19021
"Allow VEH"
Auto Assembler Script
{$LUA}
if syntaxcheck then return end
local symbolName = "KERNELBASE.SetThreadContext"
[ENABLE]
local bt = {195, 144, 144, 144} --C3 90 90 90 (ret nop nop nop)
writeBytes(symbolName, bt)
[DISABLE]
local bt = {72, 131, 236, 40} --48 83 EC 28 (sub rsp, 28)
writeBytes(symbolName, bt)
1337095140
"[ACTIVATE]"
Auto Assembler Script
// Original Code by G40sty.
[ENABLE]
{$lua}
local gameName = "Horizon Zero Dawn"
local gameProcess = "HorizonZeroDawn.exe"
if getProcessIDFromProcessName(gameProcess) ~= nil then
if readInteger(process) == nil then
openProcess(gameProcess)
else
if readInteger(process) ~= readInteger(gameProcess) then
openProcess(gameProcess)
end
end
else
beep() error(showMessage(string.format("%s is not running.",gameName)))
end
--; Auto Attach Process For User
if syntaxcheck then return end
if messageDialog([[
Copyright © 2023 OpenCheatTables.com
Table Creator: Marcus101RR
Would you like to read additional information?
]],mtInformation,mbYes,mbNo) == mrYes then
messageDialog("This information has been added to deter users of FRF (Fearless Revolution Forums) to violate the GPL License. You are hereby informed that use of this table is strictly forbidden from distribution, upload, or alterations with or without consent from this author on FRF. All other sources are allowed with permission.")
else
end
[DISABLE]
1337095004
"[POINTERS]"
Auto Assembler Script
[ENABLE]
// +5310 1.06
define(player,HorizonZeroDawn.exe+714CDC8)
define(debug,HorizonZeroDawn.exe+7152588)
define(inventoryCap,HorizonZeroDawn.exe+7146628)
define(world,HorizonZeroDawn.exe+714F830)
registersymbol(player)
registersymbol(debug)
registersymbol(inventoryCap)
registersymbol(world)
[DISABLE]
unregistersymbol(player)
unregistersymbol(debug)
unregistersymbol(inventoryCap)
unregistersymbol(world)
1337092276
"World"
1
1337092275
"Time of Day"
Float
world
98
58
1337095012
"Speed"
Float
world
190
1337095141
"Loading Status"
0
Float
world
4B4
1337095131
"Total Game Time"
0
0000FF
Double
HorizonZeroDawn.exe+2A497E8
1337092267
"Player"
1
1337092278
"X"
Float
player
70
E0
1D8
360
30
1337095094
"Y"
Float
player
74
E0
1D8
360
30
1337095093
"Z"
Float
player
78
E0
1D8
360
30
1337092242
"Base Health"
Float
player
2C
30
1F0
30
1337092192
"God Mode"
Byte
player
60
1F0
30
1337092240
"Health"
Float
player
64
1F0
30
1337092193
"Max"
Float
player
68
1F0
30
1337092194
"Bonus Health"
Float
player
74
1F0
30
1337095006
"Medicine Pouch"
1
1337095007
"New Game Plus"
1
1337092233
"Medicine Pouch"
0
Float
player
58
20
18
190
1C0
30
1337092234
"Medicine Pouch Max"
0
Float
player
5C
20
18
190
1C0
30
1337095008
"Normal"
1
1337095009
"Medicine Pouch"
0
Float
player
58
20
20
190
1C0
30
1337095010
"Medicine Pouch Max"
0
Float
player
5C
20
20
190
1C0
30
1337095011
"Character Progress"
1
1337092281
"Experience"
0
4 Bytes
player
58
148
290
30
1337092279
"Level"
0
4 Bytes
player
5C
148
290
30
1337092280
"Max Level"
0
4 Bytes
player
60
148
290
30
1337092283
"Skill Points"
0
4 Bytes
player
68
148
290
30
1337092247
"Buffs"
1
1337092248
"Slot 1"
Float
player
18
60
A0
290
30
1337092249
"Slot 2"
Float
player
38
60
A0
290
30
1337092251
"Slot 3"
Float
player
58
60
A0
290
30
1337092252
"Slot 4"
Float
player
78
60
A0
290
30
1337095096
"CountdownTimer"
Float
player
1C
20
200
370
430
48
30
1337092266
"InventoryCapacity"
1
1337092264
"Info"
1
String
64
0
0
1
inventoryCap
0
20
130
C0
38
50
A8
1337095047
"Weapons"
4 Bytes
inventoryCap
28
130
C0
38
50
A8
1337092269
"??"
