114982
"<=== Attach to process"
0000FF
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if(getCEVersion() < 7.4) then
ShowMessage('Warning! CE version should be 7.4 or above')
end
OpenProcess("Zoria AoS.exe")
if(process == nil) then
ShowMessage('The process is NOT found!')
end
{$asm}
[DISABLE]
114991
"GodMode and One-Hit-Kill 2"
Auto Assembler Script
[ENABLE]
aobscanmodule(health,GameAssembly.dll,89 47 28 48 8B 47 70) // should be unique
alloc(newmem,$1000,health)
label(code)
label(return)
label(godmode)
label(onehit)
label(godmode_on)
label(onehit_on)
newmem:
cmp [rdi+88],0 // check if it's us (Enemys have no followers)
jne godmode // if so, see if we want to be invulnerable
jmp onehit // if it's not us, see if one-hit-kills is on
godmode:
cmp byte ptr [godmode_on],1 // check if godmode-box is activated
jne code // if not, back to the normal code
mov eax,#9999 // fill up life
jmp code // and go back to the normal code
onehit:
cmp byte ptr [onehit_on],1 // check if one-hit-kill is activated
jne code // if not, back to the normal code
mov eax,#0 // set the new amount of enemys life to zero
code:
mov [rdi+28],eax
mov rax,[rdi+70]
jmp return
godmode_on:
db 0
onehit_on:
db 0
health:
jmp newmem
nop 2
return:
registersymbol(health godmode_on onehit_on)
[DISABLE]
health:
db 89 47 28 48 8B 47 70
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+20C18F6
GameAssembly.dll+20C18D5: 8B E8 - mov ebp,eax
GameAssembly.dll+20C18D7: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll+20C18DE: 75 05 - jne GameAssembly.dll+20C18E5
GameAssembly.dll+20C18E0: E8 9B 2F 10 FE - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+20C18E5: 45 33 C9 - xor r9d,r9d
GameAssembly.dll+20C18E8: 44 8B C5 - mov r8d,ebp
GameAssembly.dll+20C18EB: 33 D2 - xor edx,edx
GameAssembly.dll+20C18ED: 8B CB - mov ecx,ebx
GameAssembly.dll+20C18EF: E8 6C 2E 19 FF - call GameAssembly.dll+1254760
GameAssembly.dll+20C18F4: 8B D8 - mov ebx,eax
// ---------- INJECTING HERE ----------
GameAssembly.dll+20C18F6: 89 47 28 - mov [rdi+28],eax
// ---------- DONE INJECTING ----------
GameAssembly.dll+20C18F9: 48 8B 47 70 - mov rax,[rdi+70]
GameAssembly.dll+20C18FD: 2B DE - sub ebx,esi
GameAssembly.dll+20C18FF: 48 85 C0 - test rax,rax
GameAssembly.dll+20C1902: 74 13 - je GameAssembly.dll+20C1917
GameAssembly.dll+20C1904: 4C 8B 48 28 - mov r9,[rax+28]
GameAssembly.dll+20C1908: 44 8B C3 - mov r8d,ebx
GameAssembly.dll+20C190B: 48 8B 48 40 - mov rcx,[rax+40]
GameAssembly.dll+20C190F: BA 0D 00 00 00 - mov edx,0000000D
GameAssembly.dll+20C1914: FF 50 18 - call qword ptr [rax+18]
GameAssembly.dll+20C1917: 8B C3 - mov eax,ebx
}
114985
"GodMode"
Auto Assembler Script
[ENABLE]
godmode_on:
db 1
[DISABLE]
godmode_on:
db 0
114984
"OneHit Kill"
Auto Assembler Script
[ENABLE]
onehit_on:
db 1
[DISABLE]
onehit_on:
db 0
103
"Instead of loosing money/supplies/mats: get +100 each time"
Auto Assembler Script
[ENABLE]
aobscanmodule(gold,GameAssembly.dll,01 7B 38 40 84 F6) // should be unique
alloc(newmem,$100,gold)
label(code)
label(return)
newmem:
mov edi,#100
