If you've never done reverse engineering, you might want to stay away from this, but don't fret as there are offsets at the bottom if you want to use them in your trainer.
Please note that this tutorial is for SP however, MP should be pretty simillar. Also, I am using an older version of OllyDBG, newer versions are still simillar but may have different names for things.
Load up iw5sp.exe with OllyDBG. Right-click in the CPU Window and click Search for -> All referenced text strings.
https://img189.imageshack.us/img189/9...01231652pm.png
Right-click in the new window and click Search for text. Type in CG_FireWeapon and ensure that Entire scope is checked.
https://img215.imageshack.us/img215/5...01231918pm.png
It should highlight one of the lines which look like this:
https://img20.imageshack.us/img20/333...0425102201.png
Double-click on the line or just hit the Enter key. You should now be in the CPU Window however you are on the instruction where the string was referenced.
https://img687.imageshack.us/img687/6...0425102258.png
Keep scrolling down until you see the following (look for ADD EDI, xxxxx, note that in MP, you're looking for ADD ESI, xxxxx):
https://img189.imageshack.us/img189/4...0425100708.png
Now, if you notice, you can see a conditional jump, that is the JE right before it. It will only jump if the zero flag (ZF) is 1. The CMP instruction before the JE compares the 2 values and sets ZF to 1 when they match. There are a few ways to patch it, we could NOP out the CMP instruction and the JE instruction, edit the CMP instruction, or we could be smart about it and only have to patch 1 byte.
https://img151.imageshack.us/img151/3...0425101110.png
The smart way would be to turn the JE instruction into a JMP which means that it will always jump over the code no matter what. Now, if we try double clicking on the instruction and typing in JMP instead of JE like this:
https://img215.imageshack.us/img215/6...0425101310.png
We can click Assemble and close the window and see, that the only byte modified was the 0x74 byte which is now 0xEB.
https://img710.imageshack.us/img710/9...0425101526.png
Now notice the address on the left of the modification, that means all we have to do is write 0xEB to 0x40976A to bypass the recoil functions!
******* Updated Addresses *******
1.5.388:
So we are writing 0xEB (byte) to 0x40976A.
For multiplayer you write the same thing to 0x54946D. I haven't tested it but I'm pretty sure it should work, note you could get VAC banned for trying on MP.
Enjoy guys, have fun. Big thanks to @Hell_Demon for the original tutorial for MW2.
- master131
