So I've screwed around a bit trying to grab the coordinates, the player coordinates were simple enough and I'm sure others have already found and utilized the coordinates for their teleportation scripts, and I think mine is under risk of being called by different function since I just grabbed the first instruction that accessed it that seemingly only was used by just the player, but nonetheless:
Code: Select all
<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
<CheatEntries>
<CheatEntry>
<ID>552</ID>
<Description>"GRAB PLAYER COORDINATES"</Description>
<Options moHideChildren="1"/>
<LastState/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>{ Game : ds.exe
Version:
Date : 2020-08-15
Author : SenorPlebeian
This script grabs the coordinates of the player that
you can alter to move Sam's position
}
[ENABLE]
aobscanmodule(GRABPLAYERCOORDINATES,ds.exe,C5 FA 10 82 80 00 00 00 * * * * C4) // should be unique
alloc(newmem,$1000,"ds.exe"+19C3DA1)
alloc(coordinates, 8)
registersymbol(coordinates)
label(code)
label(return)
newmem:
code:
mov [coordinates], rdx
vmovss xmm0,[rdx+00000080]
jmp return
GRABPLAYERCOORDINATES:
jmp newmem
nop 3
return:
registersymbol(GRABPLAYERCOORDINATES)
[DISABLE]
GRABPLAYERCOORDINATES:
db C5 FA 10 82 80 00 00 00
unregistersymbol(GRABPLAYERCOORDINATES)
unregistersymbol(coordinates)
dealloc(coordinates)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "ds.exe"+19C3DA1
"ds.exe"+19C3D6C: C5 E8 58 C6 - vaddps xmm0,xmm2,xmm6
"ds.exe"+19C3D70: C5 F8 28 74 24 60 - vmovaps xmm6,[rsp+60]
"ds.exe"+19C3D76: 49 8B C0 - mov rax,r8
"ds.exe"+19C3D79: C5 F8 58 E2 - vaddps xmm4,xmm0,xmm2
"ds.exe"+19C3D7D: C5 F2 59 15 3B FB D9 01 - vmulss xmm2,xmm1,[ds.exe+37638C0]
"ds.exe"+19C3D85: C5 EA 58 05 07 38 DB 01 - vaddss xmm0,xmm2,[ds.exe+3777594]
"ds.exe"+19C3D8D: C5 C2 5A D7 - vcvtss2sd xmm2,xmm7,xmm7
"ds.exe"+19C3D91: C5 F8 28 7C 24 50 - vmovaps xmm7,[rsp+50]
"ds.exe"+19C3D97: C5 E0 57 DB - vxorps xmm3,xmm3,xmm3
"ds.exe"+19C3D9B: C4 E3 61 21 D8 20 - unknown avx 0F3A 21 xmm3,xmm3,xmm0,20
// ---------- INJECTING HERE ----------
"ds.exe"+19C3DA1: C5 FA 10 82 80 00 00 00 - vmovss xmm0,[rdx+00000080]
// ---------- DONE INJECTING ----------
"ds.exe"+19C3DA9: C5 FA 5A C0 - vcvtss2sd xmm0,xmm0,xmm0
"ds.exe"+19C3DAD: C4 C1 7B 58 C8 - vaddsd xmm1,xmm0,xmm8
"ds.exe"+19C3DB2: C5 D8 58 EB - vaddps xmm5,xmm4,xmm3
"ds.exe"+19C3DB6: C5 D2 5A C5 - vcvtss2sd xmm0,xmm5,xmm5
"ds.exe"+19C3DBA: C5 F3 5C C8 - vsubsd xmm1,xmm1,xmm0
"ds.exe"+19C3DBE: C4 C1 7B 11 08 - vmovsd [r8],xmm1
"ds.exe"+19C3DC3: C5 D0 C6 C5 55 - vshufps xmm0,xmm5,xmm5,55
"ds.exe"+19C3DC8: C4 41 39 15 C0 - vunpckhpd xmm8,xmm8,xmm8
"ds.exe"+19C3DCD: C4 C1 6B 58 C8 - vaddsd xmm1,xmm2,xmm8
"ds.exe"+19C3DD2: C5 78 28 44 24 40 - vmovaps xmm8,[rsp+40]
}
</AssemblerScript>
<CheatEntries>
<CheatEntry>
<ID>553</ID>
<Description>"Player X"</Description>
<VariableType>Float</VariableType>
<Address>coordinates</Address>
<Offsets>
<Offset>80</Offset>
</Offsets>
<CheatEntries>
<CheatEntry>
<ID>554</ID>
<Description>"Player Y"</Description>
<VariableType>Float</VariableType>
<Address>+4</Address>
</CheatEntry>
<CheatEntry>
<ID>555</ID>
<Description>"Player Z"</Description>
<VariableType>Float</VariableType>
<Address>+8</Address>
</CheatEntry>
</CheatEntries>
</CheatEntry>
</CheatEntries>
</CheatEntry>
</CheatEntries>
</CheatTable>
Vehicle coordinates were a little more finicky, but I think I found at least one part of the addresses responsible for the vehicle's placement. The first set of coordinates seems to control where the vehicle is once it starts moving while the second one seems responsible for loading where they are in general. Whether it will actually teleport or not is slightly intermittent, I believe the vehicle needs to come to a complete stop or it will simply just revert the coordinates back to it was before, but maybe someone can find a more clever use of it.
