7
"Invulnerability"
Auto Assembler Script
[ENABLE]
aobscan(godmode,D9 5F 54 8B 47 38) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
cmp [edi+a4],1
je code
fstp dword ptr [edi+54]
code:
mov eax,[edi+38]
jmp return
godmode:
jmp newmem
nop
return:
registersymbol(godmode)
[DISABLE]
godmode:
db D9 5F 54 8B 47 38
unregistersymbol(godmode)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 062780CE
062780B3: D9 5F 50 - fstp dword ptr [edi+50]
062780B6: D9 45 0C - fld dword ptr [ebp+0C]
062780B9: D9 47 54 - fld dword ptr [edi+54]
062780BC: DF F1 - fcomip st(0),st(1)
062780BE: DD D8 - fstp st(0)
062780C0: 76 09 - jna 062780CB
062780C2: 8B 47 30 - mov eax,[edi+30]
062780C5: D9 40 34 - fld dword ptr [eax+34]
062780C8: D9 5F 4C - fstp dword ptr [edi+4C]
062780CB: D9 45 0C - fld dword ptr [ebp+0C]
// ---------- INJECTING HERE ----------
062780CE: D9 5F 54 - fstp dword ptr [edi+54]
062780D1: 8B 47 38 - mov eax,[edi+38]
// ---------- DONE INJECTING ----------
062780D4: 83 EC 0C - sub esp,0C
062780D7: 50 - push eax
062780D8: E8 CB 90 F5 FF - call 061D11A8
062780DD: 83 C4 10 - add esp,10
062780E0: 85 C0 - test eax,eax
062780E2: 74 16 - je 062780FA
062780E4: 8B 47 38 - mov eax,[edi+38]
062780E7: 8B 4F 34 - mov ecx,[edi+34]
062780EA: 6A 00 - push 00
062780EC: 6A 00 - push 00
}
10
"Always 200 Mana"
Auto Assembler Script
[ENABLE]
aobscan(mana,D9 40 54 D9 9D 34 FF FF FF D9 85 34 FF FF FF D9 5F 70) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
mov [eax+54],43480000
code:
fld dword ptr [eax+54]
fstp dword ptr [ebp-000000CC]
jmp return
mana:
jmp newmem
nop 4
return:
registersymbol(mana)
[DISABLE]
mana:
db D9 40 54 D9 9D 34 FF FF FF
unregistersymbol(mana)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 06518299
06518280: 39 09 - cmp [ecx],ecx
06518282: 8B 40 40 - mov eax,[eax+40]
06518285: 83 EC 08 - sub esp,08
06518288: 6A 05 - push 05
0651828A: 50 - push eax
0651828B: 39 00 - cmp [eax],eax
0651828D: E8 76 C4 F1 FF - call 06434708
06518292: 83 C4 10 - add esp,10
06518295: 8B C8 - mov ecx,eax
06518297: 39 09 - cmp [ecx],ecx
// ---------- INJECTING HERE ----------
06518299: D9 40 54 - fld dword ptr [eax+54]
0651829C: D9 9D 34 FF FF FF - fstp dword ptr [ebp-000000CC]
// ---------- DONE INJECTING ----------
065182A2: D9 85 34 FF FF FF - fld dword ptr [ebp-000000CC]
065182A8: D9 5F 70 - fstp dword ptr [edi+70]
065182AB: 8B 47 34 - mov eax,[edi+34]
065182AE: 83 EC 0C - sub esp,0C
065182B1: 50 - push eax
065182B2: 39 00 - cmp [eax],eax
065182B4: E8 5F 5D FF FF - call 0650E018
065182B9: 83 C4 10 - add esp,10
065182BC: 8B C8 - mov ecx,eax
065182BE: 39 09 - cmp [ecx],ecx
}
17
"Don't spent money in shop"
Auto Assembler Script
[ENABLE]
aobscan(gold,89 88 90 00 00 00 8B 40) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// mov [eax+00000090],ecx
jmp return
gold:
jmp newmem
nop
return:
registersymbol(gold)
[DISABLE]
gold:
db 89 88 90 00 00 00
unregistersymbol(gold)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 062CDB04
062CDAE8: 68 50 4C 97 17 - push 17974C50
062CDAED: E9 36 25 94 FF - jmp 05C10028
062CDAF2: 00 00 - add [eax],al
062CDAF4: 00 00 - add [eax],al
062CDAF6: 00 00 - add [eax],al
062CDAF8: 55 - push ebp
062CDAF9: 8B EC - mov ebp,esp
