a couple extra scripts (tested only on 2033 redux)
Code: Select all
<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
<CheatEntries>
<CheatEntry>
<ID>7</ID>
<Description>"No Reload (Fs double barrel shotgun)"</Description>
<LastState/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>[ENABLE]
aobscanmodule(noReload,metro.exe,44 89 B6 48 04 00 00) // should be unique
alloc(newmem,$1000,"metro.exe"+2C0B2F)
newmem:
cmp [rsi+00000448],r14d
jg return
mov [rsi+00000448],r14d
jmp return
noReload:
jmp newmem
nop
nop
return:
registersymbol(noReload)
[DISABLE]
noReload:
db 44 89 B6 48 04 00 00
unregistersymbol(noReload)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "metro.exe"+2C0B2F
"metro.exe"+2C0B11: 0F B6 C8 - movzx ecx,al
"metro.exe"+2C0B14: 41 0F B6 C6 - movzx eax,r14l
"metro.exe"+2C0B18: 2B D1 - sub edx,ecx
"metro.exe"+2C0B1A: 2A C1 - sub al,cl
"metro.exe"+2C0B1C: C1 FA 1F - sar edx,1F
"metro.exe"+2C0B1F: 22 D0 - and dl,al
"metro.exe"+2C0B21: 02 D1 - add dl,cl
"metro.exe"+2C0B23: 0F B6 C2 - movzx eax,dl
"metro.exe"+2C0B26: 88 86 38 0B 00 00 - mov [rsi+00000B38],al
"metro.exe"+2C0B2C: 44 2B F0 - sub r14d,eax
// ---------- INJECTING HERE ----------
"metro.exe"+2C0B2F: 44 89 B6 48 04 00 00 - mov [rsi+00000448],r14d
// ---------- DONE INJECTING ----------
"metro.exe"+2C0B36: 48 8B 5C 24 40 - mov rbx,[rsp+40]
"metro.exe"+2C0B3B: 48 8B 6C 24 48 - mov rbp,[rsp+48]
"metro.exe"+2C0B40: 48 8B 74 24 50 - mov rsi,[rsp+50]
"metro.exe"+2C0B45: 48 83 C4 20 - add rsp,20
"metro.exe"+2C0B49: 41 5F - pop r15
"metro.exe"+2C0B4B: 41 5E - pop r14
"metro.exe"+2C0B4D: 5F - pop rdi
"metro.exe"+2C0B4E: C3 - ret
"metro.exe"+2C0B4F: 48 8B 03 - mov rax,[rbx]
"metro.exe"+2C0B52: 41 8B D6 - mov edx,r14d
}
</AssemblerScript>
</CheatEntry>
<CheatEntry>
<ID>14</ID>
<Description>"Max Secondary"</Description>
<LastState/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>[ENABLE]
aobscanmodule(secondary,metro.exe,8B 81 EC 06 00 00) // should be unique
secondary:
mov eax, 5
nop
registersymbol(secondary)
// last light
aobscanmodule(claymores,metro.exe,8B 81 1C 03 00 00 C3) // should be unique
claymores:
mov eax, 5
nop
registersymbol(claymores)
[DISABLE]
secondary:
db 8B 81 EC 06 00 00
unregistersymbol(secondary)
claymores:
db 8B 81 1C 03 00 00
unregistersymbol(claymores)
{
// ORIGINAL CODE - INJECTION POINT: "metro.exe"+1EA318
"metro.exe"+1EA2FF: CC - int 3
"metro.exe"+1EA300: 89 91 1C 03 00 00 - mov [rcx+0000031C],edx
"metro.exe"+1EA306: C3 - ret
"metro.exe"+1EA307: CC - int 3
// ---------- INJECTING CLAYMORES HERE ----------
"metro.exe"+1EA308: 8B 81 1C 03 00 00 - mov eax,[rcx+0000031C]
// ---------- DONE INJECTING ----------
"metro.exe"+1EA30E: C3 - ret
