52
"Compact View Mode"
Auto Assembler Script
[ENABLE]
{$lua}
--Make parts of the main form invisible.
controlMainForm = getMainForm()
control_setVisible(wincontrol_getControl(controlMainForm,0), false)
control_setVisible(wincontrol_getControl(controlMainForm,2), false)
control_setVisible(wincontrol_getControl(controlMainForm,3), false)
[DISABLE]
{$lua}
--Make parts of the main form visible.
controlMainForm = getMainForm()
control_setVisible(wincontrol_getControl(controlMainForm,0), true)
control_setVisible(wincontrol_getControl(controlMainForm,2), true)
control_setVisible(wincontrol_getControl(controlMainForm,3), true)
107
"----------"
1
12
"Find Resources"
Auto Assembler Script
//Find some code that reads your hull value when the ship is idle.
//Make sure it's not also reading a second address!
//Hook into it and copy the base address out.
[ENABLE]
aobscanmodule(readhull,FTLGame.exe,8B 80 CC 00 00 00 39) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
globalalloc(_itembase,4) //Allocate some memory for the address.
newmem:
code:
mov [_itembase],eax //Copy the base address into our memory.
mov eax,[eax+000000CC]
jmp return
readhull:
jmp newmem
nop
return:
registersymbol(readhull)
[DISABLE]
readhull:
db 8B 80 CC 00 00 00
unregistersymbol(readhull)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 00AFC2E7
00AFC2B4: 88 85 6C FF FF FF - mov [ebp-00000094],al
00AFC2BA: 0F B6 95 64 FF FF FF - movzx edx,byte ptr [ebp-0000009C]
00AFC2C1: 0F 84 09 06 00 00 - je 00AFC8D0
00AFC2C7: 8B 8D 5C FF FF FF - mov ecx,[ebp-000000A4]
00AFC2CD: E8 BE 2A FD FF - call 00ACED90
00AFC2D2: 8B 8E E4 0D 00 00 - mov ecx,[esi+00000DE4]
00AFC2D8: E8 73 49 F1 FF - call 00A10C50
00AFC2DD: E9 E2 F9 FF FF - jmp 00AFBCC4
00AFC2E2: 8B 06 - mov eax,[esi]
00AFC2E4: 8B 40 08 - mov eax,[eax+08]
// ---------- INJECTING HERE ----------
00AFC2E7: 8B 80 CC 00 00 00 - mov eax,[eax+000000CC]
// ---------- DONE INJECTING ----------
00AFC2ED: 39 86 90 12 00 00 - cmp [esi+00001290],eax
00AFC2F3: 0F 85 B2 FC FF FF - jne 00AFBFAB
00AFC2F9: 8D 4D CC - lea ecx,[ebp-34]
00AFC2FC: C7 04 24 5D 4A D6 00 - mov [esp],00D64A5D
00AFC303: E8 08 60 FF FF - call 00AF2310
00AFC308: 8D 45 CC - lea eax,[ebp-34]
00AFC30B: 83 EC 04 - sub esp,04
00AFC30E: B9 80 37 DF 00 - mov ecx,00DF3780
00AFC313: 89 04 24 - mov [esp],eax
00AFC316: E8 05 AF E1 FF - call 00917220
}
13
"Hull"
0
4 Bytes
[_itembase]+CC
44
"Fuel"
0
4 Bytes
[_itembase]+494
45
"Scrap"
0
4 Bytes
[_itembase]+4D4
53
"Find Drone Parts"
Auto Assembler Script
//Find a line of code that reads just your drone part amount.
//Hook into that to get other data.