062CDAFB: 83 EC 08 - sub esp,08
062CDAFE: 8B 4D 0C - mov ecx,[ebp+0C]
062CDB01: 8B 45 08 - mov eax,[ebp+08]
// ---------- INJECTING HERE ----------
062CDB04: 89 88 90 00 00 00 - mov [eax+00000090],ecx
// ---------- DONE INJECTING ----------
062CDB0A: 8B 40 5C - mov eax,[eax+5C]
062CDB0D: 85 C0 - test eax,eax
062CDB0F: 74 13 - je 062CDB24
062CDB11: 8B 45 08 - mov eax,[ebp+08]
062CDB14: 8B 40 5C - mov eax,[eax+5C]
062CDB17: 83 EC 0C - sub esp,0C
062CDB1A: 50 - push eax
062CDB1B: 90 - nop
062CDB1C: 90 - nop
062CDB1D: 90 - nop
}
18
"alway 5k gold after buying"
Auto Assembler Script
[ENABLE]
aobscan(gold,89 88 90 00 00 00 8B 40) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
mov [ebp+0C],#5000
mov ecx,[ebp+0C]
code:
mov [eax+00000090],ecx
jmp return
gold:
jmp newmem
nop
return:
registersymbol(gold)
[DISABLE]
gold:
db 89 88 90 00 00 00
unregistersymbol(gold)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 062CDB04
062CDAE8: 68 50 4C 97 17 - push 17974C50
062CDAED: E9 36 25 94 FF - jmp 05C10028
062CDAF2: 00 00 - add [eax],al
062CDAF4: 00 00 - add [eax],al
062CDAF6: 00 00 - add [eax],al
062CDAF8: 55 - push ebp
062CDAF9: 8B EC - mov ebp,esp
062CDAFB: 83 EC 08 - sub esp,08
062CDAFE: 8B 4D 0C - mov ecx,[ebp+0C]
062CDB01: 8B 45 08 - mov eax,[ebp+08]
// ---------- INJECTING HERE ----------
062CDB04: 89 88 90 00 00 00 - mov [eax+00000090],ecx
// ---------- DONE INJECTING ----------
062CDB0A: 8B 40 5C - mov eax,[eax+5C]
062CDB0D: 85 C0 - test eax,eax
062CDB0F: 74 13 - je 062CDB24
062CDB11: 8B 45 08 - mov eax,[ebp+08]
062CDB14: 8B 40 5C - mov eax,[eax+5C]
062CDB17: 83 EC 0C - sub esp,0C
062CDB1A: 50 - push eax
062CDB1B: 90 - nop
062CDB1C: 90 - nop
062CDB1D: 90 - nop
}
13
"Find Experience Points"
Auto Assembler Script
[ENABLE]
aobscan(xperience,D9 40 54 D9 9D 38 FF FF FF) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(xpaddress)
newmem:
mov [xpaddress],eax
code:
fld dword ptr [eax+54]
fstp dword ptr [ebp-000000C8]
jmp return
xpaddress:
dq 0
xperience:
jmp newmem
nop 4
return:
registersymbol(xperience)
registersymbol(xpaddress)
[DISABLE]
xperience:
db D9 40 54 D9 9D 38 FF FF FF
unregistersymbol(xperience)
unregistersymbol(xpaddress)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 0651831C
06518302: E8 39 C7 FE FF - call 06504A40
06518307: 83 C4 10 - add esp,10
0651830A: 8B C8 - mov ecx,eax
0651830C: 39 09 - cmp [ecx],ecx
0651830E: 8B 40 74 - mov eax,[eax+74]
06518311: 8B C8 - mov ecx,eax
06518313: 39 09 - cmp [ecx],ecx
06518315: 8B 40 38 - mov eax,[eax+38]
06518318: 8B C8 - mov ecx,eax
0651831A: 39 09 - cmp [ecx],ecx
// ---------- INJECTING HERE ----------
0651831C: D9 40 54 - fld dword ptr [eax+54]
0651831F: D9 9D 38 FF FF FF - fstp dword ptr [ebp-000000C8]
// ---------- DONE INJECTING ----------
06518325: D9 85 38 FF FF FF - fld dword ptr [ebp-000000C8]
0651832B: D9 9F 8C 00 00 00 - fstp dword ptr [edi+0000008C]
06518331: 83 FE 01 - cmp esi,01
06518334: 0F 8E 7E 00 00 00 - jng 065183B8
0651833A: E8 D5 EC F7 FF - call 06497014
0651833F: 8B 40 70 - mov eax,[eax+70]
06518342: 8B 40 10 - mov eax,[eax+10]
06518345: 8D 4E FF - lea ecx,[esi-01]
06518348: 83 EC 08 - sub esp,08
0651834B: 51 - push ecx
}
14
"Experience"
Float
[xpaddress]+54