26721 "CE compact mode" FF0000 Auto Assembler Script [ENABLE] {$lua} function CECompactMode(state) local f = getMainForm() local controls = {f.Splitter1, f.Panel4, f.Panel5} for k,c in ipairs(controls) do c.Visible = not state end end CECompactMode(true) {$asm} [DISABLE] {$lua} CECompactMode(false) 9210 "Attach CE to game process" FF0000 Auto Assembler Script [ENABLE] {$lua} if syntaxcheck then return end OpenProcess("Arcanum.exe") {$asm} [DISABLE] Activate 18 45 0 Activate Deactivate 18 46 1 Deactivate Toggle Activation 17 99 2 Activate Deactivate 403 "Action Points" FF8000 4 Bytes
Arcanum.exe+1FC234
 579 "Character Stats [Usage: open character cheet]" FF0000 Auto Assembler Script [ENABLE] aobscanmodule(code_char,Arcanum.exe,8B 4F 50 8D 14 81 8D 44 24 10) alloc(mem_char,$1000) label(code) label(return) label(ptr_char) label(ptr_main_stats) label(ptr_skills) label(ptr_tech) label(ptr_spells) mem_char: code: mov ecx,[edi+50] // Access character sheet memory lea edx,[ecx+eax*4] // This code calculates substructure address which field value will read later // at this moment character and it's substructures base addresses can be obtained cmp ebx,[Arcanum.exe+24E010] // this static address contains ID (hash) of the character whose sheet is currently opened jne return // skip irrelevant data mov eax,edi mov [ptr_char],eax test edx,edx je return mov eax,[edx] // hint: list relevant structures with 'Find out what access this address' // ESI holds a kind of substructure ID cmp esi,DC jne @f mov [ptr_main_stats],eax // main stats (dexterity, etc...) @@: cmp esi,DD jne @f mov [ptr_skills],eax // general skills (dodge, etc) @@: cmp esi,DE jne @f mov [ptr_tech],eax // tech skills (repair, etc) @@: cmp esi,DF jne @f mov [ptr_spells],eax // tech disciplines (herbology, etc) and spells (conveyance, etc) @@: jmp return ptr_char: dd 0 ptr_main_stats: dd 0 ptr_skills: dd 0 ptr_tech: dd 0 ptr_spells: dd 0 code_char: jmp mem_char nop return: registersymbol(code_char) registersymbol(ptr_char) registersymbol(ptr_main_stats) registersymbol(ptr_skills) registersymbol(ptr_tech) registersymbol(ptr_spells) [DISABLE] code_char: db 8B 4F 50 8D 14 81 unregistersymbol(*) dealloc(mem_char) { // ORIGINAL CODE - INJECTION POINT: Arcanum.exe.text+7C46 Arcanum.exe.text+7C30: 50 - push eax Arcanum.exe.text+7C31: 56 - push esi Arcanum.exe.text+7C32: 57 - push edi Arcanum.exe.text+7C33: E8 18 47 00 00 - call Arcanum.exe.text+C350 Arcanum.exe.text+7C38: 83 C4 0C - add esp,0C Arcanum.exe.text+7C3B: 85 C0 - test eax,eax Arcanum.exe.text+7C3D: 74 20 - je Arcanum.exe.text+7C5F Arcanum.exe.text+7C3F: 56 - push esi Arcanum.exe.text+7C40: 57 - push edi Arcanum.exe.text+7C41: E8 EA 45 00 00 - call Arcanum.exe.text+C230 // ---------- INJECTING HERE ---------- Arcanum.exe.text+7C46: 8B 4F 50 - mov ecx,[edi+50] Arcanum.exe.text+7C49: 8D 14 81 - lea edx,[ecx+eax*4] // ---------- DONE INJECTING ---------- Arcanum.exe.text+7C4C: 8D 44 24 10 - lea eax,[esp+10] Arcanum.exe.text+7C50: 50 - push eax Arcanum.exe.text+7C51: 89 54 24 18 - mov [esp+18],edx Arcanum.exe.text+7C55: E8 26 B5 0D 00 - call Arcanum.exe.text+E3180 Arcanum.exe.text+7C5A: 83 C4 0C - add esp,0C Arcanum.exe.text+7C5D: EB 3C - jmp Arcanum.exe.text+7C9B Arcanum.exe.text+7C5F: 53 - push ebx Arcanum.exe.text+7C60: 55 - push ebp Arcanum.exe.text+7C61: 57 - push edi } 603 "Base pointer" 1 0 800080 1
