0
"Compact mode"
Auto Assembler Script
[ENABLE]
--https://forum.cheatengine.org/viewtopic.php?t=570055
LuaCall(function cycleFullCompact(sender,force) local state = not(compactmenuitem.Caption == 'Compact View Mode'); if force~=nil then state = not force end; compactmenuitem.Caption = state and 'Compact View Mode' or 'Full View Mode'; getMainForm().Splitter1.Visible = state; getMainForm().Panel4.Visible = state; getMainForm().Panel5.Visible = state; end; function addCompactMenu() if compactmenualreadyexists then return end; local parent = getMainForm().Menu.Items; compactmenuitem = createMenuItem(parent); parent.add(compactmenuitem); compactmenuitem.Caption = 'Compact View Mode'; compactmenuitem.OnClick = cycleFullCompact; compactmenualreadyexists = 'yes'; end; addCompactMenu(); cycleFullCompact(nil,true))
[DISABLE]
LuaCall(cycleFullCompact(nil,false))
150
"Toggle scripts"
4080FF
Auto Assembler Script
[ENABLE]
{$lua}
if (syntaxcheck) then return end
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
local enableBattleScripts = {
0, -- "Compact mode"
105, -- "Get credits & level"
109, -- "inf. sub weapon"
110, -- "inf. thruster"
111, -- "inf. main weapon EN"
112, -- "inf. consumable usage in slots"
113, -- "inf material when crafting"
116, -- "Get focused attribute value (Firepower/utility/resistance...)"
120, -- "Get Mainframe Expansions"
}
local addressList = getAddressList()
for _, id in ipairs(enableBattleScripts) do
addressList.getMemoryRecordByID(id).Active = true
end
getLuaEngine().Close()
[DISABLE]
{$lua}
if (syntaxcheck) then return end
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
local disableBattleScripts = {
84, -- "11~"
63, -- "1~10"
33, -- "11~"
12, -- "1~10"
61, -- "Attributes+"
143, -- "init. 2"
10, -- "Attributes+"
137, -- "UE5 init."
127, -- "Set some attributes (range, shield capacitry..)"
124, -- "Get renown"
136, -- "_debug"
123, -- "_not working"
120, -- "Get Mainframe Expansions"
116, -- "Get focused attribute value (Firepower/utility/resistance...)"
114, -- "browse item & set some attributes"
113, -- "inf material when crafting"
112, -- "inf. consumable usage in slots"
111, -- "inf. main weapon EN"
110, -- "inf. thruster"
109, -- "inf. sub weapon"
105, -- "Get credits & level"
1, -- "Get last 2 items level & count"
0, -- "Compact mode"
}
local addressList = getAddressList()
for _, id in ipairs(disableBattleScripts) do
addressList.getMemoryRecordByID(id).Active = false
end
getLuaEngine().Close()
1
"Get last 2 items level & count"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_ITEM_RAL,$process,41 80 7D 60 05 4C) // should be unique
alloc(newmem,$1000,INJECT_GET_ITEM_RAL)
label(code)
label(return i_base_item_r_addr i_base_item_r_addr2)
newmem:
pushfq
cmp dword ptr [i_idx], 0
je set1
cmp dword ptr [i_idx], 1
je set2
set1:
mov [i_base_item_r_addr], r13
mov dword ptr [i_idx], 1
jmp code_pre
set2:
mov [i_base_item_r_addr2], r13
mov dword ptr [i_idx], 0
jmp code_pre
code_pre:
popfq
code:
cmp byte ptr [r13+60],05
jmp return
align 10 cc
i_base_item_r_addr:
dq 0
i_base_item_r_addr2:
dq 0
i_idx:
dd 0
INJECT_GET_ITEM_RAL:
jmp newmem
return:
registersymbol(INJECT_GET_ITEM_RAL i_base_item_r_addr i_base_item_r_addr2)
[DISABLE]
INJECT_GET_ITEM_RAL:
db 41 80 7D 60 05
unregistersymbol(INJECT_GET_ITEM_RAL i_base_item_r_addr i_base_item_r_addr2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4BA8CB4
ES2-Win64-Shipping.exe+4BA8C91: 3B 43 0C - cmp eax,[rbx+0C]
ES2-Win64-Shipping.exe+4BA8C94: 76 0A - jna ES2-Win64-Shipping.exe+4BA8CA0
ES2-Win64-Shipping.exe+4BA8C96: 8B D5 - mov edx,ebp
ES2-Win64-Shipping.exe+4BA8C98: 48 8B CB - mov rcx,rbx
ES2-Win64-Shipping.exe+4BA8C9B: E8 E0 7C 5A FC - call ES2-Win64-Shipping.ffxFsr3UpscalerResourceIsNull+CDB0
ES2-Win64-Shipping.exe+4BA8CA0: 48 8B 03 - mov rax,[rbx]
ES2-Win64-Shipping.exe+4BA8CA3: 49 83 C7 08 - add r15,08
ES2-Win64-Shipping.exe+4BA8CA7: 48 89 3C E8 - mov [rax+rbp*8],rdi
ES2-Win64-Shipping.exe+4BA8CAB: 4D 3B FC - cmp r15,r12
ES2-Win64-Shipping.exe+4BA8CAE: 0F 85 3C FF FF FF - jne ES2-Win64-Shipping.exe+4BA8BF0
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4BA8CB4: 41 80 7D 60 05 - cmp byte ptr [r13+60],05
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4BA8CB9: 4C 8B 7C 24 50 - mov r15,[rsp+50]
ES2-Win64-Shipping.exe+4BA8CBE: 4C 8B A4 24 98 00 00 00 - mov r12,[rsp+00000098]
ES2-Win64-Shipping.exe+4BA8CC6: 48 8B AC 24 88 00 00 00 - mov rbp,[rsp+00000088]
ES2-Win64-Shipping.exe+4BA8CCE: 0F 85 AB 00 00 00 - jne ES2-Win64-Shipping.exe+4BA8D7F
ES2-Win64-Shipping.exe+4BA8CD4: 49 8B CD - mov rcx,r13
ES2-Win64-Shipping.exe+4BA8CD7: E8 44 E4 00 00 - call ES2-Win64-Shipping.exe+4BB7120
ES2-Win64-Shipping.exe+4BA8CDC: 84 C0 - test al,al
ES2-Win64-Shipping.exe+4BA8CDE: 0F 84 9B 00 00 00 - je ES2-Win64-Shipping.exe+4BA8D7F
ES2-Win64-Shipping.exe+4BA8CE4: E8 67 0B 0A 00 - call ES2-Win64-Shipping.exe+4C49850
ES2-Win64-Shipping.exe+4BA8CE9: 41 B0 01 - mov r8b,01
}
2
"#A"
1
3
"base"
1
0
808080
8 Bytes
i_base_item_r_addr
4
"item level"
0
FF8080
4 Bytes
i_base_item_r_addr
58
5
"??"
