38
"No Damage to Party members"
Auto Assembler Script
[ENABLE]
aobscanmodule(health,Throne.exe,D9 91 F8 00 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
cmp [ecx+30],0
je code
jmp return
code:
fst dword ptr [ecx+000000F8]
jmp return
health:
jmp newmem
nop
return:
registersymbol(health)
[DISABLE]
health:
db D9 91 F8 00 00 00
unregistersymbol(health)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "Throne.exe"+16B14A
"Throne.exe"+16B127: 8B 51 64 - mov edx,[ecx+64]
"Throne.exe"+16B12A: 03 C2 - add eax,edx
"Throne.exe"+16B12C: 33 D2 - xor edx,edx
"Throne.exe"+16B12E: 3B C2 - cmp eax,edx
"Throne.exe"+16B130: 89 44 24 00 - mov [esp+00],eax
"Throne.exe"+16B134: 74 3E - je Throne.exe+16B174
"Throne.exe"+16B136: DB 44 24 08 - fild dword ptr [esp+08]
"Throne.exe"+16B13A: D8 0D 00 25 79 00 - fmul dword ptr [Throne.exe+392500]
"Throne.exe"+16B140: DA 74 24 00 - fidiv dword ptr [esp+00]
"Throne.exe"+16B144: D8 15 00 25 79 00 - fcom dword ptr [Throne.exe+392500]
// ---------- INJECTING HERE ----------
"Throne.exe"+16B14A: D9 91 F8 00 00 00 - fst dword ptr [ecx+000000F8]
// ---------- DONE INJECTING ----------
"Throne.exe"+16B150: DF E0 - fnstsw ax
"Throne.exe"+16B152: F6 C4 41 - test ah,41
"Throne.exe"+16B155: 75 10 - jne Throne.exe+16B167
"Throne.exe"+16B157: DD D8 - fstp st(0)
"Throne.exe"+16B159: C7 81 F8 00 00 00 00 00 C8 42 - mov [ecx+000000F8],42C80000
"Throne.exe"+16B163: 59 - pop ecx
"Throne.exe"+16B164: C2 04 00 - ret 0004
"Throne.exe"+16B167: D8 1D F4 24 79 00 - fcomp dword ptr [Throne.exe+3924F4]
"Throne.exe"+16B16D: DF E0 - fnstsw ax
"Throne.exe"+16B16F: F6 C4 01 - test ah,01
}
41
"Do not spent mana when casting"
Auto Assembler Script
[ENABLE]
aobscanmodule(mana,Throne.exe,D9 91 FC 00 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// fst dword ptr [ecx+000000FC]
jmp return
mana:
jmp newmem
nop
return:
registersymbol(mana)
[DISABLE]
mana:
db D9 91 FC 00 00 00
unregistersymbol(mana)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "Throne.exe"+16B1DA
"Throne.exe"+16B1B7: 8B 51 68 - mov edx,[ecx+68]
"Throne.exe"+16B1BA: 03 C2 - add eax,edx
"Throne.exe"+16B1BC: 33 D2 - xor edx,edx
"Throne.exe"+16B1BE: 3B C2 - cmp eax,edx
"Throne.exe"+16B1C0: 89 44 24 00 - mov [esp+00],eax
"Throne.exe"+16B1C4: 74 3E - je Throne.exe+16B204
"Throne.exe"+16B1C6: DB 44 24 08 - fild dword ptr [esp+08]
"Throne.exe"+16B1CA: D8 0D 00 25 79 00 - fmul dword ptr [Throne.exe+392500]
"Throne.exe"+16B1D0: DA 74 24 00 - fidiv dword ptr [esp+00]
"Throne.exe"+16B1D4: D8 15 00 25 79 00 - fcom dword ptr [Throne.exe+392500]
// ---------- INJECTING HERE ----------
"Throne.exe"+16B1DA: D9 91 FC 00 00 00 - fst dword ptr [ecx+000000FC]