Code: Select all
<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
<CheatEntries>
<CheatEntry>
<ID>565</ID>
<Description>"GRAB VEHICLE COORDINATES"</Description>
<Options moHideChildren="1"/>
<LastState/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>{ Game : ds.exe
Version:
Date : 2020-08-15
Author : SenorPlebeian
This script grabs the coordinates of the vehicle when
You start moving it and allows you to change the vehicles
Coordinates while you're inside it (Kind of finicky)
}
[ENABLE]
aobscanmodule(GRAB_VEHICLE_COORDS,ds.exe,1F * * * * C8 00 00 00 C5 F8 11 87 78 08 00 00) // should be unique
alloc(newmem,$1000,"ds.exe"+2BF86A6)
alloc(vehcoordinates, 8)
registersymbol(vehcoordinates)
label(code)
label(return)
newmem:
mov [vehcoordinates], rdi
code:
vmovups [rdi+00000878],xmm0
jmp return
GRAB_VEHICLE_COORDS+09:
jmp newmem
nop 3
return:
registersymbol(GRAB_VEHICLE_COORDS)
[DISABLE]
GRAB_VEHICLE_COORDS+09:
db C5 F8 11 87 78 08 00 00
unregistersymbol(GRAB_VEHICLE_COORDS)
unregistersymbol(vehcoordinates)
dealloc(vehcoordinates)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "ds.exe"+2BF86A6
"ds.exe"+2BF8669: 48 8D 8F 90 08 00 00 - lea rcx,[rdi+00000890]
"ds.exe"+2BF8670: C5 F8 28 74 24 30 - vmovaps xmm6,[rsp+30]
"ds.exe"+2BF8676: 48 8B 5C 24 50 - mov rbx,[rsp+50]
"ds.exe"+2BF867B: 74 21 - je ds.exe+2BF869E
"ds.exe"+2BF867D: C5 F8 10 87 F8 08 00 00 - vmovups xmm0,[rdi+000008F8]
"ds.exe"+2BF8685: C5 F8 11 87 78 08 00 00 - vmovups [rdi+00000878],xmm0
"ds.exe"+2BF868D: C5 FB 10 8F 08 09 00 00 - vmovsd xmm1,[rdi+00000908]
"ds.exe"+2BF8695: 48 8D 87 10 09 00 00 - lea rax,[rdi+00000910]
"ds.exe"+2BF869C: EB 1F - jmp ds.exe+2BF86BD
"ds.exe"+2BF869E: C5 F8 10 87 C8 00 00 00 - vmovups xmm0,[rdi+000000C8]
// ---------- INJECTING HERE ----------
"ds.exe"+2BF86A6: C5 F8 11 87 78 08 00 00 - vmovups [rdi+00000878],xmm0
// ---------- DONE INJECTING ----------
"ds.exe"+2BF86AE: C5 FB 10 8F D8 00 00 00 - vmovsd xmm1,[rdi+000000D8]
"ds.exe"+2BF86B6: 48 8D 87 E0 00 00 00 - lea rax,[rdi+000000E0]
"ds.exe"+2BF86BD: C5 FB 11 8F 88 08 00 00 - vmovsd [rdi+00000888],xmm1
"ds.exe"+2BF86C5: 48 3B C8 - cmp rcx,rax
"ds.exe"+2BF86C8: 74 0E - je ds.exe+2BF86D8
"ds.exe"+2BF86CA: C5 FC 10 00 - vmovups ymm0,[rax]
"ds.exe"+2BF86CE: C5 FC 11 01 - vmovups [rcx],ymm0
"ds.exe"+2BF86D2: 8B 40 20 - mov eax,[rax+20]
"ds.exe"+2BF86D5: 89 41 20 - mov [rcx+20],eax
"ds.exe"+2BF86D8: 83 8F 38 05 00 00 04 - or dword ptr [rdi+00000538],04
}
</AssemblerScript>
<CheatEntries>
<CheatEntry>
<ID>566</ID>
<Description>"Veh X"</Description>
<Options moRecursiveSetValue="1"/>
<VariableType>Double</VariableType>
<Address>vehcoordinates</Address>
<Offsets>
<Offset>878</Offset>
</Offsets>
<CheatEntries>
<CheatEntry>
<ID>575</ID>
<Description>"Secondary Veh X"</Description>
<VariableType>Double</VariableType>
<Address>-7B0</Address>
</CheatEntry>
</CheatEntries>
</CheatEntry>
<CheatEntry>
<ID>573</ID>
<Description>"Veh Y"</Description>
<Options moRecursiveSetValue="1"/>
<VariableType>Double</VariableType>
<Address>vehcoordinates</Address>
<Offsets>
<Offset>880</Offset>
</Offsets>
<CheatEntries>
<CheatEntry>
<ID>576</ID>
<Description>"Secondary Veh Y"</Description>
<VariableType>Double</VariableType>
<Address>-7B0</Address>
</CheatEntry>
</CheatEntries>
</CheatEntry>
<CheatEntry>
<ID>574</ID>
<Description>"Veh Z"</Description>
<Options moRecursiveSetValue="1"/>
<VariableType>Double</VariableType>
<Address>vehcoordinates</Address>
<Offsets>
<Offset>888</Offset>
</Offsets>
<CheatEntries>
<CheatEntry>
<ID>577</ID>
<Description>"Secondary Veh Z"</Description>
<VariableType>Double</VariableType>
<Address>-7B0</Address>
</CheatEntry>
</CheatEntries>
</CheatEntry>
</CheatEntries>
</CheatEntry>
</CheatEntries>
</CheatTable>