4 Bytes
inventoryCap
2C
130
C0
38
50
A8
1337092268
"??"
4 Bytes
inventoryCap
30
130
C0
38
50
A8
1337092270
"Modifications"
4 Bytes
inventoryCap
34
130
C0
38
50
A8
1337092271
"Outfits"
4 Bytes
inventoryCap
38
130
C0
38
50
A8
1337092272
"Resources"
4 Bytes
inventoryCap
3C
130
C0
38
50
A8
1337095064
"DefaultSPHealthRegeneration"
1
1337095065
"Info"
1
String
64
0
0
1
inventoryCap
0
20
10
C0
38
50
A8
1337095066
"Health Regen Max"
Float
inventoryCap
28
10
C0
38
50
A8
1337095067
"StaminaComponentResource_01"
1
1337095068
"Info"
1
String
64
0
0
1
inventoryCap
0
20
140
C0
38
50
A8
1337095069
"??"
4 Bytes
inventoryCap
28
140
C0
38
50
A8
1337095071
"??"
4 Bytes
inventoryCap
2C
140
C0
38
50
A8
1337095070
"??"
4 Bytes
inventoryCap
30
140
C0
38
50
A8
1337095072
"??"
Float
inventoryCap
34
140
C0
38
50
A8
1337095134
"StaminaComponentResource_01"
1
1337095135
"Info"
0
String
64
0
0
1
inventoryCap
0
20
100
C0
38
50
A8
1337095136
"??"
0
4 Bytes
inventoryCap
28
100
C0
38
50
A8
1337095137
"??"
4 Bytes
inventoryCap
2C
140
C0
38
50
A8
1337095138
"??"
4 Bytes
inventoryCap
30
140
C0
38
50
A8
1337095139
"??"
Float
inventoryCap
34
140
C0
38
50
A8
19025
"Debug Settings"
1
debug
19024
"??"
Byte
debug
8
1337092253
"??"
Byte
debug
E
19026
"Debug Info"
Byte
debug
10
19027
"??"
Byte
debug
14
1337092256
"Unknown"
Byte
debug
22
19028
"God Mode"
Byte
debug
24
19029
"Infinite Ammo"
Byte
debug
28
19030
"Focus: Run"
Byte
debug
29
1337092254
"??"
Byte
debug
30
1337092245
"Rapid Fire / Infinite Ammo"
Byte
debug
34
1337092257
"??"
Byte
debug
38
1337095023
"[SCRIPTS]"
1
89863
"Get Equipped Coil"
Auto Assembler Script
[ENABLE]
alloc(CustomCoilTable,$128)
aobscanmodule(getCoilComponent,HorizonZeroDawn.exe,48 8B 5A 08 48 8B F1 48 8B FA) // should be unique
alloc(newmem,$128,getCoilComponent)
label(code)
label(return)
label(gCoilComponent)
registersymbol(gCoilComponent)
label(sCoilTable)
registersymbol(sCoilTable)
CustomCoilTable:
sCoilTable:
dd 0
newmem:
code:
mov [gCoilComponent],rdx
mov rbx,[rdx+08]
mov rsi,rcx
jmp return
gCoilComponent:
dd 0
getCoilComponent:
jmp newmem
nop 2
return:
registersymbol(getCoilComponent)
[DISABLE]
getCoilComponent:
db 48 8B 5A 08 48 8B F1
unregistersymbol(getCoilComponent)
dealloc(newmem)
unregistersymbol(gCoilComponent)
unregistersymbol(sCoilTable)
dealloc(CustomCoilTable)
{
// ORIGINAL CODE - INJECTION POINT: "HorizonZeroDawn.exe"+1295F88
"HorizonZeroDawn.exe"+1295F78: 41 5F - pop r15
"HorizonZeroDawn.exe"+1295F7A: 41 5E - pop r14
"HorizonZeroDawn.exe"+1295F7C: 5F - pop rdi
