1
"UNCHARTED 4: A THIEF'S END"
1
3
"Pointers"
FF0000
1
302
"Player Base"
1
0
8 Bytes
"u4.exe"+03B7B830
440
1B0
0
303
"Player Health"
4 Bytes
"u4.exe"+03B7B830
478
1B0
0
144
"Player X Coordinate"
0
Float
"u4.exe"+03D2D380
130
0
145
"Player Z Coordinate"
0
Float
"u4.exe"+03D2D380
138
0
146
"Player Y Coordinate"
0
Float
"u4.exe"+03D2D380
134
0
327
"Player X Velocity"
0
Float
"u4.exe"+03D2D380
4A0
1E8
0
330
"Player Z Velocity"
0
Float
"u4.exe"+03D2D380
4A8
1E8
0
329
"Player Y Velocity"
0
Float
"u4.exe"+03D2D380
4A4
1E8
0
212
"Yaw Y"
0
Float
u4.exe+6452874-4
214
"Pitch"
0
Float
u4.exe+6452874
213
"Yaw X"
0
Float
u4.exe+6452874+4
310
"Scripts"
0000FF
1
306
"Godmode"
Auto Assembler Script
{ Game : u4.exe
Version:
Date : 2025-07-13
Author : Owner
This script does blah blah blah
}
[ENABLE]
aobscanmodule(godmode1,u4.exe,48 8B C4 53 56 57 41 54 41 55 41 56 41 57 48 81 EC A0 04) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
ret
code:
mov rax,rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
jmp return
godmode1:
jmp far newmem
return:
registersymbol(godmode1)
[DISABLE]
godmode1:
db 48 8B C4 53 56 57 41 54 41 55 41 56 41 57
unregistersymbol(godmode1)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: u4.exe+D4EF50
u4.exe+D4EF46: 5F - pop rdi
u4.exe+D4EF47: 5E - pop rsi
u4.exe+D4EF48: 5D - pop rbp
u4.exe+D4EF49: 5B - pop rbx
u4.exe+D4EF4A: C3 - ret
u4.exe+D4EF4B: CC - int 3
u4.exe+D4EF4C: CC - int 3
u4.exe+D4EF4D: CC - int 3
u4.exe+D4EF4E: CC - int 3
u4.exe+D4EF4F: CC - int 3
// ---------- INJECTING HERE ----------
u4.exe+D4EF50: 48 8B C4 - mov rax,rsp
// ---------- DONE INJECTING ----------
u4.exe+D4EF53: 53 - push rbx
u4.exe+D4EF54: 56 - push rsi
u4.exe+D4EF55: 57 - push rdi
u4.exe+D4EF56: 41 54 - push r12
u4.exe+D4EF58: 41 55 - push r13
u4.exe+D4EF5A: 41 56 - push r14
u4.exe+D4EF5C: 41 57 - push r15
u4.exe+D4EF5E: 48 81 EC A0 04 00 00 - sub rsp,000004A0
u4.exe+D4EF65: 48 C7 44 24 70 FE FF FF FF - mov qword ptr [rsp+70],FFFFFFFFFFFFFFFE
u4.exe+D4EF6E: C5 F8 29 70 B8 - vmovaps [rax-48],xmm6
}
Toggle Activation
96
0
Activate
Deactivate
305
"Infinite Health (2.1)"
Auto Assembler Script
{ Game : u4.exe
Version:
Date : 2025-07-13
Author : Owner
This script does blah blah blah
}
[ENABLE]
aobscanmodule(infHealth2,u4.exe,48 89 6C 24 20 56 57 41 57 48 83 EC 30 83 79 68 02) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
push rax
mov rax,["u4.exe"+03B7B830]
test rax,rax
jz nullptr_detected
mov rax,[rax+0]
test rax,rax
jz nullptr_detected
mov rax,[rax+1B0]
test rax,rax
jz nullptr_detected
add rax,440
test rax,rax
jz nullptr_detected
cmp rcx,rax
pop rax
jne code // if it's player, return
ret
code:
mov [rsp+20],rbp
push rsi
push rdi
push r15
sub rsp,30
cmp dword ptr [rcx+68],02
jmp return
nullptr_detected:
pop rax
jmp code
infHealth2:
jmp far newmem
nop 3
return:
registersymbol(infHealth2)
[DISABLE]
infHealth2:
db 48 89 6C 24 20 56 57 41 57 48 83 EC 30 83 79 68 02
unregistersymbol(infHealth2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: u4.exe+1EA4DD0
u4.exe+1EA4DB6: C3 - ret
u4.exe+1EA4DB7: C5 F8 28 7C 24 20 - vmovaps xmm7,[rsp+20]
u4.exe+1EA4DBD: C5 F8 28 C6 - vmovaps xmm0,xmm6
u4.exe+1EA4DC1: C5 F8 28 74 24 30 - vmovaps xmm6,[rsp+30]
u4.exe+1EA4DC7: 48 83 C4 40 - add rsp,40
u4.exe+1EA4DCB: 5B - pop rbx
u4.exe+1EA4DCC: C3 - ret
u4.exe+1EA4DCD: CC - int 3
u4.exe+1EA4DCE: CC - int 3
u4.exe+1EA4DCF: CC - int 3
// ---------- INJECTING HERE ----------
u4.exe+1EA4DD0: 48 89 6C 24 20 - mov [rsp+20],rbp
// ---------- DONE INJECTING ----------
u4.exe+1EA4DD5: 56 - push rsi
u4.exe+1EA4DD6: 57 - push rdi
u4.exe+1EA4DD7: 41 57 - push r15
u4.exe+1EA4DD9: 48 83 EC 30 - sub rsp,30
u4.exe+1EA4DDD: 83 79 68 02 - cmp dword ptr [rcx+68],02
u4.exe+1EA4DE1: 41 0F B6 F1 - movzx esi,r9b
u4.exe+1EA4DE5: 41 0F B6 E8 - movzx ebp,r8b
u4.exe+1EA4DE9: 44 8B FA - mov r15d,edx
u4.exe+1EA4DEC: 48 8B F9 - mov rdi,rcx
u4.exe+1EA4DEF: 75 13 - jne u4.exe+1EA4E04
}
314
"Super Damage"
Auto Assembler Script
