104
"Gold Gain Multiplier"
Auto Assembler Script
[ENABLE]
aobscanmodule(gold_add,Onimusha2.exe,03 CF 89 8A 10 01 00 00) // should be unique
alloc(newmem,$1000,gold_add)
label(code)
label(return)
registersymbol(gold_mult)
newmem:
imul edi,[gold_mult]
code:
add ecx,edi
mov [rdx+00000110],ecx
jmp return
gold_mult:
dq #1
gold_add:
jmp newmem
nop 3
return:
registersymbol(gold_add)
[DISABLE]
gold_add:
db 03 CF 89 8A 10 01 00 00
unregistersymbol(gold_mult)
unregistersymbol(gold_add)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+1C339E2
Onimusha2.exe+1C339BD: 48 8B CB - mov rcx,rbx
Onimusha2.exe+1C339C0: 41 8D 50 38 - lea edx,[r8+38]
Onimusha2.exe+1C339C4: 48 8B 5C 24 30 - mov rbx,[rsp+30]
Onimusha2.exe+1C339C9: 48 83 C4 20 - add rsp,20
Onimusha2.exe+1C339CD: 5F - pop rdi
Onimusha2.exe+1C339CE: E9 9D B3 5E 00 - jmp Onimusha2.exe+221ED70
Onimusha2.exe+1C339D3: 48 8B 52 38 - mov rdx,[rdx+38]
Onimusha2.exe+1C339D7: 48 85 D2 - test rdx,rdx
Onimusha2.exe+1C339DA: 74 DE - je Onimusha2.exe+1C339BA
Onimusha2.exe+1C339DC: 8B 8A 10 01 00 00 - mov ecx,[rdx+00000110]
// ---------- INJECTING HERE ----------
Onimusha2.exe+1C339E2: 03 CF - add ecx,edi
// ---------- DONE INJECTING ----------
Onimusha2.exe+1C339E4: 89 8A 10 01 00 00 - mov [rdx+00000110],ecx
Onimusha2.exe+1C339EA: 81 F9 9F 86 01 00 - cmp ecx,0001869F
Onimusha2.exe+1C339F0: 76 0A - jna Onimusha2.exe+1C339FC
Onimusha2.exe+1C339F2: C7 82 10 01 00 00 9F 86 01 00 - mov [rdx+00000110],0001869F
Onimusha2.exe+1C339FC: 48 8B 5C 24 30 - mov rbx,[rsp+30]
Onimusha2.exe+1C33A01: 48 83 C4 20 - add rsp,20
Onimusha2.exe+1C33A05: 5F - pop rdi
Onimusha2.exe+1C33A06: C3 - ret
Onimusha2.exe+1C33A07: CC - int 3
Onimusha2.exe+1C33A08: CC - int 3
}
105
"Multiplier"
0
4 Bytes
gold_mult
88
"Total Soul Gain Multiplier"
Auto Assembler Script
[ENABLE]
aobscanmodule(soul_total,Onimusha2.exe,03 CE 89 8A FC 01 00 00) // should be unique
alloc(newmem,$1000,soul_total)
label(code)
label(return)
label(soul_total_mult)
registersymbol(soul_total_mult)
newmem:
imul esi,[soul_total_mult]
code:
add ecx,esi
mov [rdx+000001FC],ecx
jmp return
soul_total_mult:
dq #1
soul_total:
jmp newmem
nop 3
return:
registersymbol(soul_total)
[DISABLE]
soul_total:
db 03 CE 89 8A FC 01 00 00
unregistersymbol(soul_total_mult)
unregistersymbol(soul_total)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+13DA172
Onimusha2.exe+13DA143: 48 85 D2 - test rdx,rdx
Onimusha2.exe+13DA146: 0F 84 5F FF FF FF - je Onimusha2.exe+13DA0AB
Onimusha2.exe+13DA14C: 44 3B 42 1C - cmp r8d,[rdx+1C]
Onimusha2.exe+13DA150: 73 D7 - jae Onimusha2.exe+13DA129
Onimusha2.exe+13DA152: 4A 8B 54 C2 20 - mov rdx,[rdx+r8*8+20]
Onimusha2.exe+13DA157: 48 85 D2 - test rdx,rdx
Onimusha2.exe+13DA15A: 0F 84 4B FF FF FF - je Onimusha2.exe+13DA0AB
Onimusha2.exe+13DA160: 81 BA FC 01 00 00 3F 42 0F 00 - cmp [rdx+000001FC],000F423F
Onimusha2.exe+13DA16A: 73 20 - jae Onimusha2.exe+13DA18C
Onimusha2.exe+13DA16C: 8B 8A FC 01 00 00 - mov ecx,[rdx+000001FC]
// ---------- INJECTING HERE ----------
Onimusha2.exe+13DA172: 03 CE - add ecx,esi
// ---------- DONE INJECTING ----------
Onimusha2.exe+13DA174: 89 8A FC 01 00 00 - mov [rdx+000001FC],ecx
Onimusha2.exe+13DA17A: 81 F9 3F 42 0F 00 - cmp ecx,000F423F
Onimusha2.exe+13DA180: 76 0A - jna Onimusha2.exe+13DA18C
Onimusha2.exe+13DA182: C7 82 FC 01 00 00 3F 42 0F 00 - mov [rdx+000001FC],000F423F
Onimusha2.exe+13DA18C: 81 BA F8 01 00 00 9F 86 01 00 - cmp [rdx+000001F8],0001869F
Onimusha2.exe+13DA196: 73 20 - jae Onimusha2.exe+13DA1B8
Onimusha2.exe+13DA198: 8B 8A F8 01 00 00 - mov ecx,[rdx+000001F8]
Onimusha2.exe+13DA19E: 03 CE - add ecx,esi
Onimusha2.exe+13DA1A0: 89 8A F8 01 00 00 - mov [rdx+000001F8],ecx
Onimusha2.exe+13DA1A6: 81 F9 9F 86 01 00 - cmp ecx,0001869F
}
89
"Multiplier"
0
4 Bytes
soul_total_mult
103
"Infinite Health"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT,Onimusha2.exe,00 66 89 42 10 C3) // should be unique
alloc(newmem,$1000,INJECT)
label(code)
label(return)
newmem:
//cmp [rdx+11C],0
//cmp [rdx+B10],0
cmp [rdx+118],43200000
jne code
//jne code
mov ax,[rdx+30]
code:
mov [rdx+10],ax
ret
jmp return
INJECT+01:
jmp newmem
return:
registersymbol(INJECT)
[DISABLE]
INJECT+01:
db 66 89 42 10 C3
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+1C5B21
Onimusha2.exe+1C5B06: 48 8B 40 20 - mov rax,[rax+20]
Onimusha2.exe+1C5B0A: C3 - ret
Onimusha2.exe+1C5B0B: CC - int 3
Onimusha2.exe+1C5B0C: CC - int 3
Onimusha2.exe+1C5B0D: CC - int 3
Onimusha2.exe+1C5B0E: CC - int 3
Onimusha2.exe+1C5B0F: CC - int 3
Onimusha2.exe+1C5B10: 48 B8 FF FF FF FF FF FF FF 7F - mov rax,7FFFFFFFFFFFFFFF
Onimusha2.exe+1C5B1A: 4C 23 C0 - and r8,rax
Onimusha2.exe+1C5B1D: 41 0F B7 00 - movzx eax,word ptr [r8]
// ---------- INJECTING HERE ----------
Onimusha2.exe+1C5B21: 66 89 42 10 - mov [rdx+10],ax
// ---------- DONE INJECTING ----------
Onimusha2.exe+1C5B25: C3 - ret
Onimusha2.exe+1C5B26: CC - int 3
Onimusha2.exe+1C5B27: CC - int 3
