[SA] Climb in interiors

[DavidReyes2250]

Hello, do you know if there is a way to make the player climb in the interiors as he does when he is outside?

Although there is a memory address that when overwritten, the player can only climb walls that are nearby and not jump from one place to hang on another and climb.

 

0A8C: write_memory 0x680C9E size 1 value 0 virtual_protect 0

[Jack]

On 2/7/2023 at 7:26 AM, DavidReyes2250 said:

Hello, do you know if there is a way to make the player climb in the interiors as he does when he is outside?

Although there is a memory address that when overwritten, the player can only climb walls that are nearby and not jump from one place to hang on another and climb.

 

0A8C: write_memory 0x680C9E size 1 value 0 virtual_protect 0

Modify "CTaskSimpleJumpInAir" function also:

//  0x680600    CTaskSimpleJumpInAir
    0x680ABD mov eax, _ZN5CGame8currAreaE
    0x680AC2 test eax, eax
    0x680AC4 jne loc_680C00

And here:   

//  0x680C60    CTaskSimpleJumpLaunch
    0x680C9D mov eax, _ZN5CGame8currAreaE   
    0x680CA2 test eax, eax
    0x680CA4 jne loc_680CC0    

You wrote size 1 while the value is a DWORD.

 

It would be better to Nop the cond. check instead of the variable store:

MakeNOP(0x680AC4, 6);   //  [size 6]
MakeNOP(0x680CA4, 2);   //  [WORD]

To return to default:

WriteMemoryRaw(0x680AC4, "x0F\x85\x36\x01\x00\x00", 6);  
WriteMemory<WORD>(0x680CA4, 0x1A75);

Spoiler

inline void WriteMemoryRaw(memory_pointer_tr addr, void* value, size_t size, bool vp) {
    scoped_unprotect xprotect(addr, vp? size : 0);
    memcpy(addr.get(), value, size);
}

inline void MakeNOP(memory_pointer_tr at, size_t count = 1, bool vp = true) {
    MemoryFill(at, 0x90, count, vp);
}

template<class T>
inline void WriteMemory(memory_pointer_tr addr, T value, bool vp = false)
{
    WriteObject(addr, value, vp);
}

 

 

Edited February 8 by Jack
.

[DavidReyes2250]

3 hours ago, Jack said:

Modify "CTaskSimpleJumpInAir" function also:

//  0x680600    CTaskSimpleJumpInAir
    0x680ABD mov eax, _ZN5CGame8currAreaE
    0x680AC2 test eax, eax
    0x680AC4 jne loc_680C00

And here:   

//  0x680C60    CTaskSimpleJumpLaunch
    0x680C9D mov eax, _ZN5CGame8currAreaE   
    0x680CA2 test eax, eax
    0x680CA4 jne loc_680CC0    

You wrote size 1 while the value is a DWORD.

 

It would be better to Nop the cond. check instead of the variable store:

MakeNOP(0x680AC4, 6);   //  [size 6]
MakeNOP(0x680CA4, 2);   //  [WORD]

To return to default:

WriteMemoryRaw(0x680AC4, "x0F\x85\x36\x01\x00\x00", 6);  
WriteMemory<WORD>(0x680CA4, 0x1A75);

  Hide contents

inline void WriteMemoryRaw(memory_pointer_tr addr, void* value, size_t size, bool vp) {
    scoped_unprotect xprotect(addr, vp? size : 0);
    memcpy(addr.get(), value, size);
}

inline void MakeNOP(memory_pointer_tr at, size_t count = 1, bool vp = true) {
    MemoryFill(at, 0x90, count, vp);
}

template<class T>
inline void WriteMemory(memory_pointer_tr addr, T value, bool vp = false)
{
    WriteObject(addr, value, vp);
}

 

 

Thank for the help! But how could I write all this in a SCM/CLEO script? I don't usually handle memory addresses much and I don't understand C++ much.

Edited February 8 by DavidReyes2250

[Jack]

0A8C: write_memory 0x680AC4 size 6 value 0x90 virtual_protect 0
0A8C: write_memory 0x680CA4 size 2 value 0x9090 virtual_protect 0

 

[DavidReyes2250]

Works fine. Thanks!

Edited February 8 by DavidReyes2250