0
"Compact mode"
Auto Assembler Script
[ENABLE]
--https://forum.cheatengine.org/viewtopic.php?t=570055
LuaCall(function cycleFullCompact(sender,force) local state = not(compactmenuitem.Caption == 'Compact View Mode'); if force~=nil then state = not force end; compactmenuitem.Caption = state and 'Compact View Mode' or 'Full View Mode'; getMainForm().Splitter1.Visible = state; getMainForm().Panel4.Visible = state; getMainForm().Panel5.Visible = state; end; function addCompactMenu() if compactmenualreadyexists then return end; local parent = getMainForm().Menu.Items; compactmenuitem = createMenuItem(parent); parent.add(compactmenuitem); compactmenuitem.Caption = 'Compact View Mode'; compactmenuitem.OnClick = cycleFullCompact; compactmenualreadyexists = 'yes'; end; addCompactMenu(); cycleFullCompact(nil,true))
[DISABLE]
LuaCall(cycleFullCompact(nil,false))
1
"Toggle scripts"
4080FF
Auto Assembler Script
[ENABLE]
{$lua}
if (syntaxcheck) then return end
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
local enableBattleScripts = {
0, -- "Compact mode"
106, -- "Get credits, level & stats (not achievement)"
131, -- "inf. sub weapon"
132, -- "inf. thruster"
133, -- "inf. main weapon EN"
134, -- "inf. consumable usage in slots"
135, -- "inf material when crafting"
136, -- "inf. cloak field timer"
144, -- "Fast device cooldown"
145, -- "dismantled item: keep material amount at least 10"
155, -- "browse item & set some attributes"
157, -- "Get Mainframe Expansions"
}
local addressList = getAddressList()
for _, id in ipairs(enableBattleScripts) do
addressList.getMemoryRecordByID(id).Active = true
end
getLuaEngine().Close()
[DISABLE]
{$lua}
if (syntaxcheck) then return end
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
local disableBattleScripts = {
85, -- "11~"
64, -- "1~10"
34, -- "11~"
13, -- "1~10"
62, -- "Attributes+"
171, -- "init. 2"
168, -- "Get AESPawn"
139, -- "Try to get EN sphere timer value (not real address)"
11, -- "Attributes+"
162, -- "UE5 init."
138, -- "incomplete / not full function script"
2, -- "Get last 2 items level & count"
161, -- "_debug"
160, -- "_not working"
157, -- "Get Mainframe Expansions"
155, -- "browse item & set some attributes"
147, -- "Get focused attribute value (Firepower/utility/resistance...)"
145, -- "dismantled item: keep material amount at least 10"
144, -- "Fast device cooldown"
136, -- "inf. cloak field timer"
135, -- "inf material when crafting"
134, -- "inf. consumable usage in slots"
133, -- "inf. main weapon EN"
132, -- "inf. thruster"
131, -- "inf. sub weapon"
106, -- "Get credits, level & stats (not achievement)"
0, -- "Compact mode"
}
local addressList = getAddressList()
for _, id in ipairs(disableBattleScripts) do
addressList.getMemoryRecordByID(id).Active = false
end
getLuaEngine().Close()
2
"Get last 2 items level & count"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_ITEM_RAL,$process,41 80 7D ?? 05 4C) // should be unique
alloc(newmem,$1000,INJECT_GET_ITEM_RAL)
alloc(INJECT_GET_ITEM_RALo, 5)
label(code)
label(return i_base_item_r_addr i_base_item_r_addr2 i_i_base_item_r_offset)
INJECT_GET_ITEM_RALo:
readmem(INJECT_GET_ITEM_RAL, 5)
//void __cdecl GetItemAttributes(UItem * param_1, TArray<> * param_2, TArray<> * param_3, TArray<> * param_4)
//C++: UItemLib::GetItemAttributes(UItem *param_1,TArray<> *param_2,TArray<> *param_3,TArray<> *param_ 4)
newmem:
pushfq
push r15
db 49 c7 c7
readmem(INJECT_GET_ITEM_RAL+3, 1)
db 00 00 00
mov [i_i_base_item_r_offset], r15 //UItem::Rarity
pop r15
cmp dword ptr [i_idx], 0
je set1
cmp dword ptr [i_idx], 1
je set2
set1:
mov [i_base_item_r_addr], r13
mov dword ptr [i_idx], 1
jmp code_pre
set2:
mov [i_base_item_r_addr2], r13
mov dword ptr [i_idx], 0
jmp code_pre
code_pre:
popfq
code:
//cmp byte ptr [r13+60],05 //if (((param_1->Rarity).Value == '\x05') && (bVar5 = IsModuleOrWeaponItem(param_1), bVar5))
readmem(INJECT_GET_ITEM_RAL, 5)
jmp return
align 10 cc
i_base_item_r_addr:
dq 0
i_base_item_r_addr2:
dq 0
i_i_base_item_r_offset:
dq 0
i_idx:
dd 0
INJECT_GET_ITEM_RAL:
jmp newmem
return:
registersymbol(INJECT_GET_ITEM_RAL i_base_item_r_addr i_base_item_r_addr2 i_i_base_item_r_offset)
registersymbol(INJECT_GET_ITEM_RALo)
[DISABLE]
INJECT_GET_ITEM_RAL:
//db 41 80 7D 60 05
readmem(INJECT_GET_ITEM_RALo, 5)
unregistersymbol(INJECT_GET_ITEM_RAL i_base_item_r_addr i_base_item_r_addr2 i_i_base_item_r_offset)
dealloc(newmem)
unregistersymbol(INJECT_GET_ITEM_RALo)
dealloc(INJECT_GET_ITEM_RALo)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4BA8CB4
ES2-Win64-Shipping.exe+4BA8C91: 3B 43 0C - cmp eax,[rbx+0C]
ES2-Win64-Shipping.exe+4BA8C94: 76 0A - jna ES2-Win64-Shipping.exe+4BA8CA0
ES2-Win64-Shipping.exe+4BA8C96: 8B D5 - mov edx,ebp
ES2-Win64-Shipping.exe+4BA8C98: 48 8B CB - mov rcx,rbx
ES2-Win64-Shipping.exe+4BA8C9B: E8 E0 7C 5A FC - call ES2-Win64-Shipping.ffxFsr3UpscalerResourceIsNull+CDB0
ES2-Win64-Shipping.exe+4BA8CA0: 48 8B 03 - mov rax,[rbx]
ES2-Win64-Shipping.exe+4BA8CA3: 49 83 C7 08 - add r15,08
ES2-Win64-Shipping.exe+4BA8CA7: 48 89 3C E8 - mov [rax+rbp*8],rdi
ES2-Win64-Shipping.exe+4BA8CAB: 4D 3B FC - cmp r15,r12
ES2-Win64-Shipping.exe+4BA8CAE: 0F 85 3C FF FF FF - jne ES2-Win64-Shipping.exe+4BA8BF0
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4BA8CB4: 41 80 7D 60 05 - cmp byte ptr [r13+60],05
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4BA8CB9: 4C 8B 7C 24 50 - mov r15,[rsp+50]
ES2-Win64-Shipping.exe+4BA8CBE: 4C 8B A4 24 98 00 00 00 - mov r12,[rsp+00000098]
ES2-Win64-Shipping.exe+4BA8CC6: 48 8B AC 24 88 00 00 00 - mov rbp,[rsp+00000088]
ES2-Win64-Shipping.exe+4BA8CCE: 0F 85 AB 00 00 00 - jne ES2-Win64-Shipping.exe+4BA8D7F
ES2-Win64-Shipping.exe+4BA8CD4: 49 8B CD - mov rcx,r13
ES2-Win64-Shipping.exe+4BA8CD7: E8 44 E4 00 00 - call ES2-Win64-Shipping.exe+4BB7120
ES2-Win64-Shipping.exe+4BA8CDC: 84 C0 - test al,al
ES2-Win64-Shipping.exe+4BA8CDE: 0F 84 9B 00 00 00 - je ES2-Win64-Shipping.exe+4BA8D7F
ES2-Win64-Shipping.exe+4BA8CE4: E8 67 0B 0A 00 - call ES2-Win64-Shipping.exe+4C49850
ES2-Win64-Shipping.exe+4BA8CE9: 41 B0 01 - mov r8b,01
}
3
"#A"
1
4
"base"
1
0
808080
8 Bytes
i_base_item_r_addr
5
"ItemTemplateID"
0
FF8080
4 Bytes
i_base_item_r_addr
28
187
"item level"
0
FF8080
4 Bytes
i_base_item_r_addr
58
6
"VirtualLevelOffset"
0
FF8080
Float
i_base_item_r_addr
5C
7
"Rarity"
0
FF8080
Byte
i_base_item_r_addr
60
8
"Grade"
0
FF8080
Byte
i_base_item_r_addr
198
9
"Amount"
1
FF8080
4 Bytes
i_base_item_r_addr
19C
10
"Ammo"
1
FF8080
4 Bytes
i_base_item_r_addr
1A0
178
"WasModified"
0
FF8080
Byte
i_base_item_r_addr
1A7
207
"CanBeUsedWithAnyLevel"
0
FF8080
Byte
i_base_item_r_addr
1A8
210
"CooldownRemaining"
0
FF8080
Float
i_base_item_r_addr
204
11
"Attributes+"
1
12
"# of attributes"
0
808080
4 Bytes
i_base_item_r_addr
70
13
"1~10"
1
14
"ID #1"
0
FF8080
4 Bytes
i_base_item_r_addr
68
0
68
15
"Value #1"
0
FF8080
Float
i_base_item_r_addr
70
0
68
16
"ID #2"
0
FF8080
4 Bytes
i_base_item_r_addr
68
8
68
17
"Value #2"
0
FF8080
Float
i_base_item_r_addr
70
8
68
18
"ID #3"
0
FF8080
4 Bytes
i_base_item_r_addr
68
10
68
19
"Value #3"
0
FF8080
Float
i_base_item_r_addr
70
10
68
20
"ID #4"
0
FF8080
4 Bytes
i_base_item_r_addr
68
18
68
21
"Value #4"
0
FF8080
Float
i_base_item_r_addr
70
18
68
22
"ID #5"
0
FF8080
4 Bytes
i_base_item_r_addr
68
20
68
23
"Value #5"
0
FF8080
Float
i_base_item_r_addr
70
20
68
24
"ID #6"
0
FF8080
4 Bytes
i_base_item_r_addr
68
28
68
25
"Value #6"
0
FF8080
Float
i_base_item_r_addr
70
28
68
26
"ID #7"
0
FF8080
4 Bytes
i_base_item_r_addr
68
30
68
27
"Value #7"
0
FF8080
Float
i_base_item_r_addr
70
30
68
28
"ID #8"
0
FF8080
4 Bytes
i_base_item_r_addr
68
38
68
29
"Value #8"
0
FF8080
Float
i_base_item_r_addr
70
38
68
30
"ID #9"
0
FF8080
4 Bytes
i_base_item_r_addr
68
40
68
31
"Value #9"
0
FF8080
Float
i_base_item_r_addr
70
40
68
32
"ID #10"
0
FF8080
4 Bytes
i_base_item_r_addr
68
48
68
33
"Value #10"
0
FF8080
Float
i_base_item_r_addr
70
48
68
34
"11~"
1
35
"ID #11"
0
FF8080
4 Bytes
i_base_item_r_addr
68
50
68
36
"Value #11"
0
FF8080
Float
i_base_item_r_addr
70
50
68
37
"ID #12"
0
FF8080
4 Bytes
i_base_item_r_addr
68
58
68
38
"Value #12"
0
FF8080
Float
i_base_item_r_addr
70
58
68
39
"ID #13"
0
FF8080
4 Bytes
i_base_item_r_addr
68
60
68
40
"Value #13"
0
FF8080
Float
i_base_item_r_addr
70
60
68
41
"ID #14"
0
FF8080
4 Bytes
i_base_item_r_addr
68
68
68
42
"Value #14"
0
FF8080
Float
i_base_item_r_addr
70
68
68
43
"ID #15"
0
FF8080
4 Bytes
i_base_item_r_addr
68
70
68
44
"Value #15"
0
FF8080
Float
i_base_item_r_addr
70
70
68
45
"ID #16"
0
FF8080
4 Bytes
i_base_item_r_addr
68
78
68
46
"Value #16"