Onimusha2.exe+1C5B28: CC - int 3
Onimusha2.exe+1C5B29: CC - int 3
Onimusha2.exe+1C5B2A: CC - int 3
Onimusha2.exe+1C5B2B: CC - int 3
Onimusha2.exe+1C5B2C: CC - int 3
Onimusha2.exe+1C5B2D: CC - int 3
Onimusha2.exe+1C5B2E: CC - int 3
}
92
"Infinite Magic"
Auto Assembler Script
[ENABLE]
aobscanmodule(magic_use,Onimusha2.exe,48 63 C6 66 01 6C 41 20) // should be unique
alloc(newmem,$1000,magic_use)
label(code)
label(return)
newmem:
code:
movsxd rax,esi
cmp bp,0
jl return
add [rcx+rax*2+20],bp
jmp return
magic_use:
jmp newmem
nop 3
return:
registersymbol(magic_use)
[DISABLE]
magic_use:
db 48 63 C6 66 01 6C 41 20
unregistersymbol(magic_use)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+471555
Onimusha2.exe+471532: F7 D9 - neg ecx
Onimusha2.exe+471534: 3B D1 - cmp edx,ecx
Onimusha2.exe+471536: 7D 08 - jnl Onimusha2.exe+471540
Onimusha2.exe+471538: 41 8B C0 - mov eax,r8d
Onimusha2.exe+47153B: E9 4E 01 00 00 - jmp Onimusha2.exe+47168E
Onimusha2.exe+471540: 48 8B C8 - mov rcx,rax
Onimusha2.exe+471543: 48 85 C0 - test rax,rax
Onimusha2.exe+471546: 0F 84 5B 01 00 00 - je Onimusha2.exe+4716A7
Onimusha2.exe+47154C: 3B 70 1C - cmp esi,[rax+1C]
Onimusha2.exe+47154F: 0F 83 28 01 00 00 - jae Onimusha2.exe+47167D
// ---------- INJECTING HERE ----------
Onimusha2.exe+471555: 48 63 C6 - movsxd rax,esi
// ---------- DONE INJECTING ----------
Onimusha2.exe+471558: 66 01 6C 41 20 - add [rcx+rax*2+20],bp
Onimusha2.exe+47155D: E9 D1 00 00 00 - jmp Onimusha2.exe+471633
Onimusha2.exe+471562: 45 85 F6 - test r14d,r14d
Onimusha2.exe+471565: 0F 95 C0 - setne al
Onimusha2.exe+471568: 84 C0 - test al,al
Onimusha2.exe+47156A: 0F 95 C0 - setne al
Onimusha2.exe+47156D: 84 C0 - test al,al
Onimusha2.exe+47156F: 74 5A - je Onimusha2.exe+4715CB
Onimusha2.exe+471571: 48 85 FF - test rdi,rdi
Onimusha2.exe+471574: 0F 84 2D 01 00 00 - je Onimusha2.exe+4716A7
}
91
"Infinite Arrows & Fire Arrows"
Auto Assembler Script
[ENABLE]
aobscanmodule(arrow,Onimusha2.exe,FE 49 1C 48 8B 8F C8 02 00 00) // should be unique
alloc(newmem,$1000,arrow)
label(code)
label(return)
newmem:
code:
//dec [rcx+1C]
mov rcx,[rdi+000002C8]
jmp return
arrow:
jmp newmem
nop 5
return:
registersymbol(arrow)
[DISABLE]
arrow:
db FE 49 1C 48 8B 8F C8 02 00 00
unregistersymbol(arrow)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+840EE6
Onimusha2.exe+840EB0: 48 85 C0 - test rax,rax
Onimusha2.exe+840EB3: 0F 84 FE 00 00 00 - je Onimusha2.exe+840FB7
Onimusha2.exe+840EB9: 48 8B 80 D0 00 00 00 - mov rax,[rax+000000D0]
Onimusha2.exe+840EC0: 48 85 C0 - test rax,rax
Onimusha2.exe+840EC3: 0F 84 EE 00 00 00 - je Onimusha2.exe+840FB7
Onimusha2.exe+840EC9: 81 78 1C 3C 01 00 00 - cmp [rax+1C],0000013C
Onimusha2.exe+840ED0: 0F 86 A1 00 00 00 - jbe Onimusha2.exe+840F77
Onimusha2.exe+840ED6: 48 8B 88 00 0A 00 00 - mov rcx,[rax+00000A00]
Onimusha2.exe+840EDD: 48 85 C9 - test rcx,rcx
Onimusha2.exe+840EE0: 0F 84 D1 00 00 00 - je Onimusha2.exe+840FB7
// ---------- INJECTING HERE ----------
Onimusha2.exe+840EE6: FE 49 1C - dec [rcx+1C]
// ---------- DONE INJECTING ----------
Onimusha2.exe+840EE9: 48 8B 8F C8 02 00 00 - mov rcx,[rdi+000002C8]
Onimusha2.exe+840EF0: 48 85 C9 - test rcx,rcx
Onimusha2.exe+840EF3: 0F 84 BE 00 00 00 - je Onimusha2.exe+840FB7
Onimusha2.exe+840EF9: FE 81 4C 01 00 00 - inc byte ptr [rcx+0000014C]
Onimusha2.exe+840EFF: 48 8B 87 C8 02 00 00 - mov rax,[rdi+000002C8]
Onimusha2.exe+840F06: 48 85 C0 - test rax,rax
Onimusha2.exe+840F09: 0F 84 A8 00 00 00 - je Onimusha2.exe+840FB7
Onimusha2.exe+840F0F: 83 B8 BC 00 00 00 00 - cmp dword ptr [rax+000000BC],00
Onimusha2.exe+840F16: 48 8B D7 - mov rdx,rdi
Onimusha2.exe+840F19: 48 8B CB - mov rcx,rbx
}
176
"Infinite Bullets & Burst Bullets"
Auto Assembler Script
[ENABLE]
aobscanmodule(bullet,Onimusha2.exe,FE 49 1C 45 33 C9) // should be unique
alloc(newmem,$1000,bullet)
label(code)
label(return)
newmem:
code:
//dec [rcx+1C]
xor r9d,r9d
jmp return
bullet:
jmp newmem
nop
return:
registersymbol(bullet)
[DISABLE]
bullet:
db FE 49 1C 45 33 C9
unregistersymbol(bullet)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+843581
Onimusha2.exe+84354B: 48 85 C0 - test rax,rax
Onimusha2.exe+84354E: 0F 84 30 FD FF FF - je Onimusha2.exe+843284
Onimusha2.exe+843554: 48 8B 80 D0 00 00 00 - mov rax,[rax+000000D0]
Onimusha2.exe+84355B: 48 85 C0 - test rax,rax
Onimusha2.exe+84355E: 0F 84 20 FD FF FF - je Onimusha2.exe+843284
Onimusha2.exe+843564: 81 78 1C 38 01 00 00 - cmp [rax+1C],00000138
Onimusha2.exe+84356B: 0F 86 A8 FE FF FF - jbe Onimusha2.exe+843419
Onimusha2.exe+843571: 48 8B 88 E0 09 00 00 - mov rcx,[rax+000009E0]
Onimusha2.exe+843578: 48 85 C9 - test rcx,rcx
Onimusha2.exe+84357B: 0F 84 03 FD FF FF - je Onimusha2.exe+843284
// ---------- INJECTING HERE ----------
Onimusha2.exe+843581: FE 49 1C - dec [rcx+1C]
// ---------- DONE INJECTING ----------
Onimusha2.exe+843584: 45 33 C9 - xor r9d,r9d
Onimusha2.exe+843587: 48 8D 15 42 DB BC 08 - lea rdx,[Onimusha2.exe+94110D0]
