1
"買物品時Mira不減 (金錢仍需足夠) / Mira not decrease when buy item (Mira must enough)"
Auto Assembler Script
{ Game : ed9.exe
Version:
Date : 2022-07-28
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BUY_NO_MONEY_DEC,ed9.exe,2B CD 85 C9 0F 4F C1) // should be unique
alloc(newmem,$1000,INJECT_BUY_NO_MONEY_DEC)
label(code)
label(return)
label(mira_base_addr)
newmem:
mov [mira_base_addr], r8
mov ebp 0
cmp ecx, #10000
jae @F
mov ecx, #10000
code:
sub ecx,ebp
test ecx,ecx
cmovg eax,ecx
jmp return
align 10 cc
mira_base_addr:
dq 0
INJECT_BUY_NO_MONEY_DEC:
jmp newmem
nop 2
return:
registersymbol(INJECT_BUY_NO_MONEY_DEC)
registersymbol(mira_base_addr)
[DISABLE]
INJECT_BUY_NO_MONEY_DEC:
db 2B CD 85 C9 0F 4F C1
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ed9.exe+3097FD
ed9.exe+3097CD: 0F B6 84 81 78 70 0B 00 - movzx eax,byte ptr [rcx+rax*4+000B7078]
ed9.exe+3097D5: 03 C6 - add eax,esi
ed9.exe+3097D7: 3B 87 C8 00 00 00 - cmp eax,[rdi+000000C8]
ed9.exe+3097DD: 0F 87 CD 00 00 00 - ja ed9.exe+3098B0
ed9.exe+3097E3: 8B 17 - mov edx,[rdi]
ed9.exe+3097E5: 44 8B C6 - mov r8d,esi
ed9.exe+3097E8: E8 D3 75 FA FF - call ed9.exe+2B0DC0
ed9.exe+3097ED: 4C 8B 05 24 B5 49 00 - mov r8,[ed9.exe+7A4D18]
ed9.exe+3097F4: 33 C0 - xor eax,eax
ed9.exe+3097F6: 41 8B 88 A8 01 19 00 - mov ecx,[r8+001901A8]
// ---------- INJECTING HERE ----------
ed9.exe+3097FD: 2B CD - sub ecx,ebp
// ---------- DONE INJECTING ----------
ed9.exe+3097FF: 85 C9 - test ecx,ecx
ed9.exe+309801: 0F 4F C1 - cmovg eax,ecx
ed9.exe+309804: 48 8B 0D 1D B5 49 00 - mov rcx,[ed9.exe+7A4D28]
ed9.exe+30980B: 41 89 80 A8 01 19 00 - mov [r8+001901A8],eax
ed9.exe+309812: 8B 81 50 11 01 00 - mov eax,[rcx+00011150]
ed9.exe+309818: C1 E0 02 - shl eax,02
ed9.exe+30981B: C1 F8 02 - sar eax,02
ed9.exe+30981E: 03 C5 - add eax,ebp
ed9.exe+309820: 25 FF FF FF 3F - and eax,3FFFFFFF
ed9.exe+309825: 0F BA E8 1E - bts eax,1E
}
2
"Mira"
0
4 Bytes
mira_base_addr
1901a8
3
"部份基本資料 (開啟選單) / Base data (Usage: open menu)"
Auto Assembler Script
{ Game : ed9.exe
Version:
Date : 2022-07-28
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BASE_DATA,ed9.exe,B0 * * * * 48 8B 03 45 33 C9) // should be unique
alloc(newmem,$1000,INJECT_BASE_DATA)
label(code)
label(return)
label(i_base_data_addr)
newmem:
mov [i_base_data_addr], rax
code:
mov rax,[rbx]
xor r9d,r9d
jmp return
align 10 cc
i_base_data_addr:
dq 0
INJECT_BASE_DATA+05:
jmp newmem
nop
return:
