114982
"<=== Attach to process"
0000FF
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if(getCEVersion() < 7.4) then
ShowMessage('Warning! CE version should be 7.4 or above')
end
OpenProcess("Zoria AoS.exe")
if(process == nil) then
ShowMessage('The process is NOT found!')
end
{$asm}
[DISABLE]
114991
"GodMode and One-Hit-Kill 2"
Auto Assembler Script
[ENABLE]
aobscanmodule(health,GameAssembly.dll,89 47 28 48 8B 47 70) // should be unique
alloc(newmem,$1000,health)
label(code)
label(return)
label(godmode)
label(onehit)
label(godmode_on)
label(onehit_on)
newmem:
cmp [rdi+88],0 // check if it's us (Enemys have no followers)
jne godmode // if so, see if we want to be invulnerable
jmp onehit // if it's not us, see if one-hit-kills is on
godmode:
cmp byte ptr [godmode_on],1 // check if godmode-box is activated
jne code // if not, back to the normal code
mov eax,#9999 // fill up life
jmp code // and go back to the normal code
onehit:
cmp byte ptr [onehit_on],1 // check if one-hit-kill is activated
jne code // if not, back to the normal code
mov eax,#0 // set the new amount of enemys life to zero
code:
mov [rdi+28],eax
mov rax,[rdi+70]
jmp return
godmode_on:
db 0
onehit_on:
db 0
health:
jmp newmem
nop 2
return:
registersymbol(health godmode_on onehit_on)
[DISABLE]
health:
db 89 47 28 48 8B 47 70
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+20C18F6
GameAssembly.dll+20C18D5: 8B E8 - mov ebp,eax
GameAssembly.dll+20C18D7: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll+20C18DE: 75 05 - jne GameAssembly.dll+20C18E5
GameAssembly.dll+20C18E0: E8 9B 2F 10 FE - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+20C18E5: 45 33 C9 - xor r9d,r9d
GameAssembly.dll+20C18E8: 44 8B C5 - mov r8d,ebp
GameAssembly.dll+20C18EB: 33 D2 - xor edx,edx
GameAssembly.dll+20C18ED: 8B CB - mov ecx,ebx
GameAssembly.dll+20C18EF: E8 6C 2E 19 FF - call GameAssembly.dll+1254760
GameAssembly.dll+20C18F4: 8B D8 - mov ebx,eax
// ---------- INJECTING HERE ----------
GameAssembly.dll+20C18F6: 89 47 28 - mov [rdi+28],eax
// ---------- DONE INJECTING ----------
GameAssembly.dll+20C18F9: 48 8B 47 70 - mov rax,[rdi+70]
GameAssembly.dll+20C18FD: 2B DE - sub ebx,esi
GameAssembly.dll+20C18FF: 48 85 C0 - test rax,rax
GameAssembly.dll+20C1902: 74 13 - je GameAssembly.dll+20C1917
GameAssembly.dll+20C1904: 4C 8B 48 28 - mov r9,[rax+28]
GameAssembly.dll+20C1908: 44 8B C3 - mov r8d,ebx
GameAssembly.dll+20C190B: 48 8B 48 40 - mov rcx,[rax+40]
GameAssembly.dll+20C190F: BA 0D 00 00 00 - mov edx,0000000D
GameAssembly.dll+20C1914: FF 50 18 - call qword ptr [rax+18]
GameAssembly.dll+20C1917: 8B C3 - mov eax,ebx
}
114985
"GodMode"
Auto Assembler Script
[ENABLE]
godmode_on:
db 1
[DISABLE]
godmode_on:
db 0
114984
"OneHit Kill"
Auto Assembler Script
[ENABLE]
onehit_on:
db 1
[DISABLE]
onehit_on:
db 0
103
"Instead of loosing money/supplies/mats: get +100 each time"
Auto Assembler Script
[ENABLE]