0
FF8080
Float
i_base_item_r_addr
70
78
68
47
"ID #17"
0
FF8080
4 Bytes
i_base_item_r_addr
68
80
68
48
"Value #17"
0
FF8080
Float
i_base_item_r_addr
70
80
68
49
"ID #18"
0
FF8080
4 Bytes
i_base_item_r_addr
68
88
68
50
"Value #18"
0
FF8080
Float
i_base_item_r_addr
70
88
68
51
"ID #19"
0
FF8080
4 Bytes
i_base_item_r_addr
68
90
68
52
"Value #19"
0
FF8080
Float
i_base_item_r_addr
70
90
68
53
"ID #20"
0
FF8080
4 Bytes
i_base_item_r_addr
68
98
68
54
"Value #20"
0
FF8080
Float
i_base_item_r_addr
70
98
68
55
"#B"
1
56
"ItemTemplateID"
0
FF8080
4 Bytes
i_base_item_r_addr2
28
188
"item level"
0
FF8080
4 Bytes
i_base_item_r_addr2
58
57
"VirtualLevelOffset"
0
FF8080
Float
i_base_item_r_addr2
5C
58
"Rarity"
0
FF8080
Byte
i_base_item_r_addr2
60
59
"Grade"
0
FF8080
Byte
i_base_item_r_addr2
198
60
"Amount"
1
FF8080
4 Bytes
i_base_item_r_addr2
19C
61
"Ammo"
1
FF8080
4 Bytes
i_base_item_r_addr2
1A0
179
"WasModified"
0
FF8080
Byte
i_base_item_r_addr2
1A7
208
"CanBeUsedWithAnyLevel"
0
FF8080
Byte
i_base_item_r_addr2
1A8
209
"CooldownRemaining"
0
FF8080
Float
i_base_item_r_addr2
204
62
"Attributes+"
1
63
"# of attributes"
0
808080
4 Bytes
i_base_item_r_addr2
70
64
"1~10"
1
65
"ID #1"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
0
68
66
"Value #1"
0
FF8080
Float
i_base_item_r_addr2
70
0
68
67
"ID #2"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
8
68
68
"Value #2"
0
FF8080
Float
i_base_item_r_addr2
70
8
68
69
"ID #3"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
10
68
70
"Value #3"
0
FF8080
Float
i_base_item_r_addr2
70
10
68
71
"ID #4"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
18
68
72
"Value #4"
0
FF8080
Float
i_base_item_r_addr2
70
18
68
73
"ID #5"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
20
68
74
"Value #5"
0
FF8080
Float
i_base_item_r_addr2
70
20
68
75
"ID #6"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
28
68
76
"Value #6"
0
FF8080
Float
i_base_item_r_addr2
70
28
68
77
"ID #7"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
30
68
78
"Value #7"
0
FF8080
Float
i_base_item_r_addr2
70
30
68
79
"ID #8"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
38
68
80
"Value #8"
0
FF8080
Float
i_base_item_r_addr2
70
38
68
81
"ID #9"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
40
68
82
"Value #9"
0
FF8080
Float
i_base_item_r_addr2
70
40
68
83
"ID #10"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
48
68
84
"Value #10"
0
FF8080
Float
i_base_item_r_addr2
70
48
68
85
"11~"
1
86
"ID #11"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
50
68
87
"Value #11"
0
FF8080
Float
i_base_item_r_addr2
70
50
68
88
"ID #12"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
58
68
89
"Value #12"
0
FF8080
Float
i_base_item_r_addr2
70
58
68
90
"ID #13"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
60
68
91
"Value #13"
0
FF8080
Float
i_base_item_r_addr2
70
60
68
92
"ID #14"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
68
68
93
"Value #14"
0
FF8080
Float
i_base_item_r_addr
70
68
68
94
"ID #15"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
70
68
95
"Value #15"
0
FF8080
Float
i_base_item_r_addr2
70
70
68
96
"ID #16"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
78
68
97
"Value #16"
0
FF8080
Float
i_base_item_r_addr2
70
78
68
98
"ID #17"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
80
68
99
"Value #17"
0
FF8080
Float
i_base_item_r_addr2
70
80
68
100
"ID #18"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
88
68
101
"Value #18"
0
FF8080
Float
i_base_item_r_addr2
70
88
68
102
"ID #19"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
90
68
103
"Value #19"
0
FF8080
Float
i_base_item_r_addr2
70
90
68
104
"ID #20"
0
FF8080
4 Bytes
i_base_item_r_addr2
68
98
68
105
"Value #20"
0
FF8080
Float
i_base_item_r_addr2
70
98
68
106
"Get credits, level & stats (not achievement)"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_CREDITS,$process,39 8A ?? ?? 00 00 0F 9D) // should be unique
alloc(newmem,$1000,INJECT_GET_CREDITS)
alloc(INJECT_GET_CREDITSo, 6)
label(code)
label(return i_base_money_addr i_base_money_offset)
INJECT_GET_CREDITSo:
readmem(INJECT_GET_CREDITS, 6)
//bool __cdecl HasEnoughCredits(int param_1)
//C++: bool __cdecl UGameplayLib::HasEnoughCredits(int param_1)
newmem:
mov [i_base_money_addr], rdx // rdx ==> UPlayerData, PlayerData
push r15
db 49 c7 c7
readmem(INJECT_GET_CREDITS+2, 4)
mov [i_base_money_offset], r15
@@:
pop r15
code:
readmem(INJECT_GET_CREDITS, 6)
//cmp [rdx+00000120],ecx
jmp return
align 10 cc
i_base_money_addr:
dq 0
i_base_money_offset:
dq 0
INJECT_GET_CREDITS:
jmp newmem
nop
return:
registersymbol(INJECT_GET_CREDITS i_base_money_addr i_base_money_offset)
registersymbol(INJECT_GET_CREDITSo)
[DISABLE]
INJECT_GET_CREDITS:
//db 39 8A 20 01 00 00
readmem(INJECT_GET_CREDITSo, 6)
unregistersymbol(INJECT_GET_CREDITS i_base_money_addr i_base_money_offset)
dealloc(newmem)
unregistersymbol(INJECT_GET_CREDITSo)
dealloc(INJECT_GET_CREDITSo)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4A99108
ES2-Win64-Shipping.exe+4A990EC: CC - int 3
ES2-Win64-Shipping.exe+4A990ED: CC - int 3
ES2-Win64-Shipping.exe+4A990EE: CC - int 3
ES2-Win64-Shipping.exe+4A990EF: CC - int 3
ES2-Win64-Shipping.exe+4A990F0: 48 8B 05 81 6F A9 04 - mov rax,[ES2-Win64-Shipping.exe+9530078]
ES2-Win64-Shipping.exe+4A990F7: 48 85 C0 - test rax,rax
ES2-Win64-Shipping.exe+4A990FA: 74 16 - je ES2-Win64-Shipping.exe+4A99112
ES2-Win64-Shipping.exe+4A990FC: 48 8B 90 C0 01 00 00 - mov rdx,[rax+000001C0]
ES2-Win64-Shipping.exe+4A99103: 48 85 D2 - test rdx,rdx
ES2-Win64-Shipping.exe+4A99106: 74 0A - je ES2-Win64-Shipping.exe+4A99112
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4A99108: 39 8A 20 01 00 00 - cmp [rdx+00000120],ecx
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4A9910E: 0F 9D C0 - setge al
ES2-Win64-Shipping.exe+4A99111: C3 - ret
ES2-Win64-Shipping.exe+4A99112: 32 C0 - xor al,al
ES2-Win64-Shipping.exe+4A99114: C3 - ret
ES2-Win64-Shipping.exe+4A99115: CC - int 3
ES2-Win64-Shipping.exe+4A99116: CC - int 3
ES2-Win64-Shipping.exe+4A99117: CC - int 3
ES2-Win64-Shipping.exe+4A99118: CC - int 3
ES2-Win64-Shipping.exe+4A99119: CC - int 3
ES2-Win64-Shipping.exe+4A9911A: CC - int 3
}
107
"UPlayerData.base"
1
0
808080
8 Bytes
i_base_money_addr
195
"Credits"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]
108
"PlayerLevel"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+4
109
"EXP"
0
FF8080
Float
i_base_money_addr
[i_base_money_offset]+8
206
"TArray<FShipdata> (0x468)"
1
0
808080
8 Bytes
i_base_money_addr
[i_base_money_offset]+348
111
"Items collected"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+900
112
"Resource mined"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+8FC
113
"Items bought"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+904
114
"Items sold"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+908
115
"Items dismantled"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+90C
116
"Items crafted"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+910
117
"Items upgraded"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+924
118
"Level restrictions removed"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+928
119
"??"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+92C
120
"Jobs completed"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+930
121
"Missions: Main"
0
808080
4 Bytes
i_base_money_addr
[i_base_money_offset]+934
122
"Missions: side"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+938
199
"LastCraftingCategoryID"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+CD8
202
"LastCraftingRarity"
0
FF8080
Byte
i_base_money_addr
[i_base_money_offset]+CC0
200
"LastCraftingItemID"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+CC4
128
"bAutoRepair"
0
FF8080
Byte
i_base_money_addr
[i_base_money_offset]+EA0
197
"bAutoRestock"
0
FF8080
Byte
i_base_money_addr
[i_base_money_offset]+EA1
198
"bHeadlightsEnabled"
0
FF8080
Byte
i_base_money_addr
[i_base_money_offset]+EA3
193
"Difficulty"
0
FF8080
Byte
i_base_money_addr
[i_base_money_offset]+A30
194
"CurrentShip"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+A34
129
"Device upgrades"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+B30
130
"Renown"
0
FF8080
4 Bytes
i_base_money_addr
[i_base_money_offset]+F88
196
"PlayingTimeSecondsDouble"
0
FF8080
Double
i_base_money_addr
[i_base_money_offset]+1958
131
"inf. sub weapon"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_SUBWEAPON,$process,FF C8 48 8B D7) // should be unique
//void __thiscall ConsumeAmmo(UWeaponComponent * this, UItem * param_1, bool param_2)
