114982
"<=== Attach to process and activate mono"
0000FF
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if(getCEVersion() < 7.4) then
ShowMessage('Warning! CE version should be 7.4 or above')
end
OpenProcess("TheThaumaturge-Win64-Shipping.exe")
if(process == nil) then
ShowMessage('The process is NOT found!')
end
{$asm}
[DISABLE]
114984
"Keep 10 Points available when learning a skill"
Auto Assembler Script
[ENABLE]
aobscanmodule(points,TheThaumaturge-Win64-Shipping.exe,8B 59 30 89 5C 24 30) // should be unique
alloc(newmem,$1000,points)
label(code)
label(return)
newmem:
mov ebx,#10
mov [rcx+30],ebx
code:
mov ebx,[rcx+30]
mov [rsp+30],ebx
jmp return
points:
jmp newmem
nop 2
return:
registersymbol(points)
[DISABLE]
points:
db 8B 59 30 89 5C 24 30
unregistersymbol(points)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: TheThaumaturge-Win64-Shipping.exe+2644542
TheThaumaturge-Win64-Shipping.exe+264452C: CC - int 3
TheThaumaturge-Win64-Shipping.exe+264452D: CC - int 3
TheThaumaturge-Win64-Shipping.exe+264452E: CC - int 3
TheThaumaturge-Win64-Shipping.exe+264452F: CC - int 3
TheThaumaturge-Win64-Shipping.exe+2644530: 40 57 - push rdi
TheThaumaturge-Win64-Shipping.exe+2644532: 48 83 EC 20 - sub rsp,20
TheThaumaturge-Win64-Shipping.exe+2644536: 48 8B F9 - mov rdi,rcx
TheThaumaturge-Win64-Shipping.exe+2644539: 85 D2 - test edx,edx
TheThaumaturge-Win64-Shipping.exe+264453B: 74 47 - je TheThaumaturge-Win64-Shipping.exe+2644584
TheThaumaturge-Win64-Shipping.exe+264453D: 48 89 5C 24 38 - mov [rsp+38],rbx
// ---------- INJECTING HERE ----------
TheThaumaturge-Win64-Shipping.exe+2644542: 8B 59 30 - mov ebx,[rcx+30]
// ---------- DONE INJECTING ----------
TheThaumaturge-Win64-Shipping.exe+2644545: 89 5C 24 30 - mov [rsp+30],ebx
TheThaumaturge-Win64-Shipping.exe+2644549: 8D 04 13 - lea eax,[rbx+rdx]
TheThaumaturge-Win64-Shipping.exe+264454C: 89 41 30 - mov [rcx+30],eax
TheThaumaturge-Win64-Shipping.exe+264454F: 48 8D 54 24 30 - lea rdx,[rsp+30]
TheThaumaturge-Win64-Shipping.exe+2644554: 48 81 C1 C8 02 00 00 - add rcx,000002C8
TheThaumaturge-Win64-Shipping.exe+264455B: 89 44 24 34 - mov [rsp+34],eax
TheThaumaturge-Win64-Shipping.exe+264455F: E8 FC DA 55 FE - call TheThaumaturge-Win64-Shipping.AK::WriteBytesMem::Bytes+1740
TheThaumaturge-Win64-Shipping.exe+2644564: 44 8B 47 30 - mov r8d,[rdi+30]
TheThaumaturge-Win64-Shipping.exe+2644568: 48 8D 8F D8 02 00 00 - lea rcx,[rdi+000002D8]
TheThaumaturge-Win64-Shipping.exe+264456F: 8B D3 - mov edx,ebx
}
114986
"Get Adresses (activate and press "O" to update address)"
Auto Assembler Script
[ENABLE]
aobscanmodule(getaddy,TheThaumaturge-Win64-Shipping.exe,8B 81 00 01 00 00 41 89 00) // should be unique
alloc(newmem,$1000,getaddy)
label(code)
label(return)
label(chardata)
newmem:
mov [chardata],rcx
code:
mov eax,[rcx+00000100]
jmp return
chardata:
dq 0
getaddy:
jmp newmem
nop
return:
registersymbol(getaddy chardata)
[DISABLE]
getaddy:
db 8B 81 00 01 00 00
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: TheThaumaturge-Win64-Shipping.exe+D796C5
