45
"Gem-Scripts - you have to collect one gem to actually load the code in memory!"
1
3
"find address of gems - collect one gem to update address"
Auto Assembler Script
[ENABLE]
aobscan(gems,89 47 20 8B 47 10 89) // should be unique
alloc(newmem,$1000)
globalalloc(gemaddy,4)
label(code)
label(return)
gemaddy:
dw 0
newmem:
push eax
lea eax,[edi]
mov [gemaddy],eax
pop eax
code:
mov [edi+20],eax
mov eax,[edi+10]
jmp return
gems:
jmp newmem
nop
return:
registersymbol(gems)
[DISABLE]
gems:
db 89 47 20 8B 47 10
unregistersymbol(gems)
dealloc(newmem)
dealloc(gemaddy)
{
// ORIGINAL CODE - INJECTION POINT: GameManager:AddGem+e
UnityEngine:Time:get_timeScale+49: DD 5D D0 - fstp qword ptr [ebp-30]
UnityEngine:Time:get_timeScale+4c: EB E0 - jmp UnityEngine:Time:get_timeScale+2e
16D2E28E: 00 00 - add [eax],al
GameManager:AddGem: 55 - push ebp
GameManager:AddGem+1: 8B EC - mov ebp,esp
GameManager:AddGem+3: 57 - push edi
GameManager:AddGem+4: 83 EC 04 - sub esp,04
GameManager:AddGem+7: 8B 7D 08 - mov edi,[ebp+08]
GameManager:AddGem+a: 8B 47 20 - mov eax,[edi+20]
GameManager:AddGem+d: 40 - inc eax
// ---------- INJECTING HERE ----------
GameManager:AddGem+e: 89 47 20 - mov [edi+20],eax
// ---------- DONE INJECTING ----------
GameManager:AddGem+11: 8B 47 10 - mov eax,[edi+10]
GameManager:AddGem+14: 89 45 F8 - mov [ebp-08],eax
GameManager:AddGem+17: 8D 47 20 - lea eax,[edi+20]
GameManager:AddGem+1a: 83 EC 0C - sub esp,0C
GameManager:AddGem+1d: 50 - push eax
GameManager:AddGem+1e: E8 85 11 ED EE - call System:Int32:ToString
GameManager:AddGem+23: 83 C4 10 - add esp,10
GameManager:AddGem+26: 8B C8 - mov ecx,eax
GameManager:AddGem+28: 8B 45 F8 - mov eax,[ebp-08]
GameManager:AddGem+2b: 83 EC 08 - sub esp,08
}
4
"Collected Gems"
4 Bytes
gemaddy
20
47
"--- OR ---"
1
46
"set gems to 99 when collecting one"
Auto Assembler Script
[ENABLE]
aobscan(gems,89 47 20 8B 47 10 89) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
mov eax,#99
code:
mov [edi+20],eax
mov eax,[edi+10]
jmp return
gems:
jmp newmem
nop
return:
registersymbol(gems)
[DISABLE]
gems:
db 89 47 20 8B 47 10
unregistersymbol(gems)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameManager:AddGem+e
UnityEngine:Time:get_timeScale+49: DD 5D D0 - fstp qword ptr [ebp-30]
UnityEngine:Time:get_timeScale+4c: EB E0 - jmp UnityEngine:Time:get_timeScale+2e
16D2E28E: 00 00 - add [eax],al
GameManager:AddGem: 55 - push ebp
GameManager:AddGem+1: 8B EC - mov ebp,esp
GameManager:AddGem+3: 57 - push edi
GameManager:AddGem+4: 83 EC 04 - sub esp,04
GameManager:AddGem+7: 8B 7D 08 - mov edi,[ebp+08]
GameManager:AddGem+a: 8B 47 20 - mov eax,[edi+20]
GameManager:AddGem+d: 40 - inc eax
// ---------- INJECTING HERE ----------
GameManager:AddGem+e: 89 47 20 - mov [edi+20],eax
// ---------- DONE INJECTING ----------
GameManager:AddGem+11: 8B 47 10 - mov eax,[edi+10]
GameManager:AddGem+14: 89 45 F8 - mov [ebp-08],eax
GameManager:AddGem+17: 8D 47 20 - lea eax,[edi+20]
GameManager:AddGem+1a: 83 EC 0C - sub esp,0C
GameManager:AddGem+1d: 50 - push eax
GameManager:AddGem+1e: E8 85 11 ED EE - call System:Int32:ToString
GameManager:AddGem+23: 83 C4 10 - add esp,10
GameManager:AddGem+26: 8B C8 - mov ecx,eax
GameManager:AddGem+28: 8B 45 F8 - mov eax,[ebp-08]
GameManager:AddGem+2b: 83 EC 08 - sub esp,08
}
48
"Health-Scripts - chose one"
1
44
"GodMode for Player"
Auto Assembler Script
// Mono-Address: DealDamage:Attack+2ff
[ENABLE]
aobscan(health,2B 4D 10 89 48 3C 83 EC 0C 56 39 36 E8 48 B2) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
push ebx
mov ebx,[eax+18]
cmp ebx,0
jne code
mov ecx,4
mov [eax+3C],ecx
pop ebx
jmp return
code:
sub ecx,[ebp+10]
mov [eax+3C],ecx
pop ebx
jmp return
health:
jmp newmem
nop
return:
registersymbol(health)
[DISABLE]
health:
db 2B 4D 10 89 48 3C
unregistersymbol(health)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 142132E7
142132CA: E8 41 9C 07 F2 - call 0628CF10