Onimusha2.exe+84358E: 45 33 C0 - xor r8d,r8d
Onimusha2.exe+843591: 48 8B CB - mov rcx,rbx
Onimusha2.exe+843594: E8 57 3B A4 01 - call Onimusha2.exe+22870F0
Onimusha2.exe+843599: 83 F8 01 - cmp eax,01
Onimusha2.exe+84359C: 74 08 - je Onimusha2.exe+8435A6
Onimusha2.exe+84359E: 48 8B CB - mov rcx,rbx
Onimusha2.exe+8435A1: E8 6A 0A 3D 00 - call Onimusha2.exe+C14010
Onimusha2.exe+8435A6: 48 8B 15 1B DB BC 08 - mov rdx,[Onimusha2.exe+94110C8]
}
178
"Infinite Daggers (Oyu + Kotaro)"
Auto Assembler Script
[ENABLE]
aobscanmodule(subweapon,Onimusha2.exe,FE 49 1C 48 8B CB E8 CA) // should be unique
alloc(newmem,$1000,subweapon)
label(code)
label(return)
newmem:
code:
//dec [rcx+1C]
mov rcx,rbx
jmp return
subweapon:
jmp newmem
nop
return:
registersymbol(subweapon)
[DISABLE]
subweapon:
db FE 49 1C 48 8B CB
unregistersymbol(subweapon)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+1ECEB5B
Onimusha2.exe+1ECEB2A: 84 C0 - test al,al
Onimusha2.exe+1ECEB2C: 75 30 - jne Onimusha2.exe+1ECEB5E
Onimusha2.exe+1ECEB2E: 48 8B 8F D0 00 00 00 - mov rcx,[rdi+000000D0]
Onimusha2.exe+1ECEB35: 48 85 C9 - test rcx,rcx
Onimusha2.exe+1ECEB38: 0F 84 2C FE FF FF - je Onimusha2.exe+1ECE96A
Onimusha2.exe+1ECEB3E: 81 79 1C 37 01 00 00 - cmp [rcx+1C],00000137
Onimusha2.exe+1ECEB45: 0F 86 5C FE FF FF - jbe Onimusha2.exe+1ECE9A7
Onimusha2.exe+1ECEB4B: 48 8B 89 D8 09 00 00 - mov rcx,[rcx+000009D8]
Onimusha2.exe+1ECEB52: 48 85 C9 - test rcx,rcx
Onimusha2.exe+1ECEB55: 0F 84 0F FE FF FF - je Onimusha2.exe+1ECE96A
// ---------- INJECTING HERE ----------
Onimusha2.exe+1ECEB5B: FE 49 1C - dec [rcx+1C]
// ---------- DONE INJECTING ----------
Onimusha2.exe+1ECEB5E: 48 8B CB - mov rcx,rbx
Onimusha2.exe+1ECEB61: E8 CA 6C 35 FE - call Onimusha2.exe+225830
Onimusha2.exe+1ECEB66: 48 8B CB - mov rcx,rbx
Onimusha2.exe+1ECEB69: 48 85 C0 - test rax,rax
Onimusha2.exe+1ECEB6C: 0F 85 6E FE FF FF - jne Onimusha2.exe+1ECE9E0
Onimusha2.exe+1ECEB72: 45 33 C0 - xor r8d,r8d
Onimusha2.exe+1ECEB75: 8D 50 38 - lea edx,[rax+38]
Onimusha2.exe+1ECEB78: E9 F7 FD FF FF - jmp Onimusha2.exe+1ECE974
Onimusha2.exe+1ECEB7D: 48 85 FF - test rdi,rdi
Onimusha2.exe+1ECEB80: 0F 84 E4 FD FF FF - je Onimusha2.exe+1ECE96A
}
180
"Infinite Charms (Ekei)"
Auto Assembler Script
[ENABLE]
aobscanmodule(subweapon2,Onimusha2.exe,FE 49 1C 48 8B 86 C8 02 00 00) // should be unique
alloc(newmem,$1000,subweapon2)
label(code)
label(return)
newmem:
code:
//dec [rcx+1C]
mov rax,[rsi+000002C8]
jmp return
subweapon2:
jmp newmem
nop 5
return:
registersymbol(subweapon2)
[DISABLE]
subweapon2:
db FE 49 1C 48 8B 86 C8 02 00 00
unregistersymbol(subweapon2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+20BA345
Onimusha2.exe+20BA30F: 48 85 C0 - test rax,rax
Onimusha2.exe+20BA312: 0F 84 C3 02 00 00 - je Onimusha2.exe+20BA5DB
Onimusha2.exe+20BA318: 48 8B 80 D0 00 00 00 - mov rax,[rax+000000D0]
Onimusha2.exe+20BA31F: 48 85 C0 - test rax,rax
Onimusha2.exe+20BA322: 0F 84 B3 02 00 00 - je Onimusha2.exe+20BA5DB
Onimusha2.exe+20BA328: 81 78 1C 3E 01 00 00 - cmp [rax+1C],0000013E
Onimusha2.exe+20BA32F: 0F 86 4C 02 00 00 - jbe Onimusha2.exe+20BA581
Onimusha2.exe+20BA335: 48 8B 88 10 0A 00 00 - mov rcx,[rax+00000A10]
Onimusha2.exe+20BA33C: 48 85 C9 - test rcx,rcx
Onimusha2.exe+20BA33F: 0F 84 96 02 00 00 - je Onimusha2.exe+20BA5DB
// ---------- INJECTING HERE ----------
Onimusha2.exe+20BA345: FE 49 1C - dec [rcx+1C]
// ---------- DONE INJECTING ----------
Onimusha2.exe+20BA348: 48 8B 86 C8 02 00 00 - mov rax,[rsi+000002C8]
Onimusha2.exe+20BA34F: 48 85 C0 - test rax,rax
Onimusha2.exe+20BA352: 75 10 - jne Onimusha2.exe+20BA364
Onimusha2.exe+20BA354: 45 33 C0 - xor r8d,r8d
Onimusha2.exe+20BA357: 8D 50 38 - lea edx,[rax+38]
Onimusha2.exe+20BA35A: 48 8B CF - mov rcx,rdi
Onimusha2.exe+20BA35D: E8 0E 4A 16 00 - call Onimusha2.exe+221ED70
Onimusha2.exe+20BA362: EB 07 - jmp Onimusha2.exe+20BA36B
Onimusha2.exe+20BA364: C6 80 4E 01 00 00 37 - mov byte ptr [rax+0000014E],37
Onimusha2.exe+20BA36B: 48 8B D6 - mov rdx,rsi
}
182
"Infinite Flash Bombs (Magoichi)"
Auto Assembler Script
[ENABLE]
aobscanmodule(subweapon3,Onimusha2.exe,FE 49 1C 48 8B CB E8 89) // should be unique
alloc(newmem,$1000,subweapon3)
label(code)
label(return)
newmem:
code:
//dec [rcx+1C]
mov rcx,rbx
jmp return
subweapon3:
jmp newmem
nop
return:
registersymbol(subweapon3)
[DISABLE]
subweapon3:
db FE 49 1C 48 8B CB
unregistersymbol(subweapon3)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+1ECEA9C
Onimusha2.exe+1ECEA6B: 84 C0 - test al,al
Onimusha2.exe+1ECEA6D: 75 30 - jne Onimusha2.exe+1ECEA9F
Onimusha2.exe+1ECEA6F: 48 8B 8F D0 00 00 00 - mov rcx,[rdi+000000D0]
Onimusha2.exe+1ECEA76: 48 85 C9 - test rcx,rcx
Onimusha2.exe+1ECEA79: 0F 84 EB FE FF FF - je Onimusha2.exe+1ECE96A
Onimusha2.exe+1ECEA7F: 81 79 1C 3F 01 00 00 - cmp [rcx+1C],0000013F
Onimusha2.exe+1ECEA86: 0F 86 1B FF FF FF - jbe Onimusha2.exe+1ECE9A7
Onimusha2.exe+1ECEA8C: 48 8B 89 18 0A 00 00 - mov rcx,[rcx+00000A18]