"metro.exe"+1EA30F: CC - int 3
"metro.exe"+1EA310: 89 91 EC 06 00 00 - mov [rcx+000006EC],edx
"metro.exe"+1EA316: C3 - ret
"metro.exe"+1EA317: CC - int 3
// ---------- INJECTING OTHERS HERE ----------
"metro.exe"+1EA318: 8B 81 EC 06 00 00 - mov eax,[rcx+000006EC]
// ---------- DONE INJECTING ----------
"metro.exe"+1EA31E: C3 - ret
"metro.exe"+1EA31F: CC - int 3
"metro.exe"+1EA320: 0F 57 C0 - xorps xmm0,xmm0
"metro.exe"+1EA323: 8B C2 - mov eax,edx
"metro.exe"+1EA325: F3 48 0F 2A C0 - cvtsi2ss xmm0,rax
"metro.exe"+1EA32A: F3 0F 11 81 50 02 00 00 - movss [rcx+00000250],xmm0
"metro.exe"+1EA332: C3 - ret
"metro.exe"+1EA333: CC - int 3
"metro.exe"+1EA334: F3 0F 10 81 50 02 00 00 - movss xmm0,[rcx+00000250]
"metro.exe"+1EA33C: F3 0F 58 05 D4 73 A3 00 - addss xmm0,[metro.exe+C21718]
}
</AssemblerScript>
</CheatEntry>
</CheatEntries>
</CheatTable>
here's one more (only tested on last light redux)
Code: Select all
<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
<CheatEntries>
<CheatEntry>
<ID>17</ID>
<Description>"Max Military Ammo"</Description>
<LastState Activated="1"/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>[ENABLE]
aobscanmodule(maxMilitaryAmmo,metro.exe,74 0C B8 F7 2A 00 00) // should be unique
maxMilitaryAmmo:
nop
nop
registersymbol(maxMilitaryAmmo)
[DISABLE]
maxMilitaryAmmo:
db 74 0C B8 F7 2A 00 00
unregistersymbol(maxMilitaryAmmo)
{
// ORIGINAL CODE - INJECTION POINT: "metro.exe"+4F7D80
"metro.exe"+4F7D6A: CC - int 3
"metro.exe"+4F7D6B: CC - int 3
"metro.exe"+4F7D6C: CC - int 3
"metro.exe"+4F7D6D: CC - int 3
"metro.exe"+4F7D6E: CC - int 3
"metro.exe"+4F7D6F: CC - int 3
"metro.exe"+4F7D70: 41 57 - push r15
"metro.exe"+4F7D72: 48 83 EC 30 - sub rsp,30
"metro.exe"+4F7D76: F6 05 13 E0 7D 00 08 - test byte ptr [metro.exe+CD5D90],08
"metro.exe"+4F7D7D: 4C 8B F9 - mov r15,rcx
// ---------- INJECTING HERE ----------
"metro.exe"+4F7D80: 74 0C - je metro.exe+4F7D8E
"metro.exe"+4F7D82: B8 F7 2A 00 00 - mov eax,00002AF7
// ---------- DONE INJECTING ----------
"metro.exe"+4F7D87: 48 83 C4 30 - add rsp,30
"metro.exe"+4F7D8B: 41 5F - pop r15
"metro.exe"+4F7D8D: C3 - ret
"metro.exe"+4F7D8E: 0F B7 81 FA 00 00 00 - movzx eax,word ptr [rcx+000000FA]
"metro.exe"+4F7D95: 48 89 74 24 50 - mov [rsp+50],rsi
"metro.exe"+4F7D9A: 33 F6 - xor esi,esi
"metro.exe"+4F7D9C: 85 C0 - test eax,eax
"metro.exe"+4F7D9E: 0F 84 E4 00 00 00 - je metro.exe+4F7E88
"metro.exe"+4F7DA4: 48 89 5C 24 40 - mov [rsp+40],rbx
"metro.exe"+4F7DA9: 48 89 6C 24 48 - mov [rsp+48],rbp
}
</AssemblerScript>
</CheatEntry>
</CheatEntries>
</CheatTable>
uses the same memory address as god mode (but not the same code so no script injection issues, both can be enabled and disabled separately)