code:
add [rbx+38],edi
test sil,sil
jmp return
gold:
jmp newmem
nop
return:
registersymbol(gold)
[DISABLE]
gold:
db 01 7B 38 40 84 F6
unregistersymbol(gold)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+21F8CD3
GameAssembly.dll+21F8CB3: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll+21F8CBA: 75 05 - jne GameAssembly.dll+21F8CC1
GameAssembly.dll+21F8CBC: E8 6F 6E 02 FE - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+21F8CC1: 45 33 C0 - xor r8d,r8d
GameAssembly.dll+21F8CC4: 8B D7 - mov edx,edi
GameAssembly.dll+21F8CC6: 8B CD - mov ecx,ebp
GameAssembly.dll+21F8CC8: E8 63 34 11 FF - call GameAssembly.dll+130C130
GameAssembly.dll+21F8CCD: 8B F8 - mov edi,eax
GameAssembly.dll+21F8CCF: F7 DF - neg edi
GameAssembly.dll+21F8CD1: 74 1E - je GameAssembly.dll+21F8CF1
// ---------- INJECTING HERE ----------
GameAssembly.dll+21F8CD3: 01 7B 38 - add [rbx+38],edi
// ---------- DONE INJECTING ----------
GameAssembly.dll+21F8CD6: 40 84 F6 - test sil,sil
GameAssembly.dll+21F8CD9: 74 1D - je GameAssembly.dll+21F8CF8
GameAssembly.dll+21F8CDB: 33 D2 - xor edx,edx
GameAssembly.dll+21F8CDD: 48 8B CB - mov rcx,rbx
GameAssembly.dll+21F8CE0: E8 9B 96 FE FF - call GameAssembly.dll+21E2380
GameAssembly.dll+21F8CE5: 8B 4B 38 - mov ecx,[rbx+38]
GameAssembly.dll+21F8CE8: 84 C0 - test al,al
GameAssembly.dll+21F8CEA: 75 09 - jne GameAssembly.dll+21F8CF5
GameAssembly.dll+21F8CEC: 2B CF - sub ecx,edi
GameAssembly.dll+21F8CEE: 89 4B 38 - mov [rbx+38],ecx
}
118
"Items with more than 1 item in stock do not decrease"
Auto Assembler Script
[ENABLE]
aobscanmodule(dealer,GameAssembly.dll,89 51 38 89 51 3C) // should be unique
alloc(newmem,$1000,dealer)
label(code)
label(return)
newmem:
code:
mov [rcx+38],edx
// mov [rcx+3C],edx
jmp return
dealer:
jmp newmem
nop
return:
registersymbol(dealer)
[DISABLE]
dealer:
db 89 51 38 89 51 3C
unregistersymbol(dealer)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+1D0DF40
GameAssembly.dll+1D0DF36: CC - int 3
GameAssembly.dll+1D0DF37: CC - int 3
GameAssembly.dll+1D0DF38: CC - int 3
GameAssembly.dll+1D0DF39: CC - int 3
GameAssembly.dll+1D0DF3A: CC - int 3
GameAssembly.dll+1D0DF3B: CC - int 3
GameAssembly.dll+1D0DF3C: CC - int 3
GameAssembly.dll+1D0DF3D: CC - int 3
GameAssembly.dll+1D0DF3E: CC - int 3
GameAssembly.dll+1D0DF3F: CC - int 3
// ---------- INJECTING HERE ----------
GameAssembly.dll+1D0DF40: 89 51 38 - mov [rcx+38],edx
// ---------- DONE INJECTING ----------
GameAssembly.dll+1D0DF43: 89 51 3C - mov [rcx+3C],edx
GameAssembly.dll+1D0DF46: C3 - ret
GameAssembly.dll+1D0DF47: CC - int 3
GameAssembly.dll+1D0DF48: CC - int 3
GameAssembly.dll+1D0DF49: CC - int 3
GameAssembly.dll+1D0DF4A: CC - int 3
GameAssembly.dll+1D0DF4B: CC - int 3
GameAssembly.dll+1D0DF4C: CC - int 3
GameAssembly.dll+1D0DF4D: CC - int 3
GameAssembly.dll+1D0DF4E: CC - int 3
}
114998
"set fatigue to zero when opening character"
Auto Assembler Script
[ENABLE]
aobscanmodule(fatigue,GameAssembly.dll,8B 40 10 48 8D 4C 24 50 33) // should be unique
alloc(newmem,$1000,fatigue)
label(code)
label(return)