//C++: void __thiscall UWeaponComponent::ConsumeAmmo(UWeaponComponent *this,UItem *param_1,bool para
INJECT_INF_SUBWEAPON:
db 90 90
registersymbol(INJECT_INF_SUBWEAPON)
[DISABLE]
INJECT_INF_SUBWEAPON:
db FF C8
unregistersymbol(INJECT_INF_SUBWEAPON)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+499B4C3
ES2-Win64-Shipping.exe+499B49C: 48 3B DA - cmp rbx,rdx
ES2-Win64-Shipping.exe+499B49F: 75 EF - jne ES2-Win64-Shipping.exe+499B490
ES2-Win64-Shipping.exe+499B4A1: E9 E2 01 00 00 - jmp ES2-Win64-Shipping.exe+499B688
ES2-Win64-Shipping.exe+499B4A6: 45 84 C0 - test r8b,r8b
ES2-Win64-Shipping.exe+499B4A9: 0F 84 D9 01 00 00 - je ES2-Win64-Shipping.exe+499B688
ES2-Win64-Shipping.exe+499B4AF: 83 7B 38 00 - cmp dword ptr [rbx+38],00
ES2-Win64-Shipping.exe+499B4B3: 0F 8E CF 01 00 00 - jng ES2-Win64-Shipping.exe+499B688
ES2-Win64-Shipping.exe+499B4B9: 8B 81 A0 01 00 00 - mov eax,[rcx+000001A0]
ES2-Win64-Shipping.exe+499B4BF: 85 C0 - test eax,eax
ES2-Win64-Shipping.exe+499B4C1: 7E 32 - jle ES2-Win64-Shipping.exe+499B4F5
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+499B4C3: FF C8 - dec eax
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+499B4C5: 48 8B D7 - mov rdx,rdi
ES2-Win64-Shipping.exe+499B4C8: 89 81 A0 01 00 00 - mov [rcx+000001A0],eax
ES2-Win64-Shipping.exe+499B4CE: 48 8D 8E 88 06 00 00 - lea rcx,[rsi+00000688]
ES2-Win64-Shipping.exe+499B4D5: E8 56 3D A3 FE - call ES2-Win64-Shipping.exe+33CF230
ES2-Win64-Shipping.exe+499B4DA: 48 8B 03 - mov rax,[rbx]
ES2-Win64-Shipping.exe+499B4DD: 83 B8 A0 01 00 00 00 - cmp dword ptr [rax+000001A0],00
ES2-Win64-Shipping.exe+499B4E4: 75 0F - jne ES2-Win64-Shipping.exe+499B4F5
ES2-Win64-Shipping.exe+499B4E6: 48 8D 8E A8 06 00 00 - lea rcx,[rsi+000006A8]
ES2-Win64-Shipping.exe+499B4ED: 48 8B D7 - mov rdx,rdi
ES2-Win64-Shipping.exe+499B4F0: E8 3B 3D A3 FE - call ES2-Win64-Shipping.exe+33CF230
}
132
"inf. thruster"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_THRUSTER,$process,F3 0F 5C C1 F3 41 0F 5F C5) // should be unique
alloc(newmem,$1000,INJECT_INF_THRUSTER)
label(code)
label(return)
//void __thiscall TickComponent(UShipMovementComponent * this, float param_1, ELevelTick param_2, FActorComponentTickFunction * param_3)
//UShipMovementComponent::TickComponent(UShipMovementComponent *this,float param_1,ELevelTick param_2, FActorComponentTickFunction *param_3)
newmem:
xorps xmm1, xmm1
code:
subss xmm0,xmm1 //fVar22 = this->CurrentBoostEnergy - fVar17 * param_1;
maxss xmm0,xmm13
jmp return
INJECT_INF_THRUSTER:
jmp newmem
nop 4
return:
registersymbol(INJECT_INF_THRUSTER)
[DISABLE]
INJECT_INF_THRUSTER:
db F3 0F 5C C1 F3 41 0F 5F C5
unregistersymbol(INJECT_INF_THRUSTER)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+49B5CF3
ES2-Win64-Shipping.exe+49B5CBE: 44 38 B3 A4 00 00 00 - cmp [rbx+000000A4],r14b
ES2-Win64-Shipping.exe+49B5CC5: 75 0E - jne ES2-Win64-Shipping.exe+49B5CD5
ES2-Win64-Shipping.exe+49B5CC7: F3 0F 10 83 A8 00 00 00 - movss xmm0,[rbx+000000A8]
ES2-Win64-Shipping.exe+49B5CCF: 0F 2E 43 70 - ucomiss xmm0,[rbx+70]
ES2-Win64-Shipping.exe+49B5CD3: 74 09 - je ES2-Win64-Shipping.exe+49B5CDE
ES2-Win64-Shipping.exe+49B5CD5: 48 8D 4B 70 - lea rcx,[rbx+70]
ES2-Win64-Shipping.exe+49B5CD9: E8 22 F8 04 00 - call ES2-Win64-Shipping.exe+4A05500
ES2-Win64-Shipping.exe+49B5CDE: F3 0F 10 8B A0 00 00 00 - movss xmm1,[rbx+000000A0]
ES2-Win64-Shipping.exe+49B5CE6: F3 0F 10 87 90 0A 00 00 - movss xmm0,[rdi+00000A90]
ES2-Win64-Shipping.exe+49B5CEE: F3 41 0F 59 CC - mulss xmm1,xmm12
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+49B5CF3: F3 0F 5C C1 - subss xmm0,xmm1
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+49B5CF7: F3 41 0F 5F C5 - maxss xmm0,xmm13
ES2-Win64-Shipping.exe+49B5CFC: 48 8B CF - mov rcx,rdi
ES2-Win64-Shipping.exe+49B5CFF: F3 0F 11 87 90 0A 00 00 - movss [rdi+00000A90],xmm0
ES2-Win64-Shipping.exe+49B5D07: E8 14 8A FE FF - call ES2-Win64-Shipping.exe+499E720
ES2-Win64-Shipping.exe+49B5D0C: 48 8D 8F 70 09 00 00 - lea rcx,[rdi+00000970]
ES2-Win64-Shipping.exe+49B5D13: 41 0F 28 D4 - movaps xmm2,xmm12
ES2-Win64-Shipping.exe+49B5D17: 0F 28 C8 - movaps xmm1,xmm0
ES2-Win64-Shipping.exe+49B5D1A: E8 B1 76 F6 FF - call ES2-Win64-Shipping.exe+491D3D0
ES2-Win64-Shipping.exe+49B5D1F: 44 0F 2F AF 90 0A 00 00 - comiss xmm13,[rdi+00000A90]
ES2-Win64-Shipping.exe+49B5D27: 0F 82 61 01 00 00 - jb ES2-Win64-Shipping.exe+49B5E8E
}
133
"inf. main weapon EN"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_EN_WEAPON,$process,0F 28 CE 0F 28 FE F3) // should be unique
alloc(newmem,$1000,INJECT_INF_EN_WEAPON)
label(code)
label(return)
//void __thiscall ChangeEnergy(AWeaponBase * this, float param_1)
//void __thiscall AWeaponBase::ChangeEnergy(AWeaponBase *this,float param_1)
newmem:
pushfq
vxorps xmm15, xmm15, xmm15
vucomiss xmm6, xmm15
ja @F
vmovss xmm6, [vf_1]
@@:
popfq
code:
movaps xmm1,xmm6 // fVar4 = GetMaxEnergyCapacity(this); fVar6 = -param_1;
movaps xmm7,xmm6
jmp return
align 10 cc
vf_1:
dd (float)1
INJECT_INF_EN_WEAPON:
jmp newmem
nop
return:
registersymbol(INJECT_INF_EN_WEAPON)
[DISABLE]
INJECT_INF_EN_WEAPON:
db 0F 28 CE 0F 28 FE
unregistersymbol(INJECT_INF_EN_WEAPON)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+49C4AC8
ES2-Win64-Shipping.exe+49C4AA3: 74 13 - je ES2-Win64-Shipping.exe+49C4AB8
ES2-Win64-Shipping.exe+49C4AA5: 0F 28 CE - movaps xmm1,xmm6
ES2-Win64-Shipping.exe+49C4AA8: 48 8B C8 - mov rcx,rax
ES2-Win64-Shipping.exe+49C4AAB: E8 C0 5C FD FF - call ES2-Win64-Shipping.exe+499A770
ES2-Win64-Shipping.exe+49C4AB0: 48 8B CF - mov rcx,rdi
ES2-Win64-Shipping.exe+49C4AB3: E8 C8 FE FD FF - call ES2-Win64-Shipping.exe+49A4980
ES2-Win64-Shipping.exe+49C4AB8: 48 8B 7C 24 70 - mov rdi,[rsp+70]
ES2-Win64-Shipping.exe+49C4ABD: EB 31 - jmp ES2-Win64-Shipping.exe+49C4AF0
ES2-Win64-Shipping.exe+49C4ABF: E8 CC D6 00 00 - call ES2-Win64-Shipping.exe+49D2190
ES2-Win64-Shipping.exe+49C4AC4: 41 0F 2F F0 - comiss xmm6,xmm8
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+49C4AC8: 0F 28 CE - movaps xmm1,xmm6
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+49C4ACB: 0F 28 FE - movaps xmm7,xmm6
ES2-Win64-Shipping.exe+49C4ACE: F3 0F 58 8B E4 0B 00 00 - addss xmm1,[rbx+00000BE4]
ES2-Win64-Shipping.exe+49C4AD6: 0F 57 3D B3 D4 49 02 - xorps xmm7,[ES2-Win64-Shipping.exe+6E61F90]
ES2-Win64-Shipping.exe+49C4ADD: F3 0F 5D C8 - minss xmm1,xmm0
ES2-Win64-Shipping.exe+49C4AE1: F3 41 0F 5F C8 - maxss xmm1,xmm8
ES2-Win64-Shipping.exe+49C4AE6: F3 0F 11 8B E4 0B 00 00 - movss [rbx+00000BE4],xmm1
ES2-Win64-Shipping.exe+49C4AEE: 73 42 - jae ES2-Win64-Shipping.exe+49C4B32
ES2-Win64-Shipping.exe+49C4AF0: C7 83 EC 0B 00 00 00 00 00 00 - mov [rbx+00000BEC],00000000
ES2-Win64-Shipping.exe+49C4AFA: 0F 28 F7 - movaps xmm6,xmm7
ES2-Win64-Shipping.exe+49C4AFD: 48 8B 8B 40 01 00 00 - mov rcx,[rbx+00000140]
}
134
"inf. consumable usage in slots"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_COMSUMABLE,$process,FF 88 ?? 0? 00 00 48 8B 83) // should be unique
//label(INJECT_INF_COMSUMABLEo)
alloc(INJECT_INF_COMSUMABLEo, 6)
INJECT_INF_COMSUMABLEo:
readmem(INJECT_INF_COMSUMABLE, 6)
INJECT_INF_COMSUMABLE:
nop 6
registersymbol(INJECT_INF_COMSUMABLE)
registersymbol(INJECT_INF_COMSUMABLEo)
[DISABLE]
INJECT_INF_COMSUMABLE:
//db FF 88 9C 01 00 00
readmem(INJECT_INF_COMSUMABLEo, 6)
unregistersymbol(INJECT_INF_COMSUMABLE)
unregistersymbol(INJECT_INF_COMSUMABLEo)
dealloc(INJECT_INF_COMSUMABLEo)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+498E767
ES2-Win64-Shipping.exe+498E73E: 48 8B 15 2B 39 B9 04 - mov rdx,[ES2-Win64-Shipping.exe+9522070]
ES2-Win64-Shipping.exe+498E745: 49 8B 04 C8 - mov rax,[r8+rcx*8]
ES2-Win64-Shipping.exe+498E749: 48 39 50 28 - cmp [rax+28],rdx
ES2-Win64-Shipping.exe+498E74D: 75 10 - jne ES2-Win64-Shipping.exe+498E75F
ES2-Win64-Shipping.exe+498E74F: E8 CC 77 0F 00 - call ES2-Win64-Shipping.exe+4A85F20
ES2-Win64-Shipping.exe+498E754: 84 C0 - test al,al
ES2-Win64-Shipping.exe+498E756: 75 15 - jne ES2-Win64-Shipping.exe+498E76D
ES2-Win64-Shipping.exe+498E758: 4C 8B 83 A0 00 00 00 - mov r8,[rbx+000000A0]
ES2-Win64-Shipping.exe+498E75F: 4B 8D 0C 64 - lea rcx,[r12+r12*2]
ES2-Win64-Shipping.exe+498E763: 49 8B 04 C8 - mov rax,[r8+rcx*8]
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+498E767: FF 88 9C 01 00 00 - dec [rax+0000019C]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+498E76D: 48 8B 83 A0 00 00 00 - mov rax,[rbx+000000A0]
ES2-Win64-Shipping.exe+498E774: 4B 8D 0C 64 - lea rcx,[r12+r12*2]
ES2-Win64-Shipping.exe+498E778: 48 8B 0C C8 - mov rcx,[rax+rcx*8]
