102
"Static Addresses (yes, I couldn't believe it either)"
1
101
"Credit$"
4 Bytes
NStW_x64.exe+8AAAAC
103
"Stars"
4 Bytes
NStW_x64.exe+8AAAB0
127
"Improvement Points"
4 Bytes
NStW_x64.exe+8AAAB4
118
"Experience - Points - set to 99.999 and get a regular LevelUp :)"
4 Bytes
NStW_x64.exe+8AAACC
130
"Display Value: Current Level"
C0C0C0
4 Bytes
NStW_x64.exe+9021C0
131
"GodMode"
Auto Assembler Script
[ENABLE]
aobscanmodule(godmode,NStW_x64.exe,89 87 30 01 00 00 8B 87 A8) // should be unique
alloc(newmem,$1000,godmode)
label(code)
label(return)
newmem:
cmp dword ptr[rdi+298],1 // is it the player?
jne code // if not, continue
mov eax,[rdi+12C] // if player, load full health
code:
mov [rdi+00000130],eax
jmp return
godmode:
jmp newmem
nop
return:
registersymbol(godmode)
[DISABLE]
godmode:
db 89 87 30 01 00 00
unregistersymbol(godmode)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: NStW_x64.exe.text+1325FD
NStW_x64.exe.text+1325E1: 0B D0 - or edx,eax
NStW_x64.exe.text+1325E3: 44 0B C9 - or r9d,ecx
NStW_x64.exe.text+1325E6: C1 FA 1F - sar edx,1F
NStW_x64.exe.text+1325E9: 41 C1 F9 1F - sar r9d,1F
NStW_x64.exe.text+1325ED: 41 23 D1 - and edx,r9d
NStW_x64.exe.text+1325F0: 44 23 D2 - and r10d,edx
NStW_x64.exe.text+1325F3: 8B C2 - mov eax,edx
NStW_x64.exe.text+1325F5: F7 D0 - not eax
NStW_x64.exe.text+1325F7: 41 23 C0 - and eax,r8d
NStW_x64.exe.text+1325FA: 41 0B C2 - or eax,r10d
// ---------- INJECTING HERE ----------
NStW_x64.exe.text+1325FD: 89 87 30 01 00 00 - mov [rdi+00000130],eax
// ---------- DONE INJECTING ----------
NStW_x64.exe.text+132603: 8B 87 A8 00 00 00 - mov eax,[rdi+000000A8]
NStW_x64.exe.text+132609: C1 E8 16 - shr eax,16
NStW_x64.exe.text+13260C: A8 01 - test al,01
NStW_x64.exe.text+13260E: 74 23 - je NStW_x64.exe.text+132633
NStW_x64.exe.text+132610: 45 84 FF - test r15l,r15l
NStW_x64.exe.text+132613: 74 1E - je NStW_x64.exe.text+132633
NStW_x64.exe.text+132615: E8 66 DA 02 00 - call NStW_x64.exe.text+160080
NStW_x64.exe.text+13261A: 48 8B C8 - mov rcx,rax
NStW_x64.exe.text+13261D: 41 B8 04 00 00 00 - mov r8d,00000004
NStW_x64.exe.text+132623: 48 8B D7 - mov rdx,rdi
}
117
"Quest-Push"
Auto Assembler Script
[ENABLE]
aobscanmodule(questprogress,NStW_x64.exe,F3 0F 11 47 68 E9 54) // should be unique
alloc(newmem,$100,questprogress)
label(code)
label(return)
newmem:
push eax
mov eax,(float)99999
mov [rdi+68],eax
movss xmm0,[rdi+68]
pop eax
code:
movss [rdi+68],xmm0
jmp return
questprogress:
jmp newmem
