901 "PROTECTION" 808080 1 931 "Apply bleeding protection" FF0000 Auto Assembler Script [ENABLE] // UCDSBleed::Reload aobscanmodule(BleedReloadIP,Ancestors-Win64-Shipping.exe,0F B6 87 01 01 00 00) // should be unique alloc(BleedReloadPL,$1000,BleedReloadIP) define(iDesiredShieldValue,#720) BleedReloadPL: mov [rdi+00000138],iDesiredShieldValue // MaxMinutesBeforeShieldOver mov [rdi+00000130],iDesiredShieldValue // MinutesBeforeShieldOver mov byte ptr [rdi+00000101],00 // BleedState movzx eax,byte ptr [rdi+00000101] jmp return BleedReloadIP: jmp BleedReloadPL nop 2 return: registersymbol(BleedReloadIP) registersymbol(BleedReloadPL) [DISABLE] BleedReloadIP: db 0F B6 87 01 01 00 00 unregistersymbol(BleedReloadIP) unregistersymbol(BleedReloadPL) dealloc(BleedReloadPL) { "Ancestors-Win64-Shipping.exe"+43DE4B: 48 8B C8 - mov rcx,rax "Ancestors-Win64-Shipping.exe"+43DE4E: E8 ED D6 9B 01 - call Ancestors-Win64-Shipping.exe+1DFB540 "Ancestors-Win64-Shipping.exe"+43DE53: 0F 10 80 08 01 00 00 - movups xmm0,[rax+00000108] "Ancestors-Win64-Shipping.exe"+43DE5A: 0F 11 87 00 01 00 00 - movups [rdi+00000100],xmm0 "Ancestors-Win64-Shipping.exe"+43DE61: 0F 10 88 18 01 00 00 - movups xmm1,[rax+00000118] "Ancestors-Win64-Shipping.exe"+43DE68: 0F 11 8F 10 01 00 00 - movups [rdi+00000110],xmm1 "Ancestors-Win64-Shipping.exe"+43DE6F: 0F 10 80 28 01 00 00 - movups xmm0,[rax+00000128] "Ancestors-Win64-Shipping.exe"+43DE76: 0F 11 87 20 01 00 00 - movups [rdi+00000120],xmm0 "Ancestors-Win64-Shipping.exe"+43DE7D: 0F 10 88 38 01 00 00 - movups xmm1,[rax+00000138] "Ancestors-Win64-Shipping.exe"+43DE84: 0F 11 8F 30 01 00 00 - movups [rdi+00000130],xmm1 // ---------- HERE ---------- "Ancestors-Win64-Shipping.exe"+43DE8B: 0F B6 87 01 01 00 00 - movzx eax,byte ptr [rdi+00000101] // ---------- DONE ---------- "Ancestors-Win64-Shipping.exe"+43DE92: FE C8 - dec al "Ancestors-Win64-Shipping.exe"+43DE94: 3C 01 - cmp al,01 "Ancestors-Win64-Shipping.exe"+43DE96: 77 4D - ja Ancestors-Win64-Shipping.exe+43DEE5 "Ancestors-Win64-Shipping.exe"+43DE98: F3 0F 10 8F 10 01 00 00 - movss xmm1,[rdi+00000110] "Ancestors-Win64-Shipping.exe"+43DEA0: 48 8B CF - mov rcx,rdi "Ancestors-Win64-Shipping.exe"+43DEA3: E8 78 03 00 00 - call Ancestors-Win64-Shipping.exe+43E220 "Ancestors-Win64-Shipping.exe"+43DEA8: 48 8B CF - mov rcx,rdi "Ancestors-Win64-Shipping.exe"+43DEAB: E8 B0 EB FF FF - call Ancestors-Win64-Shipping.exe+43CA60 "Ancestors-Win64-Shipping.exe"+43DEB0: 48 8D 4F 40 - lea rcx,[rdi+40] "Ancestors-Win64-Shipping.exe"+43DEB4: E8 57 EF 69 00 - call Ancestors-Win64-Shipping.exe+ADCE10 } 937 "Infinite bleeding protection" FF0000 Auto Assembler Script [ENABLE] // UCDSBleed::GetShieldRatio aobscanmodule(BleedShieldIP,Ancestors-Win64-Shipping.exe,48 8B 81 30 01 00 00 0F) // should be unique alloc(BleedShieldPL,$1000,BleedShieldIP) BleedShieldPL: mov rax,[rcx+00000138] // MaxMinutesBeforeShieldOver mov [rcx+00000130],rax // MinutesBeforeShieldOver jmp return BleedShieldIP: jmp BleedShieldPL nop 2 return: registersymbol(BleedShieldIP) registersymbol(BleedShieldPL) [DISABLE] BleedShieldIP: db 48 8B 81 30 01 00 00 unregistersymbol(BleedShieldIP) unregistersymbol(BleedShieldPL) dealloc(BleedShieldPL) { "Ancestors-Win64-Shipping.exe"+43D9A3: 48 83 C4 58 - add rsp,58 "Ancestors-Win64-Shipping.exe"+43D9A7: C3 - ret "Ancestors-Win64-Shipping.exe"+43D9A8: CC - int 3 "Ancestors-Win64-Shipping.exe"+43D9A9: CC - int 3 "Ancestors-Win64-Shipping.exe"+43D9AA: CC - int 3 "Ancestors-Win64-Shipping.exe"+43D9AB: CC - int 3 "Ancestors-Win64-Shipping.exe"+43D9AC: CC - int 3 "Ancestors-Win64-Shipping.exe"+43D9AD: CC - int 3 "Ancestors-Win64-Shipping.exe"+43D9AE: CC - int 3 "Ancestors-Win64-Shipping.exe"+43D9AF: CC - int 3 // ---------- HERE ---------- "Ancestors-Win64-Shipping.exe"+43D9B0: 48 8B 81 30 01 00 00 - mov rax,[rcx+00000130] // ---------- DONE ---------- "Ancestors-Win64-Shipping.exe"+43D9B7: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+43D9BA: 48 85 C0 - test rax,rax "Ancestors-Win64-Shipping.exe"+43D9BD: 74 37 - je Ancestors-Win64-Shipping.exe+43D9F6 "Ancestors-Win64-Shipping.exe"+43D9BF: 48 8B 89 38 01 00 00 - mov rcx,[rcx+00000138] "Ancestors-Win64-Shipping.exe"+43D9C6: 48 85 C9 - test rcx,rcx "Ancestors-Win64-Shipping.exe"+43D9C9: 74 2B - je Ancestors-Win64-Shipping.exe+43D9F6 "Ancestors-Win64-Shipping.exe"+43D9CB: F3 0F 10 15 85 75 00 02 - movss xmm2,[Ancestors-Win64-Shipping.exe+2444F58] "Ancestors-Win64-Shipping.exe"+43D9D3: F3 48 0F 2A C0 - cvtsi2ss xmm0,rax "Ancestors-Win64-Shipping.exe"+43D9D8: 48 85 C0 - test rax,rax "Ancestors-Win64-Shipping.exe"+43D9DB: 79 04 - jns Ancestors-Win64-Shipping.exe+43D9E1 } 926 "Apply injury protection" FF0000 Auto Assembler Script [ENABLE] // UCDSWounds::Reload aobscanmodule(WoundReloadIP,Ancestors-Win64-Shipping.exe,0F B6 8B A9 00 00 00 85) // should be unique alloc(WoundReloadPL,$1000,WoundReloadIP) define(iDesiredShieldValue,#720) WoundReloadPL: mov [rbx+000000B8],iDesiredShieldValue // MaxMinutesBeforeShieldOver mov [rbx+000000C8],iDesiredShieldValue // MinutesBeforeShieldOver mov byte ptr [rbx+000000A9],00 // remove wounds if any movzx ecx,byte ptr [rbx+000000A9] jmp return WoundReloadIP: jmp WoundReloadPL nop 2 return: registersymbol(WoundReloadIP) registersymbol(WoundReloadPL) [DISABLE] WoundReloadIP: db 0F B6 8B A9 00 00 00 unregistersymbol(WoundReloadIP) unregistersymbol(WoundReloadPL) dealloc(WoundReloadPL) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+4A6FB6 "Ancestors-Win64-Shipping.exe"+4A6F79: 48 83 C1 28 - add rcx,28 "Ancestors-Win64-Shipping.exe"+4A6F7D: E8 8E 5E 63 00 - call Ancestors-Win64-Shipping.exe+ADCE10 "Ancestors-Win64-Shipping.exe"+4A6F82: 48 8B C8 - mov rcx,rax "Ancestors-Win64-Shipping.exe"+4A6F85: E8 B6 45 95 01 - call Ancestors-Win64-Shipping.exe+1DFB540 "Ancestors-Win64-Shipping.exe"+4A6F8A: 0F 10 80 E0 00 00 00 - movups xmm0,[rax+000000E0] "Ancestors-Win64-Shipping.exe"+4A6F91: 0F 11 83 A8 00 00 00 - movups [rbx+000000A8],xmm0 "Ancestors-Win64-Shipping.exe"+4A6F98: 0F 10 88 F0 00 00 00 - movups xmm1,[rax+000000F0] "Ancestors-Win64-Shipping.exe"+4A6F9F: 0F 11 8B B8 00 00 00 - movups [rbx+000000B8],xmm1 "Ancestors-Win64-Shipping.exe"+4A6FA6: F2 0F 10 80 00 01 00 00 - movsd xmm0,[rax+00000100] "Ancestors-Win64-Shipping.exe"+4A6FAE: F2 0F 11 83 C8 00 00 00 - movsd [rbx+000000C8],xmm0 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+4A6FB6: 0F B6 8B A9 00 00 00 - movzx ecx,byte ptr [rbx+000000A9] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+4A6FBD: 85 C9 - test ecx,ecx "Ancestors-Win64-Shipping.exe"+4A6FBF: 74 2C - je Ancestors-Win64-Shipping.exe+4A6FED "Ancestors-Win64-Shipping.exe"+4A6FC1: 83 E9 01 - sub ecx,01 "Ancestors-Win64-Shipping.exe"+4A6FC4: 74 16 - je Ancestors-Win64-Shipping.exe+4A6FDC "Ancestors-Win64-Shipping.exe"+4A6FC6: 83 F9 01 - cmp ecx,01 "Ancestors-Win64-Shipping.exe"+4A6FC9: 75 61 - jne Ancestors-Win64-Shipping.exe+4A702C "Ancestors-Win64-Shipping.exe"+4A6FCB: 48 8B 8B 58 01 00 00 - mov rcx,[rbx+00000158] "Ancestors-Win64-Shipping.exe"+4A6FD2: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+4A6FD6: 5B - pop rbx "Ancestors-Win64-Shipping.exe"+4A6FD7: E9 44 EF FF FF - jmp Ancestors-Win64-Shipping.exe+4A5F20 } 918 "Infinite injury protection" FF0000 Auto Assembler Script [ENABLE] // UCDSWounds::GetShieldRatio aobscanmodule(WoundShieldRatioIP,Ancestors-Win64-Shipping.exe,48 8B 91 C8 00 00 00 0F) // should be unique alloc(WoundShieldRatioPL,$1000,WoundShieldRatioIP) WoundShieldRatioPL: mov rdx,[rcx+000000C8] // MaxMinutesBeforeShieldOver mov [rcx+000000B8],rdx // MinutesBeforeShieldOver jmp return WoundShieldRatioIP: jmp WoundShieldRatioPL nop 2 return: registersymbol(WoundShieldRatioIP) registersymbol(WoundShieldRatioPL) [DISABLE] WoundShieldRatioIP: db 48 8B 91 C8 00 00 00 unregistersymbol(WoundShieldRatioPL) unregistersymbol(WoundShieldRatioIP) dealloc(WoundShieldRatioPL) { // ORIGINAL CODE - WoundShieldRatioIPION POINT: "Ancestors-Win64-Shipping.exe"+4A53B0 "Ancestors-Win64-Shipping.exe"+4A5389: F3 0F 5D 35 D7 B0 F9 01 - minss xmm6,[Ancestors-Win64-Shipping.exe+2440468] "Ancestors-Win64-Shipping.exe"+4A5391: 0F 28 7C 24 30 - movaps xmm7,[rsp+30] "Ancestors-Win64-Shipping.exe"+4A5396: F3 41 0F 59 F0 - mulss xmm6,xmm8 "Ancestors-Win64-Shipping.exe"+4A539B: 44 0F 28 44 24 20 - movaps xmm8,[rsp+20] "Ancestors-Win64-Shipping.exe"+4A53A1: 0F 28 C6 - movaps xmm0,xmm6 "Ancestors-Win64-Shipping.exe"+4A53A4: 0F 28 74 24 40 - movaps xmm6,[rsp+40] "Ancestors-Win64-Shipping.exe"+4A53A9: 48 83 C4 58 - add rsp,58 "Ancestors-Win64-Shipping.exe"+4A53AD: C3 - ret "Ancestors-Win64-Shipping.exe"+4A53AE: CC - int 3 "Ancestors-Win64-Shipping.exe"+4A53AF: CC - int 3 // ---------- WoundShieldRatioIPING HERE ---------- "Ancestors-Win64-Shipping.exe"+4A53B0: 48 8B 91 C8 00 00 00 - mov rdx,[rcx+000000C8] // ---------- DONE WoundShieldRatioIPING ---------- "Ancestors-Win64-Shipping.exe"+4A53B7: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+4A53BA: 48 85 D2 - test rdx,rdx "Ancestors-Win64-Shipping.exe"+4A53BD: 74 32 - je Ancestors-Win64-Shipping.exe+4A53F1 "Ancestors-Win64-Shipping.exe"+4A53BF: 48 8B 81 B8 00 00 00 - mov rax,[rcx+000000B8] "Ancestors-Win64-Shipping.exe"+4A53C6: F3 0F 10 15 8A FB F9 01 - movss xmm2,[Ancestors-Win64-Shipping.exe+2444F58] "Ancestors-Win64-Shipping.exe"+4A53CE: F3 48 0F 2A C0 - cvtsi2ss xmm0,rax "Ancestors-Win64-Shipping.exe"+4A53D3: 48 85 C0 - test rax,rax "Ancestors-Win64-Shipping.exe"+4A53D6: 79 04 - jns Ancestors-Win64-Shipping.exe+4A53DC "Ancestors-Win64-Shipping.exe"+4A53D8: F3 0F 58 C2 - addss xmm0,xmm2 "Ancestors-Win64-Shipping.exe"+4A53DC: 0F 57 C9 - xorps xmm1,xmm1 } 930 "Apply camouflage protection" FF0000 Auto Assembler Script [ENABLE] // UCDSCamouflage::Reload aobscanmodule(CamouflageReloadIP,Ancestors-Win64-Shipping.exe,48 83 BB 98 00 00 00 00 76 0D) // should be unique alloc(CamouflageReloadPL,$1000,CamouflageReloadIP) define(DesiredShieldValue,#480) CamouflageReloadPL: mov qword ptr [rbx+00000098],DesiredShieldValue // MinutesBeforeOver cmp qword ptr [rbx+00000098],00 jmp return CamouflageReloadIP: jmp CamouflageReloadPL nop 3 return: registersymbol(CamouflageReloadIP) registersymbol(CamouflageReloadPL) [DISABLE] CamouflageReloadIP: db 48 83 BB 98 00 00 00 00 unregistersymbol(CamouflageReloadPL) unregistersymbol(CamouflageReloadIP) dealloc(CamouflageReloadPL) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+43F4D8 "Ancestors-Win64-Shipping.exe"+43F4AF: CC - int 3 "Ancestors-Win64-Shipping.exe"+43F4B0: 40 53 - push rbx "Ancestors-Win64-Shipping.exe"+43F4B2: 48 83 EC 20 - sub rsp,20 "Ancestors-Win64-Shipping.exe"+43F4B6: 48 8B D9 - mov rbx,rcx "Ancestors-Win64-Shipping.exe"+43F4B9: 48 83 C1 28 - add rcx,28 "Ancestors-Win64-Shipping.exe"+43F4BD: E8 4E D9 69 00 - call Ancestors-Win64-Shipping.exe+ADCE10 "Ancestors-Win64-Shipping.exe"+43F4C2: 48 8B C8 - mov rcx,rax "Ancestors-Win64-Shipping.exe"+43F4C5: E8 76 C0 9B 01 - call Ancestors-Win64-Shipping.exe+1DFB540 "Ancestors-Win64-Shipping.exe"+43F4CA: 0F 10 80 70 05 00 00 - movups xmm0,[rax+00000570] "Ancestors-Win64-Shipping.exe"+43F4D1: 0F 11 83 90 00 00 00 - movups [rbx+00000090],xmm0 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+43F4D8: 48 83 BB 98 00 00 00 00 - cmp qword ptr [rbx+00000098],00 // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+43F4E0: 76 0D - jna Ancestors-Win64-Shipping.exe+43F4EF "Ancestors-Win64-Shipping.exe"+43F4E2: 48 8B CB - mov rcx,rbx "Ancestors-Win64-Shipping.exe"+43F4E5: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+43F4E9: 5B - pop rbx "Ancestors-Win64-Shipping.exe"+43F4EA: E9 91 F8 FF FF - jmp Ancestors-Win64-Shipping.exe+43ED80 "Ancestors-Win64-Shipping.exe"+43F4EF: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+43F4F3: 5B - pop rbx "Ancestors-Win64-Shipping.exe"+43F4F4: C3 - ret "Ancestors-Win64-Shipping.exe"+43F4F5: CC - int 3 "Ancestors-Win64-Shipping.exe"+43F4F6: CC - int 3 } 934 "Infinite camouflage protection" FF0000 Auto Assembler Script [ENABLE] // UCDSCamouflage::GetRemainingDurationRatio aobscanmodule(CamouflageRatioIP,Ancestors-Win64-Shipping.exe,FF F3 0F 5E F0 0F 28 C6) // should be unique alloc(CamouflageRatioPL,$1000,CamouflageRatioIP) CamouflageRatioPL: movaps xmm6,xmm0 // xmm0 is UCDSCamouflage::GetMaxDuration divss xmm6,xmm0 movaps xmm0,xmm6 jmp return CamouflageRatioIP+01: jmp CamouflageRatioPL nop 2 return: registersymbol(CamouflageRatioPL) registersymbol(CamouflageRatioIP) [DISABLE] CamouflageRatioIP+01: db F3 0F 5E F0 0F 28 C6 unregistersymbol(CamouflageRatioPL) unregistersymbol(CamouflageRatioIP) dealloc(CamouflageRatioPL) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+43F309 "Ancestors-Win64-Shipping.exe"+43F2E0: 