Onimusha2.exe+1ECEA93: 48 85 C9 - test rcx,rcx
Onimusha2.exe+1ECEA96: 0F 84 CE FE FF FF - je Onimusha2.exe+1ECE96A
// ---------- INJECTING HERE ----------
Onimusha2.exe+1ECEA9C: FE 49 1C - dec [rcx+1C]
// ---------- DONE INJECTING ----------
Onimusha2.exe+1ECEA9F: 48 8B CB - mov rcx,rbx
Onimusha2.exe+1ECEAA2: E8 89 6D 35 FE - call Onimusha2.exe+225830
Onimusha2.exe+1ECEAA7: 48 8B CB - mov rcx,rbx
Onimusha2.exe+1ECEAAA: 48 85 C0 - test rax,rax
Onimusha2.exe+1ECEAAD: 0F 84 57 FE FF FF - je Onimusha2.exe+1ECE90A
Onimusha2.exe+1ECEAB3: 41 B9 10 00 00 00 - mov r9d,00000010
Onimusha2.exe+1ECEAB9: E9 28 FF FF FF - jmp Onimusha2.exe+1ECE9E6
Onimusha2.exe+1ECEABE: 48 85 FF - test rdi,rdi
Onimusha2.exe+1ECEAC1: 0F 84 A3 FE FF FF - je Onimusha2.exe+1ECE96A
Onimusha2.exe+1ECEAC7: 48 8B 87 D0 00 00 00 - mov rax,[rdi+000000D0]
}
94
"Last Selected Item"
Auto Assembler Script
[ENABLE]
aobscanmodule(selected,Onimusha2.exe,B9 00 48 8B 8B A0 00 00 00) // should be unique
alloc(newmem,$1000,selected)
label(code)
label(return)
registersymbol(selected_item)
newmem:
mov [selected_item],rsi
code:
mov rcx,[rbx+000000A0]
jmp return
selected_item:
dq 0
selected+02:
jmp newmem
nop 2
return:
registersymbol(selected)
[DISABLE]
selected+02:
db 48 8B 8B A0 00 00 00
unregistersymbol(selected_item)
unregistersymbol(selected)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+16926DE
Onimusha2.exe+16926BB: 85 C0 - test eax,eax
Onimusha2.exe+16926BD: 79 09 - jns Onimusha2.exe+16926C8
Onimusha2.exe+16926BF: 48 89 B3 A0 00 00 00 - mov [rbx+000000A0],rsi
Onimusha2.exe+16926C6: EB 57 - jmp Onimusha2.exe+169271F
Onimusha2.exe+16926C8: 48 3B B3 A0 00 00 00 - cmp rsi,[rbx+000000A0]
Onimusha2.exe+16926CF: 74 4E - je Onimusha2.exe+169271F
Onimusha2.exe+16926D1: 48 85 F6 - test rsi,rsi
Onimusha2.exe+16926D4: 74 08 - je Onimusha2.exe+16926DE
Onimusha2.exe+16926D6: 48 8B CE - mov rcx,rsi
Onimusha2.exe+16926D9: E8 62 E0 B9 00 - call Onimusha2.exe+2230740
// ---------- INJECTING HERE ----------
Onimusha2.exe+16926DE: 48 8B 8B A0 00 00 00 - mov rcx,[rbx+000000A0]
// ---------- DONE INJECTING ----------
Onimusha2.exe+16926E5: 48 8B C1 - mov rax,rcx
Onimusha2.exe+16926E8: F0 48 0F B1 B3 A0 00 00 00 - lock cmpxchg [rbx+000000A0],rsi
Onimusha2.exe+16926F1: 74 22 - je Onimusha2.exe+1692715
Onimusha2.exe+16926F3: 0F 0D 8B A0 00 00 00 - prefetchw [rbx+000000A0]
Onimusha2.exe+16926FA: 66 0F 1F 44 00 00 - nop word ptr [rax+rax+00]
Onimusha2.exe+1692700: 48 8B 8B A0 00 00 00 - mov rcx,[rbx+000000A0]
Onimusha2.exe+1692707: 48 8B C1 - mov rax,rcx
Onimusha2.exe+169270A: F0 48 0F B1 B3 A0 00 00 00 - lock cmpxchg [rbx+000000A0],rsi
Onimusha2.exe+1692713: 75 EB - jne Onimusha2.exe+1692700
Onimusha2.exe+1692715: 48 85 C9 - test rcx,rcx
}
95
"Base"
1
0
808080
4 Bytes
selected_item
0
96
"Amount"
0
Byte
selected_item
1C
140
"Issen Count (Do an issen to update)"
Auto Assembler Script
[ENABLE]
aobscanmodule(issenct,Onimusha2.exe,66 89 8D 4C 01 00 00) // should be unique
alloc(newmem,$1000,issenct)
label(code)
label(return)
registersymbol(issen_ptr)
newmem:
mov [issen_ptr],rbp
code:
mov [rbp+0000014C],cx
jmp return
issen_ptr:
dq 0
issenct:
jmp newmem
nop 2
return:
registersymbol(issenct)
[DISABLE]
issenct:
db 66 89 8D 4C 01 00 00
unregistersymbol(issen_ptr)
unregistersymbol(issenct)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+166E8E
Onimusha2.exe+166E59: 0F B6 8D 7F 01 00 00 - movzx ecx,byte ptr [rbp+0000017F]
Onimusha2.exe+166E60: 0F B6 85 80 01 00 00 - movzx eax,byte ptr [rbp+00000180]
Onimusha2.exe+166E67: 3B C8 - cmp ecx,eax
Onimusha2.exe+166E69: 7D 0D - jnl Onimusha2.exe+166E78
Onimusha2.exe+166E6B: 0F B6 85 80 01 00 00 - movzx eax,byte ptr [rbp+00000180]
Onimusha2.exe+166E72: 88 85 7F 01 00 00 - mov [rbp+0000017F],al
Onimusha2.exe+166E78: 0F B7 85 4C 01 00 00 - movzx eax,word ptr [rbp+0000014C]
Onimusha2.exe+166E7F: 0F B6 8D 80 01 00 00 - movzx ecx,byte ptr [rbp+00000180]
Onimusha2.exe+166E86: 66 03 C8 - add cx,ax
Onimusha2.exe+166E89: B8 0F 27 00 00 - mov eax,0000270F
// ---------- INJECTING HERE ----------
Onimusha2.exe+166E8E: 66 89 8D 4C 01 00 00 - mov [rbp+0000014C],cx
// ---------- DONE INJECTING ----------
Onimusha2.exe+166E95: 66 3B C8 - cmp cx,ax
Onimusha2.exe+166E98: 72 07 - jb Onimusha2.exe+166EA1
Onimusha2.exe+166E9A: 66 89 85 4C 01 00 00 - mov [rbp+0000014C],ax
Onimusha2.exe+166EA1: 40 88 B5 81 01 00 00 - mov [rbp+00000181],sil
Onimusha2.exe+166EA8: 48 8B 74 24 50 - mov rsi,[rsp+50]
Onimusha2.exe+166EAD: 48 8B 5C 24 58 - mov rbx,[rsp+58]
Onimusha2.exe+166EB2: 48 8B 6C 24 60 - mov rbp,[rsp+60]
Onimusha2.exe+166EB7: 48 83 C4 30 - add rsp,30
Onimusha2.exe+166EBB: 41 5F - pop r15
Onimusha2.exe+166EBD: 41 5E - pop r14
}
141
"Issen Count"
0
2 Bytes
issen_ptr
14C
137
"Kill Count (Kill enemies to update)"
Auto Assembler Script
[ENABLE]
aobscanmodule(kill,Onimusha2.exe,66 FF 87 3E 01 00 00) // should be unique
alloc(newmem,$1000,kill)
label(code)
label(return)
registersymbol(kill_ptr)