registersymbol(INJECT_BASE_DATA)
registersymbol(i_base_data_addr)
[DISABLE]
INJECT_BASE_DATA+05:
db 48 8B 03 45 33 C9
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ed9.exe+113E42
ed9.exe+113E15: E8 D6 00 F5 FF - call ed9.exe+63EF0
ed9.exe+113E1A: 90 - nop
ed9.exe+113E1B: C6 45 00 00 - mov byte ptr [rbp+00],00
ed9.exe+113E1F: 4C 8D 35 DA C1 EE FF - lea r14,[ed9.exe]
ed9.exe+113E26: FF C7 - inc edi
ed9.exe+113E28: 48 83 C6 04 - add rsi,04
ed9.exe+113E2C: 83 FF 08 - cmp edi,08
ed9.exe+113E2F: 0F 82 FB FE FF FF - jb ed9.exe+113D30
ed9.exe+113E35: 48 8B 05 DC 0E 69 00 - mov rax,[ed9.exe+7A4D18]
ed9.exe+113E3C: 8B B0 A8 01 19 00 - mov esi,[rax+001901A8]
// ---------- INJECTING HERE ----------
ed9.exe+113E42: 48 8B 03 - mov rax,[rbx]
// ---------- DONE INJECTING ----------
ed9.exe+113E45: 45 33 C9 - xor r9d,r9d
ed9.exe+113E48: 45 8D 41 02 - lea r8d,[r9+02]
ed9.exe+113E4C: 48 8D 15 65 68 5C 00 - lea rdx,[ed9.exe+6DA6B8]
ed9.exe+113E53: 48 8B 88 A0 00 00 00 - mov rcx,[rax+000000A0]
ed9.exe+113E5A: E8 61 A5 25 00 - call ed9.exe+36E3C0
ed9.exe+113E5F: 48 85 C0 - test rax,rax
ed9.exe+113E62: 74 56 - je ed9.exe+113EBA
ed9.exe+113E64: 45 33 C9 - xor r9d,r9d
ed9.exe+113E67: 41 B8 FF FF FF 7F - mov r8d,7FFFFFFF
ed9.exe+113E6D: 48 8D 15 30 40 5C 00 - lea rdx,[ed9.exe+6D7EA4]
}
4
"Base Addr."
1
0
808080
8 Bytes
i_base_data_addr
11
"地 / Earth"
0
4 Bytes
i_base_data_addr
190188
12
"水 / Water"
0
4 Bytes
i_base_data_addr
19018C
13
"火 / Fire"
0
4 Bytes
i_base_data_addr
190190
14
"風 / Wind"
0
4 Bytes
i_base_data_addr
190194
15
"時"
0
4 Bytes
i_base_data_addr
190198
16
"空"
0
4 Bytes
i_base_data_addr
19019C
17
"幻"
0
4 Bytes
i_base_data_addr
1901A0
18
"耀金石塊 / Exchange"
0
4 Bytes
i_base_data_addr
1901A4
5
"Mira"
0
4 Bytes
i_base_data_addr
1901a8
9
"Gourmet Point"
0
4 Bytes
i_base_data_addr
1901B4
10
"遊戲時間 / Playing time"
0
Double
i_base_data_addr
1901B8
7
"填充道具、料理數量 (需大於1;使用方式：開啟道具選單) / Fill consumables (must > 1; usage: open item menu)"
Auto Assembler Script
{ Game : ed9.exe
Version:
Date : 2022-07-28
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_FILL_ITEMS,ed9.exe,0F B6 94 88 78 70 0B 00 85 D2 75 10 48 8B D3 E8 D4) // should be unique
alloc(newmem,$1000,INJECT_FILL_ITEMS)
label(code)
label(return)
newmem:
push rbx
movzx ebx,byte ptr [rax+rcx*4+000B7078]
cmp bl, 2
jb @F
cmp bl, #75
jae @F
mov bl, #75
mov [rax+rcx*4+000B7078], bl
@@:
pop rbx
code:
movzx edx,byte ptr [rax+rcx*4+000B7078]
jmp return