0F 2E C6 - ucomiss xmm0,xmm6 "Ancestors-Win64-Shipping.exe"+43F2E3: 74 28 - je Ancestors-Win64-Shipping.exe+43F30D "Ancestors-Win64-Shipping.exe"+43F2E5: 48 8B 83 98 00 00 00 - mov rax,[rbx+00000098] "Ancestors-Win64-Shipping.exe"+43F2EC: 0F 57 F6 - xorps xmm6,xmm6 "Ancestors-Win64-Shipping.exe"+43F2EF: F3 48 0F 2A F0 - cvtsi2ss xmm6,rax "Ancestors-Win64-Shipping.exe"+43F2F4: 48 85 C0 - test rax,rax "Ancestors-Win64-Shipping.exe"+43F2F7: 79 08 - jns Ancestors-Win64-Shipping.exe+43F301 "Ancestors-Win64-Shipping.exe"+43F2F9: F3 0F 58 35 57 5C 00 02 - addss xmm6,[Ancestors-Win64-Shipping.exe+2444F58] "Ancestors-Win64-Shipping.exe"+43F301: 48 8B CB - mov rcx,rbx "Ancestors-Win64-Shipping.exe"+43F304: E8 27 FF FF FF - call Ancestors-Win64-Shipping.exe+43F230 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+43F309: F3 0F 5E F0 - divss xmm6,xmm0 "Ancestors-Win64-Shipping.exe"+43F30D: 0F 28 C6 - movaps xmm0,xmm6 // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+43F310: 0F 28 74 24 20 - movaps xmm6,[rsp+20] "Ancestors-Win64-Shipping.exe"+43F315: 48 83 C4 30 - add rsp,30 "Ancestors-Win64-Shipping.exe"+43F319: 5B - pop rbx "Ancestors-Win64-Shipping.exe"+43F31A: C3 - ret "Ancestors-Win64-Shipping.exe"+43F31B: CC - int 3 "Ancestors-Win64-Shipping.exe"+43F31C: CC - int 3 "Ancestors-Win64-Shipping.exe"+43F31D: CC - int 3 "Ancestors-Win64-Shipping.exe"+43F31E: CC - int 3 "Ancestors-Win64-Shipping.exe"+43F31F: CC - int 3 "Ancestors-Win64-Shipping.exe"+43F320: 48 89 5C 24 10 - mov [rsp+10],rbx } 933 "Apply infinite fear protection" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UFearManager::GetFearShieldRatio+3D aobscanmodule(FearShieldIP,Ancestors-Win64-Shipping.exe,EE FF 0F 57 C0 48 8B 5C 24 30) // should be unique alloc(FearShieldPL,$1000,"Ancestors-Win64-Shipping.exe"+6E549D) label(fDesiredFearShieldRatio) FearShieldPL: xorps xmm0,xmm0 movss xmm0,[fDesiredFearShieldRatio] mov rbx,[rsp+30] jmp return fDesiredFearShieldRatio: dd (float)1.0 FearShieldIP+02: jmp FearShieldPL nop 3 return: registersymbol(FearShieldIP) registersymbol(FearShieldPL) [DISABLE] FearShieldIP+02: db 0F 57 C0 48 8B 5C 24 30 unregistersymbol(FearShieldPL) unregistersymbol(FearShieldIP) dealloc(FearShieldPL) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+6E549D "Ancestors-Win64-Shipping.exe"+6E5474: E8 97 CA 3F 00 - call Ancestors-Win64-Shipping.exe+AE1F10 "Ancestors-Win64-Shipping.exe"+6E5479: 84 C0 - test al,al "Ancestors-Win64-Shipping.exe"+6E547B: 74 20 - je Ancestors-Win64-Shipping.exe+6E549D "Ancestors-Win64-Shipping.exe"+6E547D: 48 83 BF 60 13 00 00 00 - cmp qword ptr [rdi+00001360],00 "Ancestors-Win64-Shipping.exe"+6E5485: 74 16 - je Ancestors-Win64-Shipping.exe+6E549D "Ancestors-Win64-Shipping.exe"+6E5487: 48 8B 8F 60 13 00 00 - mov rcx,[rdi+00001360] "Ancestors-Win64-Shipping.exe"+6E548E: 48 8B 5C 24 30 - mov rbx,[rsp+30] "Ancestors-Win64-Shipping.exe"+6E5493: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+6E5497: 5F - pop rdi "Ancestors-Win64-Shipping.exe"+6E5498: E9 13 DC EE FF - jmp Ancestors-Win64-Shipping.exe+5D30B0 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+6E549D: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+6E54A0: 48 8B 5C 24 30 - mov rbx,[rsp+30] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+6E54A5: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+6E54A9: 5F - pop rdi "Ancestors-Win64-Shipping.exe"+6E54AA: C3 - ret "Ancestors-Win64-Shipping.exe"+6E54AB: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E54AC: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E54AD: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E54AE: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E54AF: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E54B0: 40 53 - push rbx "Ancestors-Win64-Shipping.exe"+6E54B2: 48 83 EC 40 - sub rsp,40 } 929 "Apply cold and heat protection" FF0000 Auto Assembler Script [ENABLE] // UCDSTemperature::Reload aobscanmodule(TempReloadIP,Ancestors-Win64-Shipping.exe,8B 83 F4 00 00 00 85) // should be unique alloc(TempReloadPL,$1000,TempReloadIP) label(iHotShieldDesired) label(iColdShieldDesired) TempReloadPL: mov eax,[iColdShieldDesired] mov [rbx+000000FC],eax // CurrentMaxMinutesBeforeColdShieldOver mov [rbx+000000F4],eax // MinutesBeforeColdShieldOver mov eax,[iHotShieldDesired] mov [rbx+00000100],eax // CurrentMaxMinutesBeforeHotShieldOver mov [rbx+000000F8],eax // MinutesBeforeHotShieldOver mov eax,[rbx+000000F4] jmp return iHotShieldDesired: dd #720 iColdShieldDesired: dd #720 TempReloadIP: jmp TempReloadPL nop return: registersymbol(TempReloadPL) registersymbol(TempReloadIP) registersymbol(iHotShieldDesired) registersymbol(iColdShieldDesired) [DISABLE] TempReloadIP: db 8B 83 F4 00 00 00 unregistersymbol(TempReloadPL) unregistersymbol(TempReloadIP) unregistersymbol(iHotShieldDesired) unregistersymbol(iColdShieldDesired) dealloc(TempReloadPL) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+49CE24 "Ancestors-Win64-Shipping.exe"+49CDF2: 48 83 EC 20 - sub rsp,20 "Ancestors-Win64-Shipping.exe"+49CDF6: 48 8B D9 - mov rbx,rcx "Ancestors-Win64-Shipping.exe"+49CDF9: 48 83 C1 28 - add rcx,28 "Ancestors-Win64-Shipping.exe"+49CDFD: E8 0E 00 64 00 - call Ancestors-Win64-Shipping.exe+ADCE10 "Ancestors-Win64-Shipping.exe"+49CE02: 48 8B C8 - mov rcx,rax "Ancestors-Win64-Shipping.exe"+49CE05: E8 36 E7 95 01 - call Ancestors-Win64-Shipping.exe+1DFB540 "Ancestors-Win64-Shipping.exe"+49CE0A: 0F 10 80 58 05 00 00 - movups xmm0,[rax+00000558] "Ancestors-Win64-Shipping.exe"+49CE11: 0F 11 83 F0 00 00 00 - movups [rbx+000000F0],xmm0 "Ancestors-Win64-Shipping.exe"+49CE18: 8B 80 68 05 00 00 - mov eax,[rax+00000568] "Ancestors-Win64-Shipping.exe"+49CE1E: 89 83 00 01 00 00 - mov [rbx+00000100],eax // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+49CE24: 8B 83 F4 00 00 00 - mov eax,[rbx+000000F4] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+49CE2A: 85 C0 - test eax,eax "Ancestors-Win64-Shipping.exe"+49CE2C: 74 16 - je Ancestors-Win64-Shipping.exe+49CE44 "Ancestors-Win64-Shipping.exe"+49CE2E: 48 8B 8B 68 01 00 00 - mov rcx,[rbx+00000168] "Ancestors-Win64-Shipping.exe"+49CE35: 0F 57 D2 - xorps xmm2,xmm2 "Ancestors-Win64-Shipping.exe"+49CE38: F3 48 0F 2A D0 - cvtsi2ss xmm2,rax "Ancestors-Win64-Shipping.exe"+49CE3D: B2 01 - mov dl,01 "Ancestors-Win64-Shipping.exe"+49CE3F: E8 8C 02 00 00 - call Ancestors-Win64-Shipping.exe+49D0D0 "Ancestors-Win64-Shipping.exe"+49CE44: 83 BB F8 00 00 00 00 - cmp dword ptr [rbx+000000F8],00 "Ancestors-Win64-Shipping.exe"+49CE4B: 76 21 - jna Ancestors-Win64-Shipping.exe+49CE6E "Ancestors-Win64-Shipping.exe"+49CE4D: 8B 83 F4 00 00 00 - mov eax,[rbx+000000F4] } 935 "Infinite heat protection" FF0000 Auto Assembler Script [ENABLE] // UCDSTemperature::GetHotShieldRatio aobscanmodule(HotShieldIP,Ancestors-Win64-Shipping.exe,8B 91 00 01 00 00 0F) // should be unique alloc(HotShieldPL,$1000,HotShieldIP) HotShieldPL: mov edx,[rcx+00000100] // CurrentMaxMinutesBeforeHotShieldOver mov [rcx+00000F8],edx // MinutesBeforeHotShieldOver jmp return HotShieldIP: jmp HotShieldPL nop return: registersymbol(HotShieldIP) registersymbol(HotShieldPL) [DISABLE] HotShieldIP: db 8B 91 00 01 00 00 unregistersymbol(HotShieldPL) unregistersymbol(HotShieldIP) dealloc(HotShieldPL) { "Ancestors-Win64-Shipping.exe"+499266: CC - int 3 "Ancestors-Win64-Shipping.exe"+499267: CC - int 3 "Ancestors-Win64-Shipping.exe"+499268: CC - int 3 "Ancestors-Win64-Shipping.exe"+499269: CC - int 3 "Ancestors-Win64-Shipping.exe"+49926A: CC - int 3 "Ancestors-Win64-Shipping.exe"+49926B: CC - int 3 "Ancestors-Win64-Shipping.exe"+49926C: CC - int 3 "Ancestors-Win64-Shipping.exe"+49926D: CC - int 3 "Ancestors-Win64-Shipping.exe"+49926E: CC - int 3 "Ancestors-Win64-Shipping.exe"+49926F: CC - int 3 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+499270: 8B 91 00 01 00 00 - mov edx,[rcx+00000100] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+499276: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+499279: 85 D2 - test edx,edx "Ancestors-Win64-Shipping.exe"+49927B: 74 1A - je Ancestors-Win64-Shipping.exe+499297 "Ancestors-Win64-Shipping.exe"+49927D: 8B 81 F8 00 00 00 - mov eax,[rcx+000000F8] "Ancestors-Win64-Shipping.exe"+499283: 0F 57 C9 - xorps xmm1,xmm1 "Ancestors-Win64-Shipping.exe"+499286: F3 48 0F 2A C2 - cvtsi2ss xmm0,rdx "Ancestors-Win64-Shipping.exe"+49928B: F3 48 0F 2A C8 - cvtsi2ss xmm1,rax "Ancestors-Win64-Shipping.exe"+499290: F3 0F 5E C8 - divss xmm1,xmm0 "Ancestors-Win64-Shipping.exe"+499294: 0F 28 C1 - movaps xmm0,xmm1 "Ancestors-Win64-Shipping.exe"+499297: C3 - ret } 936 "Infinite cold protection" FF0000 Auto Assembler Script [ENABLE] // UCDSTemperature::GetColdShieldRatio aobscanmodule(ColdShieldIP,Ancestors-Win64-Shipping.exe,8B 91 FC 00 00 00) // should be unique alloc(ColdShieldPL,$1000,ColdShieldIP) ColdShieldPL: mov edx,[rcx+000000FC] // CurrentMaxMinutesBeforeColdShieldOver mov [rcx+000000F4],edx // MinutesBeforeColdShieldOver jmp return ColdShieldIP: jmp ColdShieldPL nop return: registersymbol(ColdShieldPL) registersymbol(ColdShieldIP) [DISABLE] ColdShieldIP: db 8B 91 FC 00 00 00 unregistersymbol(ColdShieldPL) unregistersymbol(ColdShieldIP) dealloc(ColdShieldPL) { "Ancestors-Win64-Shipping.exe"+4991F6: CC - int 3 "Ancestors-Win64-Shipping.exe"+4991F7: CC - int 3 "Ancestors-Win64-Shipping.exe"+4991F8: CC - int 3 "Ancestors-Win64-Shipping.exe"+4991F9: CC - int 3 "Ancestors-Win64-Shipping.exe"+4991FA: CC - int 3 "Ancestors-Win64-Shipping.exe"+4991FB: CC - int 3 "Ancestors-Win64-Shipping.exe"+4991FC: CC - int 3 "Ancestors-Win64-Shipping.exe"+4991FD: CC - int 3 "Ancestors-Win64-Shipping.exe"+4991FE: CC - int 3 "Ancestors-Win64-Shipping.exe"+4991FF: CC - int 3 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+499200: 8B 91 FC 00 00 00 - mov edx,[rcx+000000FC] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+499206: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+499209: 85 D2 - test edx,edx "Ancestors-Win64-Shipping.exe"+49920B: 74 1A - je Ancestors-Win64-Shipping.exe+499227 "Ancestors-Win64-Shipping.exe"+49920D: 8B 81 F4 00 00 00 - mov eax,[rcx+000000F4] "Ancestors-Win64-Shipping.exe"+499213: 0F 57 C9 - xorps xmm1,xmm1 "Ancestors-Win64-Shipping.exe"+499216: F3 48 0F 2A C2 - cvtsi2ss xmm0,rdx "Ancestors-Win64-Shipping.exe"+49921B: F3 48 0F 2A C8 - cvtsi2ss xmm1,rax "Ancestors-Win64-Shipping.exe"+499220: F3 0F 5E C8 - divss xmm1,xmm0 "Ancestors-Win64-Shipping.exe"+499224: 0F 28 C1 - movaps xmm0,xmm1 "Ancestors-Win64-Shipping.exe"+499227: C3 - ret } 922 "Apply venom poisoning protection" FF0000 Auto Assembler Script [ENABLE] // UCDSVenomPoisoning::Reload aobscanmodule(VenomReloadIP,"Ancestors-Win64-Shipping.exe",70 0F 11 81 E8 00 00 00 0F B6 91 C9 00 00 00) alloc(VenomReloadPL,0x1000,VenomReloadIP) define(DesiredShieldValue,#720) VenomReloadPL: mov [rcx+000000E8],DesiredShieldValue // MaxMinutesBeforeShieldOver mov [rcx+000000D8],DesiredShieldValue // MinutesBeforeShieldOver mov [rcx+000000C9],00 // PoisonLevel movups xmm0,[rdx+50] movzx edx,byte ptr [rcx+000000C9] jmp return VenomReloadIP+08: jmp VenomReloadPL nop 2 return: registersymbol(VenomReloadIP) registersymbol(VenomReloadPL) [DISABLE] VenomReloadIP+08: db 0F B6 91 C9 00 00 00 unregistersymbol(VenomReloadIP) unregistersymbol(VenomReloadPL) dealloc(VenomReloadPL) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+47F4B1 "Ancestors-Win64-Shipping.exe"+47F48C: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F48D: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F48E: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F48F: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F490: 0F 10 42 50 - movups xmm0,[rdx+50] "Ancestors-Win64-Shipping.exe"+47F494: 0F 11 81 C8 00 00 00 - movups [rcx+000000C8],xmm0 "Ancestors-Win64-Shipping.exe"+47F49B: 0F 10 4A 60 - movups xmm1,[rdx+60] "Ancestors-Win64-Shipping.exe"+47F49F: 0F 11 89 D8 00 00 00 - movups [rcx+000000D8],xmm1 "Ancestors-Win64-Shipping.exe"+47F4A6: 0F 10 42 70 - movups xmm0,[rdx+70] "Ancestors-Win64-Shipping.exe"+47F4AA: 0F 11 81 E8 00 00 00 - movups [rcx+000000E8],xmm0 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+47F4B1: 0F B6 91 C9 00 00 00 - movzx edx,byte ptr [rcx+000000C9] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+47F4B8: 85 D2 - test edx,edx "Ancestors-Win64-Shipping.exe"+47F4BA: 74 22 - je Ancestors-Win64-Shipping.exe+47F4DE "Ancestors-Win64-Shipping.exe"+47F4BC: 83 EA 01 - sub edx,01 "Ancestors-Win64-Shipping.exe"+47F4BF: 74 11 - je Ancestors-Win64-Shipping.exe+47F4D2 "Ancestors-Win64-Shipping.exe"+47F4C1: 83 FA 01 - cmp edx,01 "Ancestors-Win64-Shipping.exe"+47F4C4: 75 4C - jne Ancestors-Win64-Shipping.exe+47F512 "Ancestors-Win64-Shipping.exe"+47F4C6: 48 8B 89 88 01 00 00 - mov rcx,[rcx+00000188] "Ancestors-Win64-Shipping.exe"+47F4CD: E9 4E E5 FF FF - jmp Ancestors-Win64-Shipping.exe+47DA20 "Ancestors-Win64-Shipping.exe"+47F4D2: 48 8B 89 88 01 00 00 - mov rcx,[rcx+00000188] "Ancestors-Win64-Shipping.exe"+47F4D9: E9 F2 E6 FF FF - jmp Ancestors-Win64-Shipping.exe+47DBD0 } 928 "Apply omnivorous poisoning protection" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UCDSOmnivorousPoisoning::Reload aobscanmodule(OmnivorousReloadIP,Ancestors-Win64-Shipping.exe,D0 00 00 00 0F 11 81 E8 00 00 00 0F B6 91 C9 00 00 00) // should be unique alloc(OmnivorousReloadPL,$1000,OmnivorousReloadIP) define(DesiredShieldValue,#720) OmnivorousReloadPL: mov [rcx+000000E8],DesiredShieldValue // MaxMinutesBeforeShieldOver mov [rcx+000000D8],DesiredShieldValue // MinutesBeforeShieldOver mov byte ptr [rcx+000000C9],00 // PoisonLevel movzx edx,byte ptr [rcx+000000C9] jmp return OmnivorousReloadIP+0B: jmp OmnivorousReloadPL nop 2 return: registersymbol(OmnivorousReloadIP) registersymbol(OmnivorousReloadPL) [DISABLE] OmnivorousReloadIP+0B: db 0F B6 91 C9 00 00 00 unregistersymbol(OmnivorousReloadPL) unregistersymbol(OmnivorousReloadIP) dealloc(OmnivorousReloadPL) { "Ancestors-Win64-Shipping.exe"+47F38C: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F38D: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F38E: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F38F: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F390: 0F 10 82 B0 00 00 00 - movups xmm0,[rdx+000000B0] "Ancestors-Win64-Shipping.exe"+47F397: 0F 11 81 C8 00 00 00 - movups [rcx+000000C8],xmm0 "Ancestors-Win64-Shipping.exe"+47F39E: 0F 10 8A C0 00 00 00 - movups xmm1,[rdx+000000C0] "Ancestors-Win64-Shipping.exe"+47F3A5: 0F 11 89 D8 00 00 00 - movups [rcx+000000D8],xmm1 "Ancestors-Win64-Shipping.exe"+47F3AC: 0F 10 82 D0 00 00 00 - movups xmm0,[rdx+000000D0] "Ancestors-Win64-Shipping.exe"+47F3B3: 0F 11 81 E8 00 00 00 - movups [rcx+000000E8],xmm0 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+47F3BA: 0F B6 91 C9 00 00 00 - movzx edx,byte ptr [rcx+000000C9] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+47F3C1: 85 D2 - test edx,edx "Ancestors-Win64-Shipping.exe"+47F3C3: 74 22 - je Ancestors-Win64-Shipping.exe+47F3E7 "Ancestors-Win64-Shipping.exe"+47F3C5: 83 EA 01 - sub edx,01 "Ancestors-Win64-Shipping.exe"+47F3C8: 74 11 - je Ancestors-Win64-Shipping.exe+47F3DB "Ancestors-Win64-Shipping.exe"+47F3CA: 83 FA 01 - cmp edx,01 "Ancestors-Win64-Shipping.exe"+47F3CD: 75 4C - jne Ancestors-Win64-Shipping.exe+47F41B "Ancestors-Win64-Shipping.exe"+47F3CF: 48 8B 89 88 01 00 00 - mov rcx,[rcx+00000188] "Ancestors-Win64-Shipping.exe"+47F3D6: E9 45 E6 FF FF - jmp Ancestors-Win64-Shipping.exe+47DA20 "Ancestors-Win64-Shipping.exe"+47F3DB: 48 8B 89 88 01 00 00 - mov rcx,[rcx+00000188] "Ancestors-Win64-Shipping.exe"+47F3E2: E9 E9 E7 FF FF - jmp Ancestors-Win64-Shipping.exe+47DBD0 } 927 "Apply alimentary poisoning protection" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UCDSAlimentaryPoisoning::Reload aobscanmodule(AlimentaryReloadIP,Ancestors-Win64-Shipping.exe,A0 00 00 00 0F 11 81 E8 00 00 00 0F B6 91 C9 00 00 00) // should be unique alloc(AlimentaryReloadPL,$1000,AlimentaryReloadIP) define(DesiredShieldValue,#720) AlimentaryReloadPL: mov [rcx+000000E8],DesiredShieldValue // MaxMinutesBeforeShieldOver mov [rcx+000000D8],DesiredShieldValue // MinutesBeforeShieldOver mov byte ptr [rcx+000000C9],00 // PoisonLevel movzx edx,byte ptr [rcx+000000C9] jmp return AlimentaryReloadIP+0B: jmp AlimentaryReloadPL nop 2 return: registersymbol(AlimentaryReloadPL) registersymbol(AlimentaryReloadIP) [DISABLE] AlimentaryReloadIP+0B: db 0F B6 91 C9 00 00 00 unregistersymbol(AlimentaryReloadPL) unregistersymbol(AlimentaryReloadIP) dealloc(AlimentaryReloadPL) { "Ancestors-Win64-Shipping.exe"+47F2FC: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F2FD: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F2FE: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F2FF: CC - int 3 "Ancestors-Win64-Shipping.exe"+47F300: 0F 10 82 80 00 00 00 - movups xmm0,[rdx+00000080] "Ancestors-Win64-Shipping.exe"+47F307: 0F 11 81 C8 00 00 00 - movups [rcx+000000C8],xmm0 "Ancestors-Win64-Shipping.exe"+47F30E: 0F 10 8A 90 00 00 00 - movups xmm1,[rdx+00000090] "Ancestors-Win64-Shipping.exe"+47F315: 0F 11 89 D8 00 00 00 - movups [rcx+000000D8],xmm1 "Ancestors-Win64-Shipping.exe"+47F31C: 0F 10 82 A0 00 00 00 - movups xmm0,[rdx+000000A0] "Ancestors-Win64-Shipping.exe"+47F323: 0F 11 81 E8 00 00 00 - movups [rcx+000000E8],xmm0 // ---------- HERE ---------- "Ancestors-Win64-Shipping.exe"+47F32A: 0F B6 91 C9 00 00 00 - movzx edx,byte ptr [rcx+000000C9] // ---------- DONE ---------- "Ancestors-Win64-Shipping.exe"+47F331: 85 D2 - test edx,edx "Ancestors-Win64-Shipping.exe"+47F333: 74 22 - je Ancestors-Win64-Shipping.exe+47F357 "Ancestors-Win64-Shipping.exe"+47F335: 83 EA 01 - sub edx,01 "Ancestors-Win64-Shipping.exe"+47F338: 74 11 - je Ancestors-Win64-Shipping.exe+47F34B "Ancestors-Win64-Shipping.exe"+47F33A: 83 FA 01 - cmp edx,01 "Ancestors-Win64-Shipping.exe"+47F33D: 75 4C - jne Ancestors-Win64-Shipping.exe+47F38B "Ancestors-Win64-Shipping.exe"+47F33F: 48 8B 89 88 01 00 00 - mov rcx,[rcx+00000188] "Ancestors-Win64-Shipping.exe"+47F346: E9 D5 E6 FF FF - jmp Ancestors-Win64-Shipping.exe+47DA20 "Ancestors-Win64-Shipping.exe"+47F34B: 48 8B 89 88 01 00 00 - mov rcx,[rcx+00000188] "Ancestors-Win64-Shipping.exe"+47F352: E9 79 E8 FF FF - jmp Ancestors-Win64-Shipping.exe+47DBD0 } 902 "Infinite poisoning protection" FF0000 Auto Assembler Script [ENABLE] // UCDSPoisoning::GetShieldRatio aobscanmodule(PoisoningShieldRatioIP,Ancestors-Win64-Shipping.exe,48 8B 91 E8 00 00 00 0F) // should be unique alloc(PoisoningShieldRatioPL,$1000,PoisoningShieldRatioIP) PoisoningShieldRatioPL: mov rdx,[rcx+000000E8] // CurrentMaxMinutesBeforeVenomShieldOver mov [rcx+000000D8],rdx // MinutesBeforeVenomShieldOver jmp return PoisoningShieldRatioIP: jmp PoisoningShieldRatioPL nop 2 return: registersymbol(PoisoningShieldRatioPL) registersymbol(PoisoningShieldRatioIP) [DISABLE] PoisoningShieldRatioIP: db 48 8B 91 E8 00 00 00 unregistersymbol(PoisoningShieldRatioPL) unregistersymbol(PoisoningShieldRatioIP) dealloc(PoisoningShieldRatioPL) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+47D3E0 "Ancestors-Win64-Shipping.exe"+47D3D6: CC - int 3 "Ancestors-Win64-Shipping.exe"+47D3D7: CC - int 3 "Ancestors-Win64-Shipping.exe"+47D3D8: CC - int 3 "Ancestors-Win64-Shipping.exe"+47D3D9: CC - int 3 "Ancestors-Win64-Shipping.exe"+47D3DA: CC - int 3 "Ancestors-Win64-Shipping.exe"+47D3DB: CC - int 3 "Ancestors-Win64-Shipping.exe"+47D3DC: CC - int 3 "Ancestors-Win64-Shipping.exe"+47D3DD: CC - int 3 "Ancestors-Win64-Shipping.exe"+47D3DE: CC - int 3 "Ancestors-Win64-Shipping.exe"+47D3DF: CC - int 3 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+47D3E0: 48 8B 91 E8 00 00 00 - mov rdx,[rcx+000000E8] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+47D3E7: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+47D3EA: 48 85 D2 - test rdx,rdx "Ancestors-Win64-Shipping.exe"+47D3ED: 74 32 - je Ancestors-Win64-Shipping.exe+47D421 "Ancestors-Win64-Shipping.exe"+47D3EF: 48 8B 81 D8 00 00 00 - mov rax,[rcx+000000D8] "Ancestors-Win64-Shipping.exe"+47D3F6: F3 0F 10 15 72 7B FC 01 - movss xmm2,[Ancestors-Win64-Shipping.exe+2444F70] "Ancestors-Win64-Shipping.exe"+47D3FE: F3 48 0F 2A C0 - cvtsi2ss xmm0,rax "Ancestors-Win64-Shipping.exe"+47D403: 48 85 C0 - test rax,rax "Ancestors-Win64-Shipping.exe"+47D406: 79 04 - jns Ancestors-Win64-Shipping.exe+47D40C "Ancestors-Win64-Shipping.exe"+47D408: F3 0F 58 C2 - addss xmm0,xmm2 "Ancestors-Win64-Shipping.exe"+47D40C: 0F 57 C9 - xorps xmm1,xmm1 } 913 "VITALITY" 808080 1 908 "Max health" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UCDSHealth::GetHealth aobscanmodule(GetHealth,Ancestors-Win64-Shipping.exe,F3 0F 10 41 58 C3) // should be unique alloc(GetHealthMem,$1000,"Ancestors-Win64-Shipping.exe"+6E5140) label(code) label(return) GetHealthMem: code: //mov byte ptr [rcx+54],#1 // Invincible - makes the character stuck but not dead, tested scripted death on Thorbjarnarson's Crocodile movss xmm0,[rcx+50] // HealthMax movss [rcx+58],xmm0 movss xmm0,[rcx+58] jmp return GetHealth: jmp GetHealthMem return: registersymbol(GetHealth) registersymbol(GetHealthMem) [DISABLE] GetHealth: db F3 0F 10 41 58 unregistersymbol(GetHealth) unregistersymbol(GetHealthMem) dealloc(GetHealthMem) { // ORIGINAL CODE - GetHealthION POINT: "Ancestors-Win64-Shipping.exe"+6E5140 "Ancestors-Win64-Shipping.exe"+6E512D: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+6E5130: 48 8B 5C 24 30 - mov rbx,[rsp+30] "Ancestors-Win64-Shipping.exe"+6E5135: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+6E5139: 5F - pop rdi "Ancestors-Win64-Shipping.exe"+6E513A: C3 - ret "Ancestors-Win64-Shipping.exe"+6E513B: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E513C: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E513D: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E513E: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E513F: CC - int 3 // ---------- GetHealthING HERE ---------- "Ancestors-Win64-Shipping.exe"+6E5140: F3 0F 10 41 58 - movss xmm0,[rcx+58] // ---------- DONE GetHealthING ---------- "Ancestors-Win64-Shipping.exe"+6E5145: C3 - ret "Ancestors-Win64-Shipping.exe"+6E5146: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E5147: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E5148: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E5149: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E514A: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E514B: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E514C: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E514D: CC - int 3 "Ancestors-Win64-Shipping.exe"+6E514E: CC - int 3 } 906 "Max energy" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UCDSVitality::ModifyEnergy aobscanmodule(ModifyEnergyIP,Ancestors-Win64-Shipping.exe,F3 44 0F 58 83 A4 00 00 00) // should be unique alloc(ModifyEnergyPL,$1000,ModifyEnergyIP) label(fDesiredVitality) ModifyEnergyPL: movss xmm8,[fDesiredVitality] jmp return fDesiredVitality: dd (float)1.0 ModifyEnergyIP: jmp ModifyEnergyPL nop 4 return: registersymbol(ModifyEnergyIP) registersymbol(ModifyEnergyPL) [DISABLE] ModifyEnergyIP: db F3 44 0F 58 83 A4 00 00 00 unregistersymbol(ModifyEnergyIP) unregistersymbol(ModifyEnergyPL) dealloc(ModifyEnergyIP) { // Ancestors-Win64-Shipping.UCDSVitality::Update+38 // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+4A0D41 "Ancestors-Win64-Shipping.exe"+4A0D1A: 0F 29 74 24 50 - movaps [rsp+50],xmm6 "Ancestors-Win64-Shipping.exe"+4A0D1F: 41 0F B6 F9 - movzx edi,r9l "Ancestors-Win64-Shipping.exe"+4A0D23: 0F 29 7C 24 40 - movaps [rsp+40],xmm7 "Ancestors-Win64-Shipping.exe"+4A0D28: 48 8B D9 - mov rbx,rcx "Ancestors-Win64-Shipping.exe"+4A0D2B: 44 0F 29 44 24 30 - movaps [rsp+30],xmm8 "Ancestors-Win64-Shipping.exe"+4A0D31: 44 0F 28 C1 - movaps xmm8,xmm1 "Ancestors-Win64-Shipping.exe"+4A0D35: 45 84 C0 - test r8l,r8l "Ancestors-Win64-Shipping.exe"+4A0D38: 74 07 - je Ancestors-Win64-Shipping.exe+4A0D41 "Ancestors-Win64-Shipping.exe"+4A0D3A: B2 01 - mov dl,01 "Ancestors-Win64-Shipping.exe"+4A0D3C: E8 6F 03 00 00 - call Ancestors-Win64-Shipping.exe+4A10B0 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+4A0D41: F3 44 0F 58 83 A4 00 00 00 - addss xmm8,[rbx+000000A4] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+4A0D4A: 0F 57 F6 - xorps xmm6,xmm6 "Ancestors-Win64-Shipping.exe"+4A0D4D: 41 B1 01 - mov r9l,01 "Ancestors-Win64-Shipping.exe"+4A0D50: 44 0F B6 C7 - movzx r8d,dil "Ancestors-Win64-Shipping.exe"+4A0D54: 48 8B CB - mov rcx,rbx "Ancestors-Win64-Shipping.exe"+4A0D57: 41 0F 28 F8 - movaps xmm7,xmm8 "Ancestors-Win64-Shipping.exe"+4A0D5B: 41 0F 28 C8 - movaps xmm1,xmm8 "Ancestors-Win64-Shipping.exe"+4A0D5F: F3 0F 5D FE - minss xmm7,xmm6 "Ancestors-Win64-Shipping.exe"+4A0D63: E8 68 08 00 00 - call Ancestors-Win64-Shipping.exe+4A15D0 "Ancestors-Win64-Shipping.exe"+4A0D68: 0F 2F FE - comiss xmm7,xmm6 "Ancestors-Win64-Shipping.exe"+4A0D6B: 73 23 - jae Ancestors-Win64-Shipping.exe+4A0D90 } 878 "No hunger, thirst, fatigue" FF0000 Auto Assembler Script [ENABLE] //Ancestors-Win64-Shipping.UCDSRegimen::ComputeNeedState+4E aobscanmodule(INJECT,Ancestors-Win64-Shipping.exe,0F 2F 83 E8 00 00 00 73 08) // should be unique alloc(newmem,$1000,"Ancestors-Win64-Shipping.exe"+55978E) label(code) label(return) label(pRegimen) newmem: code: mov [pRegimen],rbx push eax mov eax, [rbx+19C] // max need 1 mov [rbx+13C], eax // current need 1 mov eax, [rbx+1C8] // max need 2 mov [rbx+140], eax // current need 2 mov eax, [rbx+1F4] // max need 3 mov [rbx+144], eax // current need 3 pop eax comiss xmm0,[rbx+000000E8] jmp return pRegimen: dq 0 INJECT: jmp newmem nop 2 return: registersymbol(INJECT) registersymbol(newmem) registersymbol(pRegimen) [DISABLE] INJECT: db 0F 2F 83 E8 00 00 00 unregistersymbol(INJECT) unregistersymbol(newmem) unregistersymbol(pRegimen) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+55978E "Ancestors-Win64-Shipping.exe"+559767: EB 08 - jmp Ancestors-Win64-Shipping.exe+559771 "Ancestors-Win64-Shipping.exe"+559769: F3 0F 10 81 54 01 00 00 - movss xmm0,[rcx+00000154] "Ancestors-Win64-Shipping.exe"+559771: 0F 54 05 D8 6E EE 01 - andps xmm0,[Ancestors-Win64-Shipping.exe+2440650] "Ancestors-Win64-Shipping.exe"+559778: 0F 2F 05 71 BA EE 01 - comiss xmm0,[Ancestors-Win64-Shipping.exe+24451F0] "Ancestors-Win64-Shipping.exe"+55977F: 76 08 - jna Ancestors-Win64-Shipping.exe+559789 "Ancestors-Win64-Shipping.exe"+559781: B0 04 - mov al,04 "Ancestors-Win64-Shipping.exe"+559783: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+559787: 5B - pop rbx "Ancestors-Win64-Shipping.exe"+559788: C3 - ret "Ancestors-Win64-Shipping.exe"+559789: E8 82 08 00 00 - call Ancestors-Win64-Shipping.exe+55A010 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+55978E: 0F 2F 83 E8 00 00 00 - comiss xmm0,[rbx+000000E8] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+559795: 73 08 - jae Ancestors-Win64-Shipping.exe+55979F "Ancestors-Win64-Shipping.exe"+559797: B0 03 - mov al,03 "Ancestors-Win64-Shipping.exe"+559799: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+55979D: 5B - pop rbx "Ancestors-Win64-Shipping.exe"+55979E: C3 - ret "Ancestors-Win64-Shipping.exe"+55979F: 0F 2F 83 E4 00 00 00 - comiss xmm0,[rbx+000000E4] "Ancestors-Win64-Shipping.exe"+5597A6: 73 08 - jae Ancestors-Win64-Shipping.exe+5597B0 "Ancestors-Win64-Shipping.exe"+5597A8: B0 02 - mov al,02 "Ancestors-Win64-Shipping.exe"+5597AA: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+5597AE: 5B - pop rbx } 16 "Max dopamine" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UFearManager::SetDopamine+60 aobscanmodule(pDopamineCode,Ancestors-Win64-Shipping.exe,F3 0F 11 87 28 12 00 00) // should be unique alloc(pDopamineInjection,$1000,"Ancestors-Win64-Shipping.exe"+6E7DC0) label(return) label(pDopamine) label(fDopamineDesired) pDopamineInjection: mov [pDopamine],rdi movss xmm0, [fDopamineDesired] movss [rdi+00001228],xmm0 jmp return fDopamineDesired: dd (float)1.0 pDopamine: dq 0 pDopamineCode: jmp pDopamineInjection nop 3 return: registersymbol(pDopamineCode) registersymbol(pDopamineInjection) registersymbol(pDopamine) registersymbol(fDopamineDesired) [DISABLE] pDopamineCode: db F3 0F 11 87 28 12 00 00 unregistersymbol(pDopamine) unregistersymbol(fDopamineDesired) unregistersymbol(pDopamineInjection) unregistersymbol(pDopamineCode) dealloc(pDopamineInjection) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+6E7DC0 "Ancestors-Win64-Shipping.exe"+6E7D91: F3 44 0F 10 89 28 12 00 00 - movss xmm9,[rcx+00001228] "Ancestors-Win64-Shipping.exe"+6E7D9A: E8 21 D9 FF FF - call Ancestors-Win64-Shipping.exe+6E56C0 "Ancestors-Win64-Shipping.exe"+6E7D9F: 44 0F 28 C0 - movaps xmm8,xmm0 "Ancestors-Win64-Shipping.exe"+6E7DA3: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+6E7DA6: 0F 2F F0 - comiss xmm6,xmm0 "Ancestors-Win64-Shipping.exe"+6E7DA9: F3 44 0F 59 47 48 - mulss xmm8,[rdi+48] "Ancestors-Win64-Shipping.exe"+6E7DAF: 72 08 - jb Ancestors-Win64-Shipping.exe+6E7DB9 "Ancestors-Win64-Shipping.exe"+6E7DB1: 41 0F 28 C0 - movaps xmm0,xmm8 "Ancestors-Win64-Shipping.exe"+6E7DB5: F3 0F 5D C6 - minss xmm0,xmm6 "Ancestors-Win64-Shipping.exe"+6E7DB9: 48 8D 8F 30 13 00 00 - lea rcx,[rdi+00001330] // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+6E7DC0: F3 0F 11 87 28 12 00 00 - movss [rdi+00001228],xmm0 // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+6E7DC8: E8 D3 B8 3F 00 - call Ancestors-Win64-Shipping.exe+AE36A0 "Ancestors-Win64-Shipping.exe"+6E7DCD: 84 C0 - test al,al "Ancestors-Win64-Shipping.exe"+6E7DCF: 74 3C - je Ancestors-Win64-Shipping.exe+6E7E0D "Ancestors-Win64-Shipping.exe"+6E7DD1: 48 8D 8F 30 13 00 00 - lea rcx,[rdi+00001330] "Ancestors-Win64-Shipping.exe"+6E7DD8: E8 73 67 3F 00 - call Ancestors-Win64-Shipping.exe+ADE550 "Ancestors-Win64-Shipping.exe"+6E7DDD: 41 B8 01 00 00 00 - mov r8d,00000001 "Ancestors-Win64-Shipping.exe"+6E7DE3: 48 8D 15 36 2C EF 01 - lea rdx,[Ancestors-Win64-Shipping.exe+25DAA20] "Ancestors-Win64-Shipping.exe"+6E7DEA: 48 8D 4C 24 70 - lea rcx,[rsp+70] "Ancestors-Win64-Shipping.exe"+6E7DEF: 48 8B D8 - mov rbx,rax "Ancestors-Win64-Shipping.exe"+6E7DF2: E8 D9 80 25 00 - call Ancestors-Win64-Shipping.exe+93FED0 } 29 "Instant recovery from injury" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UCDSWounds::DecrementHealingTimer+2B aobscanmodule(WoundHealingIP,Ancestors-Win64-Shipping.exe,4C 89 8B B0 00 00 00) // should be unique alloc(WoundHealingPL,$1000,WoundHealingIP) WoundHealingPL: code: mov r9,#0 mov [rbx+000000B0],r9 jmp return WoundHealingIP: jmp WoundHealingPL nop 2 return: registersymbol(WoundHealingIP) registersymbol(WoundHealingPL) [DISABLE] WoundHealingIP: db 4C 89 8B B0 00 00 00 unregistersymbol(WoundHealingPL) unregistersymbol(WoundHealingIP) dealloc(WoundHealingPL) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+4A56DB "Ancestors-Win64-Shipping.exe"+4A56BA: 57 - push rdi "Ancestors-Win64-Shipping.exe"+4A56BB: 48 83 EC 60 - sub rsp,60 "Ancestors-Win64-Shipping.exe"+4A56BF: 33 FF - xor edi,edi "Ancestors-Win64-Shipping.exe"+4A56C1: 48 8B D9 - mov rbx,rcx "Ancestors-Win64-Shipping.exe"+4A56C4: 48 8B 89 B0 00 00 00 - mov rcx,[rcx+000000B0] "Ancestors-Win64-Shipping.exe"+4A56CB: 44 8B CF - mov r9d,edi "Ancestors-Win64-Shipping.exe"+4A56CE: 48 8B C1 - mov rax,rcx "Ancestors-Win64-Shipping.exe"+4A56D1: 48 2B C2 - sub rax,rdx "Ancestors-Win64-Shipping.exe"+4A56D4: 48 3B CA - cmp rcx,rdx "Ancestors-Win64-Shipping.exe"+4A56D7: 4C 0F 43 C8 - cmovae r9,rax // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+4A56DB: 4C 89 8B B0 00 00 00 - mov [rbx+000000B0],r9 // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+4A56E2: 4D 85 C9 - test r9,r9 "Ancestors-Win64-Shipping.exe"+4A56E5: 75 17 - jne Ancestors-Win64-Shipping.exe+4A56FE "Ancestors-Win64-Shipping.exe"+4A56E7: 48 2B D1 - sub rdx,rcx "Ancestors-Win64-Shipping.exe"+4A56EA: 48 8B 8B 58 01 00 00 - mov rcx,[rbx+00000158] "Ancestors-Win64-Shipping.exe"+4A56F1: E8 1A 23 00 00 - call Ancestors-Win64-Shipping.exe+4A7A10 "Ancestors-Win64-Shipping.exe"+4A56F6: 4C 8B 84 24 80 00 00 00 - mov r8,[rsp+00000080] "Ancestors-Win64-Shipping.exe"+4A56FE: 48 89 7C 24 70 - mov [rsp+70],rdi "Ancestors-Win64-Shipping.exe"+4A5703: 4C 3B C7 - cmp r8,rdi "Ancestors-Win64-Shipping.exe"+4A5706: 0F 84 B0 00 00 00 - je Ancestors-Win64-Shipping.exe+4A57BC "Ancestors-Win64-Shipping.exe"+4A570C: 48 8D 15 CD 87 09 02 - lea rdx,[Ancestors-Win64-Shipping.exe+253DEE0] } 27 "Instant recovery from poison" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UCDSPoisoning::DecrementHealingTimer+2B aobscanmodule(PoisonHealingIP,Ancestors-Win64-Shipping.exe,4C 89 8B D0 00 00 00 4D) // should be unique alloc(PoisonHealingPL,$1000,PoisonHealingIP) PoisonHealingPL: mov r9,#0 mov [rbx+000000D0],r9 // MinutesBeforeCurrentPoisoningHeals jmp return PoisonHealingIP: jmp PoisonHealingPL nop 2 return: registersymbol(PoisonHealingIP) registersymbol(PoisonHealingPL) [DISABLE] PoisonHealingIP: db 4C 89 8B D0 00 00 00 unregistersymbol(PoisonHealingIP) unregistersymbol(PoisonHealingPL) dealloc(PoisonHealingPL) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+47C2FB "Ancestors-Win64-Shipping.exe"+47C2DA: 57 - push rdi "Ancestors-Win64-Shipping.exe"+47C2DB: 48 83 EC 60 - sub rsp,60 "Ancestors-Win64-Shipping.exe"+47C2DF: 33 FF - xor edi,edi "Ancestors-Win64-Shipping.exe"+47C2E1: 48 8B D9 - mov rbx,rcx "Ancestors-Win64-Shipping.exe"+47C2E4: 48 8B 89 D0 00 00 00 - mov rcx,[rcx+000000D0] "Ancestors-Win64-Shipping.exe"+47C2EB: 44 8B CF - mov r9d,edi "Ancestors-Win64-Shipping.exe"+47C2EE: 48 8B C1 - mov rax,rcx "Ancestors-Win64-Shipping.exe"+47C2F1: 48 2B C2 - sub rax,rdx "Ancestors-Win64-Shipping.exe"+47C2F4: 48 3B CA - cmp rcx,rdx "Ancestors-Win64-Shipping.exe"+47C2F7: 4C 0F 43 C8 - cmovae r9,rax // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+47C2FB: 4C 89 8B D0 00 00 00 - mov [rbx+000000D0],r9 // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+47C302: 4D 85 C9 - test r9,r9 "Ancestors-Win64-Shipping.exe"+47C305: 75 17 - jne Ancestors-Win64-Shipping.exe+47C31E "Ancestors-Win64-Shipping.exe"+47C307: 48 2B D1 - sub rdx,rcx "Ancestors-Win64-Shipping.exe"+47C30A: 48 8B 8B 88 01 00 00 - mov rcx,[rbx+00000188] "Ancestors-Win64-Shipping.exe"+47C311: E8 FA 34 00 00 - call Ancestors-Win64-Shipping.exe+47F810 "Ancestors-Win64-Shipping.exe"+47C316: 4C 8B 84 24 80 00 00 00 - mov r8,[rsp+00000080] "Ancestors-Win64-Shipping.exe"+47C31E: 48 89 7C 24 70 - mov [rsp+70],rdi "Ancestors-Win64-Shipping.exe"+47C323: 4C 3B C7 - cmp r8,rdi "Ancestors-Win64-Shipping.exe"+47C326: 74 5D - je Ancestors-Win64-Shipping.exe+47C385 "Ancestors-Win64-Shipping.exe"+47C328: 48 8D 15 31 5B 0B 02 - lea rdx,[Ancestors-Win64-Shipping.exe+2531E60] } 914 "EVOLUTION" 808080 1 846 "Alter item on the first successfull try" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UCDSCrafting::ApplyOutcome+14A aobscanmodule(ApplyOutcome,Ancestors-Win64-Shipping.exe,0F 47 C8 44 3B E1) // should be unique alloc(ApplyOutcomeMem,$1000,"Ancestors-Win64-Shipping.exe"+458FEA) label(code) label(return) ApplyOutcomeMem: code: cmova ecx,eax mov r12d,ecx cmp r12d,ecx jmp return ApplyOutcome: jmp ApplyOutcomeMem nop return: registersymbol(ApplyOutcome) registersymbol(ApplyOutcomeMem) [DISABLE] ApplyOutcome: db 0F 47 C8 44 3B E1 unregistersymbol(ApplyOutcome) unregistersymbol(ApplyOutcomeMem) dealloc(ApplyOutcomeMem) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+458FEA "Ancestors-Win64-Shipping.exe"+458FCB: 74 12 - je Ancestors-Win64-Shipping.exe+458FDF "Ancestors-Win64-Shipping.exe"+458FCD: 0F 14 C0 - unpcklps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+458FD0: 0F 50 C0 - movmskps eax,xmm0 "Ancestors-Win64-Shipping.exe"+458FD3: 83 E0 01 - and eax,01 "Ancestors-Win64-Shipping.exe"+458FD6: 2B C8 - sub ecx,eax "Ancestors-Win64-Shipping.exe"+458FD8: 66 0F 6E C1 - movd xmm0,ecx "Ancestors-Win64-Shipping.exe"+458FDC: 0F 5B C0 - cvtdq2ps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+458FDF: F3 0F 2C C0 - cvttss2si eax,xmm0 "Ancestors-Win64-Shipping.exe"+458FE3: B9 01 00 00 00 - mov ecx,00000001 "Ancestors-Win64-Shipping.exe"+458FE8: 3B C1 - cmp eax,ecx // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+458FEA: 0F 47 C8 - cmova ecx,eax "Ancestors-Win64-Shipping.exe"+458FED: 44 3B E1 - cmp r12d,ecx // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+458FF0: 0F 82 C7 00 00 00 - jb Ancestors-Win64-Shipping.exe+4590BD "Ancestors-Win64-Shipping.exe"+458FF6: 49 8B CE - mov rcx,r14 "Ancestors-Win64-Shipping.exe"+458FF9: E8 A2 17 00 00 - call Ancestors-Win64-Shipping.exe+45A7A0 "Ancestors-Win64-Shipping.exe"+458FFE: 49 8D 4F 08 - lea rcx,[r15+08] "Ancestors-Win64-Shipping.exe"+459002: E8 29 C1 FF FF - call Ancestors-Win64-Shipping.exe+455130 "Ancestors-Win64-Shipping.exe"+459007: 48 8D 4D 88 - lea rcx,[rbp-78] "Ancestors-Win64-Shipping.exe"+45900B: 48 8B F0 - mov rsi,rax "Ancestors-Win64-Shipping.exe"+45900E: E8 8D F5 57 01 - call Ancestors-Win64-Shipping.exe+19D85A0 "Ancestors-Win64-Shipping.exe"+459013: 49 8B 16 - mov rdx,[r14] "Ancestors-Win64-Shipping.exe"+459016: 49 8B CE - mov rcx,r14 } 788 "Grow neuronal connections faster" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.URPGNode::AddAssignedEnergy aobscanmodule(AddAssignedEnergy,Ancestors-Win64-Shipping.exe,F3 0F 58 89 1C 01 00 00) // should be unique alloc(AddAssignedEnergyMem,$1000,"Ancestors-Win64-Shipping.exe"+704080) label(code) label(return) label(AssignedEnergyDesired) AddAssignedEnergyMem: code: movss xmm1,[AssignedEnergyDesired] addss xmm1,[rcx+0000011C] jmp return AssignedEnergyDesired: dd (float)0.1 AddAssignedEnergy: jmp AddAssignedEnergyMem nop 3 return: registersymbol(AddAssignedEnergy) registersymbol(AddAssignedEnergyMem) [DISABLE] AddAssignedEnergy: db F3 0F 58 89 1C 01 00 00 unregistersymbol(AddAssignedEnergy) unregistersymbol(AddAssignedEnergyMem) dealloc(AddAssignedEnergyMem) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+704080 "Ancestors-Win64-Shipping.exe"+704076: CC - int 3 "Ancestors-Win64-Shipping.exe"+704077: CC - int 3 "Ancestors-Win64-Shipping.exe"+704078: CC - int 3 "Ancestors-Win64-Shipping.exe"+704079: CC - int 3 "Ancestors-Win64-Shipping.exe"+70407A: CC - int 3 "Ancestors-Win64-Shipping.exe"+70407B: CC - int 3 "Ancestors-Win64-Shipping.exe"+70407C: CC - int 3 "Ancestors-Win64-Shipping.exe"+70407D: CC - int 3 "Ancestors-Win64-Shipping.exe"+70407E: CC - int 3 "Ancestors-Win64-Shipping.exe"+70407F: CC - int 3 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+704080: F3 0F 58 89 1C 01 00 00 - addss xmm1,[rcx+0000011C] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+704088: 66 0F 6E 81 20 01 00 00 - movd xmm0,[rcx+00000120] "Ancestors-Win64-Shipping.exe"+704090: 0F 5B C0 - cvtdq2ps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+704093: F3 0F 11 89 1C 01 00 00 - movss [rcx+0000011C],xmm1 "Ancestors-Win64-Shipping.exe"+70409B: F3 0F 59 81 08 01 00 00 - mulss xmm0,[rcx+00000108] "Ancestors-Win64-Shipping.exe"+7040A3: 0F 2F C8 - comiss xmm1,xmm0 "Ancestors-Win64-Shipping.exe"+7040A6: 0F 83 14 DD 71 01 - jae Ancestors-Win64-Shipping.exe+1E21DC0 "Ancestors-Win64-Shipping.exe"+7040AC: C3 - ret "Ancestors-Win64-Shipping.exe"+7040AD: CC - int 3 "Ancestors-Win64-Shipping.exe"+7040AE: CC - int 3 "Ancestors-Win64-Shipping.exe"+7040AF: CC - int 3 } 841 "Max neuron energy" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.URPGTracker::UpdateEnergyPool+B6 aobscanmodule(NeuronEnergy,Ancestors-Win64-Shipping.exe,F3 41 0F 11 30 40) // should be unique alloc(NeuronEnergyInjection,$1000,"Ancestors-Win64-Shipping.exe"+70B787) label(code) label(return) label(pNeuronEnergy) label(fNeuronalEnergyDesired) NeuronEnergyInjection: code: mov [pNeuronEnergy], rsi movss xmm6,[rsi+00000140] // max movss [rsi+0000013C],xmm6 // current jmp return pNeuronEnergy: dq 0 fNeuronalEnergyDesired: // unused for now dd (float)14.0 NeuronEnergy: jmp NeuronEnergyInjection return: registersymbol(NeuronEnergy) registersymbol(NeuronEnergyInjection) registersymbol(fNeuronalEnergyDesired) registersymbol(pNeuronEnergy) [DISABLE] NeuronEnergy: db F3 41 0F 11 30 unregistersymbol(NeuronEnergy) unregistersymbol(NeuronEnergyInjection) unregistersymbol(fNeuronalEnergyDesired) unregistersymbol(pNeuronEnergy) dealloc(NeuronEnergyInjection) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+70B787 "Ancestors-Win64-Shipping.exe"+70B75E: 48 8B D3 - mov rdx,rbx "Ancestors-Win64-Shipping.exe"+70B761: 48 89 6C 24 28 - mov [rsp+28],rbp "Ancestors-Win64-Shipping.exe"+70B766: 48 8B C8 - mov rcx,rax "Ancestors-Win64-Shipping.exe"+70B769: 89 6C 24 20 - mov [rsp+20],ebp "Ancestors-Win64-Shipping.exe"+70B76D: E8 7E F9 3D 00 - call Ancestors-Win64-Shipping.exe+AEB0F0 "Ancestors-Win64-Shipping.exe"+70B772: 4C 8D 86 3C 01 00 00 - lea r8,[rsi+0000013C] "Ancestors-Win64-Shipping.exe"+70B779: 48 8B D8 - mov rbx,rax "Ancestors-Win64-Shipping.exe"+70B77C: 41 8B 08 - mov ecx,[r8] "Ancestors-Win64-Shipping.exe"+70B77F: 89 48 28 - mov [rax+28],ecx "Ancestors-Win64-Shipping.exe"+70B782: F3 41 0F 58 30 - addss xmm6,[r8] // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+70B787: F3 41 0F 11 30 - movss [r8],xmm6 // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+70B78C: 40 84 FF - test dil,dil "Ancestors-Win64-Shipping.exe"+70B78F: 74 1A - je Ancestors-Win64-Shipping.exe+70B7AB "Ancestors-Win64-Shipping.exe"+70B791: 48 8D 96 40 01 00 00 - lea rdx,[rsi+00000140] "Ancestors-Win64-Shipping.exe"+70B798: 49 8B C8 - mov rcx,r8 "Ancestors-Win64-Shipping.exe"+70B79B: F3 0F 10 02 - movss xmm0,[rdx] "Ancestors-Win64-Shipping.exe"+70B79F: 0F 2F C6 - comiss xmm0,xmm6 "Ancestors-Win64-Shipping.exe"+70B7A2: 48 0F 42 CA - cmovb rcx,rdx "Ancestors-Win64-Shipping.exe"+70B7A6: 8B 01 - mov eax,[rcx] "Ancestors-Win64-Shipping.exe"+70B7A8: 41 89 00 - mov [r8],eax "Ancestors-Win64-Shipping.exe"+70B7AB: 41 8B 00 - mov eax,[r8] } 798 "Instant identifying" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UCDSDiscoverEnvironment::Tick_FocusInProgress<CDSDiscoverEnvironmentLogic::TickFocusInProgressCallSuper>+11C aobscanmodule(Tick_FocusInProgress,Ancestors-Win64-Shipping.exe,77 28 48 8B 8B A0 0D 00 00) // should be unique Tick_FocusInProgress: db 72 // jb registersymbol(Tick_FocusInProgress) [DISABLE] Tick_FocusInProgress: db 77 // ja unregistersymbol(Tick_FocusInProgress) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+52688C "Ancestors-Win64-Shipping.exe"+526855: 72 07 - jb Ancestors-Win64-Shipping.exe+52685E "Ancestors-Win64-Shipping.exe"+526857: F3 0F 5D C6 - minss xmm0,xmm6 "Ancestors-Win64-Shipping.exe"+52685B: 0F 28 C8 - movaps xmm1,xmm0 "Ancestors-Win64-Shipping.exe"+52685E: 48 8B 8B B8 0C 00 00 - mov rcx,[rbx+00000CB8] "Ancestors-Win64-Shipping.exe"+526865: F3 0F 11 8B 58 0D 00 00 - movss [rbx+00000D58],xmm1 "Ancestors-Win64-Shipping.exe"+52686D: E8 EE EF 1E 00 - call Ancestors-Win64-Shipping.exe+715860 "Ancestors-Win64-Shipping.exe"+526872: F3 0F 10 83 58 0D 00 00 - movss xmm0,[rbx+00000D58] "Ancestors-Win64-Shipping.exe"+52687A: F3 0F 5C C6 - subss xmm0,xmm6 "Ancestors-Win64-Shipping.exe"+52687E: 0F 54 05 CB 9D F1 01 - andps xmm0,[Ancestors-Win64-Shipping.exe+2440650] "Ancestors-Win64-Shipping.exe"+526885: 0F 2F 05 C4 45 F2 01 - comiss xmm0,[Ancestors-Win64-Shipping.exe+244AE50] // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+52688C: 77 28 - ja Ancestors-Win64-Shipping.exe+5268B6 "Ancestors-Win64-Shipping.exe"+52688E: 48 8B 8B A0 0D 00 00 - mov rcx,[rbx+00000DA0] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+526895: E8 56 74 00 00 - call Ancestors-Win64-Shipping.exe+52DCF0 "Ancestors-Win64-Shipping.exe"+52689A: 48 8B 5C 24 60 - mov rbx,[rsp+60] "Ancestors-Win64-Shipping.exe"+52689F: 0F 28 74 24 40 - movaps xmm6,[rsp+40] "Ancestors-Win64-Shipping.exe"+5268A4: 48 83 C4 50 - add rsp,50 "Ancestors-Win64-Shipping.exe"+5268A8: 5F - pop rdi "Ancestors-Win64-Shipping.exe"+5268A9: C3 - ret "Ancestors-Win64-Shipping.exe"+5268AA: 48 8B 8B A0 0D 00 00 - mov rcx,[rbx+00000DA0] "Ancestors-Win64-Shipping.exe"+5268B1: E8 8A 82 00 00 - call Ancestors-Win64-Shipping.exe+52EB40 "Ancestors-Win64-Shipping.exe"+5268B6: 48 8B 5C 24 60 - mov rbx,[rsp+60] "Ancestors-Win64-Shipping.exe"+5268BB: 0F 28 74 24 40 - movaps xmm6,[rsp+40] } 795 "Increase visibility range for points of interest" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UCDSDiscoverEnvironment::GetDetectionDistanceModifier+502 aobscanmodule(GetDetectionDistanceModifier,Ancestors-Win64-Shipping.exe,F0 48 8B 5C 24 40 0F 28 C6 0F 28 74 24 20 48 8B) // should be unique alloc(GetDetectionDistanceModifierInjection,$1000,"Ancestors-Win64-Shipping.exe"+52C392) label(code) label(return) label(DetectionDistance) GetDetectionDistanceModifierInjection: code: movss xmm6, [DetectionDistance] movaps xmm0,xmm6 movaps xmm6,[rsp+20] jmp return DetectionDistance: dd (float)500 // desired detection range GetDetectionDistanceModifier+06: jmp GetDetectionDistanceModifierInjection nop 3 return: registersymbol(GetDetectionDistanceModifier) [DISABLE] GetDetectionDistanceModifier+06: db 0F 28 C6 0F 28 74 24 20 unregistersymbol(GetDetectionDistanceModifier) dealloc(GetDetectionDistanceModifierInjection) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+52C392 "Ancestors-Win64-Shipping.exe"+52C36B: 84 C0 - test al,al "Ancestors-Win64-Shipping.exe"+52C36D: 74 1E - je Ancestors-Win64-Shipping.exe+52C38D "Ancestors-Win64-Shipping.exe"+52C36F: 48 8B CB - mov rcx,rbx "Ancestors-Win64-Shipping.exe"+52C372: E8 D9 21 5B 00 - call Ancestors-Win64-Shipping.exe+ADE550 "Ancestors-Win64-Shipping.exe"+52C377: 48 8B 15 2A 04 0A 03 - mov rdx,[Ancestors-Win64-Shipping.exe+35CC7A8] "Ancestors-Win64-Shipping.exe"+52C37E: 45 33 C0 - xor r8d,r8d "Ancestors-Win64-Shipping.exe"+52C381: 48 8B C8 - mov rcx,rax "Ancestors-Win64-Shipping.exe"+52C384: E8 47 6B FF FF - call Ancestors-Win64-Shipping.exe+522ED0 "Ancestors-Win64-Shipping.exe"+52C389: F3 0F 58 F0 - addss xmm6,xmm0 "Ancestors-Win64-Shipping.exe"+52C38D: 48 8B 5C 24 40 - mov rbx,[rsp+40] // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+52C392: 0F 28 C6 - movaps xmm0,xmm6 "Ancestors-Win64-Shipping.exe"+52C395: 0F 28 74 24 20 - movaps xmm6,[rsp+20] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+52C39A: 48 8B 74 24 48 - mov rsi,[rsp+48] "Ancestors-Win64-Shipping.exe"+52C39F: 48 83 C4 30 - add rsp,30 "Ancestors-Win64-Shipping.exe"+52C3A3: 5F - pop rdi "Ancestors-Win64-Shipping.exe"+52C3A4: C3 - ret "Ancestors-Win64-Shipping.exe"+52C3A5: CC - int 3 "Ancestors-Win64-Shipping.exe"+52C3A6: CC - int 3 "Ancestors-Win64-Shipping.exe"+52C3A7: CC - int 3 "Ancestors-Win64-Shipping.exe"+52C3A8: CC - int 3 "Ancestors-Win64-Shipping.exe"+52C3A9: CC - int 3 "Ancestors-Win64-Shipping.exe"+52C3AA: CC - int 3 } 842 "EXPERIMENTAL" 808080 1 862 "DEPRECATED" 808080 1 843 "NEURONS" 808080 1 827 "UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked" 0000FF Auto Assembler Script define(OnNodeButtonClicked2E,"Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked"+2E) define(OnNodeButtonClicked2EBytes,0F 84) define(OnNodeButtonClicked43,"Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked"+43) define(OnNodeButtonClicked43Bytes,74 17) define(OnNodeButtonClicked98,"Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked"+98) define(OnNodeButtonClicked98Bytes,74 1E) define(OnNodeButtonClickedAD,"Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked"+AD) define(OnNodeButtonClickedADBytes,75 09) define(OnNodeButtonClickedC4,"Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked"+C4) define(OnNodeButtonClickedC4Bytes,0F 84) define(OnNodeButtonClickedD8,"Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked"+D8) define(OnNodeButtonClickedD8Bytes,74 1A) define(OnNodeButtonClickedF2,"Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked"+F2) define(OnNodeButtonClickedF2Bytes,75 EC) define(OnNodeButtonClicked113,"Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked"+113) define(OnNodeButtonClicked113Bytes,74 1B) define(OnNodeButtonClicked13E,"Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked"+13E) define(OnNodeButtonClicked13EBytes,74 3A) [ENABLE] assert(OnNodeButtonClicked2E,OnNodeButtonClicked2EBytes) assert(OnNodeButtonClicked43,OnNodeButtonClicked43Bytes) assert(OnNodeButtonClicked98,OnNodeButtonClicked98Bytes) assert(OnNodeButtonClickedAD,OnNodeButtonClickedADBytes) assert(OnNodeButtonClickedC4,OnNodeButtonClickedC4Bytes) assert(OnNodeButtonClickedD8,OnNodeButtonClickedD8Bytes) assert(OnNodeButtonClickedF2,OnNodeButtonClickedF2Bytes) assert(OnNodeButtonClicked113,OnNodeButtonClicked113Bytes) assert(OnNodeButtonClicked13E,OnNodeButtonClicked13EBytes) // makes node responsive to assigning neuron energy OnNodeButtonClicked2E: db 0F 85 [DISABLE] OnNodeButtonClicked43: db OnNodeButtonClicked43Bytes OnNodeButtonClicked98: db OnNodeButtonClicked98Bytes OnNodeButtonClickedAD: db OnNodeButtonClickedADBytes OnNodeButtonClickedC4: db OnNodeButtonClickedC4Bytes OnNodeButtonClickedD8: db OnNodeButtonClickedD8Bytes OnNodeButtonClickedF2: db OnNodeButtonClickedF2Bytes OnNodeButtonClicked113: db OnNodeButtonClicked113Bytes OnNodeButtonClicked13E: db OnNodeButtonClicked13EBytes OnNodeButtonClicked2E: db OnNodeButtonClicked2EBytes { Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked - 48 89 5C 24 10 - mov [rsp+10],rbx Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+5- 48 89 74 24 18 - mov [rsp+18],rsi Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+A- 57 - push rdi Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+B- 48 83 EC 30 - sub rsp,30 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+F- 48 8B F2 - mov rsi,rdx Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+12- 48 8B F9 - mov rdi,rcx Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+15- 45 84 C0 - test r8l,r8l // Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+18- 0F84 EE000000 - je Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+10C Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+1E- 45 84 C9 - test r9l,r9l // Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+21- 0F84 53010000 - je Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+17A Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+27- E8 649BFFFF - call Ancestors-Win64-Shipping.UMSRPGMenu::CanInteract Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+2C- 84 C0 - test al,al // Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+2E- 0F84 46010000 - je Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+17A Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+34- B2 03 - mov dl,03 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+36- 48 8B CE - mov rcx,rsi Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+39- E8 C20BF3FF - call