1
"[Pointer]"
1
574
"Campaign Progress"
1
579
"RCT Unlocker"
F8000000:All Unlocked
1
4 Bytes
RCT.EXE+4B99E8
580
"Corkscrew Follies Unlocker"
00000000:All Unlocked
1
4 Bytes
RCT.EXE+4B99ED
571
"Score"
1
570
"Forest Frontiers"
0
2 Bytes
rct.exe+4B87DC
572
"Dynamite Dunes"
2 Bytes
rct.exe+4B87E0
575
"Name"
1
573
"Forest Frontiers"
1
String
32
0
0
1
rct.exe+4B89DC
576
"Forest Frontiers"
1
String
32
0
0
1
rct.exe+4B89E0
507
"Park Data"
1
567
"Month"
2 Bytes
rct.exe+503D5C
568
"Day"
2 Bytes
rct.exe+503D5E
521
"Current Park"
1
533
"Flags"
1
530
"Park Open"
Binary
0
1
0
RCT.EXE+69C598
534
"Forbid Landscape Changes"
Binary
2
1
0
RCT.EXE+69C598
535
"Forbid Tree Removal"
Binary
3
1
0
RCT.EXE+69C598
536
"Forbid High Construction"
Binary
5
1
0
RCT.EXE+69C598
537
"Guests Prefer Less Intense"
Binary
6
1
0
RCT.EXE+69C598
538
"Forbid Marketing Campaigns"
Binary
7
1
0
RCT.EXE+69C598
539
"Guests Prefer More Intense"
Binary
1
1
0
RCT.EXE+69C599
540
"Guest Generation Difficulty"
Binary
4
1
0
RCT.EXE+69C599
541
"No Park Fee"
Binary
5
1
0
RCT.EXE+69C599
0
"Cash"
1
4 Bytes
RCT.EXE+69C590
474
"Loan"
1
4 Bytes
RCT.EXE+69C594
500
"??"
4 Bytes
RCT.EXE+69C598
503
"Park Entrance Fee"
2 Bytes
RCT.EXE+69C59C
565
"Research Funding"
Byte
RCT.EXE+69C5B3
532
"Initial Happiness"
Byte
RCT.EXE+69D29D
527
"Tram Size"
2 Bytes
RCT.EXE+69D2A0
524
"Initial Cash In Pocket"
2 Bytes
RCT.EXE+69D2A8
528
"Initial Hunger"
Byte
RCT.EXE+69D2AA
529
"Initial Thirst"
Byte
RCT.EXE+69D2AB
477
"Park Value"
4 Bytes
RCT.EXE+69D6F0
476
"Company Value"
1
4 Bytes
RCT.EXE+69D900
522
"Weather"
1
515
"Weather Timer"
2 Bytes
rct.exe+6F8088
517
"Weather (Current)"
listWeather
Byte
rct.exe+6F808A
519
"Weather (Target)"
listWeather
Byte
rct.exe+6F808B
518
"Temperature"
Byte
rct.exe+6F808C
516
"Temperature (Target)"
Byte
rct.exe+6F808D
511
"Scenario Settings"
1
506
"Scenario Type"
listScenario
Byte
rct.exe+69D2AC
509
"Year"
Byte
rct.exe+69D2AD
510
"Park Value"
4 Bytes
rct.exe+69D2B0
508
"Guests"
2 Bytes
rct.exe+69D2B4
512
"Land Purchase Cost"
2 Bytes
rct.exe+69D924
513
"Construction Purchase Cost"
2 Bytes
rct.exe+69D926
502
"[Scripts]"
1
557
"Guest Cheats"
Auto Assembler Script
{ Game : rct.exe
Version:
Date : 2020-10-08
Author : Marcus101RR
This script does blah blah blah
}
[ENABLE]
aobscanmodule(setGuests,rct.exe,8A 46 3A 8A 5E 3B) // should be unique
alloc(newmem,$256)
label(code)
label(return)
label(sHappy)
label(sFood)
label(sSick)
label(sAllRides)
label(sSetStats)
registersymbol(sSetStats)
newmem:
code:
mov al,[esi+3A]
mov bl,[esi+3B]
cmp [sSetStats],01
jne sHappy
mov [esi+3A],#255
sHappy:
cmp [sSetStats+1],01
jne sFood
mov [esi+3E],#1
mov [esi+3F],#1
sFood:
cmp [sSetStats+2],01
jne sSick
mov [esi+3C],#255
mov [esi+3D],#255
sSick:
cmp [sSetStats+3],01
