2466
"Aim Teleporter Hold - L1 - Store Hold - L2 - Teleport "
BA7C45
Auto Assembler Script
{ Game : Darksiders2.exe
Version:
Date : 2015-12-12
Author : Akumakuja
This script does stores and teleports character
}
[ENABLE]
aobscanmodule(Aim_Teleport_ret,Darksiders2.exe,F3 41 0F 11 9E F0 04 00 00) // should be unique
alloc(newmem,$1000,"Darksiders2.exe"+46B17D)
alloc(Aiming_Stats,8) // 8 Bytes for one register
registersymbol(Aiming_Stats)
alloc(Register_Storing_Aim,16) // 16 Bytes For 2 Register Stores
registersymbol(Register_Storing_Aim)
alloc(Stored_Aim,12) // 12 Bytes For Map X,Y,Z
registersymbol(Stored_Aim)
label(code)
label(1st_Person_Check)
label(Button_Check)
label(Store_Aiming_Stats)
label(Teleport_To_Location_Stored)
label(Restoring_Registers)
label(originalcode)
label(return)
newmem:
code:
pushf // Storing/Push Flags On Stack
Mov [Aiming_Stats],r14d // Start of Aiming Stats
1st_Person_Check:
cmp [r14+8],7 // Comparing For Aim Mode
je Button_Check
jne originalcode // Jumps Out if not in aim mode
Button_Check:
mov [Register_Storing_Aim+8],RDX // Equivalent To Push, but This Game Hates Push Pops
mov [Register_Storing_Aim],RAX
// RDI Is Deaths Stat/Controller Input Also
mov rcx,[rdi+a9b] // Moving L1 Button Into RCX
cmp cl,1 // Comparing Lower Byte Of RCX For Button Push
je Store_Aiming_Stats // IF L1 is pressed Store Aiming Stats
mov rax,[rdi+a99] // Moving L2 Button Into RAX
cmp al,1 // Comparing Lower Byte Of RAX For Button Push
je Teleport_To_Location_Stored
jne originalcode
// https://msdn.microsoft.com/en-us/library/windows/hardware/ff561499(v=vs.85).aspx // Register Reference
Store_Aiming_Stats:
//Xmm3,4,5 Are the GAMES stored values for Aimed Locations
movss [Stored_Aim],xmm3 // X map Value
movss [Stored_Aim+4],xmm4 // Y map Value
movss [Stored_Aim+8],xmm5 // Z map Value
jmp Restoring_Registers
Teleport_To_Location_Stored:
cmp [Stored_Aim],0 // Check to make sure values have been stored
je originalcode // Jump to originalcode if no value been Stored
movss xmm15,[Stored_Aim]
movss [rdi+2f0],xmm15 // Character X Value
movss xmm15,[Stored_Aim+4]
movss [rdi+2f4],xmm15 // Character Y Value
movss xmm15,[Stored_Aim+8]
movss [rdi+2f8],xmm15 // Character Z Value
xorps xmm15,xmm15 // Clearing xmm15
jmp Restoring_Registers
Restoring_Registers:
mov [Register_Storing_Aim],RAX // Poping/Restoring Register
mov [Register_Storing_Aim+8],RDX // Poping/Restoring Register
jmp originalcode
originalcode:
popf // Restoring Flags
movss [r14+000004F0],xmm3 // xmm3 is Value of Aim X
jmp return
Aim_Teleport_ret:
jmp code
nop
nop
nop
nop
return:
registersymbol(Aim_Teleport_ret)
[DISABLE]
Aim_Teleport_ret:
db F3 41 0F 11 9E F0 04 00 00
unregistersymbol(Aim_Teleport_ret)
dealloc(newmem)
dealloc(Aiming_Stats)
unregistersymbol(Aiming_Stats)
dealloc(Register_Storing_Aim)
unregistersymbol(Register_Storing_Aim)
dealloc(Stored_Aim)
unregistersymbol(Stored_Aim)
{
// ORIGINAL CODE - INJECTION POINT: "Darksiders2.exe"+46B17D
"Darksiders2.exe"+46B14B: F3 0F 10 5C 24 70 - movss xmm3,[rsp+70]
"Darksiders2.exe"+46B151: F3 0F 10 64 24 74 - movss xmm4,[rsp+74]
"Darksiders2.exe"+46B157: F3 0F 10 6C 24 78 - movss xmm5,[rsp+78]
"Darksiders2.exe"+46B15D: F3 0F 11 65 A4 - movss [rbp-5C],xmm4
"Darksiders2.exe"+46B162: F3 0F 11 5D A0 - movss [rbp-60],xmm3
"Darksiders2.exe"+46B167: F3 0F 11 6D A8 - movss [rbp-58],xmm5
"Darksiders2.exe"+46B16C: EB 0F - jmp Darksiders2.exe+46B17D
"Darksiders2.exe"+46B16E: F3 0F 10 6D A8 - movss xmm5,[rbp-58]
"Darksiders2.exe"+46B173: F3 0F 10 65 A4 - movss xmm4,[rbp-5C]
"Darksiders2.exe"+46B178: F3 0F 10 5D A0 - movss xmm3,[rbp-60]
// ---------- INJECTING HERE ----------
"Darksiders2.exe"+46B17D: F3 41 0F 11 9E F0 04 00 00 - movss [r14+000004F0],xmm3
// ---------- DONE INJECTING ----------
"Darksiders2.exe"+46B186: F3 41 0F 11 A6 F4 04 00 00 - movss [r14+000004F4],xmm4
"Darksiders2.exe"+46B18F: F3 41 0F 11 AE F8 04 00 00 - movss [r14+000004F8],xmm5
"Darksiders2.exe"+46B198: 41 8B 86 98 04 00 00 - mov eax,[r14+00000498]
"Darksiders2.exe"+46B19F: 41 89 86 9C 04 00 00 - mov [r14+0000049C],eax
"Darksiders2.exe"+46B1A6: 45 88 BE 20 05 00 00 - mov [r14+00000520],r15l
"Darksiders2.exe"+46B1AD: 44 38 BF AC 0A 00 00 - cmp [rdi+00000AAC],r15l
"Darksiders2.exe"+46B1B4: 74 2A - je Darksiders2.exe+46B1E0
"Darksiders2.exe"+46B1B6: 48 8B 97 B0 0A 00 00 - mov rdx,[rdi+00000AB0]
"Darksiders2.exe"+46B1BD: 48 85 D2 - test rdx,rdx
"Darksiders2.exe"+46B1C0: 74 1E - je Darksiders2.exe+46B1E0
}
2469
"Camera Mode"
1
808000
4 Bytes
Aiming_Stats
8
2480
"Current Aim Location"
80000008
1
2470
"Aim X"
0000AE
Float
Aiming_Stats
4F0
2471
"Aim Y"
009F00
Float
Aiming_Stats
4F4
2472
"Aim Z"
FF0000
Float
Aiming_Stats
4F8
2479
"Teleport Location"
80000008
1
2476
"Stored X"
0000AE
Float
Stored_Aim+0
2477
"Stored Y"
009F00
Float
Stored_Aim+4
2475
"Stored Z"
FF0000
Float
Stored_Aim+8
2478
"Push Pop Registers"
808080
1
2473
"Stored RAX"
808080
8 Bytes
Register_Storing_Aim
2474
"Stored RDX"
1
808080
8 Bytes
Register_Storing_Aim+8
2468
"Aiming Stat Start"
1
C0C0C0
4 Bytes
Aiming_Stats