Frans posted on his GitHub a CT file enabling Ansel (
Photo Mode)
everywhere and disabling the maximum radius you can move camera in. While this is nice and dandy, there are maps where Camera Mode still remains disabled:
Did some inspection and found the logic behind the shitz:
Code: Select all
MetroExodus.exe+86BE2A0 - 48 89 5C 24 08 - mov [rsp+08],rbx
MetroExodus.exe+86BE2A5 - 57 - push rdi
MetroExodus.exe+86BE2A6 - 48 83 EC 20 - sub rsp,20
MetroExodus.exe+86BE2AA - 48 8B 05 2F87F2F8 - mov rax,[MetroExodus.exe+15E69E0]
MetroExodus.exe+86BE2B1 - 48 89 CF - mov rdi,rcx
MetroExodus.exe+86BE2B4 - 48 8B 48 28 - mov rcx,[rax+28]
MetroExodus.exe+86BE2B8 - 48 85 C9 - test rcx,rcx
MetroExodus.exe+86BE2BB - 74 1E - je MetroExodus.exe+86BE2DB
MetroExodus.exe+86BE2BD - 48 8B 01 - mov rax,[rcx]
MetroExodus.exe+86BE2C0 - FF 90 20080000 - call qword ptr [rax+00000820]
MetroExodus.exe+86BE2C6 - 48 85 C0 - test rax,rax
MetroExodus.exe+86BE2C9 - 74 10 - je MetroExodus.exe+86BE2DB
MetroExodus.exe+86BE2CB - 48 8B 10 - mov rdx,[rax]
MetroExodus.exe+86BE2CE - 48 89 C1 - mov rcx,rax
MetroExodus.exe+86BE2D1 - FF 92 08190000 - call qword ptr [rdx+00001908]
MetroExodus.exe+86BE2D7 - 89 C3 - mov ebx,eax
MetroExodus.exe+86BE2D9 - EB 05 - jmp MetroExodus.exe+86BE2E0
MetroExodus.exe+86BE2DB - BB 01000000 - mov ebx,00000001
MetroExodus.exe+86BE2E0 - 48 89 F9 - mov rcx,rdi
MetroExodus.exe+86BE2E3 - E8 284F39F8 - call MetroExodus.exe+A53210
MetroExodus.exe+86BE2E8 - 85 DB - test ebx,ebx
MetroExodus.exe+86BE2EA - 74 14 - je MetroExodus.exe+86BE300
MetroExodus.exe+86BE2EC - 85 C0 - test eax,eax
MetroExodus.exe+86BE2EE - 74 10 - je MetroExodus.exe+86BE300
MetroExodus.exe+86BE2F0 - B8 01000000 - mov eax,00000001 // « good boy
MetroExodus.exe+86BE2F5 - 48 8B 5C 24 30 - mov rbx,[rsp+30]
MetroExodus.exe+86BE2FA - 48 83 C4 20 - add rsp,20
MetroExodus.exe+86BE2FE - 5F - pop rdi
MetroExodus.exe+86BE2FF - C3 - ret
MetroExodus.exe+86BE300 - 48 8B 5C 24 30 - mov rbx,[rsp+30]
MetroExodus.exe+86BE305 - 31 C0 - xor eax,eax // « bad boy
MetroExodus.exe+86BE307 - 48 83 C4 20 - add rsp,20
MetroExodus.exe+86BE30B - 5F - pop rdi
MetroExodus.exe+86BE30C - C3 - ret
First-up, the reason Photo Mode returns 0x0 is explained in the below logic:
Code: Select all
MetroExodus.exe+86BE2E3 - E8 284F39F8 - call MetroExodus.exe+A53210
..
..
MetroExodus.exe+1206CAC1 - FF 90 A8010000 - call qword ptr [rax+000001A8]
..
..
MetroExodus.exe+9890630 - 8B 81 C8040000 - mov eax,[rcx+000004C8]
MetroExodus.exe+9890636 - 25 00002000 - and eax,00200000 // « in my case, I get 0x200000
MetroExodus.exe+989063B - C3 - ret
..
..
MetroExodus.exe+1206CACB - 85 C0 - test eax,eax
MetroExodus.exe+1206CACD - 75 03 - jne MetroExodus.exe+1206CAD2 // « which will make the JNE jump
MetroExodus.exe+1206CACF - 44 89 FE - mov esi,r15d
MetroExodus.exe+1206CAD2 - 48 39 1D 079F57EF - cmp [MetroExodus.exe+15E69E0],rbx
..
..
MetroExodus.exe+1206CC0D - 44 89 F8 - mov eax,r15d // « since EAX is updated here from R15D, which is 0x1 ifJNE is taken..
..
..
MetroExodus.exe+86BE2EC - 85 C0 - test eax,eax // « ..and the test is done here
MetroExodus.exe+86BE2EE - 74 10 - je MetroExodus.exe+86BE300
MetroExodus.exe+86BE2F0 - B8 01000000 - mov eax,00000001
MetroExodus.exe+86BE2F5 - 48 8B 5C 24 30 - mov rbx,[rsp+30]
MetroExodus.exe+86BE2FA - 48 83 C4 20 - add rsp,20
MetroExodus.exe+86BE2FE - 5F - pop rdi
MetroExodus.exe+86BE2FF - C3 - ret
MetroExodus.exe+86BE300 - 48 8B 5C 24 30 - mov rbx,[rsp+30] // « bad boy is going to get executed
MetroExodus.exe+86BE305 - 31 C0 - xor eax,eax
MetroExodus.exe+86BE307 - 48 83 C4 20 - add rsp,20
MetroExodus.exe+86BE30B - 5F - pop rdi
MetroExodus.exe+86BE30C - C3 - ret
Now, in the Photo Mode check logic there's also this happening:
Code: Select all
MetroExodus.exe+1206CC01 - 80 BD 79D50000 02 - cmp byte ptr [rbp+0000D579],02 // « I wonder what this does :P
MetroExodus.exe+1206CC08 - 8D 46 01 - lea eax,[rsi+01]
MetroExodus.exe+1206CC0B - 75 03 - jne MetroExodus.exe+1206CC10
MetroExodus.exe+1206CC0D - 44 89 F8 - mov eax,r15d
MetroExodus.exe+1206CC10 - 48 8B 7C 24 60 - mov rdi,[rsp+60]
MetroExodus.exe+1206CC15 - 48 83 C4 30 - add rsp,30
MetroExodus.exe+1206CC19 - 41 5F - pop r15
MetroExodus.exe+1206CC1B - 5E - pop rsi
MetroExodus.exe+1206CC1C - 5D - pop rbp
MetroExodus.exe+1206CC1D - C3 - ret
Simply setting that BOOL to 0x0 will get you this:
BR,
Sun