ES2-Win64-Shipping.exe+498E77C: 83 B9 9C 01 00 00 00 - cmp dword ptr [rcx+0000019C],00
ES2-Win64-Shipping.exe+498E783: 0F 8F 85 00 00 00 - jg ES2-Win64-Shipping.exe+498E80E
ES2-Win64-Shipping.exe+498E789: 48 8B BB 90 00 00 00 - mov rdi,[rbx+00000090]
ES2-Win64-Shipping.exe+498E790: 48 85 FF - test rdi,rdi
ES2-Win64-Shipping.exe+498E793: 74 3E - je ES2-Win64-Shipping.exe+498E7D3
ES2-Win64-Shipping.exe+498E795: E8 66 B6 EF FF - call ES2-Win64-Shipping.exe+4889E00
ES2-Win64-Shipping.exe+498E79A: 48 8B 4F 10 - mov rcx,[rdi+10]
}
135
"inf material when crafting"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_CRAFTING,$process,2B C8 89 8E ?? ?? 00 00 75) // should be unique
alloc(newmem,$1000,INJECT_INF_CRAFTING)
alloc(INJECT_INF_CRAFTINGo, 8)
label(code)
label(return)
INJECT_INF_CRAFTINGo:
readmem(INJECT_INF_CRAFTING, 8)
//int __thiscall RemoveItemTypeWithAmount(UInventory * this, FName param_1, TEnumAsByte<> param_2, int param_3)
//UInventory::RemoveItemTypeWithAmount(UInventory *this,FName param_1,TEnumAsByte<> param_2,int param_3)
newmem:
pushfq
cmp dword ptr [rsi+00000028], #63537
je set_tears
normal_items:
cmp ecx, 67
jae clear_subs
mov ecx, 67
jmp clear_subs
set_tears:
cmp ecx, #2111
jae clear_subs
mov ecx, #2111
//jmp clear_subs
clear_subs:
xor eax, eax
//jmp endp_pre
endp_pre:
popfq
code:
sub ecx,eax
//mov [rsi+0000019C],ecx
readmem(INJECT_INF_CRAFTING+2, 6)
jmp return
INJECT_INF_CRAFTING:
jmp newmem
nop 3
return:
registersymbol(INJECT_INF_CRAFTING)
registersymbol(INJECT_INF_CRAFTINGo)
[DISABLE]
INJECT_INF_CRAFTING:
//db 2B C8 89 8E 9C 01 00 00
readmem(INJECT_INF_CRAFTINGo, 8)
unregistersymbol(INJECT_INF_CRAFTING)
dealloc(newmem)
unregistersymbol(INJECT_INF_CRAFTINGo)
dealloc(INJECT_INF_CRAFTINGo)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4CBB145
ES2-Win64-Shipping.exe+4CBB124: 49 8B 34 36 - mov rsi,[r14+rsi]
ES2-Win64-Shipping.exe+4CBB128: 48 85 F6 - test rsi,rsi
ES2-Win64-Shipping.exe+4CBB12B: 74 5E - je ES2-Win64-Shipping.exe+4CBB18B
ES2-Win64-Shipping.exe+4CBB12D: 48 39 7E 28 - cmp [rsi+28],rdi
ES2-Win64-Shipping.exe+4CBB131: 75 58 - jne ES2-Win64-Shipping.exe+4CBB18B
ES2-Win64-Shipping.exe+4CBB133: 8B 8E 9C 01 00 00 - mov ecx,[rsi+0000019C]
ES2-Win64-Shipping.exe+4CBB139: 41 8B C7 - mov eax,r15d
ES2-Win64-Shipping.exe+4CBB13C: 41 3B CF - cmp ecx,r15d
ES2-Win64-Shipping.exe+4CBB13F: 0F 4C C1 - cmovl eax,ecx
ES2-Win64-Shipping.exe+4CBB142: 44 2B F8 - sub r15d,eax
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4CBB145: 2B C8 - sub ecx,eax
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4CBB147: 89 8E 9C 01 00 00 - mov [rsi+0000019C],ecx
ES2-Win64-Shipping.exe+4CBB14D: 75 37 - jne ES2-Win64-Shipping.exe+4CBB186
ES2-Win64-Shipping.exe+4CBB14F: 49 8B 04 24 - mov rax,[r12]
ES2-Win64-Shipping.exe+4CBB153: 49 C7 04 06 00 00 00 00 - mov qword ptr [r14+rax],00000000
ES2-Win64-Shipping.exe+4CBB15B: 80 FB 0A - cmp bl,0A
ES2-Win64-Shipping.exe+4CBB15E: 74 26 - je ES2-Win64-Shipping.exe+4CBB186
ES2-Win64-Shipping.exe+4CBB160: E8 DB 5F EC FF - call ES2-Win64-Shipping.exe+4B81140
ES2-Win64-Shipping.exe+4CBB165: 49 3B C5 - cmp rax,r13
ES2-Win64-Shipping.exe+4CBB168: 75 1C - jne ES2-Win64-Shipping.exe+4CBB186
ES2-Win64-Shipping.exe+4CBB16A: 48 8B CE - mov rcx,rsi
}
136
"inf. cloak field timer"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-12
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_INF_EN_SPHERE_TIMER,$process,F3 0F 5C C8 F3 0F 11 0C 06) // should be unique
alloc(newmem,$1000,INJECT_INF_EN_SPHERE_TIMER)
label(code)
label(return en_timer_enabled)
//void __thiscall TickComponent(UConditionBaseComponent * this, float param_1, ELevelTick param_2, FActorComponentTickFunction * param_3)
//UConditionBaseComponent::TickComponent(UConditionBaseComponent *this,float param_1,ELevelTick param_2, FActorComponentTickFunction *param_3)
newmem:
vmovss xmm15, [vf_15]
vucomiss xmm1, xmm15
je no_dec
vmovss xmm15, [vf_8]
vucomiss xmm1, xmm15
je no_dec
jmp chk_en_sphere
no_dec:
vxorps xmm0, xmm0, xmm0
jmp code
//movss xmm0, [vf_60]
//movss [rsi+rax], xmm0
//vxorps xmm0, xmm0, xmm0
//movaps [rsp+00000140], xmm0
//movaps [rsp+00000150], xmm0
//movaps [rsp+00000160], xmm0
chk_en_sphere:
cmp dword ptr [en_timer_enabled], 0
je code
vxorps xmm0, xmm0, xmm0
movss xmm1, [vf_120]
mov dword ptr [en_timer_enabled], 0
code:
subss xmm1,xmm0
movss [rsi+rax],xmm1
jmp return
align 10 cc
vf_60:
dd (float)60
vf_15:
dd (float)15
vf_8:
dd (float)8
en_timer_enabled:
dd 0
vf_120:
dd (float)120
INJECT_INF_EN_SPHERE_TIMER:
jmp newmem
nop 4
return:
registersymbol(INJECT_INF_EN_SPHERE_TIMER en_timer_enabled)
[DISABLE]
INJECT_INF_EN_SPHERE_TIMER:
db F3 0F 5C C8 F3 0F 11 0C 06
unregistersymbol(INJECT_INF_EN_SPHERE_TIMER en_timer_enabled)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4986B8A
ES2-Win64-Shipping.exe+4986B59: F3 0F 10 35 0F B4 4D 02 - movss xmm6,[ES2-Win64-Shipping.exe+6E61F70]
ES2-Win64-Shipping.exe+4986B61: F3 44 0F 10 05 3E B3 4D 02 - movss xmm8,[ES2-Win64-Shipping.exe+6E61EA8]
ES2-Win64-Shipping.exe+4986B6A: 48 63 C7 - movsxd rax,edi
ES2-Win64-Shipping.exe+4986B6D: 48 6B F0 1C - imul rsi,rax,1C
ES2-Win64-Shipping.exe+4986B71: 48 8B 83 48 01 00 00 - mov rax,[rbx+00000148]
ES2-Win64-Shipping.exe+4986B78: F3 0F 10 0C 06 - movss xmm1,[rsi+rax]
ES2-Win64-Shipping.exe+4986B7D: 0F 2F CF - comiss xmm1,xmm7
ES2-Win64-Shipping.exe+4986B80: 72 24 - jb ES2-Win64-Shipping.exe+4986BA6
ES2-Win64-Shipping.exe+4986B82: 0F 28 C1 - movaps xmm0,xmm1
ES2-Win64-Shipping.exe+4986B85: F3 41 0F 5D C2 - minss xmm0,xmm10
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4986B8A: F3 0F 5C C8 - subss xmm1,xmm0
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4986B8E: F3 0F 11 0C 06 - movss [rsi+rax],xmm1
ES2-Win64-Shipping.exe+4986B93: 0F 54 CE - andps xmm1,xmm6
ES2-Win64-Shipping.exe+4986B96: 41 0F 2F C8 - comiss xmm1,xmm8
ES2-Win64-Shipping.exe+4986B9A: 77 0A - ja ES2-Win64-Shipping.exe+4986BA6
ES2-Win64-Shipping.exe+4986B9C: 8B D7 - mov edx,edi
ES2-Win64-Shipping.exe+4986B9E: 48 8B CB - mov rcx,rbx
ES2-Win64-Shipping.exe+4986BA1: E8 1A 6E FF FF - call ES2-Win64-Shipping.exe+497D9C0
ES2-Win64-Shipping.exe+4986BA6: 48 83 EE 1C - sub rsi,1C
ES2-Win64-Shipping.exe+4986BAA: 83 EF 01 - sub edi,01
ES2-Win64-Shipping.exe+4986BAD: 79 C2 - jns ES2-Win64-Shipping.exe+4986B71
}
137
"Caution: affects other counters but not working on them "
8000FF
1
138
"incomplete / not full function scripts"
8000FF
1
140
"Only enable before grab sphere"
8000FF
1
141
"May affect to debuff timers"
8000FF
1
142
"Use these value to search new value in CE with "Double" type"
8000FF
1
139
"Try to get EN sphere timer value (not real address)"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-14
Author :
}
[ENABLE]
aobscanmodule(INJECT_TRY_TO_LOCK_EN_SPHERE,$process,5C 44 24 50 0F 28 74 24 20 0F 95 C1 48 03 C8 48 89 4B 20 48 8B 5C 24 40) // should be unique
alloc(newmem,$1000,INJECT_TRY_TO_LOCK_EN_SPHERE)
label(code)
label(return i_base_en_s_value_fake_addr i_base_en_s_value_fake_addr2)
//void __cdecl execSubtract_DoubleDouble(UObject * param_1, FFrame * param_2, void * param_3)
//C++: UKismetMathLibrary::execSubtract_DoubleDouble(UObject *param_1,FFrame *param_2,void *param_3)
newmem:
vmovss xmm15, [vf_7d5]
comiss xmm15, [rdi+8C]
ja chk_type2
cmp dword ptr [rdi+84], -1
jne chk_type2
movsd xmm15, [vd_7d5]
comisd xmm15, [rdi]
ja code
mov dword ptr [en_timer_enabled], 1
movsd xmm15, [vd_120]
movsd [rdi], xmm15
mov [i_base_en_s_value_fake_addr], rdi
jmp code
chk_type2:
jmp code
cmp qword ptr [i_base_en_s_value_fake_addr], 0
je code
cmp dword ptr [en_timer_enabled], 1
jne code
push r15
mov r15, [i_base_en_s_value_fake_addr]
movsd xmm15, [r15]
cmp r15, rdi
pop r15
je code
//jmp code
movsd xmm14, [rdi]
vsubsd xmm15, xmm15, xmm14
vxorps xmm14, xmm14, xmm14
vucomisd xmm15, xmm14
jb mul_minus
jmp after_mul
mul_minus:
vmovsd xmm14, [vd_m1]
vmulsd xmm15, xmm14, xmm15
after_mul:
vmovsd xmm14, [vd_003]
vucomisd xmm15, xmm14
ja code
movsd xmm15, [vd_7d5]
comisd xmm15, [rdi]
ja code
mov dword ptr [en_timer_enabled], 1
movsd xmm15, [vd_120]
movsd [rdi], xmm15
mov [i_base_en_s_value_fake_addr2], rdi
jmp code
code:
mov rbx,[rsp+40]
jmp return
align 10 cc
i_base_en_s_value_fake_addr:
dq 0
i_base_en_s_value_fake_addr2:
dq 0
vf_7d5:
dd (float)7.5
dd 0
vd_7d5:
dq (double)7.5
vd_120:
dq (double)120
vd_30:
dq (double)30
vf_1:
dd (float)1
vd_003:
dq (double)0.09
vd_m1:
dq (double)-1
INJECT_TRY_TO_LOCK_EN_SPHERE+13:
jmp newmem
return:
registersymbol(INJECT_TRY_TO_LOCK_EN_SPHERE i_base_en_s_value_fake_addr i_base_en_s_value_fake_addr2)
[DISABLE]
{$lua}
if syntaxcheck then return end
