34
"Find XP"
1
35
"Experience Points"
4 Bytes
[xpaddy]+4
37
"Find Gold"
Auto Assembler Script
[ENABLE]
aobscanmodule(gold,RtK.exe,8B 48 50 89 4D E0 83) // should be unique
alloc(newmem,$1000)
globalalloc(goldaddy,4)
label(code)
label(return)
goldaddy:
dw 0
newmem:
mov [goldaddy],eax
code:
mov ecx,[eax+50]
mov [ebp-20],ecx
jmp return
gold:
jmp newmem
nop
return:
registersymbol(gold)
[DISABLE]
gold:
db 8B 48 50 89 4D E0
unregistersymbol(gold)
dealloc(newmem)
dealloc(goldaddy)
{
// ORIGINAL CODE - INJECTION POINT: RtK.exe+141B42
RtK.exe+141B1B: 89 4D F0 - mov [ebp-10],ecx
RtK.exe+141B1E: 8B 55 E4 - mov edx,[ebp-1C]
RtK.exe+141B21: 8B 42 30 - mov eax,[edx+30]
RtK.exe+141B24: 89 45 EC - mov [ebp-14],eax
RtK.exe+141B27: 8B 0D 94 DB 66 00 - mov ecx,[RtK.exe+26DB94]
RtK.exe+141B2D: 89 4D DC - mov [ebp-24],ecx
RtK.exe+141B30: 8B 15 94 DB 66 00 - mov edx,[RtK.exe+26DB94]
RtK.exe+141B36: 83 C2 01 - add edx,01
RtK.exe+141B39: 89 15 94 DB 66 00 - mov [RtK.exe+26DB94],edx
RtK.exe+141B3F: 8B 45 F4 - mov eax,[ebp-0C]
// ---------- INJECTING HERE ----------
RtK.exe+141B42: 8B 48 50 - mov ecx,[eax+50]
// ---------- DONE INJECTING ----------
RtK.exe+141B45: 89 4D E0 - mov [ebp-20],ecx
RtK.exe+141B48: 83 3D BC D2 66 00 00 - cmp dword ptr [RtK.exe+26D2BC],00
RtK.exe+141B4F: 74 14 - je RtK.exe+141B65
RtK.exe+141B51: 8B 15 F4 DC 66 00 - mov edx,[RtK.exe+26DCF4]
RtK.exe+141B57: 3B 55 F4 - cmp edx,[ebp-0C]
RtK.exe+141B5A: 75 09 - jne RtK.exe+141B65
RtK.exe+141B5C: 8B 45 E0 - mov eax,[ebp-20]
RtK.exe+141B5F: 83 E8 01 - sub eax,01
RtK.exe+141B62: 89 45 E0 - mov [ebp-20],eax
RtK.exe+141B65: 8B 4D E0 - mov ecx,[ebp-20]
}
38
"Gold"
4 Bytes
[goldaddy]+50
4
"Character"
1
"RtK.exe"+0021D90C
0
A0
4C
30
"Current Health"
0000FF
4 Bytes
+60
31
"Full Health"
4 Bytes
+64
40
"Current Spellcasting"
FF0000
2 Bytes
+70
58
"Full Spellcasting"
000000
2 Bytes
+74
32
"? No idea ?"
4 Bytes
+68
42
"======= Skills ======= "
008000
1
57
"Brawling"
008000
2 Bytes
+84
41
"Bladed"
008000
2 Bytes
+86
43
"Blunt"
008000
2 Bytes
+88
44
"Axe"
008000
2 Bytes
+8a
45
"2-Handed"
008000
2 Bytes
+8c
46
"Bow"
008000
2 Bytes
+8e
47
"Defense"
008000
2 Bytes
+90
48
"Initiative"
008000
2 Bytes
+92
49
"Analyze"
008000
2 Bytes
+94
50
"Stealth"
008000
2 Bytes
+96
51
"Pick Lock"
008000
2 Bytes
+98
52
"Disarm Traps"
008000
2 Bytes
+9a
53
"Perception"
008000
2 Bytes
+9c
54
"Alchemy"
008000
2 Bytes
+9e
55
"Evaluate"
008000
2 Bytes
+a0
56
"Shield"
008000
2 Bytes
+a2
5
"Backup Pointers to Health, adjust accordingly if you need to change main ptr)"
1
6
"pointerscan result"
2 Bytes
"RtK.exe"+0021D904
60
80
5C
7
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
B0
40
8
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
80
5C
9
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
4F4
80
5C
10
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
4F4
A0
4C
11
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
4D8
80
5C
12
"pointerscan result"
2 Bytes
"RtK.exe"+0021D904
60
4F4
80
5C
13
"pointerscan result"
2 Bytes
"RtK.exe"+0021D904
60
4EC
80
5C
14
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
E4
A0
4C
15
"pointerscan result"
2 Bytes
"RtK.exe"+00228D6C
60
0
C
4
16
"pointerscan result"
2 Bytes
"RtK.exe"+0021D904
60
16C
80
5C
17
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
16C
A0
4C
18
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
16C
B0
40
19
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
E4
80
5C
20
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
E4
B0
40
21
"pointerscan result"
2 Bytes
"RtK.exe"+0021D904
60
4D8
80
5C
22
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
4D8
A0
4C
23
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
4D8
B0
40
24
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
4F4
B0
40
25
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
4EC
80
5C
26
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
4EC
A0
4C
27
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
4EC
B0
40
28
"pointerscan result"
2 Bytes
"RtK.exe"+0021D904
60
E4
80
5C
29
"pointerscan result"
2 Bytes
"RtK.exe"+0021D90C
60
16C
80
5C
xpaddy
00850000
goldaddy
00850010