3
"Get 10 Training Points instead of spending them when learning something"
Auto Assembler Script
[ENABLE]
aobscanmodule(tp,Siege.exe,01 B3 31 02 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
mov esi,#10
code:
add [ebx+00000231],esi
jmp return
tp:
jmp newmem
nop
return:
registersymbol(tp)
[DISABLE]
tp:
db 01 B3 31 02 00 00
unregistersymbol(tp)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Siege.exe+2E483A
Siege.exe+2E4818: 8B D8 - mov ebx,eax
Siege.exe+2E481A: A1 1C 7E BF 00 - mov eax,[Siege.exe+3F7E1C]
Siege.exe+2E481F: 8B 00 - mov eax,[eax]
Siege.exe+2E4821: 8B 15 FC 6A BF 00 - mov edx,[Siege.exe+3F6AFC]
Siege.exe+2E4827: E8 14 B4 04 00 - call Siege.exe+32FC40
Siege.exe+2E482C: 33 D2 - xor edx,edx
Siege.exe+2E482E: 55 - push ebp
Siege.exe+2E482F: 68 5B 48 AE 00 - push Siege.exe+2E485B
Siege.exe+2E4834: 64 FF 32 - push fs:[edx]
Siege.exe+2E4837: 64 89 22 - mov fs:[edx],esp
// ---------- INJECTING HERE ----------
Siege.exe+2E483A: 01 B3 31 02 00 00 - add [ebx+00000231],esi
// ---------- DONE INJECTING ----------
Siege.exe+2E4840: 83 BB 31 02 00 00 00 - cmp dword ptr [ebx+00000231],00
Siege.exe+2E4847: 7D 08 - jnl Siege.exe+2E4851
Siege.exe+2E4849: 33 C0 - xor eax,eax
Siege.exe+2E484B: 89 83 31 02 00 00 - mov [ebx+00000231],eax
Siege.exe+2E4851: 33 C0 - xor eax,eax
Siege.exe+2E4853: 5A - pop edx
Siege.exe+2E4854: 59 - pop ecx
Siege.exe+2E4855: 59 - pop ecx
Siege.exe+2E4856: 64 89 10 - mov fs:[eax],edx
Siege.exe+2E4859: EB 2E - jmp Siege.exe+2E4889
}
11
"Charakter Data Base Stats (press 'c' to cheat..ehrm update address)"
Auto Assembler Script
[ENABLE]
aobscanmodule(stats,Siege.exe,8B 80 88 04 00 00 89 83 B1) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
globalalloc(char_data,4)
newmem:
code:
mov [char_data],eax
mov eax,[eax+00000488]
jmp return
stats:
jmp newmem
nop
return:
registersymbol(stats)
[DISABLE]
stats:
db 8B 80 88 04 00 00
unregistersymbol(stats)
dealloc(newmem)
dealloc(char_data)
{
// ORIGINAL CODE - INJECTION POINT: Siege.exe+35724C
Siege.exe+35721A: 81 C6 CC 04 00 00 - add esi,000004CC
Siege.exe+357220: 8D BB 09 0A 00 00 - lea edi,[ebx+00000A09]
Siege.exe+357226: B9 16 00 00 00 - mov ecx,00000016
Siege.exe+35722B: F3 A5 - repe movsd
Siege.exe+35722D: 8B B3 D9 0B 00 00 - mov esi,[ebx+00000BD9]
Siege.exe+357233: 81 C6 24 05 00 00 - add esi,00000524
Siege.exe+357239: 8D BB 61 0A 00 00 - lea edi,[ebx+00000A61]
Siege.exe+35723F: B9 14 00 00 00 - mov ecx,00000014
Siege.exe+357244: F3 A5 - repe movsd
Siege.exe+357246: 8B 83 D9 0B 00 00 - mov eax,[ebx+00000BD9]
// ---------- INJECTING HERE ----------
Siege.exe+35724C: 8B 80 88 04 00 00 - mov eax,[eax+00000488]
// ---------- DONE INJECTING ----------
Siege.exe+357252: 89 83 B1 0A 00 00 - mov [ebx+00000AB1],eax
