RAGE 2 [Engine:APEX]

[l0wb1t]

Coords:

Code: Select all

44 0F 59 59 40

RCX + 00 = X
RCX + 04 = Y
RCX + 08 = Z

Player Base + 28 + 88 = Pointer i use for compare at this loaction.

R12 is holding the Adress.

Code: Select all

HealthBaseMem:
push rdx
mov rdx,[rcx+28]
mov rdx,[rdx+88]
mov [_pTeleport],rdx
pop rdx
...

Code: Select all

TeleportMem:
cmp r12,[_pTeleport]
jne codeTeleport
mov [_pCoords],rcx
....

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[SunBeam]

please add exp multiple too

thanks

This is the exact reason I'm just hacking what I like in games. Sorry, if you want that, start learning ASM, some reversing and how to use CE for more than just enabling scripts. That way you will be sure you DO ONLY WHAT YOU WANT And won't have to rely on others, like possibly me, to do it for you.

[TimFun13]

...
This is the exact reason I'm just hacking what I like in games. Sorry, if you want that, start learning ASM, some reversing and how to use CE for more than just enabling scripts. That way you will be sure you DO ONLY WHAT YOU WANT And won't have to rely on others, like possibly me, to do it for you.

I'm with you on this, and when there is a full page of the same request all in a row just quite responding to it all together.

[Larqus]

...
EDIT: APEX is nothing new. It's the same idTech5 Engine I've spoken about in this post --> viewtopic.php?f=10&t=6790

I understand that I can not do anything there if I do not have the skills of a programmer?

[jonasbeckman]

Looks like the Steam version got patched, Denuvo seems to have been removed as well from what I'm seeing.
(From 480 to 48 MB for the game exe.)

EDIT: [Link]

Removes Denuvo DRM (We saw a few requests.)
Enables Crash Reporter for error reporting
Fixes occasional crash related to Scaleform
Fixes occasional crash on startup
Fixes issue where Bethesda.net users would always default to English
Razer Chroma effects enabled by default

[l0wb1t]

Rapid Fire

Code: Select all

[ENABLE]

aobscanmodule(_RapidFire,RAGE2.exe,F3 41 0F 10 84 24 58 03 00 00) // should be unique
alloc(newmem,$1000,"RAGE2.exe"+5EADA3)

label(code)
label(return)

newmem:
mov [r12+00000358],(float)10
code:
  movss xmm0,[r12+00000358]
  jmp return

_RapidFire:
  jmp newmem
  nop
  nop
  nop
  nop
  nop
return:
registersymbol(_RapidFire)

[DISABLE]

_RapidFire:
  db F3 41 0F 10 84 24 58 03 00 00

unregistersymbol(_RapidFire)
dealloc(newmem)

Rate Of Fire Multiplier (shared)

Code: Select all

RAGE2.exe+7E3107 - F3 0F59 F4            - mulss xmm6,xmm4
RAGE2.exe+7E310B - F3 0F59 F0            - mulss xmm6,xmm0
RAGE2.exe+7E310F - F3 0F59 B3 6C030000   - mulss xmm6,[rbx+0000036C] <------ Default is 1.0f, lower = Faster
RAGE2.exe+7E3117 - 4D 85 C0              - test r8,r8

[TimFun13]

Denuvo removed, time to buy a new game. Downloading it now.

[skywolf23]

LAWL what was the point of denuvo when the bethesda store had NO drm? i am pretty sure codex ripped the beth store game or exe to "crack" the game.

Nm that denuvo has been cracked for months and nothing denuvo has done has changed that most it delays cracking a game a few days.

Now they got the videos showing the denuvo slows the load times down to a stupid degree. because they had one version with it and one version wo on launch day. still think they should have tested on bare min CPUs to see if it tanked fps when you did not have some 12 core 4.8 ghz monster processor to handle that denuvo. vs a 4 core 3.2 ghz or w/e the minimuim was listed for rage.

[l0wb1t]

No Spread

Code: Select all

[ENABLE]

aobscanmodule(_NoSpread,RAGE2.exe,F3 0F 10 81 38 04 00 00) // should be unique
alloc(newmem,$1000,"RAGE2.exe"+7E0DAF)

label(code)
label(return)

newmem:

code:
  mov [rcx+00000438],(float)0
  jmp return

_NoSpread:
  jmp newmem
  nop
  nop
  nop
return:
registersymbol(_NoSpread)

[DISABLE]

_NoSpread:
  db F3 0F 10 81 38 04 00 00

unregistersymbol(_NoSpread)
dealloc(newmem)

No Recoil

Code: Select all

[ENABLE]

aobscanmodule(_NoRecoil,RAGE2.exe,F2 0F 11 43 24 89 43 2C F3 41) // should be unique
alloc(newmem,$1000,"RAGE2.exe"+5EAD9B)

label(code)
label(return)

newmem:

code:
  mov [rbx+24],0
    mov [rbx+28],0
      mov [rbx+2C],0
  jmp return

_NoRecoil:
  jmp newmem
return:
registersymbol(_NoRecoil)