[ENABLE]
aobscanmodule(readdrones,FTLGame.exe,8B 80 CC 01 00 00 C3) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
globalalloc(_dronebase,4) //Allocate memory for the address
newmem:
code:
mov [_dronebase],eax
mov eax,[eax+000001CC]
jmp return
readdrones:
jmp newmem
nop
return:
registersymbol(readdrones)
[DISABLE]
readdrones:
db 8B 80 CC 01 00 00
unregistersymbol(readdrones)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 0097F2B6
0097F292: E9 05 FF FF FF - jmp 0097F19C
0097F297: 90 - nop
0097F298: 90 - nop
0097F299: 8D B4 26 00 00 00 00 - lea esi,[esi+00000000]
0097F2A0: 8B 81 C8 04 00 00 - mov eax,[ecx+000004C8]
0097F2A6: 83 78 10 FF - cmp dword ptr [eax+10],-01
0097F2AA: 75 07 - jne 0097F2B3
0097F2AC: 8B 81 00 08 00 00 - mov eax,[ecx+00000800]
0097F2B2: C3 - ret
0097F2B3: 8B 41 4C - mov eax,[ecx+4C]
// ---------- INJECTING HERE ----------
0097F2B6: 8B 80 CC 01 00 00 - mov eax,[eax+000001CC]
// ---------- DONE INJECTING ----------
0097F2BC: C3 - ret
0097F2BD: 90 - nop
0097F2BE: 66 90 - nop 2
0097F2C0: 57 - push edi
0097F2C1: 8D 7C 24 08 - lea edi,[esp+08]
0097F2C5: 83 E4 F0 - and esp,-10
0097F2C8: FF 77 FC - push [edi-04]
0097F2CB: 55 - push ebp
0097F2CC: 89 E5 - mov ebp,esp
0097F2CE: 57 - push edi
}
54
"Drone parts"
0
4 Bytes
[_dronebase]+1CC
79
"Find Reactor Stuff"
Auto Assembler Script
//Find code that reads the number of reactor bars currently used (not free).
[ENABLE]
aobscanmodule(readmainreactor,FTLGame.exe,2B 01 5D C3 8D 74 26 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
globalalloc(_reactorbase,4) //Allocate memory for the address.
newmem:
code:
mov [_reactorbase],ecx //Copy the base address out for our use.
sub eax,[ecx]
pop ebp
ret
lea esi,[esi+00]
jmp return
readmainreactor:
jmp newmem
nop 3
return:
registersymbol(readmainreactor)
[DISABLE]
readmainreactor:
db 2B 01 5D C3 8D 74 26 00
unregistersymbol(readmainreactor)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 00EE7828
00EE7810: 5F - pop edi
00EE7811: 5D - pop ebp
00EE7812: C2 0C 00 - ret 000C
00EE7815: 90 - nop
00EE7816: 8D 76 00 - lea esi,[esi+00]
00EE7819: 8D BC 27 00 00 00 00 - lea edi,[edi+00000000]
00EE7820: 8B 51 04 - mov edx,[ecx+04]
00EE7823: 55 - push ebp
00EE7824: 89 E5 - mov ebp,esp
00EE7826: 89 D0 - mov eax,edx
// ---------- INJECTING HERE ----------
00EE7828: 2B 01 - sub eax,[ecx]
// ---------- DONE INJECTING ----------
00EE782A: 5D - pop ebp
00EE782B: C3 - ret
00EE782C: 8D 74 26 00 - lea esi,[esi+00]
00EE7830: 8B 41 20 - mov eax,[ecx+20]
00EE7833: 03 41 18 - add eax,[ecx+18]
00EE7836: 8B 51 04 - mov edx,[ecx+04]
00EE7839: 29 C2 - sub edx,eax
00EE783B: 89 D0 - mov eax,edx
00EE783D: 8B 51 14 - mov edx,[ecx+14]
00EE7840: 39 D0 - cmp eax,edx
}
80
"Reactor Bars Used"
0
4 Bytes
[_reactorbase]
81
"Reactor Bars Max"
0
4 Bytes
[_reactorbase]+4
49
"Find Weapon Stuff"
Auto Assembler Script
//Find a line of code that reads just your missile count.