{ Game : u4.exe
Version:
Date : 2025-07-15
Author : Owner
This script does blah blah blah
}
[ENABLE]
aobscanmodule(ohk2,u4.exe,48 8B 1F 48 8B 48 10 48 89 4C 24 50 48 8B CF) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
cmp dword ptr [rdi+4C],-1 // if it's player/ally, then skip code
jne code
mov r15d, #500
code:
mov rbx,[rdi]
mov rcx,[rax+10]
mov [rsp+50],rcx
mov rcx,rdi
jmp return
ohk2:
jmp far newmem
nop
return:
registersymbol(ohk2)
[DISABLE]
ohk2:
db 48 8B 1F 48 8B 48 10 48 89 4C 24 50 48 8B CF
unregistersymbol(ohk2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: u4.exe+1EA4E21
u4.exe+1EA4DF5: 0F 85 7A 01 00 00 - jne u4.exe+1EA4F75
u4.exe+1EA4DFB: 45 84 C9 - test r9b,r9b
u4.exe+1EA4DFE: 0F 84 71 01 00 00 - je u4.exe+1EA4F75
u4.exe+1EA4E04: 48 89 5C 24 58 - mov [rsp+58],rbx
u4.exe+1EA4E09: 4C 89 74 24 60 - mov [rsp+60],r14
u4.exe+1EA4E0E: C5 F8 29 74 24 20 - vmovaps [rsp+20],xmm6
u4.exe+1EA4E14: 85 D2 - test edx,edx
u4.exe+1EA4E16: 74 2E - je u4.exe+1EA4E46
u4.exe+1EA4E18: 48 8B 01 - mov rax,[rcx]
u4.exe+1EA4E1B: FF 90 B8 01 00 00 - call qword ptr [rax+000001B8]
// ---------- INJECTING HERE ----------
u4.exe+1EA4E21: 48 8B 1F - mov rbx,[rdi]
// ---------- DONE INJECTING ----------
u4.exe+1EA4E24: 48 8B 48 10 - mov rcx,[rax+10]
u4.exe+1EA4E28: 48 89 4C 24 50 - mov [rsp+50],rcx
u4.exe+1EA4E2D: 48 8B CF - mov rcx,rdi
u4.exe+1EA4E30: FF 93 B8 00 00 00 - call qword ptr [rbx+000000B8]
u4.exe+1EA4E36: 4C 8D 44 24 50 - lea r8,[rsp+50]
u4.exe+1EA4E3B: 48 8B CF - mov rcx,rdi
u4.exe+1EA4E3E: 8B D0 - mov edx,eax
u4.exe+1EA4E40: FF 93 90 00 00 00 - call qword ptr [rbx+00000090]
u4.exe+1EA4E46: 48 8D 8F B8 00 00 00 - lea rcx,[rdi+000000B8]
u4.exe+1EA4E4D: E8 FE B6 8F FF - call u4.exe+17A0550
}
219
"All Enemies Die Instantly (lol)"
Auto Assembler Script
{ Game : u4.exe (paused)
Version:
Date : 2024-09-15
Author : Owner
This script does blah blah blah
}
[ENABLE]
aobscanmodule(health2,u4.exe,8B 59 38 FF 90 C0 00 00 00 8B F0 3B D8 7D 5A) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
cmp [rcx+4C],#4294967295 // (can just put -1 instead, 32 bits)
jne code
mov [rcx+38],0
code:
mov ebx,[rcx+38]
call qword ptr [rax+000000C0]
mov esi,eax
cmp ebx,eax
jnl u4.exe+1EA4BDE
jmp return
health2:
jmp far newmem
nop
return:
registersymbol(health2)
[DISABLE]
health2:
db 8B 59 38 FF 90 C0 00 00 00 8B F0 3B D8 7D 5A
unregistersymbol(health2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: u4.exe+1EA4B75
u4.exe+1EA4B5C: CC - int 3
u4.exe+1EA4B5D: CC - int 3
u4.exe+1EA4B5E: CC - int 3
u4.exe+1EA4B5F: CC - int 3
u4.exe+1EA4B60: 48 89 5C 24 08 - mov [rsp+08],rbx
u4.exe+1EA4B65: 48 89 74 24 10 - mov [rsp+10],rsi
u4.exe+1EA4B6A: 57 - push rdi
u4.exe+1EA4B6B: 48 83 EC 30 - sub rsp,30
u4.exe+1EA4B6F: 48 8B 01 - mov rax,[rcx]
u4.exe+1EA4B72: 48 8B F9 - mov rdi,rcx
// ---------- INJECTING HERE ----------
u4.exe+1EA4B75: 8B 59 38 - mov ebx,[rcx+38]
// ---------- DONE INJECTING ----------
u4.exe+1EA4B78: FF 90 C0 00 00 00 - call qword ptr [rax+000000C0]
u4.exe+1EA4B7E: 8B F0 - mov esi,eax
u4.exe+1EA4B80: 3B D8 - cmp ebx,eax
u4.exe+1EA4B82: 7D 5A - jnl u4.exe+1EA4BDE
u4.exe+1EA4B84: 85 DB - test ebx,ebx
u4.exe+1EA4B86: 7E 56 - jle u4.exe+1EA4BDE
u4.exe+1EA4B88: C5 FA 10 47 34 - vmovss xmm0,[rdi+34]
u4.exe+1EA4B8D: C5 F8 29 74 24 20 - vmovaps [rsp+20],xmm6
u4.exe+1EA4B93: C5 C8 57 F6 - vxorps xmm6,xmm6,xmm6
u4.exe+1EA4B97: C5 F8 2F C6 - vcomiss xmm0,xmm6
}
307
"Weapon (main script)"
Auto Assembler Script
{ Game : u4.exe
Version:
Date : 2025-07-12
Author : Owner
This script does blah blah blah
}
[ENABLE]
aobscanmodule(ammo1,u4.exe,66 FF 8F C0 08 00 00 45 38 5C 24 05 74 07) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(NoReload_Flag)
label(InfAmmo_Flag)
registersymbol(NoReload_Flag)
registersymbol(InfAmmo_Flag)
newmem:
cmp [NoReload_Flag],1
jne InfAmmo
NoReload:
push rax
mov ax,[rdi+8C4] // clip/mag cap
add ax,1
mov word ptr [rdi+8C0],ax // clip/mag
pop rax
InfAmmo:
cmp [InfAmmo_Flag],1
