1
"inf. timer"
Auto Assembler Script
{ Game : KikiKaikai.exe
Version:
Date : 2025-01-06
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_TIME,GameAssembly.dll,F3 0F 11 80 A0 00 00 00 48) // should be unique
alloc(newmem,$1000,INJECT_INF_TIME)
label(code)
label(return)
newmem:
//GameMain._PostStep
code:
//movss [rax+000000A0],xmm0
jmp return
INJECT_INF_TIME:
jmp newmem
nop 3
return:
registersymbol(INJECT_INF_TIME)
[DISABLE]
INJECT_INF_TIME:
db F3 0F 11 80 A0 00 00 00
unregistersymbol(INJECT_INF_TIME)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+3114D4
GameAssembly.dll+311498: 48 8B 0D C9 65 C9 00 - mov rcx,[GameAssembly.dll+FA7A68]
GameAssembly.dll+31149F: F6 81 33 01 00 00 02 - test byte ptr [rcx+00000133],02
GameAssembly.dll+3114A6: 74 15 - je GameAssembly.dll+3114BD
GameAssembly.dll+3114A8: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll+3114AF: 75 0C - jne GameAssembly.dll+3114BD
GameAssembly.dll+3114B1: E8 EA AB E1 FF - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+3114B6: 48 8B 0D AB 65 C9 00 - mov rcx,[GameAssembly.dll+FA7A68]
GameAssembly.dll+3114BD: 48 8B 81 B8 00 00 00 - mov rax,[rcx+000000B8]
GameAssembly.dll+3114C4: F3 0F 10 80 A0 00 00 00 - movss xmm0,[rax+000000A0]
GameAssembly.dll+3114CC: F3 0F 5C 05 E8 96 96 00 - subss xmm0,[GameAssembly.dll+C7ABBC]
// ---------- INJECTING HERE ----------
GameAssembly.dll+3114D4: F3 0F 11 80 A0 00 00 00 - movss [rax+000000A0],xmm0
// ---------- DONE INJECTING ----------
GameAssembly.dll+3114DC: 48 8B 15 85 65 C9 00 - mov rdx,[GameAssembly.dll+FA7A68]
GameAssembly.dll+3114E3: 48 8B 82 B8 00 00 00 - mov rax,[rdx+000000B8]
GameAssembly.dll+3114EA: 66 0F 6E 80 A8 00 00 00 - movd xmm0,[rax+000000A8]
GameAssembly.dll+3114F2: 0F 5B C0 - cvtdq2ps xmm0,xmm0
GameAssembly.dll+3114F5: 0F 2F 80 A0 00 00 00 - comiss xmm0,[rax+000000A0]
GameAssembly.dll+3114FC: 76 6B - jna GameAssembly.dll+311569
GameAssembly.dll+3114FE: F6 82 33 01 00 00 02 - test byte ptr [rdx+00000133],02
GameAssembly.dll+311505: 8B BB 94 02 00 00 - mov edi,[rbx+00000294]
GameAssembly.dll+31150B: 74 18 - je GameAssembly.dll+311525
GameAssembly.dll+31150D: 83 BA E0 00 00 00 00 - cmp dword ptr [rdx+000000E0],00
}
21
"inf. barrier after acquired"
Auto Assembler Script
{ Game : KikiKaikai.exe
Version:
Date : 2025-01-07
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_SET_SHIELD,GameAssembly.dll,83 7A 40 00 75 07) // should be unique
aobscanmodule(INJECT_SET_SHIELD2,GameAssembly.dll,C7 40 40 00 00 00 00 B2) // should be unique
alloc(newmem,$1000,INJECT_SET_SHIELD)
label(code)
label(return)
newmem:
cmp dword ptr [rdx+40], 3
jae code
mov dword ptr [rdx+40], 3
code:
cmp dword ptr [rdx+40],00
reassemble(INJECT_SET_SHIELD+4)
//jne GameAssembly.dll+9699E6
jmp return
INJECT_SET_SHIELD:
jmp newmem
nop
return:
INJECT_SET_SHIELD2:
db C7 40 40 04 00 00 00
registersymbol(INJECT_SET_SHIELD)
registersymbol(INJECT_SET_SHIELD2)
[DISABLE]
INJECT_SET_SHIELD:
