Qk

测试极速开枪，真隐身模式可用

#BIOHAZARD RE2:re2:1.2.1
#logo=re2.jpg
#fallback=re2_update1.txt

global long playerInfoPtr=0
global long playerModPtr=0
global long playerModSizePtr=0
global long statePtr=0
global long actionPtr=0

//-1.GetPlayer::[0xC86AE8D]48 39 7A 10 0F 95 D0 84 C0 0F 95 D0 EB 02 30 C0 84 C0 74 1D=48 39 7A 10 0F 95 D0
//mov [playerInfoPtr],rdx
//mov rax,[rdx+10]
//add rax,60
//mov [playerModPtr],rax
//add rax,50
//mov [playerModSizePtr],rax
//cmp qword ptr [rdx+0x10], rdi
//setnz al

-2.GetState::[0xAD9D718]48 89 D7 48 8B 52 10 48 89 ** 44=48 89 D7 48 8B 52 10
lea rdi,[rdx+50]
mov [statePtr],rdi
mov rdi, rdx
mov rdx, qword ptr [rdx+0x10]

-3.GetPlayer::[0x4CD4E3]8B 40 58 48 8B 5C 24 30 48 83 ** 20 ** C3 48 8B ** ** 30 ** 01=8B 40 58 48 8B 5C 24 30
mov [playerInfoPtr],rax
mov rbx,[rax+10]
add rbx,60
mov [playerModPtr],rbx
add rbx,50
mov [playerModSizePtr],rbx
mov eax, dword ptr [rax+0x58]
mov rbx, qword ptr [rsp+0x30]

-4.GetAction::[0x16EBA78]48 8B 82 88 00 00 00 84=48 8B 82 88 00 00 00
lea rax,[rdx+0x88]
mov [actionPtr],rax
mov rax, qword ptr [rdx+0x88]

1.无限生命|infinte health::[0xC58687]48 83 78 18 00 75 ** 80 ** 5D 00 75 ** 8B=48 83 78 18 00
public bool all=false:敌人也一样|enemy also effective
cmp b[all],1
je @f
cmp rdx,[playerInfoPtr]
jne org
@@:
mov ecx,[rdx+54]
mov [rdx+58],ecx
ret
org:
cmp qword ptr [rax+0x18], 0x0

2.无消耗|items not reduced::[0xE87CCA]89 58 20 48 8B 74=89 58 20 48 8B 74 24 30
cmp dword ptr [rax+0x20], ebx
jg @f
mov dword ptr [rax+0x20], ebx
@@:
mov rsi, qword ptr [rsp+0x30]

2.::[0xE8AE20]83 F8 02 0F 85 14 01+2=02
db FF

3.一击即死|one hit kill::[0xC586A5]0F 4F C1 41 89 41=0F 4F C1 41 89 41 58
cmovnle eax, ecx
cmp r9,[playerInfoPtr]
je org
xor rax,rax
org:
mov dword ptr [r9+0x58], eax

4.暴君无法复活|tyrant can't revive::[0x1C62E23]75 3C 0F 5A C0 F2=75
db eb

5.无后坐力|no recoil::[0x1125ECF]48 83 78 18 00 0F 57 ** F3 0F 5A ** 0F 85 ** ** ** ** 48 8B ** 88=48 83 78 18 00
cmp rax, 0

6.超级精准度|fast weapon accuracy::[0x1705CEE]F3 0F 11 84 24 C8 00 00 00 F3 0F 11 ** ** CC 00 00 00 48 83=F3 0F 11 84 24 C8 00 00 00
float v = 100
movss xmm0,[v]
movss xmm1,[v]
movss dword ptr [rsp+0xC8], xmm0

7.包裹格数|backpack size::[0x1CBB2B3]41 3B 88 90 00=41 3B 88 90 00 00 00
range uint v[8,1,20] = 20:格子数|grid size
mov eax,[v]
mov dword ptr [r8+0x90],eax
cmp ecx, dword ptr [r8+0x90]

8.可交互提示距离|highilght item tip distance::[0x22BE153]F3 0F 59 63 6C=F3 0F 59 63 6C
range float v[1,1,50] = 15:距离|distance
mov rcx,qword ptr [rbx+28]
test rcx,rcx
je @f
mov rcx,qword ptr [rcx+80]
test rcx,rcx
je @f
mov rax,74006F004E002F
cmp qword ptr [rcx+30],rax
jne @f
mov rax,2F006500630069
cmp qword ptr [rcx+38],rax
jne @f
mulss xmm4, dword ptr [v]
jmp return
@@:
mulss xmm4, dword ptr [rbx+0x6C]