142132CF: 83 C4 10 - add esp,10
142132D2: 85 C0 - test eax,eax
142132D4: 74 17 - je 142132ED
142132D6: 8B 43 10 - mov eax,[ebx+10]
142132D9: 0F B6 40 5F - movzx eax,byte ptr [eax+5F]
142132DD: 85 C0 - test eax,eax
142132DF: 75 0C - jne 142132ED
142132E1: 8B 43 10 - mov eax,[ebx+10]
142132E4: 8B 48 3C - mov ecx,[eax+3C]
// ---------- INJECTING HERE ----------
142132E7: 2B 4D 10 - sub ecx,[ebp+10]
// ---------- DONE INJECTING ----------
142132EA: 89 48 3C - mov [eax+3C],ecx
142132ED: 83 EC 0C - sub esp,0C
142132F0: 56 - push esi
142132F1: 39 36 - cmp [esi],esi
142132F3: E8 48 B2 FF FF - call 1420E540
142132F8: 83 C4 10 - add esp,10
142132FB: 83 EC 08 - sub esp,08
142132FE: 68 A0 1E 8A 13 - push 138A1EA0
14213303: 50 - push eax
14213304: E8 3F EA FF F1 - call 06211D48
}
41
"don't get or deal damage"
Auto Assembler Script
// Mono-Address: DealDamage:Attack+2ff
[ENABLE]
aobscan(health,2B 4D 10 89 48 3C 83 EC 0C 56 39 36 E8 48 B2) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// sub ecx,[ebp+10]
mov [eax+3C],ecx
jmp return
health:
jmp newmem
nop
return:
registersymbol(health)
[DISABLE]
health:
db 2B 4D 10 89 48 3C
unregistersymbol(health)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 142132E7
142132CA: E8 41 9C 07 F2 - call 0628CF10
142132CF: 83 C4 10 - add esp,10
142132D2: 85 C0 - test eax,eax
142132D4: 74 17 - je 142132ED
142132D6: 8B 43 10 - mov eax,[ebx+10]
142132D9: 0F B6 40 5F - movzx eax,byte ptr [eax+5F]
142132DD: 85 C0 - test eax,eax
142132DF: 75 0C - jne 142132ED
142132E1: 8B 43 10 - mov eax,[ebx+10]
142132E4: 8B 48 3C - mov ecx,[eax+3C]
// ---------- INJECTING HERE ----------
142132E7: 2B 4D 10 - sub ecx,[ebp+10]
// ---------- DONE INJECTING ----------
142132EA: 89 48 3C - mov [eax+3C],ecx
142132ED: 83 EC 0C - sub esp,0C
142132F0: 56 - push esi
142132F1: 39 36 - cmp [esi],esi
142132F3: E8 48 B2 FF FF - call 1420E540
142132F8: 83 C4 10 - add esp,10
142132FB: 83 EC 08 - sub esp,08
142132FE: 68 A0 1E 8A 13 - push 138A1EA0
14213303: 50 - push eax
14213304: E8 3F EA FF F1 - call 06211D48
}
43
"No damage for Units with health avove 1"
Auto Assembler Script
// Mono-Address: DealDamage:Attack+2ff
[ENABLE]
aobscan(health,2B 4D 10 89 48 3C 83 EC 0C 56 39 36 E8 48 B2) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
cmp ecx,1 // rats have 1 health
jle code // if above, set health to 4 and exit
mov ecx,4
mov [eax+3C],ecx
jmp return
code:
sub ecx,[ebp+10]
mov [eax+3C],ecx
jmp return
health:
jmp newmem
nop
return:
registersymbol(health)
[DISABLE]
health:
db 2B 4D 10 89 48 3C
unregistersymbol(health)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 142132E7
142132CA: E8 41 9C 07 F2 - call 0628CF10
142132CF: 83 C4 10 - add esp,10
142132D2: 85 C0 - test eax,eax
142132D4: 74 17 - je 142132ED
142132D6: 8B 43 10 - mov eax,[ebx+10]
142132D9: 0F B6 40 5F - movzx eax,byte ptr [eax+5F]
142132DD: 85 C0 - test eax,eax
142132DF: 75 0C - jne 142132ED
142132E1: 8B 43 10 - mov eax,[ebx+10]
142132E4: 8B 48 3C - mov ecx,[eax+3C]
// ---------- INJECTING HERE ----------
142132E7: 2B 4D 10 - sub ecx,[ebp+10]
// ---------- DONE INJECTING ----------
142132EA: 89 48 3C - mov [eax+3C],ecx
142132ED: 83 EC 0C - sub esp,0C
142132F0: 56 - push esi
142132F1: 39 36 - cmp [esi],esi
142132F3: E8 48 B2 FF FF - call 1420E540
142132F8: 83 C4 10 - add esp,10
142132FB: 83 EC 08 - sub esp,08
142132FE: 68 A0 1E 8A 13 - push 138A1EA0
14213303: 50 - push eax
14213304: E8 3F EA FF F1 - call 06211D48
}
Change of je PlayerMove:JumpCalculations+92
121BBA87
00
8B
F7
85
C0
74
41
D9
87
B8
00
00
Change of jne PlayerMove:JumpCalculations+1da
121BBB24
83
C4
10
85
C0
0F
85
E8
00
00
00
8B
47
24
83
EC
Change of je PlayerMove:JumpCalculations+1da
121BBB3B
83
C4
10
85
C0
0F
84
D1
00
00
00
83
EC
0C
57
E8
Change of jbe PlayerMove:JumpCalculations+1da
121BBB6E
E8
DF
F1
DD
D8
0F
86
9E
00
00
00
83
EC
0C
57
E8
gemaddy
00C10000
PlayerMove:JumpCalculations