TheThaumaturge-Win64-Shipping.exe+D796AC: CC - int 3
TheThaumaturge-Win64-Shipping.exe+D796AD: CC - int 3
TheThaumaturge-Win64-Shipping.exe+D796AE: CC - int 3
TheThaumaturge-Win64-Shipping.exe+D796AF: CC - int 3
TheThaumaturge-Win64-Shipping.exe+D796B0: 48 8B 42 20 - mov rax,[rdx+20]
TheThaumaturge-Win64-Shipping.exe+D796B4: 45 33 C9 - xor r9d,r9d
TheThaumaturge-Win64-Shipping.exe+D796B7: 48 85 C0 - test rax,rax
TheThaumaturge-Win64-Shipping.exe+D796BA: 41 0F 95 C1 - setne r9b
TheThaumaturge-Win64-Shipping.exe+D796BE: 4C 03 C8 - add r9,rax
TheThaumaturge-Win64-Shipping.exe+D796C1: 4C 89 4A 20 - mov [rdx+20],r9
// ---------- INJECTING HERE ----------
TheThaumaturge-Win64-Shipping.exe+D796C5: 8B 81 00 01 00 00 - mov eax,[rcx+00000100]
// ---------- DONE INJECTING ----------
TheThaumaturge-Win64-Shipping.exe+D796CB: 41 89 00 - mov [r8],eax
TheThaumaturge-Win64-Shipping.exe+D796CE: C3 - ret
TheThaumaturge-Win64-Shipping.exe+D796CF: CC - int 3
TheThaumaturge-Win64-Shipping.exe+D796D0: 48 89 5C 24 08 - mov [rsp+08],rbx
TheThaumaturge-Win64-Shipping.exe+D796D5: 48 89 74 24 10 - mov [rsp+10],rsi
TheThaumaturge-Win64-Shipping.exe+D796DA: 57 - push rdi
TheThaumaturge-Win64-Shipping.exe+D796DB: 48 83 EC 30 - sub rsp,30
TheThaumaturge-Win64-Shipping.exe+D796DF: 33 FF - xor edi,edi
TheThaumaturge-Win64-Shipping.exe+D796E1: 0F 57 C0 - xorps xmm0,xmm0
TheThaumaturge-Win64-Shipping.exe+D796E4: 48 8B F1 - mov rsi,rcx
}
114987
"Chardata"
0
1
chardata
0
114988
"Available Thaumaturgy-Points"
0
4 Bytes
+30
114989
"Experience"
0
4 Bytes
+100
115021
"Vice: Pride ?"
0
4 Bytes
+1d8
115015
"Debug"
C0C0C0
1
115010
"Prevent Damage in Fights"
Auto Assembler Script
[ENABLE]
aobscanmodule(godmode,TheThaumaturge-Win64-Shipping.exe,CC F3 0F 11 49 08 C3) // should be unique
alloc(newmem,$1000,godmode)
label(code)
label(return)
newmem:
code:
// movss [rcx+08],xmm1
jmp return
godmode+01:
jmp newmem
return:
registersymbol(godmode)
[DISABLE]
godmode+01:
db F3 0F 11 49 08
unregistersymbol(godmode)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: TheThaumaturge-Win64-Shipping.exe+13D7530
TheThaumaturge-Win64-Shipping.exe+13D7510: 49 8B CE - mov rcx,r14
TheThaumaturge-Win64-Shipping.exe+13D7513: 48 8B C7 - mov rax,rdi
TheThaumaturge-Win64-Shipping.exe+13D7516: 48 8B 5C 24 30 - mov rbx,[rsp+30]
TheThaumaturge-Win64-Shipping.exe+13D751B: 48 8B 74 24 38 - mov rsi,[rsp+38]
TheThaumaturge-Win64-Shipping.exe+13D7520: 48 8B 7C 24 40 - mov rdi,[rsp+40]
TheThaumaturge-Win64-Shipping.exe+13D7525: 48 83 C4 20 - add rsp,20
TheThaumaturge-Win64-Shipping.exe+13D7529: 41 5E - pop r14
TheThaumaturge-Win64-Shipping.exe+13D752B: 48 FF E0 - jmp rax
TheThaumaturge-Win64-Shipping.exe+13D752E: CC - int 3
TheThaumaturge-Win64-Shipping.exe+13D752F: CC - int 3
// ---------- INJECTING HERE ----------
TheThaumaturge-Win64-Shipping.exe+13D7530: F3 0F 11 49 08 - movss [rcx+08],xmm1
// ---------- DONE INJECTING ----------
TheThaumaturge-Win64-Shipping.exe+13D7535: C3 - ret
TheThaumaturge-Win64-Shipping.exe+13D7536: CC - int 3
