Tutorials Part 2
Rockets from sword:
first this drives me nuts because it shouldn't work but it does:
Part 1:Removing the Check:
first go to :472950: ZMyCharacter::OnShotRocket (83 EC 48 56 8B F1 8D 4E 64 E8 EE EE EE EE 85 )
use everything before E8:
ok so now that we see the code we NOP the jle to remove the check
Part 2:Switching the calls:
first go to local calls. you will see this:
change the CALL HolyFate.004780b0 to CALL HolyFate.004771b0
ok thats rockets from sword next is ghosting:
first search for binary 18 CC:
ok so nop all of the local calls on MOV EAX,DWORD PTR DS:[ECX]
ok now long wall run:
go here:
00475760 /$ 83EC 24 SUB ESP,24
now nop all of the local calls and if you want super wall jump or assassin jump
nop the je and jnz then go to the 3rd local call and nop the jmp and je
Credits to xXzYzXx for help on rockets
first this drives me nuts because it shouldn't work but it does:
Part 1:Removing the Check:
first go to :472950: ZMyCharacter::OnShotRocket (83 EC 48 56 8B F1 8D 4E 64 E8 EE EE EE EE 85 )
use everything before E8:
Code:
004771B0 /$ 83EC 48 SUB ESP,48 004771B3 |. 56 PUSH ESI 004771B4 |. 8BF1 MOV ESI,ECX 004771B6 |. 8D4E 64 LEA ECX,DWORD PTR DS:[ESI+64] 004771B9 |. E8 A2ABFFFF CALL HolyFate.00471D60 004771BE |. 85C0 TEST EAX,EAX 004771C0 |. 0F84 5A010000 JE HolyFate.00477320 004771C6 |. 8B48 30 MOV ECX,DWORD PTR DS:[EAX+30] 004771C9 |. 85C9 TEST ECX,ECX 004771CB 0F8E 4F010000 JLE HolyFate.00477320 004771D1 |. 33C0 XOR EAX,EAX
Part 2:Switching the calls:
first go to local calls. you will see this:
Code:
004787D2 . E8 D9E9FFFF CALL HolyFate.004771B0 004787D7 . 5F POP EDI 004787D8 . 5B POP EBX 004787D9 . 5D POP EBP 004787DA . 8BCE MOV ECX,ESI 004787DC . 5E POP ESI 004787DD . 83C4 04 ADD ESP,4 004787E0 .^E9 DB41FFFF JMP HolyFate.0046C9C0 004787E5 > 8BCE MOV ECX,ESI ; Cases 1,7,C,D,E of switch 0047878A 004787E7 . E8 C4F8FFFF CALL HolyFate.004780B0 004787EC . 5F POP EDI 004787ED . 5B POP EBX 004787EE . 5D POP EBP 004787EF . 8BCE MOV ECX,ESI 004787F1 . 5E POP ESI 004787F2 . 83C4 04 ADD ESP,4 004787F5 .^E9 C641FFFF JMP HolyFate.0046C9C0 004787FA > 8BCE MOV ECX,ESI ; Default case of switch 0047878A 004787FC E8 8FECFFFF CALL HolyFate.00477490
ok thats rockets from sword next is ghosting:
first search for binary 18 CC:
Code:
0046C940 $ 8B01 MOV EAX,DWORD PTR DS:[ECX] 0046C942 . FF60 18 JMP DWORD PTR DS:[EAX+18]
ok now long wall run:
go here:
00475760 /$ 83EC 24 SUB ESP,24
now nop all of the local calls and if you want super wall jump or assassin jump
Code:
00475760 /$ 83EC 24 SUB ESP,24 00475763 |. 56 PUSH ESI 00475764 |. 8BF1 MOV ESI,ECX 00475766 |. 8A86 20060000 MOV AL,BYTE PTR DS:[ESI+620] 0047576C |. D946 58 FLD DWORD PTR DS:[ESI+58] 0047576F |. D946 54 FLD DWORD PTR DS:[ESI+54] 00475772 |. 24 7F AND AL,7F 00475774 |. 8886 20060000 MOV BYTE PTR DS:[ESI+620],AL 0047577A |. D9E0 FCHS 0047577C |. 8A86 DC040000 MOV AL,BYTE PTR DS:[ESI+4DC] 00475782 |. D95C24 04 FSTP DWORD PTR SS:[ESP+4] 00475786 |. 24 FD AND AL,0FD 00475788 |. 0C 10 OR AL,10 0047578A |. D9E0 FCHS 0047578C |. 8886 DC040000 MOV BYTE PTR DS:[ESI+4DC],AL 00475792 |. D95C24 08 FSTP DWORD PTR SS:[ESP+8] 00475796 |. 8A86 9C040000 MOV AL,BYTE PTR DS:[ESI+49C] 0047579C |. 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4] 004757A0 |. 51 PUSH ECX 004757A1 |. 8BD1 MOV EDX,ECX 004757A3 |. 24 BF AND AL,0BF 004757A5 |. 52 PUSH EDX 004757A6 |. 8886 9C040000 MOV BYTE PTR DS:[ESI+49C],AL 004757AC |. C74424 14 0000>MOV DWORD PTR SS:[ESP+14],0 004757B4 |. E8 D6090F00 CALL HolyFate.0056618F 004757B9 |. 8B8E E4040000 MOV ECX,DWORD PTR DS:[ESI+4E4] 004757BF |. 83F9 01 CMP ECX,1 004757C2 |. 0F85 FC000000 JNZ HolyFate.004758C4 004757C8 |. 6A 00 PUSH 0 004757CA |. E8 E10A0D00 CALL HolyFate.005462B0 004757CF |. 8BC8 MOV ECX,EAX 004757D1 |. E8 7A0B0D00 CALL HolyFate.00546350 004757D6 |. D94424 04 FLD DWORD PTR SS:[ESP+4] 004757DA |. 84C0 TEST AL,AL 004757DC |. 8B46 60 MOV EAX,DWORD PTR DS:[ESI+60] 004757DF |. 74 49 JE SHORT HolyFate.0047582A
Credits to xXzYzXx for help on rockets
Originally Posted by Craig
