115509
"Auto-Attach to the Game + show scripts"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if(getCEVersion() < 7.4) then
ShowMessage('Warning! CE version should be 7.4 or above')
end
OpenProcess("KA_KT.exe")
if(process == nil) then
ShowMessage('The process KA_KT.exe is NOT found!')
end
{$asm}
[DISABLE]
115512
"Only when in Camelot"
1
115505
"Get Addresses for Gold, Building Ressources, Relic Dust - press "C" to update"
Auto Assembler Script
[ENABLE]
aobscanmodule(getgold,KA_KT.exe,8B B3 98 04 00 00 48 8B) // should be unique
alloc(newmem,$1000,getgold)
label(code)
label(return)
alloc(gold,8)
newmem:
mov [gold],rbx
code:
mov esi,[rbx+00000498]
jmp return
getgold:
jmp newmem
nop
return:
registersymbol(getgold gold)
[DISABLE]
getgold:
db 8B B3 98 04 00 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: KA_KT.exe.text+A4130A
KA_KT.exe.text+A412EB: 48 8B D8 - mov rbx,rax
KA_KT.exe.text+A412EE: 48 85 C0 - test rax,rax
KA_KT.exe.text+A412F1: 74 14 - je KA_KT.exe.text+A41307
KA_KT.exe.text+A412F3: E8 E8 3D CF FF - call KA_KT.exe.text+7350E0
KA_KT.exe.text+A412F8: 48 8B D0 - mov rdx,rax
KA_KT.exe.text+A412FB: 48 8B CB - mov rcx,rbx
KA_KT.exe.text+A412FE: E8 3D 38 64 00 - call KA_KT.exe.text+1084B40
KA_KT.exe.text+A41303: 84 C0 - test al,al
KA_KT.exe.text+A41305: 75 03 - jne KA_KT.exe.text+A4130A
KA_KT.exe.text+A41307: 48 8B DE - mov rbx,rsi
// ---------- INJECTING HERE ----------
KA_KT.exe.text+A4130A: 8B B3 98 04 00 00 - mov esi,[rbx+00000498]
// ---------- DONE INJECTING ----------
KA_KT.exe.text+A41310: 48 8B BF F8 06 00 00 - mov rdi,[rdi+000006F8]
KA_KT.exe.text+A41317: 48 8B 07 - mov rax,[rdi]
KA_KT.exe.text+A4131A: 48 8B 98 58 01 00 00 - mov rbx,[rax+00000158]
KA_KT.exe.text+A41321: 8B D6 - mov edx,esi
KA_KT.exe.text+A41323: 48 8D 4C 24 20 - lea rcx,[rsp+20]
KA_KT.exe.text+A41328: E8 43 E9 1B 00 - call KA_KT.exe.text+BFFC70
KA_KT.exe.text+A4132D: 90 - nop
KA_KT.exe.text+A4132E: 45 33 C0 - xor r8d,r8d
KA_KT.exe.text+A41331: 48 8B D0 - mov rdx,rax
KA_KT.exe.text+A41334: 48 8B CF - mov rcx,rdi
}
115506
"Gold"
0
4 Bytes
gold
498
115507
"Building Ressources"
0
4 Bytes
gold
49C
115508
"Relic Dust"
0
4 Bytes
gold
4A0
115510
"don't spend ressource, set to 9999 instead"
1
115503
"Gold"
Auto Assembler Script
[ENABLE]
aobscanmodule(money,KA_KT.exe,44 03 C2 41 0F 49 C0) // should be unique
alloc(newmem,$1000,money)
label(code)
label(return)
newmem:
mov r8d, #9999
code:
//add r8d,edx
cmovns eax,r8d
jmp return
money:
jmp newmem
nop 2
return:
registersymbol(money)
[DISABLE]
money:
db 44 03 C2 41 0F 49 C0
unregistersymbol(money)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: KA_KT.exe.text+735C3D
KA_KT.exe.text+735C1E: CC - int 3
KA_KT.exe.text+735C1F: CC - int 3
KA_KT.exe.text+735C20: 48 89 5C 24 08 - mov [rsp+08],rbx
KA_KT.exe.text+735C25: 48 89 74 24 10 - mov [rsp+10],rsi
KA_KT.exe.text+735C2A: 57 - push rdi
KA_KT.exe.text+735C2B: 48 83 EC 40 - sub rsp,40
KA_KT.exe.text+735C2F: 8B F2 - mov esi,edx
KA_KT.exe.text+735C31: 48 8B F9 - mov rdi,rcx
KA_KT.exe.text+735C34: 44 8B 81 98 04 00 00 - mov r8d,[rcx+00000498]
KA_KT.exe.text+735C3B: 33 C0 - xor eax,eax
// ---------- INJECTING HERE ----------
KA_KT.exe.text+735C3D: 44 03 C2 - add r8d,edx
// ---------- DONE INJECTING ----------
KA_KT.exe.text+735C40: 41 0F 49 C0 - cmovns eax,r8d
KA_KT.exe.text+735C44: 89 81 98 04 00 00 - mov [rcx+00000498],eax
KA_KT.exe.text+735C4A: 85 D2 - test edx,edx
KA_KT.exe.text+735C4C: 7E 34 - jle KA_KT.exe.text+735C82
KA_KT.exe.text+735C4E: 48 8B 99 10 05 00 00 - mov rbx,[rcx+00000510]
KA_KT.exe.text+735C55: 48 8D 15 1C AD 08 01 - lea rdx,[KA_KT.exe.rdata+B2978]
KA_KT.exe.text+735C5C: 48 8D 4C 24 20 - lea rcx,[rsp+20]
KA_KT.exe.text+735C61: E8 8A 66 4C 00 - call KA_KT.exe.text+BFC2F0
KA_KT.exe.text+735C66: 90 - nop
KA_KT.exe.text+735C67: 44 8B C6 - mov r8d,esi
}
115504
"Building Ressources"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT,KA_KT.exe,01 91 9C 04 00 00) // should be unique
alloc(newmem,$1000,INJECT)
label(code)
label(return)
newmem:
mov edx,#9999
mov [rcx+0000049C],edx
mov edx,0
code:
add [rcx+0000049C],edx
jmp return
INJECT:
jmp newmem
nop
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 01 91 9C 04 00 00
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: KA_KT.exe.text+735CE4
KA_KT.exe.text+735CCC: CC - int 3
KA_KT.exe.text+735CCD: CC - int 3
KA_KT.exe.text+735CCE: CC - int 3
KA_KT.exe.text+735CCF: CC - int 3
KA_KT.exe.text+735CD0: 48 89 5C 24 08 - mov [rsp+08],rbx
KA_KT.exe.text+735CD5: 48 89 74 24 10 - mov [rsp+10],rsi
KA_KT.exe.text+735CDA: 57 - push rdi
KA_KT.exe.text+735CDB: 48 83 EC 40 - sub rsp,40
KA_KT.exe.text+735CDF: 8B F2 - mov esi,edx
KA_KT.exe.text+735CE1: 48 8B F9 - mov rdi,rcx
// ---------- INJECTING HERE ----------
KA_KT.exe.text+735CE4: 01 91 9C 04 00 00 - add [rcx+0000049C],edx
// ---------- DONE INJECTING ----------
KA_KT.exe.text+735CEA: 85 D2 - test edx,edx
KA_KT.exe.text+735CEC: 7E 34 - jle KA_KT.exe.text+735D22
KA_KT.exe.text+735CEE: 48 8B 99 10 05 00 00 - mov rbx,[rcx+00000510]