db 83 7A 40 00 75 07
INJECT_SET_SHIELD2:
db C7 40 40 00 00 00 00
unregistersymbol(INJECT_SET_SHIELD)
unregistersymbol(INJECT_SET_SHIELD2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+9699D9
GameAssembly.dll+9699B3: E8 28 53 25 00 - call SoundManager.StartSound
GameAssembly.dll+9699B8: 48 8B 87 30 02 00 00 - mov rax,[rdi+00000230]
GameAssembly.dll+9699BF: 48 85 C0 - test rax,rax
GameAssembly.dll+9699C2: 74 2E - je GameAssembly.dll+9699F2
GameAssembly.dll+9699C4: 48 8B 48 18 - mov rcx,[rax+18]
GameAssembly.dll+9699C8: 48 85 C9 - test rcx,rcx
GameAssembly.dll+9699CB: 74 25 - je GameAssembly.dll+9699F2
GameAssembly.dll+9699CD: 48 8B 91 48 02 00 00 - mov rdx,[rcx+00000248]
GameAssembly.dll+9699D4: 48 85 D2 - test rdx,rdx
GameAssembly.dll+9699D7: 74 19 - je GameAssembly.dll+9699F2
// ---------- INJECTING HERE ----------
GameAssembly.dll+9699D9: 83 7A 40 00 - cmp dword ptr [rdx+40],00
// ---------- DONE INJECTING ----------
GameAssembly.dll+9699DD: 75 07 - jne GameAssembly.dll+9699E6
GameAssembly.dll+9699DF: C7 40 60 00 00 80 3F - mov [rax+60],3F800000
GameAssembly.dll+9699E6: C7 40 5C 00 00 80 3F - mov [rax+5C],3F800000
GameAssembly.dll+9699ED: E9 55 FE FF FF - jmp GameAssembly.dll+969847
GameAssembly.dll+9699F2: E8 D9 7F 83 FF - call GameAssembly.dll+1A19D0
GameAssembly.dll+9699F7: CC - int 3
GameAssembly.dll+9699F8: CC - int 3
GameAssembly.dll+9699F9: CC - int 3
GameAssembly.dll+9699FA: CC - int 3
GameAssembly.dll+9699FB: CC - int 3
}
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+967BA6
//ObjPlayer.ChangeDamageStep
GameAssembly.dll+967B7C: FF 90 78 02 00 00 - call qword ptr [rax+00000278]
GameAssembly.dll+967B82: 45 33 C0 - xor r8d,r8d
GameAssembly.dll+967B85: 0F 57 C9 - xorps xmm1,xmm1
GameAssembly.dll+967B88: 48 8B CB - mov rcx,rbx
GameAssembly.dll+967B8B: E8 40 C2 26 00 - call kkObjBase.set_m_PosZ
GameAssembly.dll+967B90: 48 8B 83 48 02 00 00 - mov rax,[rbx+00000248]
GameAssembly.dll+967B97: C6 83 34 03 00 00 00 - mov byte ptr [rbx+00000334],00
GameAssembly.dll+967B9E: 48 85 C0 - test rax,rax
GameAssembly.dll+967BA1: 74 3B - je GameAssembly.dll+967BDE
GameAssembly.dll+967BA3: 45 33 C0 - xor r8d,r8d
// ---------- INJECTING HERE ----------
GameAssembly.dll+967BA6: C7 40 40 00 00 00 00 - mov [rax+40],00000000
// ---------- DONE INJECTING ----------
GameAssembly.dll+967BAD: B2 01 - mov dl,01
GameAssembly.dll+967BAF: 48 8B CB - mov rcx,rbx
GameAssembly.dll+967BB2: E8 59 37 00 00 - call ObjPlayer.PowerDown
GameAssembly.dll+967BB7: 45 33 C0 - xor r8d,r8d
GameAssembly.dll+967BBA: 48 8B CB - mov rcx,rbx
GameAssembly.dll+967BBD: 41 8D 50 01 - lea edx,[r8+01]
GameAssembly.dll+967BC1: E8 9A BA FD FF - call ObjCharacter.SetFlag
GameAssembly.dll+967BC6: 45 33 C0 - xor r8d,r8d
GameAssembly.dll+967BC9: 48 8B D7 - mov rdx,rdi
GameAssembly.dll+967BCC: 48 8B CB - mov rcx,rbx
}
23
"inf. bomb"
Auto Assembler Script
{ Game : KikiKaikai.exe
Version:
Date : 2025-01-07