local adr1 = getAddressSafe('en_timer_enabled')
writeInteger(adr1, 0)
{$asm}
INJECT_TRY_TO_LOCK_EN_SPHERE+13:
db 48 8B 5C 24 40
unregistersymbol(INJECT_TRY_TO_LOCK_EN_SPHERE i_base_en_s_value_fake_addr i_base_en_s_value_fake_addr2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+398C1CE
ES2-Win64-Shipping.exe+398C1A5: E8 16 17 B3 FD - call ES2-Win64-Shipping.exe+14BD8C0
ES2-Win64-Shipping.exe+398C1AA: 48 8B 43 20 - mov rax,[rbx+20]
ES2-Win64-Shipping.exe+398C1AE: 33 C9 - xor ecx,ecx
ES2-Win64-Shipping.exe+398C1B0: F2 0F 10 44 24 48 - movsd xmm0,[rsp+48]
ES2-Win64-Shipping.exe+398C1B6: 48 85 C0 - test rax,rax
ES2-Win64-Shipping.exe+398C1B9: F2 0F 5C 44 24 50 - subsd xmm0,[rsp+50]
ES2-Win64-Shipping.exe+398C1BF: 0F 28 74 24 20 - movaps xmm6,[rsp+20]
ES2-Win64-Shipping.exe+398C1C4: 0F 95 C1 - setne cl
ES2-Win64-Shipping.exe+398C1C7: 48 03 C8 - add rcx,rax
ES2-Win64-Shipping.exe+398C1CA: 48 89 4B 20 - mov [rbx+20],rcx
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+398C1CE: 48 8B 5C 24 40 - mov rbx,[rsp+40]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+398C1D3: F2 0F 11 07 - movsd [rdi],xmm0
ES2-Win64-Shipping.exe+398C1D7: 48 83 C4 30 - add rsp,30
ES2-Win64-Shipping.exe+398C1DB: 5F - pop rdi
ES2-Win64-Shipping.exe+398C1DC: C3 - ret
ES2-Win64-Shipping.exe+398C1DD: CC - int 3
ES2-Win64-Shipping.exe+398C1DE: CC - int 3
ES2-Win64-Shipping.exe+398C1DF: CC - int 3
ES2-Win64-Shipping.exe+398C1E0: 48 89 5C 24 08 - mov [rsp+08],rbx
ES2-Win64-Shipping.exe+398C1E5: 48 89 74 24 20 - mov [rsp+20],rsi
ES2-Win64-Shipping.exe+398C1EA: 57 - push rdi
}
143
"Value"
0
FF8080
Double
i_base_en_s_value_fake_addr
0
185
"Try to get racing timer (not real address)"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-16
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_RACING_FAKE_TIMER,$process,58 44 24 50 0F 28 74 24 20) // should be unique
alloc(newmem,$1000,INJECT_GET_RACING_FAKE_TIMER)
label(code)
label(return i_base_rtimer_addr_fake)
//void __cdecl execAdd_DoubleDouble(UObject * param_1, FFrame * param_2, void * param_3)
//C++: UKismetMathLibrary::execAdd_DoubleDouble(UObject *param_1,FFrame *param_2,void *param_3)
newmem:
pushfq
cmp dword ptr [rdi+8], 0
jne endp_p1
cmp qword ptr [rdi+10], 0
jne endp_p1
cmp qword ptr [rdi+30], 0
jne endp_p1
cmp dword ptr [rdi+C], 0
je endp_p1
cmp dword ptr [rdi+1C], 0
je endp_p1
cmp dword ptr [rdi+20], 0
je endp_p1
cmp dword ptr [rdi+84], 0
jne endp_p1
cmp dword ptr [rdi+8C], 0
jne endp_p1
mov [i_base_rtimer_addr_fake], rdi
endp_p1:
popfq
code:
movaps xmm6,[rsp+20]
jmp return
align 10 cc
i_base_rtimer_addr_fake:
dq 0
INJECT_GET_RACING_FAKE_TIMER+04:
jmp newmem
return:
registersymbol(INJECT_GET_RACING_FAKE_TIMER i_base_rtimer_addr_fake)
[DISABLE]
INJECT_GET_RACING_FAKE_TIMER+04:
db 0F 28 74 24 20
unregistersymbol(INJECT_GET_RACING_FAKE_TIMER i_base_rtimer_addr_fake)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+39321DF
ES2-Win64-Shipping.exe+39321AE: 4C 8B 83 88 00 00 00 - mov r8,[rbx+00000088]
ES2-Win64-Shipping.exe+39321B5: 48 8D 54 24 48 - lea rdx,[rsp+48]
ES2-Win64-Shipping.exe+39321BA: 49 8B 40 18 - mov rax,[r8+18]
ES2-Win64-Shipping.exe+39321BE: 48 89 83 88 00 00 00 - mov [rbx+00000088],rax
ES2-Win64-Shipping.exe+39321C5: E8 F6 B6 B8 FD - call ES2-Win64-Shipping.exe+14BD8C0
ES2-Win64-Shipping.exe+39321CA: 48 8B 43 20 - mov rax,[rbx+20]
ES2-Win64-Shipping.exe+39321CE: 33 C9 - xor ecx,ecx
ES2-Win64-Shipping.exe+39321D0: F2 0F 10 44 24 48 - movsd xmm0,[rsp+48]
ES2-Win64-Shipping.exe+39321D6: 48 85 C0 - test rax,rax
ES2-Win64-Shipping.exe+39321D9: F2 0F 58 44 24 50 - addsd xmm0,[rsp+50]
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+39321DF: 0F 28 74 24 20 - movaps xmm6,[rsp+20]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+39321E4: 0F 95 C1 - setne cl
ES2-Win64-Shipping.exe+39321E7: 48 03 C8 - add rcx,rax
ES2-Win64-Shipping.exe+39321EA: 48 89 4B 20 - mov [rbx+20],rcx
ES2-Win64-Shipping.exe+39321EE: 48 8B 5C 24 40 - mov rbx,[rsp+40]
ES2-Win64-Shipping.exe+39321F3: F2 0F 11 07 - movsd [rdi],xmm0
ES2-Win64-Shipping.exe+39321F7: 48 83 C4 30 - add rsp,30
ES2-Win64-Shipping.exe+39321FB: 5F - pop rdi
ES2-Win64-Shipping.exe+39321FC: C3 - ret
ES2-Win64-Shipping.exe+39321FD: CC - int 3
ES2-Win64-Shipping.exe+39321FE: CC - int 3
}
186
"Time (not real address)"
0
FF8080
Double
i_base_rtimer_addr_fake
0
191
"Try to get detonator countdown (astorid / not real address)"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-18
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_DETONATOR_TIMER_FAKE,$process,5C 44 24 50 0F 28 74 24 20) // should be unique
alloc(newmem,$1000,INJECT_DETONATOR_TIMER_FAKE)
label(code)
label(return i_base_deto_addr_fake)
//void __cdecl execSubtract_DoubleDouble(UObject * param_1, FFrame * param_2, void * param_3)
newmem:
code:
movaps xmm6,[rsp+20]
{
KismetMathLibrary.gen.cpp:36614 (6)
14398c1b0 f2 0f 10 MOVSD XMM0 ,qword ptr [RSP + local_res10 ]
44 24 48
KismetMathLibrary.gen.cpp:36612 (3)
14398c1b6 48 85 c0 TEST RAX ,RAX
KismetMathLibrary.gen.cpp:36614 (6)
14398c1b9 f2 0f 5c SUBSD XMM0 ,qword ptr [RSP + local_res18 ]
44 24 50
KismetMathLibrary.gen.cpp:36616 (30)
==> 14398c1bf 0f 28 74 MOVAPS XMM6 ,xmmword ptr [RSP + local_18[0] ]
24 20
14398c1c4 0f 95 c1 SETNZ param_1
14398c1c7 48 03 c8 ADD param_1 ,RAX
}
pushfq
cmp dword ptr [rdi+8], 0
je endp
cmp dword ptr [rdi+C], 0
je endp
cmp dword ptr [rdi+10], 0
je endp
cmp dword ptr [rdi+14], 0
jne endp
cmp dword ptr [rdi+18], 0
je endp
cmp dword ptr [rdi+18], #25
ja endp
cmp dword ptr [rdi+28], #25
ja endp
cmp dword ptr [rdi+70], 0
je endp
//cmp dword ptr [rdi+84], 0
//jne endp
mov [i_base_deto_addr_fake], rdi
endp:
popfq
jmp return
align 10 cc
i_base_deto_addr_fake:
dq 0
INJECT_DETONATOR_TIMER_FAKE+04:
jmp newmem
return:
registersymbol(INJECT_DETONATOR_TIMER_FAKE i_base_deto_addr_fake)
[DISABLE]
INJECT_DETONATOR_TIMER_FAKE+04:
db 0F 28 74 24 20
unregistersymbol(INJECT_DETONATOR_TIMER_FAKE i_base_deto_addr_fake)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+398C1BF
ES2-Win64-Shipping.exe+398C18E: 4C 8B 83 88 00 00 00 - mov r8,[rbx+00000088]
ES2-Win64-Shipping.exe+398C195: 48 8D 54 24 50 - lea rdx,[rsp+50]
ES2-Win64-Shipping.exe+398C19A: 49 8B 40 18 - mov rax,[r8+18]
ES2-Win64-Shipping.exe+398C19E: 48 89 83 88 00 00 00 - mov [rbx+00000088],rax
ES2-Win64-Shipping.exe+398C1A5: E8 16 17 B3 FD - call ES2-Win64-Shipping.exe+14BD8C0
ES2-Win64-Shipping.exe+398C1AA: 48 8B 43 20 - mov rax,[rbx+20]
ES2-Win64-Shipping.exe+398C1AE: 33 C9 - xor ecx,ecx
ES2-Win64-Shipping.exe+398C1B0: F2 0F 10 44 24 48 - movsd xmm0,[rsp+48]
ES2-Win64-Shipping.exe+398C1B6: 48 85 C0 - test rax,rax
ES2-Win64-Shipping.exe+398C1B9: F2 0F 5C 44 24 50 - subsd xmm0,[rsp+50]
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+398C1BF: 0F 28 74 24 20 - movaps xmm6,[rsp+20]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+398C1C4: 0F 95 C1 - setne cl
ES2-Win64-Shipping.exe+398C1C7: 48 03 C8 - add rcx,rax
ES2-Win64-Shipping.exe+398C1CA: 48 89 4B 20 - mov [rbx+20],rcx
ES2-Win64-Shipping.exe+398C1CE: 48 8B 5C 24 40 - mov rbx,[rsp+40]
ES2-Win64-Shipping.exe+398C1D3: F2 0F 11 07 - movsd [rdi],xmm0
ES2-Win64-Shipping.exe+398C1D7: 48 83 C4 30 - add rsp,30
ES2-Win64-Shipping.exe+398C1DB: 5F - pop rdi
ES2-Win64-Shipping.exe+398C1DC: C3 - ret
ES2-Win64-Shipping.exe+398C1DD: CC - int 3
ES2-Win64-Shipping.exe+398C1DE: CC - int 3
}
192
"Value"
0
FF8080
Double
i_base_deto_addr_fake
0
144
"Fast device cooldown"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-13
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_FAST_COOLDOWN,$process,F3 0F 11 00 48 8B 0E 0F) // should be unique
alloc(newmem,$1000,INJECT_FAST_COOLDOWN)
label(code)
label(return)
//void __thiscall Tick(ADeviceBase * this, float param_1)
//C++: void __thiscall ADeviceBase::Tick(ADeviceBase *this,float param_1)
newmem:
vmovss xmm15, [vf_05]
vucomiss xmm0, xmm15
jbe code
movss xmm0, xmm15
code:
movss [rax],xmm0
mov rcx,[rsi]
jmp return
align 10 cc
vf_05:
dd (float)0.5
INJECT_FAST_COOLDOWN:
jmp newmem
nop 2
return:
registersymbol(INJECT_FAST_COOLDOWN)
[DISABLE]
INJECT_FAST_COOLDOWN:
db F3 0F 11 00 48 8B 0E
unregistersymbol(INJECT_FAST_COOLDOWN)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4A0BF55
ES2-Win64-Shipping.exe+4A0BF25: E8 D6 95 FF FF - call ES2-Win64-Shipping.exe+4A05500
ES2-Win64-Shipping.exe+4A0BF2A: 83 BB E0 04 00 00 00 - cmp dword ptr [rbx+000004E0],00
ES2-Win64-Shipping.exe+4A0BF31: 7E 7B - jle ES2-Win64-Shipping.exe+4A0BFAE
ES2-Win64-Shipping.exe+4A0BF33: 48 89 74 24 58 - mov [rsp+58],rsi
