This one was a lot trickier to set up due to having to jump around the assembly a bunch to get a specific address into r12, as the address as a null value in it, so I wasn't able to include it in the stack overflow part.
The repo can be found here, and the gci files can be found here.
NBA Live 2005 Save Exploit
NBA Live 2005 Save Exploit
TTYD Speedrunner