Author : Abbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_BOMB,GameAssembly.dll,65 E7 FF 48 8B 5C 24 30 48 83 C4 20 5F) // should be unique
alloc(newmem,$1000,INJECT_INF_BOMB)
label(code)
label(return)
newmem:
cmp eax, 4
ja code
mov eax, 5
mov dword ptr [rcx+10], 5
code:
add rsp,20
pop rdi
jmp return
INJECT_INF_BOMB+08:
jmp newmem
return:
registersymbol(INJECT_INF_BOMB)
[DISABLE]
INJECT_INF_BOMB+08:
db 48 83 C4 20 5F
unregistersymbol(INJECT_INF_BOMB)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+32AE25
GameAssembly.dll+32AE00: 45 33 C0 - xor r8d,r8d
GameAssembly.dll+32AE03: 33 D2 - xor edx,edx
GameAssembly.dll+32AE05: 48 8B C8 - mov rcx,rax
GameAssembly.dll+32AE08: 48 8B D8 - mov rbx,rax
GameAssembly.dll+32AE0B: E8 30 F2 88 00 - call ScrambleInt..ctor
GameAssembly.dll+32AE10: 48 8B D3 - mov rdx,rbx
GameAssembly.dll+32AE13: 48 89 5F 30 - mov [rdi+30],rbx
GameAssembly.dll+32AE17: 48 8D 4F 30 - lea rcx,[rdi+30]
GameAssembly.dll+32AE1B: E8 D0 65 E7 FF - call GameAssembly.dll+1A13F0
GameAssembly.dll+32AE20: 48 8B 5C 24 30 - mov rbx,[rsp+30]
// ---------- INJECTING HERE ----------
GameAssembly.dll+32AE25: 48 83 C4 20 - add rsp,20
// ---------- DONE INJECTING ----------
GameAssembly.dll+32AE29: 5F - pop rdi
GameAssembly.dll+32AE2A: C3 - ret
GameAssembly.dll+32AE2B: CC - int 3
GameAssembly.dll+32AE2C: CC - int 3
GameAssembly.dll+32AE2D: CC - int 3
GameAssembly.dll+32AE2E: CC - int 3
GameAssembly.dll+32AE2F: CC - int 3
PlayerWork..ctor: 48 89 5C 24 08 - mov [rsp+08],rbx
GameAssembly.dll+32AE35: 48 89 6C 24 10 - mov [rsp+10],rbp
GameAssembly.dll+32AE3A: 48 89 74 24 18 - mov [rsp+18],rsi
}
22
"Keep min coin after Roulette"
Auto Assembler Script
{ Game : KikiKaikai.exe
Version:
Date : 2025-01-07
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_MIN_COINS,GameAssembly.dll,8B 68 3C F6 82 33 01 00 00 02) // should be unique
alloc(newmem,$1000,INJECT_MIN_COINS)
label(code)
label(return)
newmem:
cmp dword ptr [rax+3C], #900
jae code
mov dword ptr [rax+3C], #900
code:
mov ebp,[rax+3C]
test byte ptr [rdx+00000133],02
jmp return
INJECT_MIN_COINS:
jmp newmem
nop 5
return:
registersymbol(INJECT_MIN_COINS)
[DISABLE]
INJECT_MIN_COINS:
db 8B 68 3C F6 82 33 01 00 00 02
unregistersymbol(INJECT_MIN_COINS)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+87BCCE
GameAssembly.dll+87BC9B: 48 85 D2 - test rdx,rdx
GameAssembly.dll+87BC9E: 0F 84 B2 02 00 00 - je GameAssembly.dll+87BF56
GameAssembly.dll+87BCA4: 48 63 5C 24 50 - movsxd rbx,dword ptr [rsp+50]
GameAssembly.dll+87BCA9: 3B 5A 18 - cmp ebx,[rdx+18]
GameAssembly.dll+87BCAC: 0F 83 AA 02 00 00 - jae GameAssembly.dll+87BF5C
GameAssembly.dll+87BCB2: 48 8D 34 DD 20 00 00 00 - lea rsi,[rbx*8+00000020]
GameAssembly.dll+87BCBA: 48 8B 04 16 - mov rax,[rsi+rdx]
GameAssembly.dll+87BCBE: 48 85 C0 - test rax,rax
GameAssembly.dll+87BCC1: 0F 84 8F 02 00 00 - je GameAssembly.dll+87BF56
GameAssembly.dll+87BCC7: 48 8B 15 DA 1E 73 00 - mov rdx,[GameAssembly.dll+FADBA8]