[DISABLE]

_NoRecoil:
  db F2 0F 11 43 24

unregistersymbol(_NoRecoil)
dealloc(newmem)

[pigeon]

Free Camera and time of day scripts for Steam version from 5.16.19 (hotfix)

Features:
- Free camera
- Calm enemies
- HUD switch
- FOV multiplier
- Time of day change

If you wish to change hotkeys (most of them stored inside the scripts), you should look inside desired script and see strings as "local MoveForward = isKeyPressed(VK_W)", where is MoveForward some kind of internal link and description (you shouldn't change this) and "isKeyPressed(VK_W)" is actual hotkey that use "W" key. So if you wish to change it to "T", this string should looks like "local MoveForward = isKeyPressed(VK_T)". You can find list of virtual-key codes (hotkeys) here: [Link]

If you enable "Hide_Weapons" and "Hide_Bottom_HUD" scripts when you are in safe zone, than you can shoot and use double-jump even when you in that zones.

List of all hotkeys you can find in "Table Extras" in bottom right corner of Cheat Engine window.

Knowing issues:
- When you enable free camera and jump few times or just moving too far away, you will start to see falling down animation (it will not affect camera position) and wind sound. I can't find at current moment how to deal with, but it doesn't really affect free camera behavior.

Script list and descriptions:

Spoiler

--Time:
Manual switch tome of day.

--Calm_Enemies:
Enemies doesn't react to player.

--no_All_HUD:
Turn off overall HUD. I made that because for some reason in-game photo mode doesn't make screenshots when i press "F", so this script useful for disabling HUD and making screenshot without of in-game hotkeys.

Free Camera group:
--Free_Camera:
Allow you to fly around at any direction and any distance.
--freeze_player:
Doesn't allow player model to move in any direction. Used for being able to move camera with ordinal WASD keys, but at the same time player will doesn't moving as well.
--No_Fall:
Prevent player from falling underground and triggering player respawn event when you move camera too far away.
--Hide_Weapons:
Makes game think that you are in the safe zone and move weapon down (use pistol if you wish "clean" view).
--Hide_Bottom_HUD:
Makes game think that you are in the safe zone and hide bottom HUD.
--Waypoint_XYZ (place after enable free cam):
Allows free camera to jump at placed waypoint on the map. Jumps are not really precisely, seems like i can do nothing with it.
--Custom_FOV (num7,4 + Ctrl):
Change FOV with normal of fast speed.

[ray2160]

Here's my 2 cents worth

[ENABLE]

aobscanmodule(CarNitro,RAGE2.exe,F3 0F 11 83 10 4E 00 00 40)
alloc(newmem,$100,"RAGE2.exe"+C06F70)

label(code)
label(return)

newmem:
mov [rbx+00004E10],(float)1

code:
//movss [rbx+00004E10],xmm0
jmp return

CarNitro:
jmp newmem
nop
nop
nop
return:
registersymbol(CarNitro)

[DISABLE]

CarNitro:
db F3 0F 11 83 10 4E 00 00

unregistersymbol(CarNitro)
dealloc(newmem)

[SunBeam]

Holy shit, people are flocking in! Please, do post, my friends! I got some more shit cooked up for ya, just building it up



With permission, may I add the other scripts in? (credited, of course)

BR,
Sun

[Csimbi]

Rate Of Fire Multiplier (shared)

Thanks!
Here, scripted with player check (requires Sun's player grabber!)

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>76</ID>
      <Description>"--aobRefireRateReader"</Description>
      <Options moHideChildren="1"/>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// Game   : RAGE2.exe
// Version:
// Date   :
// Author : Cs
[ENABLE]
aobscanmodule(aobRefireRateReader,RAGE2.exe,F3 0F 59 B3 ?? ?? 00 00 4D 85 C0 0F)
aobscanmodule(aobWeaponPlayerOffset,RAGE2.exe,48 8B 81 ?? ?? 00 00 48 89 85 ?? ?? 00 00 4C 8B)

alloc(newmemRefireRateReader,4096,aobRefireRateReader)

label(aobRefireRateReader_r)
label(aobRefireRateReader_i)
registersymbol(aobRefireRateReader_r)
registersymbol(aobRefireRateReader_i)

label(lblRefireRateReader)
label(lblRefireRateReaderSkip)
label(lblRefireRateReaderRet)

label(bEnableRefireRateMod)
label(fRefireRateMod)
registersymbol(bEnableRefireRateMod)
registersymbol(fRefireRateMod)

label(iWeaponPlayerOffset)
registersymbol(iWeaponPlayerOffset)

newmemRefireRateReader:
bEnableRefireRateMod:
dd 1
fRefireRateMod:
dd (float)0.1

lblRefireRateReader:
//Alt: mulss xmm6,[rbx+0000036C]
//db F3 0F 59 B3 6C 03 00 00
readmem(aobRefireRateReader,8)
push rax
push rcx
mov rcx,[g_Player]
test rcx,rcx
jz short lblRefireRateReaderSkip
movsxd rax,[iWeaponPlayerOffset]
cmp qword ptr [rax+rbx],rcx
jne short lblRefireRateReaderSkip
cmp dword ptr [bEnableRefireRateMod],1
jne short lblRefireRateReaderSkip
mulss xmm6,[fRefireRateMod]
lblRefireRateReaderSkip:
pop rcx
pop rax
jmp lblRefireRateReaderRet
aobRefireRateReader_i:
readmem(aobRefireRateReader,8)
iWeaponPlayerOffset:
readmem(aobWeaponPlayerOffset+03,4)