ptr_char
0 655 "Main stats I" FF0000 Auto Assembler Script [ENABLE] aobscanmodule(code_charval,Arcanum.exe,74 20 57 56 E8) alloc(mem_charval,$1000) label(code) label(return) label(ptr_hp_loss) label(ptr_hp_bonus) label(ptr_mp_loss) label(ptr_mp_bonus) label(ptr_name) label(ptr_flags) mem_charval: code: mov ecx,[esi+50] // Access character sheet memory lea edx,[ecx+eax*4] // This code calculates property address which value will read later /* cmp edi,1D jne @f mov [edx],0 @@: cmp edi,DB jne @f mov eax,[edx] @@:*/ cmp ebp,[Arcanum.exe+24E010] // this static address contains ID (hash) of the character whose sheet is currently opened jne return // skip irrelevant data test edx,edx je return mov eax,[edx] // hint: list relevant properties with 'Find out what access this address' // EDI holds a kind of property ID cmp edi,1B jne @f mov [ptr_hp_bonus],edx @@: cmp edi,1D jne @f mov [ptr_hp_loss],edx @@: cmp edi,E0 jne @f mov [ptr_mp_bonus],edx @@: cmp edi,E2 jne @f mov [ptr_mp_loss],edx @@: cmp edi,10E jne @f mov [ptr_name],edx @@: cmp edi,13 jne @f mov [ptr_flags],edx @@: jmp return ptr_hp_loss: dd 0 ptr_hp_bonus: dd 0 ptr_mp_loss: dd 0 ptr_mp_bonus: dd 0 ptr_name: dd 0 ptr_flags: dd 0 code_charval+9: jmp mem_charval nop return: registersymbol(code_charval) registersymbol(ptr_hp_loss) registersymbol(ptr_hp_bonus) registersymbol(ptr_mp_loss) registersymbol(ptr_mp_bonus) registersymbol(ptr_name) registersymbol(ptr_flags) [DISABLE] code_charval+9: db 8B 4E 50 8D 14 81 unregistersymbol(*) dealloc(mem_charval) { // ORIGINAL CODE - INJECTION POINT: Arcanum.exe.text+7ABE Arcanum.exe.text+7AA3: 50 - push eax Arcanum.exe.text+7AA4: 89 54 24 10 - mov [esp+10],edx Arcanum.exe.text+7AA8: E8 D3 B6 0D 00 - call Arcanum.exe.text+E3180 Arcanum.exe.text+7AAD: 83 C4 04 - add esp,04 Arcanum.exe.text+7AB0: EB 6A - jmp Arcanum.exe.text+7B1C Arcanum.exe.text+7AB2: 57 - push edi Arcanum.exe.text+7AB3: 56 - push esi Arcanum.exe.text+7AB4: E8 67 48 00 00 - call Arcanum.exe.text+C320 Arcanum.exe.text+7AB9: 83 C4 08 - add esp,08 Arcanum.exe.text+7ABC: 85 C0 - test eax,eax Arcanum.exe.text+7ABE: 74 20 - je Arcanum.exe.text+7AE0 Arcanum.exe.text+7AC0: 57 - push edi Arcanum.exe.text+7AC1: 56 - push esi Arcanum.exe.text+7AC2: E8 69 47 00 00 - call Arcanum.exe.text+C230 // ---------- INJECTING HERE ---------- Arcanum.exe.text+7AC7: 8B 4E 50 - mov ecx,[esi+50] Arcanum.exe.text+7ACA: 8D 14 81 - lea edx,[ecx+eax*4] // ---------- DONE INJECTING ---------- Arcanum.exe.text+7ACD: 8D 44 24 10 - lea eax,[esp+10] Arcanum.exe.text+7AD1: 50 - push eax Arcanum.exe.text+7AD2: 89 54 24 18 - mov [esp+18],edx Arcanum.exe.text+7AD6: E8 A5 B6 0D 00 - call Arcanum.exe.text+E3180 Arcanum.exe.text+7ADB: 83 C4 0C - add esp,0C } 656 "HP bonus" 1 4 Bytes
