ryouma17 wrote: Wed Jul 05, 2023 11:52 am
It's Namco game lol and it is in il2cpp (first time seeing il2cpp). Namco did involve in creating SRS (which i still got 2 retails CDs of SRS game). Back to topic!
Timer value is 4 bytes. which is in Friggin rando table -- pointer address type is correct.
Yet pointer in the table seems to be not working, I mean I got "P->???" (with current offsets -- just a hint if you making pointer's : don't use multilevelled pointers if possible). While scripts work flawlessly.
(If current time script doesn't allow you activate script try activating "Mono"-->"Activate mono features" – yet this might be not the case since I didn’t see any usage of mono features)
While,
Some my in-game insight:
If in-game timer is around 3 minutes you can start looking value 4000 - 6000 and every second timer decrease you can use "next scan" after first scan (decreased value). Again, if timer is decreasing.
If in-game timer is increasing you can start new scan and use again range value from 0-6000 to find timer value at first 1 / 3 minutes. and while timer updates increase by second use next scan (increased value).
I don't really know about ""as fast as possible"" mode you talking but let's assume it's increasing timer mode (which I have played trough).
Direct assembly script:
Code: Select all
[ENABLE]
aobscanmodule(IncreaseTimer_AOB,GameAssembly.dll,FF 41 40 48 83 C4 28) // should be unique
alloc(newmem,$1000,IncreaseTimer_AOB)
label(code return)
newmem:
code:
//inc [rcx+40]
add rsp,28
jmp return
IncreaseTimer_AOB:
jmp newmem
nop 2
return:
registersymbol(IncreaseTimer_AOB)
[DISABLE]
IncreaseTimer_AOB:
db FF 41 40 48 83 C4 28
unregistersymbol(IncreaseTimer_AOB)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll.il2cpp+32F630
GameAssembly.dll.il2cpp+32F5FF: 81 7A 40 20 BF 02 00 - cmp [rdx+40],0002BF20
GameAssembly.dll.il2cpp+32F606: 73 2B - jae GameAssembly.dll.il2cpp+32F633
GameAssembly.dll.il2cpp+32F608: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll.il2cpp+32F60F: 75 0C - jne GameAssembly.dll.il2cpp+32F61D
GameAssembly.dll.il2cpp+32F611: E8 3A 7E BE FF - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll.il2cpp+32F616: 48 8B 0D 5B 9F 63 02 - mov rcx,[GameAssembly.dll.data+68578]
GameAssembly.dll.il2cpp+32F61D: 48 8B 81 B8 00 00 00 - mov rax,[rcx+000000B8]
GameAssembly.dll.il2cpp+32F624: 48 8B 88 B8 1F 00 00 - mov rcx,[rax+00001FB8]
GameAssembly.dll.il2cpp+32F62B: 48 85 C9 - test rcx,rcx
GameAssembly.dll.il2cpp+32F62E: 74 08 - je GameAssembly.dll.il2cpp+32F638
// ---------- INJECTING HERE ----------
GameAssembly.dll.il2cpp+32F630: FF 41 40 - inc [rcx+40]
// ---------- DONE INJECTING ----------
GameAssembly.dll.il2cpp+32F633: 48 83 C4 28 - add rsp,28
GameAssembly.dll.il2cpp+32F637: C3 - ret
GameAssembly.dll.il2cpp+32F638: E8 73 7D BE FF - call GameAssembly.mono_method_get_class+90
GameAssembly.dll.il2cpp+32F63D: CC - int 3
GameAssembly.dll.il2cpp+32F63E: CC - int 3
GameAssembly.dll.il2cpp+32F63F: CC - int 3
GameAssembly.dll.il2cpp+32F640: 48 83 EC 28 - sub rsp,28
GameAssembly.dll.il2cpp+32F644: 80 3D 69 DE 79 02 00 - cmp byte ptr [GameAssembly.dll+2DD04B4],00
GameAssembly.dll.il2cpp+32F64B: 75 13 - jne GameAssembly.dll.il2cpp+32F660
GameAssembly.dll.il2cpp+32F64D: 48 8D 0D 24 9F 63 02 - lea rcx,[GameAssembly.dll.data+68578]
}
Despite this assembly script if you interest in Lua coding you can use directly from Lua engine:
(In order enable back again address value increasing/decreasing hold F2.)
local addressToLock = "" -- first find timer address then enter address in the quotation marks
local valueToLock = 4500 -- will lock around timer between 2 and 3 minutes.
-- Lock the value
function lockValue()
lockTimer = createTimer() -- Create a timer
lockTimer.Interval = 100 -- Set the timer interval to 100 milliseconds
lockTimer.OnTimer = function()
-- prioritize disable function.
if isKeyPressed(VK_F2) then -- Hold F2 Key
lockTimer.Enabled = false -- Disable the timer
lockTimer.destroy() -- Destroy the timer
lockTimer = nil
end
writeInteger(addressToLock, valueToLock) -- Write the desired value to the address
end
end
-- Create and start the lock
lockValue()
Or instead of Lua, if you found timer address, you can check what writes to address and then you can nop an increase opcode. When ever you nop code it should appear for quicker access in code list.