52
"Compact View Mode"
Auto Assembler Script
[ENABLE]
{$lua}
--Make parts of the main form invisible.
controlMainForm = getMainForm()
control_setVisible(wincontrol_getControl(controlMainForm,0), false)
control_setVisible(wincontrol_getControl(controlMainForm,2), false)
control_setVisible(wincontrol_getControl(controlMainForm,3), false)
[DISABLE]
{$lua}
--Make parts of the main form visible.
controlMainForm = getMainForm()
control_setVisible(wincontrol_getControl(controlMainForm,0), true)
control_setVisible(wincontrol_getControl(controlMainForm,2), true)
control_setVisible(wincontrol_getControl(controlMainForm,3), true)
60
"-----"
1
2
"Find Player Entity Stats"
Auto Assembler Script
//Find health, it's floating-point.
//Unlike the old engine, this one actually uses structures.
//And health is even read in the pause screen.
[ENABLE]
aobscanmodule(readhealth,GameAssembly.dll,F3 0F 10 8A 58 01 00 00) // should be unique
alloc(newmem,$1000,readhealth)
label(code)
label(return)
globalalloc(_playerbase,8) //8 bytes for a 64-bit address.
newmem:
push rax //Push a register to the stack to free it for use.
mov rax,_playerbase //Copy our allocated address into it.
mov [rax],rdx //Copy our desired value into where rbx is pointing.
pop rax //Restore the value of rbx and pretend nothing happened.
code:
movss xmm1,[rdx+00000158]
jmp return
readhealth:
jmp newmem
nop 3
return:
registersymbol(readhealth)
[DISABLE]
readhealth:
db F3 0F 10 8A 58 01 00 00
unregistersymbol(readhealth)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 7FF9E071915C
7FF9E071913C: 48 85 D2 - test rdx,rdx
7FF9E071913F: 74 3B - je 7FF9E071917C
7FF9E0719141: 48 8B 82 48 01 00 00 - mov rax,[rdx+00000148]
7FF9E0719148: 48 85 C0 - test rax,rax
7FF9E071914B: 74 2F - je 7FF9E071917C
7FF9E071914D: F3 0F 10 40 58 - movss xmm0,[rax+58]
7FF9E0719152: 0F 57 C9 - xorps xmm1,xmm1
7FF9E0719155: 0F 2E C1 - ucomiss xmm0,xmm1
7FF9E0719158: 7A 02 - jp 7FF9E071915C
7FF9E071915A: 74 0C - je 7FF9E0719168
// ---------- INJECTING HERE ----------
7FF9E071915C: F3 0F 10 8A 58 01 00 00 - movss xmm1,[rdx+00000158]
// ---------- DONE INJECTING ----------
7FF9E0719164: F3 0F 5E C8 - divss xmm1,xmm0
7FF9E0719168: 4D 85 C9 - test r9,r9
7FF9E071916B: 74 0F - je 7FF9E071917C
7FF9E071916D: 45 33 C0 - xor r8d,r8d
7FF9E0719170: 49 8B C9 - mov rcx,r9
7FF9E0719173: 48 83 C4 28 - add rsp,28
7FF9E0719177: E9 54 8F 9E FF - jmp 7FF9E01020D0
7FF9E071917C: E8 9F F0 1A FD - call 7FF9DD8C8220
7FF9E0719181: CC - int 3
7FF9E0719182: CC - int 3
}
11
"Base"
0
808080
Binary
0
1
0
[_playerbase]
24
"Current Health"
0
Float
[_playerbase]+158
4
"Current EXP"
0
Float
[_playerbase]+16C
21
"Find Player Core Stats"
Auto Assembler Script
//Find max health.
//Float, game shows a rounded value though.
//Can max out normal health and see what it sticks at.
[ENABLE]
aobscanmodule(readmaxhealth,GameAssembly.dll,F3 0F 10 40 58 0F 57) // should be unique
alloc(newmem,$1000,readmaxhealth)
label(code)
label(return)
globalalloc(_playerstats,8) //8 bytes in case of a 64-bit address.
newmem:
push rbx //Push a register to the stack to free it for use.
mov rbx,_playerstats //Copy our allocated address into it.
mov [rbx],rax //Copy our desired value into where rbx is pointing.
pop rbx //Restore the value of rbx and pretend nothing happened.
code:
//Original code.