jne code
mov word ptr [rdi+8C2],#969 // total ammo
code:
dec word ptr [rdi+000008C0]
cmp [r12+05],r11b
je u4.exe+1451D28
jmp return
NoReload_Flag:
dd 0
InfAmmo_Flag:
dd 0
ammo1:
jmp far newmem
return:
registersymbol(ammo1)
[DISABLE]
ammo1:
db 66 FF 8F C0 08 00 00 45 38 5C 24 05 74 07
unregistersymbol(ammo1)
unregistersymbol(NoReload_Flag)
unregistersymbol(InfAmmo_Flag)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: u4.exe+1451D13
u4.exe+1451CF0: 8B 15 3E 6B 75 02 - mov edx,[u4.exe+3BA8834]
u4.exe+1451CF6: 49 8B 47 30 - mov rax,[r15+30]
u4.exe+1451CFA: 8B CA - mov ecx,edx
u4.exe+1451CFC: 48 C1 E9 06 - shr rcx,06
u4.exe+1451D00: 83 E2 3F - and edx,3F
u4.exe+1451D03: 48 8B 44 C8 20 - mov rax,[rax+rcx*8+20]
u4.exe+1451D08: 48 0F A3 D0 - bt rax,rdx
u4.exe+1451D0C: 72 1A - jb u4.exe+1451D28
u4.exe+1451D0E: 45 84 DB - test r11b,r11b
u4.exe+1451D11: 75 15 - jne u4.exe+1451D28
// ---------- INJECTING HERE ----------
u4.exe+1451D13: 66 FF 8F C0 08 00 00 - dec word ptr [rdi+000008C0]
// ---------- DONE INJECTING ----------
u4.exe+1451D1A: 45 38 5C 24 05 - cmp [r12+05],r11b
u4.exe+1451D1F: 74 07 - je u4.exe+1451D28
u4.exe+1451D21: 44 88 9F C8 08 00 00 - mov [rdi+000008C8],r11b
u4.exe+1451D28: 4C 8B BC 24 30 04 00 00 - mov r15,[rsp+00000430]
u4.exe+1451D30: 4C 8B A4 24 40 04 00 00 - mov r12,[rsp+00000440]
u4.exe+1451D38: 48 8B 8C 24 20 04 00 00 - mov rcx,[rsp+00000420]
u4.exe+1451D40: 48 33 CC - xor rcx,rsp
u4.exe+1451D43: E8 08 8D F5 00 - call u4.exe+23AAA50
u4.exe+1451D48: 48 81 C4 48 04 00 00 - add rsp,00000448
u4.exe+1451D4F: 5F - pop rdi
}
308
"Infinite Ammo"
Auto Assembler Script
[ENABLE]
InfAmmo_Flag:
dd 1
[DISABLE]
InfAmmo_Flag:
dd 0
309
"No Reload"
Auto Assembler Script
[ENABLE]
NoReload_Flag:
dd 1
[DISABLE]
NoReload_Flag:
dd 0
315
"===== game might crash when going out of the map with Fly ====="
808080
1
223
"Fly/Super Run (coordinates) [Lua]"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
function checkKeys()
--Speed Modifiers
local speed = 0.2
if isKeyPressed(VK_T) then
speed = 0.6
elseif isKeyPressed(VK_X) then
speed = 0.1
end
local playerBase = getAddressSafe('[["u4.exe"+03D2D380]+0]') -- null check
-- local velBase = getAddressSafe('[[["u4.exe"+03D2D380]+0]+1E8]') -- null check
if playerBase == nil or playerBase == 0 then return end -- exit early if invalid
--Player Coordinates
local playerX = readFloat(playerBase + 0x130)
local playerZ = readFloat(playerBase + 0x138)
local playerY = readFloat(playerBase + 0x134)
-- local velY = readFloat(velBase + 0x4A4)
-- Yaw values (no pointer chain, but add check anyway)
local yaw_VY = readFloatSafe("u4.exe+6452870")
local yaw_VX = readFloatSafe("u4.exe+6452878")
-- validate floats
if playerX == nil or playerZ == nil or playerY == nil or yaw_VX == nil or yaw_VY == nil then return end
--Hotkey Setup
--[[
Button Mappings:
LEFT CTRL key - Forward
LEFT ALT key - Upwards
CAPS LOCK key - Downwards
T - Speed up
X - Slow down
--Keys are oriented to where mouse is pointing
]]
-- Forward
if isKeyPressed (VK_LCONTROL) then
writeFloat(playerBase + 0x130, playerX + yaw_VY * speed)
writeFloat(playerBase + 0x138, playerZ + yaw_VX * speed)
end
-- Upwards
if isKeyPressed (VK_LMENU) then
writeFloat(playerBase + 0x134, playerY + speed)
end
-- Downwards
if isKeyPressed (VK_CAPITAL) then
writeFloat(playerBase + 0x134, playerY - speed)
--[[ elseif velY < 0 then
writeFloat(velBase + 0x4A4, velY * 0)]]
end
end
-- helper function to safely read floats
function readFloatSafe(address)
local a = getAddressSafe(address)
if a ~= nil and a ~= 0 then
return readFloat(a)
else
return nil
end
end
-- Timer setup
if t == nil then
t = createTimer(nil)
timer_setInterval(t, 10)
timer_onTimer(t, checkKeys)
timer_setEnabled(t, true)
end
[DISABLE]
if t ~= nil then
timer_setEnabled(t, false)
t.destroy()
t = nil
end
Toggle Activation
97
0
Activate
Deactivate
331
"Fly/Super Run (velocity) 2 [Lua]"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
function checkKeys()