//Hook into that to get other data.
[ENABLE]
aobscanmodule(readmissiles,FTLGame.exe,8B 80 E8 01 00 00 C3) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
globalalloc(_ammobase,4) //Allocate memory for the address
newmem:
code:
mov [_ammobase],eax
mov eax,[eax+000001E8]
jmp return
readmissiles:
jmp newmem
nop
return:
registersymbol(readmissiles)
[DISABLE]
readmissiles:
db 8B 80 E8 01 00 00
unregistersymbol(readmissiles)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 0097FAF6
0097FAD5: 5F - pop edi
0097FAD6: C2 04 00 - ret 0004
0097FAD9: 90 - nop
0097FADA: 8D B6 00 00 00 00 - lea esi,[esi+00000000]
0097FAE0: 8B 81 C8 04 00 00 - mov eax,[ecx+000004C8]
0097FAE6: 83 78 0C FF - cmp dword ptr [eax+0C],-01
0097FAEA: 75 07 - jne 0097FAF3
0097FAEC: 8B 81 04 08 00 00 - mov eax,[ecx+00000804]
0097FAF2: C3 - ret
0097FAF3: 8B 41 48 - mov eax,[ecx+48]
// ---------- INJECTING HERE ----------
0097FAF6: 8B 80 E8 01 00 00 - mov eax,[eax+000001E8]
// ---------- DONE INJECTING ----------
0097FAFC: C3 - ret
0097FAFD: 90 - nop
0097FAFE: 66 90 - nop 2
0097FB00: 55 - push ebp
0097FB01: 89 E5 - mov ebp,esp
0097FB03: 57 - push edi
0097FB04: 56 - push esi
0097FB05: 53 - push ebx
0097FB06: 89 CB - mov ebx,ecx
0097FB08: 83 E4 F0 - and esp,-10
}
64
"Weapon Bars (Used)"
0
4 Bytes
[_ammobase]+50
69
"Weapon Bars (Max)"
0
4 Bytes
[_ammobase]+54
65
"Weapon Bars (Undamaged)"
0
4 Bytes
[_ammobase]+100
68
"Weapon Bars (Max Undamaged)"
0
4 Bytes
[_ammobase]+104
89
"Weapon Bar Cooldown?"
0
4 Bytes
[_ammobase]+128
59
"Missiles"
0
4 Bytes
[_ammobase]+1E8
93
"Find Ship System Stuff"
Auto Assembler Script
//Find the number of power bars in a system.
//Find code that subtracts from that value when you do.
//Hook into this to explose a few things I guess.
[ENABLE]
aobscanmodule(subpowerbar,FTLGame.exe,03 43 50 03 83 A4 01 00 00 89) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
globalalloc(_currentsystembase,4) //Allocate memory for the address.
newmem:
code:
mov [_currentsystembase],ebx //Copy the address out.
add eax,[ebx+50]
add eax,[ebx+000001A4]
jmp return
subpowerbar:
jmp newmem
nop 4
return:
registersymbol(subpowerbar)
[DISABLE]
subpowerbar:
db 03 43 50 03 83 A4 01 00 00
unregistersymbol(subpowerbar)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 00EDD7FF
00EDD7E1: 8D 53 50 - lea edx,[ebx+50]
00EDD7E4: 89 14 24 - mov [esp],edx
00EDD7E7: E8 D4 9E 00 00 - call 00EE76C0
00EDD7EC: 83 EC 0C - sub esp,0C
00EDD7EF: 84 C0 - test al,al
00EDD7F1: 74 A4 - je 00EDD797
00EDD7F3: 89 FA - mov edx,edi
00EDD7F5: 84 D2 - test dl,dl
00EDD7F7: 74 A0 - je 00EDD799
00EDD7F9: 8B 83 70 01 00 00 - mov eax,[ebx+00000170]
// ---------- INJECTING HERE ----------
00EDD7FF: 03 43 50 - add eax,[ebx+50]
// ---------- DONE INJECTING ----------
00EDD802: 03 83 A4 01 00 00 - add eax,[ebx+000001A4]
00EDD808: 89 83 6C 01 00 00 - mov [ebx+0000016C],eax
00EDD80E: 89 F8 - mov eax,edi
00EDD810: EB 87 - jmp 00EDD799
00EDD812: 89 F7 - mov edi,esi
00EDD814: C7 04 24 01 00 00 00 - mov [esp],00000001
00EDD81B: FF D0 - call eax
00EDD81D: 83 EC 04 - sub esp,04
00EDD820: 21 C7 - and edi,eax
00EDD822: EB CF - jmp 00EDD7F3
}
95
"Subtract power from a system to show it here."