0
FF8080
Float
i_base_item_r_addr
5C
6
"item rarity"
0
FF8080
Byte
i_base_item_r_addr
60
7
"Grade"
0
FF8080
Byte
i_base_item_r_addr
198
8
"Amount"
0
FF8080
Byte
i_base_item_r_addr
19C
9
"Ammo"
0
FF8080
Byte
i_base_item_r_addr
1A0
10
"Attributes+"
1
11
"# of attributes"
0
808080
4 Bytes
i_base_item_r_addr
70
12
"1~10"
1
13
"ID #1"
0
FF8080
4 Bytes
i_base_item_r_addr
68
0
68
14
"Value #1"
0
FF8080
Float
i_base_item_r_addr
70
0
68
15
"ID #2"
0
FF8080
4 Bytes
i_base_item_r_addr
68
8
68
16
"Value #2"
0
FF8080
Float
i_base_item_r_addr
70
8
68
17
"ID #3"
0
FF8080
4 Bytes
i_base_item_r_addr
68
10
68
18
"Value #3"
0
FF8080
Float
i_base_item_r_addr
70
10
68
19
"ID #4"
0
FF8080
4 Bytes
i_base_item_r_addr
68
18
68
20
"Value #4"
0
FF8080
Float
i_base_item_r_addr
70
18
68
21
"ID #5"
0
FF8080
4 Bytes
i_base_item_r_addr
68
20
68
22
"Value #5"
0
FF8080
Float
i_base_item_r_addr
70
20
68
23
"ID #6"
0
FF8080
4 Bytes
i_base_item_r_addr
68
28
68
24
"Value #6"
0
FF8080
Float
i_base_item_r_addr
70
28
68
25
"ID #7"
0
FF8080
4 Bytes
i_base_item_r_addr
68
30
68
26
"Value #7"
0
FF8080
Float
i_base_item_r_addr
70
30
68
27
"ID #8"
0
FF8080
4 Bytes
i_base_item_r_addr
68
38
68
28
"Value #8"
0
FF8080
Float
i_base_item_r_addr
70
38
68
29
"ID #9"
0
FF8080
4 Bytes
i_base_item_r_addr
68
40
68
30
"Value #9"
0
FF8080
Float
i_base_item_r_addr
70
40
68
31
"ID #10"
0
FF8080
4 Bytes
i_base_item_r_addr
68
48
68
32
"Value #10"
0
FF8080
Float
i_base_item_r_addr
70
48
68
33
"11~"
1
34
"ID #11"
0
FF8080
4 Bytes
i_base_item_r_addr
68
50
68
35
"Value #11"
0
FF8080
Float
i_base_item_r_addr
70
50
68
36
"ID #12"
0
FF8080
4 Bytes
i_base_item_r_addr
68
58
68
37
"Value #12"
0
FF8080
Float
i_base_item_r_addr
70
58
68
38
"ID #13"
0
FF8080
4 Bytes
i_base_item_r_addr
68
60
68
39
"Value #13"
0
FF8080
Float
i_base_item_r_addr
70
60
68
40
"ID #14"
0
FF8080
4 Bytes
i_base_item_r_addr
68
68
68
41
"Value #14"
0
FF8080
Float
i_base_item_r_addr
70
68
68
42
"ID #15"
0
FF8080
4 Bytes
i_base_item_r_addr
68
70
68
43
"Value #15"
0
FF8080
Float
i_base_item_r_addr
70
70
68
44
"ID #16"
0
FF8080
4 Bytes
i_base_item_r_addr
68
78
68
45
"Value #16"
0
FF8080
Float
i_base_item_r_addr
70
78
68
46
"ID #17"
0
FF8080
4 Bytes
i_base_item_r_addr
68
80
68
47
"Value #17"
0
FF8080
Float
i_base_item_r_addr
70
80
68
48
"ID #18"
0
FF8080
4 Bytes
i_base_item_r_addr
68
88
68
49
"Value #18"
0
FF8080
Float
i_base_item_r_addr
70
88
68
50
"ID #19"
0
FF8080
4 Bytes
i_base_item_r_addr
68
90
68
51
"Value #19"
0
FF8080
Float
i_base_item_r_addr
70
90
68
52
"ID #20"
0
FF8080
4 Bytes
i_base_item_r_addr
68
98
68
53
"Value #20"
0
FF8080
Float
i_base_item_r_addr
70
98
68
54
"#B"
1
55
"item level #2"
0
FF8080
4 Bytes
i_base_item_r_addr2
58
56
"??"
0
FF8080
Float
i_base_item_r_addr2
5C
57
"item rarity #2"
0
FF8080
Byte
i_base_item_r_addr2
60
58
"Grade"
0
FF8080
Byte
i_base_item_r_addr2
198
59
"Amount #2"
0
FF8080
Byte
i_base_item_r_addr2
19C
60
"Ammo #2"
0
FF8080
Byte
i_base_item_r_addr2
1A0
61
"Attributes+"
1
62
"# of attributes"
0
808080
4 Bytes
i_base_item_r_addr2
70
63
"1~10"
1
64
"ID #1"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
0
68
65
"Value #1"
0
FF8080
Float
i_base_item_r_addr2
70
0
68
66
"ID #2"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
8
68
67
"Value #2"
0
FF8080
Float
i_base_item_r_addr2
70
8
68
68
"ID #3"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
10
68
69
"Value #3"
0
FF8080
Float
i_base_item_r_addr2
70
10
68
70
"ID #4"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
18
68
71
"Value #4"
0
FF8080
Float
i_base_item_r_addr2
70
18
68
72
"ID #5"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
20
68
73
"Value #5"
0
FF8080
Float
i_base_item_r_addr2
70
20
68
74
"ID #6"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
28
68
75
"Value #6"
0
FF8080
Float
i_base_item_r_addr2
70
28
68
76
"ID #7"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
30
68
77
"Value #7"
0
FF8080
Float
i_base_item_r_addr2
70
30
68
78
"ID #8"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
38
68
79
"Value #8"
0
FF8080
Float
i_base_item_r_addr2
70
38
68
80
"ID #9"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
40
68
81
"Value #9"
0
FF8080
Float
i_base_item_r_addr2
70
40
68
82
"ID #10"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
48
68
83
"Value #10"
0
FF8080
Float
i_base_item_r_addr2
70
48
68
84
"11~"
1
85
"ID #11"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
50
68
86
"Value #11"
0
FF8080
Float
i_base_item_r_addr2
70
50
68
87
"ID #12"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
58
68
88
"Value #12"
0
FF8080
Float
i_base_item_r_addr2
70
58
68
89
"ID #13"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
60
68
90
"Value #13"
0
FF8080
Float
i_base_item_r_addr2
70
60
68
91
"ID #14"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
68
68
92
"Value #14"
0
FF8080
Float
i_base_item_r_addr
70
68
68
93
"ID #15"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
70
68
94
"Value #15"
0
FF8080
Float
i_base_item_r_addr2
70
70
68
95
"ID #16"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
78
68
96
"Value #16"
0
FF8080
Float
i_base_item_r_addr2
70
78
68
97
"ID #17"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
80
68
98
"Value #17"
0
FF8080
Float
i_base_item_r_addr2
70
80
68
99
"ID #18"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
88
68
100
"Value #18"
0
FF8080
Float
i_base_item_r_addr2
70
88
68
101
"ID #19"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
90
68
102
"Value #19"
0
FF8080
Float
i_base_item_r_addr2
70
90
68
103
"ID #20"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
98
68
104
"Value #20"
0
FF8080
Float
i_base_item_r_addr2
70
98
68
105
"Get credits & level"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_CREDITS,$process,39 8A 20 01 00 00 0F 9D C0 C3) // should be unique