"HorizonZeroDawn.exe"+1295F7D: 5E - pop rsi
"HorizonZeroDawn.exe"+1295F7E: 5D - pop rbp
"HorizonZeroDawn.exe"+1295F7F: C3 - ret
"HorizonZeroDawn.exe"+1295F80: 40 53 - push rbx
"HorizonZeroDawn.exe"+1295F82: 56 - push rsi
"HorizonZeroDawn.exe"+1295F83: 57 - push rdi
"HorizonZeroDawn.exe"+1295F84: 48 83 EC 20 - sub rsp,20
// ---------- INJECTING HERE ----------
"HorizonZeroDawn.exe"+1295F88: 48 8B 5A 08 - mov rbx,[rdx+08]
"HorizonZeroDawn.exe"+1295F8C: 48 8B F1 - mov rsi,rcx
// ---------- DONE INJECTING ----------
"HorizonZeroDawn.exe"+1295F8F: 48 8B FA - mov rdi,rdx
"HorizonZeroDawn.exe"+1295F92: 4C 8B 43 18 - mov r8,[rbx+18]
"HorizonZeroDawn.exe"+1295F96: 49 8B 48 30 - mov rcx,[r8+30]
"HorizonZeroDawn.exe"+1295F9A: 48 85 C9 - test rcx,rcx
"HorizonZeroDawn.exe"+1295F9D: 74 4D - je HorizonZeroDawn.exe+1295FEC
"HorizonZeroDawn.exe"+1295F9F: 48 8B 49 40 - mov rcx,[rcx+40]
"HorizonZeroDawn.exe"+1295FA3: 48 8D 54 24 48 - lea rdx,[rsp+48]
"HorizonZeroDawn.exe"+1295FA8: E8 03 CE 5E FF - call HorizonZeroDawn.exe+882DB0
"HorizonZeroDawn.exe"+1295FAD: 8B 5B 10 - mov ebx,[rbx+10]
"HorizonZeroDawn.exe"+1295FB0: 48 8D 54 24 50 - lea rdx,[rsp+50]
}
1337095100
"Price"
4 Bytes
gCoilComponent
2C
38
48
1337095101
"Rarity"
4 Bytes
gCoilComponent
48
68
48
1337095098
"Slots"
4 Bytes
gCoilComponent
0
1337095025
"??"
4 Bytes
gCoilComponent
4
1337095037
"Stat Pointer"
1
8 Bytes
gCoilComponent
8
1337095018
"Effect 1"
1
gCoilComponent
0
1337095102
"% Effect"
4 Bytes
gCoilComponent
10
8
1337095017
"Effect Link"
listcoiltypes
1
2 Bytes
gCoilComponent
18
8
1337095014
"Effect Name"
String
32
0
0
1
gCoilComponent
0
20
18
8
1337095044
"Stat Table"
1
Array of byte
32
gCoilComponent
0
8
1337095021
"Effect 2"
0
1
gCoilComponent
4
1337095016
"% Effect"
4 Bytes
gCoilComponent
30
8
1337095027
"Effect Link"
listcoiltypes
1
2 Bytes
gCoilComponent
38
8
1337095019
"Effect Name"
String
32
0
0
1
gCoilComponent
0
20
38
8
1337095103
"Stat Table"
1
Array of byte
32
gCoilComponent
20
8
1337095022
"Effect 3"
0
1
gCoilComponent
8
1337095015
"% Effect"
4 Bytes
gCoilComponent
50
8
1337095028
"Effect Link"
listcoiltypes
1
2 Bytes
gCoilComponent
58
8
1337095020
"Effect Name"
listcoiltypes
String
32
0
0
1
gCoilComponent
0
20
58
8
1337095104
"Stat Table"
1
Array of byte
32
gCoilComponent
40
8
1337095105
"Effect 4"
0
1
gCoilComponent
C
1337095106
"% Effect"
4 Bytes
gCoilComponent
70
8
1337095107
"Effect Link"
listcoiltypes
1
2 Bytes
gCoilComponent
78
8
1337095108
"Effect Name"
listcoiltypes
String
32
0
0
1
gCoilComponent
0
20
