5
"Get money"
Auto Assembler Script
{ Game : StationToStation-Win64-Shipping.exe
Version:
Date : 2023-11-26
Author :
}
[ENABLE]
aobscanmodule(INJECT_MONEY_ADDR,StationToStation-Win64-Shipping.exe,8B C1 49 8B 4E 18) // should be unique
alloc(newmem,$1000,INJECT_MONEY_ADDR)
label(code)
label(return)
label(i_base_money_addr)
newmem:
push rcx
mov rcx, [r12+10]
test rcx, rcx
jz endp
mov ecx, [rcx+18]
cmp ecx, 000D3E94
jne endp
//mov ecx, [r12+1C]
//cmp ecx, 7FFFF872
//jne endp
mov ecx, [r12+18]
mov [i_base_money_addr], r12
endp:
pop rcx
code:
mov eax,ecx
mov rcx,[r14+18]
jmp return
align 10 cc
i_base_money_addr:
dq 0
db EB 3B 54
db 68 69 73 20 74 61 62 6C 65
db 20 63 6F 6D
db 65 73 20 66 72 6F 6D 20
db 68 74 74 70
db 73 3A 2F 2F 6F 70 65 6E 63 68 65 61
db 74 74 61 62
db 6C 65
db 73 2E
db 63 6F 6D 20
db 2F
db 20
db 43 45 20 37
db 2E 34 2B
INJECT_MONEY_ADDR:
jmp newmem
nop
return:
registersymbol(INJECT_MONEY_ADDR)
registersymbol(i_base_money_addr)
[DISABLE]
INJECT_MONEY_ADDR:
db 8B C1 49 8B 4E 18
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: StationToStation-Win64-Shipping.exe+11F6940
StationToStation-Win64-Shipping.exe+11F691F: 48 8B 06 - mov rax,[rsi]
StationToStation-Win64-Shipping.exe+11F6922: 41 8B D7 - mov edx,r15d
StationToStation-Win64-Shipping.exe+11F6925: 48 8B CE - mov rcx,rsi
StationToStation-Win64-Shipping.exe+11F6928: FF 50 08 - call qword ptr [rax+08]
StationToStation-Win64-Shipping.exe+11F692B: 49 8B 46 20 - mov rax,[r14+20]
StationToStation-Win64-Shipping.exe+11F692F: 49 8B D6 - mov rdx,r14
StationToStation-Win64-Shipping.exe+11F6932: 4D 8B 46 38 - mov r8,[r14+38]
StationToStation-Win64-Shipping.exe+11F6936: 0F B6 08 - movzx ecx,byte ptr [rax]
StationToStation-Win64-Shipping.exe+11F6939: 48 FF C0 - inc rax
StationToStation-Win64-Shipping.exe+11F693C: 49 89 46 20 - mov [r14+20],rax
// ---------- INJECTING HERE ----------
StationToStation-Win64-Shipping.exe+11F6940: 8B C1 - mov eax,ecx
// ---------- DONE INJECTING ----------
StationToStation-Win64-Shipping.exe+11F6942: 49 8B 4E 18 - mov rcx,[r14+18]
StationToStation-Win64-Shipping.exe+11F6946: 41 FF 54 C5 00 - call qword ptr [r13+rax*8+00]
StationToStation-Win64-Shipping.exe+11F694B: 48 85 DB - test rbx,rbx
StationToStation-Win64-Shipping.exe+11F694E: 74 22 - je StationToStation-Win64-Shipping.exe+11F6972
StationToStation-Win64-Shipping.exe+11F6950: 48 85 FF - test rdi,rdi
StationToStation-Win64-Shipping.exe+11F6953: 74 1D - je StationToStation-Win64-Shipping.exe+11F6972
StationToStation-Win64-Shipping.exe+11F6955: 48 8B 47 40 - mov rax,[rdi+40]
StationToStation-Win64-Shipping.exe+11F6959: 48 C1 E8 24 - shr rax,24
StationToStation-Win64-Shipping.exe+11F695D: F6 D0 - not al
StationToStation-Win64-Shipping.exe+11F695F: A8 01 - test al,01
}
6
"Money"
0
FF8080
4 Bytes
i_base_money_addr
3D0
8
"Get data"
Auto Assembler Script
{ Game : StationToStation-Win64-Shipping.exe
Version:
Date : 2023-11-26
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_DATA,StationToStation-Win64-Shipping.exe,8B 44 3B 0B 89 43 0B) // should be unique
alloc(newmem,$1000,INJECT_GET_DATA)
label(code)
label(return)
label(i_base_data_addr)