alloc(newmem,$1000,INJECT_GET_CREDITS)
label(code)
label(return i_base_money_addr)
newmem:
mov [i_base_money_addr], rdx
code:
cmp [rdx+00000120],ecx
jmp return
align 10 cc
i_base_money_addr:
dq 0
INJECT_GET_CREDITS:
jmp newmem
nop
return:
registersymbol(INJECT_GET_CREDITS i_base_money_addr)
[DISABLE]
INJECT_GET_CREDITS:
db 39 8A 20 01 00 00
unregistersymbol(INJECT_GET_CREDITS i_base_money_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4A99108
ES2-Win64-Shipping.exe+4A990EC: CC - int 3
ES2-Win64-Shipping.exe+4A990ED: CC - int 3
ES2-Win64-Shipping.exe+4A990EE: CC - int 3
ES2-Win64-Shipping.exe+4A990EF: CC - int 3
ES2-Win64-Shipping.exe+4A990F0: 48 8B 05 81 6F A9 04 - mov rax,[ES2-Win64-Shipping.exe+9530078]
ES2-Win64-Shipping.exe+4A990F7: 48 85 C0 - test rax,rax
ES2-Win64-Shipping.exe+4A990FA: 74 16 - je ES2-Win64-Shipping.exe+4A99112
ES2-Win64-Shipping.exe+4A990FC: 48 8B 90 C0 01 00 00 - mov rdx,[rax+000001C0]
ES2-Win64-Shipping.exe+4A99103: 48 85 D2 - test rdx,rdx
ES2-Win64-Shipping.exe+4A99106: 74 0A - je ES2-Win64-Shipping.exe+4A99112
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4A99108: 39 8A 20 01 00 00 - cmp [rdx+00000120],ecx
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4A9910E: 0F 9D C0 - setge al
ES2-Win64-Shipping.exe+4A99111: C3 - ret
ES2-Win64-Shipping.exe+4A99112: 32 C0 - xor al,al
ES2-Win64-Shipping.exe+4A99114: C3 - ret
ES2-Win64-Shipping.exe+4A99115: CC - int 3
ES2-Win64-Shipping.exe+4A99116: CC - int 3
ES2-Win64-Shipping.exe+4A99117: CC - int 3
ES2-Win64-Shipping.exe+4A99118: CC - int 3
ES2-Win64-Shipping.exe+4A99119: CC - int 3
ES2-Win64-Shipping.exe+4A9911A: CC - int 3
}
106
"Money"
0
FF8080
4 Bytes
i_base_money_addr
120
107
"Level"
0
FF8080
4 Bytes
i_base_money_addr
124
108
"Exp"
0
FF8080
Float
i_base_money_addr
128
109
"inf. sub weapon"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_SUBWEAPON,$process,FF C8 48 8B D7) // should be unique
INJECT_INF_SUBWEAPON:
db 90 90
registersymbol(INJECT_INF_SUBWEAPON)
[DISABLE]
INJECT_INF_SUBWEAPON:
db FF C8
unregistersymbol(INJECT_INF_SUBWEAPON)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+499B4C3
ES2-Win64-Shipping.exe+499B49C: 48 3B DA - cmp rbx,rdx
ES2-Win64-Shipping.exe+499B49F: 75 EF - jne ES2-Win64-Shipping.exe+499B490
ES2-Win64-Shipping.exe+499B4A1: E9 E2 01 00 00 - jmp ES2-Win64-Shipping.exe+499B688
ES2-Win64-Shipping.exe+499B4A6: 45 84 C0 - test r8b,r8b
ES2-Win64-Shipping.exe+499B4A9: 0F 84 D9 01 00 00 - je ES2-Win64-Shipping.exe+499B688
ES2-Win64-Shipping.exe+499B4AF: 83 7B 38 00 - cmp dword ptr [rbx+38],00
ES2-Win64-Shipping.exe+499B4B3: 0F 8E CF 01 00 00 - jng ES2-Win64-Shipping.exe+499B688
ES2-Win64-Shipping.exe+499B4B9: 8B 81 A0 01 00 00 - mov eax,[rcx+000001A0]
ES2-Win64-Shipping.exe+499B4BF: 85 C0 - test eax,eax
ES2-Win64-Shipping.exe+499B4C1: 7E 32 - jle ES2-Win64-Shipping.exe+499B4F5
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+499B4C3: FF C8 - dec eax
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+499B4C5: 48 8B D7 - mov rdx,rdi
ES2-Win64-Shipping.exe+499B4C8: 89 81 A0 01 00 00 - mov [rcx+000001A0],eax
ES2-Win64-Shipping.exe+499B4CE: 48 8D 8E 88 06 00 00 - lea rcx,[rsi+00000688]
ES2-Win64-Shipping.exe+499B4D5: E8 56 3D A3 FE - call ES2-Win64-Shipping.exe+33CF230
ES2-Win64-Shipping.exe+499B4DA: 48 8B 03 - mov rax,[rbx]
ES2-Win64-Shipping.exe+499B4DD: 83 B8 A0 01 00 00 00 - cmp dword ptr [rax+000001A0],00
ES2-Win64-Shipping.exe+499B4E4: 75 0F - jne ES2-Win64-Shipping.exe+499B4F5
ES2-Win64-Shipping.exe+499B4E6: 48 8D 8E A8 06 00 00 - lea rcx,[rsi+000006A8]
ES2-Win64-Shipping.exe+499B4ED: 48 8B D7 - mov rdx,rdi
ES2-Win64-Shipping.exe+499B4F0: E8 3B 3D A3 FE - call ES2-Win64-Shipping.exe+33CF230
}
110
"inf. thruster"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_THRUSTER,$process,F3 0F 5C C1 F3 41 0F 5F C5) // should be unique
alloc(newmem,$1000,INJECT_INF_THRUSTER)
label(code)
label(return)
newmem:
xorps xmm1, xmm1
code:
subss xmm0,xmm1
maxss xmm0,xmm13
jmp return
INJECT_INF_THRUSTER:
jmp newmem
nop 4
return:
registersymbol(INJECT_INF_THRUSTER)
[DISABLE]
INJECT_INF_THRUSTER:
db F3 0F 5C C1 F3 41 0F 5F C5
unregistersymbol(INJECT_INF_THRUSTER)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+49B5CF3
ES2-Win64-Shipping.exe+49B5CBE: 44 38 B3 A4 00 00 00 - cmp [rbx+000000A4],r14b
ES2-Win64-Shipping.exe+49B5CC5: 75 0E - jne ES2-Win64-Shipping.exe+49B5CD5
ES2-Win64-Shipping.exe+49B5CC7: F3 0F 10 83 A8 00 00 00 - movss xmm0,[rbx+000000A8]
ES2-Win64-Shipping.exe+49B5CCF: 0F 2E 43 70 - ucomiss xmm0,[rbx+70]
ES2-Win64-Shipping.exe+49B5CD3: 74 09 - je ES2-Win64-Shipping.exe+49B5CDE
ES2-Win64-Shipping.exe+49B5CD5: 48 8D 4B 70 - lea rcx,[rbx+70]
ES2-Win64-Shipping.exe+49B5CD9: E8 22 F8 04 00 - call ES2-Win64-Shipping.exe+4A05500
ES2-Win64-Shipping.exe+49B5CDE: F3 0F 10 8B A0 00 00 00 - movss xmm1,[rbx+000000A0]
ES2-Win64-Shipping.exe+49B5CE6: F3 0F 10 87 90 0A 00 00 - movss xmm0,[rdi+00000A90]
ES2-Win64-Shipping.exe+49B5CEE: F3 41 0F 59 CC - mulss xmm1,xmm12
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+49B5CF3: F3 0F 5C C1 - subss xmm0,xmm1
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+49B5CF7: F3 41 0F 5F C5 - maxss xmm0,xmm13
ES2-Win64-Shipping.exe+49B5CFC: 48 8B CF - mov rcx,rdi
ES2-Win64-Shipping.exe+49B5CFF: F3 0F 11 87 90 0A 00 00 - movss [rdi+00000A90],xmm0
ES2-Win64-Shipping.exe+49B5D07: E8 14 8A FE FF - call ES2-Win64-Shipping.exe+499E720
ES2-Win64-Shipping.exe+49B5D0C: 48 8D 8F 70 09 00 00 - lea rcx,[rdi+00000970]
ES2-Win64-Shipping.exe+49B5D13: 41 0F 28 D4 - movaps xmm2,xmm12
ES2-Win64-Shipping.exe+49B5D17: 0F 28 C8 - movaps xmm1,xmm0
ES2-Win64-Shipping.exe+49B5D1A: E8 B1 76 F6 FF - call ES2-Win64-Shipping.exe+491D3D0