78
8
1337095109
"Stat Table"
1
Array of byte
32
gCoilComponent
60
8
1337095110
"Custom Table"
1
1337095111
"Stat #1"
1
Array of byte
32
sCoilTable
1337095114
"Stat #2"
1
Array of byte
32
sCoilTable+20
1337095113
"Stat #3"
1
Array of byte
32
sCoilTable+40
1337095112
"Stat #4"
1
Array of byte
32
sCoilTable+60
1337095115
"Stat #5"
1
Array of byte
32
sCoilTable+80
1337095132
"Stat #6"
1
0
Array of byte
32
sCoilTable+A0
1337095051
"Get Attacked Machine"
Auto Assembler Script
[ENABLE]
aobscanmodule(getLastEnemy,HorizonZeroDawn.exe,F3 0F 11 47 64 48 8B B1) // should be unique
alloc(newmem,$256,getLastEnemy)
label(code)
label(return)
label(gLastEnemy)
registersymbol(gLastEnemy)
newmem:
code:
mov [gLastEnemy],rbx
movss [rdi+64],xmm0
jmp return
gLastEnemy:
dd 0
getLastEnemy:
jmp newmem
return:
registersymbol(getLastEnemy)
[DISABLE]
getLastEnemy:
db F3 0F 11 47 64
unregistersymbol(getLastEnemy)
dealloc(newmem)
unregistersymbol(gLastEnemy)
{
// ORIGINAL CODE - INJECTION POINT: HorizonZeroDawn.exe+C5CAB0
HorizonZeroDawn.exe+C5CA82: 7A 06 - jp HorizonZeroDawn.exe+C5CA8A
HorizonZeroDawn.exe+C5CA84: 0F 84 D5 00 00 00 - je HorizonZeroDawn.exe+C5CB5F
HorizonZeroDawn.exe+C5CA8A: 0F 2F C1 - comiss xmm0,xmm1
HorizonZeroDawn.exe+C5CA8D: 48 8B 49 30 - mov rcx,[rcx+30]
HorizonZeroDawn.exe+C5CA91: 48 89 74 24 58 - mov [rsp+58],rsi
HorizonZeroDawn.exe+C5CA96: 76 18 - jna HorizonZeroDawn.exe+C5CAB0
HorizonZeroDawn.exe+C5CA98: 8B 81 BC 00 00 00 - mov eax,[rcx+000000BC]
HorizonZeroDawn.exe+C5CA9E: 89 87 90 00 00 00 - mov [rdi+00000090],eax
HorizonZeroDawn.exe+C5CAA4: 8B 81 C0 00 00 00 - mov eax,[rcx+000000C0]
HorizonZeroDawn.exe+C5CAAA: 89 87 94 00 00 00 - mov [rdi+00000094],eax
// ---------- INJECTING HERE ----------
HorizonZeroDawn.exe+C5CAB0: F3 0F 11 47 64 - movss [rdi+64],xmm0
// ---------- DONE INJECTING ----------
HorizonZeroDawn.exe+C5CAB5: 48 8B B1 D8 00 00 00 - mov rsi,[rcx+000000D8]
HorizonZeroDawn.exe+C5CABC: 48 85 F6 - test rsi,rsi
HorizonZeroDawn.exe+C5CABF: 0F 84 80 00 00 00 - je HorizonZeroDawn.exe+C5CB45
HorizonZeroDawn.exe+C5CAC5: BA 01 00 00 00 - mov edx,00000001
HorizonZeroDawn.exe+C5CACA: 48 89 5C 24 48 - mov [rsp+48],rbx
HorizonZeroDawn.exe+C5CACF: 48 8D 4C 24 50 - lea rcx,[rsp+50]
HorizonZeroDawn.exe+C5CAD4: E8 77 72 05 00 - call HorizonZeroDawn.exe+CB3D50
HorizonZeroDawn.exe+C5CAD9: 48 8B 4C 24 50 - mov rcx,[rsp+50]
HorizonZeroDawn.exe+C5CADE: BA FF FF FF FF - mov edx,FFFFFFFF
HorizonZeroDawn.exe+C5CAE3: E8 78 F6 FF FF - call HorizonZeroDawn.exe+C5C160
}
1337095052
"??"