Ancestors-Win64-Shipping.URPGNode::IsInState Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+3E- 48 8B D6 - mov rdx,rsi Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+41- 84 C0 - test al,al //---------------- Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+43- 74 17 - je Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+5C Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+45- 48 8B CF - mov rcx,rdi Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+48- 48 8B 5C 24 48 - mov rbx,[rsp+48] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+4D- 48 8B 74 24 50 - mov rsi,[rsp+50] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+52- 48 83 C4 30 - add rsp,30 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+56- 5F - pop rdi Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+57- E9 546E0000 - jmp Ancestors-Win64-Shipping.UMSRPGMenu::TryNodeActivation Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+5C- 48 8D 8F 70020000 - lea rcx,[rdi+00000270] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+63- 48 89 6C 24 40 - mov [rsp+40],rbp Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+68- E8 D3EE2F00 - call Ancestors-Win64-Shipping.FWeakObjectPtr::operator= Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+6D- 48 8B 46 50 - mov rax,[rsi+50] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+71- 48 8D 54 24 20 - lea rdx,[rsp+20] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+76- 48 8B 8F D0030000 - mov rcx,[rdi+000003D0] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+7D- 48 89 44 24 20 - mov [rsp+20],rax Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+82- E8 C95F0000 - call Ancestors-Win64-Shipping.MSRPGMenuLogic::Statechart::StartFilling Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+87- 48 8B AF 80020000 - mov rbp,[rdi+00000280] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+8E- 48 8B 9F 78020000 - mov rbx,[rdi+00000278] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+95- 48 3B DD - cmp rbx,rbp //----------------- Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+98- 74 1E - je Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+B8 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+9A- 66 0F1F 44 00 00 - nop word ptr [rax+rax+00] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+A0- 48 8B D6 - mov rdx,rsi Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+A3- 48 8B CB - mov rcx,rbx Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+A6- E8 1527D8FF - call "Ancestors-Win64"-Shipping.operator==<UGameCondition,UGameCondition,FWeakObjectPtr> Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+AB- 84 C0 - test al,al // Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+AD- 75 09 - jne Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+B8 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+AF- 48 83 C3 08 - add rbx,08 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+B3- 48 3B DD - cmp rbx,rbp Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+B6- 75 E8 - jne Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+A0 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+B8- 48 8B 6C 24 40 - mov rbp,[rsp+40] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+BD- 48 3B 9F 80020000 - cmp rbx,[rdi+00000280] // Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+C4- 0F84 B0000000 - je Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+17A Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+CA- 48 8B 97 80020000 - mov rdx,[rdi+00000280] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+D1- 48 8D 43 08 - lea rax,[rbx+08] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+D5- 48 3B C2 - cmp rax,rdx // Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+D8- 74 1A - je Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+F4 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+DA- 66 0F1F 44 00 00 - nop word ptr [rax+rax+00] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+E0- 8B 08 - mov ecx,[rax] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+E2- 89 48 F8 - mov [rax-08],ecx Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+E5- 8B 48 04 - mov ecx,[rax+04] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+E8- 89 48 FC - mov [rax-04],ecx Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+EB- 48 83 C0 08 - add rax,08 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+EF- 48 3B C2 - cmp rax,rdx // Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+F2- 75 EC - jne Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+E0 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+F4- 48 83 87 80020000 F8 - add qword ptr [rdi+00000280],-08 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+FC- 48 8B 5C 24 48 - mov rbx,[rsp+48] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+101- 48 8B 74 24 50 - mov rsi,[rsp+50] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+106- 48 83 C4 30 - add rsp,30 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+10A- 5F - pop rdi Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+10B- C3 - ret Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+10C- 80 BA 80000000 02 - cmp byte ptr [rdx+00000080],02 // makes dim node visible Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+113- 74 1B - je Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+130 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+115- 48 8D 4C 24 20 - lea rcx,[rsp+20] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+11A- E8 21EE2F00 - call Ancestors-Win64-Shipping.FWeakObjectPtr::operator= Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+11F- 48 8D 8F 78020000 - lea rcx,[rdi+00000278] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+126- 48 8D 54 24 20 - lea rdx,[rsp+20] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+12B- E8 90C1F0FF - call "Ancestors-Win64"-Shipping.std::vector<TWeakObjectPtr<UGameProgressionTutorialNode,FWeakObjectPtr>,std::allocator<TWeakObjectPtr<UGameProgressionTutorialNode,FWeakObjectPtr> > >::push_back Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+130- 48 8D 8F 70020000 - lea rcx,[rdi+00000270] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+137- E8 C4F73000 - call Ancestors-Win64-Shipping.exe+AE36A0 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+13C- 84 C0 - test al,al // crash the game Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+13E- 74 3A - je Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+17A Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+140- 48 8D 8F 70020000 - lea rcx,[rdi+00000270] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+147- E8 64A63000 - call Ancestors-Win64-Shipping.exe+ADE550 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+14C- 48 8D 54 24 20 - lea rdx,[rsp+20] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+151- 48 8B 48 50 - mov rcx,[rax+50] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+155- 48 89 4C 24 20 - mov [rsp+20],rcx Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+15A- 48 8B 8F D0030000 - mov rcx,[rdi+000003D0] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+161- E8 FA600000 - call Ancestors-Win64-Shipping.MSRPGMenuLogic::Statechart::StopFilling Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+166- C7 87 70020000 FFFFFFFF - mov [rdi+00000270],FFFFFFFF Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+170- C7 87 74020000 00000000 - mov [rdi+00000274],00000000 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+17A- 48 8B 5C 24 48 - mov rbx,[rsp+48] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+17F- 48 8B 74 24 50 - mov rsi,[rsp+50] Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+184- 48 83 C4 30 - add rsp,30 Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+188- 5F - pop rdi Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+189- C3 - ret Ancestors-Win64-Shipping.UMSRPGMenu::NeuronalNetwork_OnNodeButtonClicked+18A- CC - int 3 } 833 "ARPGMenuBranch::GetEndNodeState" 0000FF Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.ARPGMenuBranch::GetEndNodeState aobscanmodule(ARPGMenuBranch,Ancestors-Win64-Shipping.exe,0F B6 81 35 03 00 00) // should be unique alloc(ARPGMenuBranchInjection,$1000,"Ancestors-Win64-Shipping.exe"+7DEC60) label(code) label(return) ARPGMenuBranchInjection: code: mov byte ptr [rcx+00000335],05 // ERPGNodeState: 0..5 = Invalid, Locked, Potential, Revealed, Activated, Energized movzx eax,byte ptr [rcx+00000335] jmp return ARPGMenuBranch: jmp ARPGMenuBranchInjection nop 2 return: registersymbol(ARPGMenuBranch) [DISABLE] ARPGMenuBranch: db 0F B6 81 35 03 00 00 unregistersymbol(ARPGMenuBranch) dealloc(ARPGMenuBranchInjection) { // ORIGINAL CODE - ARPGMenuBranchION POINT: "Ancestors-Win64-Shipping.exe"+7DEC60 "Ancestors-Win64-Shipping.exe"+7DEC4C: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC4D: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC4E: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC4F: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC50: 48 81 C1 40 03 00 00 - add rcx,00000340 "Ancestors-Win64-Shipping.exe"+7DEC57: E9 F4 F8 2F 00 - jmp Ancestors-Win64-Shipping.exe+ADE550 "Ancestors-Win64-Shipping.exe"+7DEC5C: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC5D: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC5E: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC5F: CC - int 3 // ---------- ARPGMenuBranchING HERE ---------- "Ancestors-Win64-Shipping.exe"+7DEC60: 0F B6 81 35 03 00 00 - movzx eax,byte ptr [rcx+00000335] // ---------- DONE ARPGMenuBranchING ---------- "Ancestors-Win64-Shipping.exe"+7DEC67: C3 - ret "Ancestors-Win64-Shipping.exe"+7DEC68: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC69: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC6A: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC6B: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC6C: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC6D: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC6E: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC6F: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DEC70: 48 81 C1 48 03 00 00 - add rcx,00000348 } 826 "URPGNode::GetRPGState" 0000FF Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.URPGNode::GetRPGState aobscanmodule(INJECT,Ancestors-Win64-Shipping.exe,0F B6 81 19 01 00 00 C3 CC) // should be unique alloc(newmem,$1000,"Ancestors-Win64-Shipping.exe"+7046F0) label(code) label(return) newmem: code: mov byte ptr [rcx+00000119],05 // ERPGNodeState: 0..5 = Invalid, Locked, Potential, Revealed, Activated, Energized movzx eax,byte ptr [rcx+00000119] jmp return INJECT: jmp newmem nop 2 return: registersymbol(INJECT) [DISABLE] INJECT: db 0F B6 81 19 01 00 00 unregistersymbol(INJECT) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+7046F0 "Ancestors-Win64-Shipping.exe"+7046E6: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046E7: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046E8: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046E9: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046EA: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046EB: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046EC: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046ED: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046EE: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046EF: CC - int 3 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+7046F0: 0F B6 81 19 01 00 00 - movzx eax,byte ptr [rcx+00000119] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+7046F7: C3 - ret "Ancestors-Win64-Shipping.exe"+7046F8: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046F9: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046FA: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046FB: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046FC: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046FD: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046FE: CC - int 3 "Ancestors-Win64-Shipping.exe"+7046FF: CC - int 3 "Ancestors-Win64-Shipping.exe"+704700: 48 85 D2 - test rdx,rdx } 820 "ARPGMenuBranch::SetFill" 0000FF Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.ARPGMenuBranch::SetFill+13 aobscanmodule(SetFill,Ancestors-Win64-Shipping.exe,0F 28 C1 F3 0F 11 81 30 03 00 00) // should be unique alloc(SetFillInjection,$1000,"Ancestors-Win64-Shipping.exe"+7DECE0) label(code) label(return) label(fDesiredFill) SetFillInjection: code: movss xmm0,[fDesiredFill] movss [rcx+00000330],xmm0 jmp return fDesiredFill: dd (float)1.0 SetFill: jmp SetFillInjection nop 6 return: registersymbol(SetFill) registersymbol(SetFillInjection) registersymbol(fDesiredFill) [DISABLE] SetFill: db 0F 28 C1 F3 0F 11 81 30 03 00 00 unregistersymbol(SetFillInjection) unregistersymbol(fDesiredFill) unregistersymbol(SetFill) dealloc(SetFillInjection) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+7DECE0 "Ancestors-Win64-Shipping.exe"+7DECC6: E9 C5 EC 05 00 - jmp Ancestors-Win64-Shipping.exe+83D990 "Ancestors-Win64-Shipping.exe"+7DECCB: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DECCC: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DECCD: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DECCE: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DECCF: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DECD0: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+7DECD3: 0F 2F C8 - comiss xmm1,xmm0 "Ancestors-Win64-Shipping.exe"+7DECD6: 72 0B - jb Ancestors-Win64-Shipping.exe+7DECE3 "Ancestors-Win64-Shipping.exe"+7DECD8: F3 0F 5D 0D 88 17 C6 01 - minss xmm1,[Ancestors-Win64-Shipping.exe+2440468] // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+7DECE0: 0F 28 C1 - movaps xmm0,xmm1 "Ancestors-Win64-Shipping.exe"+7DECE3: F3 0F 11 81 30 03 00 00 - movss [rcx+00000330],xmm0 // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+7DECEB: E9 A0 EC 05 00 - jmp Ancestors-Win64-Shipping.exe+83D990 "Ancestors-Win64-Shipping.exe"+7DECF0: 38 91 36 03 00 00 - cmp [rcx+00000336],dl "Ancestors-Win64-Shipping.exe"+7DECF6: 74 0B - je Ancestors-Win64-Shipping.exe+7DED03 "Ancestors-Win64-Shipping.exe"+7DECF8: 88 91 36 03 00 00 - mov [rcx+00000336],dl "Ancestors-Win64-Shipping.exe"+7DECFE: E9 9D EB 05 00 - jmp Ancestors-Win64-Shipping.exe+83D8A0 "Ancestors-Win64-Shipping.exe"+7DED03: C3 - ret "Ancestors-Win64-Shipping.exe"+7DED04: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DED05: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DED06: CC - int 3 "Ancestors-Win64-Shipping.exe"+7DED07: CC - int 3 } 834 "GetBranchFilling" 0000FF Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.