KA_KT.exe.text+735CF5: 48 8D 15 94 AC 08 01 - lea rdx,[KA_KT.exe.rdata+B2990]
KA_KT.exe.text+735CFC: 48 8D 4C 24 20 - lea rcx,[rsp+20]
KA_KT.exe.text+735D01: E8 EA 65 4C 00 - call KA_KT.exe.text+BFC2F0
KA_KT.exe.text+735D06: 90 - nop
KA_KT.exe.text+735D07: 44 8B C6 - mov r8d,esi
KA_KT.exe.text+735D0A: 48 8D 54 24 20 - lea rdx,[rsp+20]
KA_KT.exe.text+735D0F: 48 8B CB - mov rcx,rbx
}
115511
"Relict Dust"
Auto Assembler Script
[ENABLE]
aobscanmodule(dust,KA_KT.exe,89 81 A0 04 00 00) // should be unique
alloc(newmem,$1000,dust)
label(code)
label(return)
newmem:
mov eax,#9999
code:
mov [rcx+000004A0],eax
jmp return
dust:
jmp newmem
nop
return:
registersymbol(dust)
[DISABLE]
dust:
db 89 81 A0 04 00 00
unregistersymbol(dust)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: KA_KT.exe.text+735D7B
KA_KT.exe.text+735D69: CC - int 3
KA_KT.exe.text+735D6A: CC - int 3
KA_KT.exe.text+735D6B: CC - int 3
KA_KT.exe.text+735D6C: CC - int 3
KA_KT.exe.text+735D6D: CC - int 3
KA_KT.exe.text+735D6E: CC - int 3
KA_KT.exe.text+735D6F: CC - int 3
KA_KT.exe.text+735D70: 33 C0 - xor eax,eax
KA_KT.exe.text+735D72: 03 91 A0 04 00 00 - add edx,[rcx+000004A0]
KA_KT.exe.text+735D78: 0F 49 C2 - cmovns eax,edx
// ---------- INJECTING HERE ----------
KA_KT.exe.text+735D7B: 89 81 A0 04 00 00 - mov [rcx+000004A0],eax
// ---------- DONE INJECTING ----------
KA_KT.exe.text+735D81: 48 81 C1 18 05 00 00 - add rcx,00000518
KA_KT.exe.text+735D88: E9 D3 05 99 FF - jmp KA_KT.exe.text+C6360
KA_KT.exe.text+735D8D: CC - int 3
KA_KT.exe.text+735D8E: CC - int 3
KA_KT.exe.text+735D8F: CC - int 3
KA_KT.exe.text+735D90: CC - int 3
KA_KT.exe.text+735D91: CC - int 3
KA_KT.exe.text+735D92: CC - int 3
KA_KT.exe.text+735D93: CC - int 3
KA_KT.exe.text+735D94: CC - int 3
}
115513
"Only when in Battle"
1
115520
"Godmode and One-Hit-Kill"
Auto Assembler Script
[ENABLE]
aobscanmodule(fightcode,KA_KT.exe,03 BE 78 03 00 00) // should be unique
alloc(newmem,$1000,fightcode)
label(code)
label(return)
label(enemy)
label(godmode_on)
label(twohit_on)
newmem:
cmp [rsi+428],0 // differ between us and them
jne enemy
cmp [rsi+2c0],5 // differ between us and them
jne enemy
cmp byte ptr [godmode_on],1 // is godmode on?
jne enemy // if not check for two-hit-kill
push eax // save RAX
mov eax, [rsi+32c] // load full health
mov [rsi+378],eax // save full health in current health
mov eax, #99
mov [rsi+328],eax // write to life power
pop eax
jmp code
enemy:
cmp byte ptr [twohit_on],1 // is twohit on?
