So.. this is what I got so far:
Code: Select all
function _readInteger( Input )
-- thanks, Pox!
local Value = readInteger( Input )
if Value < 0x80000000 then return Value
else return Value - 0x100000000 end
end
function GetType( input )
return readQword( input + 0x10 )
end
function GetName( input )
local addr = readQword( readQword( readQword( readQword( input ) ) + 0x68 ) + 0x20 )
return readString( addr, 6000 )
end
local addr = 0x0000000012265C80
local szName = GetName( addr )
local szType = GetName( GetType( addr ) ) -- you may comment this if you get errors
print( string.format( "Struct: 0x%X\r\nName: %s\r\nType: %s\r\n- - - -" , addr, szName, szType ) )
Above function allows you to get this information:
Code: Select all
Struct: 0x15C777B0
Name: app.ropeway.survivor.Equipment
Type: via.GameObject
Or.. if you get an error and comment the line I mentioned, this:
Code: Select all
Struct: 0x12265C80
Name: app.ropeway.ReticleParam
Type: nil
That being said, to get the gun
reticle (should work for shotgun as well) to always and instantly calibrate to full lock (so,
super accuracy), tinker with this:
Code: Select all
re2.exe+F906994 - 48 85 C0 - test rax,rax
re2.exe+F906997 - 74 0A - je re2.exe+F9069A3
re2.exe+F906999 - F3 0F10 40 10 - movss xmm0,[rax+10] // rax == app.ropeway.ReticleParam
re2.exe+F90699E - 0F5A C0 - vcvtps2pd xmm0,xmm0
re2.exe+F9069A1 - EB 03 - jmp re2.exe+F9069A6
re2.exe+F9069A3 - 0F57 C0 - xorps xmm0,xmm0
Here:
Code: Select all
{ Game : re2.exe
Version:
Date : 2019-01-19
Author : SunBeam
This script does blah blah blah
}
define(address,"re2.exe"+F906999)
define(bytes,F3 0F 10 40 10)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,"re2.exe"+F906999)
label(code)
label(return)
newmem:
code:
movss xmm0,[rax+14]
movss [rax+10],xmm0
movss xmm0,[rax+10]
jmp return
address:
jmp newmem
return:
[DISABLE]
address:
db bytes
// movss xmm0,[rax+10]
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "re2.exe"+F906999
"re2.exe"+F906970: E8 AB 48 3C F2 - call re2.exe+1CCB220
"re2.exe"+F906975: E9 E6 FE FF FF - jmp re2.exe+F906860
"re2.exe"+F90697A: 48 89 FA - mov rdx,rdi
"re2.exe"+F90697D: 48 89 D9 - mov rcx,rbx
"re2.exe"+F906980: E8 7B D1 B6 F1 - call re2.exe+1473B00
"re2.exe"+F906985: 48 8B 4B 50 - mov rcx,[rbx+50]
"re2.exe"+F906989: 48 83 79 18 00 - cmp qword ptr [rcx+18],00
"re2.exe"+F90698E: 0F 85 D7 FE FF FF - jne re2.exe+F90686B
"re2.exe"+F906994: 48 85 C0 - test rax,rax
"re2.exe"+F906997: 74 0A - je re2.exe+F9069A3
// ---------- INJECTING HERE ----------
"re2.exe"+F906999: F3 0F 10 40 10 - movss xmm0,[rax+10]
// ---------- DONE INJECTING ----------
"re2.exe"+F90699E: 0F 5A C0 - vcvtps2pd xmm0,xmm0
"re2.exe"+F9069A1: EB 03 - jmp re2.exe+F9069A6
"re2.exe"+F9069A3: 0F 57 C0 - xorps xmm0,xmm0
"re2.exe"+F9069A6: 66 0F 5A C0 - cvtpd2ps xmm0,xmm0
"re2.exe"+F9069AA: F3 0F 11 87 20 01 00 00 - movss [rdi+00000120],xmm0
"re2.exe"+F9069B2: 48 8B 43 50 - mov rax,[rbx+50]
"re2.exe"+F9069B6: 48 83 78 18 00 - cmp qword ptr [rax+18],00
"re2.exe"+F9069BB: 0F 85 AA FE FF FF - jne re2.exe+F90686B
"re2.exe"+F9069C1: C6 87 24 01 00 00 00 - mov byte ptr [rdi+00000124],00
"re2.exe"+F9069C8: E9 9E FE FF FF - jmp re2.exe+F90686B
}
As for the demo timer.. it can be killed simply by adding this to your list: [[re2.exe+70236C0]+54] as byte. Set that byte from 1 to 0 and the game won't process the system timer, nor store it in your savegame. Its name is
app.ropeway.GameClock.
More, later
BR,
Sun