`anonymous namespace'::GetBranchFilling+7C aobscanmodule(GetBranchFilling,Ancestors-Win64-Shipping.exe,00 00 66 0F 6E 88 20 01 00 00) // should be unique alloc(GetBranchFillingInjection,$1000,"Ancestors-Win64-Shipping.exe"+7CF06C) label(code) label(return) GetBranchFillingInjection: code: movd xmm1,[rax+00000120] mov byte ptr [rax+00000119],05 // ERPGNodeState: 0..5 = Invalid, Locked, Potential, Revealed, Activated, Energized jmp return GetBranchFilling+02: jmp GetBranchFillingInjection nop 3 return: registersymbol(GetBranchFilling) registersymbol(GetBranchFillingInjection) [DISABLE] GetBranchFilling+02: db 66 0F 6E 88 20 01 00 00 unregistersymbol(GetBranchFillingInjection) unregistersymbol(GetBranchFilling) dealloc(GetBranchFillingInjection) { // ORIGINAL CODE - GetBranchFillingION POINT: "Ancestors-Win64-Shipping.exe"+7CF06C "Ancestors-Win64-Shipping.exe"+7CF046: 40 80 FD 05 - cmp bpl,05 "Ancestors-Win64-Shipping.exe"+7CF04A: 74 05 - je Ancestors-Win64-Shipping.exe+7CF051 "Ancestors-Win64-Shipping.exe"+7CF04C: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+7CF04F: EB 3A - jmp Ancestors-Win64-Shipping.exe+7CF08B "Ancestors-Win64-Shipping.exe"+7CF051: 80 BE 34 03 00 00 00 - cmp byte ptr [rsi+00000334],00 "Ancestors-Win64-Shipping.exe"+7CF058: 74 0A - je Ancestors-Win64-Shipping.exe+7CF064 "Ancestors-Win64-Shipping.exe"+7CF05A: F3 0F 10 05 06 14 C7 01 - movss xmm0,[Ancestors-Win64-Shipping.exe+2440468] "Ancestors-Win64-Shipping.exe"+7CF062: EB 27 - jmp Ancestors-Win64-Shipping.exe+7CF08B "Ancestors-Win64-Shipping.exe"+7CF064: 48 8B CE - mov rcx,rsi "Ancestors-Win64-Shipping.exe"+7CF067: E8 E4 FB 00 00 - call Ancestors-Win64-Shipping.exe+7DEC50 // ---------- GetBranchFillingING HERE ---------- "Ancestors-Win64-Shipping.exe"+7CF06C: 66 0F 6E 88 20 01 00 00 - movd xmm1,[rax+00000120] // ---------- DONE GetBranchFillingING ---------- "Ancestors-Win64-Shipping.exe"+7CF074: F3 0F 10 80 1C 01 00 00 - movss xmm0,[rax+0000011C] "Ancestors-Win64-Shipping.exe"+7CF07C: 0F 5B C9 - cvtdq2ps xmm1,xmm1 "Ancestors-Win64-Shipping.exe"+7CF07F: F3 0F 59 88 08 01 00 00 - mulss xmm1,[rax+00000108] "Ancestors-Win64-Shipping.exe"+7CF087: F3 0F 5E C1 - divss xmm0,xmm1 "Ancestors-Win64-Shipping.exe"+7CF08B: 48 8B 5C 24 30 - mov rbx,[rsp+30] "Ancestors-Win64-Shipping.exe"+7CF090: 48 8B 6C 24 38 - mov rbp,[rsp+38] "Ancestors-Win64-Shipping.exe"+7CF095: 48 8B 74 24 48 - mov rsi,[rsp+48] "Ancestors-Win64-Shipping.exe"+7CF09A: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+7CF09E: 5F - pop rdi "Ancestors-Win64-Shipping.exe"+7CF09F: C3 - ret } 836 "ARPGMenuNode::execGetIsSelectedAsGenerationLegacy" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.ARPGMenuNode::execGetIsSelectedAsGenerationLegacy aobscanmodule(execGetIsSelectedAsGenerationLegacy,Ancestors-Win64-Shipping.exe,0F B6 81 32 03 00 00) // should be unique alloc(execGetIsSelectedAsGenerationLegacyMem,$1000,"Ancestors-Win64-Shipping.exe"+83E005) label(code) label(return) execGetIsSelectedAsGenerationLegacyMem: code: mov byte ptr [rcx+00000332],01 // SelectedAsGenerationLegacy movzx eax,byte ptr [rcx+00000332] jmp return execGetIsSelectedAsGenerationLegacy: jmp execGetIsSelectedAsGenerationLegacyMem nop 2 return: registersymbol(execGetIsSelectedAsGenerationLegacy) registersymbol(execGetIsSelectedAsGenerationLegacyMem) [DISABLE] execGetIsSelectedAsGenerationLegacy: db 0F B6 81 32 03 00 00 unregistersymbol(execGetIsSelectedAsGenerationLegacy) unregistersymbol(execGetIsSelectedAsGenerationLegacyMem) dealloc(execGetIsSelectedAsGenerationLegacyMem) 837 "ARPGMenuBranch::execGetIsSelectedAsGenerationLegacy" FF0000 Auto Assembler Script [ENABLE] // ARPGMenuBranch::execGetIsSelectedAsGenerationLegacy aobscanmodule(BranchLegacy,Ancestors-Win64-Shipping.exe,0F B6 81 37 03 00 00) // should be unique alloc(BranchLegacyMem,$1000,"Ancestors-Win64-Shipping.exe"+83DA75) label(code) label(return) BranchLegacyMem: code: mov byte ptr [rcx+00000336],01 // IsBeingFilled mov byte ptr [rcx+00000337],01 // SelectedAsGenerationLegacy movzx eax,byte ptr [rcx+00000337] jmp return BranchLegacy: jmp BranchLegacyMem nop 2 return: registersymbol(BranchLegacy) registersymbol(BranchLegacyMem) [DISABLE] BranchLegacy: db 0F B6 81 37 03 00 00 unregistersymbol(BranchLegacy) unregistersymbol(BranchLegacyMem) dealloc(BranchLegacyMem) { // ORIGINAL CODE - BranchLegacyION POINT: "Ancestors-Win64-Shipping.exe"+83DA75 "Ancestors-Win64-Shipping.exe"+83DA51: 4C 89 4A 20 - mov [rdx+20],r9 "Ancestors-Win64-Shipping.exe"+83DA55: 0F B6 81 36 03 00 00 - movzx eax,byte ptr [rcx+00000336] "Ancestors-Win64-Shipping.exe"+83DA5C: 41 88 00 - mov [r8],al "Ancestors-Win64-Shipping.exe"+83DA5F: C3 - ret "Ancestors-Win64-Shipping.exe"+83DA60: 48 8B 42 20 - mov rax,[rdx+20] "Ancestors-Win64-Shipping.exe"+83DA64: 45 33 C9 - xor r9d,r9d "Ancestors-Win64-Shipping.exe"+83DA67: 48 85 C0 - test rax,rax "Ancestors-Win64-Shipping.exe"+83DA6A: 41 0F 95 C1 - setne r9l "Ancestors-Win64-Shipping.exe"+83DA6E: 4C 03 C8 - add r9,rax "Ancestors-Win64-Shipping.exe"+83DA71: 4C 89 4A 20 - mov [rdx+20],r9 // ---------- BranchLegacyING HERE ---------- "Ancestors-Win64-Shipping.exe"+83DA75: 0F B6 81 37 03 00 00 - movzx eax,byte ptr [rcx+00000337] // ---------- DONE BranchLegacyING ---------- "Ancestors-Win64-Shipping.exe"+83DA7C: 41 88 00 - mov [r8],al "Ancestors-Win64-Shipping.exe"+83DA7F: C3 - ret "Ancestors-Win64-Shipping.exe"+83DA80: 40 53 - push rbx "Ancestors-Win64-Shipping.exe"+83DA82: 48 83 EC 20 - sub rsp,20 "Ancestors-Win64-Shipping.exe"+83DA86: 48 8B 42 20 - mov rax,[rdx+20] "Ancestors-Win64-Shipping.exe"+83DA8A: 45 33 C9 - xor r9d,r9d "Ancestors-Win64-Shipping.exe"+83DA8D: 48 85 C0 - test rax,rax "Ancestors-Win64-Shipping.exe"+83DA90: 49 8B D8 - mov rbx,r8 "Ancestors-Win64-Shipping.exe"+83DA93: 41 0F 95 C1 - setne r9l "Ancestors-Win64-Shipping.exe"+83DA97: 4C 03 C8 - add r9,rax } 830 "Max reinforcements (some glitches)" FF0000 Auto Assembler Script [ENABLE] // Ancestors-Win64-Shipping.UGCPlayerClan::GetLegacyPoints+6B aobscanmodule(GetLegacyPoints,Ancestors-Win64-Shipping.exe,8B C5 48 8B 6C 24 40 48 8B 7C 24 48) // should be unique alloc(GetLegacyPointsInjection,$1000,"Ancestors-Win64-Shipping.exe"+5B8C1B) label(code) label(return) label(iPointsDesired) GetLegacyPointsInjection: code: mov eax,[iPointsDesired] mov rbp,[rsp+40] jmp return iPointsDesired: dd #193 GetLegacyPoints: jmp GetLegacyPointsInjection nop 2 return: registersymbol(GetLegacyPoints) registersymbol(GetLegacyPointsInjection) registersymbol(iPointsDesired) [DISABLE] GetLegacyPoints: db 8B C5 48 8B 6C 24 40 unregistersymbol(GetLegacyPointsInjection) unregistersymbol(iPointsDesired) unregistersymbol(GetLegacyPoints) dealloc(GetLegacyPointsInjection) { // ORIGINAL CODE - GetLegacyPointsION POINT: "Ancestors-Win64-Shipping.exe"+5B8C1B "Ancestors-Win64-Shipping.exe"+5B8BF3: 48 8D 4E 30 - lea rcx,[rsi+30] "Ancestors-Win64-Shipping.exe"+5B8BF7: E8 64 BC FE FF - call Ancestors-Win64-Shipping.exe+5A4860 "Ancestors-Win64-Shipping.exe"+5B8BFC: 41 0F AF 86 6C 04 00 00 - imul eax,[r14+0000046C] "Ancestors-Win64-Shipping.exe"+5B8C04: FF C5 - inc ebp "Ancestors-Win64-Shipping.exe"+5B8C06: 03 E8 - add ebp,eax "Ancestors-Win64-Shipping.exe"+5B8C08: 48 83 C3 18 - add rbx,18 "Ancestors-Win64-Shipping.exe"+5B8C0C: 48 3B DF - cmp rbx,rdi "Ancestors-Win64-Shipping.exe"+5B8C0F: 75 D1 - jne Ancestors-Win64-Shipping.exe+5B8BE2 "Ancestors-Win64-Shipping.exe"+5B8C11: 48 8B 74 24 30 - mov rsi,[rsp+30] "Ancestors-Win64-Shipping.exe"+5B8C16: 48 8B 5C 24 38 - mov rbx,[rsp+38] // ---------- GetLegacyPointsING HERE ---------- "Ancestors-Win64-Shipping.exe"+5B8C1B: 8B C5 - mov eax,ebp "Ancestors-Win64-Shipping.exe"+5B8C1D: 48 8B 6C 24 40 - mov rbp,[rsp+40] // ---------- DONE GetLegacyPointsING ---------- "Ancestors-Win64-Shipping.exe"+5B8C22: 48 8B 7C 24 48 - mov rdi,[rsp+48] "Ancestors-Win64-Shipping.exe"+5B8C27: 48 83 C4 20 - add rsp,20 "Ancestors-Win64-Shipping.exe"+5B8C2B: 41 5E - pop r14 "Ancestors-Win64-Shipping.exe"+5B8C2D: C3 - ret "Ancestors-Win64-Shipping.exe"+5B8C2E: CC - int 3 "Ancestors-Win64-Shipping.exe"+5B8C2F: CC - int 3 "Ancestors-Win64-Shipping.exe"+5B8C30: 40 53 - push rbx "Ancestors-Win64-Shipping.exe"+5B8C32: 48 83 EC 40 - sub rsp,40 "Ancestors-Win64-Shipping.exe"+5B8C36: 0F 57 C0 - xorps xmm0,xmm0 "Ancestors-Win64-Shipping.exe"+5B8C39: 48 C7 44 24 30 00 00 00 00 - mov qword ptr [rsp+30],00000000 } 844 "VITALITY" 808080 1 18 "Vitality Internal" FF0000 Auto Assembler Script [ENABLE] aobscanmodule(pUCDSVitalityCode,Ancestors-Win64-Shipping.exe,F3 0F 58 89 A4 00 00 00 0F) // should be unique alloc(pUCDSVitalityInjection,$1000,pUCDSVitalityCode) label(return) label(pVitality) pUCDSVitalityInjection: mov [pVitality],rcx addss xmm1,[rcx+000000A4] jmp return pVitality: dq 0 pUCDSVitalityCode: jmp pUCDSVitalityInjection nop 3 return: registersymbol(pUCDSVitalityCode) registersymbol(pUCDSVitalityInjection) registersymbol(pVitality) [DISABLE] pUCDSVitalityCode: db F3 0F 58 89 A4 00 00 00 unregistersymbol(pVitality) unregistersymbol(pUCDSVitalityInjection) dealloc(pUCDSVitalityInjection) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+4A0F38 "Ancestors-Win64-Shipping.exe"+4A0F0D: 48 8B D9 - mov rbx,rcx "Ancestors-Win64-Shipping.exe"+4A0F10: 44 0F 29 44 24 30 - movaps [rsp+30],xmm8 "Ancestors-Win64-Shipping.exe"+4A0F16: 44 0F 28 C1 - movaps xmm8,xmm1 "Ancestors-Win64-Shipping.exe"+4A0F1A: 0F 84 C7 00 00 00 - je Ancestors-Win64-Shipping.exe+4A0FE7 "Ancestors-Win64-Shipping.exe"+4A0F20: F3 0F 59 49 68 - mulss xmm1,[rcx+68] "Ancestors-Win64-Shipping.exe"+4A0F25: 41 B1 01 - mov r9l,01 "Ancestors-Win64-Shipping.exe"+4A0F28: 41 B0 02 - mov r8l,02 "Ancestors-Win64-Shipping.exe"+4A0F2B: 0F 29 74 24 50 - movaps [rsp+50],xmm6 "Ancestors-Win64-Shipping.exe"+4A0F30: 0F 57 F6 - xorps xmm6,xmm6 "Ancestors-Win64-Shipping.exe"+4A0F33: 0F 29 7C 24 40 - movaps [rsp+40],xmm7 // ---------- INJECTING HERE ---------- "Ancestors-Win64-Shipping.exe"+4A0F38: F3 0F 58 89 A4 00 00 00 - addss xmm1,[rcx+000000A4] // ---------- DONE INJECTING ---------- "Ancestors-Win64-Shipping.exe"+4A0F40: 0F 28 F9 - movaps xmm7,xmm1 "Ancestors-Win64-Shipping.exe"+4A0F43: F3 0F 5D FE - minss xmm7,xmm6 "Ancestors-Win64-Shipping.exe"+4A0F47: E8 A4 F9 FF FF - call Ancestors-Win64-Shipping.exe+4A08F0 "Ancestors-Win64-Shipping.exe"+4A0F4C: 0F 2F FE - comiss xmm7,xmm6 "Ancestors-Win64-Shipping.exe"+4A0F4F: 0F 28 74 24 50 - movaps xmm6,[rsp+50] "Ancestors-Win64-Shipping.exe"+4A0F54: 73 23 - jae Ancestors-Win64-Shipping.exe+4A0F79 "Ancestors-Win64-Shipping.exe"+4A0F56: F3 0F 59 7B 64 - mulss xmm7,[rbx+64] "Ancestors-Win64-Shipping.exe"+4A0F5B: 45 33 C9 - xor r9d,r9d "Ancestors-Win64-Shipping.exe"+4A0F5E: 41 B0 01 - mov r8l,01 "Ancestors-Win64-Shipping.exe"+4A0F61: C6 44 24 20 02 - mov byte ptr [rsp+20],02 } 19 "[Vitality]" 1 000080 8 Bytes