newmem:
mov [kill_ptr],rdi
code:
inc word ptr [rdi+0000013E]
jmp return
kill_ptr:
dq 0
kill:
jmp newmem
nop 2
return:
registersymbol(kill)
[DISABLE]
kill:
db 66 FF 87 3E 01 00 00
unregistersymbol(kill_ptr)
unregistersymbol(kill)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+177EEB6
Onimusha2.exe+177EE8F: 0F B6 80 26 01 00 00 - movzx eax,byte ptr [rax+00000126]
Onimusha2.exe+177EE96: 84 C0 - test al,al
Onimusha2.exe+177EE98: 75 3E - jne Onimusha2.exe+177EED8
Onimusha2.exe+177EE9A: 48 85 FF - test rdi,rdi
Onimusha2.exe+177EE9D: 74 D8 - je Onimusha2.exe+177EE77
Onimusha2.exe+177EE9F: B8 0F 27 00 00 - mov eax,0000270F
Onimusha2.exe+177EEA4: 66 39 87 3E 01 00 00 - cmp [rdi+0000013E],ax
Onimusha2.exe+177EEAB: 72 09 - jb Onimusha2.exe+177EEB6
Onimusha2.exe+177EEAD: 66 89 87 3E 01 00 00 - mov [rdi+0000013E],ax
Onimusha2.exe+177EEB4: EB 07 - jmp Onimusha2.exe+177EEBD
// ---------- INJECTING HERE ----------
Onimusha2.exe+177EEB6: 66 FF 87 3E 01 00 00 - inc word ptr [rdi+0000013E]
// ---------- DONE INJECTING ----------
Onimusha2.exe+177EEBD: 48 8B CB - mov rcx,rbx
Onimusha2.exe+177EEC0: E8 EB 66 AA FE - call Onimusha2.exe+2255B0
Onimusha2.exe+177EEC5: 48 85 C0 - test rax,rax
Onimusha2.exe+177EEC8: 74 AD - je Onimusha2.exe+177EE77
Onimusha2.exe+177EECA: 48 8B 48 48 - mov rcx,[rax+48]
Onimusha2.exe+177EECE: 48 85 C9 - test rcx,rcx
Onimusha2.exe+177EED1: 74 A4 - je Onimusha2.exe+177EE77
Onimusha2.exe+177EED3: FE 41 19 - inc byte ptr [rcx+19]
Onimusha2.exe+177EED6: EB 1D - jmp Onimusha2.exe+177EEF5
Onimusha2.exe+177EED8: 3C 01 - cmp al,01
}
138
"Count"
0
2 Bytes
kill_ptr
13E
154
"Freeze Save Count"
Auto Assembler Script
[ENABLE]
aobscanmodule(savect,Onimusha2.exe,FE C0 88 87 FE 00 00 00 0F BE C0 88 46 37 0F BF 87 BE 00 00 00 66 89 46 2C 0F BF 87 C8 00 00 00) // should be unique
alloc(newmem,$1000,savect)
label(code)
label(return)
newmem:
code:
//inc al
mov [rdi+000000FE],al
jmp return
savect:
jmp newmem
nop 3
return:
registersymbol(savect)
[DISABLE]
savect:
db FE C0 88 87 FE 00 00 00
unregistersymbol(savect)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+626821
Onimusha2.exe+626809: BF FE 00 00 00 - mov edi,000000FE
Onimusha2.exe+62680E: 63 7C 09 0F - movsxd rdi,dword ptr [rcx+rcx+0F]
Onimusha2.exe+626812: BE 87 FE 00 00 - mov esi,0000FE87
Onimusha2.exe+626817: 00 EB - add bl,ch
Onimusha2.exe+626819: 12 0F - adc cl,byte ptr [rdi]
Onimusha2.exe+62681B: B6 87 - mov dh,-79
Onimusha2.exe+62681D: FE 00 - inc byte ptr [rax]
Onimusha2.exe+62681F: 00 00 - add [rax],al
Onimusha2.exe+626821: FE C0 - inc al
Onimusha2.exe+626823: 88 87 FE 00 00 00 - mov [rdi+000000FE],al
// ---------- INJECTING HERE ----------
Onimusha2.exe+626829: 0F BE C0 - movsx eax,al
// ---------- DONE INJECTING ----------
Onimusha2.exe+62682C: 88 46 37 - mov [rsi+37],al
Onimusha2.exe+62682F: 0F BF 87 BE 00 00 00 - movsx eax,word ptr [rdi+000000BE]
Onimusha2.exe+626836: 66 89 46 2C - mov [rsi+2C],ax
Onimusha2.exe+62683A: 0F BF 87 C8 00 00 00 - movsx eax,word ptr [rdi+000000C8]
Onimusha2.exe+626841: 66 89 46 2E - mov [rsi+2E],ax
Onimusha2.exe+626845: 0F BF 87 BC 00 00 00 - movsx eax,word ptr [rdi+000000BC]
Onimusha2.exe+62684C: 66 89 46 30 - mov [rsi+30],ax
Onimusha2.exe+626850: 0F BF 87 C0 00 00 00 - movsx eax,word ptr [rdi+000000C0]
Onimusha2.exe+626857: 66 89 46 32 - mov [rsi+32],ax
Onimusha2.exe+62685B: 0F B6 87 D2 00 00 00 - movzx eax,byte ptr [rdi+000000D2]
}
174
"Easy Issen"
Auto Assembler Script
[ENABLE]
aobscanmodule(bncheck,Onimusha2.exe,75 66 48 8B 05 DE A6 29 09) // should be unique
alloc(newmem,$1000,bncheck)
label(code)
label(return)
newmem:
code:
//jne Onimusha2.exe+165749
mov rax,[Onimusha2.exe+93FFDC8]
jmp return
bncheck:
jmp newmem
nop 4
return:
registersymbol(bncheck)
aobscanmodule(bncheck2,Onimusha2.exe,0F 85 B3 00 00 00 48 8B C6) // should be unique
alloc(newmem2,$1000,bncheck2)
label(code2)
label(return2)
newmem2:
code2:
jmp Onimusha2.exe+46A61F
jmp return2
bncheck2:
jmp newmem2
nop
return2:
registersymbol(bncheck2)
aobscanmodule(realmcheck,Onimusha2.exe,84 C0 0F 85 FD 00 00 00 48 8B CB) // should be unique
alloc(newmem3,$1000,realmcheck)
label(code3)
label(return3)
newmem3:
code3:
//test al,al
//jne Onimusha2.exe+165749
jmp return3
realmcheck:
jmp newmem3
nop 3
return3:
registersymbol(realmcheck)
[DISABLE]
bncheck:
db 75 66 48 8B 05 DE A6 29 09
bncheck2:
db 0F 85 B3 00 00 00
realmcheck:
db 84 C0 0F 85 FD 00 00 00
unregistersymbol(bncheck)
unregistersymbol(bncheck2)
unregistersymbol(realmcheck)
dealloc(newmem)
dealloc(newmem2)
dealloc(newmem3)
134
"Pointers"
1
44
"Items"
1
43
"Herb"
0
Byte
"Onimusha2.exe"+09419DF8
1C
28
D0
38
46
"Medicine"
0
Byte
"Onimusha2.exe"+09419DF8
6C
28
D0
38
47
"Secret Medicine"
0
Byte
"Onimusha2.exe"+09419DF8
BC
28
D0
38
48
"Perfect Medicine"
0
Byte
"Onimusha2.exe"+09419DF8
10C
28
D0
38
49
"Magic Liquid"
0
Byte
"Onimusha2.exe"+09419DF8
15C
28
D0
38
50
"Special Magic Liquid"
0
Byte
"Onimusha2.exe"+09419DF8