movss xmm0,[rax+58]
jmp return
readmaxhealth:
jmp newmem
return:
registersymbol(readmaxhealth)
[DISABLE]
readmaxhealth:
db F3 0F 10 40 58
unregistersymbol(readmaxhealth)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 7FF9E071914D
7FF9E071912E: CC - int 3
7FF9E071912F: CC - int 3
7FF9E0719130: 48 83 EC 28 - sub rsp,28
7FF9E0719134: 48 8B 51 20 - mov rdx,[rcx+20]
7FF9E0719138: 4C 8B 49 18 - mov r9,[rcx+18]
7FF9E071913C: 48 85 D2 - test rdx,rdx
7FF9E071913F: 74 3B - je 7FF9E071917C
7FF9E0719141: 48 8B 82 48 01 00 00 - mov rax,[rdx+00000148]
7FF9E0719148: 48 85 C0 - test rax,rax
7FF9E071914B: 74 2F - je 7FF9E071917C
// ---------- INJECTING HERE ----------
7FF9E071914D: F3 0F 10 40 58 - movss xmm0,[rax+58]
// ---------- DONE INJECTING ----------
7FF9E0719152: 0F 57 C9 - xorps xmm1,xmm1
7FF9E0719155: 0F 2E C1 - ucomiss xmm0,xmm1
7FF9E0719158: 7A 02 - jp 7FF9E071915C
7FF9E071915A: 74 0C - je 7FF9E0719168
7FF9E071915C: E9 9F 6E 4F 01 - jmp 7FF9E1C10000
7FF9E0719161: 0F 1F 00 - nop dword ptr [rax]
7FF9E0719164: F3 0F 5E C8 - divss xmm1,xmm0
7FF9E0719168: 4D 85 C9 - test r9,r9
7FF9E071916B: 74 0F - je 7FF9E071917C
7FF9E071916D: 45 33 C0 - xor r8d,r8d
}
29
"Ordered as in-game, not by address for once."
008000
1
22
"Base"
0
808080
Binary
0
1
0
[_playerstats]
32
"-----"
1
25
"Max Health"
0
Float
[_playerstats]+58
27
"Recovery"
0
000080
Float
[_playerstats]+40
28
"Armor"
0
Float
[_playerstats]+38
26
"Move Speed"
0
808080
Float
[_playerstats]+1C
30
"-----"
1
31
"Might"
0
008000
Float
[_playerstats]+10
33
"Speed"
0
004080
Float
[_playerstats]+18
34
"Duration"
0
008080
Float
[_playerstats]+28
35
"Area"
0
408080
Float
[_playerstats]+14
36
"-----"
1
37
"Cooldown (1-stat=)"
0
404080
Float
[_playerstats]+2C
38
"Amount"
0
800000
Float
[_playerstats]+30
43
"Revival"
0
404080
Float
[_playerstats]+4C
40
"-----"
1
44
"Luck"
0
408000
Float
[_playerstats]+24
45
"Growth"
0
008080
Float
[_playerstats]+20
46
"Greed"
0
408080
Float
[_playerstats]+3C
47
"Curse"
0
400040
Float
[_playerstats]+60
48
"-----"
1
49
"Reroll"
0
Float
[_playerstats]+50
50
"Skip"
0
Float
[_playerstats]+54
51
"Banish"
0
Float
[_playerstats]+64
53
"-----"
1
65
"Find Timer"
Auto Assembler Script
//The in-game timer is a float that matches what the game shows you.
[ENABLE]
aobscanmodule(readtimer,GameAssembly.dll,F3 0F 10 B0 30 02 00 00 48) // should be unique
alloc(newmem,$1000,readtimer)
label(code)
label(return)
globalalloc(_gameplaybase,8) //8 bytes for a 64-bit address.
newmem:
push rbx //Push a register to the stack to free it for use.
mov rbx,_gameplaybase //Copy our allocated address into it.
mov [rbx],rax //Copy our desired value into where rbx is pointing.
pop rbx //Restore the value of rbx and pretend nothing happened.