--Speed Modifiers
local speed = 0.2
local speed2 = 14
if isKeyPressed(VK_T) then
speed = 0.6
elseif isKeyPressed(VK_X) then
speed = 0.1
end
local velBase = getAddressSafe('[[["u4.exe"+03D2D380]+0]+1E8]') -- null check
if velBase == nil or velBase == 0 then return end -- exit early if invalid
--Player Coordinates
local velX = readFloat(velBase + 0x4A0)
local velZ = readFloat(velBase + 0x4A8)
local velY = readFloat(velBase + 0x4A4)
-- Yaw values (no pointer chain, but add check anyway)
local yaw_VY = readFloatSafe("u4.exe+6452870")
local yaw_VX = readFloatSafe("u4.exe+6452878")
-- validate floats
if velX == nil or velZ == nil or velY == nil or yaw_VX == nil or yaw_VY == nil then return end
--Hotkey Setup
--[[
Button Mappings:
LEFT CTRL key - Forward
LEFT ALT key - Upwards
CAPS LOCK key - Downwards
T - Speed up
X - Slow down
--Keys are oriented to where mouse is pointing
]]
-- Forward
if isKeyPressed (VK_LCONTROL) then
writeFloat(velBase + 0x4A0, yaw_VY * speed2)
writeFloat(velBase + 0x4A8, yaw_VX * speed2)
end
-- Upwards
if isKeyPressed (VK_LMENU) then
writeFloat(velBase + 0x4A4, velY + speed)
end
-- Downwards
if isKeyPressed (VK_CAPITAL) then
writeFloat(velBase + 0x4A4, velY - speed)
--[[ elseif velY < 0 then
writeFloat(velBase + 0x4A4, velY * 0)]]
end
end
-- helper function to safely read floats
function readFloatSafe(address)
local a = getAddressSafe(address)
if a ~= nil and a ~= 0 then
return readFloat(a)
else
return nil
end
end
-- Timer setup
if e == nil then
e = createTimer(nil)
timer_setInterval(e, 10)
timer_onTimer(e, checkKeys)
timer_setEnabled(e, true)
end
[DISABLE]
if e ~= nil then
timer_setEnabled(e, false)
e.destroy()
e = nil
end
Toggle Activation
97
0
Activate
Deactivate
2
"testing"
008000
1
328
"Fly/Super Run (velocity) 1 [Lua]"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
function checkKeys()
--Speed Modifiers
local speed = 0.2
if isKeyPressed(VK_T) then
speed = 0.6
elseif isKeyPressed(VK_X) then
speed = 0.1
end
local velBase = getAddressSafe('[[["u4.exe"+03D2D380]+0]+1E8]') -- null check
if velBase == nil or velBase == 0 then return end -- exit early if invalid
--Player Coordinates
local velX = readFloat(velBase + 0x4A0)
local velZ = readFloat(velBase + 0x4A8)
local velY = readFloat(velBase + 0x4A4)
-- Yaw values (no pointer chain, but add check anyway)
local yaw_VY = readFloatSafe("u4.exe+6452870")
local yaw_VX = readFloatSafe("u4.exe+6452878")
-- validate floats
if velX == nil or velZ == nil or velY == nil or yaw_VX == nil or yaw_VY == nil then return end
--Hotkey Setup
--[[
Button Mappings:
LEFT CTRL key - Forward
LEFT ALT key - Upwards
CAPS LOCK key - Downwards
T - Speed up
X - Slow down
--Keys are oriented to where mouse is pointing
]]
-- Forward
if isKeyPressed (VK_LCONTROL) then
writeFloat(velBase + 0x4A0, velX + yaw_VY * speed)
writeFloat(velBase + 0x4A8, velZ + yaw_VX * speed)
end
-- Upwards
if isKeyPressed (VK_LMENU) then
writeFloat(velBase + 0x4A4, velY + speed)
end
-- Downwards
if isKeyPressed (VK_CAPITAL) then
writeFloat(velBase + 0x4A4, velY - speed)
--[[ elseif velY < 0 then
writeFloat(velBase + 0x4A4, velY * 0)]]
end
end
-- helper function to safely read floats
function readFloatSafe(address)
local a = getAddressSafe(address)
if a ~= nil and a ~= 0 then
return readFloat(a)
else
return nil
end
end
-- Timer setup
if e == nil then
e = createTimer(nil)
timer_setInterval(e, 10)
timer_onTimer(e, checkKeys)
timer_setEnabled(e, true)
end
[DISABLE]
if e ~= nil then
timer_setEnabled(e, false)
e.destroy()
e = nil
end
Toggle Activation
97
0
Activate
Deactivate
311
"one hit kill (meh/mid)"
Auto Assembler Script
{ Game : u4.exe
Version:
Date : 2025-07-13
Author : Owner
This script does blah blah blah
}
[ENABLE]
aobscanmodule(ohk1,u4.exe,48 89 5C 24 08 57 48 83 EC 20 48 83 79 58 00 8B) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
cmp dword ptr [rcx+4C],-1 // if it's player/ally, then skip code
jne code
mov [rsp+08],rbx
push rdi
sub rsp,20