jne code // if not, continue with normal code
mov [rsi+378],0
cmp [rsi+328],1 // if more than 1 HP, set to 1 HP
jle code
mov [rsi+328],1
code:
add edi,[rsi+00000378]
jmp return
godmode_on:
db 0
twohit_on:
db 0
fightcode:
jmp newmem
nop
return:
registersymbol(fightcode godmode_on twohit_on)
[DISABLE]
fightcode:
db 03 BE 78 03 00 00
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: KA_KT.exe.text+69232A
KA_KT.exe.text+6922FF: 57 - push rdi
KA_KT.exe.text+692300: 48 83 EC 20 - sub rsp,20
KA_KT.exe.text+692304: 48 8B F1 - mov rsi,rcx
KA_KT.exe.text+692307: 48 8B 89 08 01 00 00 - mov rcx,[rcx+00000108]
KA_KT.exe.text+69230E: E8 AD 70 2D 00 - call KA_KT.exe.text+9693C0
KA_KT.exe.text+692313: 48 8D 8E 78 03 00 00 - lea rcx,[rsi+00000378]
KA_KT.exe.text+69231A: 8B E8 - mov ebp,eax
KA_KT.exe.text+69231C: E8 EF 3C C2 FF - call KA_KT.exe.text+2B6010
KA_KT.exe.text+692321: 8B F8 - mov edi,eax
KA_KT.exe.text+692323: 48 8D 8E 28 03 00 00 - lea rcx,[rsi+00000328]
// ---------- INJECTING HERE ----------
KA_KT.exe.text+69232A: 03 BE 78 03 00 00 - add edi,[rsi+00000378]
// ---------- DONE INJECTING ----------
KA_KT.exe.text+692330: E8 DB 3C C2 FF - call KA_KT.exe.text+2B6010
KA_KT.exe.text+692335: 03 86 28 03 00 00 - add eax,[rsi+00000328]
KA_KT.exe.text+69233B: 48 8B 5C 24 30 - mov rbx,[rsp+30]
KA_KT.exe.text+692340: 03 C7 - add eax,edi
KA_KT.exe.text+692342: 48 8B 74 24 40 - mov rsi,[rsp+40]
KA_KT.exe.text+692347: 3B E8 - cmp ebp,eax
KA_KT.exe.text+692349: 48 8B 6C 24 38 - mov rbp,[rsp+38]
KA_KT.exe.text+69234E: 0F 9F C0 - setg al
KA_KT.exe.text+692351: 48 83 C4 20 - add rsp,20
KA_KT.exe.text+692355: 5F - pop rdi
}
115521
"GodMode"
Auto Assembler Script
[ENABLE]
godmode_on:
db 1
[DISABLE]
godmode_on:
db 0
115522
"Two-Hit-Kills"
Auto Assembler Script
[ENABLE]
twohit_on:
db 1
[DISABLE]
twohit_on:
db 0
257094
"F1: unlimited action points"
Auto Assembler Script
[ENABLE]
aobscanmodule(moves,KA_KT.exe,F3 41 0F 10 4A 20 83) // should be unique
alloc(newmem,$1000,moves)
label(code)
label(return)
newmem:
cmp rbx,1
je code
push rbx
mov ebx,(float)10
mov [r10+20],ebx
pop rbx
code:
movss xmm1,[r10+20]
jmp return
moves:
jmp newmem
nop
return:
registersymbol(moves)
[DISABLE]
moves:
db F3 41 0F 10 4A 20
unregistersymbol(moves)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: KA_KT.exe.text+6A98EF
KA_KT.exe.text+6A98D0: 48 8B 00 - mov rax,[rax]
KA_KT.exe.text+6A98D3: 80 78 19 00 - cmp byte ptr [rax+19],00
KA_KT.exe.text+6A98D7: 74 E8 - je KA_KT.exe.text+6A98C1