ES2-Win64-Shipping.exe+49B5D1F: 44 0F 2F AF 90 0A 00 00 - comiss xmm13,[rdi+00000A90]
ES2-Win64-Shipping.exe+49B5D27: 0F 82 61 01 00 00 - jb ES2-Win64-Shipping.exe+49B5E8E
}
111
"inf. main weapon EN"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_EN_WEAPON,$process,0F 28 CE 0F 28 FE F3) // should be unique
alloc(newmem,$1000,INJECT_INF_EN_WEAPON)
label(code)
label(return)
newmem:
pushfq
vxorps xmm15, xmm15, xmm15
vucomiss xmm6, xmm15
ja @F
vmovss xmm6, [vf_1]
@@:
popfq
code:
movaps xmm1,xmm6
movaps xmm7,xmm6
jmp return
align 10 cc
vf_1:
dd (float)1
INJECT_INF_EN_WEAPON:
jmp newmem
nop
return:
registersymbol(INJECT_INF_EN_WEAPON)
[DISABLE]
INJECT_INF_EN_WEAPON:
db 0F 28 CE 0F 28 FE
unregistersymbol(INJECT_INF_EN_WEAPON)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+49C4AC8
ES2-Win64-Shipping.exe+49C4AA3: 74 13 - je ES2-Win64-Shipping.exe+49C4AB8
ES2-Win64-Shipping.exe+49C4AA5: 0F 28 CE - movaps xmm1,xmm6
ES2-Win64-Shipping.exe+49C4AA8: 48 8B C8 - mov rcx,rax
ES2-Win64-Shipping.exe+49C4AAB: E8 C0 5C FD FF - call ES2-Win64-Shipping.exe+499A770
ES2-Win64-Shipping.exe+49C4AB0: 48 8B CF - mov rcx,rdi
ES2-Win64-Shipping.exe+49C4AB3: E8 C8 FE FD FF - call ES2-Win64-Shipping.exe+49A4980
ES2-Win64-Shipping.exe+49C4AB8: 48 8B 7C 24 70 - mov rdi,[rsp+70]
ES2-Win64-Shipping.exe+49C4ABD: EB 31 - jmp ES2-Win64-Shipping.exe+49C4AF0
ES2-Win64-Shipping.exe+49C4ABF: E8 CC D6 00 00 - call ES2-Win64-Shipping.exe+49D2190
ES2-Win64-Shipping.exe+49C4AC4: 41 0F 2F F0 - comiss xmm6,xmm8
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+49C4AC8: 0F 28 CE - movaps xmm1,xmm6
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+49C4ACB: 0F 28 FE - movaps xmm7,xmm6
ES2-Win64-Shipping.exe+49C4ACE: F3 0F 58 8B E4 0B 00 00 - addss xmm1,[rbx+00000BE4]
ES2-Win64-Shipping.exe+49C4AD6: 0F 57 3D B3 D4 49 02 - xorps xmm7,[ES2-Win64-Shipping.exe+6E61F90]
ES2-Win64-Shipping.exe+49C4ADD: F3 0F 5D C8 - minss xmm1,xmm0
ES2-Win64-Shipping.exe+49C4AE1: F3 41 0F 5F C8 - maxss xmm1,xmm8
ES2-Win64-Shipping.exe+49C4AE6: F3 0F 11 8B E4 0B 00 00 - movss [rbx+00000BE4],xmm1
ES2-Win64-Shipping.exe+49C4AEE: 73 42 - jae ES2-Win64-Shipping.exe+49C4B32
ES2-Win64-Shipping.exe+49C4AF0: C7 83 EC 0B 00 00 00 00 00 00 - mov [rbx+00000BEC],00000000
ES2-Win64-Shipping.exe+49C4AFA: 0F 28 F7 - movaps xmm6,xmm7
ES2-Win64-Shipping.exe+49C4AFD: 48 8B 8B 40 01 00 00 - mov rcx,[rbx+00000140]
}
112
"inf. consumable usage in slots"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_COMSUMABLE,$process,FF 88 ?? 0? 00 00 48 8B 83) // should be unique
//label(INJECT_INF_COMSUMABLEo)
alloc(INJECT_INF_COMSUMABLEo, 6)
INJECT_INF_COMSUMABLEo:
readmem(INJECT_INF_COMSUMABLE, 6)
INJECT_INF_COMSUMABLE:
nop 6
registersymbol(INJECT_INF_COMSUMABLE)
registersymbol(INJECT_INF_COMSUMABLEo)
[DISABLE]
INJECT_INF_COMSUMABLE:
//db FF 88 9C 01 00 00
readmem(INJECT_INF_COMSUMABLEo, 6)
unregistersymbol(INJECT_INF_COMSUMABLE)
unregistersymbol(INJECT_INF_COMSUMABLEo)
dealloc(INJECT_INF_COMSUMABLEo)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+498E767
ES2-Win64-Shipping.exe+498E73E: 48 8B 15 2B 39 B9 04 - mov rdx,[ES2-Win64-Shipping.exe+9522070]
ES2-Win64-Shipping.exe+498E745: 49 8B 04 C8 - mov rax,[r8+rcx*8]
ES2-Win64-Shipping.exe+498E749: 48 39 50 28 - cmp [rax+28],rdx
ES2-Win64-Shipping.exe+498E74D: 75 10 - jne ES2-Win64-Shipping.exe+498E75F
ES2-Win64-Shipping.exe+498E74F: E8 CC 77 0F 00 - call ES2-Win64-Shipping.exe+4A85F20
ES2-Win64-Shipping.exe+498E754: 84 C0 - test al,al
ES2-Win64-Shipping.exe+498E756: 75 15 - jne ES2-Win64-Shipping.exe+498E76D
ES2-Win64-Shipping.exe+498E758: 4C 8B 83 A0 00 00 00 - mov r8,[rbx+000000A0]
ES2-Win64-Shipping.exe+498E75F: 4B 8D 0C 64 - lea rcx,[r12+r12*2]
ES2-Win64-Shipping.exe+498E763: 49 8B 04 C8 - mov rax,[r8+rcx*8]
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+498E767: FF 88 9C 01 00 00 - dec [rax+0000019C]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+498E76D: 48 8B 83 A0 00 00 00 - mov rax,[rbx+000000A0]
ES2-Win64-Shipping.exe+498E774: 4B 8D 0C 64 - lea rcx,[r12+r12*2]
ES2-Win64-Shipping.exe+498E778: 48 8B 0C C8 - mov rcx,[rax+rcx*8]
ES2-Win64-Shipping.exe+498E77C: 83 B9 9C 01 00 00 00 - cmp dword ptr [rcx+0000019C],00
ES2-Win64-Shipping.exe+498E783: 0F 8F 85 00 00 00 - jg ES2-Win64-Shipping.exe+498E80E
ES2-Win64-Shipping.exe+498E789: 48 8B BB 90 00 00 00 - mov rdi,[rbx+00000090]
ES2-Win64-Shipping.exe+498E790: 48 85 FF - test rdi,rdi
ES2-Win64-Shipping.exe+498E793: 74 3E - je ES2-Win64-Shipping.exe+498E7D3
ES2-Win64-Shipping.exe+498E795: E8 66 B6 EF FF - call ES2-Win64-Shipping.exe+4889E00
ES2-Win64-Shipping.exe+498E79A: 48 8B 4F 10 - mov rcx,[rdi+10]
}
113
"inf material when crafting"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_CRAFTING,$process,2B C8 89 8E 9C 01 00 00) // should be unique
alloc(newmem,$1000,INJECT_INF_CRAFTING)
label(code)
label(return)
newmem:
pushfq
cmp ecx, 67
jae @F
mov ecx, 67
@@:
xor eax, eax
popfq
code:
sub ecx,eax
mov [rsi+0000019C],ecx
jmp return
INJECT_INF_CRAFTING:
jmp newmem
nop 3
return:
registersymbol(INJECT_INF_CRAFTING)
[DISABLE]
INJECT_INF_CRAFTING:
db 2B C8 89 8E 9C 01 00 00
unregistersymbol(INJECT_INF_CRAFTING)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4CBB145
ES2-Win64-Shipping.exe+4CBB124: 49 8B 34 36 - mov rsi,[r14+rsi]
ES2-Win64-Shipping.exe+4CBB128: 48 85 F6 - test rsi,rsi
ES2-Win64-Shipping.exe+4CBB12B: 74 5E - je ES2-Win64-Shipping.exe+4CBB18B
ES2-Win64-Shipping.exe+4CBB12D: 48 39 7E 28 - cmp [rsi+28],rdi
ES2-Win64-Shipping.exe+4CBB131: 75 58 - jne ES2-Win64-Shipping.exe+4CBB18B
ES2-Win64-Shipping.exe+4CBB133: 8B 8E 9C 01 00 00 - mov ecx,[rsi+0000019C]
ES2-Win64-Shipping.exe+4CBB139: 41 8B C7 - mov eax,r15d
ES2-Win64-Shipping.exe+4CBB13C: 41 3B CF - cmp ecx,r15d