cmp qword ptr [rcx+58],00
mov edx,0
jmp return
code:
mov [rsp+08],rbx
push rdi
sub rsp,20
cmp qword ptr [rcx+58],00
jmp return
ohk1:
jmp far newmem
nop
return:
registersymbol(ohk1)
[DISABLE]
ohk1:
db 48 89 5C 24 08 57 48 83 EC 20 48 83 79 58 00
unregistersymbol(ohk1)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: u4.exe+1EA4A00
u4.exe+1EA49F6: CC - int 3
u4.exe+1EA49F7: CC - int 3
u4.exe+1EA49F8: CC - int 3
u4.exe+1EA49F9: CC - int 3
u4.exe+1EA49FA: CC - int 3
u4.exe+1EA49FB: CC - int 3
u4.exe+1EA49FC: CC - int 3
u4.exe+1EA49FD: CC - int 3
u4.exe+1EA49FE: CC - int 3
u4.exe+1EA49FF: CC - int 3
// ---------- INJECTING HERE ----------
u4.exe+1EA4A00: 48 89 5C 24 08 - mov [rsp+08],rbx
// ---------- DONE INJECTING ----------
u4.exe+1EA4A05: 57 - push rdi
u4.exe+1EA4A06: 48 83 EC 20 - sub rsp,20
u4.exe+1EA4A0A: 48 83 79 58 00 - cmp qword ptr [rcx+58],00
u4.exe+1EA4A0F: 8B FA - mov edi,edx
u4.exe+1EA4A11: 48 8B D9 - mov rbx,rcx
u4.exe+1EA4A14: 89 51 38 - mov [rcx+38],edx
u4.exe+1EA4A17: 74 47 - je u4.exe+1EA4A60
u4.exe+1EA4A19: 48 8B 01 - mov rax,[rcx]
u4.exe+1EA4A1C: FF 90 B8 01 00 00 - call qword ptr [rax+000001B8]
u4.exe+1EA4A22: 44 8B 43 60 - mov r8d,[rbx+60]
}
304
"infinite health (2.0)"
Auto Assembler Script
{ Game : u4.exe
Version:
Date : 2025-07-12
Author : Owner
This script does blah blah blah
}
[ENABLE]
aobscanmodule(invincibility1,u4.exe,48 89 5C 24 08 57 48 83 EC 20 48 83 79 58 00 8B) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
push rax
mov rax,["u4.exe"+03B7B830]
test rax,rax
jz nullptr_detected
mov rax,[rax+0]
test rax,rax
jz nullptr_detected
mov rax,[rax+1B0]
test rax,rax
jz nullptr_detected
add rax,440
test rax,rax
jz nullptr_detected
cmp rcx,rax
pop rax
jne code
ret
code:
mov [rsp+08],rbx
push rdi
sub rsp,20
cmp qword ptr [rcx+58],00
jmp return
nullptr_detected:
pop rax
jmp code
invincibility1:
jmp far newmem
nop
return:
registersymbol(invincibility1)
[DISABLE]
invincibility1:
db 48 89 5C 24 08 57 48 83 EC 20 48 83 79 58 00
unregistersymbol(invincibility1)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: u4.exe+1EA4A00
u4.exe+1EA49F6: CC - int 3
u4.exe+1EA49F7: CC - int 3
u4.exe+1EA49F8: CC - int 3
u4.exe+1EA49F9: CC - int 3
u4.exe+1EA49FA: CC - int 3
u4.exe+1EA49FB: CC - int 3
u4.exe+1EA49FC: CC - int 3
u4.exe+1EA49FD: CC - int 3
u4.exe+1EA49FE: CC - int 3
u4.exe+1EA49FF: CC - int 3
// ---------- INJECTING HERE ----------
u4.exe+1EA4A00: 48 89 5C 24 08 - mov [rsp+08],rbx
// ---------- DONE INJECTING ----------
u4.exe+1EA4A05: 57 - push rdi
u4.exe+1EA4A06: 48 83 EC 20 - sub rsp,20
u4.exe+1EA4A0A: 48 83 79 58 00 - cmp qword ptr [rcx+58],00
u4.exe+1EA4A0F: 8B FA - mov edi,edx
u4.exe+1EA4A11: 48 8B D9 - mov rbx,rcx
u4.exe+1EA4A14: 89 51 38 - mov [rcx+38],edx
u4.exe+1EA4A17: 74 47 - je u4.exe+1EA4A60
u4.exe+1EA4A19: 48 8B 01 - mov rax,[rcx]
u4.exe+1EA4A1C: FF 90 B8 01 00 00 - call qword ptr [rax+000001B8]
u4.exe+1EA4A22: 44 8B 43 60 - mov r8d,[rbx+60]
}
0
"infinite health (1.0) [meh/mid]"
Auto Assembler Script
{ Game : u4.exe
Version:
Date : 2024-09-14
Author : Owner
This script does blah blah blah
}
[ENABLE]
aobscanmodule(health1,u4.exe,C5 CA 2A 71 38 C5 F8 29 7C 24 30 FF 90 C0 00 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
mov [rcx+38],#100
cvtsi2ss xmm6, [rcx+38]
code:
// vcvtsi2ss xmm6,esi,[rcx+38]
vmovaps [rsp+30],xmm7
call qword ptr [rax+000000C0]
jmp return
health1:
jmp far newmem
nop 3
return:
registersymbol(health1)
[DISABLE]
health1:
db C5 CA 2A 71 38 C5 F8 29 7C 24 30 FF 90 C0 00 00 00
unregistersymbol(health1)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: u4.exe+1EA5186
u4.exe+1EA516C: CC - int 3
u4.exe+1EA516D: CC - int 3
u4.exe+1EA516E: CC - int 3
u4.exe+1EA516F: CC - int 3
u4.exe+1EA5170: 40 53 - push rbx
u4.exe+1EA5172: 48 83 EC 50 - sub rsp,50
u4.exe+1EA5176: 48 8B 01 - mov rax,[rcx]
u4.exe+1EA5179: 48 8B D9 - mov rbx,rcx
u4.exe+1EA517C: C5 F8 29 74 24 40 - vmovaps [rsp+40],xmm6
u4.exe+1EA5182: C5 C8 57 F6 - vxorps xmm6,xmm6,xmm6