1AC
28
D0
38
51
"Super Magic Liquid"
0
Byte
"Onimusha2.exe"+09419DF8
1FC
28
D0
38
57
"Talisman"
0
Byte
"Onimusha2.exe"+09419DF8
3DC
28
D0
38
111
"Fossilized Bone"
0
Byte
"Onimusha2.exe"+09419DF8
1C
3F0
D0
38
133
"Black Necklace"
0
Byte
"Onimusha2.exe"+09419DF8
1C
908
D0
38
1
"Gold Pointer (Open Inventory to Update Address)"
Auto Assembler Script
[ENABLE]
aobscanmodule(gold,Onimusha2.exe,8B B0 10 01 00 00 48 8B CB) // should be unique
alloc(newmem,$1000,gold)
label(code)
label(return)
registersymbol(gold_ptr)
newmem:
mov [gold_ptr],rax
code:
mov esi,[rax+00000110]
jmp return
gold_ptr:
dq 0
gold:
jmp newmem
nop
return:
registersymbol(gold)
[DISABLE]
gold:
db 8B B0 10 01 00 00
unregistersymbol(gold_ptr)
unregistersymbol(gold)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+1684CDB
Onimusha2.exe+1684CB8: 75 19 - jne Onimusha2.exe+1684CD3
Onimusha2.exe+1684CBA: 45 33 C0 - xor r8d,r8d
Onimusha2.exe+1684CBD: 48 8B CB - mov rcx,rbx
Onimusha2.exe+1684CC0: 41 8D 50 38 - lea edx,[r8+38]
Onimusha2.exe+1684CC4: 48 8B 7C 24 48 - mov rdi,[rsp+48]
Onimusha2.exe+1684CC9: 48 83 C4 30 - add rsp,30
Onimusha2.exe+1684CCD: 5B - pop rbx
Onimusha2.exe+1684CCE: E9 9D A0 B9 00 - jmp Onimusha2.exe+221ED70
Onimusha2.exe+1684CD3: 45 33 C0 - xor r8d,r8d
Onimusha2.exe+1684CD6: 48 89 74 24 40 - mov [rsp+40],rsi
// ---------- INJECTING HERE ----------
Onimusha2.exe+1684CDB: 8B B0 10 01 00 00 - mov esi,[rax+00000110]
// ---------- DONE INJECTING ----------
Onimusha2.exe+1684CE1: 48 8B CB - mov rcx,rbx
Onimusha2.exe+1684CE4: 48 85 FF - test rdi,rdi
Onimusha2.exe+1684CE7: 74 2E - je Onimusha2.exe+1684D17
Onimusha2.exe+1684CE9: 45 33 C9 - xor r9d,r9d
Onimusha2.exe+1684CEC: 48 8D 15 A5 BF D9 07 - lea rdx,[Onimusha2.exe+9420C98]
Onimusha2.exe+1684CF3: E8 F8 23 C0 00 - call Onimusha2.exe+22870F0
Onimusha2.exe+1684CF8: 83 F8 01 - cmp eax,01
Onimusha2.exe+1684CFB: 74 08 - je Onimusha2.exe+1684D05
Onimusha2.exe+1684CFD: 48 8B CB - mov rcx,rbx
Onimusha2.exe+1684D00: E8 7B DC EA FF - call Onimusha2.exe+1532980
}
3
"Gold"
0
4 Bytes
gold_ptr
110
13
"Current Soul Pointer"
Auto Assembler Script
[ENABLE]
aobscanmodule(soul,Onimusha2.exe,41 0F BF 8E F8 01 00 00) // should be unique
alloc(newmem,$1000,soul)
label(code)
label(return)
registersymbol(soul_ptr)
newmem:
mov [soul_ptr],r14
code:
movsx ecx,word ptr [r14+000001F8]
jmp return
soul_ptr:
dq 0
soul:
jmp newmem
nop 3
return:
registersymbol(soul)
[DISABLE]
soul:
db 41 0F BF 8E F8 01 00 00
unregistersymbol(soul_ptr)
unregistersymbol(soul)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+13C5E54
Onimusha2.exe+13C5E27: 75 0B - jne Onimusha2.exe+13C5E34
Onimusha2.exe+13C5E29: 48 8B D7 - mov rdx,rdi
Onimusha2.exe+13C5E2C: 48 8B CB - mov rcx,rbx
Onimusha2.exe+13C5E2F: E8 3C 31 00 00 - call Onimusha2.exe+13C8F70
Onimusha2.exe+13C5E34: 48 85 F6 - test rsi,rsi
Onimusha2.exe+13C5E37: 0F 84 81 02 00 00 - je Onimusha2.exe+13C60BE
Onimusha2.exe+13C5E3D: 4D 85 F6 - test r14,r14
Onimusha2.exe+13C5E40: 0F 84 78 02 00 00 - je Onimusha2.exe+13C60BE
Onimusha2.exe+13C5E46: 0F BF 96 FC 00 00 00 - movsx edx,word ptr [rsi+000000FC]
Onimusha2.exe+13C5E4D: 48 8D 86 32 01 00 00 - lea rax,[rsi+00000132]
// ---------- INJECTING HERE ----------
Onimusha2.exe+13C5E54: 41 0F BF 8E F8 01 00 00 - movsx ecx,word ptr [r14+000001F8]
// ---------- DONE INJECTING ----------
Onimusha2.exe+13C5E5C: 4C 8D 8E D4 00 00 00 - lea r9,[rsi+000000D4]
Onimusha2.exe+13C5E63: 66 C7 44 24 38 04 00 - mov word ptr [rsp+38],0004
Onimusha2.exe+13C5E6A: 4C 8D 86 D0 00 00 00 - lea r8,[rsi+000000D0]
Onimusha2.exe+13C5E71: 48 89 44 24 30 - mov [rsp+30],rax
Onimusha2.exe+13C5E76: 89 54 24 28 - mov [rsp+28],edx
Onimusha2.exe+13C5E7A: 48 8B D7 - mov rdx,rdi
Onimusha2.exe+13C5E7D: 89 4C 24 20 - mov [rsp+20],ecx
Onimusha2.exe+13C5E81: 48 8B CB - mov rcx,rbx
Onimusha2.exe+13C5E84: E8 37 E7 00 00 - call Onimusha2.exe+13D45C0
Onimusha2.exe+13C5E89: 48 8B 87 18 02 00 00 - mov rax,[rdi+00000218]
}
14
"Current Soul"
0
4 Bytes
soul_ptr
1F8
45
"Debug"
FF0000
1
36
"Herb1"
4 Bytes
13CC8FDC
37
"Herb2"
4 Bytes
13FCBADC
106
"Fossilized Bone 1"
0
Byte
13BB2CBC
107
"Fossilized Bone 2"
0
Byte
13A3C63C
123
"BN1"
0
4 Bytes
138CE47C
124
"BN2"
0
4 Bytes
13889A7C
125
"BN3"
0
4 Bytes
13922E4C
97
"Soul Gain Multiplier (Unnecesary)"
808080
Auto Assembler Script
[ENABLE]
aobscanmodule(soul,Onimusha2.exe,03 CE 89 8A F8 01 00 00) // should be unique
alloc(newmem,$1000,soul)
label(code)
label(return)
registersymbol(soul_mult)
newmem:
imul esi,[soul_mult]
code:
add ecx,esi
mov [rdx+000001F8],ecx
jmp return
soul_mult:
dq #1
soul:
jmp newmem
nop 3
return:
registersymbol(soul)
[DISABLE]
soul:
db 03 CE 89 8A F8 01 00 00
unregistersymbol(soul_mult)
unregistersymbol(soul)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+13DA19E
Onimusha2.exe+13DA16A: 73 20 - jae Onimusha2.exe+13DA18C
Onimusha2.exe+13DA16C: 8B 8A FC 01 00 00 - mov ecx,[rdx+000001FC]
Onimusha2.exe+13DA172: 03 CE - add ecx,esi