ES2-Win64-Shipping.exe+4CBB13F: 0F 4C C1 - cmovl eax,ecx
ES2-Win64-Shipping.exe+4CBB142: 44 2B F8 - sub r15d,eax
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4CBB145: 2B C8 - sub ecx,eax
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4CBB147: 89 8E 9C 01 00 00 - mov [rsi+0000019C],ecx
ES2-Win64-Shipping.exe+4CBB14D: 75 37 - jne ES2-Win64-Shipping.exe+4CBB186
ES2-Win64-Shipping.exe+4CBB14F: 49 8B 04 24 - mov rax,[r12]
ES2-Win64-Shipping.exe+4CBB153: 49 C7 04 06 00 00 00 00 - mov qword ptr [r14+rax],00000000
ES2-Win64-Shipping.exe+4CBB15B: 80 FB 0A - cmp bl,0A
ES2-Win64-Shipping.exe+4CBB15E: 74 26 - je ES2-Win64-Shipping.exe+4CBB186
ES2-Win64-Shipping.exe+4CBB160: E8 DB 5F EC FF - call ES2-Win64-Shipping.exe+4B81140
ES2-Win64-Shipping.exe+4CBB165: 49 3B C5 - cmp rax,r13
ES2-Win64-Shipping.exe+4CBB168: 75 1C - jne ES2-Win64-Shipping.exe+4CBB186
ES2-Win64-Shipping.exe+4CBB16A: 48 8B CE - mov rcx,rsi
}
114
"browse item & set some attributes"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_SET_SOME_ATTRS,$process,48 39 41 68 74 13) // should be unique
alloc(newmem,$1000,INJECT_SET_SOME_ATTRS)
label(code)
label(return)
newmem:
push r15
mov r15d, [rcx+68]
cmp r15d, #52789
je set_core_base
cmp r15d, #52819
je set_core_base
cmp r15d, #52848
je set_core_base
cmp r15d, #53048
je set_misc
cmp r15d, #53042
je set_misc
cmp r15d, #53054
je set_misc
cmp r15d, #53060
je set_misc
cmp r15d, #53065
je set_misc
cmp r15d, #53071
je set_misc
cmp r15d, #53065
je set_misc
cmp r15d, #53342
je set_cargo
cmp r15d, #54400
je set_misc2
cmp r15d, #54514
je set_misc3
// shield
cmp r15d, #53034
je set_shield_base1
cmp r15d, #52904
je set_shield_base2
cmp r15d, #52924
je set_booster3
cmp r15d, #53024
je set_shield_base2
//booster
cmp r15d, #53084
je set_booster1
cmp r15d, #53158
je set_booster2
cmp r15d, #53094
je set_booster3
cmp r15d, #53110
je set_booster4
cmp r15d, #53133
je set_booster5
cmp r15d, #53265
je set_booster6
//radar
cmp r15d, #54432
je set_radar1
cmp r15d, #54455
je set_radar2
cmp r15d, #54477
je set_radar2
cmp r15d, #57311
je set_radar3
cmp r15d, #53397
je set_weapon1
cmp r15d, #53420
je set_weapon1
jmp endp
set_core_base:
mov [rcx+70], (float)294204000
jmp endp
set_cargo:
mov [rcx+70], (float)200
jmp endp
set_shield_base1:
mov [rcx+70], (float)0.6
jmp endp
set_shield_base2:
mov [rcx+70], (float)338400000
jmp endp
set_booster1:
mov [rcx+70], (float)0.66
jmp endp
set_booster2:
mov [rcx+70], (float)592117952
jmp endp
set_booster3:
mov [rcx+70], (float)8.07
jmp endp
set_booster4:
mov [rcx+70], (float)3.34
jmp endp
set_booster5:
mov [rcx+70], (float)2.567
jmp endp
set_booster6:
mov [rcx+70], (float)100000
jmp endp
set_radar1:
mov [rcx+70], (float)1714218
jmp endp
set_radar2:
mov [rcx+70], (float)520000
jmp endp
set_radar3:
mov [rcx+70], (float)0.1
jmp endp
set_weapon1:
mov [rcx+70], (float)1900000
jmp endp
set_misc:
mov [rcx+70], (float)4500
jmp endp
set_misc2:
mov [rcx+70], (float)120000
jmp endp
set_misc3:
mov [rcx+70], (float)760000
jmp endp
endp:
pop r15
code:
cmp [rcx+68],rax
reassemble(INJECT_SET_SOME_ATTRS+4)
//je ES2-Win64-Shipping.exe+4C4B5B1
jmp return
INJECT_SET_SOME_ATTRS:
jmp newmem
nop
return:
registersymbol(INJECT_SET_SOME_ATTRS)
[DISABLE]
INJECT_SET_SOME_ATTRS:
db 48 39 41 68 74 13
unregistersymbol(INJECT_SET_SOME_ATTRS)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4C4B598
ES2-Win64-Shipping.exe+4C4B574: 48 8B 51 68 - mov rdx,[rcx+68]
ES2-Win64-Shipping.exe+4C4B578: 48 63 41 70 - movsxd rax,dword ptr [rcx+70]
ES2-Win64-Shipping.exe+4C4B57C: 4C 8D 04 C2 - lea r8,[rdx+rax*8]
ES2-Win64-Shipping.exe+4C4B580: 49 3B D0 - cmp rdx,r8
ES2-Win64-Shipping.exe+4C4B583: 74 22 - je ES2-Win64-Shipping.exe+4C4B5A7
ES2-Win64-Shipping.exe+4C4B585: 48 8B 05 D4 F3 8F 04 - mov rax,[ES2-Win64-Shipping.exe+954A960]
ES2-Win64-Shipping.exe+4C4B58C: 0F 1F 40 00 - nop dword ptr [rax+00]
ES2-Win64-Shipping.exe+4C4B590: 48 8B 0A - mov rcx,[rdx]
ES2-Win64-Shipping.exe+4C4B593: 48 85 C9 - test rcx,rcx
ES2-Win64-Shipping.exe+4C4B596: 74 06 - je ES2-Win64-Shipping.exe+4C4B59E
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4C4B598: 48 39 41 68 - cmp [rcx+68],rax
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4C4B59C: 74 13 - je ES2-Win64-Shipping.exe+4C4B5B1
ES2-Win64-Shipping.exe+4C4B59E: 48 83 C2 08 - add rdx,08
ES2-Win64-Shipping.exe+4C4B5A2: 49 3B D0 - cmp rdx,r8
ES2-Win64-Shipping.exe+4C4B5A5: 75 E9 - jne ES2-Win64-Shipping.exe+4C4B590
ES2-Win64-Shipping.exe+4C4B5A7: B8 01 00 00 00 - mov eax,00000001
ES2-Win64-Shipping.exe+4C4B5AC: 48 83 C4 28 - add rsp,28
ES2-Win64-Shipping.exe+4C4B5B0: C3 - ret
ES2-Win64-Shipping.exe+4C4B5B1: 48 89 5C 24 20 - mov [rsp+20],rbx
ES2-Win64-Shipping.exe+4C4B5B6: 48 8D 59 70 - lea rbx,[rcx+70]
ES2-Win64-Shipping.exe+4C4B5BA: 80 7B 34 00 - cmp byte ptr [rbx+34],00
}
115
"Warning: backup you saves before using this"
8000FF
1
116
"Get focused attribute value (Firepower/utility/resistance...)"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_ATTRS,$process,8B 00 48 8B 5C 24 30 48 83 C4 20 5F C3 CC CC CC CC 48 83) // should be unique
alloc(newmem,$1000,INJECT_GET_ATTRS)
label(code)
label(return i_base_attr_addr1 i_base_attr_addr2)
newmem:
cmp qword ptr [i_base_attr_addr1], rax
je code
cmp qword ptr [i_base_attr_addr2], rax
je code
cmp qword ptr [i_base_attr_addr1], 0
je write1
mov [i_base_attr_addr2], rax
jmp code
write1:
mov [i_base_attr_addr1], rax
jmp code
code:
mov eax,[rax]
mov rbx,[rsp+30]
jmp return
align 10 cc
i_base_attr_addr1:
dq 0
i_base_attr_addr2:
dq 0
align 100 0
db 0
INJECT_GET_ATTRS:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_ATTRS i_base_attr_addr1 i_base_attr_addr2)
[DISABLE]
INJECT_GET_ATTRS:
db 8B 00 48 8B 5C 24 30