// ---------- INJECTING HERE ----------
u4.exe+1EA5186: C5 CA 2A 71 38 - vcvtsi2ss xmm6,esi,[rcx+38]
// ---------- DONE INJECTING ----------
u4.exe+1EA518B: C5 F8 29 7C 24 30 - vmovaps [rsp+30],xmm7
u4.exe+1EA5191: FF 90 C0 00 00 00 - call qword ptr [rax+000000C0]
u4.exe+1EA5197: C5 C0 57 FF - vxorps xmm7,xmm7,xmm7
u4.exe+1EA519B: C5 C2 2A F8 - vcvtsi2ss xmm7,edi,eax
u4.exe+1EA519F: C5 F8 2F FE - vcomiss xmm7,xmm6
u4.exe+1EA51A3: 76 62 - jna u4.exe+1EA5207
u4.exe+1EA51A5: C5 78 29 44 24 20 - vmovaps [rsp+20],xmm8
u4.exe+1EA51AB: C4 41 38 57 C0 - vxorps xmm8,xmm8,xmm8
u4.exe+1EA51B0: C4 C1 78 2F F0 - vcomiss xmm6,xmm8
u4.exe+1EA51B5: 76 4A - jna u4.exe+1EA5201
}
221
"infinite ammo (without allocating memory)"
Auto Assembler Script
{ Game : u4.exe
Version:
Date : 2025-07-12
Author : Owner
This script does blah blah blah
}
[ENABLE]
assert(u4.exe+1451D13,66 FF 8F C0 08 00 00 45 38 5C 24 05 74 07) // should be unique
u4.exe+1451D13:
db 90 90 90 90 90 90 90
[DISABLE]
u4.exe+1451D13:
db 66 FF 8F C0 08 00 00
{
// ORIGINAL CODE - INJECTION POINT: u4.exe+1451D13
u4.exe+1451CF0: 8B 15 3E 6B 75 02 - mov edx,[u4.exe+3BA8834]
u4.exe+1451CF6: 49 8B 47 30 - mov rax,[r15+30]
u4.exe+1451CFA: 8B CA - mov ecx,edx
u4.exe+1451CFC: 48 C1 E9 06 - shr rcx,06
u4.exe+1451D00: 83 E2 3F - and edx,3F
u4.exe+1451D03: 48 8B 44 C8 20 - mov rax,[rax+rcx*8+20]
u4.exe+1451D08: 48 0F A3 D0 - bt rax,rdx
u4.exe+1451D0C: 72 1A - jb u4.exe+1451D28
u4.exe+1451D0E: 45 84 DB - test r11b,r11b
u4.exe+1451D11: 75 15 - jne u4.exe+1451D28
// ---------- INJECTING HERE ----------
u4.exe+1451D13: 66 FF 8F C0 08 00 00 - dec word ptr [rdi+000008C0]
// ---------- DONE INJECTING ----------
u4.exe+1451D1A: 45 38 5C 24 05 - cmp [r12+05],r11b
u4.exe+1451D1F: 74 07 - je u4.exe+1451D28
u4.exe+1451D21: 44 88 9F C8 08 00 00 - mov [rdi+000008C8],r11b
u4.exe+1451D28: 4C 8B BC 24 30 04 00 00 - mov r15,[rsp+00000430]
u4.exe+1451D30: 4C 8B A4 24 40 04 00 00 - mov r12,[rsp+00000440]
u4.exe+1451D38: 48 8B 8C 24 20 04 00 00 - mov rcx,[rsp+00000420]
u4.exe+1451D40: 48 33 CC - xor rcx,rsp
u4.exe+1451D43: E8 08 8D F5 00 - call u4.exe+23AAA50
u4.exe+1451D48: 48 81 C4 48 04 00 00 - add rsp,00000448
u4.exe+1451D4F: 5F - pop rdi
}
313
"super damage (crashes)"
Auto Assembler Script
{ Game : u4.exe
Version:
Date : 2025-07-13
Author : Owner
This script does blah blah blah
}
[ENABLE]
aobscanmodule(ohk2,u4.exe,48 89 5C 24 08 57 48 83 EC 20 48 83 79 58 00 8B) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
cmp dword ptr [rcx+4C],-1 // if it's player/ally, then skip code
jne code
mov r15d,#500
code:
mov [rsp+08],rbx
push rdi
sub rsp,20
cmp qword ptr [rcx+58],00
jmp return
ohk2:
jmp far newmem
nop
return:
registersymbol(ohk2)
[DISABLE]
ohk2:
db 48 89 5C 24 08 57 48 83 EC 20 48 83 79 58 00
unregistersymbol(ohk2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: u4.exe+1EA4A00
u4.exe+1EA49F6: CC - int 3
u4.exe+1EA49F7: CC - int 3
u4.exe+1EA49F8: CC - int 3
u4.exe+1EA49F9: CC - int 3
u4.exe+1EA49FA: CC - int 3
u4.exe+1EA49FB: CC - int 3
u4.exe+1EA49FC: CC - int 3
u4.exe+1EA49FD: CC - int 3
u4.exe+1EA49FE: CC - int 3
u4.exe+1EA49FF: CC - int 3
// ---------- INJECTING HERE ----------
u4.exe+1EA4A00: 48 89 5C 24 08 - mov [rsp+08],rbx
// ---------- DONE INJECTING ----------
u4.exe+1EA4A05: 57 - push rdi
u4.exe+1EA4A06: 48 83 EC 20 - sub rsp,20
u4.exe+1EA4A0A: 48 83 79 58 00 - cmp qword ptr [rcx+58],00
u4.exe+1EA4A0F: 8B FA - mov edi,edx
u4.exe+1EA4A11: 48 8B D9 - mov rbx,rcx
u4.exe+1EA4A14: 89 51 38 - mov [rcx+38],edx
u4.exe+1EA4A17: 74 47 - je u4.exe+1EA4A60
u4.exe+1EA4A19: 48 8B 01 - mov rax,[rcx]
u4.exe+1EA4A1C: FF 90 B8 01 00 00 - call qword ptr [rax+000001B8]
u4.exe+1EA4A22: 44 8B 43 60 - mov r8d,[rbx+60]
}
301
"health pointerscan"
1
227
"pointerscan result"
4 Bytes
"u4.exe"+03B7B830
478
1B0
0
230
"pointerscan result"
4 Bytes
"u4.exe"+03BB1590
478
1B0
0
231
"pointerscan result"
4 Bytes
"u4.exe"+03C2AEC8
478
1B0
0
232