jne sAllRides
mov [esi+43],0xF0
mov [esi+44],0x3
sAllRides:
jmp return
sSetStats:
db 00 00 00 00
setGuests:
jmp newmem
nop
return:
registersymbol(setGuests)
[DISABLE]
setGuests:
db 8A 46 3A 8A 5E 3B
unregistersymbol(setGuests)
dealloc(newmem)
unregistersymbol(sSetStats)
{
// ORIGINAL CODE - INJECTION POINT: "rct.exe"+2E5CD
"rct.exe"+2E5B6: 3C 20 - cmp al,20
"rct.exe"+2E5B8: 73 02 - jae rct.exe+2E5BC
"rct.exe"+2E5BA: B0 20 - mov al,20
"rct.exe"+2E5BC: 3C 80 - cmp al,-80
"rct.exe"+2E5BE: 76 02 - jna rct.exe+2E5C2
"rct.exe"+2E5C0: B0 80 - mov al,-80
"rct.exe"+2E5C2: 38 C8 - cmp al,cl
"rct.exe"+2E5C4: 74 07 - je rct.exe+2E5CD
"rct.exe"+2E5C6: 88 46 38 - mov [esi+38],al
"rct.exe"+2E5C9: 80 4E 45 04 - or byte ptr [esi+45],04
// ---------- INJECTING HERE ----------
"rct.exe"+2E5CD: 8A 46 3A - mov al,[esi+3A]
"rct.exe"+2E5D0: 8A 5E 3B - mov bl,[esi+3B]
// ---------- DONE INJECTING ----------
"rct.exe"+2E5D3: 8A C8 - mov cl,al
"rct.exe"+2E5D5: 38 D8 - cmp al,bl
"rct.exe"+2E5D7: 72 0E - jb rct.exe+2E5E7
"rct.exe"+2E5D9: 2C 04 - sub al,04
"rct.exe"+2E5DB: 73 02 - jae rct.exe+2E5DF
"rct.exe"+2E5DD: 32 C0 - xor al,al
"rct.exe"+2E5DF: 38 D8 - cmp al,bl
"rct.exe"+2E5E1: 73 10 - jae rct.exe+2E5F3
"rct.exe"+2E5E3: 8A C3 - mov al,bl
"rct.exe"+2E5E5: EB 0C - jmp rct.exe+2E5F3
}
558
"Make Happy"
listState
Byte
sSetStats
559
"Make Hunger & Thirst"
listState
Byte
sSetStats+1
562
"Make Sick"
listState
Byte
sSetStats+2
561
"Make All Rides Intensity"
listState
Byte
sSetStats+3
479
"Get Active Guest Window"
Auto Assembler Script
{ Game : rct.exe
Version:
Date : 2020-10-08
Author : Marcus101RR
This script does blah blah blah
}
[ENABLE]
aobscanmodule(getGuest,rct.exe,8B 86 9C 00 00 00 A3 64 D4 C0 00 5E 0F) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(gGuest)
registersymbol(gGuest)
newmem:
code:
mov [gGuest],esi
mov eax,[esi+0000009C]
jmp return
gGuest:
dq 0
getGuest:
jmp newmem
nop
return:
registersymbol(getGuest)
[DISABLE]
getGuest:
db 8B 86 9C 00 00 00
unregistersymbol(getGuest)
dealloc(newmem)
unregistersymbol(gGuest)
{
// ORIGINAL CODE - INJECTION POINT: "rct.exe"+3427D
"rct.exe"+34255: 0F B7 8E 74 01 00 00 - movzx ecx,word ptr [esi+00000174]
"rct.exe"+3425C: 83 C1 04 - add ecx,04
"rct.exe"+3425F: 0F AB CA - bts edx,ecx
"rct.exe"+34262: 89 56 1C - mov [esi+1C],edx
"rct.exe"+34265: 56 - push esi
"rct.exe"+34266: 0F B7 76 40 - movzx esi,word ptr [esi+40]
"rct.exe"+3426A: C1 E6 08 - shl esi,08
"rct.exe"+3426D: 81 C6 70 3D 96 00 - add esi,rct.exe+563D70
"rct.exe"+34273: 66 8B 46 22 - mov ax,[esi+22]
"rct.exe"+34277: 66 A3 62 D4 C0 00 - mov [rct.exe+80D462],ax
// ---------- INJECTING HERE ----------
"rct.exe"+3427D: 8B 86 9C 00 00 00 - mov eax,[esi+0000009C]
// ---------- DONE INJECTING ----------
