Please note that you are required to have a exploited PlayStation 4 console on firmware 9.00 or lower to run the patches mentioned in this article.
With the recent release of the 7.5x exploit, I have an opportunity to make a cheat I wanted a reality.
For those who have not played The Last of Us: Part II, there is now a proper cheat system. intended for players who have completed the game once.
Quiet or they’ll find out
When activating a cheat, one expects it to do what it says in the title, right?
There’s a fault with one of the provided cheats, “Infinite Ammo” - Whether this is intended or not is another question, but I wanted to improve on it since it’s been on my mind since the feature was made available.
The issue with this cheat is that ammo still decreases for the silencer, one of the games craftable items for the Pistol.
Find it first or it will be gone
I can do a search for the silencer ammo, find it, change the value, and should be it right, right?
Not so fast. The byte for the ammo itself will shift after sometime idling, this makes the process a little difficult. but after a while, I found its memory region and found it within a couple of minutes.
015df257 41 ff 8e DEC dword ptr [R14 + 0x814] 14 08 00 00
This is our instruction for the silencer ammo. Nop this and the ammo will not decrease.
Options are nice
How about implementing this into the cheat that’s built into the game. Sounds simple enough.
003188d0 48 8b 05 MOV RAX,qword ptr [DAT_037675b0] d9 ec 44 03 003188d7 80 b8 ac CMP byte ptr [RAX + DAT_000043ac],0x0 43 00 00 00 003188de 0f 95 c1 SETNZ CL 003188e1 44 30 f1 XOR CL,R14B 003188e4 80 f9 01 CMP CL,0x1 003188ed 44 88 b0 MOV byte ptr [RAX + DAT_000043ac],R14B ac 43 00 00
You can see here that the first instruction setups a pointer, the second compares if isn’t 0, writes 1 to CL, last instruction then moves from what is in R14B, into the specified address.
Let’s make it a toggle.
Knowing that instruction at 0x15df257 decreases the silencer ammo and skipping it does not gives a few clues.
015df257 67 67 e8 CALL FUN_01404590 // call to cave 32 53 e2 ff 01404590 48 8b 05 MOV RAX,qword ptr [DAT_037675b0] //set ptr 19 30 36 02 01404597 80 3d e3 CMP byte ptr [DAT_035aec81],0x0 // leftover, not needed in final!! a6 1a 02 00 0140459e 80 b8 ac CMP byte ptr [RAX + 0x43ac],0x0 //cmp ptr +43ac 43 00 00 00 014045a5 75 07 JNZ LAB_014045ae if isn't 0 go to ret 014045a7 41 ff 8e DEC dword ptr [R14 + 0x814] // decreae as normal 14 08 00 00 014045ae c3 RET
DEC instruction to call to our new location, setup a pointer, compare if is not 0, do nothing, if 0 decrease ammo as normal.
One More Thing
As you may have noticed, The blog now has a new theme.
I have also ported the Infected’s Severed Head Crash Bug Fix to the latest version of The Last of Us Remastered. (1.11)
Also, here is Naughty Dog code for loading section on 1.11.
0x2c is framelock but the fact that it doesn’t even work in the menu made me laughed a little.
Thanks to the patrons who supported me on various platforms! You guys are awesome!
- Jeff Eberlin