Did a bit of debugging regarding the
Flamethrower's pneumatic pump value and even though there's
l0wb1t's script for the first CPY version of the game, I couldn't help but want to do it properly. So I got to the value, debugged it, saw what writes to it. Then I noticed the same instruction that writes to it as value decreases when idle (cuz slider drops from 1 to like 0.66 and stays there) does the writing when you fire. To separate them I used the end 'RET' (Find out what addresses this instruction accesses) and found a bunch of addresses that are calling the write function when idle (4 of them) and when firing (only 1 hit). Dug around the "::OnFire" function then I decided to check the rest. And I found this:
Code: Select all
MetroExodus.exe+7FA5168 - 0F28 F1 - movaps xmm6,xmm1
MetroExodus.exe+7FA516B - FF 90 881C0000 - call qword ptr [rax+00001C88]
MetroExodus.exe+7FA5171 - 48 89 D9 - mov rcx,rbx
MetroExodus.exe+7FA5174 - 85 C0 - test eax,eax
MetroExodus.exe+7FA5176 - 74 24 - je MetroExodus.exe+7FA519C
I then tested the JE (NOP-ing it) and guess what.. value is always 1, full pressure, no matter what I do. Idle or fire
Then I inspected that dynamic member-function call and found this:
Code: Select all
call qword ptr [rax+00001C88]
..
MetroExodus.exe+326508 - E9 F3F91C00 - jmp MetroExodus.exe+4F5F00
..
MetroExodus.exe+4F5F00 - 33 C0 - xor eax,eax
MetroExodus.exe+4F5F02 - C3 - ret
So yeah.. guess what happens if you do this @ "MetroExodus.exe+4F5F00": "mov al,1" instead of "xor eax,eax"?
And yeah, I tested the RET to see if other game functions call this particular piece of code. There are 3 exits for the RET:
Code: Select all
MetroExodus.exe+7F91899 - FF 90 881C0000 - call qword ptr [rax+00001C88]
MetroExodus.exe+7FA516B - FF 90 881C0000 - call qword ptr [rax+00001C88]
MetroExodus.exe+7FA5AB1 - FF 90 881C0000 - call qword ptr [rax+00001C88]
The last one occurs when you fire the flamethrower, the 2nd one is ours (the one I talked about) and the 1st one is part of the "update pneumo while idle"
So.. either NOP that JE @ "MetroExodus.exe+7FA5176" or "mov al,1" instead of "xor eax,eax" @ "MetroExodus.exe+4F5F00" (I prefer the last one as it patches a member-function used by calculations in all the other functions).
Oh.. and this is for the
Epic Store version of the game. Use AOBs if you wanna find it in the Steam version. Or let me know.
Therefore, I give you
Instant Full & Unlimited Flamethrower Pneumo:
Code: Select all
[ENABLE]
MetroExodus.exe+4F5F00:
mov al,1
[DISABLE]
MetroExodus.exe+4F5F00:
xor eax,eax
// MetroExodus.exe+4F5F00 - 33 C0 - xor eax,eax
// MetroExodus.exe+4F5F02 - C3 - ret
Peace,
Sun