9.游戏时间|play time::[0xB7FB8E]48 8B 43 50 4C 39 70 18 0F 85 ** ** ** ** 48 8B ** 60 48 85 ** 75 ** 8D=48 8B 43 50 4C 39 70 18
public tick curtime=0:游戏时间|play time
xor rdx,rdx
mov q[rax+20],rdx
mov q[rax+28],rdx
mov q[rax+30],rdx
mov rdx,[curtime]
mov q[rax+18],rdx
mov rax, qword ptr [rbx+0x50]
cmp qword ptr [rax+0x18], r14

10.存档次数|save counter::[0xBA001E]89 41 24 48 8B 43 50 48 39 ** 18 0F 85 ** ** ** ** 48 8B ** ** ** ** ** 48 85 ** 0F=89 41 24 48 8B 43 50
public uint saveCount=0:存档后生效|count(effective after saving game)
mov eax,[saveCount]
mov dword ptr [rcx+0x24], eax
mov rax, qword ptr [rbx+0x50]

11.开箱次数|box open counter::[0x1304111]48 8B 47 70 48 85 C0 0F 84 ** ** ** ** 01 ** 18=48 8B 47 70 48 85 C0
public uint openCount=0:开箱后生效|count(effective after open box)
mov rax, qword ptr [rdi+0x70]
test rax, rax
je return
mov ebp,[openCount]
mov [rax+18],ebp
xor rbp,rbp

12.治疗次数|recovery item used counter::[0x1304126]48 8B 47 70 48 85 C0 0F 84 ** ** ** ** 01 ** 1C=48 8B 47 70 48 85 C0
public uint itemCount=0:治疗后生效|count(effective after use of recovery item)
mov rax, qword ptr [rdi+0x70]
test rax, rax
je return
mov ebp,[itemCount]
mov [rax+1C],ebp
xor rbp,rbp

13.走动步数|step counter::[0x49585B]44 01 42 64 48=44 01 42 64 48 8B 41 50
public uint stepCount=0:走动步数|count
mov eax,[stepCount]
mov dword ptr [rdx+0x64], eax
mov rax, qword ptr [rcx+0x50]

14.移动速度|move speed::[0x213D1E4]F3 41 0F 58 16 F3 41=F3 41 0F 58 16
range float mul[0.5,0.1,5.0] = 2:移动倍数|speed multiple
cmp [actionPtr],0
je org
cmp [statePtr],0
je org
mov rax,[actionPtr]
cmp q[rax],0
jne org
mov rax,[statePtr]
cmp b[rax],1
jne org
cmp rdi,[playerModPtr]
jne org
movss xmm10,dword ptr [r14]
mulss xmm10,[mul]
movss dword ptr [r14],xmm10

//movss xmm10,dword ptr [r14+4]
//mulss xmm10,[mul]
//movss dword ptr [r14+4],xmm10

movss xmm10,dword ptr [r14+8]
mulss xmm10,[mul]
movss dword ptr [r14+8],xmm10
org:
addss xmm2,dword ptr [r14]

15.瞬移&穿墙|teleport & through wall::[0x213D1FF]F3 0F 11 47 38 E9=F3 0F 11 47 38
float[4] localtion = {}
public bool freeUD=false:随意上升/下降|free rise/fall
public onece bool save=true:保存坐标|save location
public onece bool load=true:读取坐标|load location
public onece bool up=true:上升|rise
public onece bool down=true:下降|fall

int hvalue=0
float hchang=0.1

movss dword ptr [rdi+0x38], xmm0

cmp rdi,[playerModPtr]
jne return
cmp [actionPtr],0
je return
cmp [statePtr],0
je return
mov rax,[actionPtr]
cmp q[rax],0
jne return

mov rax,[statePtr]
cmp b[rax],1
jne return

cmp b[save],1
je s
cmp b[load],1
je l
cmp b[up],1
je setup
cmp b[down],1
je setdown
jmp checkHeight
s:
mov b[save],0
movaps xmm10,[rdi+0x30]
movaps [localtion],xmm10
jmp return
l:
xorps xmm10,xmm10
cmpps xmm10,[localtion],0
movmskps eax, xmm10
cmp al,F
jne @f
mov b[load],0
jmp return
@@:
movaps xmm10,[localtion]
movaps [rdi+0x30],xmm10
mov b[load],0
jmp return

setup:
mov [hvalue],#16
mov b[up],0
jmp checkHeight
setdown:
mov [hvalue],#-16
mov b[down],0

checkHeight:
cmp [hvalue],0
je return
jl @f
movss xmm10,[rdi+0x34]
addss xmm10,[hchang]
movss [rdi+0x34],xmm10
sub [hvalue],1
jmp return
@@:
movss xmm10,[rdi+0x34]
subss xmm10,[hchang]
movss [rdi+0x34],xmm10
add [hvalue],1