TheThaumaturge-Win64-Shipping.exe+13D7537: CC - int 3
TheThaumaturge-Win64-Shipping.exe+13D7538: CC - int 3
TheThaumaturge-Win64-Shipping.exe+13D7539: CC - int 3
TheThaumaturge-Win64-Shipping.exe+13D753A: CC - int 3
TheThaumaturge-Win64-Shipping.exe+13D753B: CC - int 3
TheThaumaturge-Win64-Shipping.exe+13D753C: CC - int 3
TheThaumaturge-Win64-Shipping.exe+13D753D: CC - int 3
TheThaumaturge-Win64-Shipping.exe+13D753E: CC - int 3
}
115014
"HPs (example Value - it's a float)"
Float
1D77B3B757C
115018
"Find Health Adress during combat"
Auto Assembler Script
[ENABLE]
aobscanmodule(health,TheThaumaturge-Win64-Shipping.exe,48 63 48 4C 49 03 CE) // should be unique
alloc(newmem,$1000,health)
label(code)
label(return)
label(healthaddy)
newmem:
code:
movsxd rcx,dword ptr [rax+4C]
add rcx,r14
mov [healthaddy], rcx
jmp return
healthaddy:
dq 0
health:
jmp newmem
nop 2
return:
registersymbol(health healthaddy)
[DISABLE]
health:
db 48 63 48 4C 49 03 CE
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: TheThaumaturge-Win64-Shipping.exe+13B311E
TheThaumaturge-Win64-Shipping.exe+13B30FE: 48 8B CF - mov rcx,rdi
TheThaumaturge-Win64-Shipping.exe+13B3101: E8 3A 14 01 00 - call TheThaumaturge-Win64-Shipping.exe+13C4540
TheThaumaturge-Win64-Shipping.exe+13B3106: 48 85 C0 - test rax,rax
TheThaumaturge-Win64-Shipping.exe+13B3109: 74 10 - je TheThaumaturge-Win64-Shipping.exe+13B311B
TheThaumaturge-Win64-Shipping.exe+13B310B: 48 8B 48 08 - mov rcx,[rax+08]
TheThaumaturge-Win64-Shipping.exe+13B310F: 8B 51 10 - mov edx,[rcx+10]
TheThaumaturge-Win64-Shipping.exe+13B3112: 48 C1 EA 14 - shr rdx,14
TheThaumaturge-Win64-Shipping.exe+13B3116: F6 C2 01 - test dl,01
TheThaumaturge-Win64-Shipping.exe+13B3119: 75 03 - jne TheThaumaturge-Win64-Shipping.exe+13B311E
TheThaumaturge-Win64-Shipping.exe+13B311B: 49 8B C4 - mov rax,r12
// ---------- INJECTING HERE ----------
TheThaumaturge-Win64-Shipping.exe+13B311E: 48 63 48 4C - movsxd rcx,dword ptr [rax+4C]
// ---------- DONE INJECTING ----------
TheThaumaturge-Win64-Shipping.exe+13B3122: 49 03 CE - add rcx,r14
TheThaumaturge-Win64-Shipping.exe+13B3125: 74 28 - je TheThaumaturge-Win64-Shipping.exe+13B314F
TheThaumaturge-Win64-Shipping.exe+13B3127: F3 0F 10 71 08 - movss xmm6,[rcx+08]
TheThaumaturge-Win64-Shipping.exe+13B312C: EB 21 - jmp TheThaumaturge-Win64-Shipping.exe+13B314F
TheThaumaturge-Win64-Shipping.exe+13B312E: 48 85 F6 - test rsi,rsi
TheThaumaturge-Win64-Shipping.exe+13B3131: 74 0A - je TheThaumaturge-Win64-Shipping.exe+13B313D
TheThaumaturge-Win64-Shipping.exe+13B3133: 48 8B 0E - mov rcx,[rsi]
TheThaumaturge-Win64-Shipping.exe+13B3136: E8 E5 95 03 00 - call TheThaumaturge-Win64-Shipping.exe+13EC720
TheThaumaturge-Win64-Shipping.exe+13B313B: EB 0F - jmp TheThaumaturge-Win64-Shipping.exe+13B314C
TheThaumaturge-Win64-Shipping.exe+13B313D: 48 8B 8D 08 01 00 00 - mov rcx,[rbp+00000108]
}
115019
"No description"
0
Float
healthaddy
8
Change of movss [rcx+08],xmm1
TheThaumaturge-Win64-Shipping.exe+13D7530
48
FF
E0
CC
CC
F3
0F
11
49
08
C3
CC
CC
CC
CC