14 "GodMode and 1-Hit-Kill" Auto Assembler Script [ENABLE] aobscanmodule(health,SandsOfAura-Win64-Shipping.exe,F3 0F 11 8B 84 05 00 00) // should be unique alloc(newmem,$1000,health) label(code) label(return) label(onehit) label(godmode_on) label(onehit_on) newmem: cmp rdx,0 je onehit // if enemy, check for onehit cmp byte ptr [godmode_on],1 // else if it's us, check for godmode jne code movss xmm1,xmm2 jmp code onehit: cmp byte ptr [onehit_on],1 jne code xorps xmm1,xmm1 code: movss [rbx+00000584],xmm1 jmp return godmode_on: db 0 onehit_on: db 0 health: jmp newmem nop 3 return: registersymbol(health godmode_on onehit_on) [DISABLE] health: db F3 0F 11 8B 84 05 00 00 unregistersymbol(*) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: SandsOfAura-Win64-Shipping.exe+E7028C SandsOfAura-Win64-Shipping.exe+E70257: 48 8B 03 - mov rax,[rbx] SandsOfAura-Win64-Shipping.exe+E7025A: 48 8B CB - mov rcx,rbx SandsOfAura-Win64-Shipping.exe+E7025D: F2 0F 11 45 B7 - movsd [rbp-49],xmm0 SandsOfAura-Win64-Shipping.exe+E70262: FF 90 D8 07 00 00 - call qword ptr [rax+000007D8] SandsOfAura-Win64-Shipping.exe+E70268: F3 41 0F 10 36 - movss xmm6,[r14] SandsOfAura-Win64-Shipping.exe+E7026D: 48 8D 8B 50 05 00 00 - lea rcx,[rbx+00000550] SandsOfAura-Win64-Shipping.exe+E70274: F3 0F 10 8B 84 05 00 00 - movss xmm1,[rbx+00000584] SandsOfAura-Win64-Shipping.exe+E7027C: F3 0F 10 93 80 05 00 00 - movss xmm2,[rbx+00000580] SandsOfAura-Win64-Shipping.exe+E70284: F3 0F 5C CE - subss xmm1,xmm6 SandsOfAura-Win64-Shipping.exe+E70288: F3 0F 5F CF - maxss xmm1,xmm7 // ---------- INJECTING HERE ---------- SandsOfAura-Win64-Shipping.exe+E7028C: F3 0F 11 8B 84 05 00 00 - movss [rbx+00000584],xmm1 // ---------- DONE INJECTING ---------- SandsOfAura-Win64-Shipping.exe+E70294: E8 17 F8 FF FF - call SandsOfAura-Win64-Shipping.exe+E6FAB0 SandsOfAura-Win64-Shipping.exe+E70299: 0F 28 CE - movaps xmm1,xmm6 SandsOfAura-Win64-Shipping.exe+E7029C: 48 8B CB - mov rcx,rbx SandsOfAura-Win64-Shipping.exe+E7029F: E8 4C EE 12 00 - call SandsOfAura-Win64-Shipping.exe+F9F0F0 SandsOfAura-Win64-Shipping.exe+E702A4: F3 0F 10 83 84 05 00 00 - movss xmm0,[rbx+00000584] SandsOfAura-Win64-Shipping.exe+E702AC: 48 8B CB - mov rcx,rbx SandsOfAura-Win64-Shipping.exe+E702AF: 0F 2F C7 - comiss xmm0,xmm7 SandsOfAura-Win64-Shipping.exe+E702B2: 4C 8B 6D 77 - mov r13,[rbp+77] SandsOfAura-Win64-Shipping.exe+E702B6: 76 0A - jna SandsOfAura-Win64-Shipping.exe+E702C2 SandsOfAura-Win64-Shipping.exe+E702B8: 49 8B D5 - mov rdx,r13 } 15 "GodMode" Auto Assembler Script [ENABLE] godmode_on: db 1 [DISABLE] godmode_on: db 0 16 "One-Hit-Kill" Auto Assembler Script [ENABLE] onehit_on: db 1 [DISABLE] onehit_on: db 0 24 "Don't spend money on buying something" Auto Assembler Script define(address,"SandsOfAura-Win64-Shipping.exe"+EAE1CA) define(bytes,29 81 90 01 00 00) [ENABLE] assert(address,bytes) address: nop 6 [DISABLE] address: db bytes // sub [rcx+00000190],eax dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: SandsOfAura-Win64-Shipping.exe+EAE1CA SandsOfAura-Win64-Shipping.exe+EAE1AD: CC - int 3 SandsOfAura-Win64-Shipping.exe+EAE1AE: CC - int 3 SandsOfAura-Win64-Shipping.exe+EAE1AF: CC - int 3 SandsOfAura-Win64-Shipping.exe+EAE1B0: 48 89 5C 24 08 - mov [rsp+08],rbx SandsOfAura-Win64-Shipping.exe+EAE1B5: 57 - push rdi SandsOfAura-Win64-Shipping.exe+EAE1B6: 48 83 EC 20 - sub rsp,20 SandsOfAura-Win64-Shipping.exe+EAE1BA: 8B 82 8C 00 00 00 - mov eax,[rdx+0000008C] SandsOfAura-Win64-Shipping.exe+EAE1C0: 48 8B DA - mov rbx,rdx SandsOfAura-Win64-Shipping.exe+EAE1C3: 0F AF 42 7C - imul eax,[rdx+7C] SandsOfAura-Win64-Shipping.exe+EAE1C7: 48 8B F9 - mov rdi,rcx // ---------- INJECTING HERE ---------- SandsOfAura-Win64-Shipping.exe+EAE1CA: 29 81 90 01 00 00 - sub [rcx+00000190],eax // ---------- DONE INJECTING ---------- SandsOfAura-Win64-Shipping.exe+EAE1D0: E8 DB FB 00 00 - call SandsOfAura-Win64-Shipping.exe+EBDDB0 SandsOfAura-Win64-Shipping.exe+EAE1D5: 8B 97 90 01 00 00 - mov edx,[rdi+00000190] SandsOfAura-Win64-Shipping.exe+EAE1DB: 48 8B C8 - mov rcx,rax SandsOfAura-Win64-Shipping.exe+EAE1DE: 4C 8B 00 - mov r8,[rax] SandsOfAura-Win64-Shipping.exe+EAE1E1: 41 FF 90 F0 09 00 00 - call qword ptr [r8+000009F0] SandsOfAura-Win64-Shipping.exe+EAE1E8: 45 33 C9 - xor r9d,r9d SandsOfAura-Win64-Shipping.exe+EAE1EB: 45 33 C0 - xor r8d,r8d SandsOfAura-Win64-Shipping.exe+EAE1EE: 48 8B D3 - mov rdx,rbx SandsOfAura-Win64-Shipping.exe+EAE1F1: 48 8B CF - mov rcx,rdi SandsOfAura-Win64-Shipping.exe+EAE1F4: 48 8B 5C 24 30 - mov rbx,[rsp+30] } 28 "Unlimited Bells" Auto Assembler Script define(address,"SandsOfAura-Win64-Shipping.exe"+EBE6DC) define(bytes,FF 8B D4 0D 00 00) [ENABLE] address: nop 6 [DISABLE] address: db bytes // dec [rbx+00000DD4] dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: SandsOfAura-Win64-Shipping.exe+EBE6DC SandsOfAura-Win64-Shipping.exe+EBE6AB: F3 0F 59 B0 B8 08 00 00 - mulss xmm6,[rax+000008B8] SandsOfAura-Win64-Shipping.exe+EBE6B3: EB 03 - jmp SandsOfAura-Win64-Shipping.exe+EBE6B8 SandsOfAura-Win64-Shipping.exe+EBE6B5: 0F 57 F6 - xorps xmm6,xmm6 SandsOfAura-Win64-Shipping.exe+EBE6B8: E8 43 A8 03 00 - call SandsOfAura-Win64-Shipping.exe+EF8F00 