//"RAGE2.exe"+7E310F:
aobRefireRateReader:
aobRefireRateReader_r:
jmp lblRefireRateReader
nop
nop
nop
lblRefireRateReaderRet:

[DISABLE]
//"RAGE2.exe"+7E310F:
//Alt: mulss xmm6,[rbx+0000036C]
//db F3 0F 59 B3 6C 03 00 00
aobRefireRateReader_r:
readmem(aobRefireRateReader_i,8)

unregistersymbol(aobRefireRateReader_r)
unregistersymbol(aobRefireRateReader_i)

unregistersymbol(bEnableRefireRateMod)
unregistersymbol(fRefireRateMod)

unregistersymbol(iWeaponPlayerOffset)

dealloc(newmemRefireRateReader)

{
// ORIGINAL CODE - INJECTION POINT: "RAGE2.exe"+7E310F

"RAGE2.exe"+7E30DE: 48 81 C2 88 00 00 00        -  add rdx,00000088
"RAGE2.exe"+7E30E5: 49 3B D0                    -  cmp rdx,r8
"RAGE2.exe"+7E30E8: 75 C6                       -  jne RAGE2.exe+7E30B0
"RAGE2.exe"+7E30EA: 0F 28 C2                    -  movaps xmm0,xmm2
"RAGE2.exe"+7E30ED: F3 0F 59 77 7C              -  mulss xmm6,[rdi+7C]
"RAGE2.exe"+7E30F2: 4C 8B 83 80 05 00 00        -  mov r8,[rbx+00000580]
"RAGE2.exe"+7E30F9: 48 C7 44 24 20 00 00 00 00  -  mov qword ptr [rsp+20],00000000
"RAGE2.exe"+7E3102: 4C 89 44 24 28              -  mov [rsp+28],r8
"RAGE2.exe"+7E3107: F3 0F 59 F4                 -  mulss xmm6,xmm4
"RAGE2.exe"+7E310B: F3 0F 59 F0                 -  mulss xmm6,xmm0
// ---------- INJECTING HERE ----------
"RAGE2.exe"+7E310F: F3 0F 59 B3 6C 03 00 00     -  mulss xmm6,[rbx+0000036C]
// ---------- DONE INJECTING  ----------
"RAGE2.exe"+7E3117: 4D 85 C0                    -  test r8,r8
"RAGE2.exe"+7E311A: 0F 84 10 01 00 00           -  je RAGE2.exe+7E3230
"RAGE2.exe"+7E3120: 41 8B 50 08                 -  mov edx,[r8+08]
"RAGE2.exe"+7E3124: 85 D2                       -  test edx,edx
"RAGE2.exe"+7E3126: 74 1B                       -  je RAGE2.exe+7E3143
"RAGE2.exe"+7E3128: 0F 1F 84 00 00 00 00 00     -  nop [rax+rax+00000000]
"RAGE2.exe"+7E3130: 8D 4A 01                    -  lea ecx,[rdx+01]
"RAGE2.exe"+7E3133: 8B C2                       -  mov eax,edx
"RAGE2.exe"+7E3135: F0 41 0F B1 48 08           - lock  cmpxchg [r8+08],ecx
"RAGE2.exe"+7E313B: 74 5A                       -  je RAGE2.exe+7E3197
}

</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>77</ID>
          <Description>"bEnableRefireRateMod"</Description>
          <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Disabled
1:Enabled
</DropDownList>
          <Color>008000</Color>
          <VariableType>4 Bytes</VariableType>
          <Address>bEnableRefireRateMod</Address>
          <CheatEntries>
            <CheatEntry>
              <ID>78</ID>
              <Description>"fRefireRateMod"</Description>
              <Color>FF0000</Color>
              <VariableType>Float</VariableType>
              <Address>fRefireRateMod</Address>
            </CheatEntry>
          </CheatEntries>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

Holy shit, people are flocking in! Please, do post, my friends! I got some more shit cooked up for ya, just building it up

With permission, may I add the other scripts in? (credited, of course)

A true community effort

You can add mine, of course - as always.

[Csimbi]

No Spread

No Recoil

@l0wb1t
Are these player-only or shall I add player checks?
I guess recoil is a player only thing...

[SunBeam]

From testing, the Pawn (be it AI or Vehicles) uses the same member-functions. I usually add checks to everything, by default. Better safe than sorry