"pointerscan result"
4 Bytes
"u4.exe"+03D4C4E0
478
1B0
0
233
"pointerscan result"
4 Bytes
"u4.exe"+03D50B80
478
1B0
0
234
"pointerscan result"
4 Bytes
"u4.exe"+062C2708
478
1B0
0
235
"pointerscan result"
4 Bytes
"u4.exe"+06502300
478
1B0
0
236
"pointerscan result"
4 Bytes
"u4.exe"+06502938
478
1B0
0
237
"pointerscan result"
4 Bytes
"u4.exe"+06524198
478
1B0
0
238
"pointerscan result"
4 Bytes
"u4.exe"+069C4250
478
1B0
0
239
"pointerscan result"
4 Bytes
"u4.exe"+03B7B830
218
350
0
242
"pointerscan result"
4 Bytes
"u4.exe"+03BB1590
218
350
0
243
"pointerscan result"
4 Bytes
"u4.exe"+03C2AEC8
218
350
0
244
"pointerscan result"
4 Bytes
"u4.exe"+03D2D380
218
350
0
245
"pointerscan result"
4 Bytes
"u4.exe"+03D4C4E0
218
350
0
246
"pointerscan result"
4 Bytes
"u4.exe"+03D50B80
218
350
0
247
"pointerscan result"
4 Bytes
"u4.exe"+062C2708
218
350
0
248
"pointerscan result"
4 Bytes
"u4.exe"+06502938
218
350
0
249
"pointerscan result"
4 Bytes
"u4.exe"+06502300
218
350
0
250
"pointerscan result"
4 Bytes
"u4.exe"+06524198
218
350
0
251
"pointerscan result"
4 Bytes
"u4.exe"+069C4250
218
350
0
252
"pointerscan result"
4 Bytes
"u4.exe"+03B7B830
38
488
0
255
"pointerscan result"
4 Bytes
"u4.exe"+03BB1590
38
488
0
256
"pointerscan result"
4 Bytes
"u4.exe"+03C2AEC8
38
488
0
257
"pointerscan result"
4 Bytes
"u4.exe"+03D2D380
38
488
0
258
"pointerscan result"
4 Bytes
"u4.exe"+03D4C4E0
38
488
0
259
"pointerscan result"
4 Bytes
"u4.exe"+06502300
38
488
0
260
"pointerscan result"
4 Bytes
"u4.exe"+069C4250
38
488
0
261
"pointerscan result"
4 Bytes
"u4.exe"+03C2AEC8
228
340
0
262
"pointerscan result"
4 Bytes
"u4.exe"+06502300
228
340
0
263
"pointerscan result"
4 Bytes
"u4.exe"+03B7B830
228
340
8
264
"pointerscan result"
4 Bytes
"u4.exe"+03C2AEC8
228
340
8
265
"pointerscan result"
4 Bytes
"u4.exe"+06524198
228
340
8
267
"pointerscan result"
4 Bytes
"u4.exe"+03D4C4E0
478
1B0
8
268
"pointerscan result"
4 Bytes
"u4.exe"+06502938
478
1B0
8
270
"pointerscan result"
4 Bytes
"u4.exe"+03D2D380
38
488
8
271
"pointerscan result"
4 Bytes
"u4.exe"+06502300
38
488
8
272
"pointerscan result"
4 Bytes
"u4.exe"+06524198
38
488
8
274
"pointerscan result"
4 Bytes
"u4.exe"+03C2AEC8
218
350
8
275
"pointerscan result"
4 Bytes
"u4.exe"+062C2708
218
350
8
276
"pointerscan result"
4 Bytes
"u4.exe"+06524198
218
350
8
277
"pointerscan result"
4 Bytes
"u4.exe"+036D6B68
228
340
68
278
"pointerscan result"
4 Bytes
"u4.exe"+036D6BA0
228
340
68
279
"pointerscan result"
4 Bytes
"u4.exe"+036D6BE0
228
340
68
280
"pointerscan result"
4 Bytes
"u4.exe"+036D6C10
228
340
68
281
"pointerscan result"
4 Bytes
"u4.exe"+036D6C30
228
340
68
282
"pointerscan result"
4 Bytes
"u4.exe"+036D6B58
38
488
68
283
"pointerscan result"
4 Bytes
"u4.exe"+036D6B78
478
1B0
68
284
"pointerscan result"
4 Bytes
"u4.exe"+036D6B98
478
1B0
68
285
"pointerscan result"
4 Bytes
"u4.exe"+036D6BD0
478
1B0
68
286
"pointerscan result"
4 Bytes
"u4.exe"+036D6BF0
478
1B0
68
287
"pointerscan result"
4 Bytes
"u4.exe"+036D6C10
478
1B0
68
288
"pointerscan result"
4 Bytes
"u4.exe"+036D6C28
478
1B0
68
289
"pointerscan result"
4 Bytes
"u4.exe"+036D6BC8
478
1B0
68
290
"pointerscan result"
4 Bytes
"u4.exe"+036D6C38
38
488
68
291
"pointerscan result"
4 Bytes
"u4.exe"+036D6B60
478
1B0
68
292
"pointerscan result"
4 Bytes
"u4.exe"+036D6BF0
218
350
68
293
"pointerscan result"
4 Bytes
"u4.exe"+036D6C20
218
350
68
294
"pointerscan result"
4 Bytes
"u4.exe"+036D6BE8
218
350
68
295
"pointerscan result"
4 Bytes
"u4.exe"+036D6B48
478
1B0
68
296
"pointerscan result"
4 Bytes
"u4.exe"+036D6B68
218
350
68
297
"pointerscan result"
4 Bytes
"u4.exe"+036D6B50
478
1B0
68
298
"pointerscan result"
4 Bytes
"u4.exe"+036D6B60
38
488
68
299
"pointerscan result"
4 Bytes
"u4.exe"+036D6B80
38
488
68
300
"pointerscan result"
4 Bytes
"u4.exe"+036D6B98
38
488
68
228
"bad"
4 Bytes
"u4.exe"+03BA1580
478
1B0
0
229
"bad"
4 Bytes
"u4.exe"+03BA1590
478
1B0
0
240
"bad"
4 Bytes
"u4.exe"+03BA1580
218
350
0
241
"bad"
4 Bytes
"u4.exe"+03BA1590
