34
"always at least 100 Health"
Auto Assembler Script
[ENABLE]
aobscan(health,F3 0F 11 AE A0 00 00 00 48 8B) // should be unique
alloc(newmem,$1000,health)
alloc(value, 8)
label(code)
label(return)
label(fill)
value:
dd (float)100
newmem:
push eax
mov eax,[rsi+a4]
cmp eax,0 // enemies do not have energy, so we use this to distinct between us and them
je code
comiss xmm5,[value] // compare xmm5 with our fixed value
ja fill // if xmm5>value then goto fill:
movss xmm5,[value] // else set xmm5 to value
jmp code
fill:
movss [value],xmm5
code:
pop eax
movss [rsi+000000A0],xmm5
jmp return
health:
jmp newmem
nop 3
return:
registersymbol(health)
[DISABLE]
health:
db F3 0F 11 AE A0 00 00 00
unregistersymbol(health)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 1A48AB10811
1A48AB107E9: F9 - stc
1A48AB107EA: 82 A4 01 00 00 00 55 48 - and byte ptr [rcx+rax+55000000],48
1A48AB107F2: 8B EC - mov ebp,esp
1A48AB107F4: 48 83 EC 30 - sub rsp,30
1A48AB107F8: 48 89 75 F8 - mov [rbp-08],rsi
1A48AB107FC: 48 8B F1 - mov rsi,rcx
1A48AB107FF: F3 0F 11 4D F0 - movss [rbp-10],xmm1
1A48AB10804: F3 0F 10 45 F0 - movss xmm0,[rbp-10]
1A48AB10809: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
1A48AB1080D: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0
// ---------- INJECTING HERE ----------
1A48AB10811: F3 0F 11 AE A0 00 00 00 - movss [rsi+000000A0],xmm5
// ---------- DONE INJECTING ----------
1A48AB10819: 48 8B CE - mov rcx,rsi
1A48AB1081C: 33 D2 - xor edx,edx
1A48AB1081E: 49 BB 60 08 B1 8A A4 01 00 00 - mov r11,000001A48AB10860
1A48AB10828: 41 FF D3 - call r11
1A48AB1082B: 48 8B 75 F8 - mov rsi,[rbp-08]
1A48AB1082F: 48 8D 65 00 - lea rsp,[rbp+00]
1A48AB10833: 5D - pop rbp
1A48AB10834: C3 - ret
1A48AB10835: 00 00 - add [rax],al
1A48AB10837: 00 01 - add [rcx],al
}
38
"always at least 100 Energy"
Auto Assembler Script
[ENABLE]
aobscan(energy,F3 0F 11 AE A4 00 00 00 48) // should be unique
alloc(newmem,$1000,energy)
alloc(value, 8)
label(code)
label(return)
label(fill)
value:
dq (float)100
newmem:
comiss xmm5, [value]
ja code
movss xmm5,[value]
fill:
movss [value],xmm5
code:
movss [rsi+000000A4],xmm5
jmp return
energy:
jmp newmem
nop 3
return:
registersymbol(energy)
[DISABLE]
energy:
db F3 0F 11 AE A4 00 00 00
unregistersymbol(energy)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 27889F857F1
27889F857CE: 00 00 - add [rax],al
27889F857D0: 55 - push rbp
27889F857D1: 48 8B EC - mov rbp,rsp
27889F857D4: 48 83 EC 30 - sub rsp,30
27889F857D8: 48 89 75 F8 - mov [rbp-08],rsi
27889F857DC: 48 8B F1 - mov rsi,rcx
27889F857DF: F3 0F 11 4D F0 - movss [rbp-10],xmm1
27889F857E4: F3 0F 10 45 F0 - movss xmm0,[rbp-10]
27889F857E9: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
27889F857ED: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0
// ---------- INJECTING HERE ----------
27889F857F1: F3 0F 11 AE A4 00 00 00 - movss [rsi+000000A4],xmm5
// ---------- DONE INJECTING ----------