INJECT_FILL_ITEMS:
jmp newmem
nop 3
return:
registersymbol(INJECT_FILL_ITEMS)
[DISABLE]
INJECT_FILL_ITEMS:
db 0F B6 94 88 78 70 0B 00
unregistersymbol(INJECT_FILL_ITEMS)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ed9.exe+345538
ed9.exe+34550C: E8 1F 4F 02 00 - call ed9.exe+36A430
ed9.exe+345511: EB 31 - jmp ed9.exe+345544
ed9.exe+345513: 8D 88 CA FE FF FF - lea ecx,[rax-00000136]
ed9.exe+345519: 83 F9 07 - cmp ecx,07
ed9.exe+34551C: 77 10 - ja ed9.exe+34552E
ed9.exe+34551E: 48 8B 05 F3 F7 45 00 - mov rax,[ed9.exe+7A4D18]
ed9.exe+345525: 8B 94 88 88 01 19 00 - mov edx,[rax+rcx*4+00190188]
ed9.exe+34552C: EB 12 - jmp ed9.exe+345540
ed9.exe+34552E: 48 8B C8 - mov rcx,rax
ed9.exe+345531: 48 8B 05 E0 F7 45 00 - mov rax,[ed9.exe+7A4D18]
// ---------- INJECTING HERE ----------
ed9.exe+345538: 0F B6 94 88 78 70 0B 00 - movzx edx,byte ptr [rax+rcx*4+000B7078]
// ---------- DONE INJECTING ----------
ed9.exe+345540: 85 D2 - test edx,edx
ed9.exe+345542: 75 10 - jne ed9.exe+345554
ed9.exe+345544: 48 8B D3 - mov rdx,rbx
ed9.exe+345547: E8 D4 F6 EF FF - call ed9.exe+244C20
ed9.exe+34554C: 85 C0 - test eax,eax
ed9.exe+34554E: 0F 84 4E 01 00 00 - je ed9.exe+3456A2
ed9.exe+345554: 45 85 F6 - test r14d,r14d
ed9.exe+345557: 74 13 - je ed9.exe+34556C
ed9.exe+345559: 41 83 FE 01 - cmp r14d,01
ed9.exe+34555D: 74 1E - je ed9.exe+34557D
}
27
"CP使用時回滿 / When use CP: recharge"
Auto Assembler Script
{ Game : ed9.exe
Version:
Date : 2022-07-28
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_USE_CP,ed9.exe,41 8B 4A 1C 41 8B 52 20) // should be unique
alloc(newmem,$1000,INJECT_USE_CP)
label(code)
label(return)
newmem:
push rax
mov ax, [r10]
cmp ax, FFFF
je to_enemy
mov eax, [r10+20]
mov [r10+1C], eax
to_enemy:
endp:
pop rax
code:
mov ecx,[r10+1C]
mov edx,[r10+20]
jmp return
INJECT_USE_CP:
jmp newmem
nop 3
return:
registersymbol(INJECT_USE_CP)
[DISABLE]
INJECT_USE_CP:
db 41 8B 4A 1C 41 8B 52 20
unregistersymbol(INJECT_USE_CP)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ed9.exe+D04A4
ed9.exe+D0488: 41 89 52 14 - mov [r10+14],edx
ed9.exe+D048C: C3 - ret
ed9.exe+D048D: 41 8B 42 20 - mov eax,[r10+20]
ed9.exe+D0491: 44 3B D8 - cmp r11d,eax
ed9.exe+D0494: 41 0F 4C C3 - cmovl eax,r11d
ed9.exe+D0498: 33 C9 - xor ecx,ecx
ed9.exe+D049A: 85 C0 - test eax,eax
ed9.exe+D049C: 0F 48 C1 - cmovs eax,ecx
ed9.exe+D049F: 41 89 42 1C - mov [r10+1C],eax
ed9.exe+D04A3: C3 - ret
// ---------- INJECTING HERE ----------
