Man, oh man
Discovered quite a lot of shit in the meantime. Although
ToggleWeaponInfiniteAmmo leads to a RET, I discovered that backtracing from the ammo subtraction function can lead to a "refresh" of the ammo. Simply put, there's a check "CMP EAX,3" (if server or client or something else) and the engine simply refreshes the amount you've fired out. Try this:
Code: Select all
OTWD-Win64-Shipping.exe+1A11436 - 83 F8 03 - cmp eax,03
OTWD-Win64-Shipping.exe+1A11439 - 7D 21 - jnl OTWD-Win64-Shipping.exe+1A1145C
Change that 7D to EB and fire your weapon
Then give it 1-2s and see what happens
Then here you will find the
MaxSpeedMultiplier processing:
Code: Select all
00007FF663DA6070 | 48:895C24 18 | MOV QWORD PTR SS:[RSP+18],RBX |
00007FF663DA6075 | 57 | PUSH RDI |
00007FF663DA6076 | 48:83EC 20 | SUB RSP,20 |
00007FF663DA607A | 80B9 14080000 05 | CMP BYTE PTR DS:[RCX+814],5 |
00007FF663DA6081 | 48:8BD9 | MOV RBX,RCX |
00007FF663DA6084 | 75 13 | JNE otwd-win64-shipping.7FF663DA6099 |
00007FF663DA6086 | 33FF | XOR EDI,EDI |
00007FF663DA6088 | 89B9 CC070000 | MOV DWORD PTR DS:[RCX+7CC],EDI |
00007FF663DA608E | 48:8B5C24 40 | MOV RBX,QWORD PTR SS:[RSP+40] |
00007FF663DA6093 | 48:83C4 20 | ADD RSP,20 |
00007FF663DA6097 | 5F | POP RDI |
00007FF663DA6098 | C3 | RET |
00007FF663DA6099 | 48:83B9 E0070000 00 | CMP QWORD PTR DS:[RCX+7E0],0 |
00007FF663DA60A1 | 48:896C24 30 | MOV QWORD PTR SS:[RSP+30],RBP |
00007FF663DA60A6 | 48:897424 38 | MOV QWORD PTR SS:[RSP+38],RSI |
00007FF663DA60AB | 74 1C | JE otwd-win64-shipping.7FF663DA60C9 |
00007FF663DA60AD | E8 6EE90600 | CALL otwd-win64-shipping.7FF663E14A20 |
00007FF663DA60B2 | 48:8B8B E0070000 | MOV RCX,QWORD PTR DS:[RBX+7E0] |
00007FF663DA60B9 | 48:8BD0 | MOV RDX,RAX | rax:&L"MaxSpeedMultiplier"
00007FF663DA60BC | E8 9FC77900 | CALL otwd-win64-shipping.7FF664542860 |
00007FF663DA60C1 | F3:0F1183 CC070000 | MOVSS DWORD PTR DS:[RBX+7CC],XMM0 |
00007FF663DA60C9 | 48:8BB3 00080000 | MOV RSI,QWORD PTR DS:[RBX+800] |
00007FF663DA60D0 | 33FF | XOR EDI,EDI |
00007FF663DA60D2 | 48:6383 08080000 | MOVSXD RAX,DWORD PTR DS:[RBX+808] | rax:&L"MaxSpeedMultiplier"
00007FF663DA60D9 | 48:8D0CC6 | LEA RCX,QWORD PTR DS:[RSI+RAX*8] |
00007FF663DA60DD | 48:8BE9 | MOV RBP,RCX |
00007FF663DA60E0 | 48:2BEE | SUB RBP,RSI |
00007FF663DA60E3 | 48:83C5 07 | ADD RBP,7 |
00007FF663DA60E7 | 48:C1ED 03 | SHR RBP,3 |
00007FF663DA60EB | 48:3BF1 | CMP RSI,RCX |
00007FF663DA60EE | 48:0F47EF | CMOVA RBP,RDI |
00007FF663DA60F2 | 48:85ED | TEST RBP,RBP |
00007FF663DA60F5 | 74 2D | JE otwd-win64-shipping.7FF663DA6124 |
00007FF663DA60F7 | 66:0F1F8400 00000000 | NOP WORD PTR DS:[RAX+RAX],AX |
00007FF663DA6100 | F3:0F108B CC070000 | MOVSS XMM1,DWORD PTR DS:[RBX+7CC] |
00007FF663DA6108 | 48:8B0E | MOV RCX,QWORD PTR DS:[RSI] |
00007FF663DA610B | E8 50760000 | CALL otwd-win64-shipping.7FF663DAD760 |
00007FF663DA6110 | 48:FFC7 | INC RDI |
00007FF663DA6113 | F3:0F1183 CC070000 | MOVSS DWORD PTR DS:[RBX+7CC],XMM0 |
00007FF663DA611B | 48:8D76 08 | LEA RSI,QWORD PTR DS:[RSI+8] |
00007FF663DA611F | 48:3BFD | CMP RDI,RBP |
00007FF663DA6122 | 75 DC | JNE otwd-win64-shipping.7FF663DA6100 |
00007FF663DA6124 | 48:8B6C24 30 | MOV RBP,QWORD PTR SS:[RSP+30] |
00007FF663DA6129 | 48:8B7424 38 | MOV RSI,QWORD PTR SS:[RSP+38] |
00007FF663DA612E | 48:8B5C24 40 | MOV RBX,QWORD PTR SS:[RSP+40] |
00007FF663DA6133 | 48:83C4 20 | ADD RSP,20 |
00007FF663DA6137 | 5F | POP RDI |
00007FF663DA6138 | C3 | RET |
Mainly here, where the property is read:
Code: Select all
OTWD-Win64-Shipping.exe+1FB3FDA - 48 63 57 44 - movsxd rdx,dword ptr [rdi+44]
OTWD-Win64-Shipping.exe+1FB3FDE - 48 8B CF - mov rcx,rdi
OTWD-Win64-Shipping.exe+1FB3FE1 - 48 8B 07 - mov rax,[rdi]
OTWD-Win64-Shipping.exe+1FB3FE4 - 48 03 D6 - add rdx,rsi
OTWD-Win64-Shipping.exe+1FB3FE7 - FF 90 60030000 - call qword ptr [rax+00000360] <-- enter
OTWD-Win64-Shipping.exe+1FB3FED - F2 0F5A C0 - cvtsd2ss xmm0,xmm0
OTWD-Win64-Shipping.exe+1FB3FF1 - 48 8B 5C 24 30 - mov rbx,[rsp+30]
OTWD-Win64-Shipping.exe+1FB3FF6 - 48 8B 74 24 38 - mov rsi,[rsp+38]
OTWD-Win64-Shipping.exe+1FB3FFB - 48 83 C4 20 - add rsp,20
OTWD-Win64-Shipping.exe+1FB3FFF - 5F - pop rdi
OTWD-Win64-Shipping.exe+1FB4000 - C3 - ret
..
..
OTWD-Win64-Shipping.exe+56E940 - F3 0F10 02 - movss xmm0,[rdx]
OTWD-Win64-Shipping.exe+56E944 - 0F5A C0 - vcvtps2pd xmm0,xmm0
OTWD-Win64-Shipping.exe+56E947 - C3 - ret
Note the above wrapper is used for other float values reading. In simpler terms, the MaxSpeedMultiplier is 1.0. Crank it up to 4-5 and see what happens when you move
BR,
Sun
L.E.: Not working in a public game