SunBeam wrote: ↑Tue May 23, 2017 12:35 pm
You can use AOBs too for the non-AOB
Just implement a function that calculates the x64 address (can provide that), then just scan for an AOB where that static is used
Heh yeah I know. I have implemented that function somewhere in a Assassin's creed syndicate cheat table (the timestop one), I haven't bothered to update my AOB scanner to pull values from blocks that way, but I guess I have to do that to avoid updating the stuff every time (the rest works without problems).
supersampling in v1.0.3:
Code: Select all
;0000000140FC3FF0 | 41 F7 F8 | idiv r8d
;0000000140FC3FF3 | 44 8B C0 | mov r8d,eax
;0000000140FC3FF6 | 8B C1 | mov eax,ecx
;0000000140FC3FF8 | 8B 0D 7A E7 4E 01 | mov ecx,dword ptr ds:[1424B2778] << Supersampling read
;0000000140FC3FFE | 99 | cdq
;0000000140FC3FFF | F7 FF | idiv edi
;0000000140FC4001 | 44 3B C0 | cmp r8d,eax
;0000000140FC4004 | 41 0F 4C C0 | cmovl eax,r8d
;0000000140FC4008 | 83 F9 01 | cmp ecx,1
;0000000140FC400B | 7D 07 | jge prey_dump.140FC4014
;0000000140FC400D | B8 01 00 00 00 | mov eax,1
;0000000140FC4012 | EB 05 | jmp prey_dump.140FC4019
;0000000140FC4014 | 3B C8 | cmp ecx,eax
;0000000140FC4016 | 0F 4C C1 | cmovl eax,ecx
;0000000140FC4019 | 39 83 F4 F3 00 00 | cmp dword ptr ds:[rbx+F3F4],eax
;0000000140FC401F | 74 13 | je prey_dump.140FC4034
;0000000140FC4021 | 89 83 F4 F3 00 00 | mov dword ptr ds:[rbx+F3F4],eax
;0000000140FC4027 | B0 01 | mov al,1
;0000000140FC4029 | 48 8B 5C 24 30 | mov rbx,qword ptr ss:[rsp+30]
;0000000140FC402E | 48 83 C4 20 | add rsp,20
;0000000140FC4032 | 5F | pop rdi
;0000000140FC4033 | C3 | ret
;0000000140FC4034 | 32 C0 | xor al,al
;0000000140FC4036 | 48 8B 5C 24 30 | mov rbx,qword ptr ss:[rsp+30]
;0000000140FC403B | 48 83 C4 20 | add rsp,20
;0000000140FC403F | 5F | pop rdi
;0000000140FC4040 | C3 | ret
sys_flash read: (hud toggle)
Code: Select all
;0000000146F06D30 | 48 89 74 24 10 | mov qword ptr ss:[rsp+10],rsi
;0000000146F06D35 | 57 | push rdi
;0000000146F06D36 | 48 83 EC 20 | sub rsp,20
;0000000146F06D3A | 83 3D 2B 46 48 FB 00 | cmp dword ptr ds:[14238B36C],0 << sys_flash read
;0000000146F06D41 | 0F B6 F2 | movzx esi,dl
;0000000146F06D44 | 48 89 CF | mov rdi,rcx
;0000000146F06D47 | 74 2E | je prey_dump.146F06D77
;0000000146F06D49 | 48 8B 81 C8 00 00 00 | mov rax,qword ptr ds:[rcx+C8]
;0000000146F06D50 | 48 89 5C 24 30 | mov qword ptr ss:[rsp+30],rbx
;0000000146F06D55 | 48 8B 58 38 | mov rbx,qword ptr ds:[rax+38]
;0000000146F06D59 | 48 8B 01 | mov rax,qword ptr ds:[rcx]
;0000000146F06D5C | FF 10 | call qword ptr ds:[rax]
;0000000146F06D5E | 48 8B 03 | mov rax,qword ptr ds:[rbx]
;0000000146F06D61 | 48 8D 57 08 | lea rdx,qword ptr ds:[rdi+8]
;0000000146F06D65 | 44 0F B6 C6 | movzx r8d,sil
;0000000146F06D69 | 48 89 D9 | mov rcx,rbx
;0000000146F06D6C | FF 90 68 03 00 00 | call qword ptr ds:[rax+368]
;0000000146F06D72 | 48 8B 5C 24 30 | mov rbx,qword ptr ss:[rsp+30]
;0000000146F06D77 | 48 8B 74 24 38 | mov rsi,qword ptr ss:[rsp+38]
;0000000146F06D7C | 48 83 C4 20 | add rsp,20
;0000000146F06D80 | 5F | pop rdi
;0000000146F06D81 | C3 | ret