this time im going to post the codes and put notes with them...
since this was a unity-based game, most of my finding are coming from that method of accessing game files
[Breeze Yars Rising 1.0.891299 TID: 01007EA01E00A000 BID: 28E6F0436FCA2D90]
[Restore(asm)]
04000000 022C84AC B943DE8B
04000000 022F41CC AA1F03E1
04000000 0235718C 1A9F17E0
[acquire playerbase]
04000000 022C84AC 14B00F79
04000000 04ECC290 F0010D8B
04000000 04ECC294 F900F974
04000000 04ECC298 B943DE8B
04000000 04ECC29C 174FF085
under Yars.PlayerBase$$ProcessAbilities
// Token: 0x040029A2 RID: 10658
[Token(Token = "0x40029A2")]
[Il2CppDummyDll.FieldOffset(Offset = "0x3DC")]
private PlayerBase.PlayerAbilityFlags2 m_AbilityFlags2;
this is where i hooked to get the playerbase address which is copied to a separate memory space and used for pointer setup below.
its important to note, this has to be ON constantly for the pointer codes to work.
[hover mode ptr version]
580F0000 0707F1F0
580F1000 00000418
780F0000 000000C4
640F0000 00000000 41A00000
80002002
640F0000 00000000 C1A00000
20000000
80000003
640F0000 00000000 00000000
21000000
[hover mode]
80800000
04000000 02302040 BC6A6900
20000000
80000020
04000000 02302040 1E2703E0
20000000
80200000
04000000 02302040 1E35D000
20000000
the 2 codes above use what is know as
// Token: 0x04002BDD RID: 11229
[Token(Token = "0x4002BDD")]
[Il2CppDummyDll.FieldOffset(Offset = "0xC4")]
[SerializeField]
private float m_MaxFallSpeed;
set this to 0, and you got hover mode, set it negative and you got moonjump. neat, right?
the keys for the asm version are:
rstick down: normal mode
rstick click: hover mode
rstick up: reverse gravity (moonjump)
[debug inv off]
580F0000 0707F1F0
580F1000 00000048
780F0000 00000098
610F0000 00000000 00000000
[debug inv on]
580F0000 0707F1F0
580F1000 00000048
780F0000 00000098
610F0000 00000000 00000001
you have no idea how happy i was once i found this, this is the ULTIMATE damage blocker,
nothing damages you: police guard, lazers, those annoying robots. doesnt save you from the death pit, thought.
[hp]
580F0000 0707F1F0
580F1000 00000048
780F0000 00000038
989EF000
540E1000 00000018
A4EF0000
[mp]
580F0000 0707F1F0
580F1000 00000148
580F1000 00000020
780F0000 00000074
989EF000
540E1000 00000004
A4EF0000
again, if you need to trace these 2, you have to convert into fixed value, not the copy and write what's in the register mode.
[spd x2]
04000000 022F41CC 1E282908
running spd:
// Token: 0x040029CC RID: 10700
[Token(Token = "0x40029CC")]
[Il2CppDummyDll.FieldOffset(Offset = "0x4F8")]
[SerializeField]
private float m_movementSpeedXZRun;
using the playerbase and the offset here, i was able to trace a code that affects movement.
[Storymode - minigame inv on]
04000000 0235718C 52800020
"hacker tip: this can be use even in hard(pro) mode when they remove the option."
^if you get it, you get it."
since this was a unity-based game, most of my finding are coming from that method of accessing game files
[Breeze Yars Rising 1.0.891299 TID: 01007EA01E00A000 BID: 28E6F0436FCA2D90]
[Restore(asm)]
04000000 022C84AC B943DE8B
04000000 022F41CC AA1F03E1
04000000 0235718C 1A9F17E0
[acquire playerbase]
04000000 022C84AC 14B00F79
04000000 04ECC290 F0010D8B
04000000 04ECC294 F900F974
04000000 04ECC298 B943DE8B
04000000 04ECC29C 174FF085
under Yars.PlayerBase$$ProcessAbilities
// Token: 0x040029A2 RID: 10658
[Token(Token = "0x40029A2")]
[Il2CppDummyDll.FieldOffset(Offset = "0x3DC")]
private PlayerBase.PlayerAbilityFlags2 m_AbilityFlags2;
this is where i hooked to get the playerbase address which is copied to a separate memory space and used for pointer setup below.
its important to note, this has to be ON constantly for the pointer codes to work.
[hover mode ptr version]
580F0000 0707F1F0
580F1000 00000418
780F0000 000000C4
640F0000 00000000 41A00000
80002002
640F0000 00000000 C1A00000
20000000
80000003
640F0000 00000000 00000000
21000000
[hover mode]
80800000
04000000 02302040 BC6A6900
20000000
80000020
04000000 02302040 1E2703E0
20000000
80200000
04000000 02302040 1E35D000
20000000
the 2 codes above use what is know as
// Token: 0x04002BDD RID: 11229
[Token(Token = "0x4002BDD")]
[Il2CppDummyDll.FieldOffset(Offset = "0xC4")]
[SerializeField]
private float m_MaxFallSpeed;
set this to 0, and you got hover mode, set it negative and you got moonjump. neat, right?
the keys for the asm version are:
rstick down: normal mode
rstick click: hover mode
rstick up: reverse gravity (moonjump)
[debug inv off]
580F0000 0707F1F0
580F1000 00000048
780F0000 00000098
610F0000 00000000 00000000
[debug inv on]
580F0000 0707F1F0
580F1000 00000048
780F0000 00000098
610F0000 00000000 00000001
you have no idea how happy i was once i found this, this is the ULTIMATE damage blocker,
nothing damages you: police guard, lazers, those annoying robots. doesnt save you from the death pit, thought.
[hp]
580F0000 0707F1F0
580F1000 00000048
780F0000 00000038
989EF000
540E1000 00000018
A4EF0000
[mp]
580F0000 0707F1F0
580F1000 00000148
580F1000 00000020
780F0000 00000074
989EF000
540E1000 00000004
A4EF0000
again, if you need to trace these 2, you have to convert into fixed value, not the copy and write what's in the register mode.
[spd x2]
04000000 022F41CC 1E282908
running spd:
// Token: 0x040029CC RID: 10700
[Token(Token = "0x40029CC")]
[Il2CppDummyDll.FieldOffset(Offset = "0x4F8")]
[SerializeField]
private float m_movementSpeedXZRun;
using the playerbase and the offset here, i was able to trace a code that affects movement.
[Storymode - minigame inv on]
04000000 0235718C 52800020
"hacker tip: this can be use even in hard(pro) mode when they remove the option."
^if you get it, you get it."