newmem:
cmp qword ptr [i_base_data_addr], 0
jne code
push r15
lea r15, [rbx+rdi]
mov [i_base_data_addr], r15
pop r15
code:
mov eax,[rbx+rdi+0B]
mov [rbx+0B],eax
jmp return
align 10 cc
i_base_data_addr:
dq 0
INJECT_GET_DATA:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_DATA)
registersymbol(i_base_data_addr)
[DISABLE]
INJECT_GET_DATA:
db 8B 44 3B 0B 89 43 0B
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: StationToStation-Win64-Shipping.exe+EBB5BF
StationToStation-Win64-Shipping.exe+EBB59A: 0F B6 04 3B - movzx eax,byte ptr [rbx+rdi]
StationToStation-Win64-Shipping.exe+EBB59E: 88 03 - mov [rbx],al
StationToStation-Win64-Shipping.exe+EBB5A0: 0F B6 44 3B 01 - movzx eax,byte ptr [rbx+rdi+01]
StationToStation-Win64-Shipping.exe+EBB5A5: 88 43 01 - mov [rbx+01],al
StationToStation-Win64-Shipping.exe+EBB5A8: 0F B6 44 3B 02 - movzx eax,byte ptr [rbx+rdi+02]
StationToStation-Win64-Shipping.exe+EBB5AD: 88 43 02 - mov [rbx+02],al
StationToStation-Win64-Shipping.exe+EBB5B0: 0F B6 44 3B 03 - movzx eax,byte ptr [rbx+rdi+03]
StationToStation-Win64-Shipping.exe+EBB5B5: 88 43 03 - mov [rbx+03],al
StationToStation-Win64-Shipping.exe+EBB5B8: 8B 44 3B 07 - mov eax,[rbx+rdi+07]
StationToStation-Win64-Shipping.exe+EBB5BC: 89 43 07 - mov [rbx+07],eax
// ---------- INJECTING HERE ----------
StationToStation-Win64-Shipping.exe+EBB5BF: 8B 44 3B 0B - mov eax,[rbx+rdi+0B]
// ---------- DONE INJECTING ----------
StationToStation-Win64-Shipping.exe+EBB5C3: 89 43 0B - mov [rbx+0B],eax
StationToStation-Win64-Shipping.exe+EBB5C6: 8B 44 3B 0F - mov eax,[rbx+rdi+0F]
StationToStation-Win64-Shipping.exe+EBB5CA: 89 43 0F - mov [rbx+0F],eax
StationToStation-Win64-Shipping.exe+EBB5CD: 8B 44 3B 13 - mov eax,[rbx+rdi+13]
StationToStation-Win64-Shipping.exe+EBB5D1: 89 43 13 - mov [rbx+13],eax
StationToStation-Win64-Shipping.exe+EBB5D4: 8B 44 3B 17 - mov eax,[rbx+rdi+17]
StationToStation-Win64-Shipping.exe+EBB5D8: 89 43 17 - mov [rbx+17],eax
StationToStation-Win64-Shipping.exe+EBB5DB: 8B 44 3B 1B - mov eax,[rbx+rdi+1B]
StationToStation-Win64-Shipping.exe+EBB5DF: 89 43 1B - mov [rbx+1B],eax
StationToStation-Win64-Shipping.exe+EBB5E2: 8B 44 3B 1F - mov eax,[rbx+rdi+1F]
}
12
"Usage: move mouse over Star icon on bottom-right "
8000FF
1
13
"Re-enable when start new stage"
8000FF
1
9
"??"
0
FF8080
4 Bytes
i_base_data_addr
7
10
"Rail length"
0
FF8080
4 Bytes
i_base_data_addr
B
11
"Progress"
0
FF8080
4 Bytes
i_base_data_addr
F
14
"Money left"
0
FF8080
4 Bytes
i_base_data_addr
13
15
"Saving $"
0
FF8080
4 Bytes
i_base_data_addr
17
16
"??"
0
FF8080
4 Bytes
i_base_data_addr
1B
17
"??"
0
FF8080
4 Bytes
i_base_data_addr
1F
18
"??"
0
FF8080
4 Bytes
i_base_data_addr
23
19
"??"
0
FF8080
4 Bytes
i_base_data_addr
27
20
"??"
0
FF8080
4 Bytes
i_base_data_addr
2B
21
"??"
0
FF8080
4 Bytes
i_base_data_addr
2F
22
"??"
0
FF8080
4 Bytes
i_base_data_addr
33
23
"??"
0
FF8080
4 Bytes
i_base_data_addr
37
24
"??"
0
FF8080
4 Bytes
i_base_data_addr
3B
25
"??"
0
FF8080
4 Bytes
i_base_data_addr
5B
26
"??"
0
FF8080
4 Bytes
i_base_data_addr
5F
27
"Station to Station v1.1 (3744) / https://opencheattables.com / CE 7.5+"
00B058
1