Float
gLastEnemy
0
A8
1337095058
"Base"
1
8 Bytes
gLastEnemy
0
1337095060
"Base"
1
8 Bytes
gLastEnemy
0
30
1337095059
"Health"
Float
gLastEnemy
64
1337095053
"Max Health"
Float
gLastEnemy
68
1337095062
"Force Long Buildup Effect"
Auto Assembler Script
[ENABLE]
aobscanmodule(setEffectTime,HorizonZeroDawn.exe,F3 0F 10 43 40 F3 0F 11 86 A0 00 00 00) // should be unique
alloc(newmem,$256,setEffectTime)
label(code)
label(return)
newmem:
code:
mov [rbx+40],(float)999.0
movss xmm0,[rbx+40]
jmp return
setEffectTime:
jmp newmem
return:
registersymbol(setEffectTime)
[DISABLE]
setEffectTime:
db F3 0F 10 43 40
unregistersymbol(setEffectTime)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: HorizonZeroDawn.exe+F6C28E
HorizonZeroDawn.exe+F6C26E: 48 C1 E1 04 - shl rcx,04
HorizonZeroDawn.exe+F6C272: 48 03 C8 - add rcx,rax
HorizonZeroDawn.exe+F6C275: 48 3B C1 - cmp rax,rcx
HorizonZeroDawn.exe+F6C278: 74 14 - je HorizonZeroDawn.exe+F6C28E
HorizonZeroDawn.exe+F6C27A: 66 0F 1F 44 00 00 - nop word ptr [rax+rax+00]
HorizonZeroDawn.exe+F6C280: 48 39 18 - cmp [rax],rbx
HorizonZeroDawn.exe+F6C283: 74 25 - je HorizonZeroDawn.exe+F6C2AA
HorizonZeroDawn.exe+F6C285: 48 83 C0 10 - add rax,10
HorizonZeroDawn.exe+F6C289: 48 3B C1 - cmp rax,rcx
HorizonZeroDawn.exe+F6C28C: 75 F2 - jne HorizonZeroDawn.exe+F6C280
// ---------- INJECTING HERE ----------
HorizonZeroDawn.exe+F6C28E: F3 0F 10 43 40 - movss xmm0,[rbx+40]
// ---------- DONE INJECTING ----------
HorizonZeroDawn.exe+F6C293: F3 0F 11 86 A0 00 00 00 - movss [rsi+000000A0],xmm0
HorizonZeroDawn.exe+F6C29B: 48 8B 53 78 - mov rdx,[rbx+78]
HorizonZeroDawn.exe+F6C29F: 48 85 D2 - test rdx,rdx
HorizonZeroDawn.exe+F6C2A2: 74 0D - je HorizonZeroDawn.exe+F6C2B1
HorizonZeroDawn.exe+F6C2A4: 48 83 C2 30 - add rdx,30
HorizonZeroDawn.exe+F6C2A8: EB 19 - jmp HorizonZeroDawn.exe+F6C2C3
HorizonZeroDawn.exe+F6C2AA: F3 0F 10 40 08 - movss xmm0,[rax+08]
HorizonZeroDawn.exe+F6C2AF: EB E2 - jmp HorizonZeroDawn.exe+F6C293
HorizonZeroDawn.exe+F6C2B1: 48 8B 53 70 - mov rdx,[rbx+70]
HorizonZeroDawn.exe+F6C2B5: 48 85 D2 - test rdx,rdx
}
1337092188
"DEBUG"
0000FF
1
1337095029
"DEFINITIONS"
1
1337095030
"listcoiltypes"
15C0:Spear Damage
1600:Damage
1640:Tear
1680:Corruption
16C0:Handling
1700:Fire
1740:Shock
1780:Freeze
E3C0:Resist Ranged Attacks
E400:Resist Shock
E440:Resist Melee Attacks
E480:Resist Freeze
E4C0:Resist Fire
E500:Resist Corruption
DB80:Stealth
4 Bytes
1337095045
"Info"
Auto Assembler Script
{ Game : HorizonZeroDawn.exe
Version:
Date : 2020-08-28
Author : Marcus101RR
Get Capacities
41 8B 54 89 28 01 50 FC 41 83 F8 08 7C E7 48 83 C4 20 5B C3 CC 8
}
[ENABLE]
[DISABLE]
1337092187
"Fetch Base Addresses (Easy)"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
print(string.format("Fetching Base Addresses..."))