newmem:
push ebx
mov ebx,0
mov [rax+10], ebx
pop ebx
code:
mov eax,[rax+10]
lea rcx,[rsp+50]
jmp return
fatigue:
jmp newmem
nop 3
return:
registersymbol(fatigue)
[DISABLE]
fatigue:
db 8B 40 10 48 8D 4C 24 50
unregistersymbol(fatigue)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+1FB26C9
GameAssembly.dll+1FB26A0: F3 0F 5E 0D 00 D5 1B 00 - divss xmm1,[GameAssembly.dll+216FBA8]
GameAssembly.dll+1FB26A8: E8 73 73 02 00 - call GameAssembly.dll+1FD9A20
GameAssembly.dll+1FB26AD: 48 8B 7B 50 - mov rdi,[rbx+50]
GameAssembly.dll+1FB26B1: 0F 10 30 - movups xmm6,[rax]
GameAssembly.dll+1FB26B4: 48 8B 83 88 00 00 00 - mov rax,[rbx+00000088]
GameAssembly.dll+1FB26BB: 48 85 C0 - test rax,rax
GameAssembly.dll+1FB26BE: 74 7B - je GameAssembly.dll+1FB273B
GameAssembly.dll+1FB26C0: 48 8B 40 48 - mov rax,[rax+48]
GameAssembly.dll+1FB26C4: 48 85 C0 - test rax,rax
GameAssembly.dll+1FB26C7: 74 72 - je GameAssembly.dll+1FB273B
// ---------- INJECTING HERE ----------
GameAssembly.dll+1FB26C9: 8B 40 10 - mov eax,[rax+10]
// ---------- DONE INJECTING ----------
GameAssembly.dll+1FB26CC: 48 8D 4C 24 50 - lea rcx,[rsp+50]
GameAssembly.dll+1FB26D1: 33 D2 - xor edx,edx
GameAssembly.dll+1FB26D3: 89 44 24 50 - mov [rsp+50],eax
GameAssembly.dll+1FB26D7: E8 54 86 2A FF - call GameAssembly.dll+125AD30
GameAssembly.dll+1FB26DC: 48 8B 0D 15 9B 9E 00 - mov rcx,[GameAssembly.dll+299C1F8]
GameAssembly.dll+1FB26E3: 48 8B D8 - mov rbx,rax
GameAssembly.dll+1FB26E6: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll+1FB26ED: 75 05 - jne GameAssembly.dll+1FB26F4
GameAssembly.dll+1FB26EF: E8 8C 21 21 FE - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+1FB26F4: 45 33 C0 - xor r8d,r8d
}
114993
"get additional 500 XP when gaining XP"
Auto Assembler Script
[ENABLE]
aobscanmodule(xp,GameAssembly.dll,01 83 80 00 00 00) // should be unique
alloc(newmem,$100,xp)
label(code)
label(return)
newmem:
add eax,#500
code:
add [rbx+00000080],eax
jmp return
xp:
jmp newmem
nop
return:
registersymbol(xp)
[DISABLE]
xp:
db 01 83 80 00 00 00
unregistersymbol(xp)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+220E307
GameAssembly.dll+220E2DB: E8 30 08 CD FE - call GameAssembly.dll+EDEB10
GameAssembly.dll+220E2E0: 48 85 C0 - test rax,rax
GameAssembly.dll+220E2E3: 0F 84 92 01 00 00 - je GameAssembly.dll+220E47B
GameAssembly.dll+220E2E9: F3 0F 10 48 24 - movss xmm1,[rax+24]
GameAssembly.dll+220E2EE: EB 08 - jmp GameAssembly.dll+220E2F8
GameAssembly.dll+220E2F0: F3 0F 10 0D 50 A8 09 00 - movss xmm1,[GameAssembly.dll+22A8B48]
GameAssembly.dll+220E2F8: 66 0F 6E C5 - movd xmm0,ebp
GameAssembly.dll+220E2FC: 0F 5B C0 - cvtdq2ps xmm0,xmm0
GameAssembly.dll+220E2FF: F3 0F 59 C1 - mulss xmm0,xmm1
GameAssembly.dll+220E303: F3 0F 2C C0 - cvttss2si eax,xmm0
// ---------- INJECTING HERE ----------
GameAssembly.dll+220E307: 01 83 80 00 00 00 - add [rbx+00000080],eax
// ---------- DONE INJECTING ----------
GameAssembly.dll+220E30D: 48 8B 0D 8C 05 8F 00 - mov rcx,[GameAssembly.dll+2AFE8A0]
GameAssembly.dll+220E314: 8B BB 80 00 00 00 - mov edi,[rbx+00000080]