008000
1
94
"System Name"
0
String
16
0
0
1
[_currentsystembase]+28
96
"Current Bars"
0
4 Bytes
[_currentsystembase]+50
97
"Max Bars"
0
4 Bytes
[_currentsystembase]+54
98
"Fixed Bars"
0
4 Bytes
[_currentsystembase]+100
99
"Undamaged Bars"
0
4 Bytes
[_currentsystembase]+104
100
"Cooldown Steps"
1
4 Bytes
[_currentsystembase]+128
102
"Cooldown Countup"
0
Float
[_currentsystembase]+134
101
"Room Name"
0
String
16
0
0
1
[_currentsystembase]+14C
105
"Zoltan Bonus Bars"
0
4 Bytes
[_currentsystembase]+170
37
"----------"
1
56
"Infinite Reactor Power"
Auto Assembler Script
//Find the variable tracking how many power bars you're using.
//Not how many you have left to use, but the number currently eaten!
//Find the code that adds to that, and nop it.
[ENABLE]
aobscanmodule(addtousedpower,FTLGame.exe,83 01 01 83 C2 01) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
//add dword ptr [ecx],01
add edx,01
jmp return
addtousedpower:
jmp newmem
nop
return:
registersymbol(addtousedpower)
[DISABLE]
addtousedpower:
db 83 01 01 83 C2 01
unregistersymbol(addtousedpower)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 00B277B7
00B2779D: 7F 66 - jg 00B27805
00B2779F: 8B 2C 24 - mov ebp,[esp]
00B277A2: 31 D2 - xor edx,edx
00B277A4: 85 ED - test ebp,ebp
00B277A6: 7E 4E - jle 00B277F6
00B277A8: 8B 2C 24 - mov ebp,[esp]
00B277AB: EB 22 - jmp 00B277CF
00B277AD: 8D 76 00 - lea esi,[esi+00]
00B277B0: 8B 44 24 18 - mov eax,[esp+18]
00B277B4: 83 00 01 - add dword ptr [eax],01
// ---------- INJECTING HERE ----------
00B277B7: 83 01 01 - add dword ptr [ecx],01
// ---------- DONE INJECTING ----------
00B277BA: 83 C2 01 - add edx,01
00B277BD: 39 D5 - cmp ebp,edx
00B277BF: 74 35 - je 00B277F6
00B277C1: 8B 59 20 - mov ebx,[ecx+20]
00B277C4: 03 59 18 - add ebx,[ecx+18]
00B277C7: 8B 39 - mov edi,[ecx]
00B277C9: 8B 41 04 - mov eax,[ecx+04]
00B277CC: 8B 71 14 - mov esi,[ecx+14]
00B277CF: 29 D8 - sub eax,ebx
00B277D1: 39 F0 - cmp eax,esi
}
63
"Weapons Insta-Charge"
Auto Assembler Script
//Find the code that adds to the weapon charge via addss.
//Right above that is a multiplication.
//Make your own multiplier instead.
//This code will affect both the player and enemy.
//Offset +04 in the weapon structure is 0 for players and 1 for enemies.
//So make a comparison off that.