ES2-Win64-Shipping.exe+4A0BF38: 0F 28 CF - movaps xmm1,xmm7
ES2-Win64-Shipping.exe+4A0BF3B: F3 0F 59 8B 70 04 00 00 - mulss xmm1,[rbx+00000470]
ES2-Win64-Shipping.exe+4A0BF43: 48 8D B3 D8 04 00 00 - lea rsi,[rbx+000004D8]
ES2-Win64-Shipping.exe+4A0BF4A: 48 8B 06 - mov rax,[rsi]
ES2-Win64-Shipping.exe+4A0BF4D: F3 0F 10 00 - movss xmm0,[rax]
ES2-Win64-Shipping.exe+4A0BF51: F3 0F 5C C1 - subss xmm0,xmm1
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4A0BF55: F3 0F 11 00 - movss [rax],xmm0
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4A0BF59: 48 8B 0E - mov rcx,[rsi]
ES2-Win64-Shipping.exe+4A0BF5C: 0F 2F 31 - comiss xmm6,[rcx]
ES2-Win64-Shipping.exe+4A0BF5F: 72 48 - jb ES2-Win64-Shipping.exe+4A0BFA9
ES2-Win64-Shipping.exe+4A0BF61: 8B 46 08 - mov eax,[rsi+08]
ES2-Win64-Shipping.exe+4A0BF64: 83 E8 01 - sub eax,01
ES2-Win64-Shipping.exe+4A0BF67: 74 10 - je ES2-Win64-Shipping.exe+4A0BF79
ES2-Win64-Shipping.exe+4A0BF69: 4C 63 C0 - movsxd r8,eax
ES2-Win64-Shipping.exe+4A0BF6C: 48 8D 51 04 - lea rdx,[rcx+04]
ES2-Win64-Shipping.exe+4A0BF70: 49 C1 E0 02 - shl r8,02
ES2-Win64-Shipping.exe+4A0BF74: E8 A3 15 27 02 - call ES2-Win64-Shipping.exe+6C7D51C
}
145
"dismantled item: keep material amount at least 10"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-12
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_DESTRUCT_ITEM,$process,01 91 ?? ?? 00 00 29 96) // should be unique
alloc(newmem,$1000,INJECT_DESTRUCT_ITEM)
alloc(INJECT_DESTRUCT_ITEMo, 6)
label(code)
label(return)
INJECT_DESTRUCT_ITEMo:
readmem(INJECT_DESTRUCT_ITEM, 6)
//int __thiscall AddItem(UInventory * this, UItem * param_1, TEnumAsByte<> param_2, int param_3, bool param_4, bool param_5)
//UInventory::AddItem(UInventory *this,UItem *param_1,TEnumAsByte<> param_2,int param_3,bool para m_4,bool param_5)
newmem:
push r15
db 4c 8d b9
readmem(INJECT_DESTRUCT_ITEM+2, 4)
cmp dword ptr [r15-174], #63537 //[rsi+28]
je set_crazy_tears
cmp dword ptr [r15], A
jae endp
mov dword ptr [r15], A
jmp endp
set_crazy_tears:
cmp dword ptr [r15], #2111
jae endp
mov dword ptr [r15], #2111
endp:
pop r15
code:
//add [rcx+0000019C],edx
readmem(INJECT_DESTRUCT_ITEM, 6)
jmp return
align 10 cc
INJECT_DESTRUCT_ITEM:
jmp newmem
nop
return:
registersymbol(INJECT_DESTRUCT_ITEM)
registersymbol(INJECT_DESTRUCT_ITEMo)
[DISABLE]
INJECT_DESTRUCT_ITEM:
//db 01 91 9C 01 00 00
readmem(INJECT_DESTRUCT_ITEMo, 6)
unregistersymbol(INJECT_DESTRUCT_ITEM)
dealloc(newmem)
unregistersymbol(INJECT_DESTRUCT_ITEMo)
dealloc(INJECT_DESTRUCT_ITEMo)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4C4146C
ES2-Win64-Shipping.exe+4C41448: 8B 81 0C 02 00 00 - mov eax,[rcx+0000020C]
ES2-Win64-Shipping.exe+4C4144E: 89 86 0C 02 00 00 - mov [rsi+0000020C],eax
ES2-Win64-Shipping.exe+4C41454: 41 8B C1 - mov eax,r9d
ES2-Win64-Shipping.exe+4C41457: 2B C2 - sub eax,edx
ES2-Win64-Shipping.exe+4C41459: 41 8B D2 - mov edx,r10d
ES2-Win64-Shipping.exe+4C4145C: 41 3B C2 - cmp eax,r10d
ES2-Win64-Shipping.exe+4C4145F: 0F 4C D0 - cmovl edx,eax
ES2-Win64-Shipping.exe+4C41462: 49 8B 06 - mov rax,[r14]
ES2-Win64-Shipping.exe+4C41465: 44 03 FA - add r15d,edx
ES2-Win64-Shipping.exe+4C41468: 4A 8B 0C C0 - mov rcx,[rax+r8*8]
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4C4146C: 01 91 9C 01 00 00 - add [rcx+0000019C],edx
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4C41472: 29 96 9C 01 00 00 - sub [rsi+0000019C],edx
ES2-Win64-Shipping.exe+4C41478: 44 2B D2 - sub r10d,edx
ES2-Win64-Shipping.exe+4C4147B: 74 0F - je ES2-Win64-Shipping.exe+4C4148C
ES2-Win64-Shipping.exe+4C4147D: FF C5 - inc ebp
ES2-Win64-Shipping.exe+4C4147F: 49 FF C0 - inc r8
ES2-Win64-Shipping.exe+4C41482: 41 3B 6E 08 - cmp ebp,[r14+08]
ES2-Win64-Shipping.exe+4C41486: 0F 8C 74 FF FF FF - jl ES2-Win64-Shipping.exe+4C41400
ES2-Win64-Shipping.exe+4C4148C: 45 85 FF - test r15d,r15d
ES2-Win64-Shipping.exe+4C4148F: 0F 8F 42 01 00 00 - jg ES2-Win64-Shipping.exe+4C415D7
ES2-Win64-Shipping.exe+4C41495: 80 7C 24 70 00 - cmp byte ptr [rsp+70],00
}
146
"material must be exist (non-zero)"
8000FF
1
147
"Get focused attribute value (Firepower/utility/resistance...)"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_ATTRS,$process,8B 00 48 8B 5C 24 30 48 83 C4 20 5F C3 CC CC CC CC 48 83) // should be unique
alloc(newmem,$1000,INJECT_GET_ATTRS)
label(code)
label(return i_base_attr_addr1 i_base_attr_addr2 i_base_attr_addr3 i_base_attr_addr4 i_base_attr_addr5 i_base_attr_addr6)
//int __thiscall GetAugmentLevel(UPlayerData * this, FName param_1)
//int __thiscall UPlayerData::GetAugmentLevel(UPlayerData *this,FName param_1)
newmem:
cmp [i_base_attr_addr1], rax
je code
cmp [i_base_attr_addr2], rax
je code
cmp [i_base_attr_addr3], rax
je code
cmp [i_base_attr_addr4], rax
je code
cmp [i_base_attr_addr5], rax
je code
cmp [i_base_attr_addr6], rax
je code
cmp dword ptr [i_base_attr_addr1], 0
je write1
cmp dword ptr [i_base_attr_addr2], 0
je write2
cmp dword ptr [i_base_attr_addr3], 0
je write3
cmp dword ptr [i_base_attr_addr4], 0
je write4
cmp dword ptr [i_base_attr_addr5], 0
je write5
cmp dword ptr [i_base_attr_addr6], 0
je write6
jmp code
write1:
mov [i_base_attr_addr1], rax
jmp code
write2:
mov [i_base_attr_addr2], rax
sort_1_2:
push r15
cmp rax, [i_base_attr_addr1]
ja @F
mov r15, [i_base_attr_addr1]
mov [i_base_attr_addr1], rax
mov [i_base_attr_addr2], r15
@@:
pop r15
jmp code
write3:
mov [i_base_attr_addr3], rax
sort_2_3:
push r15
cmp rax, [i_base_attr_addr2]
ja @F
mov r15, [i_base_attr_addr2]
mov [i_base_attr_addr2], rax
mov [i_base_attr_addr3], r15
@@:
pop r15
jmp sort_1_2
//jmp code
write4:
mov [i_base_attr_addr4], rax
sort_3_4:
push r15
cmp rax, [i_base_attr_addr3]
ja @F
mov r15, [i_base_attr_addr3]
mov [i_base_attr_addr3], rax
mov [i_base_attr_addr4], r15
@@:
pop r15
jmp sort_2_3
//jmp code
write5:
mov [i_base_attr_addr5], rax
sort_4_5:
push r15
cmp rax, [i_base_attr_addr4]
ja @F
mov r15, [i_base_attr_addr4]
mov [i_base_attr_addr4], rax
mov [i_base_attr_addr5], r15
@@:
pop r15
jmp sort_3_4
//jmp code
write6:
sort_5_6:
mov [i_base_attr_addr6], rax
push r15
cmp rax, [i_base_attr_addr5]
ja @F
mov r15, [i_base_attr_addr5]
mov [i_base_attr_addr5], rax
mov [i_base_attr_addr6], r15
@@:
pop r15
jmp sort_4_5
//jmp code
code:
mov eax,[rax] //return *piVar5;
mov rbx,[rsp+30]
jmp return
align 10 cc
i_base_attr_addr1:
dq 0
i_base_attr_addr2:
dq 0
i_base_attr_addr3:
dq 0
i_base_attr_addr4:
dq 0
i_base_attr_addr5:
dq 0
i_base_attr_addr6:
dq 0
align 100 0
db 0
INJECT_GET_ATTRS:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_ATTRS i_base_attr_addr1 i_base_attr_addr2 i_base_attr_addr3 i_base_attr_addr4 i_base_attr_addr5 i_base_attr_addr6)
[DISABLE]
INJECT_GET_ATTRS:
db 8B 00 48 8B 5C 24 30
unregistersymbol(INJECT_GET_ATTRS i_base_attr_addr1 i_base_attr_addr2 i_base_attr_addr3 i_base_attr_addr4 i_base_attr_addr5 i_base_attr_addr6)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4A589EF
ES2-Win64-Shipping.exe+4A589D4: 48 83 C4 20 - add rsp,20
ES2-Win64-Shipping.exe+4A589D8: 5F - pop rdi
ES2-Win64-Shipping.exe+4A589D9: C3 - ret
ES2-Win64-Shipping.exe+4A589DA: 48 8B C2 - mov rax,rdx
ES2-Win64-Shipping.exe+4A589DD: 33 D2 - xor edx,edx
ES2-Win64-Shipping.exe+4A589DF: 48 03 C1 - add rax,rcx
ES2-Win64-Shipping.exe+4A589E2: 48 8D 40 08 - lea rax,[rax+08]
ES2-Win64-Shipping.exe+4A589E6: 48 0F 44 C2 - cmove rax,rdx
ES2-Win64-Shipping.exe+4A589EA: 48 85 C0 - test rax,rax
ES2-Win64-Shipping.exe+4A589ED: 74 DE - je ES2-Win64-Shipping.exe+4A589CD
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4A589EF: 8B 00 - mov eax,[rax]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4A589F1: 48 8B 5C 24 30 - mov rbx,[rsp+30]
ES2-Win64-Shipping.exe+4A589F6: 48 83 C4 20 - add rsp,20
ES2-Win64-Shipping.exe+4A589FA: 5F - pop rdi
ES2-Win64-Shipping.exe+4A589FB: C3 - ret
ES2-Win64-Shipping.exe+4A589FC: CC - int 3
ES2-Win64-Shipping.exe+4A589FD: CC - int 3
ES2-Win64-Shipping.exe+4A589FE: CC - int 3
ES2-Win64-Shipping.exe+4A589FF: CC - int 3
ES2-Win64-Shipping.exe+4A58A00: 48 83 EC 28 - sub rsp,28
ES2-Win64-Shipping.exe+4A58A04: E8 47 FF FF FF - call ES2-Win64-Shipping.exe+4A58950
}
148
"Must be non-zero, can over than 5"
8000FF
1
149
"#1"
0
FF8080
4 Bytes
i_base_attr_addr1
0
150
"#2"
0
FF8080
4 Bytes
i_base_attr_addr2
0
151
"#3"
0
FF8080
4 Bytes
i_base_attr_addr3
0
152
"#4"
0
FF8080
4 Bytes
i_base_attr_addr4
0
153
"#5"
0
FF8080
4 Bytes
i_base_attr_addr5
0
154
"#6"
0
FF8080
4 Bytes
i_base_attr_addr6
0
155
"browse item & set some attributes"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_SET_SOME_ATTRS,$process,48 39 41 68 74 13) // should be unique