27889F857F9: 48 8B CE - mov rcx,rsi
27889F857FC: BA 01 00 00 00 - mov edx,00000001
27889F85801: 48 8D 64 24 00 - lea rsp,[rsp+00]
27889F85806: 49 BB D0 53 F8 89 78 02 00 00 - mov r11,0000027889F853D0
27889F85810: 41 FF D3 - call r11
27889F85813: 48 8B 75 F8 - mov rsi,[rbp-08]
27889F85817: 48 8D 65 00 - lea rsp,[rbp+00]
27889F8581B: 5D - pop rbp
27889F8581C: C3 - ret
27889F8581D: 00 00 - add [rax],al
}
30
"do not decrease amout of ammo when firing"
Auto Assembler Script
[ENABLE]
aobscan(ammo,FF CA 83 39 00) // should be unique
alloc(newmem,$1000,ammo)
label(code)
label(return)
newmem:
code:
// dec edx
cmp dword ptr [rcx],00
jmp return
ammo:
jmp newmem
return:
registersymbol(ammo)
[DISABLE]
ammo:
db FF CA 83 39 00
unregistersymbol(ammo)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 1A490EEEBE5
1A490EEEBB8: 48 89 75 F8 - mov [rbp-08],rsi
1A490EEEBBC: 48 8B F1 - mov rsi,rcx
1A490EEEBBF: 48 8B 0E - mov rcx,[rsi]
1A490EEEBC2: 49 BA 08 28 0E 8A A4 01 00 00 - mov r10,000001A48A0E2808
1A490EEEBCC: 66 90 - nop 2
1A490EEEBCE: 49 BB 10 39 7E 88 A4 01 00 00 - mov r11,000001A4887E3910
1A490EEEBD8: 41 FF D3 - call r11
1A490EEEBDB: 48 8B C8 - mov rcx,rax
1A490EEEBDE: 83 39 00 - cmp dword ptr [rcx],00
1A490EEEBE1: 48 63 51 48 - movsxd rdx,dword ptr [rcx+48]
// ---------- INJECTING HERE ----------
1A490EEEBE5: FF CA - dec edx
// ---------- DONE INJECTING ----------
1A490EEEBE7: 83 39 00 - cmp dword ptr [rcx],00
1A490EEEBEA: 89 51 48 - mov [rcx+48],edx
1A490EEEBED: 83 38 00 - cmp dword ptr [rax],00
1A490EEEBF0: 48 63 40 48 - movsxd rax,dword ptr [rax+48]
1A490EEEBF4: 85 C0 - test eax,eax
1A490EEEBF6: 75 1A - jne 1A490EEEC12
1A490EEEBF8: 48 8B 0E - mov rcx,[rsi]
1A490EEEBFB: 66 66 90 - nop 3
1A490EEEBFE: 49 BB 90 E4 A5 9A A4 01 00 00 - mov r11,000001A49AA5E490
1A490EEEC08: 41 FF D3 - call r11
}
42
"Find XP - gets filled when killing something"
Auto Assembler Script
[ENABLE]
aobscan(xperience,F3 41 0F 11 6F 40 48) // should be unique
alloc(newmem,$1000,xperience)
globalalloc(xpaddy,8)
label(code)
label(return)
xpaddy:
dw 0
newmem:
mov [xpaddy],r15
code:
movss [r15+40],xmm5
jmp return
xperience:
jmp newmem
nop
return:
registersymbol(xperience)
[DISABLE]
xperience:
db F3 41 0F 11 6F 40
unregistersymbol(xperience)
dealloc(newmem xpaddy)
{
// ORIGINAL CODE - INJECTION POINT: 27889FA0FCD
27889FA0F9B: F2 0F 5A C0 - cvtsd2ss xmm0,xmm0
27889FA0F9F: 48 8D AD 00 00 00 00 - lea rbp,[rbp+00000000]
27889FA0FA6: 49 BB D0 8D F8 89 78 02 00 00 - mov r11,0000027889F88DD0
27889FA0FB0: 41 FF D3 - call r11
27889FA0FB3: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
27889FA0FB7: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0
27889FA0FBB: F3 0F 11 6D 94 - movss [rbp-6C],xmm5
27889FA0FC0: F3 0F 10 45 94 - movss xmm0,[rbp-6C]
27889FA0FC5: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
27889FA0FC9: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0