// ---------- DONE INJECTING ----------
"Throne.exe"+16B1E0: DF E0 - fnstsw ax
"Throne.exe"+16B1E2: F6 C4 41 - test ah,41
"Throne.exe"+16B1E5: 75 10 - jne Throne.exe+16B1F7
"Throne.exe"+16B1E7: DD D8 - fstp st(0)
"Throne.exe"+16B1E9: C7 81 FC 00 00 00 00 00 C8 42 - mov [ecx+000000FC],42C80000
"Throne.exe"+16B1F3: 59 - pop ecx
"Throne.exe"+16B1F4: C2 04 00 - ret 0004
"Throne.exe"+16B1F7: D8 1D F4 24 79 00 - fcomp dword ptr [Throne.exe+3924F4]
"Throne.exe"+16B1FD: DF E0 - fnstsw ax
"Throne.exe"+16B1FF: F6 C4 01 - test ah,01
}
5
"Set Gold to 50.000"
Auto Assembler Script
[ENABLE]
aobscanmodule(gold,Throne.exe,89 88 50 01 00 00 8B) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
mov ecx,#50000
code:
mov [eax+00000150],ecx
jmp return
gold:
jmp newmem
nop
return:
registersymbol(gold)
[DISABLE]
gold:
db 89 88 50 01 00 00
unregistersymbol(gold)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "Throne.exe"+1DD6E2
"Throne.exe"+1DD6C8: 8B 44 24 20 - mov eax,[esp+20]
"Throne.exe"+1DD6CC: 8B 54 24 28 - mov edx,[esp+28]
"Throne.exe"+1DD6D0: 53 - push ebx
"Throne.exe"+1DD6D1: 55 - push ebp
"Throne.exe"+1DD6D2: 56 - push esi
"Throne.exe"+1DD6D3: 8B 74 24 28 - mov esi,[esp+28]
"Throne.exe"+1DD6D7: 57 - push edi
"Throne.exe"+1DD6D8: 8B F9 - mov edi,ecx
"Throne.exe"+1DD6DA: 8B 88 50 01 00 00 - mov ecx,[eax+00000150]
"Throne.exe"+1DD6E0: 03 CA - add ecx,edx
// ---------- INJECTING HERE ----------
"Throne.exe"+1DD6E2: 89 88 50 01 00 00 - mov [eax+00000150],ecx
// ---------- DONE INJECTING ----------
"Throne.exe"+1DD6E8: 8B 86 50 01 00 00 - mov eax,[esi+00000150]
"Throne.exe"+1DD6EE: 2B C2 - sub eax,edx
"Throne.exe"+1DD6F0: 89 86 50 01 00 00 - mov [esi+00000150],eax
"Throne.exe"+1DD6F6: 89 44 24 30 - mov [esp+30],eax
"Throne.exe"+1DD6FA: 75 5C - jne Throne.exe+1DD758
"Throne.exe"+1DD6FC: 8B 5C 24 28 - mov ebx,[esp+28]
"Throne.exe"+1DD700: 8B AB E8 00 00 00 - mov ebp,[ebx+000000E8]
"Throne.exe"+1DD706: E8 35 5F F4 FF - call Throne.exe+123640
"Throne.exe"+1DD70B: 3B E8 - cmp ebp,eax
"Throne.exe"+1DD70D: 8B 6C 24 34 - mov ebp,[esp+34]
}
32
"pointerscan result"
Binary
0
1
0
"Throne.exe"+0046E8CC
0
D0
DC
4
B4
20
C
37
"Health %"
0000FF
Float
+f8
39
"Mana %"
FF0000
Float
+fc
31
"Health Points"
4 Bytes
+64
40
"Mana Points"
4 Bytes
+68
25
"XP"
4 Bytes
+d0
26
"Stat Points to spent"
4 Bytes
+d8
27
"Strength"
4 Bytes
+c
28
"Dexterity"
4 Bytes
+10
29
"Vitality"
4 Bytes
+14
30
"KI"
4 Bytes
+18
35
"Charisma"
4 Bytes
+1c
17
"Debug"
1
33
"pointerscan result"
4 Bytes
"Throne.exe"+0046E8CC
D0
104
A8
4
B4
20
C
34
"pointerscan result"
4 Bytes
"Throne.exe"+0046E8CC
D0
104
C4
8
94
20
C