local aobList = {
"48 8B 05 ?? ?? ?? ?? 80 78 2B 00",
"48 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 8F E8 01 00 00",
"48 8B 05 ?? ?? ?? ?? BA 04 00 00 00 48 8B CF ?? ?? ?? ?? 8C 01 00 00",
"48 8B 1D ?? ?? ?? ?? 48 8B 74 24 60 48 85 DB 74 ?? 80",
"48 8B 2D ?? ?? ?? ?? 48 8B D7 48 8B C5 48 39 18 75 ?? 48 39 70 08",
"48 8B 0D ?? ?? ?? ?? F2 0F 10 87 60 01 00 00 0F",
"F2 0F 10 05 ?? ?? ?? ?? 48 8B C3 F2 0F 11 43 40"
}
local aobNames = {
"Debug Data",
"Player Data",
"World Pointer",
"Inventory Capacity",
"Medicine Base Address",
"Player Entity XYZ",
"Total Hours Played"
}
local xbase = readInteger(process)and GetAddress(process)
print(string.format("Base: %X",xbase))
for i = 1, #aobList do
local aob = AOBScan(aobList[i],"+X*C*W")
local instruct = getAddressSafe(aob[0])
local distance = getAddressSafe(instruct)+3
distance = readInteger(distance)
local instructSize = getInstructionSize(instruct)
local address = (instruct + distance + instructSize) - xbase
print(string.format("%s: HorizonZeroDawn.exe+%X",aobNames[i],address))
end
[DISABLE]
1337092203
"Get Modifications"
Auto Assembler Script
{ Game : HorizonZeroDawn.exe
Version:
Date : 2020-08-09
Author : Marcus101RR
This script does blah blah blah
}
[ENABLE]
aobscanmodule(getModifcation,HorizonZeroDawn.exe,48 8B 0C D0 33 D2 48 85 C9 48 8D 41 E0 48 0F 44 C2 48) // should be unique
alloc(newmem,$1000,getModifcation)
label(code)
label(return)
label(gModifications)
registersymbol(gModifications)
newmem:
code:
mov [gModifications],rax
mov rcx,[rax+rdx*8]
xor edx,edx
jmp return
gModifications:
dq 0
getModifcation:
jmp newmem
nop
return:
registersymbol(getModifcation)
[DISABLE]
getModifcation:
db 48 8B 0C D0 33 D2
unregistersymbol(getModifcation)
dealloc(newmem)
unregistersymbol(gModifcation)
{
// ORIGINAL CODE - INJECTION POINT: "HorizonZeroDawn.exe"+1481FCB
"HorizonZeroDawn.exe"+1481FB9: CC - int 3
"HorizonZeroDawn.exe"+1481FBA: CC - int 3
"HorizonZeroDawn.exe"+1481FBB: CC - int 3
"HorizonZeroDawn.exe"+1481FBC: CC - int 3
"HorizonZeroDawn.exe"+1481FBD: CC - int 3
"HorizonZeroDawn.exe"+1481FBE: CC - int 3
"HorizonZeroDawn.exe"+1481FBF: CC - int 3
"HorizonZeroDawn.exe"+1481FC0: 48 63 C2 - movsxd rax,edx
"HorizonZeroDawn.exe"+1481FC3: 48 8D 14 40 - lea rdx,[rax+rax*2]
"HorizonZeroDawn.exe"+1481FC7: 48 8B 41 60 - mov rax,[rcx+60]
// ---------- INJECTING HERE ----------
"HorizonZeroDawn.exe"+1481FCB: 48 8B 0C D0 - mov rcx,[rax+rdx*8]
"HorizonZeroDawn.exe"+1481FCF: 33 D2 - xor edx,edx
// ---------- DONE INJECTING ----------
"HorizonZeroDawn.exe"+1481FD1: 48 85 C9 - test rcx,rcx
"HorizonZeroDawn.exe"+1481FD4: 48 8D 41 E0 - lea rax,[rcx-20]
"HorizonZeroDawn.exe"+1481FD8: 48 0F 44 C2 - cmove rax,rdx
"HorizonZeroDawn.exe"+1481FDC: 48 85 C0 - test rax,rax
"HorizonZeroDawn.exe"+1481FDF: 74 13 - je HorizonZeroDawn.exe+1481FF4