aobscanmodule(ressources,GameAssembly.dll,03 CA 89 4B 38) // should be unique
alloc(newmem,$1000,ressources)
label(code)
label(return)
newmem:
mov edx,#100
code:
add ecx,edx
mov [rbx+38],ecx
jmp return
ressources:
jmp newmem
return:
registersymbol(ressources)
[DISABLE]
ressources:
db 03 CA 89 4B 38
unregistersymbol(ressources)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+1D0DEB6
GameAssembly.dll+1D0DE9E: CC - int 3
GameAssembly.dll+1D0DE9F: CC - int 3
GameAssembly.dll+1D0DEA0: 48 89 5C 24 08 - mov [rsp+08],rbx
GameAssembly.dll+1D0DEA5: 57 - push rdi
GameAssembly.dll+1D0DEA6: 48 83 EC 20 - sub rsp,20
GameAssembly.dll+1D0DEAA: 8B FA - mov edi,edx
GameAssembly.dll+1D0DEAC: 48 8B D9 - mov rbx,rcx
GameAssembly.dll+1D0DEAF: 85 D2 - test edx,edx
GameAssembly.dll+1D0DEB1: 74 23 - je GameAssembly.dll+1D0DED6
GameAssembly.dll+1D0DEB3: 8B 49 38 - mov ecx,[rcx+38]
// ---------- INJECTING HERE ----------
GameAssembly.dll+1D0DEB6: 03 CA - add ecx,edx
// ---------- DONE INJECTING ----------
GameAssembly.dll+1D0DEB8: 89 4B 38 - mov [rbx+38],ecx
GameAssembly.dll+1D0DEBB: 45 84 C0 - test r8l,r8b
GameAssembly.dll+1D0DEBE: 74 26 - je GameAssembly.dll+1D0DEE6
GameAssembly.dll+1D0DEC0: 33 D2 - xor edx,edx
GameAssembly.dll+1D0DEC2: 48 8B CB - mov rcx,rbx
GameAssembly.dll+1D0DEC5: E8 F6 79 FE FF - call GameAssembly.dll+1CF58C0
GameAssembly.dll+1D0DECA: 8B 4B 38 - mov ecx,[rbx+38]
GameAssembly.dll+1D0DECD: 84 C0 - test al,al
GameAssembly.dll+1D0DECF: 75 12 - jne GameAssembly.dll+1D0DEE3
GameAssembly.dll+1D0DED1: 2B CF - sub ecx,edi
}
118
"Items with more than 1 item in stock do not decrease"
Auto Assembler Script
[ENABLE]
aobscanmodule(dealer,GameAssembly.dll,89 51 38 89 51 3C) // should be unique
alloc(newmem,$1000,dealer)
label(code)
label(return)
newmem:
code:
mov [rcx+38],edx
// mov [rcx+3C],edx
jmp return
dealer:
jmp newmem
nop
return:
registersymbol(dealer)
[DISABLE]
dealer:
db 89 51 38 89 51 3C
unregistersymbol(dealer)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+1D0DF40
GameAssembly.dll+1D0DF36: CC - int 3
GameAssembly.dll+1D0DF37: CC - int 3
GameAssembly.dll+1D0DF38: CC - int 3
GameAssembly.dll+1D0DF39: CC - int 3
GameAssembly.dll+1D0DF3A: CC - int 3
GameAssembly.dll+1D0DF3B: CC - int 3
GameAssembly.dll+1D0DF3C: CC - int 3
GameAssembly.dll+1D0DF3D: CC - int 3
GameAssembly.dll+1D0DF3E: CC - int 3
GameAssembly.dll+1D0DF3F: CC - int 3
// ---------- INJECTING HERE ----------
GameAssembly.dll+1D0DF40: 89 51 38 - mov [rcx+38],edx
// ---------- DONE INJECTING ----------
GameAssembly.dll+1D0DF43: 89 51 3C - mov [rcx+3C],edx
GameAssembly.dll+1D0DF46: C3 - ret
GameAssembly.dll+1D0DF47: CC - int 3
GameAssembly.dll+1D0DF48: CC - int 3
GameAssembly.dll+1D0DF49: CC - int 3
GameAssembly.dll+1D0DF4A: CC - int 3
GameAssembly.dll+1D0DF4B: CC - int 3
GameAssembly.dll+1D0DF4C: CC - int 3
GameAssembly.dll+1D0DF4D: CC - int 3
GameAssembly.dll+1D0DF4E: CC - int 3
}
77
"Get Adress of selected character (activate and select a char)"
Auto Assembler Script