"rct.exe"+34283: A3 64 D4 C0 00 - mov [rct.exe+80D464],eax
"rct.exe"+34288: 5E - pop esi
"rct.exe"+34289: 0F BA 76 1C 0D - btr [esi+1C],0D
"rct.exe"+3428E: 0F B7 7E 40 - movzx edi,word ptr [esi+40]
"rct.exe"+34292: C1 E7 08 - shl edi,08
"rct.exe"+34295: 81 C7 70 3D 96 00 - add edi,rct.exe+563D70
"rct.exe"+3429B: F7 87 C8 00 00 00 08 00 00 00 - test [edi+000000C8],00000008
"rct.exe"+342A5: 74 05 - je rct.exe+342AC
"rct.exe"+342A7: 0F BA 6E 1C 0D - bts [esi+1C],0D
"rct.exe"+342AC: E8 66 11 00 00 - call rct.exe+35417
}
485
"Shirt Color"
Byte
gGuest
30
484
"Pants Color"
Byte
gGuest
31
486
"Energy"
Byte
gGuest
38
495
"Energy (Max)"
Byte
gGuest
39
494
"Happiness"
Byte
gGuest
3A
493
"Happiness (Max)"
Byte
gGuest
3B
492
"Nausea"
Byte
gGuest
3C
491
"Nausea (Max)"
Byte
gGuest
3D
490
"Hunger"
Byte
gGuest
3E
489
"Thirst"
Byte
gGuest
3F
488
"Toilet"
Byte
gGuest
40
487
"Ride Intensity"
1
Byte
gGuest
43
482
"Nausea Tolerance"
Byte
gGuest
44
483
"ID"
4 Bytes
gGuest
9C
480
"Cash Pocket"
4 Bytes
gGuest
A0
481
"Cash Spent"
4 Bytes
gGuest
A4
501
"Guest Pay All Cash"
Auto Assembler Script
{ Game : rct.exe
Version:
Date : 2020-10-08
Author : Marcus101RR
This script does blah blah blah
}
[ENABLE]
aobscanmodule(gPayFull,rct.exe,29 9E A0 00 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
mov ebx,[esi+000000A0]
sub [esi+000000A0],ebx
jmp return
gPayFull:
jmp newmem
nop
return:
registersymbol(gPayFull)
[DISABLE]
gPayFull:
db 29 9E A0 00 00 00
unregistersymbol(gPayFull)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "rct.exe"+35C69
"rct.exe"+35C3D: 66 8B 46 0A - mov ax,[esi+0A]
"rct.exe"+35C41: 66 A3 74 C5 A9 00 - mov [rct.exe+69C574],ax
"rct.exe"+35C47: 66 C7 46 04 FF FF - mov word ptr [esi+04],FFFF
"rct.exe"+35C4D: 66 C7 46 06 FF FF - mov word ptr [esi+06],FFFF
"rct.exe"+35C53: C6 05 FC 5A 8A 00 30 - mov byte ptr [rct.exe+4A5AFC],30
"rct.exe"+35C5A: 61 - popad
"rct.exe"+35C5B: C3 - ret
"rct.exe"+35C5C: 60 - pushad
"rct.exe"+35C5D: F7 05 98 C5 A9 00 00 08 00 00 - test [rct.exe+69C598],00000800
"rct.exe"+35C67: 75 63 - jne rct.exe+35CCC
// ---------- INJECTING HERE ----------
"rct.exe"+35C69: 29 9E A0 00 00 00 - sub [esi+000000A0],ebx
// ---------- DONE INJECTING ----------
"rct.exe"+35C6F: 7D 0A - jnl rct.exe+35C7B
"rct.exe"+35C71: C7 86 A0 00 00 00 00 00 00 00 - mov [esi+000000A0],00000000
"rct.exe"+35C7B: 01 9E A4 00 00 00 - add [esi+000000A4],ebx
"rct.exe"+35C81: 8B 3D 90 F1 8F 00 - mov edi,[rct.exe+4FF190]
"rct.exe"+35C87: 66 01 1C 37 - add [edi+esi],bx
"rct.exe"+35C8B: 53 - push ebx
"rct.exe"+35C8C: B0 17 - mov al,17
"rct.exe"+35C8E: 66 8B 5E 0A - mov bx,[esi+0A]
"rct.exe"+35C92: E8 DC 74 14 00 - call rct.exe+17D173
"rct.exe"+35C97: 5B - pop ebx
}
545
"Get Active Ride Window"