// ---------- INJECTING HERE ----------
GameAssembly.dll+87BCCE: 8B 68 3C - mov ebp,[rax+3C]
// ---------- DONE INJECTING ----------
GameAssembly.dll+87BCD1: F6 82 33 01 00 00 02 - test byte ptr [rdx+00000133],02
GameAssembly.dll+87BCD8: 74 1F - je GameAssembly.dll+87BCF9
GameAssembly.dll+87BCDA: 83 BA E0 00 00 00 00 - cmp dword ptr [rdx+000000E0],00
GameAssembly.dll+87BCE1: 75 16 - jne GameAssembly.dll+87BCF9
GameAssembly.dll+87BCE3: 48 8B CA - mov rcx,rdx
GameAssembly.dll+87BCE6: E8 B5 03 8B FF - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+87BCEB: 48 8B 0D 76 BD 72 00 - mov rcx,[GameAssembly.dll+FA7A68]
GameAssembly.dll+87BCF2: 48 8B 15 AF 1E 73 00 - mov rdx,[GameAssembly.dll+FADBA8]
GameAssembly.dll+87BCF9: 48 8B 82 B8 00 00 00 - mov rax,[rdx+000000B8]
GameAssembly.dll+87BD00: 4C 8B 00 - mov r8,[rax]
}
24
"Double coin income for normal drops"
Auto Assembler Script
{ Game : KikiKaikai.exe
Version:
Date : 2025-01-07
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_DOUBLE_COIN,GameAssembly.dll,5C 5E C3 CC CC CC CC CC CC CC CC CC 48 89 5C 24 08) // should be unique
alloc(newmem,$1000,INJECT_DOUBLE_COIN)
label(code)
label(return)
newmem:
cmp edx, 1
ja code
mov edx, 2
code:
mov [rsp+08],rbx
jmp return
INJECT_DOUBLE_COIN+0C:
jmp newmem
return:
registersymbol(INJECT_DOUBLE_COIN)
[DISABLE]
INJECT_DOUBLE_COIN+0C:
db 48 89 5C 24 08
unregistersymbol(INJECT_DOUBLE_COIN)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: PlayerWork.AddCoin
GameAssembly.dll+32A0F6: C3 - ret
GameAssembly.dll+32A0F7: CC - int 3
GameAssembly.dll+32A0F8: CC - int 3
GameAssembly.dll+32A0F9: CC - int 3
GameAssembly.dll+32A0FA: CC - int 3
GameAssembly.dll+32A0FB: CC - int 3
GameAssembly.dll+32A0FC: CC - int 3
GameAssembly.dll+32A0FD: CC - int 3
GameAssembly.dll+32A0FE: CC - int 3
GameAssembly.dll+32A0FF: CC - int 3
// ---------- INJECTING HERE ----------
PlayerWork.AddCoin: 48 89 5C 24 08 - mov [rsp+08],rbx
// ---------- DONE INJECTING ----------
GameAssembly.dll+32A105: 48 89 74 24 10 - mov [rsp+10],rsi
GameAssembly.dll+32A10A: 57 - push rdi
GameAssembly.dll+32A10B: 48 83 EC 20 - sub rsp,20
GameAssembly.dll+32A10F: 80 3D 05 00 CF 00 00 - cmp byte ptr [GameAssembly.dll+101A11B],00
GameAssembly.dll+32A116: 8B F2 - mov esi,edx
GameAssembly.dll+32A118: 48 8B D9 - mov rbx,rcx
GameAssembly.dll+32A11B: 75 37 - jne GameAssembly.dll+32A154
GameAssembly.dll+32A11D: 48 8D 0D 74 60 C7 00 - lea rcx,[GameAssembly.dll+FA0198]
GameAssembly.dll+32A124: E8 47 77 E7 FF - call GameAssembly.dll+1A1870
GameAssembly.dll+32A129: 48 8D 0D 28 99 C7 00 - lea rcx,[GameAssembly.dll+FA3A58]
}
3
"Get HP data"
Auto Assembler Script
{ Game : KikiKaikai.exe
Version:
Date : 2025-01-06
Author : bbfox@https://opencheattables.com
}
[ENABLE]
//PlayerWork.AddHP
aobscanmodule(INJECT_INF_HP,GameAssembly.dll,01 7B 18 8B 43 18) // should be unique
alloc(newmem,$1000,INJECT_INF_HP)
label(code)