return:
registersymbol(questprogress)
[DISABLE]
questprogress:
db F3 0F 11 47 68
unregistersymbol(questprogress)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: NStW_x64.exe.text+52CECD
NStW_x64.exe.text+52CEA7: 41 83 EA 68 - sub r10d,68
NStW_x64.exe.text+52CEAB: 0F 84 92 00 00 00 - je NStW_x64.exe.text+52CF43
NStW_x64.exe.text+52CEB1: 41 83 FA 01 - cmp r10d,01
NStW_x64.exe.text+52CEB5: 74 32 - je NStW_x64.exe.text+52CEE9
NStW_x64.exe.text+52CEB7: 48 85 C9 - test rcx,rcx
NStW_x64.exe.text+52CEBA: 0F 84 05 04 00 00 - je NStW_x64.exe.text+52D2C5
NStW_x64.exe.text+52CEC0: 8B 41 20 - mov eax,[rcx+20]
NStW_x64.exe.text+52CEC3: 83 F8 01 - cmp eax,01
NStW_x64.exe.text+52CEC6: 75 0F - jne NStW_x64.exe.text+52CED7
NStW_x64.exe.text+52CEC8: F3 0F 10 41 08 - movss xmm0,[rcx+08]
// ---------- INJECTING HERE ----------
NStW_x64.exe.text+52CECD: F3 0F 11 47 68 - movss [rdi+68],xmm0
// ---------- DONE INJECTING ----------
NStW_x64.exe.text+52CED2: E9 54 07 00 00 - jmp NStW_x64.exe.text+52D62B
NStW_x64.exe.text+52CED7: 83 F8 02 - cmp eax,02
NStW_x64.exe.text+52CEDA: 0F 85 E5 03 00 00 - jne NStW_x64.exe.text+52D2C5
NStW_x64.exe.text+52CEE0: 80 79 08 00 - cmp byte ptr [rcx+08],00
NStW_x64.exe.text+52CEE4: E9 4A 04 00 00 - jmp NStW_x64.exe.text+52D333
NStW_x64.exe.text+52CEE9: 48 85 C9 - test rcx,rcx
NStW_x64.exe.text+52CEEC: 74 24 - je NStW_x64.exe.text+52CF12
NStW_x64.exe.text+52CEEE: 8B 41 20 - mov eax,[rcx+20]
NStW_x64.exe.text+52CEF1: 83 F8 01 - cmp eax,01
NStW_x64.exe.text+52CEF4: 75 07 - jne NStW_x64.exe.text+52CEFD
}
106
"Get Health"
Auto Assembler Script
[ENABLE]
aobscanmodule(reader,NStW_x64.exe,F3 0F 10 81 30 01 00 00 F3 0F 5E C1 44) // should be unique
alloc(newmem,$1000,reader)
label(code)
label(return)
alloc(playerbase,4)
newmem:
mov [playerbase],rcx
code:
movss xmm0,[rcx+00000130]
jmp return
reader:
jmp newmem
nop 3
return:
registersymbol(reader playerbase)
[DISABLE]
reader:
db F3 0F 10 81 30 01 00 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: NStW_x64.exe.text+4F4D2B
NStW_x64.exe.text+4F4CFF: E8 FC CF BF FF - call NStW_x64.exe.text+F1D00
NStW_x64.exe.text+4F4D04: 44 38 BC 06 D0 C0 00 00 - cmp [rsi+rax+0000C0D0],r15l
NStW_x64.exe.text+4F4D0C: 74 4D - je NStW_x64.exe.text+4F4D5B
NStW_x64.exe.text+4F4D0E: 48 8B 4F 18 - mov rcx,[rdi+18]
NStW_x64.exe.text+4F4D12: F3 0F 10 89 2C 01 00 00 - movss xmm1,[rcx+0000012C]
NStW_x64.exe.text+4F4D1A: 41 0F 2E CA - ucomiss xmm1,xmm10
NStW_x64.exe.text+4F4D1E: 7A 02 - jp NStW_x64.exe.text+4F4D22