ed9.exe+D04A4: 41 8B 4A 1C - mov ecx,[r10+1C]
// ---------- DONE INJECTING ----------
ed9.exe+D04A8: 41 8B 52 20 - mov edx,[r10+20]
ed9.exe+D04AC: 41 03 CB - add ecx,r11d
ed9.exe+D04AF: 3B CA - cmp ecx,edx
ed9.exe+D04B1: 0F 4C D1 - cmovl edx,ecx
ed9.exe+D04B4: 33 C9 - xor ecx,ecx
ed9.exe+D04B6: 85 D2 - test edx,edx
ed9.exe+D04B8: 0F 48 D1 - cmovs edx,ecx
ed9.exe+D04BB: 41 89 52 1C - mov [r10+1C],edx
ed9.exe+D04BF: C3 - ret
ed9.exe+D04C0: 45 8B 42 10 - mov r8d,[r10+10]
}
22
"HP/EP/CP (受傷害時 / when get hit)"
Auto Assembler Script
{ Game : ed9.exe
Version:
Date : 2022-07-28
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_DMG_CTRL,ed9.exe,41 89 52 0C C3) // should be unique
alloc(newmem,$1000,INJECT_DMG_CTRL)
label(code)
label(return)
label(is_cp_full)
label(is_ep_full)
label(is_hp_full)
newmem:
push rax
mov ax, [r10]
cmp ax, FFFF
je to_enemy
check_ep:
cmp dword ptr [is_ep_full], 1
jne check_cp
mov eax, [r10+18]
mov [r10+14], eax
check_cp:
cmp dword ptr [is_cp_full], 1
jne check_hp
mov eax, [r10+20]
mov [r10+1C], eax
check_hp:
cmp dword ptr [is_hp_full], 1
jne endp
mov edx, [r10+10]
to_enemy:
endp:
pop rax
code:
mov [r10+0C],edx
ret
jmp return
align 10 cc
is_cp_full:
dd 1
is_ep_full:
dd 1
is_hp_full:
dd 0
INJECT_DMG_CTRL:
jmp newmem
return:
registersymbol(INJECT_DMG_CTRL)
registersymbol(is_cp_full)
registersymbol(is_ep_full)
registersymbol(is_hp_full)
[DISABLE]
INJECT_DMG_CTRL:
db 41 89 52 0C C3
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ed9.exe+D0455
ed9.exe+D0439: 41 89 42 0C - mov [r10+0C],eax
ed9.exe+D043D: C3 - ret
ed9.exe+D043E: 41 8B 4A 0C - mov ecx,[r10+0C]
ed9.exe+D0442: 41 8B 52 10 - mov edx,[r10+10]
ed9.exe+D0446: 41 03 CB - add ecx,r11d
ed9.exe+D0449: 3B CA - cmp ecx,edx
ed9.exe+D044B: 0F 4C D1 - cmovl edx,ecx
ed9.exe+D044E: 33 C9 - xor ecx,ecx
ed9.exe+D0450: 85 D2 - test edx,edx
ed9.exe+D0452: 0F 48 D1 - cmovs edx,ecx
// ---------- INJECTING HERE ----------
ed9.exe+D0455: 41 89 52 0C - mov [r10+0C],edx
// ---------- DONE INJECTING ----------
ed9.exe+D0459: C3 - ret
ed9.exe+D045A: 41 8B 42 18 - mov eax,[r10+18]
ed9.exe+D045E: 44 3B D8 - cmp r11d,eax
ed9.exe+D0461: 41 0F 4C C3 - cmovl eax,r11d
ed9.exe+D0465: 33 C9 - xor ecx,ecx
ed9.exe+D0467: 85 C0 - test eax,eax
ed9.exe+D0469: 0F 48 C1 - cmovs eax,ecx
ed9.exe+D046C: 41 89 42 14 - mov [r10+14],eax
ed9.exe+D0470: C3 - ret
ed9.exe+D0471: 41 8B 4A 14 - mov ecx,[r10+14]
}
23
"Full HP?"
