Re: Raft
Posted: Sat Jan 04, 2020 2:48 pm
I do not know if the game does allow you to enbale/disable a NPC - But if the shark is bothering you, then just use Fast Kill and you'll be good for a few minutes.
I do not know if the game does allow you to enbale/disable a NPC - But if the shark is bothering you, then just use Fast Kill and you'll be good for a few minutes.
I understood but I deeply doubt there's a piece of code that allows it. I can take a look at it, eventually if it's what you're waiting for.
Code: Select all
{ Game : Raft.exe
Version:
Author : Sigan
}
define(address,AI_StateMachine_Shark:UpdateStateMachine+2cf)
define(bytes,F3 0F 11 AE 94 01 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,AI_StateMachine_Shark:UpdateStateMachine+2cf)
label(code)
label(return)
newmem:
code:
movss [rsi+00000194],xmm5
mov [rsi+00000194],(float)0
jmp return
address:
jmp newmem
nop 3
return:
[DISABLE]
address:
db bytes
// movss [rsi+00000194],xmm5
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: AI_StateMachine_Shark:UpdateStateMachine+2cf
09D7E0B3: F3 0F 10 86 94 01 00 00 - movss xmm0,[rsi+00000194]
09D7E0BB: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
09D7E0BF: F2 0F 11 85 78 FF FF FF - movsd [rbp-00000088],xmm0
09D7E0C7: 48 8D AD 00 00 00 00 - lea rbp,[rbp+00000000]
09D7E0CE: 49 BB 40 2C BB 08 00 00 00 00 - mov r11,0000000008BB2C40
09D7E0D8: 41 FF D3 - call r11
09D7E0DB: F3 0F 5A C8 - cvtss2sd xmm1,xmm0
09D7E0DF: F2 0F 10 85 78 FF FF FF - movsd xmm0,[rbp-00000088]
09D7E0E7: F2 0F 58 C1 - addsd xmm0,xmm1
09D7E0EB: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0
// ---------- INJECTING HERE ----------
09D7E0EF: F3 0F 11 AE 94 01 00 00 - movss [rsi+00000194],xmm5
// ---------- DONE INJECTING ----------
09D7E0F7: F3 0F 10 86 94 01 00 00 - movss xmm0,[rsi+00000194]
09D7E0FF: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
09D7E103: F2 0F 11 45 90 - movsd [rbp-70],xmm0
09D7E108: 48 8B CE - mov rcx,rsi
09D7E10B: 66 66 90 - nop
09D7E10E: 49 BB C0 B1 E1 09 00 00 00 00 - mov r11,0000000009E1B1C0
09D7E118: 41 FF D3 - call r11
09D7E11B: F3 0F 5A C8 - cvtss2sd xmm1,xmm0
09D7E11F: F2 0F 10 45 90 - movsd xmm0,[rbp-70]
09D7E124: 66 0F 2F C8 - comisd xmm1,xmm0
}
Code: Select all
{ Game : Raft.exe
Version:
Author : Sigan
}
define(address,Cropplot:Update+28)
define(bytes,48 8B 86 D0 00 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,Cropplot:Update+28)
globalalloc(_plots,4)
label(code)
label(return)
newmem:
code:
mov byte ptr [rsi+100],00
mov rax,[rsi+000000D0]
jmp return
address:
jmp newmem
nop 2
return:
[DISABLE]
address:
db bytes
// mov rax,[rsi+000000D0]
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Cropplot:Update+28
0C38A394: 48 83 EC 50 - sub rsp,50
0C38A398: 48 89 75 D8 - mov [rbp-28],rsi
0C38A39C: 48 89 7D E0 - mov [rbp-20],rdi
0C38A3A0: 4C 89 6D E8 - mov [rbp-18],r13
0C38A3A4: 4C 89 75 F0 - mov [rbp-10],r14
0C38A3A8: 4C 89 7D F8 - mov [rbp-08],r15
0C38A3AC: 48 8B F1 - mov rsi,rcx
0C38A3AF: 45 33 FF - xor r15d,r15d
0C38A3B2: E9 77 00 00 00 - jmp 0C38A42E
0C38A3B7: 90 - nop
// ---------- INJECTING HERE ----------
0C38A3B8: 48 8B 86 D0 00 00 00 - mov rax,[rsi+000000D0]
// ---------- DONE INJECTING ----------
0C38A3BF: 4C 8B F0 - mov r14,rax
0C38A3C2: 4D 8B EF - mov r13,r15
0C38A3C5: 83 38 00 - cmp dword ptr [rax],00
0C38A3C8: 49 63 46 18 - movsxd rax,dword ptr [r14+18]
0C38A3CC: 44 3B E8 - cmp r13d,eax
0C38A3CF: 0F 83 8D 00 00 00 - jae 0C38A462