NStW_x64.exe.text+4F4D20: 74 39 - je NStW_x64.exe.text+4F4D5B
NStW_x64.exe.text+4F4D22: F6 81 A8 00 00 00 01 - test byte ptr [rcx+000000A8],01
NStW_x64.exe.text+4F4D29: 74 12 - je NStW_x64.exe.text+4F4D3D
// ---------- INJECTING HERE ----------
NStW_x64.exe.text+4F4D2B: F3 0F 10 81 30 01 00 00 - movss xmm0,[rcx+00000130]
// ---------- DONE INJECTING ----------
NStW_x64.exe.text+4F4D33: F3 0F 5E C1 - divss xmm0,xmm1
NStW_x64.exe.text+4F4D37: 44 0F 2F D8 - comiss xmm11,xmm0
NStW_x64.exe.text+4F4D3B: 76 1E - jna NStW_x64.exe.text+4F4D5B
NStW_x64.exe.text+4F4D3D: 48 8D 15 5C FE 3F 00 - lea rdx,[NStW_x64.exe+8F5BA0]
NStW_x64.exe.text+4F4D44: E8 37 A4 C3 FF - call NStW_x64.exe.text+12F180
NStW_x64.exe.text+4F4D49: 44 38 B8 52 01 00 00 - cmp [rax+00000152],r15l
NStW_x64.exe.text+4F4D50: 75 09 - jne NStW_x64.exe.text+4F4D5B
NStW_x64.exe.text+4F4D52: 44 39 B8 74 01 00 00 - cmp [rax+00000174],r15d
NStW_x64.exe.text+4F4D59: 74 0D - je NStW_x64.exe.text+4F4D68
NStW_x64.exe.text+4F4D5B: FF C5 - inc ebp
}
107
"Maximum Health"
0
Float
playerbase
12c
132
"Current Health"
0
0000FF
Float
playerbase
130
111
"Get Mana"
Auto Assembler Script
[ENABLE]
aobscanmodule(manareader,NStW_x64.exe,F3 0F 10 84 81 D4 00 00 00 C3) // should be unique
alloc(newmem,$1000,manareader)
label(code)
label(return)
alloc(manaaddress,8)
newmem:
push rbx
lea rbx,[rcx+rax*4]
mov [manaaddress],rbx
pop rbx
code:
movss xmm0,[rcx+rax*4+000000D4]
jmp return
manareader:
jmp newmem
nop 4
return:
registersymbol(manareader manaaddress)
[DISABLE]
manareader:
db F3 0F 10 84 81 D4 00 00 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: NStW_x64.exe.text+4F03FE
NStW_x64.exe.text+4F03DF: 4C 8B 99 B0 00 00 00 - mov r11,[rcx+000000B0]
NStW_x64.exe.text+4F03E6: 4B 8B 0C CB - mov rcx,[r11+r9*8]
NStW_x64.exe.text+4F03EA: 39 51 2C - cmp [rcx+2C],edx
NStW_x64.exe.text+4F03ED: 74 0C - je NStW_x64.exe.text+4F03FB
NStW_x64.exe.text+4F03EF: 41 FF C1 - inc r9d
NStW_x64.exe.text+4F03F2: 45 3B CA - cmp r9d,r10d
NStW_x64.exe.text+4F03F5: 72 EF - jb NStW_x64.exe.text+4F03E6
NStW_x64.exe.text+4F03F7: 0F 57 C0 - xorps xmm0,xmm0
NStW_x64.exe.text+4F03FA: C3 - ret
NStW_x64.exe.text+4F03FB: 49 63 C0 - movsxd rax,r8d
// ---------- INJECTING HERE ----------
NStW_x64.exe.text+4F03FE: F3 0F 10 84 81 D4 00 00 00 - movss xmm0,[rcx+rax*4+000000D4]
// ---------- DONE INJECTING ----------
NStW_x64.exe.text+4F0407: C3 - ret
NStW_x64.exe.text+4F0408: CC - int 3
