It might be crashing because you're passing zeros to the value, when you load the saved coordinates.
That and is "teleport" an AOB symbol? It's not set in your script.
With this you're moving 64 bits when you need to move 32 bits for the floating points.
Code: Select all
push rbx
mov rbx,[rax+120]
mov [z_cho],rbx
mov rbx,[rax+124]
mov [x_cho],rbx
mov rbx,[rax+128]
mov [y_cho],rbx
pop rbx
So change it to something like this:
Code: Select all
push rbx
mov ebx,[rax+120]
mov [z_cho],ebx
mov ebx,[rax+124]
mov [x_cho],ebx
mov ebx,[rax+128]
mov [y_cho],ebx
pop rbx
Thus the "dd" is fine but you need to just use the first 32 bits of RBX.
But I would also try to just see if it's the injection point, just use the AOB template and don't add any code and see if it crashes with just the redirect to your script and back to the game's code.
Here is another way of doing it just as an example.
Code: Select all
// This seems to be missing the AOB scan.
// Is "teleport" set with an AOB scan?
assert(teleport, 0F 28 88 20 01 00 00) // I like to use "assert" to insure that I'm in the right place.
alloc(newmem,$1000,"FC64.dll"+1F352BE)
// alloc(newmem,$1000,teleport) // if "teleport" is an AOB symbol then this will work.
label(myCode)
label(load)
label(en_save)
label(en_load)
label(save)
label(z_cho)
label(x_cho)
label(y_cho)
label(code)
label(return)
registersymbol(en_save)
registersymbol(en_load)
newmem:
align 10 // not really needed but insures the aligned instruction won't have any problems.
z_cho: //120
dd (float)0
x_cho: // 124
dd (float)0
y_cho: // 128
dd (float)0
dd 0// Not used just needed for the packed instruction.
en_save:
dd 0
en_load:
dd 0
myCode: // You can just make a label and use that for the redirect so you only need 1 allocation.
cmp [en_save],1
je save
cmp [en_load],1
je load
jmp code
save:
mov [en_save],0
movaps xmm1,[rax+120]
movaps [z_cho],xmm1
jmp return // no need to go to the original code because XMM1 has been set.
load:
mov [en_load],0
movaps xmm1,[z_cho]
movaps [rax+120],xmm1
jmp return // no need to go to the original code because XMM1 has been set.
code:
movaps xmm1,[rax+120]
jmp return
teleport:
jmp myCode // Here you just need to jump to the start of your code.
nop
nop
return:
registersymbol(teleport)
[DISABLE]
teleport:
db 0F 28 88 20 01 00 00
unregistersymbol(en_save)
unregistersymbol(en_load)
unregistersymbol(teleport)
dealloc(newmem)