alloc(newmem,$1000,INJECT_SET_SOME_ATTRS)
label(code)
label(return)
//int __thiscall GetMaxStackAmount(UItem * this)
//int __thiscall UItem::GetMaxStackAmount(UItem *this)
newmem:
push r15
mov r15d, [rcx+68]
cmp r15d, #47674
je set_core_base
cmp r15d, #47704
je set_core_base
cmp r15d, #47733
je set_core_base
cmp r15d, #52789
je set_core_base
cmp r15d, #52819
je set_core_base
cmp r15d, #52848
je set_core_base
cmp r15d, #53048
je set_misc
cmp r15d, #53042
je set_misc
cmp r15d, #53054
je set_misc
cmp r15d, #53060
je set_misc
cmp r15d, #53065
je set_misc
cmp r15d, #53071
je set_misc
cmp r15d, #53342
je set_cargo
cmp r15d, #54400
je set_misc2
cmp r15d, #54514
je set_misc3
// shield
cmp r15d, #53034
je set_shield_base1
cmp r15d, #47835 //shield recharge delay
je set_shield_base1
cmp r15d, #52950 //shield recharge delay
je set_shield_base1
cmp r15d, #47861 //shield shutdown duration
je set_shield_base1
cmp r15d, #52976 //shield shutdown duration
je set_shield_base1
cmp r15d, #52904
je set_shield_base2
cmp r15d, #52924
je set_booster3
cmp r15d, #47809 //X shield recharge speed
je set_booster3
cmp r15d, #53024
je set_shield_base2
//booster
cmp r15d, #53084
je set_booster1
cmp r15d, #53158
je set_booster2
cmp r15d, #53094
je set_booster3
cmp r15d, #53110
je set_booster4
cmp r15d, #53133
je set_booster5
cmp r15d, #53265
je set_booster6
//radar
cmp r15d, #54432
je set_radar1
cmp r15d, #54455
je set_radar2
cmp r15d, #54477
je set_radar2
cmp r15d, #57311
je set_radar3
// others
cmp r15d, #53397
je set_weapon1
cmp r15d, #53420
je set_weapon1
cmp r15d, #53445
je set_fire_range
cmp r15d, #48330
je set_fire_range
cmp r15d, #54255
je set_debuff2e_value
cmp r15d, #54282
je set_debuff2e_range
cmp r15d, #53487 // fire speed
je set_firespeed
cmp r15d, #54387 // lockon time
je set_lockontime
cmp r15d, #57551 // damage +% to high lv enemy
je set_dmg_to_high_enemy
jmp endp
set_core_base:
mov r15d, (float)65850000
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_cargo:
mov [rcx+70], (float)200
jmp endp
set_shield_base1:
mov r15d, (float)0.5
movd xmm15, r15d
comiss xmm15, [rcx+70]
jae endp
movss [rcx+70], xmm15
jmp endp
set_shield_base2:
mov r15d, (float)75000000
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_booster1:
mov r15d, (float)0.66
movd xmm15, r15d
comiss xmm15, [rcx+70]
jae endp
movss [rcx+70], xmm15
jmp endp
set_booster2:
mov r15d, (float)592117952
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_booster3:
mov r15d, (float)8.27
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_booster4:
mov r15d, (float)3.34
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_booster5:
mov [rcx+70], (float)2.567
jmp endp
set_booster6:
mov r15d, (float)100000
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_radar1:
mov r15d, (float)1754218
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_radar2:
mov [rcx+70], (float)755000
jmp endp
set_radar3:
mov [rcx+70], (float)0.1
jmp endp
set_weapon1:
mov r15d, (float)19000000
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_misc:
mov r15d, (float)8500
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_misc2:
mov r15d, (float)120000
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_misc3:
mov r15d, (float)760000
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_fire_range: // weapon range
mov [rcx+70], (float)1020000
jmp endp
set_debuff2e_value:
mov r15d, (float)3600
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_debuff2e_range:
mov r15d, (float)92345
movd xmm15, r15d
comiss xmm15, [rcx+70]
jbe endp
movss [rcx+70], xmm15
jmp endp
set_firespeed:
vmovss xmm15, [vf_1d5]
ucomiss xmm15, dword ptr [rcx+70]
jbe @F
vmovss xmm15, [vf_4]
vmovss [rcx+70], xmm15
@@:
jmp endp
set_lockontime:
mov r15d, (float)0.5
movd xmm15, r15d
comiss xmm15, [rcx+70]
jae endp
movss [rcx+70], xmm15
jmp endp
set_dmg_to_high_enemy:
mov [rcx+70], (float)3.5
jmp endp
endp:
pop r15
code:
cmp [rcx+68],rax
reassemble(INJECT_SET_SOME_ATTRS+4)
//je ES2-Win64-Shipping.exe+4C4B5B1
jmp return
align 10 cc
vf_02:
dd (float)0.200000003
vf_1d5:
dd (float)1.5
vf_4:
dd (float)4
INJECT_SET_SOME_ATTRS:
jmp newmem
nop
return:
registersymbol(INJECT_SET_SOME_ATTRS)
[DISABLE]
INJECT_SET_SOME_ATTRS:
db 48 39 41 68 74 13
unregistersymbol(INJECT_SET_SOME_ATTRS)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4C4B598
ES2-Win64-Shipping.exe+4C4B574: 48 8B 51 68 - mov rdx,[rcx+68]
ES2-Win64-Shipping.exe+4C4B578: 48 63 41 70 - movsxd rax,dword ptr [rcx+70]
ES2-Win64-Shipping.exe+4C4B57C: 4C 8D 04 C2 - lea r8,[rdx+rax*8]
ES2-Win64-Shipping.exe+4C4B580: 49 3B D0 - cmp rdx,r8
ES2-Win64-Shipping.exe+4C4B583: 74 22 - je ES2-Win64-Shipping.exe+4C4B5A7
ES2-Win64-Shipping.exe+4C4B585: 48 8B 05 D4 F3 8F 04 - mov rax,[ES2-Win64-Shipping.exe+954A960]
ES2-Win64-Shipping.exe+4C4B58C: 0F 1F 40 00 - nop dword ptr [rax+00]
ES2-Win64-Shipping.exe+4C4B590: 48 8B 0A - mov rcx,[rdx]
ES2-Win64-Shipping.exe+4C4B593: 48 85 C9 - test rcx,rcx
ES2-Win64-Shipping.exe+4C4B596: 74 06 - je ES2-Win64-Shipping.exe+4C4B59E
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4C4B598: 48 39 41 68 - cmp [rcx+68],rax
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4C4B59C: 74 13 - je ES2-Win64-Shipping.exe+4C4B5B1
ES2-Win64-Shipping.exe+4C4B59E: 48 83 C2 08 - add rdx,08
ES2-Win64-Shipping.exe+4C4B5A2: 49 3B D0 - cmp rdx,r8
ES2-Win64-Shipping.exe+4C4B5A5: 75 E9 - jne ES2-Win64-Shipping.exe+4C4B590
ES2-Win64-Shipping.exe+4C4B5A7: B8 01 00 00 00 - mov eax,00000001
ES2-Win64-Shipping.exe+4C4B5AC: 48 83 C4 28 - add rsp,28
ES2-Win64-Shipping.exe+4C4B5B0: C3 - ret
ES2-Win64-Shipping.exe+4C4B5B1: 48 89 5C 24 20 - mov [rsp+20],rbx
ES2-Win64-Shipping.exe+4C4B5B6: 48 8D 59 70 - lea rbx,[rcx+70]
ES2-Win64-Shipping.exe+4C4B5BA: 80 7B 34 00 - cmp byte ptr [rbx+34],00
}
156
"Warning: backup you saves before using this"
8000FF
1
157
"Get Mainframe Expansions"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_MAINFRAME,$process,03 BA ?? ?? 00 00 48 83 C1 08) // should be unique
alloc(newmem,$1000,INJECT_GET_MAINFRAME)
alloc(INJECT_GET_MAINFRAMEo, 6)
INJECT_GET_MAINFRAMEo:
readmem(INJECT_GET_MAINFRAME, 6)
label(code)
label(return i_base_mf_addr i_base_mf_offset)
//int __thiscall GetAmountOfItems(UInventory * this, FName param_1, TEnumAsByte<> param_2)
//int __thiscall UInventory::GetAmountOfItems(UInventory *this,FName param_1,TEnumAsByte<> param_ 2)
newmem:
mov [i_base_mf_addr], rdx
push r15
xor r15, r15
db 49 C7 C7
readmem(INJECT_GET_MAINFRAME+2, 4)
mov [i_base_mf_offset], r15
pop r15
code:
//add edi,[rdx+0000019C] //iVar5 = iVar5 + *(int *)(lVar2 + 0x19c);
readmem(INJECT_GET_MAINFRAME, 6)
jmp return
align 10 cc
i_base_mf_addr:
dq 0
i_base_mf_offset:
dq 0
INJECT_GET_MAINFRAME:
jmp newmem
nop
return:
registersymbol(INJECT_GET_MAINFRAME i_base_mf_addr i_base_mf_offset)
registersymbol(INJECT_GET_MAINFRAMEo)
[DISABLE]
INJECT_GET_MAINFRAME:
//db 03 BA 9C 01 00 00
readmem(INJECT_GET_MAINFRAMEo, 6)
unregistersymbol(INJECT_GET_MAINFRAME i_base_mf_addr i_base_mf_offset)
dealloc(newmem)
unregistersymbol(INJECT_GET_MAINFRAMEo)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4C477D6
ES2-Win64-Shipping.exe+4C477B8: 48 8B 08 - mov rcx,[rax]
ES2-Win64-Shipping.exe+4C477BB: 48 63 40 08 - movsxd rax,dword ptr [rax+08]
ES2-Win64-Shipping.exe+4C477BF: 4C 8D 04 C1 - lea r8,[rcx+rax*8]
ES2-Win64-Shipping.exe+4C477C3: 49 3B C8 - cmp rcx,r8
ES2-Win64-Shipping.exe+4C477C6: 74 1D - je ES2-Win64-Shipping.exe+4C477E5
ES2-Win64-Shipping.exe+4C477C8: 48 8B 11 - mov rdx,[rcx]
ES2-Win64-Shipping.exe+4C477CB: 48 85 D2 - test rdx,rdx
ES2-Win64-Shipping.exe+4C477CE: 74 0C - je ES2-Win64-Shipping.exe+4C477DC
ES2-Win64-Shipping.exe+4C477D0: 48 39 5A 28 - cmp [rdx+28],rbx
ES2-Win64-Shipping.exe+4C477D4: 75 06 - jne ES2-Win64-Shipping.exe+4C477DC
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4C477D6: 03 BA 9C 01 00 00 - add edi,[rdx+0000019C]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4C477DC: 48 83 C1 08 - add rcx,08
ES2-Win64-Shipping.exe+4C477E0: 49 3B C8 - cmp rcx,r8
ES2-Win64-Shipping.exe+4C477E3: 75 E3 - jne ES2-Win64-Shipping.exe+4C477C8
ES2-Win64-Shipping.exe+4C477E5: 48 8B 5C 24 30 - mov rbx,[rsp+30]
ES2-Win64-Shipping.exe+4C477EA: 8B C7 - mov eax,edi
ES2-Win64-Shipping.exe+4C477EC: 48 83 C4 20 - add rsp,20
ES2-Win64-Shipping.exe+4C477F0: 5F - pop rdi
ES2-Win64-Shipping.exe+4C477F1: C3 - ret
ES2-Win64-Shipping.exe+4C477F2: CC - int 3
ES2-Win64-Shipping.exe+4C477F3: CC - int 3
}
158
"Must be non 0"
8000FF
1
159
"Stock"
0
FF8080
4 Bytes
i_base_mf_addr
[i_base_mf_offset]
160
"_not working"
808080
1
161
"_debug"
808080
1
162
"UE5 init."