Auto Assembler Script
{ Game : rct.exe
Version:
Date : 2020-10-08
Author : Marcus101RR
This script does blah blah blah
}
[ENABLE]
aobscanmodule(getRide,rct.exe,69 D2 60 02 00 00 0F B6 8A) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(gRide)
registersymbol(gRide)
newmem:
code:
imul edx,edx,00000260
lea ecx,[rct.exe+6A75FC+edx]
mov [gRide],ecx
jmp return
gRide:
dq 0
getRide:
jmp newmem
nop
return:
registersymbol(getRide)
[DISABLE]
getRide:
db 69 D2 60 02 00 00
unregistersymbol(getRide)
dealloc(newmem)
unregistersymbol(gRide)
{
// ORIGINAL CODE - INJECTION POINT: "rct.exe"+435E7
"rct.exe"+435A5: 66 C7 86 74 01 00 00 00 00 - mov word ptr [esi+00000174],0000
"rct.exe"+435AE: 66 C7 86 76 01 00 00 00 00 - mov word ptr [esi+00000176],0000
"rct.exe"+435B7: 66 C7 86 78 01 00 00 00 00 - mov word ptr [esi+00000178],0000
"rct.exe"+435C0: 66 C7 86 7A 01 00 00 00 00 - mov word ptr [esi+0000017A],0000
"rct.exe"+435C9: 66 C7 86 7C 01 00 00 00 00 - mov word ptr [esi+0000017C],0000
"rct.exe"+435D2: 66 C7 86 7E 01 00 00 00 00 - mov word ptr [esi+0000017E],0000
"rct.exe"+435DB: E8 01 00 00 00 - call rct.exe+435E1
"rct.exe"+435E0: C3 - ret
"rct.exe"+435E1: 33 C0 - xor eax,eax
"rct.exe"+435E3: 0F B7 56 40 - movzx edx,word ptr [esi+40]
// ---------- INJECTING HERE ----------
"rct.exe"+435E7: 69 D2 60 02 00 00 - imul edx,edx,00000260
// ---------- DONE INJECTING ----------
"rct.exe"+435ED: 0F B6 8A FC 75 AA 00 - movzx ecx,byte ptr [edx+rct.exe+6A75FC]
"rct.exe"+435F4: F7 04 CD 20 8E 78 00 00 02 00 00 - test [ecx*8+rct.exe+388E20],00000200
"rct.exe"+435FF: 75 05 - jne rct.exe+43606
"rct.exe"+43601: 0D 00 02 00 00 - or eax,00000200
"rct.exe"+43606: 80 F9 43 - cmp cl,43
"rct.exe"+43609: 75 03 - jne rct.exe+4360E
"rct.exe"+4360B: 83 C8 60 - or eax,60
"rct.exe"+4360E: F7 04 CD 20 8E 78 00 00 20 00 00 - test [ecx*8+rct.exe+388E20],00002000
"rct.exe"+43619: 74 03 - je rct.exe+4361E
"rct.exe"+4361B: 83 C8 20 - or eax,20
}
546
"Trains"
Byte
gRide
78
551
"Cars"
Byte
gRide
79
547
"Proposed Cars"
Byte
gRide
7B
549
"Proposed Trains"
Byte
gRide
7C
550
"Min/Max Cars"
1
1
Byte
gRide
7D
548
"Reliability Timer"
0
Byte
gRide
146
554
"Build Date"
2 Bytes
gRide
130
556
"Reliability"
Byte
gRide
147
552
"Reliability Factor"
Byte
gRide
148
553
"Downtime"
Byte
gRide
149
555
"Last Inspection"
Byte
gRide
14B
569
"Auto Assemble script"
Auto Assembler Script
{ Game : rct.exe
Version:
Date : 2020-10-19
Author : Marcus101RR
Pays Full Pocket Value
}
[ENABLE]
aobscanmodule(gPayPocket,rct.exe,29 9E A0 00 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
sub [esi+000000A0],ebx
mov ebx,[esi+000000A0]
jmp return
gPayPocket:
jmp newmem
nop
return:
registersymbol(gPayPocket)
[DISABLE]
gPayPocket:
db 29 9E A0 00 00 00