KA_KT.exe.text+6A98D9: 41 80 7A 19 00 - cmp byte ptr [r10+19],00
KA_KT.exe.text+6A98DE: 75 07 - jne KA_KT.exe.text+6A98E7
KA_KT.exe.text+6A98E0: 41 83 7A 1C 00 - cmp dword ptr [r10+1C],00
KA_KT.exe.text+6A98E5: 7E 03 - jle KA_KT.exe.text+6A98EA
KA_KT.exe.text+6A98E7: 4D 8B D1 - mov r10,r9
KA_KT.exe.text+6A98EA: 4D 3B D1 - cmp r10,r9
KA_KT.exe.text+6A98ED: 74 06 - je KA_KT.exe.text+6A98F5
// ---------- INJECTING HERE ----------
KA_KT.exe.text+6A98EF: F3 41 0F 10 4A 20 - movss xmm1,[r10+20]
// ---------- DONE INJECTING ----------
KA_KT.exe.text+6A98F5: 83 EA 01 - sub edx,01
KA_KT.exe.text+6A98F8: 0F 84 8E 00 00 00 - je KA_KT.exe.text+6A998C
KA_KT.exe.text+6A98FE: 83 EA 01 - sub edx,01
KA_KT.exe.text+6A9901: 74 62 - je KA_KT.exe.text+6A9965
KA_KT.exe.text+6A9903: 83 EA 01 - sub edx,01
KA_KT.exe.text+6A9906: 74 16 - je KA_KT.exe.text+6A991E
KA_KT.exe.text+6A9908: 83 FA 01 - cmp edx,01
KA_KT.exe.text+6A990B: 0F 85 BD 00 00 00 - jne KA_KT.exe.text+6A99CE
KA_KT.exe.text+6A9911: F3 0F 10 89 80 03 00 00 - movss xmm1,[rcx+00000380]
KA_KT.exe.text+6A9919: E9 B0 00 00 00 - jmp KA_KT.exe.text+6A99CE
}
Toggle Activation
112
0
Activate
Deactivate
257098
"Get Morality+Christ-Level"
Auto Assembler Script
[ENABLE]
aobscanmodule(read_christ,KA_KT.exe,44 8B B0 A8 04 00 00) // should be unique
alloc(newmem,$1000,read_christ)
label(code)
label(return)
alloc(christ,8)
newmem:
mov [christ],rax
code:
mov r14d,[rax+000004A8]
jmp return
read_christ:
jmp newmem
nop 2
return:
registersymbol(read_christ christ)
[DISABLE]
read_christ:
db 44 8B B0 A8 04 00 00
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: KA_KT.exe.text+A21CBA
KA_KT.exe.text+A21C84: 48 81 EC E0 01 00 00 - sub rsp,000001E0
KA_KT.exe.text+A21C8B: 0F 29 70 B8 - movaps [rax-48],xmm6
KA_KT.exe.text+A21C8F: 0F 29 78 A8 - movaps [rax-58],xmm7
KA_KT.exe.text+A21C93: 4C 8B E9 - mov r13,rcx
KA_KT.exe.text+A21C96: F2 0F 10 81 C8 07 00 00 - movsd xmm0,[rcx+000007C8]
KA_KT.exe.text+A21C9E: F2 0F 11 85 20 01 00 00 - movsd [rbp+00000120],xmm0
KA_KT.exe.text+A21CA6: E8 F5 0A FF FF - call KA_KT.exe.text+A127A0
KA_KT.exe.text+A21CAB: 44 8B B8 A4 04 00 00 - mov r15d,[rax+000004A4]
KA_KT.exe.text+A21CB2: 49 8B CD - mov rcx,r13
KA_KT.exe.text+A21CB5: E8 E6 0A FF FF - call KA_KT.exe.text+A127A0
// ---------- INJECTING HERE ----------
KA_KT.exe.text+A21CBA: 44 8B B0 A8 04 00 00 - mov r14d,[rax+000004A8]
// ---------- DONE INJECTING ----------
KA_KT.exe.text+A21CC1: F3 41 0F 10 85 D0 07 00 00 - movss xmm0,[r13+000007D0]