ptr_hp_bonus
0 664 "MP bonus" 1 4 Bytes
ptr_mp_bonus
0 663 "HP loss" 1 4 Bytes
ptr_hp_loss
0 665 "MP loss" 1 4 Bytes
ptr_mp_loss
0 668 "Flags" 0 Binary 0 32 1
ptr_flags
0 667 "Name [custom character only]" 0 String 13 0 0 1
ptr_name
0 0 26722 "ID" 1 0 800080 4 Bytes
ptr_char
8 9C 602 "Main stats II" 1 0 800080 1
ptr_main_stats
0 592 "Strength" 0 4 Bytes
+C
 593 "Dexterity" 0 4 Bytes
+10
 594 "Constitution" 0 4 Bytes
+14
 595 "Beauty" 0 4 Bytes
+18
 596 "Intelligence" 0 4 Bytes
+1C
 597 "Perception" 0 4 Bytes
+20
 598 "Willpower" 0 4 Bytes
+24
 599 "Charisma" 0 4 Bytes
+28
 582 "Level" 0 4 Bytes
ptr_main_stats
50 591 "Experience" 0 4 Bytes
ptr_main_stats
54 600 "Alignment" 1 008000 4 Bytes
+58
 601 "Fate Points" 0 FF8000 4 Bytes
+5C
 666 "Skill Points" 0 FF8000 4 Bytes
+60
 604 "General skills" 1 0 800080 1
ptr_skills
0 607 "Bow" 197:Master 133:Expert 69:Apprentice 0 4 Bytes
+0C
 608 "Dodge" Bow 0 4 Bytes
+10
 609 "Melee" Bow 0 4 Bytes
+14
 610 "Throwing" Bow 0 4 Bytes
+18
 611 "Backstab" Bow 0 4 Bytes
+1c
 612 "Pickpocket" Bow 0 4 Bytes
+20
 613 "Prowling" Bow 0 4 Bytes
+24
 614 "Spot Trap" Bow 0 4 Bytes
+28
 615 "Gambling" Bow 0 4 Bytes
+2c
 616 "Haggle" Bow 0 4 Bytes
+30
 617 "Heal" Bow 0 4 Bytes
+34
 618 "Persuasion" Bow 0 4 Bytes
+38
 605 "Tech skills" 1 0 800080 1
ptr_tech
0 619 "Repair" Bow 0 4 Bytes
+C
 621 "Firearms" Bow 0 4 Bytes
+10
 620 "Pick Locks" Bow 0 4 Bytes
+14
 622 "Disarm Traps" Bow 0 4 Bytes
+18
 606 "Spell colleges & tech disciplines" 1 0 800080 1
ptr_spells
0 648 "TECH" 808000 1 639 "Herbology" 0 4 Bytes
+50
 640 "Chemistry" 0 4 Bytes
+54
 641 "Electric" 0 4 Bytes
+58
 642 "Explosives" 0 4 Bytes
+5C
 643 "Gun Smithy" 0 4 Bytes
+60
 644 "Mechanical" 0 4 Bytes
+64
 645 "Smithy" 0 4 Bytes
+68
 646 "Therapeutics" 0 4 Bytes
+6C
 647 "SPELLS" 808000 1 623 "Conveyance" 0 4 Bytes
+C
 624 "Divination" 0 4 Bytes
+10
 625 "Air" 0 4 Bytes
+14
 626 "Earth" 0 4 Bytes
+18
 627 "Fire" 0 4 Bytes
+1C
 628 "Water" 0 4 Bytes
+20
 629 "Force" 0 4 Bytes
+24
 630 "Mental" 0 4 Bytes
+28
 631 "Meta" 0 4 Bytes
+2C
 632 "Morph" 0 4 Bytes
+30
 633 "Nature" 0 4 Bytes
+34
 634 "Necromantic Black" 0 4 Bytes
+38
 635 "Necromantic White" 0 4 Bytes
+3C
 636 "Phantasm" 0 4 Bytes
+40
 637 "Summoning" 0 4 Bytes
+44
 638 "Temporal" 0 4 Bytes
+48
 Info about this table: Game Process: Arcanum.exe Game Version: see history below (tested with the Steam version modded by unofficial patch 2.0.2 by Drog Black Tooth) Author : mece CE Version : 7.3 Features: - Character action points ara located at static address. - Character editor (attributes, skills, spells) Known issues: - Game do not like ALT+TAB-ing. Use windowed mode to reduce frequency of game crashes. History: 2022-01-09: improved the offset guessing script, now should work with squad members 2020-11-17: improved the offset guessing script 2020-11-15: added a script for gessing memory offsets 2020-11-09: added alignment pointers. 2020-11-08: added scripts getting the main character pointers. Updates: https://opencheattables.org/