Code: Select all
push rbp
mov rbp,rsp
sub rsp,000009D0
mov [rbp-28],rsi
![Smile :)](./images/smilies/icon_e_smile.gif)
Here's a sample for Raft to give you unlimited oxygen:
Code: Select all
[enable]
alloc(newmem,$1000)
newmem:
MonoMethodInit(PersonController:Update,PersonController,PlayerStats,Stat_Oxygen,Stat)
push rbx
push rax
mov rbx,[rcx+PersonController.playerStats]
test rbx,rbx
jz @f
mov rbx,[rbx+PlayerStats.stat_oxygen]
test rbx,rbx
jz @f
mov eax,[rbx+Stat.maxValue]
mov [rbx+Stat.value],eax
@@:
pop rax
pop rbx
jmp original_PersonController_Update
MonoMethodHook(PersonController:Update)
[disable]
MonoMethodRestore(PersonController:Update)
dealloc(newmem)
* MonoMethodHook - hooks the method to jmp to the code following MonoMethodInit
* MonoMethodRestore - restores the original bytes that were replaced by hooking the method
As you can see in the code, I do 'jmp original_PersonController_Update' to continue executing the relocated code and jumping back to after where the replaced code was. Other options are 'jmp return_PersonController_Update' which skips the relocated code, so you need to make sure you took care of what it does. Also you could just 'ret' if you don't want the method to actually execute.
The attached table has a script with LUA to create the AA commands you can drop into your own tables (or copy the lua to your table script), a sample script with the code for the unlimited oxygen, and a script with the text being what is actually generated. For example the injected code section looks like this:
Code: Select all
label(original_PersonController_Update)
ALIGN 10
original_PersonController_Update:
push rbp
mov rbp,rsp
sub rsp,000009D0
mov [rbp-28],rsi
label(return_PersonController_Update)
return_PersonController_Update:
jmp 136FBB6000F
ALIGN 10
label(code_PersonController_Update)
code_PersonController_Update:
Code: Select all
PersonController:Update:
jmp code_PersonController_Update
Code: Select all
PersonController:Update:
db 55 48 8B EC 48 81 EC D0 09 00 00 48 89 75 D8