unregistersymbol(INJECT_GET_ATTRS i_base_attr_addr1 i_base_attr_addr2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4A589EF
ES2-Win64-Shipping.exe+4A589D4: 48 83 C4 20 - add rsp,20
ES2-Win64-Shipping.exe+4A589D8: 5F - pop rdi
ES2-Win64-Shipping.exe+4A589D9: C3 - ret
ES2-Win64-Shipping.exe+4A589DA: 48 8B C2 - mov rax,rdx
ES2-Win64-Shipping.exe+4A589DD: 33 D2 - xor edx,edx
ES2-Win64-Shipping.exe+4A589DF: 48 03 C1 - add rax,rcx
ES2-Win64-Shipping.exe+4A589E2: 48 8D 40 08 - lea rax,[rax+08]
ES2-Win64-Shipping.exe+4A589E6: 48 0F 44 C2 - cmove rax,rdx
ES2-Win64-Shipping.exe+4A589EA: 48 85 C0 - test rax,rax
ES2-Win64-Shipping.exe+4A589ED: 74 DE - je ES2-Win64-Shipping.exe+4A589CD
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4A589EF: 8B 00 - mov eax,[rax]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4A589F1: 48 8B 5C 24 30 - mov rbx,[rsp+30]
ES2-Win64-Shipping.exe+4A589F6: 48 83 C4 20 - add rsp,20
ES2-Win64-Shipping.exe+4A589FA: 5F - pop rdi
ES2-Win64-Shipping.exe+4A589FB: C3 - ret
ES2-Win64-Shipping.exe+4A589FC: CC - int 3
ES2-Win64-Shipping.exe+4A589FD: CC - int 3
ES2-Win64-Shipping.exe+4A589FE: CC - int 3
ES2-Win64-Shipping.exe+4A589FF: CC - int 3
ES2-Win64-Shipping.exe+4A58A00: 48 83 EC 28 - sub rsp,28
ES2-Win64-Shipping.exe+4A58A04: E8 47 FF FF FF - call ES2-Win64-Shipping.exe+4A58950
}
117
"Must be non-zero, can over than 5"
8000FF
1
118
"#1 (Structure)"
0
FF8080
4 Bytes
i_base_attr_addr1
0
119
"#2"
0
FF8080
4 Bytes
i_base_attr_addr2
0
120
"Get Mainframe Expansions"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_MAINFRAME,$process,03 BA ?? ?? 00 00 48 83 C1 08) // should be unique
alloc(newmem,$1000,INJECT_GET_MAINFRAME)
alloc(INJECT_GET_MAINFRAMEo, 6)
INJECT_GET_MAINFRAMEo:
readmem(INJECT_GET_MAINFRAME, 6)
label(code)
label(return i_base_mf_addr i_base_mf_offset)
newmem:
mov [i_base_mf_addr], rdx
push r15
xor r15, r15
db 49 C7 C7
readmem(INJECT_GET_MAINFRAME+2, 4)
mov [i_base_mf_offset], r15
pop r15
code:
//add edi,[rdx+0000019C]
readmem(INJECT_GET_MAINFRAME, 6)
jmp return
align 10 cc
i_base_mf_addr:
dq 0
i_base_mf_offset:
dq 0
INJECT_GET_MAINFRAME:
jmp newmem
nop
return:
registersymbol(INJECT_GET_MAINFRAME i_base_mf_addr i_base_mf_offset)
registersymbol(INJECT_GET_MAINFRAMEo)
[DISABLE]
INJECT_GET_MAINFRAME:
//db 03 BA 9C 01 00 00
readmem(INJECT_GET_MAINFRAMEo, 6)
unregistersymbol(INJECT_GET_MAINFRAME i_base_mf_addr i_base_mf_offset)
dealloc(newmem)
unregistersymbol(INJECT_GET_MAINFRAMEo)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4C477D6
ES2-Win64-Shipping.exe+4C477B8: 48 8B 08 - mov rcx,[rax]
ES2-Win64-Shipping.exe+4C477BB: 48 63 40 08 - movsxd rax,dword ptr [rax+08]
ES2-Win64-Shipping.exe+4C477BF: 4C 8D 04 C1 - lea r8,[rcx+rax*8]
ES2-Win64-Shipping.exe+4C477C3: 49 3B C8 - cmp rcx,r8
ES2-Win64-Shipping.exe+4C477C6: 74 1D - je ES2-Win64-Shipping.exe+4C477E5
ES2-Win64-Shipping.exe+4C477C8: 48 8B 11 - mov rdx,[rcx]
ES2-Win64-Shipping.exe+4C477CB: 48 85 D2 - test rdx,rdx
ES2-Win64-Shipping.exe+4C477CE: 74 0C - je ES2-Win64-Shipping.exe+4C477DC
ES2-Win64-Shipping.exe+4C477D0: 48 39 5A 28 - cmp [rdx+28],rbx
ES2-Win64-Shipping.exe+4C477D4: 75 06 - jne ES2-Win64-Shipping.exe+4C477DC
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4C477D6: 03 BA 9C 01 00 00 - add edi,[rdx+0000019C]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4C477DC: 48 83 C1 08 - add rcx,08
ES2-Win64-Shipping.exe+4C477E0: 49 3B C8 - cmp rcx,r8
ES2-Win64-Shipping.exe+4C477E3: 75 E3 - jne ES2-Win64-Shipping.exe+4C477C8
ES2-Win64-Shipping.exe+4C477E5: 48 8B 5C 24 30 - mov rbx,[rsp+30]
ES2-Win64-Shipping.exe+4C477EA: 8B C7 - mov eax,edi
ES2-Win64-Shipping.exe+4C477EC: 48 83 C4 20 - add rsp,20
ES2-Win64-Shipping.exe+4C477F0: 5F - pop rdi
ES2-Win64-Shipping.exe+4C477F1: C3 - ret
ES2-Win64-Shipping.exe+4C477F2: CC - int 3
ES2-Win64-Shipping.exe+4C477F3: CC - int 3
}
121
"Must be non 0"
8000FF
1
122
"Stock"
0
FF8080
4 Bytes
i_base_mf_addr
[i_base_mf_offset]
123
"_not working"
808080
1
124
"Get renown"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2023-04-25
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_RENOWN,$process,41 8B 9B 88 0E 00 00 48) // should be unique
alloc(newmem,$1000,INJECT_GET_RENOWN)
label(code)
label(return)
label(i_base_renown_addr)
newmem:
mov [i_base_renown_addr], r11
code:
mov ebx,[r11+00000E88]
jmp return
align 10 cc
i_base_renown_addr:
dq 0
INJECT_GET_RENOWN:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_RENOWN)
registersymbol(i_base_renown_addr)
[DISABLE]
INJECT_GET_RENOWN:
db 41 8B 9B 88 0E 00 00
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+13CD1D1
ES2-Win64-Shipping.exe+13CD1A0: 40 53 - push rbx
ES2-Win64-Shipping.exe+13CD1A2: 4C 8B 15 07 0F 92 04 - mov r10,[ES2-Win64-Shipping.exe+5CEE0B0]
ES2-Win64-Shipping.exe+13CD1A9: 4D 85 D2 - test r10,r10
ES2-Win64-Shipping.exe+13CD1AC: 0F 84 E6 00 00 00 - je ES2-Win64-Shipping.exe+13CD298
ES2-Win64-Shipping.exe+13CD1B2: 4D 8B 9A A8 01 00 00 - mov r11,[r10+000001A8]
ES2-Win64-Shipping.exe+13CD1B9: 4D 85 DB - test r11,r11
ES2-Win64-Shipping.exe+13CD1BC: 0F 84 D6 00 00 00 - je ES2-Win64-Shipping.exe+13CD298
ES2-Win64-Shipping.exe+13CD1C2: 84 C9 - test cl,cl
ES2-Win64-Shipping.exe+13CD1C4: 0F 84 CE 00 00 00 - je ES2-Win64-Shipping.exe+13CD298
ES2-Win64-Shipping.exe+13CD1CA: 41 8B 82 40 04 00 00 - mov eax,[r10+00000440]
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+13CD1D1: 41 8B 9B 88 0E 00 00 - mov ebx,[r11+00000E88]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+13CD1D8: 48 89 7C 24 10 - mov [rsp+10],rdi
ES2-Win64-Shipping.exe+13CD1DD: 33 FF - xor edi,edi
ES2-Win64-Shipping.exe+13CD1DF: 41 3B 82 6C 04 00 00 - cmp eax,[r10+0000046C]
ES2-Win64-Shipping.exe+13CD1E6: 74 58 - je ES2-Win64-Shipping.exe+13CD240