0C38A3D5: 49 8B 46 10 - mov rax,[r14+10]
0C38A3D9: 49 63 CD - movsxd rcx,r13d
0C38A3DC: 48 8D 44 C8 20 - lea rax,[rax+rcx*8+20]
0C38A3E1: 48 8B 38 - mov rdi,[rax]
}
Code: Select all
{ Game : Raft.exe
Version:
Author : Sigan
}
define(address,MotorWheel:Update+f)
define(bytes,0F B6 86 BD 00 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,MotorWheel:Update+f)
label(code)
label(return)
newmem:
push rdx
push rdi
mov rdx,[rsi+30] //FuelTank
mov rdi,[rdx+60] //maxWater
mov [rdx+58],rdi //currentWater
pop rdi
pop rdx
code:
movzx eax,byte ptr [rsi+000000BD]
jmp return
address:
jmp newmem
nop 2
return:
[DISABLE]
address:
db bytes
// movzx eax,byte ptr [rsi+000000BD]
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: MotorWheel:Update+f
0A43FED6: 00 00 - add [rax],al
0A43FED8: 00 00 - add [rax],al
0A43FEDA: 00 00 - add [rax],al
0A43FEDC: 00 00 - add [rax],al
0A43FEDE: 00 00 - add [rax],al
0A43FEE0: 55 - push rbp
0A43FEE1: 48 8B EC - mov rbp,rsp
0A43FEE4: 48 83 EC 30 - sub rsp,30
0A43FEE8: 48 89 75 F8 - mov [rbp-08],rsi
0A43FEEC: 48 8B F1 - mov rsi,rcx
// ---------- INJECTING HERE ----------
0A43FEEF: 0F B6 86 BD 00 00 00 - movzx eax,byte ptr [rsi+000000BD]
// ---------- DONE INJECTING ----------
0A43FEF6: 85 C0 - test eax,eax
0A43FEF8: 0F 84 CD 00 00 00 - je 0A43FFCB
0A43FEFE: 48 8B CE - mov rcx,rsi
0A43FF01: 48 8D 64 24 00 - lea rsp,[rsp+00]
0A43FF06: 49 BB 30 09 48 0A 00 00 00 00 - mov r11,000000000A480930
0A43FF10: 41 FF D3 - call r11
0A43FF13: 85 C0 - test eax,eax
0A43FF15: 0F 84 A0 00 00 00 - je 0A43FFBB
0A43FF1B: 66 66 90 - nop
0A43FF1E: 49 BB 50 7F C4 08 00 00 00 00 - mov r11,0000000008C47F50
}
Code: Select all
{ Game : Raft.exe
Version:
Author : Sigan
}
define(address,SteeringWheel:get_SteeringRotation+29)
define(bytes,F3 0F 10 56 68)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,SteeringWheel:get_SteeringRotation+29)
globalalloc(_wheel,4)
label(code)
label(return)
newmem:
code:
mov [_wheel],rsi
movss xmm2,[rsi+68]
jmp return
address:
jmp newmem
return:
[DISABLE]
address:
db bytes
// movss xmm2,[rsi+68]
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SteeringWheel:get_SteeringRotation+29
0A48C370: 55 - push rbp
0A48C371: 48 8B EC - mov rbp,rsp
0A48C374: 48 83 EC 40 - sub rsp,40
0A48C378: 48 89 75 F8 - mov [rbp-08],rsi
0A48C37C: 48 8B F1 - mov rsi,rcx
0A48C37F: F3 0F 10 46 6C - movss xmm0,[rsi+6C]
0A48C384: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
0A48C388: 66 0F 57 05 A0 00 00 00 - xorpd xmm0,[0A48C430]
0A48C390: F3 0F 10 4E 6C - movss xmm1,[rsi+6C]
0A48C395: F3 0F 5A C9 - cvtss2sd xmm1,xmm1
// ---------- INJECTING HERE ----------
0A48C399: F3 0F 10 56 68 - movss xmm2,[rsi+68]
// ---------- DONE INJECTING ----------
0A48C39E: F3 0F 5A D2 - cvtss2sd xmm2,xmm2
0A48C3A2: F2 0F 5A EA - cvtsd2ss xmm5,xmm2
0A48C3A6: F3 0F 11 6D F4 - movss [rbp-0C],xmm5
0A48C3AB: F3 0F 10 55 F4 - movss xmm2,[rbp-0C]
0A48C3B0: F3 0F 5A D2 - cvtss2sd xmm2,xmm2
0A48C3B4: F3 0F 10 1D 64 00 00 00 - movss xmm3,[0A48C420]
0A48C3BC: F3 0F 5A DB - cvtss2sd xmm3,xmm3
0A48C3C0: F3 0F 10 25 48 00 00 00 - movss xmm4,[0A48C410]
0A48C3C8: F3 0F 5A E4 - cvtss2sd xmm4,xmm4
0A48C3CC: F2 0F 5A EC - cvtsd2ss xmm5,xmm4
}
Mine is a mess now. It's easier to copy one of those, paste it into the Auto Assembler, click File ->Assign to current cheat table, and close the Auto Assembler. Then, in the cheat table, title the script as you feel so inclined, and activate it. Activate mono features first!