[ENABLE]
aobscanmodule(charaddress,GameAssembly.dll,40 5F C3 48 8B 15 * * * * 4C 8B 03 0F B6 82 30 01 00 00) // should be unique
alloc(newmem,$100,charaddress)
alloc(character,8)
label(code)
label(return)
newmem:
mov [character],rbx
code:
mov r8,[rbx]
movzx eax,byte ptr [rdx+00000130]
jmp return
charaddress+0A:
jmp newmem
nop 5
return:
registersymbol(charaddress character)
[DISABLE]
charaddress+0A:
db 4C 8B 03 0F B6 82 30 01 00 00
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+1FC1B63
GameAssembly.dll+1FC1B3A: 48 8B 89 B8 00 00 00 - mov rcx,[rcx+000000B8]
GameAssembly.dll+1FC1B41: 48 8B 09 - mov rcx,[rcx]
GameAssembly.dll+1FC1B44: 48 89 4C 24 20 - mov [rsp+20],rcx
GameAssembly.dll+1FC1B49: 48 8B CF - mov rcx,rdi
GameAssembly.dll+1FC1B4C: E8 DF ED FF FF - call FollowerStatEntry.SetStatText
GameAssembly.dll+1FC1B51: 48 8B 5C 24 50 - mov rbx,[rsp+50]
GameAssembly.dll+1FC1B56: 48 83 C4 40 - add rsp,40
GameAssembly.dll+1FC1B5A: 5F - pop rdi
GameAssembly.dll+1FC1B5B: C3 - ret
GameAssembly.dll+1FC1B5C: 48 8B 15 6D 47 98 00 - mov rdx,[GameAssembly.dll+29462D0]
// ---------- INJECTING HERE ----------
GameAssembly.dll+1FC1B63: 4C 8B 03 - mov r8,[rbx]
// ---------- DONE INJECTING ----------
GameAssembly.dll+1FC1B66: 0F B6 82 30 01 00 00 - movzx eax,byte ptr [rdx+00000130]
GameAssembly.dll+1FC1B6D: 41 38 80 30 01 00 00 - cmp [r8+00000130],al
GameAssembly.dll+1FC1B74: 0F 82 25 01 00 00 - jb GameAssembly.dll+1FC1C9F
GameAssembly.dll+1FC1B7A: 0F B6 C8 - movzx ecx,al
GameAssembly.dll+1FC1B7D: 49 8B 80 C8 00 00 00 - mov rax,[r8+000000C8]
GameAssembly.dll+1FC1B84: 48 39 54 C8 F8 - cmp [rax+rcx*8-08],rdx
GameAssembly.dll+1FC1B89: 0F 85 10 01 00 00 - jne GameAssembly.dll+1FC1C9F
GameAssembly.dll+1FC1B8F: 80 3D DC 10 B5 00 00 - cmp byte ptr [GameAssembly.dll+2B12C72],00
GameAssembly.dll+1FC1B96: 75 13 - jne GameAssembly.dll+1FC1BAB
GameAssembly.dll+1FC1B98: 48 8D 0D 41 ED 99 00 - lea rcx,[GameAssembly.dll+29608E0]
}
84
"Characters Base Address"
0
1
character
0
78
"HP"
0
0000FF
4 Bytes
+28
79
"Level"
0
4 Bytes
+2c
80
"Shield Points"
0
4 Bytes
+30
81
"Mana"
0
FF0000
4 Bytes
+34
82
"BaseMana"
0
4 Bytes
+38
83
"Character Name"
0
String
20
1
0
1
+40
14
78
98
"Experience Points"
0
4 Bytes
+80
100
"Availabe Stats Points"
0
4 Bytes
+84
86
"Abilities (extend to your own needs...)"
0
1
+40
0
10
50
87
"Count"
0
4 Bytes
+18
88
"Item[0]"
0
1
+20
0
89
"ID"
0
4 Bytes
+10
90
"Name"
0
String
20
1
0
1
+18
14
91
"Manachange"
0
4 Bytes
+74
92
"Action Points"
0
4 Bytes
+7c
93
"Item[1]"
0
1
+28
0
94
"ID"
0
4 Bytes
+10
95
"Name"
0
String
20
1
0
1
+18
14
96
"Manachange"
0
4 Bytes
+74
97
"Action Points"
0
4 Bytes
+7c
rbx = base address
rbx+28 = health (4byte int). there are 2 floats but these are mirrored values
rbx +48 +30 +30 = gameCharacterType. 1=PC
this would, in theory, be the best way to do it.
But checking this crashes the game...
possible alternatives:
rbx +cc (0 = we)
rbx +dc (0 = they)
rbx +e4 (0 = they)