SandsOfAura-Win64-Shipping.exe+EBE6BD: F3 0F 58 35 BB C2 A9 02 - addss xmm6,[SandsOfAura-Win64-Shipping.exe+395A980] SandsOfAura-Win64-Shipping.exe+EBE6C5: 48 8B CB - mov rcx,rbx SandsOfAura-Win64-Shipping.exe+EBE6C8: F3 0F 5F F7 - maxss xmm6,xmm7 SandsOfAura-Win64-Shipping.exe+EBE6CC: F3 0F 59 B0 30 03 00 00 - mulss xmm6,[rax+00000330] SandsOfAura-Win64-Shipping.exe+EBE6D4: 0F 28 CE - movaps xmm1,xmm6 SandsOfAura-Win64-Shipping.exe+EBE6D7: E8 A4 A8 FA FF - call SandsOfAura-Win64-Shipping.exe+E68F80 // ---------- INJECTING HERE ---------- SandsOfAura-Win64-Shipping.exe+EBE6DC: FF 8B D4 0D 00 00 - dec [rbx+00000DD4] // ---------- DONE INJECTING ---------- SandsOfAura-Win64-Shipping.exe+EBE6E2: 48 8B CB - mov rcx,rbx SandsOfAura-Win64-Shipping.exe+EBE6E5: E8 16 FB FB FF - call SandsOfAura-Win64-Shipping.exe+E7E200 SandsOfAura-Win64-Shipping.exe+EBE6EA: 48 85 C0 - test rax,rax SandsOfAura-Win64-Shipping.exe+EBE6ED: 74 1A - je SandsOfAura-Win64-Shipping.exe+EBE709 SandsOfAura-Win64-Shipping.exe+EBE6EF: 48 8B CB - mov rcx,rbx SandsOfAura-Win64-Shipping.exe+EBE6F2: E8 09 FB FB FF - call SandsOfAura-Win64-Shipping.exe+E7E200 SandsOfAura-Win64-Shipping.exe+EBE6F7: 0F B6 93 D4 0D 00 00 - movzx edx,byte ptr [rbx+00000DD4] SandsOfAura-Win64-Shipping.exe+EBE6FE: 48 8B C8 - mov rcx,rax SandsOfAura-Win64-Shipping.exe+EBE701: 41 B0 05 - mov r8l,05 SandsOfAura-Win64-Shipping.exe+EBE704: E8 17 B4 09 00 - call SandsOfAura-Win64-Shipping.exe+F59B20 } 26 "Get 100 Sacrumit when looting some" Auto Assembler Script define(address,"SandsOfAura-Win64-Shipping.exe"+EA8915) define(bytes,01 8B 8C 00 00 00) [ENABLE] assert(address,bytes) alloc(newmem,$1000,"SandsOfAura-Win64-Shipping.exe"+EA8915) label(code) label(return) newmem: mov ecx,#100 code: add [rbx+0000008C],ecx jmp return address: jmp newmem nop return: [DISABLE] address: db bytes // add [rbx+0000008C],ecx dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: SandsOfAura-Win64-Shipping.exe+EA8915 SandsOfAura-Win64-Shipping.exe+EA88FB: 48 8B 9C 24 88 00 00 00 - mov rbx,[rsp+00000088] SandsOfAura-Win64-Shipping.exe+EA8903: 48 83 C4 40 - add rsp,40 SandsOfAura-Win64-Shipping.exe+EA8907: 41 5F - pop r15 SandsOfAura-Win64-Shipping.exe+EA8909: 41 5E - pop r14 SandsOfAura-Win64-Shipping.exe+EA890B: 41 5C - pop r12 SandsOfAura-Win64-Shipping.exe+EA890D: 5F - pop rdi SandsOfAura-Win64-Shipping.exe+EA890E: 5D - pop rbp SandsOfAura-Win64-Shipping.exe+EA890F: C3 - ret SandsOfAura-Win64-Shipping.exe+EA8910: 45 84 E4 - test r12l,r12l SandsOfAura-Win64-Shipping.exe+EA8913: 75 46 - jne SandsOfAura-Win64-Shipping.exe+EA895B // ---------- INJECTING HERE ---------- SandsOfAura-Win64-Shipping.exe+EA8915: 01 8B 8C 00 00 00 - add [rbx+0000008C],ecx // ---------- DONE INJECTING ---------- SandsOfAura-Win64-Shipping.exe+EA891B: 49 8B CF - mov rcx,r15 SandsOfAura-Win64-Shipping.exe+EA891E: E8 8D 54 01 00 - call SandsOfAura-Win64-Shipping.exe+EBDDB0 SandsOfAura-Win64-Shipping.exe+EA8923: 44 8B 87 8C 00 00 00 - mov r8d,[rdi+0000008C] SandsOfAura-Win64-Shipping.exe+EA892A: 41 B1 01 - mov r9l,01 SandsOfAura-Win64-Shipping.exe+EA892D: 48 8B D3 - mov rdx,rbx SandsOfAura-Win64-Shipping.exe+EA8930: 48 8B C8 - mov rcx,rax SandsOfAura-Win64-Shipping.exe+EA8933: 4C 8B 10 - mov r10,[rax] SandsOfAura-Win64-Shipping.exe+EA8936: 41 FF 92 E0 09 00 00 - call qword ptr [r10+000009E0] SandsOfAura-Win64-Shipping.exe+EA893D: 33 C0 - xor eax,eax SandsOfAura-Win64-Shipping.exe+EA893F: EB AD - jmp SandsOfAura-Win64-Shipping.exe+EA88EE } 40 "Ressources at the Forge" 1 29 "Don't spend Sacrumit" Auto Assembler Script define(address,"SandsOfAura-Win64-Shipping.exe"+EC4D6C) define(bytes,2B C6 49 8B CF) [ENABLE] assert(address,bytes) alloc(newmem,$1000,"SandsOfAura-Win64-Shipping.exe"+EC4D6C) address: nop 2 [DISABLE] address: db bytes // sub eax,esi // mov rcx,r15 dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: SandsOfAura-Win64-Shipping.exe+EC4D6C SandsOfAura-Win64-Shipping.exe+EC4D4B: C1 E0 0A - shl eax,0A SandsOfAura-Win64-Shipping.exe+EC4D4E: 33 D0 - xor edx,eax SandsOfAura-Win64-Shipping.exe+EC4D50: 44 2B C1 - sub r8d,ecx SandsOfAura-Win64-Shipping.exe+EC4D53: 44 2B C2 - sub r8d,edx SandsOfAura-Win64-Shipping.exe+EC4D56: 48 8D 4D B0 - lea rcx,[rbp-50] SandsOfAura-Win64-Shipping.exe+EC4D5A: C1 EA 0F - shr edx,0F SandsOfAura-Win64-Shipping.exe+EC4D5D: 44 33 C2 - xor r8d,edx SandsOfAura-Win64-Shipping.exe+EC4D60: 48 8D 54 24 50 - lea rdx,[rsp+50] SandsOfAura-Win64-Shipping.exe+EC4D65: E8 76 14 93 FF - call SandsOfAura-Win64-Shipping.exe+7F61E0 SandsOfAura-Win64-Shipping.exe+EC4D6A: EB 28 - jmp SandsOfAura-Win64-Shipping.exe+EC4D94 // ---------- INJECTING HERE ---------- SandsOfAura-Win64-Shipping.exe+EC4D6C: 2B C6 - sub eax,esi // ---------- DONE INJECTING ---------- SandsOfAura-Win64-Shipping.exe+EC4D6E: 49 8B CF - mov rcx,r15 SandsOfAura-Win64-Shipping.exe+EC4D71: 89 87 8C 00 00 00 - mov [rdi+0000008C],eax SandsOfAura-Win64-Shipping.exe+EC4D77: E8 34 90 FF FF - call SandsOfAura-Win64-Shipping.exe+EBDDB0 SandsOfAura-Win64-Shipping.exe+EC4D7C: F7 DE - neg esi SandsOfAura-Win64-Shipping.exe+EC4D7E: 45 33 C9 - xor r9d,r9d SandsOfAura-Win64-Shipping.exe+EC4D81: 44 8B C6 - mov r8d,esi