unregistersymbol(gPayPocket)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "rct.exe"+35C69
"rct.exe"+35C3D: 66 8B 46 0A - mov ax,[esi+0A]
"rct.exe"+35C41: 66 A3 74 C5 A9 00 - mov [rct.exe+69C574],ax
"rct.exe"+35C47: 66 C7 46 04 FF FF - mov word ptr [esi+04],FFFF
"rct.exe"+35C4D: 66 C7 46 06 FF FF - mov word ptr [esi+06],FFFF
"rct.exe"+35C53: C6 05 FC 5A 8A 00 30 - mov byte ptr [rct.exe+4A5AFC],30
"rct.exe"+35C5A: 61 - popad
"rct.exe"+35C5B: C3 - ret
"rct.exe"+35C5C: 60 - pushad
"rct.exe"+35C5D: F7 05 98 C5 A9 00 00 08 00 00 - test [rct.exe+69C598],00000800
"rct.exe"+35C67: 75 63 - jne rct.exe+35CCC
// ---------- INJECTING HERE ----------
"rct.exe"+35C69: 29 9E A0 00 00 00 - sub [esi+000000A0],ebx
// ---------- DONE INJECTING ----------
"rct.exe"+35C6F: 7D 0A - jnl rct.exe+35C7B
"rct.exe"+35C71: C7 86 A0 00 00 00 00 00 00 00 - mov [esi+000000A0],00000000
"rct.exe"+35C7B: 01 9E A4 00 00 00 - add [esi+000000A4],ebx
"rct.exe"+35C81: 8B 3D 90 F1 8F 00 - mov edi,[rct.exe+4FF190]
"rct.exe"+35C87: 66 01 1C 37 - add [edi+esi],bx
"rct.exe"+35C8B: 53 - push ebx
"rct.exe"+35C8C: B0 17 - mov al,17
"rct.exe"+35C8E: 66 8B 5E 0A - mov bx,[esi+0A]
"rct.exe"+35C92: E8 DC 74 14 00 - call rct.exe+17D173
"rct.exe"+35C97: 5B - pop ebx
}
499
"DEBUG"
1
498
"Junior cars"
Byte
0078AA31
523
"DEFINITIONS"
1
520
"listWeather"
0:Sunny
1:Partly Cloudy
2:Cloudy
3:Rain
4:Heavy Rain
5:Thunderstorm
Byte
listWeather
526
"listScenario"
0:?
1:At Least Guests by Year
2:Park Value
3:Have Fun!
4:Best Wooden Roller Coaster
5:10 Different Roller Coasters
6:At Least Guests
Byte
listScenario
560
"listState"
0:Off
1:On
Byte
listState
Code :mov [edi+79],al
rct.exe+173DE2
66
3B
C1
74
11
88
47
79
88
67
78
B0
0B
Code :mov ah,[eax*8+rct.exe+38AA09]
rct.exe+173CF1
57
0F
B6
47
01
8A
24
C5
09
AA
78
00
0F
B6
3F
66
0F
Code :sub [esi+000000A0],ebx
rct.exe+35C69
08
00
00
75
63
29
9E
A0
00
00
00
7D
0A
C7
86
A0
Get Guets On Ride
rct.exe+16F036
85
B3
00
00
00
02
A5
B4
00
00
00
02
8D
B2
00
00
Max Guests On Ride
rct.exe+173F40
C5
D3
B0
78
00
88
96
B2
00
00
00
8A
14
C5
41
B4
invBase
0A4E0000
InvCaps_
9EDF25E0
playerBase
AFA70000
InfItems
B84A507B
LogBase
10780000
ExtraCap2
B65707CF
INJECT
83454DBE
IntCap
834A4E32
InvStorage_
0F009000
itemBase
0B540000
aobHealthAOB
4044F7FE
logs
53CB0000
thaumaturge
66630000
buffs
70634204
afish
37CB8990
_playerbase
0BCB0000
recipe1
1222F75D
recipe2
1222F76C
recipe3
1222F77D
ivy
24FDA2DE
_infmp
18CE1070
_infammo
18CE7079
_fastuse
18CE7323
_fastuse2
18CE1FFC
_infplacing
18CF60E2
_fastwater
2775519B
_minvctimer
164A375E
minionstr
1C3B3C78
magicstr
1C3B3C6A
wardingdef
1C3BA46A
minioncount
206D4213
player_index
002978DC
mapRanges
354840D3
players2
1114D1B4
playerz
10E80047
players
1118D1B4
IndexID
13470668
timer_aob
110D2436