114982
"<=== Attach to process and activate mono"
0000FF
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if(getCEVersion() < 7.4) then
ShowMessage('Warning! CE version should be 7.4 or above')
end
OpenProcess("Stolen Realm.exe")
if(process == nil) then
ShowMessage('The process is NOT found!')
end
LaunchMonoDataCollector()
{$asm}
// LuaCall(function cycleFullCompact(sender,force) local state = not(compactmenuitem.Caption == 'Compact View Mode'); if force~=nil then state = not force end; compactmenuitem.Caption = state and 'Compact View Mode' or 'Full View Mode'; getMainForm().Splitter1.Visible = state; getMainForm().Panel4.Visible = state; getMainForm().Panel5.Visible = state; end; function addCompactMenu() if compactmenualreadyexists then return end; local parent = getMainForm().Menu.Items; compactmenuitem = createMenuItem(parent); parent.add(compactmenuitem); compactmenuitem.Caption = 'Compact View Mode'; compactmenuitem.OnClick = cycleFullCompact; compactmenualreadyexists = 'yes'; end; addCompactMenu(); cycleFullCompact(nil,true))
[DISABLE]
// LuaCall(cycleFullCompact(nil,false))
114997
"Enable Cheat Mode"
Auto Assembler Script
define(address,DebugWindow:Update+23)
define(bytes,0F B6 86 81 01 00 00)
define(address2,DebugWindow:SubmitPassword+6d)
define(bytes2,0F 84 4A 00 00 00)
[ENABLE]
assert(address,bytes)
assert(address2,bytes2)
alloc(newmem,$100,DebugWindow:Update+23)
label(code)
label(return)
newmem:
mov eax,1
mov [rsi+181],eax
code:
movzx eax,byte ptr [rsi+00000181]
jmp return
address:
jmp newmem
nop 2
return:
address2:
nop
nop
nop
nop
nop
nop
[DISABLE]
address:
db bytes
// movzx eax,byte ptr [rsi+00000181]
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: DebugWindow:Update+23
DebugWindow:Update: 55 - push rbp
DebugWindow:Update+1: 48 8B EC - mov rbp,rsp
DebugWindow:Update+4: 48 83 EC 70 - sub rsp,70
DebugWindow:Update+8: 48 89 75 D0 - mov [rbp-30],rsi
DebugWindow:Update+c: 48 89 7D D8 - mov [rbp-28],rdi
DebugWindow:Update+10: 4C 89 65 E0 - mov [rbp-20],r12
DebugWindow:Update+14: 4C 89 6D E8 - mov [rbp-18],r13
DebugWindow:Update+18: 4C 89 75 F0 - mov [rbp-10],r14
DebugWindow:Update+1c: 4C 89 7D F8 - mov [rbp-08],r15
DebugWindow:Update+20: 48 8B F1 - mov rsi,rcx
// ---------- INJECTING HERE ----------
DebugWindow:Update+23: 0F B6 86 81 01 00 00 - movzx eax,byte ptr [rsi+00000181]
// ---------- DONE INJECTING ----------
DebugWindow:Update+2a: 85 C0 - test eax,eax
DebugWindow:Update+2c: 0F 84 71 00 00 00 - je DebugWindow:Update+a3
DebugWindow:Update+32: B9 02 00 00 00 - mov ecx,00000002
DebugWindow:Update+37: 48 8D AD 00 00 00 00 - lea rbp,[rbp+00000000]
DebugWindow:Update+3e: 49 BB E0 AA C7 7A BE 01 00 00 - mov r11,UnityEngine.Input:GetMouseButtonDown
DebugWindow:Update+48: 41 FF D3 - call r11
DebugWindow:Update+4b: 85 C0 - test eax,eax
DebugWindow:Update+4d: 0F 84 50 00 00 00 - je DebugWindow:Update+a3
DebugWindow:Update+53: 48 8B 86 60 01 00 00 - mov rax,[rsi+00000160]
DebugWindow:Update+5a: 48 8B C8 - mov rcx,rax
}
114998
"after enabling, make a click with the middle mouse button (wheel)"
1
114999
"when asked for the password (shot not happen), enter "fortherealm01!""