KA_KT.exe.text+A21CCA: 66 41 0F 6E FE - movd xmm7,r14d
KA_KT.exe.text+A21CCF: 0F 5B FF - cvtdq2ps xmm7,xmm7
KA_KT.exe.text+A21CD2: F3 0F 59 F8 - mulss xmm7,xmm0
KA_KT.exe.text+A21CD6: 66 41 0F 6E F7 - movd xmm6,r15d
KA_KT.exe.text+A21CDB: 0F 5B F6 - cvtdq2ps xmm6,xmm6
KA_KT.exe.text+A21CDE: F3 0F 59 F0 - mulss xmm6,xmm0
KA_KT.exe.text+A21CE2: F3 0F 10 85 20 01 00 00 - movss xmm0,[rbp+00000120]
KA_KT.exe.text+A21CEA: F3 0F 58 C7 - addss xmm0,xmm7
KA_KT.exe.text+A21CEE: F3 0F 11 85 20 01 00 00 - movss [rbp+00000120],xmm0
}
257099
"DataBlock"
0
1
christ
0
257100
"Morality"
0
4 Bytes
+4a4
257102
"Christ-Level"
0
4 Bytes
+4a8
257101
"Morality - Mirror"
0
C0C0C0
4 Bytes
+4ac
257105
"increase Zoom-Out"
Auto Assembler Script
[ENABLE]
aobscanmodule(zoom,KA_KT.exe,F3 0F 10 9B C8 01 00 00) // should be unique
alloc(newmem,$1000,zoom)
label(code)
label(return)
label(value)
newmem:
code:
movss xmm3,[value]
jmp return
value:
dd (float)2.0
zoom:
jmp newmem
nop 3
return:
registersymbol(zoom)
[DISABLE]
zoom:
db F3 0F 10 9B C8 01 00 00
unregistersymbol(zoom)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: KA_KT.exe+1207644
KA_KT.exe+1207602: F3 0F 5D 83 04 02 00 00 - minss xmm0,[rbx+00000204]
KA_KT.exe+120760A: F3 0F 11 83 DC 01 00 00 - movss [rbx+000001DC],xmm0
KA_KT.exe+1207612: F3 0F 10 8B 00 02 00 00 - movss xmm1,[rbx+00000200]
KA_KT.exe+120761A: F3 0F 5F 8B E0 01 00 00 - maxss xmm1,[rbx+000001E0]
KA_KT.exe+1207622: F3 0F 5D 8B 08 02 00 00 - minss xmm1,[rbx+00000208]
KA_KT.exe+120762A: F3 0F 11 8B E0 01 00 00 - movss [rbx+000001E0],xmm1
KA_KT.exe+1207632: F3 0F 10 83 C0 01 00 00 - movss xmm0,[rbx+000001C0]
KA_KT.exe+120763A: 0F 5A C0 - cvtps2pd xmm0,xmm0
KA_KT.exe+120763D: 0F 57 F6 - xorps xmm6,xmm6
KA_KT.exe+1207640: F3 0F 5A F7 - cvtss2sd xmm6,xmm7
// ---------- INJECTING HERE ----------
KA_KT.exe+1207644: F3 0F 10 9B C8 01 00 00 - movss xmm3,[rbx+000001C8]
// ---------- DONE INJECTING ----------
KA_KT.exe+120764C: 41 0F 2F D8 - comiss xmm3,xmm8
KA_KT.exe+1207650: 76 06 - jna KA_KT.exe+1207658
KA_KT.exe+1207652: F3 0F 59 DB - mulss xmm3,xmm3
KA_KT.exe+1207656: EB 03 - jmp KA_KT.exe+120765B
KA_KT.exe+1207658: 0F 57 DB - xorps xmm3,xmm3
KA_KT.exe+120765B: F2 0F 11 44 24 30 - movsd [rsp+30],xmm0
KA_KT.exe+1207661: F2 0F 11 74 24 28 - movsd [rsp+28],xmm6
KA_KT.exe+1207667: F3 44 0F 11 44 24 20 - movss [rsp+20],xmm8
KA_KT.exe+120766E: F3 0F 10 93 C4 01 00 00 - movss xmm2,[rbx+000001C4]
KA_KT.exe+1207676: 48 8D 93 C4 01 00 00 - lea rdx,[rbx+000001C4]
}