11
"Activate Mono"
Auto Assembler Script
[ENABLE]
{$lua}
LaunchMonoDataCollector()
{$asm}
[DISABLE]
10
"Time is frozen at 11:06"
Auto Assembler Script
define(address,StateScoreAttackPlaying:PreUpdatePlaying+27)
define(bytes,48 63 40 10 85 C0)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,StateScoreAttackPlaying:PreUpdatePlaying+27)
label(code)
label(return)
newmem:
push rbx
mov rbx,#40000
mov [rax+10],rbx
pop rbx
code:
movsxd rax,dword ptr [rax+10]
test eax,eax
jmp return
address:
jmp newmem
nop
return:
[DISABLE]
address:
db bytes
// movsxd rax,dword ptr [rax+10]
// test eax,eax
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: StateScoreAttackPlaying:PreUpdatePlaying+27
StateScoreAttackPlaying:PreUpdatePlaying+8: 41 56 - push r14
StateScoreAttackPlaying:PreUpdatePlaying+a: 41 57 - push r15
StateScoreAttackPlaying:PreUpdatePlaying+c: 48 83 EC 08 - sub rsp,08
StateScoreAttackPlaying:PreUpdatePlaying+10: 48 8B F1 - mov rsi,rcx
StateScoreAttackPlaying:PreUpdatePlaying+13: 48 8B 46 30 - mov rax,[rsi+30]
StateScoreAttackPlaying:PreUpdatePlaying+17: 48 8B C8 - mov rcx,rax
StateScoreAttackPlaying:PreUpdatePlaying+1a: 83 39 00 - cmp dword ptr [rcx],00
StateScoreAttackPlaying:PreUpdatePlaying+1d: 48 8B 40 48 - mov rax,[rax+48]
StateScoreAttackPlaying:PreUpdatePlaying+21: 48 8B C8 - mov rcx,rax
StateScoreAttackPlaying:PreUpdatePlaying+24: 83 39 00 - cmp dword ptr [rcx],00
// ---------- INJECTING HERE ----------
StateScoreAttackPlaying:PreUpdatePlaying+27: 48 63 40 10 - movsxd rax,dword ptr [rax+10]
// ---------- DONE INJECTING ----------
StateScoreAttackPlaying:PreUpdatePlaying+2b: 85 C0 - test eax,eax
StateScoreAttackPlaying:PreUpdatePlaying+2d: 0F 85 A4 00 00 00 - jne StateScoreAttackPlaying:PreUpdatePlaying+d7
StateScoreAttackPlaying:PreUpdatePlaying+33: 33 FF - xor edi,edi
StateScoreAttackPlaying:PreUpdatePlaying+35: 48 8B 04 25 50 4D 16 06 - mov rax,[06164D50]
StateScoreAttackPlaying:PreUpdatePlaying+3d: 48 8B C8 - mov rcx,rax
StateScoreAttackPlaying:PreUpdatePlaying+40: 83 39 00 - cmp dword ptr [rcx],00
StateScoreAttackPlaying:PreUpdatePlaying+43: 4C 8B 70 70 - mov r14,[rax+70]
StateScoreAttackPlaying:PreUpdatePlaying+47: 4D 8B EE - mov r13,r14
StateScoreAttackPlaying:PreUpdatePlaying+4a: 4D 85 F6 - test r14,r14
StateScoreAttackPlaying:PreUpdatePlaying+4d: 74 1B - je StateScoreAttackPlaying:PreUpdatePlaying+6a
}
3
"Find Score Address"
Auto Assembler Script
define(address,GamePlayInfo:UpdateRecordUI+200)
define(bytes,48 8B 40 40 C1 E8 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,63323F10)
alloc(base,4)
label(code)
registersymbol(base)
newmem:
mov [base],rax
code:
mov rax,[rax+40]
shr eax,00
jmp return
base:
dd 0
address:
jmp newmem
nop 2
return:
[DISABLE]
address:
db bytes
// mov rax,[rax+40]
// shr eax,00
dealloc(*)
unregistersymbol(base)
{
// ORIGINAL CODE - INJECTION POINT: GamePlayInfo:UpdateRecordUI+200
GamePlayInfo:UpdateRecordUI+1d7: 48 63 80 88 00 00 00 - movsxd rax,dword ptr [rax+00000088]
GamePlayInfo:UpdateRecordUI+1de: 83 3F 00 - cmp dword ptr [rdi],00
GamePlayInfo:UpdateRecordUI+1e1: 89 87 E0 00 00 00 - mov [rdi+000000E0],eax
GamePlayInfo:UpdateRecordUI+1e7: E9 26 01 00 00 - jmp GamePlayInfo:UpdateRecordUI+312
GamePlayInfo:UpdateRecordUI+1ec: 48 8B 46 40 - mov rax,[rsi+40]
GamePlayInfo:UpdateRecordUI+1f0: 48 8B C8 - mov rcx,rax