Onimusha2.exe+13DA174: 89 8A FC 01 00 00 - mov [rdx+000001FC],ecx
Onimusha2.exe+13DA17A: 81 F9 3F 42 0F 00 - cmp ecx,000F423F
Onimusha2.exe+13DA180: 76 0A - jna Onimusha2.exe+13DA18C
Onimusha2.exe+13DA182: C7 82 FC 01 00 00 3F 42 0F 00 - mov [rdx+000001FC],000F423F
Onimusha2.exe+13DA18C: 81 BA F8 01 00 00 9F 86 01 00 - cmp [rdx+000001F8],0001869F
Onimusha2.exe+13DA196: 73 20 - jae Onimusha2.exe+13DA1B8
Onimusha2.exe+13DA198: 8B 8A F8 01 00 00 - mov ecx,[rdx+000001F8]
// ---------- INJECTING HERE ----------
Onimusha2.exe+13DA19E: 03 CE - add ecx,esi
// ---------- DONE INJECTING ----------
Onimusha2.exe+13DA1A0: 89 8A F8 01 00 00 - mov [rdx+000001F8],ecx
Onimusha2.exe+13DA1A6: 81 F9 9F 86 01 00 - cmp ecx,0001869F
Onimusha2.exe+13DA1AC: 76 0A - jna Onimusha2.exe+13DA1B8
Onimusha2.exe+13DA1AE: C7 82 F8 01 00 00 9F 86 01 00 - mov [rdx+000001F8],0001869F
Onimusha2.exe+13DA1B8: 48 8B 5C 24 30 - mov rbx,[rsp+30]
Onimusha2.exe+13DA1BD: 48 8B 6C 24 38 - mov rbp,[rsp+38]
Onimusha2.exe+13DA1C2: 48 8B 74 24 40 - mov rsi,[rsp+40]
Onimusha2.exe+13DA1C7: 48 83 C4 20 - add rsp,20
Onimusha2.exe+13DA1CB: 5F - pop rdi
Onimusha2.exe+13DA1CC: C3 - ret
}
98
"Multiplier"
0
4 Bytes
soul_mult
16
"Health Pointer"
Auto Assembler Script
[ENABLE]
aobscanmodule(health,Onimusha2.exe,0F B7 42 10 C3) // should be unique
alloc(newmem,$1000,health)
label(code)
label(return)
registersymbol(health_ptr)
newmem:
mov [health_ptr],rdx
code:
movzx eax,word ptr [rdx+10]
ret
jmp return
health_ptr:
dq 0
health:
jmp newmem
return:
registersymbol(health)
[DISABLE]
health:
db 0F B7 42 10 C3
unregistersymbol(health_ptr)
unregistersymbol(health)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+1C5B30
Onimusha2.exe+1C5B26: CC - int 3
Onimusha2.exe+1C5B27: CC - int 3
Onimusha2.exe+1C5B28: CC - int 3
Onimusha2.exe+1C5B29: CC - int 3
Onimusha2.exe+1C5B2A: CC - int 3
Onimusha2.exe+1C5B2B: CC - int 3
Onimusha2.exe+1C5B2C: CC - int 3
Onimusha2.exe+1C5B2D: CC - int 3
Onimusha2.exe+1C5B2E: CC - int 3
Onimusha2.exe+1C5B2F: CC - int 3
// ---------- INJECTING HERE ----------
Onimusha2.exe+1C5B30: 0F B7 42 10 - movzx eax,word ptr [rdx+10]
// ---------- DONE INJECTING ----------
Onimusha2.exe+1C5B34: C3 - ret
Onimusha2.exe+1C5B35: CC - int 3
Onimusha2.exe+1C5B36: CC - int 3
Onimusha2.exe+1C5B37: CC - int 3
Onimusha2.exe+1C5B38: CC - int 3
Onimusha2.exe+1C5B39: CC - int 3
Onimusha2.exe+1C5B3A: CC - int 3
Onimusha2.exe+1C5B3B: CC - int 3
Onimusha2.exe+1C5B3C: CC - int 3
Onimusha2.exe+1C5B3D: CC - int 3
}
17
"Current Health"
0
4 Bytes
health_ptr
10
34
"Magic Pointer"
Auto Assembler Script
[ENABLE]
aobscanmodule(magic,Onimusha2.exe,C0 0F B7 44 41 20) // should be unique
alloc(newmem,$1000,magic)
label(code)
label(return)
registersymbol(magic_ptr)
newmem:
mov [magic_ptr],rcx
code:
movzx eax,word ptr [rcx+rax*2+20]
jmp return
magic_ptr:
dq 0
magic+01:
jmp newmem
return:
registersymbol(magic)
[DISABLE]
magic+01:
db 0F B7 44 41 20
unregistersymbol(magic_ptr)
unregistersymbol(magic)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+B28E7D
Onimusha2.exe+B28E5E: 44 3B 41 1C - cmp r8d,[rcx+1C]
Onimusha2.exe+B28E62: 72 16 - jb Onimusha2.exe+B28E7A
Onimusha2.exe+B28E64: 45 33 C0 - xor r8d,r8d
Onimusha2.exe+B28E67: 49 8B C9 - mov rcx,r9
Onimusha2.exe+B28E6A: 41 8D 50 37 - lea edx,[r8+37]
Onimusha2.exe+B28E6E: E8 FD 5E 6F 01 - call Onimusha2.exe+221ED70
Onimusha2.exe+B28E73: 33 C0 - xor eax,eax
Onimusha2.exe+B28E75: 48 83 C4 28 - add rsp,28
Onimusha2.exe+B28E79: C3 - ret
Onimusha2.exe+B28E7A: 49 63 C0 - movsxd rax,r8d
// ---------- INJECTING HERE ----------
Onimusha2.exe+B28E7D: 0F B7 44 41 20 - movzx eax,word ptr [rcx+rax*2+20]
// ---------- DONE INJECTING ----------
Onimusha2.exe+B28E82: 48 83 C4 28 - add rsp,28
Onimusha2.exe+B28E86: C3 - ret
Onimusha2.exe+B28E87: CC - int 3
Onimusha2.exe+B28E88: CC - int 3
Onimusha2.exe+B28E89: CC - int 3
Onimusha2.exe+B28E8A: CC - int 3
Onimusha2.exe+B28E8B: CC - int 3
Onimusha2.exe+B28E8C: CC - int 3
Onimusha2.exe+B28E8D: CC - int 3
Onimusha2.exe+B28E8E: CC - int 3
}
35
"Current Magic"
0
2 Bytes
magic_ptr
20
162
"Black Necklace Check 1"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT,Onimusha2.exe,80 B9 0D 02 00 00 05 75 66) // should be unique
alloc(newmem,$1000,INJECT)
label(code)
label(return)
newmem:
code:
cmp byte ptr [rcx+0000020D],05
jmp return
INJECT:
jmp newmem
nop 2
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 80 B9 0D 02 00 00 05
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+1656DA
Onimusha2.exe+1656AC: 3B 46 1C - cmp eax,[rsi+1C]
Onimusha2.exe+1656AF: 0F 83 21 FE FF FF - jae Onimusha2.exe+1654D6
Onimusha2.exe+1656B5: 0F B6 4C 30 20 - movzx ecx,byte ptr [rax+rsi+20]
Onimusha2.exe+1656BA: 48 85 ED - test rbp,rbp
Onimusha2.exe+1656BD: 0F 84 B2 FD FF FF - je Onimusha2.exe+165475
Onimusha2.exe+1656C3: 3B 4D 1C - cmp ecx,[rbp+1C]
Onimusha2.exe+1656C6: 0F 83 0A FE FF FF - jae Onimusha2.exe+1654D6
Onimusha2.exe+1656CC: 48 8B 4C CD 20 - mov rcx,[rbp+rcx*8+20]