code:
movss xmm6,[rax+00000230]
jmp return
readtimer:
jmp newmem
nop 3
return:
registersymbol(readtimer)
[DISABLE]
readtimer:
db F3 0F 10 B0 30 02 00 00
unregistersymbol(readtimer)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 7FF9D479E2E2
7FF9D479E2A5: C6 05 B0 01 2F 01 01 - mov byte ptr [7FF9D5A8E45C],01
7FF9D479E2AC: 48 8B 05 DD CD 08 01 - mov rax,[7FF9D582B090]
7FF9D479E2B3: 48 89 9C 24 90 00 00 00 - mov [rsp+00000090],rbx
7FF9D479E2BB: 48 89 B4 24 98 00 00 00 - mov [rsp+00000098],rsi
7FF9D479E2C3: 0F 29 74 24 70 - movaps [rsp+70],xmm6
7FF9D479E2C8: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
7FF9D479E2CF: 48 8B 01 - mov rax,[rcx]
7FF9D479E2D2: 48 85 C0 - test rax,rax
7FF9D479E2D5: 0F 84 BD 01 00 00 - je 7FF9D479E498
7FF9D479E2DB: 48 8B 8F 90 00 00 00 - mov rcx,[rdi+00000090]
// ---------- INJECTING HERE ----------
7FF9D479E2E2: F3 0F 10 B0 30 02 00 00 - movss xmm6,[rax+00000230]
// ---------- DONE INJECTING ----------
7FF9D479E2EA: 48 85 C9 - test rcx,rcx
7FF9D479E2ED: 0F 84 A5 01 00 00 - je 7FF9D479E498
7FF9D479E2F3: 45 33 C0 - xor r8d,r8d
7FF9D479E2F6: 33 D2 - xor edx,edx
7FF9D479E2F8: E8 B3 F9 98 FE - call 7FF9D312DCB0
7FF9D479E2FD: 48 8B B7 90 00 00 00 - mov rsi,[rdi+00000090]
7FF9D479E304: 0F 28 C6 - movaps xmm0,xmm6
7FF9D479E307: F3 0F 5E 05 69 17 D5 00 - divss xmm0,[7FF9D54EFA78]
7FF9D479E30F: E8 54 40 64 FD - call 7FF9D1DE2368
7FF9D479E314: 48 8B 0D BD CA 06 01 - mov rcx,[7FF9D580ADD8]
}
66
"Seconds"
0
Float
[_gameplaybase]+230
59
"9999 Magnet"
Auto Assembler Script
//Magnet value is a float that mostly matches the sidebar.
//Find what's reading that when upgrading Atteactorb.
//(Same code runs when starting a run too.)
//Override the value it reads.
[ENABLE]
aobscanmodule(readmagnet,GameAssembly.dll,F3 0F 10 43 68 33 C0) // should be unique
alloc(newmem,$1000,readmagnet)
label(code)
label(return)
newmem:
code:
//Override.
mov [rbx+68],(Float)9999
//Original code.
movss xmm0,[rbx+68]
jmp return
readmagnet:
jmp newmem
return:
registersymbol(readmagnet)
[DISABLE]
readmagnet:
db F3 0F 10 43 68
unregistersymbol(readmagnet)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 7FF9D2D90975
7FF9D2D9094E: CC - int 3
7FF9D2D9094F: CC - int 3
7FF9D2D90950: 40 53 - push rbx
7FF9D2D90952: 48 83 EC 30 - sub rsp,30
7FF9D2D90956: 80 3D B4 EF EA 00 00 - cmp byte ptr [7FF9D3C3F911],00
7FF9D2D9095D: 48 8B D9 - mov rbx,rcx
7FF9D2D90960: 75 13 - jne 7FF9D2D90975
7FF9D2D90962: 48 8D 0D C7 A4 C2 00 - lea rcx,[7FF9D39BAE30]
7FF9D2D90969: E8 52 7D 12 FD - call GameAssembly.il2cpp_gc_disable+FC30
7FF9D2D9096E: C6 05 9C EF EA 00 01 - mov byte ptr [7FF9D3C3F911],01
// ---------- INJECTING HERE ----------
7FF9D2D90975: F3 0F 10 43 68 - movss xmm0,[rbx+68]
// ---------- DONE INJECTING ----------
7FF9D2D9097A: 33 C0 - xor eax,eax
7FF9D2D9097C: 0F 57 05 BD 02 91 00 - xorps xmm0,[7FF9D36A0C40]
7FF9D2D90983: 48 8B 4B 20 - mov rcx,[rbx+20]
7FF9D2D90987: 48 89 44 24 50 - mov [rsp+50],rax
7FF9D2D9098C: F3 0F 11 44 24 54 - movss [rsp+54],xmm0
7FF9D2D90992: F3 0F 10 43 68 - movss xmm0,[rbx+68]
7FF9D2D90997: 0F 57 05 A2 02 91 00 - xorps xmm0,[7FF9D36A0C40]
7FF9D2D9099E: 48 89 44 24 40 - mov [rsp+40],rax
7FF9D2D909A3: F3 0F 11 44 24 44 - movss [rsp+44],xmm0
7FF9D2D909A9: C6 44 24 50 01 - mov byte ptr [rsp+50],01
}
61
"-----"
1
"pmain.dll"+7297F
------------------1
"pmain.dll"+72991
------------------2