[ENABLE]
aobscanmodule(multiplyweaponcharge,FTLGame.exe,F3 0F 59 C1 F3 0F 58 46 08) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
alloc(_weaponchargemultiplier,4)
newmem:
code:
cmp [esi+04],0 //Check if it's flagged as a player weapon.
jne skip //Skip the buff if it's not.
push eax //Free up a register.
mov eax,_weaponchargemultiplier //Move our allocated address into it.
mov [eax],(float)100 //Move our multiplier into there.
mulss xmm0,[eax] //Use the multiplier.
pop eax //Restore the stack.
skip:
mulss xmm0,xmm1 //Original code resumes with this line.
addss xmm0,[esi+08]
jmp return
multiplyweaponcharge:
jmp newmem
nop 4
return:
registersymbol(multiplyweaponcharge)
[DISABLE]
multiplyweaponcharge:
db F3 0F 59 C1 F3 0F 58 46 08
unregistersymbol(multiplyweaponcharge)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 008EE026
008EDFE9: C6 85 2D FF FF FF 00 - mov byte ptr [ebp-000000D3],00
008EDFF0: E8 FB CE 05 00 - call 0094AEF0
008EDFF5: F3 0F 10 8D B4 FE FF FF - movss xmm1,[ebp-0000014C]
008EDFFD: 8B 85 18 FF FF FF - mov eax,[ebp-000000E8]
008EE003: D9 9D B4 FE FF FF - fstp dword ptr [ebp-0000014C]
008EE009: F3 0F 59 0D 90 68 D5 00 - mulss xmm1,[00D56890]
008EE011: 83 EC 04 - sub esp,04
008EE014: F3 0F 10 85 B4 FE FF FF - movss xmm0,[ebp-0000014C]
008EE01C: 39 D8 - cmp eax,ebx
008EE01E: F3 0F 58 05 7C 68 D5 00 - addss xmm0,[00D5687C]
// ---------- INJECTING HERE ----------
008EE026: F3 0F 59 C1 - mulss xmm0,xmm1
// ---------- DONE INJECTING ----------
008EE02A: F3 0F 58 46 08 - addss xmm0,[esi+08]
008EE02F: F3 0F 11 46 08 - movss [esi+08],xmm0
008EE034: 74 0D - je 008EE043
008EE036: 89 04 24 - mov [esp],eax
008EE039: E8 72 7D 45 00 - call 00D45DB0
008EE03E: F3 0F 10 46 08 - movss xmm0,[esi+08]
008EE043: F3 0F 10 4E 0C - movss xmm1,[esi+0C]
008EE048: F3 0F 5D C1 - minss xmm0,xmm1
008EE04C: 0F 2E C1 - ucomiss xmm0,xmm1
008EE04F: F3 0F 11 46 08 - movss [esi+08],xmm0
}
85
"Weapons Cost 1 Bar"
Auto Assembler Script
//Find the charge time of a weapon.
//Float, 0 when not charged, value is the number of seconds it charges.
//+0xF0 from that is an int, the number of power bars.
//Find the code reading that to tweak it.
[ENABLE]
aobscanmodule(readpowerbars,FTLGame.exe,8B 9E F8 00 00 00 39) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
mov [esi+000000F8],1 //Override we're doing first.