15.::[0x454EF1]F3 0F 11 55 CF E8 ** ** ** ** 0F 28 ** ** A0+5=[5]
cmp [actionPtr],0
je org
cmp [statePtr],0
je org
mov rax,[actionPtr]
cmp q[rax],0
jne org

mov rax,[statePtr]
cmp b[rax],1
jne org

cmp rcx,[playerModPtr]
jne org
movaps xmm0,[rcx+30]
movaps [rdx],xmm0
movaps [rdx+10],xmm0
movaps [rdx+20],xmm0
jmp return
org:
call 0x0

15.::[0x22AFFDA]48 8B 49 18 E9 ** ** ** ** C3=[9]
mov rcx, qword ptr [rcx+0x18]
cmp [actionPtr],0
je org
cmp [statePtr],0
je org
mov rax,[actionPtr]
cmp q[rax],0
jne org

mov rax,[statePtr]
cmp b[rax],1
jne org

cmp rcx,[playerModPtr]
jne org
movaps xmm0,[rcx+30]
movaps [rdx],xmm0
movaps [rdx+10],xmm0
movaps [rdx+20],xmm0
jmp return
org:
jmp 0x4

15.::[0x1A8CE51]F3 44 0F 11 45 BF E8 ** ** ** ** E9+6=[5]
cmp [actionPtr],0
je org
cmp [statePtr],0
je org
mov rax,[actionPtr]
cmp q[rax],0
jne org

mov rax,[statePtr]
cmp b[rax],1
jne org

cmp rcx,[playerModPtr]
jne org
movaps xmm0,[rcx+30]
movaps [rdx],xmm0
movaps [rdx+10],xmm0
movaps [rdx+20],xmm0
jmp return
org:
call 0x0

15.::[0x1DC885F]41 8B 06 89 47=41 8B 06 89 47 30
cmp b[freeUD],0
je org
cmp [hvalue],0
je org
cmp [actionPtr],0
je org
cmp [statePtr],0
je org
mov rax,[actionPtr]
cmp q[rax],0
jne org

mov rax,[statePtr]
cmp b[rax],1
jne org

cmp rdi,[playerModPtr]
jne org

movaps xmm0,[rdi+30]
movaps [r14],xmm0
movaps [r14+10],xmm0
movaps [r14+20],xmm0

org:
mov eax, dword ptr [r14]
mov dword ptr [rdi+0x30], eax

16.视角距离|FOV distance::[0x1126A85]C6 43 30 01 66 0F 5A C1 F3 0F 11 ** 34 48 8B ** 50 48 83 ** 18 00 0F 85 ** ** ** ** 4C=C6 43 30 01 66 0F 5A C1
range float v[0.0,0.1,20.0] = 1.3:距离|distance
int weapon=0
mov byte ptr [rbx+0x30], 0x1
movss xmm0,[v]

16.::[0x112325C]44 89 A7 98 01=44 89 A7 98 01 00 00
mov dword ptr [rdi+0x198], r12d
mov dword ptr [weapon], r12d

//16.::[0xBB83445]F3 0F 11 42 14 48 8B ** 50=F3 0F 11 42 14
//range float h[-0.5,0.01,0.2] = 0:高度
//addss xmm0,[h]
//movss dword ptr [rdx+0x14], xmm0

16.::[0x11267C0]F3 0F 11 4B 54 F3 0F 11 ** 58 C6 ** 48 01 48 8B ** 50 48 83 ** 18 00 0F=F3 0F 11 4B 54
public bool smooth = true:平滑镜头|smooth camera
public bool aimReset = true:瞄准时恢复高度|Restore height when aiming
range float h[-5,0.01,5] = 0:高度|height
range float change[0.05,0.01,0.5] = 0.2:平滑增幅|smooth change
float zero=0
float target=0
cmp b[aimReset],0
je set
movss xmm0,[h]
cmp [weapon],0
je set
jmp reset
set:
cmp b[smooth],1
je @f
movss xmm0,[h]
movss [target],xmm0
jmp assign
@@:
comiss xmm0,[zero]
ja incHeight
decHeight:
comiss xmm0,[target]
jae assignTarget
movss xmm0,[target]
subss xmm0,[change]
movss [target],xmm0
jmp assign

incHeight:
comiss xmm0,[target]
jbe assignTarget
movss xmm0,[target]
addss xmm0,[change]
movss [target],xmm0
jmp assign

assignTarget:
movss [target],xmm0
jmp assign

reset:
cmp b[smooth],1
je @f
movss xmm0,[zero]
movss [target],xmm0
jmp assign
@@:
comiss xmm0,[zero]
movss xmm0,[zero]
ja decHeight
jb incHeight
movss [target],xmm0

assign:
addss xmm1,[target]
movss dword ptr [rbx+0x14], xmm1
movss dword ptr [rbx+0x54], xmm1