label(return)
label(i_base_PlayerWork_addr is_inf_hp_ON)
newmem:
code:
mov [i_base_PlayerWork_addr], rbx
cmp dword ptr [is_inf_hp_ON], 1
jne hp_proc
cmp edi, 0
jge hp_proc
sub [rbx+18],edi
hp_proc:
add [rbx+18],edi
post_step:
mov eax,[rbx+18]
jmp return
align 10 cc
i_base_PlayerWork_addr:
dq 0
is_inf_hp_ON:
dd 0
INJECT_INF_HP:
jmp newmem
nop
return:
registersymbol(INJECT_INF_HP)
registersymbol(i_base_PlayerWork_addr is_inf_hp_ON)
[DISABLE]
INJECT_INF_HP:
db 01 7B 18 8B 43 18
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+32A76C
GameAssembly.dll+32A73E: F6 80 33 01 00 00 02 - test byte ptr [rax+00000133],02
GameAssembly.dll+32A745: 74 18 - je GameAssembly.dll+32A75F
GameAssembly.dll+32A747: 83 B8 E0 00 00 00 00 - cmp dword ptr [rax+000000E0],00
GameAssembly.dll+32A74E: 75 0F - jne GameAssembly.dll+32A75F
GameAssembly.dll+32A750: 48 8B C8 - mov rcx,rax
GameAssembly.dll+32A753: E8 48 19 E0 FF - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+32A758: 48 8B 05 09 D3 C7 00 - mov rax,[GameAssembly.dll+FA7A68]
GameAssembly.dll+32A75F: 48 8B 80 B8 00 00 00 - mov rax,[rax+000000B8]
GameAssembly.dll+32A766: 83 78 60 00 - cmp dword ptr [rax+60],00
GameAssembly.dll+32A76A: 75 17 - jne GameAssembly.dll+32A783
// ---------- INJECTING HERE ----------
GameAssembly.dll+32A76C: 01 7B 18 - add [rbx+18],edi
// ---------- DONE INJECTING ----------
GameAssembly.dll+32A76F: 8B 43 18 - mov eax,[rbx+18]
GameAssembly.dll+32A772: 79 05 - jns GameAssembly.dll+32A779
GameAssembly.dll+32A774: 33 C0 - xor eax,eax
GameAssembly.dll+32A776: 89 43 18 - mov [rbx+18],eax
GameAssembly.dll+32A779: 8B 4B 1C - mov ecx,[rbx+1C]
GameAssembly.dll+32A77C: 3B C1 - cmp eax,ecx
GameAssembly.dll+32A77E: 7E 03 - jle GameAssembly.dll+32A783
GameAssembly.dll+32A780: 89 4B 18 - mov [rbx+18],ecx
GameAssembly.dll+32A783: 48 8B 5C 24 30 - mov rbx,[rsp+30]
GameAssembly.dll+32A788: 48 83 C4 20 - add rsp,20
}
20
"base"
1
0
808080
8 Bytes
i_base_PlayerWork_addr
4
"inf. HP?"
0:No
1:Yes
0
C08000
4 Bytes
is_inf_hp_ON
5
"m_HP"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
18
6
"m_HPMax"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
1C
7
"m_HPBonus"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
20
11
"m_Zanki -> Val"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
10
28
12
"m_Bomb -> Val"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
10
30
8
"m_Coin"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
3C
9
"m_Barrier"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
40
10
"m_BarrierBonus"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
44
13
"m_Next1UP"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
48
19
"m_Score"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
10
50
15
"m_ShotLev"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
58
16
"m_ShotType"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
5C
17
"m_ShotBonus"
0
FF8080
4 Bytes
i_base_PlayerWork_addr
60