19021
"Allow VEH"
Auto Assembler Script
{$LUA}
if syntaxcheck then return end
local symbolName = "KERNELBASE.SetThreadContext"
[ENABLE]
local bt = {195, 144, 144, 144} --C3 90 90 90 (ret nop nop nop)
writeBytes(symbolName, bt)
[DISABLE]
local bt = {72, 131, 236, 40} --48 83 EC 28 (sub rsp, 28)
writeBytes(symbolName, bt)
19042
"[Pointers]"
1
19046
"Data"
1
1337092194
"Buff Slot 1? Bonus"
0
4 Bytes
SOR4.exe+14BF3C0
90
68
20
150
10
0
1337092195
"Air Master Extra Jump"
0
Byte
SOR4.exe+14BF3C0
92
80
20
150
10
0
19056
"Combo Timer"
0
4 Bytes
SOR4.exe+14BF3B8
6C
D8
28
0
19045
"Extra Life Score"
0
4 Bytes
SOR4.exe+14BF3B8
88
D8
28
0
19058
"No New Lives Score"
0
4 Bytes
SOR4.exe+14BF3B8
8C
D8
28
0
1337092190
"Extra Star Score"
0
4 Bytes
SOR4.exe+14BF3C0
BC
150
10
0
1337092199
"Extra Star Score Per Milestone"
0
4 Bytes
SOR4.exe+14BF3C0
C0
150
10
0
26
"Character Select"
0
2 Bytes
SOR4.exe+14BFE38
10
8
10
88
0
20
"Combo"
1
15
"Combo"
0
4 Bytes
SOR4.exe+14BFE38
68
58
0
16
"Combo Time"
0
4 Bytes
SOR4.exe+14BFE38
64
58
0
21
"Player 1"
1
19052
"Health"
0
4 Bytes
SOR4.exe+14BFE38
3A
10
8
10
10
1A0
58
0
1337092197
"Max Jumps"
0
4 Bytes
SOR4.exe+14BFE38
13C
10
8
10
10
1A0
58
0
19041
"Time (Multiplayer)"
0
4 Bytes
SOR4.exe+14BFE38
1C
18
58
0
19037
"Base"
0
4 Bytes
SOR4.exe+14BFE38
0
10
58
0
22
"Lives"
0
4 Bytes
SOR4.exe+14BFE38
20
10
58
0
Set Value
17
97
3
0
19048
"Health (Visual)"
0
Byte
SOR4.exe+14BFE38
26
10
58
0
17
"Friendly Damage"
1
Byte
SOR4.exe+14BFE38
2A
10
58
0
9
"Stars"
0
4 Bytes
SOR4.exe+14BFE38
30
10
58
0
Set Value
17
97
2
0
10
"Score"
0
4 Bytes
SOR4.exe+14BFE38
34
10
58
0
24
"Damage"
0
2 Bytes
SOR4.exe+14BFE38
3A
10
58
0
Increase Value
17
98
300
0
19
"First Hit (flag)"
0
4 Bytes
SOR4.exe+14BFE38
5C
10
58
0
27
"Player 2"
1
19053
"Health"
0
4 Bytes
SOR4.exe+14BFE38
3A
18
8
10
10
1A0
58
0
29
"Lives"
0
4 Bytes
SOR4.exe+14BFE38
A8
10
58
0
Set Value
17
97
3
0
31
"Health (Visual)"
0
2 Bytes
SOR4.exe+14BFE38
AE
10
58
0
30
"Friendly Damage"
1
Byte
SOR4.exe+14BFE38
B0
10
58
0
34
"Stars"
0
4 Bytes
SOR4.exe+14BFE38
B8
10
58
0
Set Value
17
97
2
0
32
"Score"
0
4 Bytes
SOR4.exe+14BFE38
BC
10
58
0
36
"Damage"
0
2 Bytes
SOR4.exe+14BFE38
C2
10
58
0
35
"First Hit (flag)"
0
4 Bytes
SOR4.exe+14BFE38
E4
10
58
0
19051
"Time"
0
4 Bytes
SOR4.exe+14BFE38
34
18
58
0
19027
"[DEBUG]"
1
19026
"Select Same Char"
0000FF
Auto Assembler Script
{ Game : SOR4.exe
Version:
Date : 2020-05-10
Author : Marcus101RR
This script does blah blah blah
}
[ENABLE]
aobscanmodule(gSelectSame,SOR4.exe,24 28 48 8B 09 48 85 C9) // should be unique
alloc(newmem,$1000,gSelectSame)
label(code)
label(return)
