Titanfall 2 v2.0.6.1 +14 Trainer

Aug 5, 2017
45
0
6
#5
thanks for the trainer
hope you can tell me what value type you search for instant cloak cool down
and you find it by decreased, increased value or there's another way to find such values
 

ArmY of 0n3

FearLess CE
Table Maker
May 20, 2017
128
38
28
#6
pharaon post_id=14720 time=1501940852 user_id=7613 said:
thanks for the trainer
hope you can tell me what value type you search for instant cloak cool down
and you find it by decreased, increased value or there's another way to find such values
Code:
{ Game   : Titanfall2.exe
  Version: 
  Date   : 2017-07-15
  Author : Yavor

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(Cooldown,server.dll,F3 0F 11 8F A0 12 00 00 8B D6 48 8B CF E8 62) // should be unique
alloc(newmem,$1000,"server.dll"+6A0CDC)

label(code)
label(return)

newmem:

code:
 //movss [rdi+000012A0],xmm1
  mov [rdi+000012A0],(float)1
  jmp return

Cooldown:
  jmp newmem
  nop
  nop
  nop
return:
registersymbol(Cooldown)

[DISABLE]

Cooldown:
  db F3 0F 11 8F A0 12 00 00

unregistersymbol(Cooldown)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "server.dll"+6A0CDC

"server.dll"+6A0CA6: 74 34                       -  je server.dll+6A0CDC
"server.dll"+6A0CA8: 48 8B 05 39 C4 55 00        -  mov rax,[server.dll+BFD0E8]
"server.dll"+6A0CAF: 48 8B 98 80 00 00 00        -  mov rbx,[rax+00000080]
"server.dll"+6A0CB6: FF 15 BC 59 1C 00           -  call qword ptr [server.dll+866678]
"server.dll"+6A0CBC: 48 63 C8                    -  movsxd  rcx,eax
"server.dll"+6A0CBF: 48 0F BF C5                 -  movsx rax,bp
"server.dll"+6A0CC3: 48 C1 E1 0C                 -  shl rcx,0C
"server.dll"+6A0CC7: 48 03 C8                    -  add rcx,rax
"server.dll"+6A0CCA: 66 44 09 BC 4B 40 60 01 00  -  or [rbx+rcx*2+00016040],r15w
"server.dll"+6A0CD3: F3 0F 10 8C 24 88 00 00 00  -  movss xmm1,[rsp+00000088]
// ---------- INJECTING HERE ----------
"server.dll"+6A0CDC: F3 0F 11 8F A0 12 00 00     -  movss [rdi+000012A0],xmm1
// ---------- DONE INJECTING  ----------
"server.dll"+6A0CE4: 8B D6                       -  mov edx,esi
"server.dll"+6A0CE6: 48 8B CF                    -  mov rcx,rdi
"server.dll"+6A0CE9: E8 62 4F 00 00              -  call server.dll+6A5C50
"server.dll"+6A0CEE: 8B 8F B8 0E 00 00           -  mov ecx,[rdi+00000EB8]
"server.dll"+6A0CF4: 83 F9 FF                    -  cmp ecx,-01
"server.dll"+6A0CF7: 0F 84 92 00 00 00           -  je server.dll+6A0D8F
"server.dll"+6A0CFD: 0F B7 C1                    -  movzx eax,cx
"server.dll"+6A0D00: 3D 00 40 00 00              -  cmp eax,00004000
"server.dll"+6A0D05: 0F 8D 84 00 00 00           -  jnl server.dll+6A0D8F
"server.dll"+6A0D0B: 48 8D 1C 40                 -  lea rbx,[rax+rax*2]
}
 
Top Bottom