NStW_x64.exe.text+4F0409: CC - int 3
NStW_x64.exe.text+4F040A: CC - int 3
NStW_x64.exe.text+4F040B: CC - int 3
NStW_x64.exe.text+4F040C: CC - int 3
NStW_x64.exe.text+4F040D: CC - int 3
NStW_x64.exe.text+4F040E: CC - int 3
NStW_x64.exe.text+4F040F: CC - int 3
NStW_x64.exe.text+4F0410: 44 8B 91 B8 00 00 00 - mov r10d,[rcx+000000B8]
}
112
"Current Mana"
0
FF0000
Float
manaaddress
d4
140
"Maximum Mana"
0
Float
manaaddress
e4
138
"Get Form Points (Logic is strange, try setting to 10)"
Auto Assembler Script
[ENABLE]
aobscanmodule(formpointer,NStW_x64.exe,60 8B 41 20 83 F8 01 75 07 F3 0F 10 41 08) // should be unique
alloc(newmem,$1000,formpointer)
label(code)
label(return)
alloc(forms,8)
newmem:
mov [forms],rcx
code:
movss xmm0,[rcx+08]
jmp return
formpointer+09:
jmp newmem
return:
registersymbol(formpointer forms)
[DISABLE]
formpointer+09:
db F3 0F 10 41 08
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: NStW_x64.exe.text+5386A6
NStW_x64.exe.text+538683: 48 8D 8C 24 48 01 00 00 - lea rcx,[rsp+00000148]
NStW_x64.exe.text+53868B: E8 30 25 FC FF - call NStW_x64.exe.text+4FABC0
NStW_x64.exe.text+538690: 48 8B 08 - mov rcx,[rax]
NStW_x64.exe.text+538693: 48 85 C9 - test rcx,rcx
NStW_x64.exe.text+538696: 74 66 - je NStW_x64.exe.text+5386FE
NStW_x64.exe.text+538698: F6 41 24 01 - test byte ptr [rcx+24],01
NStW_x64.exe.text+53869C: 74 60 - je NStW_x64.exe.text+5386FE
NStW_x64.exe.text+53869E: 8B 41 20 - mov eax,[rcx+20]
NStW_x64.exe.text+5386A1: 83 F8 01 - cmp eax,01
NStW_x64.exe.text+5386A4: 75 07 - jne NStW_x64.exe.text+5386AD
// ---------- INJECTING HERE ----------
NStW_x64.exe.text+5386A6: F3 0F 10 41 08 - movss xmm0,[rcx+08]
// ---------- DONE INJECTING ----------
NStW_x64.exe.text+5386AB: EB 18 - jmp NStW_x64.exe.text+5386C5
NStW_x64.exe.text+5386AD: 83 F8 02 - cmp eax,02
NStW_x64.exe.text+5386B0: 75 10 - jne NStW_x64.exe.text+5386C2
NStW_x64.exe.text+5386B2: 80 79 08 00 - cmp byte ptr [rcx+08],00
NStW_x64.exe.text+5386B6: 74 0A - je NStW_x64.exe.text+5386C2
NStW_x64.exe.text+5386B8: F3 0F 10 05 D4 65 23 00 - movss xmm0,[NStW_x64.exe.rdata+5C94]
NStW_x64.exe.text+5386C0: EB 03 - jmp NStW_x64.exe.text+5386C5
NStW_x64.exe.text+5386C2: 0F 57 C0 - xorps xmm0,xmm0
NStW_x64.exe.text+5386C5: BA 06 00 00 00 - mov edx,00000006
NStW_x64.exe.text+5386CA: 48 8D 87 B0 03 00 00 - lea rax,[rdi+000003B0]
}
139
"Form Points"
0
Float
forms
8
game_platform
7FF62D0C0000
game_version
7FF62D0C0080
gearPointer
8B00000478B68D4D
Temp
2D7B7C70000