mov ebx,[esi+000000F8]
jmp return
readpowerbars:
jmp newmem
nop
return:
registersymbol(readpowerbars)
[DISABLE]
readpowerbars:
db 8B 9E F8 00 00 00
unregistersymbol(readpowerbars)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 00ED6405
00ED63E1: 89 4D D8 - mov [ebp-28],ecx
00ED63E4: 89 7D D4 - mov [ebp-2C],edi
00ED63E7: 89 F6 - mov esi,esi
00ED63E9: 8D BC 27 00 00 00 00 - lea edi,[edi+00000000]
00ED63F0: 8B 4D E4 - mov ecx,[ebp-1C]
00ED63F3: 8B 7D DC - mov edi,[ebp-24]
00ED63F6: 8D 34 8D 00 00 00 00 - lea esi,[ecx*4+00000000]
00ED63FD: 89 75 D0 - mov [ebp-30],esi
00ED6400: 8B 34 8A - mov esi,[edx+ecx*4]
00ED6403: 89 F9 - mov ecx,edi
// ---------- INJECTING HERE ----------
00ED6405: 8B 9E F8 00 00 00 - mov ebx,[esi+000000F8]
// ---------- DONE INJECTING ----------
00ED640B: 39 DF - cmp edi,ebx
00ED640D: 0F 4F CB - cmovg ecx,ebx
00ED6410: 29 CF - sub edi,ecx
00ED6412: 80 BE F6 00 00 00 00 - cmp byte ptr [esi+000000F6],00
00ED6419: 89 4D E0 - mov [ebp-20],ecx
00ED641C: 89 7D DC - mov [ebp-24],edi
00ED641F: 0F 85 CB 00 00 00 - jne 00ED64F0
00ED6425: 83 E8 01 - sub eax,01
00ED6428: 89 C3 - mov ebx,eax
00ED642A: 0F 88 98 00 00 00 - js 00ED64C8
}
87
"Enemy Systems Always Broken"
Auto Assembler Script
//Same structure that has used (+0x50) and max (+0x54) weapon bars.
//There's a +0x100 there, that's the max undamaged bars.
//If this is lower than the +0x104 max, then the difference is damaged bars.
//Find code reading that undamaged bar count, and make it hurt.
//+C in the structure is a flag, 0 if player and 1 if enemy.
[ENABLE]
aobscanmodule(readsystemdamage,FTLGame.exe,8B 83 00 01 00 00 BA) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
cmp [ebx+C],0 //Check if it's the player's part.
je skip //If so, skip the override.
mov [ebx+00000100],0 //Override to all bars broken.
skip:
mov eax,[ebx+00000100]
jmp return
readsystemdamage:
jmp newmem
nop
return:
registersymbol(readsystemdamage)
[DISABLE]
readsystemdamage:
db 8B 83 00 01 00 00
unregistersymbol(readsystemdamage)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 00EDB121
00EDB0F8: C6 83 11 01 00 00 00 - mov byte ptr [ebx+00000111],00
00EDB0FF: FF 50 78 - call dword ptr [eax+78]
00EDB102: 8B 83 70 01 00 00 - mov eax,[ebx+00000170]
00EDB108: 3B 83 74 01 00 00 - cmp eax,[ebx+00000174]
00EDB10E: 7D 0B - jnl 00EDB11B
00EDB110: 8B 53 40 - mov edx,[ebx+40]
00EDB113: 83 EA 03 - sub edx,03
00EDB116: 83 FA 01 - cmp edx,01
00EDB119: 77 55 - ja 00EDB170
00EDB11B: 89 83 74 01 00 00 - mov [ebx+00000174],eax
// ---------- INJECTING HERE ----------
00EDB121: 8B 83 00 01 00 00 - mov eax,[ebx+00000100]
// ---------- DONE INJECTING ----------
00EDB127: BA 00 00 00 00 - mov edx,00000000
00EDB12C: 39 83 04 01 00 00 - cmp [ebx+00000104],eax
00EDB132: 0F 4E 83 04 01 00 00 - cmovle eax,[ebx+00000104]
00EDB139: 85 C0 - test eax,eax
00EDB13B: 0F 48 C2 - cmovs eax,edx
00EDB13E: 89 83 00 01 00 00 - mov [ebx+00000100],eax
00EDB144: 8D 65 F4 - lea esp,[ebp-0C]
00EDB147: 5B - pop ebx
00EDB148: 5E - pop esi
00EDB149: 5F - pop edi
}
90
"0 Ability Cooldown"
Auto Assembler Script
//Find the cooldown count, a 4-byte integer of steps displayed.