ES2-Win64-Shipping.exe+13CD1E8: 4D 63 82 80 04 00 00 - movsxd r8,dword ptr [r10+00000480]
ES2-Win64-Shipping.exe+13CD1EF: 4D 8D 8A 70 04 00 00 - lea r9,[r10+00000470]
ES2-Win64-Shipping.exe+13CD1F6: 49 8B 51 08 - mov rdx,[r9+08]
ES2-Win64-Shipping.exe+13CD1FA: 49 FF C8 - dec r8
ES2-Win64-Shipping.exe+13CD1FD: 0F B6 C1 - movzx eax,cl
ES2-Win64-Shipping.exe+13CD200: 4C 23 C0 - and r8,rax
}
125
"Usage: Menu->Data->Renown"
8000FF
1
126
"Renown"
0
FF8080
4 Bytes
i_base_renown_addr
E88
127
"Set some attributes (range, shield capacitry..)"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2023-04-24
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_SET_SOME_ATTRS,$process,0F 2E 81 90 00 00 00 74 05 E8 F1) // should be unique
alloc(newmem,$1000,INJECT_SET_SOME_ATTRS)
label(code)
label(return)
label(vf_min_range)
label(vf_min_capacity)
label(vf_repair_per_kill)
label(vf_rehcarge_delay)
label(vf_shutdown_duration)
label(vf_min_armor)
newmem:
push rax
// 0001596E: Range
// 00015751: Capacity (from shield)
// 000157C9: Armor (from plating)
// 000157D3: Repair per kill (from plating)
// 0001577F: recharge delay
// 00015799: Shutdown duration
// 00015CD0: repair ??% (nanobots)
// 00015CF0: over ? seconds (nanobots)
mov eax, [rcx+00000088]
cmp eax, 0001596E
jne chk_2
vmovss xmm15, [rcx+00000090]
vmovss xmm14, [vf_min_range]
vucomiss xmm15, xmm14
jae chk_2
vmovss [rcx+00000090], xmm14
vmovss [rcx+000000C0], xmm14
vmovss [rcx+000000C8], xmm14
vmovss [rcx+000000FC], xmm14
vmovss [rcx+00000100], xmm14
vmovaps xmm0, xmm14
chk_2:
mov eax, [rcx+00000088]
cmp eax, 00015751
jne chk_3
vmovss xmm15, [rcx+00000090]
vmovss xmm14, [vf_min_capacity]
vucomiss xmm15, xmm14
jae chk_3
vmovss [rcx+00000090], xmm14
vmovss [rcx+000000C0], xmm14
vmovss [rcx+000000C8], xmm14
vmovss [rcx+000000FC], xmm14
vmovss [rcx+00000100], xmm14
vmovaps xmm0, xmm14
chk_3:
mov eax, [rcx+00000088]
cmp eax, 000157C9
jne chk_4
vmovss xmm15, [rcx+00000090]
vmovss xmm14, [vf_min_armor]
vucomiss xmm15, xmm14
jae chk_4
vmovss [rcx+00000090], xmm14
vmovss [rcx+000000C0], xmm14
vmovss [rcx+000000C8], xmm14
vmovss [rcx+000000FC], xmm14
vmovss [rcx+00000100], xmm14
vmovaps xmm0, xmm14
chk_4:
mov eax, [rcx+00000088]
cmp eax, 000157D3
jne chk_5
vmovss xmm15, [rcx+00000090]
vmovss xmm14, [vf_repair_per_kill]
vucomiss xmm15, xmm14
jae chk_5
vmovss [rcx+00000090], xmm14
vmovss [rcx+000000C0], xmm14
vmovss [rcx+000000C8], xmm14
vmovss [rcx+000000FC], xmm14
vmovss [rcx+00000100], xmm14
vmovaps xmm0, xmm14
chk_5:
mov eax, [rcx+00000088]
cmp eax, 0001577F
jne chk_6
vmovss xmm15, [rcx+00000090]
vmovss xmm14, [vf_rehcarge_delay]
vucomiss xmm15, xmm14
je chk_6
vmovss [rcx+00000090], xmm14
vmovss [rcx+000000C0], xmm14
vmovss [rcx+000000C8], xmm14
vmovss [rcx+000000FC], xmm14
vmovss [rcx+00000100], xmm14
vmovaps xmm0, xmm14
chk_6:
mov eax, [rcx+00000088]
cmp eax, 00015799
jne chk_7
vmovss xmm15, [rcx+00000090]
vmovss xmm14, [vf_shutdown_duration]
vucomiss xmm15, xmm14
je chk_7
vmovss [rcx+00000090], xmm14
vmovss [rcx+000000C0], xmm14
vmovss [rcx+000000C8], xmm14
vmovss [rcx+000000FC], xmm14
vmovss [rcx+00000100], xmm14
vmovaps xmm0, xmm14
chk_7:
endp:
pop rax
code:
ucomiss xmm0,[rcx+00000090]
jmp return
align 10 cc
vf_min_range:
dd (float)861000
vf_min_capacity:
dd (float)531998
vf_min_armor:
dd (float)333998
vf_repair_per_kill:
dd (float)0.5
vf_rehcarge_delay:
dd (float)0.5
vf_shutdown_duration:
dd (float)1
INJECT_SET_SOME_ATTRS:
jmp newmem
nop 2
return:
registersymbol(INJECT_SET_SOME_ATTRS)
registersymbol(vf_min_range)
registersymbol(vf_min_capacity)
registersymbol(vf_repair_per_kill)
registersymbol(vf_rehcarge_delay)
registersymbol(vf_shutdown_duration)
registersymbol(vf_min_armor)
[DISABLE]
INJECT_SET_SOME_ATTRS:
db 0F 2E 81 90 00 00 00
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+17992D1
ES2-Win64-Shipping.exe+17992AE: CC - int 3
ES2-Win64-Shipping.exe+17992AF: CC - int 3
ES2-Win64-Shipping.exe+17992B0: 48 89 5C 24 08 - mov [rsp+08],rbx
ES2-Win64-Shipping.exe+17992B5: 57 - push rdi
ES2-Win64-Shipping.exe+17992B6: 48 83 EC 20 - sub rsp,20
ES2-Win64-Shipping.exe+17992BA: 80 B9 C4 00 00 00 00 - cmp byte ptr [rcx+000000C4],00
ES2-Win64-Shipping.exe+17992C1: 48 8B FA - mov rdi,rdx
ES2-Win64-Shipping.exe+17992C4: 48 8B D9 - mov rbx,rcx
ES2-Win64-Shipping.exe+17992C7: 75 11 - jne ES2-Win64-Shipping.exe+17992DA
ES2-Win64-Shipping.exe+17992C9: F3 0F 10 81 C8 00 00 00 - movss xmm0,[rcx+000000C8]
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+17992D1: 0F 2E 81 90 00 00 00 - ucomiss xmm0,[rcx+00000090]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+17992D8: 74 05 - je ES2-Win64-Shipping.exe+17992DF
ES2-Win64-Shipping.exe+17992DA: E8 F1 A0 05 00 - call ES2-Win64-Shipping.exe+17F33D0
ES2-Win64-Shipping.exe+17992DF: 48 8B 43 28 - mov rax,[rbx+28]
ES2-Win64-Shipping.exe+17992E3: 48 89 07 - mov [rdi],rax
ES2-Win64-Shipping.exe+17992E6: 48 8B 43 30 - mov rax,[rbx+30]
ES2-Win64-Shipping.exe+17992EA: 48 89 47 08 - mov [rdi+08],rax
ES2-Win64-Shipping.exe+17992EE: 48 85 C0 - test rax,rax
ES2-Win64-Shipping.exe+17992F1: 74 04 - je ES2-Win64-Shipping.exe+17992F7
ES2-Win64-Shipping.exe+17992F3: F0 FF 40 08 - lock inc [rax+08]
ES2-Win64-Shipping.exe+17992F7: 8B 43 38 - mov eax,[rbx+38]
}
128
"Usage: browse item"
8000FF
1
129
"Weapon: min. range"
0
C08000
Float
vf_min_range
130
"***Not sure if working: Shield, Plating***"
8000FF
1
131
"Plating: min armor"
0
C08000
Float
vf_min_armor
132
"Plating: repair per kill (1=100%)"
0
C08000
Float
vf_repair_per_kill
133
"Shield: min. capacity"
0
C08000
Float
vf_min_capacity
134
"Shield: max recharge delay"
0
C08000
Float
vf_rehcarge_delay
135
"Shield: max shutdown duration"
0
C08000
Float
vf_shutdown_duration
136
"_debug"
808080
1
137
"UE5 init."