SandsOfAura-Win64-Shipping.exe+EC4D84: 48 8B D7 - mov rdx,rdi SandsOfAura-Win64-Shipping.exe+EC4D87: 48 8B C8 - mov rcx,rax SandsOfAura-Win64-Shipping.exe+EC4D8A: 4C 8B 10 - mov r10,[rax] SandsOfAura-Win64-Shipping.exe+EC4D8D: 41 FF 92 E0 09 00 00 - call qword ptr [r10+000009E0] } 39 "Don't spend cyan Donuts" Auto Assembler Script define(address,"SandsOfAura-Win64-Shipping.exe"+EC49AF) define(bytes,41 29 B7 90 01 00 00) [ENABLE] assert(address,bytes) alloc(newmem,$1000,"SandsOfAura-Win64-Shipping.exe"+EC49AF) address: nop 7 [DISABLE] address: db bytes // sub [r15+00000190],esi dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: SandsOfAura-Win64-Shipping.exe+EC49AF SandsOfAura-Win64-Shipping.exe+EC498A: 48 8B DA - mov rbx,rdx SandsOfAura-Win64-Shipping.exe+EC498D: 48 89 54 24 58 - mov [rsp+58],rdx SandsOfAura-Win64-Shipping.exe+EC4992: 4C 8B F9 - mov r15,rcx SandsOfAura-Win64-Shipping.exe+EC4995: 48 8D 15 DC D3 D1 03 - lea rdx,[SandsOfAura-Win64-Shipping.exe+4BE1D78] SandsOfAura-Win64-Shipping.exe+EC499C: 48 8B CB - mov rcx,rbx SandsOfAura-Win64-Shipping.exe+EC499F: 41 8B F1 - mov esi,r9d SandsOfAura-Win64-Shipping.exe+EC49A2: 45 0F B6 E0 - movzx r12d,r8l SandsOfAura-Win64-Shipping.exe+EC49A6: E8 C5 DA 81 01 - call SandsOfAura-Win64-Shipping.exe+26E2470 SandsOfAura-Win64-Shipping.exe+EC49AB: 84 C0 - test al,al SandsOfAura-Win64-Shipping.exe+EC49AD: 74 28 - je SandsOfAura-Win64-Shipping.exe+EC49D7 // ---------- INJECTING HERE ---------- SandsOfAura-Win64-Shipping.exe+EC49AF: 41 29 B7 90 01 00 00 - sub [r15+00000190],esi // ---------- DONE INJECTING ---------- SandsOfAura-Win64-Shipping.exe+EC49B6: 49 8B CF - mov rcx,r15 SandsOfAura-Win64-Shipping.exe+EC49B9: E8 F2 93 FF FF - call SandsOfAura-Win64-Shipping.exe+EBDDB0 SandsOfAura-Win64-Shipping.exe+EC49BE: 41 8B 97 90 01 00 00 - mov edx,[r15+00000190] SandsOfAura-Win64-Shipping.exe+EC49C5: 48 8B C8 - mov rcx,rax SandsOfAura-Win64-Shipping.exe+EC49C8: 4C 8B 00 - mov r8,[rax] SandsOfAura-Win64-Shipping.exe+EC49CB: 41 FF 90 F0 09 00 00 - call qword ptr [r8+000009F0] SandsOfAura-Win64-Shipping.exe+EC49D2: E9 A6 05 00 00 - jmp SandsOfAura-Win64-Shipping.exe+EC4F7D SandsOfAura-Win64-Shipping.exe+EC49D7: 49 63 87 B8 00 00 00 - movsxd rax,dword ptr [r15+000000B8] SandsOfAura-Win64-Shipping.exe+EC49DE: 45 33 C9 - xor r9d,r9d SandsOfAura-Win64-Shipping.exe+EC49E1: 4C 89 AC 24 18 01 00 00 - mov [rsp+00000118],r13 } Health is a simple float value. Display of healtbar does not update immediatley, instead on getting damage at the code which calculates damage, the enemies have RDX==0, R13==0, RBX+8==0, RBX+c == 0