlayerAuthId
//constchar* *pfnKeyNameForBinding
576 sequenceEntry_s* *pfnSequenceGet
580 sentenceEntry_s* *pfnSequencePickSentence
584 int *pfnGetFileSize
588 unsignedint *pfnGetApproxWavePlayLen
592 int *pfnIsCareerMatch
596 int *pfnGetLocalizedStringLength
600 void *pfnRegisterTutorMessageShown
604 int *pfnGetTimesTutorMessageShown
608 void *pfnProcessTutorMessageDecayBuffer
612 void *pfnConstructTutorMessageDecayBuffer
616 void *pfnResetTutorMessageDecayData
620 void *pfnQueryClientCvarValue
624 void *pfnQueryClientCvarValue2