0:No
1:Yes
0
4 Bytes
is_hp_full
24
"Full EP?"
0:No
1:Yes
0
4 Bytes
is_ep_full
25
"Full CP?"
0:No
1:Yes
0
4 Bytes
is_cp_full
21
"_WIP"
1
20
"No damage (Display incorrect)"
Auto Assembler Script
{ Game : ed9.exe
Version:
Date : 2022-07-28
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_DAMAGE_CTRL,ed9.exe,89 9F 90 00 00 00 48 8B) // should be unique
alloc(newmem,$1000,INJECT_DAMAGE_CTRL)
label(code)
label(return)
newmem:
push rcx
push rax
mov rcx, [rdi+00000088]
test rcx, rcx
jz endp
// monster vs chara
mov al, [rcx+10]
cmp al, 6D // 'm'
je to_enemy
movss xmm15, [rdi+00000028]
cvtss2si eax, xmm15
mov ebx, eax
mov eax, [rdi+00000028]
mov [rdi+0000002C], eax
mov [rdi+00000030], eax
mov [rdi+00000034], eax
to_enemy:
endp:
pop rax
pop rcx
code:
mov [rdi+00000090],ebx
jmp return
INJECT_DAMAGE_CTRL:
jmp newmem
nop
return:
registersymbol(INJECT_DAMAGE_CTRL)
[DISABLE]
INJECT_DAMAGE_CTRL:
db 89 9F 90 00 00 00
unregistersymbol(INJECT_DAMAGE_CTRL)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ed9.exe+102440
ed9.exe+10241D: 7A 02 - jp ed9.exe+102421
ed9.exe+10241F: 74 05 - je ed9.exe+102426
ed9.exe+102421: F3 0F 11 4F 28 - movss [rdi+28],xmm1
ed9.exe+102426: 39 9F 90 00 00 00 - cmp [rdi+00000090],ebx
ed9.exe+10242C: 74 18 - je ed9.exe+102446
ed9.exe+10242E: 66 0F 6E CB - movd xmm1,ebx
ed9.exe+102432: 0F 28 D6 - movaps xmm2,xmm6
ed9.exe+102435: 0F 5B C9 - cvtdq2ps xmm1,xmm1
ed9.exe+102438: 48 8B CF - mov rcx,rdi
ed9.exe+10243B: E8 30 A0 23 00 - call ed9.exe+33C470
// ---------- INJECTING HERE ----------
ed9.exe+102440: 89 9F 90 00 00 00 - mov [rdi+00000090],ebx
// ---------- DONE INJECTING ----------
ed9.exe+102446: 48 8B 87 88 00 00 00 - mov rax,[rdi+00000088]
ed9.exe+10244D: 0F 28 D6 - movaps xmm2,xmm6
ed9.exe+102450: 48 8B 88 08 05 00 00 - mov rcx,[rax+00000508]
ed9.exe+102457: 48 8B 01 - mov rax,[rcx]
ed9.exe+10245A: 48 8D 8F 98 00 00 00 - lea rcx,[rdi+00000098]
ed9.exe+102461: F3 0F 10 48 74 - movss xmm1,[rax+74]
ed9.exe+102466: 8B 40 78 - mov eax,[rax+78]
ed9.exe+102469: 89 87 C0 00 00 00 - mov [rdi+000000C0],eax
ed9.exe+10246F: E8 FC 9F 23 00 - call ed9.exe+33C470
ed9.exe+102474: 48 85 ED - test rbp,rbp
}
8
"The Legend of Heroes: Kuro no Kiseki 英雄傳說 黎之軌跡 / https://opencheattables.com / CE 7.4+"
400080
1