LIRW

{$STRICT}

{$lua}

if syntaxcheck then return end

[ENABLE]

function _readInteger( Input )
  -- thanks, Pox!
  local Value = readInteger( Input )
  if Value < 0x80000000 then return Value
  else return Value - 0x100000000 end
end

function aobScanEx( aob, p, a, n, s, e, pb )
  local p, a, n, s, e = p or '*X*W', a or fsmNotAligned, n or '0', s or 0x0, e or 0xffffffffffffffff
  local ms = pb and createMemScan( pb ) or createMemScan()
  local fl = createFoundList( ms )
  ms.firstScan( soExactValue, vtByteArray, nil, aob, nil, s, e, p, a, n, true, false, false, false )
  ms.waitTillDone()
  fl.initialize()
  local result = nil
  if fl ~= nil and fl.getCount() > 0 then
    result = createStringlist()
    for i = 1, fl.getCount() do result.add( fl.getAddress( i - 1 ) ) end
  end
  fl.destroy()
  ms.destroy()
  return result
end

local gameProcess = 'MetroExodus.exe'
local gameModule = getAddress( gameProcess )
local t = aobScanEx( '48837B??0074??807B??000F94D084C075??85??74??F3', nil, nil, nil, gameModule, gameModule + getModuleSize( gameProcess ) )
local NoClip = tonumber( t[0], 16 )
unregisterSymbol( 'NoClip' )
registerSymbol( 'NoClip', NoClip, true )
local t = aobScanEx( '488B0D????????4885C90F84????????488B51??48895C24??48897C24??4885D274', nil, nil, nil, gameModule, gameModule + getModuleSize( gameProcess ) )
t = tonumber( t[0], 16 )
local PhysX = readQword( t + _readInteger( t + 0x3 ) + 0x7 )
unregisterSymbol( 'PhysX' )
registerSymbol( 'PhysX', PhysX, true )

autoAssemble([[

  alloc( MovementHook, 0x1000, MetroExodus.exe )
  registersymbol( MovementHook )

  label( goback )
  label( skip )
  label( subGetAsyncKeyState )
  label( fraction )

  label( ZLock )
  registersymbol( ZLock )

  label( back )

  MovementHook:

  push rdx
  mov rdx,PhysX
  mov rdx,[rdx+28] // leads to Player
  mov rdx,[rdx+758]
  mov rdx,[rdx+10]
  cmp rbx,rdx
  pop rdx
  jnz goback

    mov [ZLock],rbx
    mov byte ptr [rbx+30],4

    mov rax,PhysX
    mov rax,[rax+28] // leads to Player
    test rax,rax
    jz goback

      cmp [rax+938],0 // check if camera vector is initialized
      jz goback

        push rax
        push rbx
        push rdx
        push rsi
        push rdi
        push rbp
        push r8
        push r9
        push r10
        push r11
        push r12
        push r13
        push r14
        push r15

          push rcx
          xor r10,r10

          mov r11,1 // FORWARD
          mov ecx,'W'
          call short subGetAsyncKeyState

          mov r11,2 // BACKWARD
          mov ecx,'S'
          call short subGetAsyncKeyState

          mov r11,4 // STRAFE LEFT
          mov ecx,'A'
          call short subGetAsyncKeyState

          mov r11,8 // STRAFE RIGHT
          mov ecx,'D'
          call short subGetAsyncKeyState

          mov r11,10 // FASTER
          mov ecx,10 // Shift
          call short subGetAsyncKeyState

          mov r11,20 // Z UP
          mov ecx,20 // Space
          call short subGetAsyncKeyState

          mov r11,40 // Z DOWN
          mov ecx,11 // Ctrl
          call short subGetAsyncKeyState

          pop rcx
          test r10,r10
          jz skip

            mov rdi,PhysX
            mov rdi,[rdi+28]
            mov rbx,rdi
            mov rdi,[rdi+928] // camera vector (already normalized)
            test rdi,rdi
            jz skip

            movups xmm1,[rdi+C0]
            xorps xmm15,xmm15 // this register will temporary keep sum of four vectors    (forward, backward,  strafe left,  strafe right)

		    test r10,01 // forward
		    jz +4
		    addps xmm15,xmm1

		    test r10,02 // backward
		    jz +4
		    subps xmm15,xmm1

		    // calc rotatedLeftBy90 vector
		    shufps xmm1,xmm1,06  //  camera struct (X,Z,Y), Z is up-down axis
                                 //  now xmm1 contains (Y,Z,X)
            xorps xmm2,xmm2
		    subss xmm2,xmm1
		    movss xmm1,xmm2 //  now xmm1 contains (-Y,Z,X); rotatedLeftBy90deg in Z-axis