[pVitality]

36 "Life Expectancy" Float

+AC

35 "Stamina" Float

+A8

34 "Energy" Float

+A4

7 "Vitality Display" FF0000 Auto Assembler Script [ENABLE] aobscanmodule(pUHECharacterStateCode,Ancestors-Win64-Shipping.exe,F3 0F 5C B1 24 08 00 00) // should be unique alloc(pUHECharacterStateInjection,$1000,"Ancestors-Win64-Shipping.exe"+77CAA5) label(return) label(pChar) pUHECharacterStateInjection: mov [pChar],rcx subss xmm6,[rcx+00000824] jmp return pChar: dq 0 pUHECharacterStateCode: jmp pUHECharacterStateInjection nop 3 return: registersymbol(pUHECharacterStateCode) registersymbol(pUHECharacterStateInjection) registersymbol(pChar) [DISABLE] pUHECharacterStateCode: db F3 0F 5C B1 24 08 00 00 unregistersymbol(pUHECharacterStateCode) unregistersymbol(pUHECharacterStateInjection) unregistersymbol(pChar) dealloc(pUHECharacterStateInjection) { // ORIGINAL CODE - INJECTION POINT: "Ancestors-Win64-Shipping.exe"+77CAA5 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle - 40 53 - push rbx Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+2- 48 83 EC 40 - sub rsp,40 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+6- 48 8B 81 00080000 - mov rax,[rcx+00000800] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+D- 48 8B D9 - mov rbx,rcx Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+10- 0F29 74 24 30 - movaps [rsp+30],xmm6 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+15- 0F29 7C 24 20 - movaps [rsp+20],xmm7 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+1A- 0F28 F9 - movaps xmm7,xmm1 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+1D- F3 0F10 B0 F0020000 - movss xmm6,[rax+000002F0] // ---------- INJECTING HERE ---------- Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+25- F3 0F5C B1 24080000 - subss xmm6,[rcx+00000824] // ---------- DONE INJECTING ---------- Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+2D- 0F28 CE - movaps xmm1,xmm6 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+30- 0F54 0D 993BCC01 - andps xmm1,[Ancestors-Win64-Shipping.exe+2440650] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+37- 0F2F 0D 3287CC01 - comiss xmm1,[Ancestors-Win64-Shipping.exe+24451F0] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+3E- 76 69 - jna Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+A9 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+40- 48 8B 89 D8070000 - mov rcx,[rcx+000007D8] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+47- F3 0F10 05 59C1D201 - movss xmm0,[Ancestors-Win64-Shipping.exe+24A8C28] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+4F- 48 85 C9 - test rcx,rcx Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+52- 74 05 - je Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+59 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+54- E8 97BAE200 - call Ancestors-Win64-Shipping.UCurveFloat::GetFloatValue Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+59- 48 8B 8B 00080000 - mov rcx,[rbx+00000800] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+60- 0F57 C9 - xorps xmm1,xmm1 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+63- 0F2F F1 - comiss xmm6,xmm1 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+66- F3 0F10 91 F0020000 - movss xmm2,[rcx+000002F0] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+6E- F3 0F59 C7 - mulss xmm0,xmm7 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+72- 76 16 - jna Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+8A Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+74- F3 0F5C D0 - subss xmm2,xmm0 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+78- F3 0F10 83 24080000 - movss xmm0,[rbx+00000824] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+80- 0F2F D0 - comiss xmm2,xmm0 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+83- 73 1C - jae Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+A1 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+85- 0F28 D0 - movaps xmm2,xmm0 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+88- EB 17 - jmp Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+A1 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+8A- F3 0F10 8B 24080000 - movss xmm1,[rbx+00000824] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+92- F3 0F58 C2 - addss xmm0,xmm2 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+96- 0F2F C8 - comiss xmm1,xmm0 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+99- 0F28 D0 - movaps xmm2,xmm0 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+9C- 73 03 - jae Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+A1 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+9E- 0F28 D1 - movaps xmm2,xmm1 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+A1- 0F28 CA - movaps xmm1,xmm2 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+A4- E8 A7A8FCFF - call Ancestors-Win64-Shipping.SCharacterStateWidget::SetHealthScale Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+A9- 0F28 74 24 30 - movaps xmm6,[rsp+30] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+AE- 0F28 7C 24 20 - movaps xmm7,[rsp+20] Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+B3- 48 83 C4 40 - add rsp,40 Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+B7- 5B - pop rbx Ancestors-Win64-Shipping.UHECharacterState::UpdateHealthCircle+B8- C3 - ret } 8 "[Vitality Display]" 1 000080 8 Bytes

[pChar]

9 "Life Expectancy" Float

+824

10 "Stamina" Float

+828

11 "Energy" Float

+82C

# Info about this table - Game Process: Ancestors-Win64-Shipping.exe - Game Version: see history below, tested with x64 steam edition - CE Version: 7.1 - Author: mece - Сredits: fearless123456, Agasio, draw95, serahah # Features Protection Switching between clan members activates the protection and disables corresponding ailment. 1. Apply bleeding protection 2. Infinite bleeding protection 3. Apply injury protection 4. Infinite injury protection 5. Apply camouflage protection 6. Infinite camouflage protection 7. Apply infinite fear protection 8. Apply cold and heat protection 9. Infinite heat protection 10. Infinite cold protection 11. Apply venom poisoning protection 12. Apply omnivorous poisoning protection 13. Apply alimentary poisoning protection 14. Infinite poisoning protection Vitality 1. Max health - determinates life expectancy 2. Max energy - characters do not get tired of e.g. from climbing 3. No hunger, thirst, fatique - takes effect after some ingame actions 4. Max dopamine - fills up dopamine pool every time it changes 5. Instant recovery from injury - make a step to heal the ailment 6. Instant recovery from poison - make a step to heal the ailment Evolution 1. Enables item altering on the first successfull try 2. Grow neuronal connections faster 3. Max Neuron Energy - fills up energy pool in the Evolution Menu 4. Instant identifying - removes ~1 second delay while identifying points of interest 5. Increase visibility range for points of interest # Table version history - 2020-09-16: addded support for 1.4.1