Re: RAGE 2 [Engine:APEX]
Posted: Mon Sep 02, 2019 2:55 pm
I haven't read all ten pages, so maybe this was already done, but here's a script to override FOV while in a vehicle.
.CEA
Code: Select all
[ENABLE]
aobscanmodule(origin_GetVehicleFov,RAGE2.exe,8B 81 ?? ?? 00 00 41 89 87 ?? ?? 00 00 41 80 8F ?? ?? 00 00 04)
registersymbol(origin_GetVehicleFov)
alloc(MEM_GetVehicleFov,$1000,"RAGE2.exe")
label(DATA_VehicleFovOverride)
registersymbol(DATA_VehicleFovOverride)
label(bytes_GetVehicleFov)
registersymbol(bytes_GetVehicleFov)
label(detour_GetVehicleFov)
label(return_GetVehicleFov)
MEM_GetVehicleFov://////////////////////////////////////////////////////////////
DATA_VehicleFovOverride:
dd (float)1.447131991 //115 FOV
bytes_GetVehicleFov:
readmem(origin_GetVehicleFov,6)
align #16
detour_GetVehicleFov:
mov eax,[DATA_VehicleFovOverride]
jmp return_GetVehicleFov
origin_GetVehicleFov:///////////////////////////////////////////////////////////
jmp detour_GetVehicleFov
nop
return_GetVehicleFov:
[DISABLE]
origin_GetVehicleFov:
readmem(bytes_GetVehicleFov,6)
unregistersymbol(origin_GetVehicleFov)
unregistersymbol(DATA_VehicleFovOverride)
unregistersymbol(bytes_GetVehicleFov)
dealloc(MEM_GetVehicleFov)
{
// ORIGINAL CODE - INJECTION POINT: "RAGE2.exe"+5F84C9
"RAGE2.exe"+5F849D: 49 8B CF - mov rcx,r15
"RAGE2.exe"+5F84A0: E8 DB A1 A7 FF - call RAGE2.exe+72680
"RAGE2.exe"+5F84A5: 4C 8D 45 E0 - lea r8,[rbp-20]
"RAGE2.exe"+5F84A9: 48 8D 54 24 40 - lea rdx,[rsp+40]
"RAGE2.exe"+5F84AE: 48 8D 4D F0 - lea rcx,[rbp-10]
"RAGE2.exe"+5F84B2: E8 59 10 A6 FF - call RAGE2.exe+59510
"RAGE2.exe"+5F84B7: 48 8B D0 - mov rdx,rax
"RAGE2.exe"+5F84BA: 49 8B CF - mov rcx,r15
"RAGE2.exe"+5F84BD: E8 8E 0C A7 FF - call RAGE2.exe+69150
"RAGE2.exe"+5F84C2: 48 8B 8D 38 0A 00 00 - mov rcx,[rbp+00000A38]
// ---------- INJECTING HERE ----------
"RAGE2.exe"+5F84C9: 8B 81 48 02 00 00 - mov eax,[rcx+00000248]
// ---------- DONE INJECTING ----------
"RAGE2.exe"+5F84CF: 41 89 87 C0 00 00 00 - mov [r15+000000C0],eax
"RAGE2.exe"+5F84D6: 41 80 8F 34 01 00 00 04 - or byte ptr [r15+00000134],04
"RAGE2.exe"+5F84DE: 48 8D 54 24 40 - lea rdx,[rsp+40]
"RAGE2.exe"+5F84E3: 49 8B CF - mov rcx,r15
"RAGE2.exe"+5F84E6: E8 75 E2 A6 FF - call RAGE2.exe+66760
"RAGE2.exe"+5F84EB: 48 8D 54 24 50 - lea rdx,[rsp+50]
"RAGE2.exe"+5F84F0: 48 8D 4C 24 40 - lea rcx,[rsp+40]
"RAGE2.exe"+5F84F5: E8 F6 DF A6 FF - call RAGE2.exe+664F0
"RAGE2.exe"+5F84FA: 48 8B D0 - mov rdx,rax
"RAGE2.exe"+5F84FD: 48 8D 4D 98 - lea rcx,[rbp-68]
}