newmem:
code:
mov rcx,[rcx]
mov rcx,00000000
test rcx,rcx
jmp return
gSelectSame+02:
jmp newmem
nop
return:
registersymbol(gSelectSame)
[DISABLE]
gSelectSame+02:
db 48 8B 09 48 85 C9
unregistersymbol(gSelectSame)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "SOR4.exe"+2FFCBD
"SOR4.exe"+2FFC97: 45 33 FF - xor r15d,r15d
"SOR4.exe"+2FFC9A: 45 85 F6 - test r14d,r14d
"SOR4.exe"+2FFC9D: 7E 4D - jle SOR4.exe+2FFCEC
"SOR4.exe"+2FFC9F: 49 63 CF - movsxd rcx,r15d
"SOR4.exe"+2FFCA2: 48 6B C9 70 - imul rcx,rcx,70
"SOR4.exe"+2FFCA6: 48 8D 74 0D 10 - lea rsi,[rbp+rcx+10]
"SOR4.exe"+2FFCAB: 48 8D 7C 24 28 - lea rdi,[rsp+28]
"SOR4.exe"+2FFCB0: B9 0E 00 00 00 - mov ecx,0000000E
"SOR4.exe"+2FFCB5: F3 48 A5 - repe movsq
"SOR4.exe"+2FFCB8: 48 8D 4C 24 28 - lea rcx,[rsp+28]
// ---------- INJECTING HERE ----------
"SOR4.exe"+2FFCBD: 48 8B 09 - mov rcx,[rcx]
"SOR4.exe"+2FFCC0: 48 85 C9 - test rcx,rcx
// ---------- DONE INJECTING ----------
"SOR4.exe"+2FFCC3: 75 07 - jne SOR4.exe+2FFCCC
"SOR4.exe"+2FFCC5: 48 8D 0D 5C 73 07 01 - lea rcx,[SOR4.exe+1377028]
"SOR4.exe"+2FFCCC: 48 8B D3 - mov rdx,rbx
"SOR4.exe"+2FFCCF: 48 85 D2 - test rdx,rdx
"SOR4.exe"+2FFCD2: 75 07 - jne SOR4.exe+2FFCDB
"SOR4.exe"+2FFCD4: 48 8D 15 4D 73 07 01 - lea rdx,[SOR4.exe+1377028]
"SOR4.exe"+2FFCDB: E8 10 63 F8 FF - call SOR4.exe+285FF0
"SOR4.exe"+2FFCE0: 84 C0 - test al,al
"SOR4.exe"+2FFCE2: 75 1D - jne SOR4.exe+2FFD01
"SOR4.exe"+2FFCE4: 41 FF C7 - inc r15d
}
1337092187
"Fetch Base Addresses (Easy)"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
print(string.format("Fetching Base Addresses..."))
local aobList = {
"48 8D 05 ?? ?? ?? ?? 48 8B 00 48 8B 00 48 8D 0D ?? ?? ?? ?? 83 79 08 01 75 01 C3 48 8B D0 E9 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 8B 00 48 8B 00 C3 48 8D 05 ?? ?? ?? ?? 48 8B 00 48 8B 00 48 8D 0D ?? ?? ?? ?? 83 79 08 01 75 01 C3"
}
local aobNames = {
"Base Pointer (Add +AB8)"
}
local xbase = readInteger(process)and GetAddress(process)
print(string.format("Base: %X",xbase))
for i = 1, #aobList do
local aob = AOBScan(aobList[i],"+X*C*W")
local instruct = getAddressSafe(aob[0])
local distance = getAddressSafe(instruct)+3
distance = readInteger(distance)
local instructSize = getInstructionSize(instruct)
local address = (instruct + distance + instructSize) - xbase
print(string.format("%s: SOR4.exe+%X",aobNames[i],address))
end
[DISABLE]
Move Addresses
SOR4.exe+4F356
08
48
8B
42
10
48
89
41
10
48
8B
42
18
48
Score Add
SOR4.exe+467E4B
4D
08
8B
56
28
44
8B
43
1C
41
B9
02
00
00
Buff Data
SOR4.exe+464574
10
8B
E9
EB
41
8B
AB
90
00
00
00
45
33
FF
8B
4C
Mr X DLC Base Address +8