		    movaps xmm14,xmm1 // save for later

		    // for strafing we have to set Z to zero
		    mov eax,-1
		    movd xmm2,eax
		    shufps xmm2,xmm2,08
		    andps xmm1,xmm2 // now xmm1 contains (-Y,0,X)

		    test r10,04  // strafe left
		    jz +4
		    addps xmm15,xmm1

		    test r10,08 // strafe right
		    jz +4
		    subps xmm15,xmm1

		    // move in Z axis
		    mov eax,(float)1
		    movd xmm1,eax
		    shufps xmm1,xmm1,51 // now xmm1 contains (0,1,0)

		    test r10,20 // Z axis UP
		    jz +4
		    addps xmm15,xmm1

		    test r10,40 // Z axis DOWN
		    jz +4
		    subps xmm15,xmm1

		    movups xmm1,[rdi+C0] // camVect
		    movaps xmm2,xmm14 // rotLeft90camVect

		    movaps xmm14,xmm1

		    shufps xmm1,xmm1,09
		    shufps xmm2,xmm2,12
		    shufps xmm14,xmm14,12

		    mulps xmm1,xmm2
		    shufps xmm2,xmm2,12
		    mulps xmm14,xmm2

		    subps xmm1,xmm14
		    // xmm1 now has cross product of camVect and rotLeft90camVect, lets call it V1

		    movaps xmm14,xmm1
		    subss xmm14,xmm1
		    subss xmm14,xmm1
		    shufps xmm14,xmm14,06 // xmm14 now has rotRight90V1, lets call it V2

		    addps xmm1,xmm14 // sum of V1 and V2

		    // normalize
		    movaps xmm2,xmm1
		    mulps xmm2,xmm2
		    movss xmm14,xmm2
		    shufps xmm2,xmm2,21
		    addss xmm14,xmm2
		    movhlps xmm2,xmm2
		    addss xmm14,xmm2
		    sqrtss xmm14,xmm14
		    shufps xmm14,xmm14,0
		    divps xmm1,xmm14

		    movaps xmm1,xmm15 // xmm1 constains vector for No_Clip (sum of many vectors)
		    xorps xmm2,xmm2

		    mulps xmm15,xmm15
		    addss xmm2,xmm15
		    shufps xmm15,xmm15,E1
		    addss xmm2,xmm15
		    movhlps xmm15,xmm15
		    addss xmm2,xmm15
		    sqrtss xmm2,xmm2 // xmm2 contains No_Clip vector length

		    xorps xmm15,xmm15
		    comiss xmm2,xmm15 // deal with division by zero
		    je short skip

		    shufps xmm2,xmm2,00
		    divps xmm1,xmm2 // No_Clip vector is now normalized

		    // before we add this vector to playerPos, we have to reduce it a bit
		    movss xmm2,[fraction]
		    shufps xmm2,xmm2,00

		    // faster
		    test r10,10
		    jz +6
		    addps xmm2,xmm2
		    addps xmm2,xmm2
		    mulps xmm1,xmm2

		    // update player pos
		    mov rbx,[rbx+758]
		    test rbx,rbx
		    jz short skip

		      mov rbx,[rbx+10]

		      movups xmm2,[rbx+BC]
		      addps xmm2,xmm1
		      movq [rbx+BC],xmm2
		      movhlps xmm2,xmm2
		      movss [rbx+C4],xmm2
/*
		      pop r15
		      pop r14
		      pop r13
		      pop r12
		      pop r11
		      pop r10
		      pop r9
		      pop r8
		      pop rbp
		      pop rdi
		      pop rsi
		      pop rdx
		      pop rbx
		      pop rax
	          jmp back+3C
*/

      skip:
      pop r15
      pop r14
      pop r13
      pop r12
      pop r11
      pop r10
      pop r9
      pop r8
      pop rbp
      pop rdi
      pop rsi
      pop rdx
      pop rbx
      pop rax

      xor edi,edi

  goback:
  //movss xmm0,[rsp+40]
  cmp qword ptr [rbx+68],0
  jmp back

  db CC CC CC CC

  subGetAsyncKeyState:
    push r10
    push r11
    sub rsp,8
    call GetAsyncKeyState
    add rsp,8
    pop r11
    pop r10
    test ax,8000
    jz short @f
      or r10,r11
    @@:
    ret

  db CC CC CC CC

  fraction:
  dd (float)0.025
  ZLock:
  dq 0

  db CC CC CC CC

  NoClip:
  jmp MovementHook
  back:
]])

[DISABLE]

{$asm}

[ZLock]+34:
dd 08080000

[ZLock]+30:
db 0

NoClip:
cmp qword ptr [rbx+68],0

unregistersymbol( ZLock )
unregistersymbol( MovementHook )
dealloc( MovementHook )
unregistersymbol( PhysX )
unregistersymbol( NoClip )