//This is +0x128, same offset as ion stuff.
//Find something that's reading only the player systems.
//Most things read enemy systems as well!
[ENABLE]
aobscanmodule(readcooldown,FTLGame.exe,8B 96 28 01 00 00 85) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
mov [esi+00000128],0 //Override
mov edx,[esi+00000128]
jmp return
readcooldown:
jmp newmem
nop
return:
registersymbol(readcooldown)
[DISABLE]
readcooldown:
db 8B 96 28 01 00 00
unregistersymbol(readcooldown)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 00EDD004
00EDCFD4: E9 1C FE FF FF - jmp 00EDCDF5
00EDCFD9: 8D B4 26 00 00 00 00 - lea esi,[esi+00000000]
00EDCFE0: 80 3D 78 6D 1B 01 00 - cmp byte ptr [011B6D78],00
00EDCFE7: BA B0 AA 1B 01 - mov edx,011BAAB0
00EDCFEC: B8 D0 AA 1B 01 - mov eax,011BAAD0
00EDCFF1: 8B 4D B4 - mov ecx,[ebp-4C]
00EDCFF4: 0F 44 C2 - cmove eax,edx
00EDCFF7: 83 7D BC 01 - cmp dword ptr [ebp-44],01
00EDCFFB: 8B 0C B9 - mov ecx,[ecx+edi*4]
00EDCFFE: 0F 8F B4 00 00 00 - jg 00EDD0B8
// ---------- INJECTING HERE ----------
00EDD004: 8B 96 28 01 00 00 - mov edx,[esi+00000128]
// ---------- DONE INJECTING ----------
00EDD00A: 85 D2 - test edx,edx
00EDD00C: 0F 8F 0B 01 00 00 - jg 00EDD11D
00EDD012: 83 FA FF - cmp edx,-01
00EDD015: 0F 84 02 01 00 00 - je 00EDD11D
00EDD01B: 83 BE A8 01 00 00 01 - cmp dword ptr [esi+000001A8],01
00EDD022: 0F 8E 0B 01 00 00 - jng 00EDD133
00EDD028: F3 0F 10 1D 28 5F 12 01 - movss xmm3,[01125F28]
00EDD030: F3 0F 10 05 98 AA 1B 01 - movss xmm0,[011BAA98]
00EDD038: F3 0F 10 0D 94 AA 1B 01 - movss xmm1,[011BAA94]
00EDD040: F3 0F 5E C3 - divss xmm0,xmm3
}
103
"Instant Ion Recovery"
Auto Assembler Script
//Find the value for counting up to remove the current cooldown number.
//It's a float, ~0 at 12 slices left, and it counts up to 5.
//Find the code that reads that, and then modify it to return 5.
//The same code runs on enemy ship systems though.
//Gotta' do a comparison to only buff player cooldowns.
[ENABLE]
aobscanmodule(readcountup,FTLGame.exe,8B 8A 34 01 00 00 89) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
cmp [edx+C],0 //Check if it's the player's part.
jne skip //If not, skip the override.
mov [edx+00000134],(float)5 //Override to cooldown done.