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-10
Author : bbfox@https://opencheattablesc.om
}
[ENABLE]
aobscanmodule(INJECT_GET_PLAYER_CTRL_ADDR,$process,56 41 54 48 8D 6C 24 88) // should be unique
alloc(newmem,$1000,INJECT_GET_PLAYER_CTRL_ADDR)
label(code)
label(return i_base_player_ctrl_addr)
//void __thiscall TickPlayerInput()
newmem:
mov [i_base_player_ctrl_addr], rcx
code:
lea rbp,[rsp-78]
jmp return
align 10 cc
i_base_player_ctrl_addr:
dq 0
INJECT_GET_PLAYER_CTRL_ADDR+03:
jmp newmem
return:
registersymbol(INJECT_GET_PLAYER_CTRL_ADDR i_base_player_ctrl_addr)
[DISABLE]
INJECT_GET_PLAYER_CTRL_ADDR+03:
db 48 8D 6C 24 88
unregistersymbol(INJECT_GET_PLAYER_CTRL_ADDR i_base_player_ctrl_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+3C22E76
ES2-Win64-Shipping.exe+3C22E6A: CC - int 3
ES2-Win64-Shipping.exe+3C22E6B: CC - int 3
ES2-Win64-Shipping.exe+3C22E6C: CC - int 3
ES2-Win64-Shipping.exe+3C22E6D: CC - int 3
ES2-Win64-Shipping.exe+3C22E6E: CC - int 3
ES2-Win64-Shipping.exe+3C22E6F: CC - int 3
ES2-Win64-Shipping.exe+3C22E70: 40 55 - push rbp
ES2-Win64-Shipping.exe+3C22E72: 53 - push rbx
ES2-Win64-Shipping.exe+3C22E73: 56 - push rsi
ES2-Win64-Shipping.exe+3C22E74: 41 54 - push r12
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+3C22E76: 48 8D 6C 24 88 - lea rbp,[rsp-78]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+3C22E7B: 48 81 EC 78 01 00 00 - sub rsp,00000178
ES2-Win64-Shipping.exe+3C22E82: 48 8B F1 - mov rsi,rcx
ES2-Win64-Shipping.exe+3C22E85: 0F 29 B4 24 60 01 00 00 - movaps [rsp+00000160],xmm6
ES2-Win64-Shipping.exe+3C22E8D: 48 8B 89 08 04 00 00 - mov rcx,[rcx+00000408]
ES2-Win64-Shipping.exe+3C22E94: 45 0F B6 E0 - movzx r12d,r8b
ES2-Win64-Shipping.exe+3C22E98: 0F 28 F1 - movaps xmm6,xmm1
ES2-Win64-Shipping.exe+3C22E9B: E8 C0 5F 2C 00 - call ES2-Win64-Shipping.exe+3EE8E60
ES2-Win64-Shipping.exe+3C22EA0: 48 83 BE 30 03 00 00 00 - cmp qword ptr [rsi+00000330],00
ES2-Win64-Shipping.exe+3C22EA8: 0F 84 39 02 00 00 - je ES2-Win64-Shipping.exe+3C230E7
ES2-Win64-Shipping.exe+3C22EAE: E8 0D D0 D9 FF - call ES2-Win64-Shipping.exe+39BFEC0
}
163
"p.controller"
1
0
808080
8 Bytes
i_base_player_ctrl_addr
164
"Pawn"
1
0
808080
8 Bytes
i_base_player_ctrl_addr
2D0
165
"controller.vtable"
1
0
808080
8 Bytes
i_base_player_ctrl_addr
328
166
"PlayerState"
1
0
808080
8 Bytes
i_base_player_ctrl_addr
298
167
"PlayerState (static)"
1
0
808080
8 Bytes
ES2-Win64-Shipping.exe+7855DB8
168
"Get AESPawn"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-13
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_AESPAWN,ES2-Win64-Shipping.exe,49 8B 4E 10 48 83 C0 30 48 63 50 08 3B 51 38 7F ?? 48 8B 49 30 48 39 04 D1 75 ?? 49 8B 86 ?? 0? 00 00 48 89 44 24 78) // should be unique
alloc(newmem,$1000,INJECT_GET_AESPAWN)
label(code)
label(return i_base_aespawn_addr)
newmem:
mov [i_base_aespawn_addr], r14
code:
mov rcx,[r14+10]
add rax,30
jmp return
align 10 cc
i_base_aespawn_addr:
dq 0
INJECT_GET_AESPAWN:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_AESPAWN i_base_aespawn_addr)
[DISABLE]
INJECT_GET_AESPAWN:
db 49 8B 4E 10 48 83 C0 30
unregistersymbol(INJECT_GET_AESPAWN i_base_aespawn_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+4A39A63
ES2-Win64-Shipping.exe+4A39A3B: B9 08 00 00 00 - mov ecx,00000008
ES2-Win64-Shipping.exe+4A39A40: F3 0F 11 45 78 - movss [rbp+78],xmm0
ES2-Win64-Shipping.exe+4A39A45: E8 66 3A F6 FF - call ES2-Win64-Shipping.exe+499D4B0
ES2-Win64-Shipping.exe+4A39A4A: 49 8B CF - mov rcx,r15
ES2-Win64-Shipping.exe+4A39A4D: 48 89 45 70 - mov [rbp+70],rax
ES2-Win64-Shipping.exe+4A39A51: E8 4A 0C E9 FE - call ES2-Win64-Shipping.exe+38CA6A0
ES2-Win64-Shipping.exe+4A39A56: 4C 8B F0 - mov r14,rax
ES2-Win64-Shipping.exe+4A39A59: 48 85 C0 - test rax,rax
ES2-Win64-Shipping.exe+4A39A5C: 74 3F - je ES2-Win64-Shipping.exe+4A39A9D
ES2-Win64-Shipping.exe+4A39A5E: E8 9D 03 E5 FF - call ES2-Win64-Shipping.exe+4889E00
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+4A39A63: 49 8B 4E 10 - mov rcx,[r14+10]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+4A39A67: 48 83 C0 30 - add rax,30
ES2-Win64-Shipping.exe+4A39A6B: 48 63 50 08 - movsxd rdx,dword ptr [rax+08]
ES2-Win64-Shipping.exe+4A39A6F: 3B 51 38 - cmp edx,[rcx+38]
ES2-Win64-Shipping.exe+4A39A72: 7F 29 - jg ES2-Win64-Shipping.exe+4A39A9D
ES2-Win64-Shipping.exe+4A39A74: 48 8B 49 30 - mov rcx,[rcx+30]
ES2-Win64-Shipping.exe+4A39A78: 48 39 04 D1 - cmp [rcx+rdx*8],rax
ES2-Win64-Shipping.exe+4A39A7C: 75 1F - jne ES2-Win64-Shipping.exe+4A39A9D
ES2-Win64-Shipping.exe+4A39A7E: 49 8B 86 70 03 00 00 - mov rax,[r14+00000370]
ES2-Win64-Shipping.exe+4A39A85: 48 89 44 24 78 - mov [rsp+78],rax
ES2-Win64-Shipping.exe+4A39A8A: 48 85 C0 - test rax,rax
}
169
"addr"
1
0
808080
8 Bytes
i_base_aespawn_addr
170
"Pawn.CanBeDamaged"
0
FF8080
Binary
2
1
0
i_base_aespawn_addr
5A
171
"init. 2"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-11
Author :
}
[ENABLE]
aobscanmodule(INJECT_GET_PCONTROLLER_VTABLE,$process,48 89 83 28 03 00 00 48 8D) // should be unique
alloc(newmem,$1000,INJECT_GET_PCONTROLLER_VTABLE)
label(code)
label(return i_base_pc_vtable_addr i_base_actor_vtable_addr)
newmem:
mov [i_base_pc_vtable_addr], rax
push r15
mov r15, [rbx]
mov [i_base_actor_vtable_addr], r15
pop r15
code:
mov [rbx+00000328],rax
jmp return
align 10 cc
i_base_pc_vtable_addr:
dq 0
i_base_actor_vtable_addr:
dq 0
INJECT_GET_PCONTROLLER_VTABLE:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_PCONTROLLER_VTABLE i_base_pc_vtable_addr i_base_actor_vtable_addr)
[DISABLE]
INJECT_GET_PCONTROLLER_VTABLE:
db 48 89 83 28 03 00 00
unregistersymbol(INJECT_GET_PCONTROLLER_VTABLE i_base_pc_vtable_addr i_base_actor_vtable_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.exe+3BF5198
ES2-Win64-Shipping.exe+3BF5158: 48 8D 05 A1 C2 C4 03 - lea rax,[ES2-Win64-Shipping.exe+7841400]
ES2-Win64-Shipping.exe+3BF515F: 48 89 AB 30 03 00 00 - mov [rbx+00000330],rbp
ES2-Win64-Shipping.exe+3BF5166: 48 89 03 - mov [rbx],rax
ES2-Win64-Shipping.exe+3BF5169: 48 8D BB 68 05 00 00 - lea rdi,[rbx+00000568]
ES2-Win64-Shipping.exe+3BF5170: 48 8D 05 E9 D1 C4 03 - lea rax,[ES2-Win64-Shipping.exe+7842360]
ES2-Win64-Shipping.exe+3BF5177: 48 89 AB 38 03 00 00 - mov [rbx+00000338],rbp
ES2-Win64-Shipping.exe+3BF517E: 48 89 83 90 02 00 00 - mov [rbx+00000290],rax
ES2-Win64-Shipping.exe+3BF5185: B9 0B 00 00 00 - mov ecx,0000000B
ES2-Win64-Shipping.exe+3BF518A: 48 8D 05 F7 D5 AF 03 - lea rax,[ES2-Win64-Shipping.exe+76F2788]
ES2-Win64-Shipping.exe+3BF5191: 48 89 AB 40 03 00 00 - mov [rbx+00000340],rbp
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.exe+3BF5198: 48 89 83 28 03 00 00 - mov [rbx+00000328],rax
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.exe+3BF519F: 48 8D 83 A0 05 00 00 - lea rax,[rbx+000005A0]
ES2-Win64-Shipping.exe+3BF51A6: 48 89 AB 48 03 00 00 - mov [rbx+00000348],rbp
ES2-Win64-Shipping.exe+3BF51AD: 48 89 AB 50 03 00 00 - mov [rbx+00000350],rbp
ES2-Win64-Shipping.exe+3BF51B4: 48 89 AB 98 03 00 00 - mov [rbx+00000398],rbp
ES2-Win64-Shipping.exe+3BF51BB: 48 89 AB A0 03 00 00 - mov [rbx+000003A0],rbp
ES2-Win64-Shipping.exe+3BF51C2: 48 89 AB A8 03 00 00 - mov [rbx+000003A8],rbp
ES2-Win64-Shipping.exe+3BF51C9: 48 89 AB B0 03 00 00 - mov [rbx+000003B0],rbp
ES2-Win64-Shipping.exe+3BF51D0: 48 89 AB F8 03 00 00 - mov [rbx+000003F8],rbp
ES2-Win64-Shipping.exe+3BF51D7: 48 89 AB 00 04 00 00 - mov [rbx+00000400],rbp
ES2-Win64-Shipping.exe+3BF51DE: 48 89 AB 08 04 00 00 - mov [rbx+00000408],rbp
}
172
"pc.vtable"
1
0
808080
8 Bytes
i_base_pc_vtable_addr
173
"actor.vtable"
1
0
808080
8 Bytes
i_base_actor_vtable_addr
174
"Pawn.Hidden"
0
FF8080
Binary
7
1
0
i_base_player_ctrl_addr
58
2D0
175
"Pawn.CanBeDamaged"
0
FF8080
Binary
2
1
0
i_base_player_ctrl_addr
5A
2D0
176
"PlayerController.CanBeDamaged"
0
FF8080
Binary
2
1
0
i_base_player_ctrl_addr
5A
184
"Auto Assemble script"
Auto Assembler Script
{ Game : ES2-Win64-Shipping.exe
Version:
Date : 2025-02-16
Author : Andyc
This script does blah blah blah
}
[ENABLE]
aobscanmodule(INJECT,ES2-Win64-Shipping.exe,90 0F B6 02 41 88 04 11) // should be unique
alloc(newmem,$1000,INJECT)
label(code)
label(return)
newmem:
push r15
mov r15, 1C8ADDAECD8
cmp rdx, r15
jne @F
mov r15d, 1
@@:
pop r15
code:
movzx eax,byte ptr [rdx]
mov [r9+rdx],al
jmp return
INJECT+01:
jmp newmem
nop 2
return:
registersymbol(INJECT)
[DISABLE]
INJECT+01:
db 0F B6 02 41 88 04 11
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E70
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E4F: 0F 2B 54 11 20 - movntps [rcx+rdx+20],xmm2
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E54: 0F 2B 5C 11 30 - movntps [rcx+rdx+30],xmm3
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E59: 48 83 C2 40 - add rdx,40
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E5D: 48 83 E8 01 - sub rax,01
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E61: 75 CD - jne ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E30
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E63: 41 83 E0 3F - and r8d,3F
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E67: 4D 85 C0 - test r8,r8
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E6A: 74 15 - je ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E81
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E6C: 4C 2B CA - sub r9,rdx
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E6F: 90 - nop
// ---------- INJECTING HERE ----------
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E70: 0F B6 02 - movzx eax,byte ptr [rdx]
// ---------- DONE INJECTING ----------
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E73: 41 88 04 11 - mov [r9+rdx],al
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E77: 48 8D 52 01 - lea rdx,[rdx+01]
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E7B: 49 83 E8 01 - sub r8,01
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E7F: 75 EF - jne ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E70
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E81: 49 8B C2 - mov rax,r10
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E84: C3 - ret
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E85: CC - int 3
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E86: CC - int 3
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E87: CC - int 3
ES2-Win64-Shipping.NVSDK_NGX_VULKAN_Shutdown1+E88: CC - int 3
}
177
"EVERSPACE™ 2 1.3.43751 / https://opencheattables.com"
00994D
1
playerWeaponsPtr
1EB17730000