17.湿身效果|wet body::[0xA95A2B]41 0F 2F C8 F3 0F 11 0E=41 0F 2F C8 F3 0F 11 0E
range float mul[0.0,0.1,1.0] = 1:湿度|effect
movss xmm1,[mul]
comiss xmm1, xmm8
movss dword ptr [rsi], xmm1

17.::[0xA95776]8B 87 98 00 00 00 FF ** 83=8B 87 98 00 00 00
mov eax, 3

18.极速开枪|no firing delay::[0x19A49BB]44 39 61 30 0F 9F ** 48 8B ** 50 4C 39 ** 18 0F 85 ** ** ** ** 84 ** 0F 84 ** ** ** ** 49 8B ** B0=44 39 61 30 0F 9F D1
xor rcx,rcx

19.无敌|invulnerable::[0xBB253C]44 38 68 5C 0F=44 38 68 5C 0F 95 D1
cmp [statePtr],0
je org
push rax
mov rax,[statePtr]
cmp b[rax],1
pop rax
jne org
cmp rax,[playerInfoPtr]
jne org
mov cl,1
jmp return
org:
cmp byte ptr [rax+0x5C], r13b
setnz cl

20.动态难度(分数)|score::[0x15544CF]F3 0F 11 75 5C 48 8B ** 50=F3 0F 11 75 5C
range float score[0,100,12999]=12999:分数|score
movss xmm6,[score]
movss dword ptr [rbp+0x5C], xmm6

21.真隐身模式|zombies don't attack::[0xAD9D71F]48 89 CB 44 89 F5 48 85 ** 75 ** 45 31 ** 41 8D ** 46=48 89 CB 44 89 F5
mov rbx, rcx
mov ebp, r14d
xor rdx,rdx

22.人物大小修改|player model size::[0x23CE99]F3 41 0F 10 49 08 F3 0F 11=F3 41 0F 10 49 08
range float mul[0.1,0.1,5]=1:人物大小|size
public bool vol=false:是否修改碰撞体积|volume calc
cmp r9,[playerModSizePtr]
jne org
movss xmm1,[mul]
jmp return
org:
movss xmm1, dword ptr [r9+0x8]

22.::[0x23CF27]F3 41 0F 10 01 F3 0F 59 ** F3=F3 41 0F 10 01
cmp r9,[playerModSizePtr]
jne org
movss xmm0,[mul]
jmp return
org:
movss xmm0, dword ptr [r9]

22.::[0x23CF30]F3 41 0F 10 49 04 F3 0F 5C ** F3=F3 41 0F 10 49 04
cmp r9,[playerModSizePtr]
jne org
movss xmm1,[mul]
jmp return
org:
movss xmm1, dword ptr [r9+0x4]

22.::[0x213AF76]F3 41 0F 11 46 18 E8 ** ** ** ** E9=F3 41 0F 11 46 18
cmp b[vol],0
je return
cmp rsi,[playerModPtr]
jne return
movss xmm1,[mul]
movss xmm0,[r14+10]
mulss xmm0,xmm1
movss [r14+10],xmm0

movss xmm0,[r14+14]
mulss xmm0,xmm1
movss [r14+14],xmm0

movss xmm0,[r14+18]
mulss xmm0,xmm1
movss [r14+18],xmm0

23.免疫中毒|immune poisoning::[0x4CF79F]40 84 F6 0F 95 ** 88 ** 58 02=40 84 F6 0F 95 C0
xor rsi,rsi
xor rax,rax

24.混合药草增益状态|mixed herbs buffer::[0x503E41]F3 0F 10 8A 5C 02 00 00 0F 57 ** 0F 5A ** 66 0F 2F ** 0F 97 ** 48=F3 0F 10 8A 5C 02 00 00
float v = 180
movss xmm1, [v]
movss dword ptr [rsi+0x25C],xmm1

25.艾达秒入侵|Ada Instant hacking::[0x1537A42]F3 0F 11 93 28 02 00 00 66=F3 0F 11 93 28 02 00 00
movss dword ptr [rbx+0x228], xmm3

26.锁定倒计时|freeze countdown timer::[0x187A7C4]F3 0F 11 4F 78 48 8B ** 50 48 39=F3 0F 11 4F 78
db 90 90 90 90 90