Onimusha2.exe+1656D1: 48 85 C9 - test rcx,rcx
Onimusha2.exe+1656D4: 0F 84 9B FD FF FF - je Onimusha2.exe+165475
// ---------- INJECTING HERE ----------
Onimusha2.exe+1656DA: 80 B9 0D 02 00 00 05 - cmp byte ptr [rcx+0000020D],05
// ---------- DONE INJECTING ----------
Onimusha2.exe+1656E1: 75 66 - jne Onimusha2.exe+165749
Onimusha2.exe+1656E3: 48 8B 05 DE A6 29 09 - mov rax,[Onimusha2.exe+93FFDC8]
Onimusha2.exe+1656EA: F3 0F 10 0D EE A6 29 09 - movss xmm1,[Onimusha2.exe+93FFDE0]
Onimusha2.exe+1656F2: 0F 5A C9 - cvtps2pd xmm1,xmm1
Onimusha2.exe+1656F5: 48 85 C0 - test rax,rax
Onimusha2.exe+1656F8: 0F 84 77 FD FF FF - je Onimusha2.exe+165475
Onimusha2.exe+1656FE: 83 78 1C 01 - cmp dword ptr [rax+1C],01
Onimusha2.exe+165702: 0F 86 CE FD FF FF - jbe Onimusha2.exe+1654D6
Onimusha2.exe+165708: F3 0F 10 40 24 - movss xmm0,[rax+24]
Onimusha2.exe+16570D: 0F 5A C0 - cvtps2pd xmm0,xmm0
}
163
"Black Necklace Check 2"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT,Onimusha2.exe,80 BA 0D 02 00 00 05) // should be unique
alloc(newmem,$1000,INJECT)
label(code)
label(return)
newmem:
code:
cmp rdx,05
jmp return
INJECT:
jmp newmem
nop 2
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 80 BA 0D 02 00 00 05
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+46A55F
Onimusha2.exe+46A539: EB 02 - jmp Onimusha2.exe+46A53D
Onimusha2.exe+46A53B: FF C8 - dec eax
Onimusha2.exe+46A53D: 48 85 C9 - test rcx,rcx
Onimusha2.exe+46A540: 0F 84 12 07 00 00 - je Onimusha2.exe+46AC58
Onimusha2.exe+46A546: 3B 41 1C - cmp eax,[rcx+1C]
Onimusha2.exe+46A549: 0F 83 35 FB FF FF - jae Onimusha2.exe+46A084
Onimusha2.exe+46A54F: 48 98 - cdqe
Onimusha2.exe+46A551: 48 8B 54 C1 20 - mov rdx,[rcx+rax*8+20]
Onimusha2.exe+46A556: 48 85 D2 - test rdx,rdx
Onimusha2.exe+46A559: 0F 84 F9 06 00 00 - je Onimusha2.exe+46AC58
// ---------- INJECTING HERE ----------
Onimusha2.exe+46A55F: 80 BA 0D 02 00 00 05 - cmp byte ptr [rdx+0000020D],05
// ---------- DONE INJECTING ----------
Onimusha2.exe+46A566: 0F 85 B3 00 00 00 - jne Onimusha2.exe+46A61F
Onimusha2.exe+46A56C: 48 8B C6 - mov rax,rsi
Onimusha2.exe+46A56F: 49 23 C6 - and rax,r14
Onimusha2.exe+46A572: 48 8B 00 - mov rax,[rax]
Onimusha2.exe+46A575: 48 85 C0 - test rax,rax
Onimusha2.exe+46A578: 0F 84 DA 06 00 00 - je Onimusha2.exe+46AC58
Onimusha2.exe+46A57E: 48 8B 40 20 - mov rax,[rax+20]
Onimusha2.exe+46A582: 48 85 C0 - test rax,rax
Onimusha2.exe+46A585: 0F 84 CD 06 00 00 - je Onimusha2.exe+46AC58
Onimusha2.exe+46A58B: 48 8D 50 40 - lea rdx,[rax+40]
}
165
"Enable Necklace Power in Phantom Realm"
Auto Assembler Script
[ENABLE]
aobscanmodule(issen,Onimusha2.exe,84 C0 0F 85 FD 00 00 00 48 8B CB) // should be unique
alloc(newmem,$1000,issen)
label(code)
label(return)
newmem:
code:
//test al,al
//jne Onimusha2.exe+165749
nop 8
jmp return
issen:
jmp newmem
nop 3
return:
registersymbol(issen)
[DISABLE]
issen:
db 84 C0 0F 85 FD 00 00 00
unregistersymbol(issen)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Onimusha2.exe+165644
Onimusha2.exe+165616: C6 81 1F 01 00 00 05 - mov byte ptr [rcx+0000011F],05
Onimusha2.exe+16561D: E9 13 02 00 00 - jmp Onimusha2.exe+165835
Onimusha2.exe+165622: 48 8B CB - mov rcx,rbx
Onimusha2.exe+165625: E8 06 03 0C 00 - call Onimusha2.exe+225930
Onimusha2.exe+16562A: 48 8B CB - mov rcx,rbx
Onimusha2.exe+16562D: 48 85 C0 - test rax,rax
Onimusha2.exe+165630: 0F 84 CA FE FF FF - je Onimusha2.exe+165500
Onimusha2.exe+165636: 41 B8 06 0F 00 00 - mov r8d,00000F06
Onimusha2.exe+16563C: 48 8B D0 - mov rdx,rax
Onimusha2.exe+16563F: E8 AC 77 5F 01 - call Onimusha2.exe+175CDF0
// ---------- INJECTING HERE ----------
Onimusha2.exe+165644: 84 C0 - test al,al
// ---------- DONE INJECTING ----------
Onimusha2.exe+165646: 0F 85 FD 00 00 00 - jne Onimusha2.exe+165749
Onimusha2.exe+16564C: 48 8B CB - mov rcx,rbx
Onimusha2.exe+16564F: E8 5C FF 0B 00 - call Onimusha2.exe+2255B0
Onimusha2.exe+165654: 48 85 C0 - test rax,rax
Onimusha2.exe+165657: 0F 84 18 FE FF FF - je Onimusha2.exe+165475
Onimusha2.exe+16565D: 48 8B 40 38 - mov rax,[rax+38]
Onimusha2.exe+165661: 48 85 C0 - test rax,rax
Onimusha2.exe+165664: 0F 84 0B FE FF FF - je Onimusha2.exe+165475
Onimusha2.exe+16566A: 48 8B A8 88 00 00 00 - mov rbp,[rax+00000088]
Onimusha2.exe+165671: 48 8B 35 60 A7 29 09 - mov rsi,[Onimusha2.exe+93FFDD8]
}
Change of mov [rdx+10],ax
Onimusha2.exe+1C5B21
C0
41
0F
B7
00
66
89
42
10
C3
CC
CC
CC
CC
Change of jne Onimusha2.exe+165749
Onimusha2.exe+1656E1
0D
02
00
00
05
75
66
48
8B
05
DE
A6
Change of cmp byte ptr [rdx+0000020D],05
Onimusha2.exe+46A55F
84
F9
06
00
00
80
BA
0D
02
00
00
05
0F
85
B3
00
00
Change of cmp byte ptr [rcx+0000020D],05
Onimusha2.exe+1656DA
84
9B
FD
FF
FF
80
B9
0D
02
00
00
05
75
66
48
8B
05
Change of jne Onimusha2.exe+46A61F
Onimusha2.exe+46A566
0D
02
00
00
05
0F
85
B3
00
00
00
48
8B
C6
49
23
Change of jne Onimusha2.exe+165749
Onimusha2.exe+165646
77
5F
01
84
C0
0F
85
FD
00
00
00
48
8B
CB
E8
5C