// ---------- INJECTING HERE ----------
27889FA0FCD: F3 41 0F 11 6F 40 - movss [r15+40],xmm5
// ---------- DONE INJECTING ----------
27889FA0FD3: 48 8B CF - mov rcx,rdi
27889FA0FD6: 33 D2 - xor edx,edx
27889FA0FD8: 48 8D 64 24 00 - lea rsp,[rsp+00]
27889FA0FDD: 90 - nop
27889FA0FDE: 49 BB C0 40 1C 8A 78 02 00 00 - mov r11,000002788A1C40C0
27889FA0FE8: 41 FF D3 - call r11
27889FA0FEB: 85 C0 - test eax,eax
27889FA0FED: 0F 84 50 02 00 00 - je 27889FA1243
27889FA0FF3: F3 0F 10 85 58 FF FF FF - movss xmm0,[rbp-000000A8]
27889FA0FFB: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
}
43
"Experience Points"
Float
xpaddy
40
46
"No Damage to anyone"
Auto Assembler Script
define(address,VapCharacter:set_Health+21)
define(bytes,F3 0F 11 AE A0 00 00 00)
[ENABLE]
{$lua}
if syntaxcheck then return end
if process and readInteger(process) ~= 0 then
mono_initialize()
LaunchMonoDataCollector()
else
local msg = 'No process detected.'
print(msg)
error(msg)
end
{$asm}
assert(address,bytes)
alloc(newmem,$1000,16E65360811)
label(code)
label(return)
newmem:
code:
// movss [rsi+000000A0],xmm5
jmp return
address:
jmp newmem
nop 3
return:
[DISABLE]
address:
db bytes
// movss [rsi+000000A0],xmm5
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: VapCharacter:set_Health+21
16E653607EF: 00 55 48 - add [rbp+48],dl
VapCharacter:set_Health+2: 8B EC - mov ebp,esp
VapCharacter:set_Health+4: 48 83 EC 30 - sub rsp,30
VapCharacter:set_Health+8: 48 89 75 F8 - mov [rbp-08],rsi
VapCharacter:set_Health+c: 48 8B F1 - mov rsi,rcx
VapCharacter:set_Health+f: F3 0F 11 4D F0 - movss [rbp-10],xmm1
VapCharacter:set_Health+14: F3 0F 10 45 F0 - movss xmm0,[rbp-10]
VapCharacter:set_Health+19: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
VapCharacter:set_Health+1d: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0
// ---------- INJECTING HERE ----------
VapCharacter:set_Health+21: F3 0F 11 AE A0 00 00 00 - movss [rsi+000000A0],xmm5
// ---------- DONE INJECTING ----------
VapCharacter:set_Health+29: 48 8B CE - mov rcx,rsi
VapCharacter:set_Health+2c: 33 D2 - xor edx,edx
VapCharacter:set_Health+2e: 49 BB 60 08 36 65 6E 01 00 00 - mov r11,VapCharacter:UpdateVitals
VapCharacter:set_Health+38: 41 FF D3 - call r11
VapCharacter:set_Health+3b: 48 8B 75 F8 - mov rsi,[rbp-08]
VapCharacter:set_Health+3f: 48 8D 65 00 - lea rsp,[rbp+00]
VapCharacter:set_Health+43: 5D - pop rbp
VapCharacter:set_Health+44: C3 - ret
16E65360835: 00 00 - add [rax],al
16E65360837: 00 01 - add [rcx],al
16E65360839: 04 02 - add al,02
}
56
"Coordinates"
Float
"THREADSTACK0"-00000AD8
B0
48
0
330
540
10
53
"You are not really ported (teleports you back at first move you make)"
1
54
"but you can take actions like peress a button at the new position"
1
57
"1 Step West = -3"
1
51
"X"
0
Float
+0
52
"Y"
0
Float
+8
statsaddy
1A491DF0000
value
1A491DF0010
xpaddy
23080AF0000
VapGUIVitalBar:OnVitalChangedEvent+b4 - F3 0F11 6F 38 - movss [rdi+38],xmm5