GameAssembly.dll+220E31A: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll+220E321: 75 05 - jne GameAssembly.dll+220E328
GameAssembly.dll+220E323: E8 08 18 01 FE - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+220E328: 33 D2 - xor edx,edx
GameAssembly.dll+220E32A: 8B CF - mov ecx,edi
GameAssembly.dll+220E32C: E8 DF 64 F2 FF - call GameAssembly.dll+2134810
GameAssembly.dll+220E331: 8B 7B 2C - mov edi,[rbx+2C]
GameAssembly.dll+220E334: 8B F0 - mov esi,eax
}
77
"Get Adress of selected character (activate and select a char)"
Auto Assembler Script
[ENABLE]
aobscanmodule(char,GameAssembly.dll,00 48 8B 11 8B 79 28) // should be unique
alloc(newmem,$100,char)
alloc(character,8)
label(code)
label(return)
newmem:
mov [character],rcx
code:
mov rdx,[rcx]
mov edi,[rcx+28]
jmp return
char+01:
jmp newmem
nop
return:
registersymbol(char character)
[DISABLE]
char+01:
db 48 8B 11 8B 79 28
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+20C9AB0
GameAssembly.dll+20C9A87: 75 05 - jne GameAssembly.dll+20C9A8E
GameAssembly.dll+20C9A89: E8 A2 60 15 FE - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+20C9A8E: 33 D2 - xor edx,edx
GameAssembly.dll+20C9A90: 48 8B CF - mov rcx,rdi
GameAssembly.dll+20C9A93: E8 F8 9C CB FF - call GameAssembly.dll+1D83790
GameAssembly.dll+20C9A98: 84 C0 - test al,al
GameAssembly.dll+20C9A9A: 0F 84 20 01 00 00 - je GameAssembly.dll+20C9BC0
GameAssembly.dll+20C9AA0: 48 8B 8B 88 00 00 00 - mov rcx,[rbx+00000088]
GameAssembly.dll+20C9AA7: 48 85 C9 - test rcx,rcx
GameAssembly.dll+20C9AAA: 0F 84 65 03 00 00 - je GameAssembly.dll+20C9E15
// ---------- INJECTING HERE ----------
GameAssembly.dll+20C9AB0: 48 8B 11 - mov rdx,[rcx]
// ---------- DONE INJECTING ----------
GameAssembly.dll+20C9AB3: 8B 79 28 - mov edi,[rcx+28]
GameAssembly.dll+20C9AB6: 48 8B 82 B8 01 00 00 - mov rax,[rdx+000001B8]
GameAssembly.dll+20C9ABD: 48 8B 92 C0 01 00 00 - mov rdx,[rdx+000001C0]
GameAssembly.dll+20C9AC4: FF D0 - call rax
GameAssembly.dll+20C9AC6: 48 8B 0D E3 9B A5 00 - mov rcx,[GameAssembly.dll+2B236B0]
GameAssembly.dll+20C9ACD: 8B F0 - mov esi,eax
GameAssembly.dll+20C9ACF: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll+20C9AD6: 75 05 - jne GameAssembly.dll+20C9ADD
GameAssembly.dll+20C9AD8: E8 53 60 15 FE - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+20C9ADD: 66 0F 6E CF - movd xmm1,edi
}
84
"Characters Base Address (put this in Dissect Data for more fun...)"
0
1
character
0
115008
"Name (sometimes,hehe)"
0
String
14
1
0
1
+40
14
18
50
78
"HP"
0
0000FF
4 Bytes
+28
79
"Level"
0
4 Bytes
+2c
80
"Shield Points"
0
4 Bytes
+30
81
"Mana (Energy)"
0
FF0000
4 Bytes
+34
82
"BaseMana"
0
4 Bytes
+38
98
"Experience Points"
0
4 Bytes
+80
100
"Availabe Stats Points"
0
4 Bytes
+84
rbx = base address
rbx+28 = health (4byte int). there are 2 floats but these are mirrored values
rbx +48 +30 +30 = gameCharacterType. 1=PC
this would, in theory, be the best way to do it.
But checking this crashes the game...
possible alternatives:
rbx +cc (0 = we)
rbx +dc (0 = they)
rbx +e4 (0 = they)