"HorizonZeroDawn.exe"+1481FE1: 48 8D 88 88 02 00 00 - lea rcx,[rax+00000288]
"HorizonZeroDawn.exe"+1481FE8: 48 8D 15 C1 37 41 01 - lea rdx,[HorizonZeroDawn.exe+28957B0]
"HorizonZeroDawn.exe"+1481FEF: E9 0C 91 6D FF - jmp HorizonZeroDawn.exe+B5B100
"HorizonZeroDawn.exe"+1481FF4: C3 - ret
"HorizonZeroDawn.exe"+1481FF5: CC - int 3
}
1337092204
"Socket1"
1
8 Bytes
gModifications
0
1337092259
"Type"
1
String
32
0
0
1
gModifications
0
18
0
1337092263
"Socket1"
1
8 Bytes
gModifications
0
98
1337092286
"Socket1"
1
8 Bytes
gModifications
0
-8
0
1337092258
"Socket1_sub"
1
8 Bytes
gModifications
10
1337092261
"Type"
1
String
64
0
0
1
gModifications
0
18
0
10
1337092260
"Socket1_sub"
1
8 Bytes
gModifications
28
0
10
1337092209
"Get Inv Caps"
Auto Assembler Script
{ Game : HorizonZeroDawn.exe
Version:
Date : 2020-08-09
Author : Marcus101RR
This script does blah blah blah
}
[ENABLE]
aobscanmodule(gInventoryCaps,HorizonZeroDawn.exe,8B 41 58 41 89 00) // should be unique
alloc(newmem,$256,gInventoryCaps)
label(code)
label(return)
label(gInvCaps)
registersymbol(gInvCaps)
newmem:
code:
mov [gInvCaps],rcx
mov eax,[rcx+58]
mov [r8],eax
jmp return
gInvCaps:
dq 0
gInventoryCaps:
jmp newmem
nop
return:
registersymbol(gInventoryCaps)
[DISABLE]
gInventoryCaps:
db 8B 41 58 41 89 00
unregistersymbol(gInventoryCaps)
dealloc(newmem)
unregistersymbol(gInvCaps)
{
// ORIGINAL CODE - INJECTION POINT: "HorizonZeroDawn.exe"+1530931
"HorizonZeroDawn.exe"+1530904: 8B 81 84 00 00 00 - mov eax,[rcx+00000084]
"HorizonZeroDawn.exe"+153090A: 89 42 0C - mov [rdx+0C],eax
"HorizonZeroDawn.exe"+153090D: 8B 81 88 00 00 00 - mov eax,[rcx+00000088]
"HorizonZeroDawn.exe"+1530913: 89 42 10 - mov [rdx+10],eax
"HorizonZeroDawn.exe"+1530916: 8B 81 8C 00 00 00 - mov eax,[rcx+0000008C]
"HorizonZeroDawn.exe"+153091C: 89 42 14 - mov [rdx+14],eax
"HorizonZeroDawn.exe"+153091F: 8B 81 90 00 00 00 - mov eax,[rcx+00000090]
"HorizonZeroDawn.exe"+1530925: 89 42 18 - mov [rdx+18],eax
"HorizonZeroDawn.exe"+1530928: 8B 81 94 00 00 00 - mov eax,[rcx+00000094]
"HorizonZeroDawn.exe"+153092E: 89 42 1C - mov [rdx+1C],eax
// ---------- INJECTING HERE ----------
"HorizonZeroDawn.exe"+1530931: 8B 41 58 - mov eax,[rcx+58]
"HorizonZeroDawn.exe"+1530934: 41 89 00 - mov [r8],eax
// ---------- DONE INJECTING ----------
"HorizonZeroDawn.exe"+1530937: 8B 41 5C - mov eax,[rcx+5C]
"HorizonZeroDawn.exe"+153093A: 41 89 40 04 - mov [r8+04],eax
"HorizonZeroDawn.exe"+153093E: 8B 41 60 - mov eax,[rcx+60]
"HorizonZeroDawn.exe"+1530941: 41 89 40 08 - mov [r8+08],eax
"HorizonZeroDawn.exe"+1530945: 8B 41 64 - mov eax,[rcx+64]
"HorizonZeroDawn.exe"+1530948: 41 89 40 0C - mov [r8+0C],eax
"HorizonZeroDawn.exe"+153094C: 8B 41 68 - mov eax,[rcx+68]
"HorizonZeroDawn.exe"+153094F: 41 89 40 10 - mov [r8+10],eax