GamePlayInfo:UpdateRecordUI+1f3: 83 39 00 - cmp dword ptr [rcx],00
GamePlayInfo:UpdateRecordUI+1f6: 48 8B 40 18 - mov rax,[rax+18]
GamePlayInfo:UpdateRecordUI+1fa: 48 8B C8 - mov rcx,rax
GamePlayInfo:UpdateRecordUI+1fd: 83 39 00 - cmp dword ptr [rcx],00
// ---------- INJECTING HERE ----------
GamePlayInfo:UpdateRecordUI+200: 48 8B 40 40 - mov rax,[rax+40]
// ---------- DONE INJECTING ----------
GamePlayInfo:UpdateRecordUI+204: C1 E8 00 - shr eax,00
GamePlayInfo:UpdateRecordUI+207: 83 3F 00 - cmp dword ptr [rdi],00
GamePlayInfo:UpdateRecordUI+20a: 89 87 DC 00 00 00 - mov [rdi+000000DC],eax
GamePlayInfo:UpdateRecordUI+210: 48 8B 46 40 - mov rax,[rsi+40]
GamePlayInfo:UpdateRecordUI+214: 48 8B C8 - mov rcx,rax
GamePlayInfo:UpdateRecordUI+217: 83 39 00 - cmp dword ptr [rcx],00
GamePlayInfo:UpdateRecordUI+21a: 48 8B 40 50 - mov rax,[rax+50]
GamePlayInfo:UpdateRecordUI+21e: 4C 8B F8 - mov r15,rax
GamePlayInfo:UpdateRecordUI+221: 41 C1 EF 00 - shr r15d,00
GamePlayInfo:UpdateRecordUI+225: 83 3F 00 - cmp dword ptr [rdi],00
}
4
"Score"
0
4 Bytes
[base]+40
22
"always 5 Lives"
Auto Assembler Script
define(address,GamePlayInfo:UpdateUI+467)
define(bytes,48 63 8E B0 00 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,GamePlayInfo:UpdateUI+467)
label(code)
label(return)
newmem:
mov rcx,5
mov [rsi+000000B0],rcx
code:
movsxd rcx,dword ptr [rsi+000000B0]
jmp return
address:
jmp newmem
nop 2
return:
[DISABLE]
address:
db bytes
// movsxd rcx,dword ptr [rsi+000000B0]
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GamePlayInfo:UpdateUI+467
GamePlayInfo:UpdateUI+437: 48 83 C4 20 - add rsp,20
GamePlayInfo:UpdateUI+43b: 83 3F 00 - cmp dword ptr [rdi],00
GamePlayInfo:UpdateUI+43e: 40 88 87 1C 01 00 00 - mov [rdi+0000011C],al
GamePlayInfo:UpdateUI+445: 48 8B CE - mov rcx,rsi
GamePlayInfo:UpdateUI+448: 48 83 EC 20 - sub rsp,20
GamePlayInfo:UpdateUI+44c: 49 BB 20 A6 C2 67 00 00 00 00 - mov r11,GamePlayInfo:IsPowerupBlinkBright
GamePlayInfo:UpdateUI+456: 41 FF D3 - call r11
GamePlayInfo:UpdateUI+459: 48 83 C4 20 - add rsp,20
GamePlayInfo:UpdateUI+45d: 83 3F 00 - cmp dword ptr [rdi],00
GamePlayInfo:UpdateUI+460: 40 88 87 1D 01 00 00 - mov [rdi+0000011D],al
// ---------- INJECTING HERE ----------
GamePlayInfo:UpdateUI+467: 48 63 8E B0 00 00 00 - movsxd rcx,dword ptr [rsi+000000B0]
// ---------- DONE INJECTING ----------
GamePlayInfo:UpdateUI+46e: FF C9 - dec ecx
GamePlayInfo:UpdateUI+470: 33 D2 - xor edx,edx
GamePlayInfo:UpdateUI+472: 48 83 EC 20 - sub rsp,20
GamePlayInfo:UpdateUI+476: 49 BB 10 15 BF 67 00 00 00 00 - mov r11,UnityEngine.Mathf:Max
GamePlayInfo:UpdateUI+480: 41 FF D3 - call r11
GamePlayInfo:UpdateUI+483: 48 83 C4 20 - add rsp,20
GamePlayInfo:UpdateUI+487: 83 3F 00 - cmp dword ptr [rdi],00
GamePlayInfo:UpdateUI+48a: 89 87 FC 00 00 00 - mov [rdi+000000FC],eax
GamePlayInfo:UpdateUI+490: 48 63 86 B4 00 00 00 - movsxd rax,dword ptr [rsi+000000B4]
GamePlayInfo:UpdateUI+497: 83 3F 00 - cmp dword ptr [rdi],00
}
Change of jp GameRecords:GetGameProgress+a6
00A54C73
C9
66
0F
2F
C8
0F
8A
2D
00
00
00
0F
87
27
00
00
Change of ja GameRecords:GetGameProgress+a6
00A54C79
90
90
90
90
90
0F
87
27
00
00
00
F3
0F
10
45
E4
Change of jp GameRecords:GetGameProgress+a6
00A54C98
C9
66
0F
2F
C8
7A
0C
77
0A
B8
64
00
Change of ja GameRecords:GetGameProgress+a6
00A54C9A
0F
2F
C8
90
90
77
0A
B8
64
00
00
00