1
115003
"Enemy has less actions (and some fooling around without sense)"
Auto Assembler Script
define(address,Character:get_Item+75)
define(bytes,83 38 00 48 8D 64 24 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,Character:get_Item+75)
label(code)
label(return)
label(enemy)
newmem:
cmp dword ptr [rax],00
je code
mov r11,[rax+10]
//cmp [r11+250],0 // TeamID = 0? if yes, it is the player
cmp [r11+130],0 // CharacterSaveFile set
je enemy
mov [r11+2f0],0 // we have not used any action points this round
mov byte ptr [r11+259],0 // isDead = 0, it's a single byte flag
mov [r11+2b4],(float)0.0 // with no death-time
mov [r11+2d0],(float)1.0 // and has full health
mov [r11+2f4],0 // action NOT completed
jmp code
enemy:
mov [r11+28a],1 // end the turn for this character
mov [r11+2f0],10 // uses up his AP
mov [r11+2f4],1 // action completed
code:
lea rsp,[rsp+00]
jmp return
address:
jmp newmem
nop 3
return:
[DISABLE]
address:
db bytes
// cmp dword ptr [rax],00
// lea rsp,[rsp+00]
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Character:get_Item+75
Character:get_Item+4d: 90 - nop
Character:get_Item+4e: 49 BB A0 DA BC 11 13 02 00 00 - mov r11,UnityEngine.Object:op_Inequality
Character:get_Item+58: 41 FF D3 - call r11
Character:get_Item+5b: 85 C0 - test eax,eax
Character:get_Item+5d: 0F 84 35 00 00 00 - je Character:get_Item+98
Character:get_Item+63: 48 8B CF - mov rcx,rdi
Character:get_Item+66: 48 8B 07 - mov rax,[rdi]
Character:get_Item+69: FF 90 B0 07 00 00 - call qword ptr [rax+000007B0]
Character:get_Item+6f: 48 8B C8 - mov rcx,rax
Character:get_Item+72: 48 8B D6 - mov rdx,rsi
// ---------- INJECTING HERE ----------
Character:get_Item+75: 83 38 00 - cmp dword ptr [rax],00
// ---------- DONE INJECTING ----------
Character:get_Item+78: 48 8D 64 24 00 - lea rsp,[rsp+00]
Character:get_Item+7d: 90 - nop
Character:get_Item+7e: 49 BB 40 6C 47 AA 14 02 00 00 - mov r11,Burst2Flame.Observable.ObservableDictionary`2[System.String,System.Single]:get_Item
Character:get_Item+88: 41 FF D3 - call r11
Character:get_Item+8b: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
Character:get_Item+8f: F2 0F 5A C0 - cvtsd2ss xmm0,xmm0
Character:get_Item+93: E9 D3 00 00 00 - jmp Character:get_Item+16b
Character:get_Item+98: 48 8D 64 24 00 - lea rsp,[rsp+00]
Character:get_Item+9d: 90 - nop
Character:get_Item+9e: 49 BB 10 27 A7 82 14 02 00 00 - mov r11,Burst2Flame.Game:get_Instance
}
115011
"Fetch Player Pointers"
Auto Assembler Script
//dharmang1910
[ENABLE]
assert(Character:get_Item+75,83 38 00 48 8D 64 24 00)
alloc(newmem,2048,Character:get_Item+75)
label(returnhere)
label(originalcode)
label(exit)
newmem:
{$luacode xBase=rax}
if readPointer(readPointer(xBase+0x10)+0x130) ~= 0 then
local id = readInteger(readPointer(xBase+0x10)+0x304)
local base = readPointer(readPointer(xBase+0x40)+0x18)
registerSymbol('Dictionary'..id,base)
end
{$asm}
originalcode:
cmp dword ptr [rax],00
lea rsp,[rsp+00]
exit:
jmp returnhere
Character:get_Item+75:
jmp newmem
nop 3
returnhere:
[DISABLE]
dealloc(newmem)
Character:get_Item+75:
cmp dword ptr [rax],00
lea rsp,[rsp+00]
//Alt: db 83 38 00 48 8D 64 24 00
115012
"Health"
0
0000FF
Float
Dictionary0+30
115013
"Mana"
0
FF0000
Float
Dictionary0+48
7
"Health"
0
0000FF
Float
Dictionary1+30
8
"Mana"
0
FF0000
Float
Dictionary1+48
115014
"Health"
0
0000FF
Float
Dictionary2+30
115015
"Mana"
0
FF0000
Float
Dictionary2+48
115016
"Health"
0
0000FF
Float
Dictionary3+30
115017
"Mana"
0
FF0000
Float
Dictionary3+48
115018
"Health"
0
0000FF
Float
Dictionary4+30
115019
"Mana"
0
FF0000
Float
Dictionary4+48
115020
"Health"
0
0000FF
Float
Dictionary5+30
115021
"Mana"
0
FF0000
Float
Dictionary5+48
Dictionary
229813AEE00
Dictionary0
2188180CC40
Dictionary1
2188180C700
Dictionary3
218818158C0
Dictionary4
21881815540
Dictionary2
2188180C1C0
Dictionary5
218818151C0
Offsezs starting at "Healthbar"-Structure:
+18 +38 +14 = Name of the Character
+18 +240 = if 0 then it's the player (OwnerID)
+18 +250 = if 0 then it's the player (TeamIndex)
+18 +28a = ended Turn 0/1
+70 = max health
+74 = current health