"HorizonZeroDawn.exe"+1530953: 8B 41 6C - mov eax,[rcx+6C]
"HorizonZeroDawn.exe"+1530956: 41 89 40 14 - mov [r8+14],eax
}
1337092210
"Weapons"
4 Bytes
gInvCaps
78
1337092213
"Modifications"
4 Bytes
gInvCaps
84
1337092212
"Outfits"
4 Bytes
gInvCaps
88
1337092211
"Resources"
4 Bytes
gInvCaps
8C
1337095041
"Get Sold Item"
Auto Assembler Script
{ Game : HorizonZeroDawn.exe
Version:
Date : 2020-08-27
Author : Marcus101RR
This script does blah blah blah
}
[ENABLE]
aobscanmodule(getItems,HorizonZeroDawn.exe,8B 41 58 3B D0) // should be unique
alloc(newmem,$256,getItems)
label(code)
label(return)
label(gItem)
registersymbol(gItem)
newmem:
code:
mov [gItem],rcx
mov eax,[rcx+58]
cmp edx,eax
jmp return
gItem:
dd 0
getItems:
jmp newmem
return:
registersymbol(getItems)
[DISABLE]
getItems:
db 8B 41 58 3B D0
unregistersymbol(getItems)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "HorizonZeroDawn.exe"+FED32D
"HorizonZeroDawn.exe"+FED30D: 48 8D 6C 24 E8 - lea rbp,[rsp-18]
"HorizonZeroDawn.exe"+FED312: 48 81 EC 18 01 00 00 - sub rsp,00000118
"HorizonZeroDawn.exe"+FED319: 4C 8B F9 - mov r15,rcx
"HorizonZeroDawn.exe"+FED31C: 85 D2 - test edx,edx
"HorizonZeroDawn.exe"+FED31E: 7F 0D - jg HorizonZeroDawn.exe+FED32D
"HorizonZeroDawn.exe"+FED320: 33 C0 - xor eax,eax
"HorizonZeroDawn.exe"+FED322: 48 81 C4 18 01 00 00 - add rsp,00000118
"HorizonZeroDawn.exe"+FED329: 41 5F - pop r15
"HorizonZeroDawn.exe"+FED32B: 5D - pop rbp
"HorizonZeroDawn.exe"+FED32C: C3 - ret
// ---------- INJECTING HERE ----------
"HorizonZeroDawn.exe"+FED32D: 8B 41 58 - mov eax,[rcx+58]
"HorizonZeroDawn.exe"+FED330: 3B D0 - cmp edx,eax
// ---------- DONE INJECTING ----------
"HorizonZeroDawn.exe"+FED332: 48 89 9C 24 30 01 00 00 - mov [rsp+00000130],rbx
"HorizonZeroDawn.exe"+FED33A: 48 8B 59 48 - mov rbx,[rcx+48]
"HorizonZeroDawn.exe"+FED33E: 4C 89 A4 24 00 01 00 00 - mov [rsp+00000100],r12
"HorizonZeroDawn.exe"+FED346: 44 8B E0 - mov r12d,eax
"HorizonZeroDawn.exe"+FED349: 44 0F 4C E2 - cmovl r12d,edx
"HorizonZeroDawn.exe"+FED34D: 41 2B C4 - sub eax,r12d
"HorizonZeroDawn.exe"+FED350: 89 41 58 - mov [rcx+58],eax
"HorizonZeroDawn.exe"+FED353: 48 8B 8B C8 01 00 00 - mov rcx,[rbx+000001C8]
"HorizonZeroDawn.exe"+FED35A: 48 85 C9 - test rcx,rcx
"HorizonZeroDawn.exe"+FED35D: 0F 84 3D 02 00 00 - je HorizonZeroDawn.exe+FED5A0
}
1337095042
"Amount"
8 Bytes
gItem
0
0
28
48
1337095043
"Amount"
4 Bytes
gItem
58
tracking health
HorizonZeroDawn.exe+142FD8A
C1
88
02
00
00
4C
89
BC
24
90
00
00
00
0F
29
B4
24
80
Code :movss xmm1,[rax+28]
HorizonZeroDawn.exe+FFFB77
44
0F
B6
40
2C
F3
0F
10
48
28
E8
6F
03
C5
FF
Code :mov eax,[rcx+rdx+10]
HorizonZeroDawn.exe+15ADBC7
10
4C
89
5A
F8
8B
44
11
10
89
02
48
8B
44
Code :mov ebx,[r14+28]
HorizonZeroDawn.exe+131862C
5D
41
5C
5F
C3
41
8B
5E
28
48
85
ED
74
61
v1.2