Kekner wrote: ↑Tue Feb 27, 2024 3:16 pm
Does anyone have a sample script to launch on game start before gg can initialise? Would be eternally grateful
Code: Select all
Inf. material(samples)
simple again, find the First samples visual counts.
go to in-game loot sample 1 -> scan -> loot -> scan
if you have found the first sample 1 address that is really sample 1
Sample 1 Address + 4 = Sample 2
Sample 1 Address + 8 = Sample 3
this is a tip for samples Pointer / Offset
AoB 45 85 C9 0F 84 ? ? ? ? 48 89 6C 24 ? 41 56 48 83 EC ? 3B 15
scan this array and goto disassembler
//you will see this down below opcodes
test r9d,r9d
je game.dll+528E13
mov [rsp+20],rbp
push r14
sub rsp,20
cmp edx,[game.dll+170520C]
mov ebp,r9d
mov r10,[game.dll+1672E58] <-------- this place [address] << this address is samples pointer address
mov r14d,r8d
je game.dll+528DCA
mov r9d,[r10+00000818]
xor r8d,r8d
mov r11d,[r10+00000820]
///// And If you go down (scroll down a bit)
lea rax,[rdx+rdx*4]
lea rcx,[rcx+rax*2]
add [r10+rcx*4+000017EC],r14d <---------- you will see this part 17ec < this is the Sample 1 Offset
lea rax,[rdx+00000099]
lea rax,[rax+rax*4]
you can add to the table
Pointer Address and Offset
to use Sample 1, 2, 3
Pointer game.dll+1672E58
Offset 17EC
= Sample 1
Value max 500
Pointer game.dll+1672E58
Offset 17F0
= Sample 2
Value max 250
Pointer game.dll+1672E58
Offset 17F4
= Sample 3
Value max 100
I found the function by debugging and realized it there was pointer so more simple to use.
backup somewhere for every updates.
using pointer/offset with modding only for values don't really need any bypasses.
@killerkrok555 send me redact this code, but I haven't checked it yet.
Code: Select all
{ Game : helldivers2.exe
Version:
Date : 2024-02-27
Author : admin
This script does blah blah blah
}
[ENABLE]
aobscanmodule(samples,game.dll,4C 8B 15 54 EB 14 01) // should be unique
alloc(newmem,$1000,samples)
label(code)
label(return)
newmem:
push rax
mov rax,[game.dll+1677218]
mov [rax+17EC],(int)499
mov [rax+17F0],(int)249
mov [rax+17F4],(int)99
pop rax
code:
mov r10,[game.dll+1677218]
jmp return
samples:
jmp newmem
nop 2
return:
registersymbol(samples)
[DISABLE]
samples:
db 4C 8B 15 54 EB 14 01
unregistersymbol(samples)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: game.dll+5286BD
game.dll+52869D: CC - int 3
game.dll+52869E: CC - int 3
game.dll+52869F: CC - int 3
game.dll+5286A0: 45 85 C9 - test r9d,r9d
game.dll+5286A3: 0F 84 EA 00 00 00 - je game.dll+528793
game.dll+5286A9: 48 89 6C 24 20 - mov [rsp+20],rbp
game.dll+5286AE: 41 56 - push r14
game.dll+5286B0: 48 83 EC 20 - sub rsp,20
game.dll+5286B4: 3B 15 92 0E 1E 01 - cmp edx,[game.dll+170954C]
game.dll+5286BA: 41 8B E9 - mov ebp,r9d
// ---------- INJECTING HERE ----------
game.dll+5286BD: 4C 8B 15 54 EB 14 01 - mov r10,[game.dll+1677218]
// ---------- DONE INJECTING ----------
game.dll+5286C4: 45 8B F0 - mov r14d,r8d
game.dll+5286C7: 0F 84 7D 00 00 00 - je game.dll+52874A
game.dll+5286CD: 45 8B 8A 18 08 00 00 - mov r9d,[r10+00000818]
game.dll+5286D4: 45 33 C0 - xor r8d,r8d
game.dll+5286D7: 45 8B 9A 20 08 00 00 - mov r11d,[r10+00000820]
game.dll+5286DE: 48 89 5C 24 30 - mov [rsp+30],rbx
game.dll+5286E3: 48 89 74 24 38 - mov [rsp+38],rsi
game.dll+5286E8: 44 0F AF DA - imul r11d,edx
game.dll+5286EC: 41 8D 71 FF - lea esi,[r9-01]
game.dll+5286F0: 48 89 7C 24 40 - mov [rsp+40],rdi
}
I think in any case, because of the anti-cheat, the game will crash, it will be enough to write some hook about joining the process. I think it was done because of artmoney. The possible surest solution is dll inject(bypass), but damn. if anichit were still applicable in some game, it would be fine. And so......