skip:
mov ecx,[edx+00000134]
jmp return
readcountup:
jmp newmem
nop
return:
registersymbol(readcountup)
[DISABLE]
readcountup:
db 8B 8A 34 01 00 00
unregistersymbol(readcountup)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 00EDBC57
00EDBC36: C3 - ret
00EDBC37: 90 - nop
00EDBC38: 90 - nop
00EDBC39: 8D B4 26 00 00 00 00 - lea esi,[esi+00000000]
00EDBC40: 8B 54 24 04 - mov edx,[esp+04]
00EDBC44: 89 C8 - mov eax,ecx
00EDBC46: 8B 8A 2C 01 00 00 - mov ecx,[edx+0000012C]
00EDBC4C: 89 08 - mov [eax],ecx
00EDBC4E: 8B 8A 30 01 00 00 - mov ecx,[edx+00000130]
00EDBC54: 89 48 04 - mov [eax+04],ecx
// ---------- INJECTING HERE ----------
00EDBC57: 8B 8A 34 01 00 00 - mov ecx,[edx+00000134]
// ---------- DONE INJECTING ----------
00EDBC5D: 89 48 08 - mov [eax+08],ecx
00EDBC60: 8B 8A 38 01 00 00 - mov ecx,[edx+00000138]
00EDBC66: 8B 92 3C 01 00 00 - mov edx,[edx+0000013C]
00EDBC6C: 89 48 0C - mov [eax+0C],ecx
00EDBC6F: 89 50 10 - mov [eax+10],edx
00EDBC72: C2 04 00 - ret 0004
00EDBC75: 90 - nop
00EDBC76: 8D 76 00 - lea esi,[esi+00]
00EDBC79: 8D BC 27 00 00 00 00 - lea edi,[edi+00000000]
00EDBC80: F3 0F 10 44 24 04 - movss xmm0,[esp+04]
}
57
"----------"
1
73
"(Dev) Code Search"
1
74
"These are for dev purposes, these aren't cheats."
008000
1
71
"Find Weapon Charge Code"
Auto Assembler Script
//This is just to find some code for dev purposes.
//This doesn't actually patch anything.
[ENABLE]
aobscanmodule(readweaponcharge,FTLGame.exe,F3 0F 10 42 08 F3 0F 5E 42) // should be unique
registersymbol(readweaponcharge)
[DISABLE]
unregistersymbol(readweaponcharge)
{
// ORIGINAL CODE - INJECTION POINT: 00DA7AAE
00DA7A7D: 89 D9 - mov ecx,ebx
00DA7A7F: 8B 85 18 FF FF FF - mov eax,[ebp-000000E8]
00DA7A85: C7 04 24 00 00 00 00 - mov [esp],00000000
00DA7A8C: 89 54 24 08 - mov [esp+08],edx
00DA7A90: 89 44 24 04 - mov [esp+04],eax
00DA7A94: E8 F7 FA FF FF - call 00DA7590
00DA7A99: 8B 93 BC 01 00 00 - mov edx,[ebx+000001BC]
00DA7A9F: 83 EC 0C - sub esp,0C
00DA7AA2: 8B 8B DC 01 00 00 - mov ecx,[ebx+000001DC]
00DA7AA8: 3B 8B E0 01 00 00 - cmp ecx,[ebx+000001E0]
// ---------- INJECTING HERE ----------
00DA7AAE: F3 0F 10 42 08 - movss xmm0,[edx+08]
// ---------- DONE INJECTING ----------
00DA7AB3: F3 0F 5E 42 0C - divss xmm0,[edx+0C]
00DA7AB8: F3 0F 11 85 64 FD FF FF - movss [ebp-0000029C],xmm0
00DA7AC0: 0F 84 AF 00 00 00 - je 00DA7B75
00DA7AC6: F3 0F 10 05 A4 C1 11 01 - movss xmm0,[0111C1A4]
00DA7ACE: 31 F6 - xor esi,esi
00DA7AD0: F3 0F 11 85 74 FD FF FF - movss [ebp-0000028C],xmm0
00DA7AD8: 90 - nop
00DA7AD9: 8D B4 26 00 00 00 00 - lea esi,[esi+00000000]
00DA7AE0: F3 0F 10 9D 68 FD FF FF - movss xmm3,[ebp-00000298]
00DA7AE8: 8B 04 B1 - mov eax,[ecx+esi*4]
}
72
"movss xmm0,[edx+08]"
1
0
Array of byte
5
readweaponcharge
75
"----------"
1
"pmain.dll"+7297F
------------------1
"pmain.dll"+72991
------------------2