Siege.exe+357258: 8B 83 D9 0B 00 00 - mov eax,[ebx+00000BD9]
Siege.exe+35725E: 8B 80 8C 04 00 00 - mov eax,[eax+0000048C]
Siege.exe+357264: 89 83 B5 0A 00 00 - mov [ebx+00000AB5],eax
Siege.exe+35726A: 8B 83 D9 0B 00 00 - mov eax,[ebx+00000BD9]
Siege.exe+357270: 8B 80 90 04 00 00 - mov eax,[eax+00000490]
Siege.exe+357276: 89 83 B9 0A 00 00 - mov [ebx+00000AB9],eax
Siege.exe+35727C: 8B 83 D9 0B 00 00 - mov eax,[ebx+00000BD9]
Siege.exe+357282: 8B 80 A4 04 00 00 - mov eax,[eax+000004A4]
Siege.exe+357288: 89 83 BD 0A 00 00 - mov [ebx+00000ABD],eax
}
20
"change equipment to copy values to CURRENT stats"
FF0000
1
12
"Strength"
0
4 Bytes
[char_data]+488
13
"Coordination"
0
4 Bytes
[char_data]+48c
14
"Constitution"
0
4 Bytes
[char_data]+490
15
"Mystique"
0
4 Bytes
[char_data]+494
16
"Fightpower"
0
4 Bytes
[char_data]+498
17
"Sneakiness"
0
4 Bytes
[char_data]+49c
18
"Cleverness"
0
4 Bytes
[char_data]+4a4
19
"Crowns ($$$)"
0
4 Bytes
[char_data]+27a
24
"Damage Taken"
0
Double
[char_data]+2e4
27
"Mana Spent"
0
FF0000
Double
[char_data]+2ec
28
"GodMode (at least according to my tests)"
Auto Assembler Script
[ENABLE]
aobscanmodule(godmode,Siege.exe,D8 45 0C DD 9B E4 02 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
cmp [ebx+5F8],0 // check if enemy
je code // if enemy, do the usual code
mov [ebp+0c],0 // otherwise (if player): reduce damage to zero
code:
fadd dword ptr [ebp+0C]
fstp qword ptr [ebx+000002E4]
jmp return
godmode:
jmp newmem
nop 4
return:
registersymbol(godmode)
[DISABLE]
godmode:
db D8 45 0C DD 9B E4 02 00 00
unregistersymbol(godmode)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Siege.exe+2E0BD3
Siege.exe+2E0BB7: EB 02 - jmp Siege.exe+2E0BBB
Siege.exe+2E0BB9: 8B F7 - mov esi,edi
Siege.exe+2E0BBB: D9 EE - fldz
Siege.exe+2E0BBD: D9 83 B4 04 00 00 - fld dword ptr [ebx+000004B4]
Siege.exe+2E0BC3: DA E9 - fucompp
Siege.exe+2E0BC5: 9B DF E0 - wait:fstsw ax
Siege.exe+2E0BC8: 9E - sahf
Siege.exe+2E0BC9: 7A 02 - jp Siege.exe+2E0BCD
Siege.exe+2E0BCB: 76 10 - jna Siege.exe+2E0BDD
Siege.exe+2E0BCD: DD 83 E4 02 00 00 - fld qword ptr [ebx+000002E4]
// ---------- INJECTING HERE ----------
Siege.exe+2E0BD3: D8 45 0C - fadd dword ptr [ebp+0C]
// ---------- DONE INJECTING ----------
Siege.exe+2E0BD6: DD 9B E4 02 00 00 - fstp qword ptr [ebx+000002E4]
Siege.exe+2E0BDC: 9B - wait
Siege.exe+2E0BDD: DD 83 E4 02 00 00 - fld qword ptr [ebx+000002E4]
Siege.exe+2E0BE3: D9 83 D7 01 00 00 - fld dword ptr [ebx+000001D7]
Siege.exe+2E0BE9: DA E9 - fucompp
Siege.exe+2E0BEB: 9B DF E0 - wait:fstsw ax
Siege.exe+2E0BEE: 9E - sahf
Siege.exe+2E0BEF: 0F 87 CB 02 00 00 - ja Siege.exe+2E0EC0
Siege.exe+2E0BF5: D9 EE - fldz
Siege.exe+2E0BF7: D9 83 B4 04 00 00 - fld dword ptr [ebx+000004B4]
}
char_data
00400000