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-10
Author : bbfox@https://opencheattablesc.om
}
[ENABLE]
aobscanmodule(INJECT_GET_PLAYER_CTRL_ADDR,$process,56 41 54 48 8D 6C 24 88) // should be unique
alloc(newmem,$1000,INJECT_GET_PLAYER_CTRL_ADDR)
label(code)
label(return i_base_player_ctrl_addr)
//void __thiscall TickPlayerInput()
newmem:
mov [i_base_player_ctrl_addr], rcx
code:
lea rbp,[rsp-78]
jmp return
align 10 cc
i_base_player_ctrl_addr:
dq 0
INJECT_GET_PLAYER_CTRL_ADDR+03:
jmp newmem
return:
registersymbol(INJECT_GET_PLAYER_CTRL_ADDR i_base_player_ctrl_addr)
[DISABLE]
INJECT_GET_PLAYER_CTRL_ADDR+03:
db 48 8D 6C 24 88
unregistersymbol(INJECT_GET_PLAYER_CTRL_ADDR i_base_player_ctrl_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+3C22E76
ES2-Win64-Shipping.exe+3C22E6A: CC - int 3
ES2-Win64-Shipping.exe+3C22E6B: CC - int 3
ES2-Win64-Shipping.exe+3C22E6C: CC - int 3
ES2-Win64-Shipping.exe+3C22E6D: CC - int 3
ES2-Win64-Shipping.exe+3C22E6E: CC - int 3
ES2-Win64-Shipping.exe+3C22E6F: CC - int 3
ES2-Win64-Shipping.exe+3C22E70: 40 55 - push rbp
ES2-Win64-Shipping.exe+3C22E72: 53 - push rbx
ES2-Win64-Shipping.exe+3C22E73: 56 - push rsi
ES2-Win64-Shipping.exe+3C22E74: 41 54 - push r12
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+3C22E76: 48 8D 6C 24 88 - lea rbp,[rsp-78]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+3C22E7B: 48 81 EC 78 01 00 00 - sub rsp,00000178
ES2-Win64-Shipping.exe+3C22E82: 48 8B F1 - mov rsi,rcx
ES2-Win64-Shipping.exe+3C22E85: 0F 29 B4 24 60 01 00 00 - movaps [rsp+00000160],xmm6
ES2-Win64-Shipping.exe+3C22E8D: 48 8B 89 08 04 00 00 - mov rcx,[rcx+00000408]
ES2-Win64-Shipping.exe+3C22E94: 45 0F B6 E0 - movzx r12d,r8b
ES2-Win64-Shipping.exe+3C22E98: 0F 28 F1 - movaps xmm6,xmm1
ES2-Win64-Shipping.exe+3C22E9B: E8 C0 5F 2C 00 - call ES2-Win64-Shipping.exe+3EE8E60
ES2-Win64-Shipping.exe+3C22EA0: 48 83 BE 30 03 00 00 00 - cmp qword ptr [rsi+00000330],00
ES2-Win64-Shipping.exe+3C22EA8: 0F 84 39 02 00 00 - je ES2-Win64-Shipping.exe+3C230E7
ES2-Win64-Shipping.exe+3C22EAE: E8 0D D0 D9 FF - call ES2-Win64-Shipping.exe+39BFEC0
}
138
"p.controller"
1
0
808080
8 Bytes
i_base_player_ctrl_addr
139
"Pawn"
1
0
808080
8 Bytes
i_base_player_ctrl_addr
2D0
140
"controller.vtable"
1
0
808080
8 Bytes
i_base_player_ctrl_addr
328
141
"PlayerState"
1
0
808080
8 Bytes
i_base_player_ctrl_addr
298
142
"PlayerState (static)"
1
0
808080
8 Bytes
ES2-Win64-Shipping.exe+7855DB8
143
"init. 2"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author :
}
[ENABLE]
aobscanmodule(INJECT_GET_PCONTROLLER_VTABLE,$process,48 89 83 28 03 00 00 48 8D) // should be unique
alloc(newmem,$1000,INJECT_GET_PCONTROLLER_VTABLE)
label(code)
label(return i_base_pc_vtable_addr i_base_actor_vtable_addr)
newmem:
mov [i_base_pc_vtable_addr], rax
push r15
mov r15, [rbx]
mov [i_base_actor_vtable_addr], r15
pop r15
code:
mov [rbx+00000328],rax
jmp return
align 10 cc
i_base_pc_vtable_addr:
dq 0
i_base_actor_vtable_addr:
dq 0
INJECT_GET_PCONTROLLER_VTABLE:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_PCONTROLLER_VTABLE i_base_pc_vtable_addr i_base_actor_vtable_addr)
[DISABLE]
INJECT_GET_PCONTROLLER_VTABLE:
db 48 89 83 28 03 00 00
unregistersymbol(INJECT_GET_PCONTROLLER_VTABLE i_base_pc_vtable_addr i_base_actor_vtable_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+3BF5198
ES2-Win64-Shipping.exe+3BF5158: 48 8D 05 A1 C2 C4 03 - lea rax,[ES2-Win64-Shipping.exe+7841400]
ES2-Win64-Shipping.exe+3BF515F: 48 89 AB 30 03 00 00 - mov [rbx+00000330],rbp
ES2-Win64-Shipping.exe+3BF5166: 48 89 03 - mov [rbx],rax
ES2-Win64-Shipping.exe+3BF5169: 48 8D BB 68 05 00 00 - lea rdi,[rbx+00000568]
ES2-Win64-Shipping.exe+3BF5170: 48 8D 05 E9 D1 C4 03 - lea rax,[ES2-Win64-Shipping.exe+7842360]
ES2-Win64-Shipping.exe+3BF5177: 48 89 AB 38 03 00 00 - mov [rbx+00000338],rbp
ES2-Win64-Shipping.exe+3BF517E: 48 89 83 90 02 00 00 - mov [rbx+00000290],rax
ES2-Win64-Shipping.exe+3BF5185: B9 0B 00 00 00 - mov ecx,0000000B
ES2-Win64-Shipping.exe+3BF518A: 48 8D 05 F7 D5 AF 03 - lea rax,[ES2-Win64-Shipping.exe+76F2788]
ES2-Win64-Shipping.exe+3BF5191: 48 89 AB 40 03 00 00 - mov [rbx+00000340],rbp
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+3BF5198: 48 89 83 28 03 00 00 - mov [rbx+00000328],rax
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+3BF519F: 48 8D 83 A0 05 00 00 - lea rax,[rbx+000005A0]
ES2-Win64-Shipping.exe+3BF51A6: 48 89 AB 48 03 00 00 - mov [rbx+00000348],rbp
ES2-Win64-Shipping.exe+3BF51AD: 48 89 AB 50 03 00 00 - mov [rbx+00000350],rbp
ES2-Win64-Shipping.exe+3BF51B4: 48 89 AB 98 03 00 00 - mov [rbx+00000398],rbp
ES2-Win64-Shipping.exe+3BF51BB: 48 89 AB A0 03 00 00 - mov [rbx+000003A0],rbp
ES2-Win64-Shipping.exe+3BF51C2: 48 89 AB A8 03 00 00 - mov [rbx+000003A8],rbp
ES2-Win64-Shipping.exe+3BF51C9: 48 89 AB B0 03 00 00 - mov [rbx+000003B0],rbp
ES2-Win64-Shipping.exe+3BF51D0: 48 89 AB F8 03 00 00 - mov [rbx+000003F8],rbp
ES2-Win64-Shipping.exe+3BF51D7: 48 89 AB 00 04 00 00 - mov [rbx+00000400],rbp
ES2-Win64-Shipping.exe+3BF51DE: 48 89 AB 08 04 00 00 - mov [rbx+00000408],rbp
}
144
"pc.vtable"
1
0
808080
8 Bytes
i_base_pc_vtable_addr
145
"actor.vtable"
1
0
808080
8 Bytes
i_base_actor_vtable_addr
146
"Pawn.Hidden"
0
FF8080
Binary
7
1
0
i_base_player_ctrl_addr
58
2D0
147
"Pawn.CanBeDamaged"
0
FF8080
Binary
2
1
0
i_base_player_ctrl_addr
5A
2D0
148
"PlayerController.CanBeDamaged"
0
FF8080
Binary
2
1
0
i_base_player_ctrl_addr
5A
149
"EVERSPACE™ 2 1.3.43751 / https://opencheattables.com"
00994D
1
playerWeaponsPtr
1EB17730000