218
350
0
253
"bad"
4 Bytes
"u4.exe"+03BA1580
38
488
0
254
"bad"
4 Bytes
"u4.exe"+03BA1590
38
488
0
266
"bad"
4 Bytes
"u4.exe"+03BA1590
478
1B0
8
269
"bad"
4 Bytes
"u4.exe"+03BA1580
38
488
8
273
"bad"
4 Bytes
"u4.exe"+03BA1580
218
350
8
143
"x coord pointerscan 1"
1
9
"x coord 1"
Float
10D7CA9D30
14
"x coord 2"
Float
10D7CB6FB0
19
"pointerscan result"
0
Float
"u4.exe"+03D2D380
130
0
20
"pointerscan result"
0
Float
"u4.exe"+03D50B80
130
0
21
"pointerscan result"
0
Float
"u4.exe"+03D4C4E0
130
0
22
"pointerscan result"
0
Float
"u4.exe"+062C2708
130
0
24
"pointerscan result"
0
Float
"u4.exe"+06502300
130
0
26
"pointerscan result"
0
Float
"u4.exe"+06502938
130
0
28
"pointerscan result"
0
Float
"u4.exe"+06524198
130
0
35
"pointerscan result"
0
Float
"u4.exe"+03C2AEC8
130
8
36
"pointerscan result"
0
Float
"u4.exe"+03D2D380
130
8
37
"pointerscan result"
0
Float
"u4.exe"+03D4C4E0
130
8
38
"pointerscan result"
0
Float
"u4.exe"+03D50B80
130
8
39
"pointerscan result"
0
Float
"u4.exe"+062C2708
130
8
41
"pointerscan result"
0
Float
"u4.exe"+06502300
130
8
43
"pointerscan result"
0
Float
"u4.exe"+06502938
130
8
45
"pointerscan result"
0
Float
"u4.exe"+06524198
130
8
33
"pointerscan result"
0
Float
"u4.exe"+03B7B830
130
8
17
"pointerscan result"
0
Float
"u4.exe"+03B7B830
130
0
118
"pointerscan result"
0
Float
"u4.exe"+0653E980
130
8
0
15
"pointerscan result"
0
Float
"u4.exe"+036D43C8
E60
16
"pointerscan result"
0
Float
"u4.exe"+03BAF970
130
0
18
"pointerscan result"
0
Float
"u4.exe"+062C2268
CB0
0
23
"pointerscan result"
0
Float
"u4.exe"+062C2818
130
0
25
"pointerscan result"
0
Float
"u4.exe"+06502360
130
0
27
"pointerscan result"
0
Float
"u4.exe"+065029C8
130
0
29
"pointerscan result"
0
Float
"u4.exe"+069C79A0
130
0
30
"pointerscan result"
0
Float
"u4.exe"+069C0B88
4B0
0
31
"pointerscan result"
0
Float
"u4.exe"+062C2268
CB0
8
32
"pointerscan result"
0
Float
"u4.exe"+069C0B88
4B0
8
34
"pointerscan result"
0
Float
"u4.exe"+03BAF970
130
8
40
"pointerscan result"
0
Float
"u4.exe"+062C2818
130
8
42
"pointerscan result"
0
Float
"u4.exe"+06502360
130
8
44
"pointerscan result"
0
Float
"u4.exe"+065029C8
130
8
46
"pointerscan result"
0
Float
"u4.exe"+069C79A0
130
8
47
"pointerscan result"
0
Float
"u4.exe"+069C7590
CB0
28
48
"pointerscan result"
0
Float
"u4.exe"+069C7450
4B0
28
49
"pointerscan result"
0
Float
"u4.exe"+069C7590
CB0
30
50
"pointerscan result"
0
Float
"u4.exe"+069C7450
4B0
30
51
"pointerscan result"
0
Float
"u4.exe"+069C7540
CB0
50
52
"pointerscan result"
0
Float
"u4.exe"+069C7540
CB0
58
53
"pointerscan result"
0
Float
"u4.exe"+036D4418
130
68
54
"pointerscan result"
0
Float
"u4.exe"+036D4410
130
68
55
"pointerscan result"
0
Float
"u4.exe"+036D4408
130
68
56
"pointerscan result"
0
Float
"u4.exe"+036D4400
130
68
57
"pointerscan result"
0
Float
"u4.exe"+036D43F8
130
68
58
"pointerscan result"
0
Float
"u4.exe"+036D4440
130
68
59
"pointerscan result"
0
Float
"u4.exe"+036D4438
130
68
60
"pointerscan result"
0
Float
"u4.exe"+036D4428
130
68
61
"pointerscan result"
0
Float
"u4.exe"+036D43F0
130
68
62
"pointerscan result"
0
Float
"u4.exe"+036D4430
130
68
63
"pointerscan result"
0
Float
"u4.exe"+036D4420
130
68
64
"pointerscan result"
0
Float
"u4.exe"+036D4450
130
68
65
"pointerscan result"
0
Float
"u4.exe"+036D44A0
130
68
66
"pointerscan result"
0
Float
"u4.exe"+036D4490
130
68
67
"pointerscan result"
0
Float
"u4.exe"+036D4498
130
68
68
"pointerscan result"
0
Float
"u4.exe"+036D4488
130
68
69
"pointerscan result"
0
Float
"u4.exe"+036D4480
130
68
70
"pointerscan result"
0
Float
"u4.exe"+036D4478
130
68
71
"pointerscan result"
0
Float
"u4.exe"+036D4470
130
68
72
"pointerscan result"
0
Float
"u4.exe"+036D4468
130
68
73
"pointerscan result"
0
Float
"u4.exe"+036D4460
130
68
74
"pointerscan result"
0
Float
"u4.exe"+036D4458
130
68
75
"pointerscan result"
0
Float
"u4.exe"+036D4448
130
68
76
"pointerscan result"
0
Float
"u4.exe"+036D44E0
130
68
77
"pointerscan result"
0
Float
"u4.exe"+036D44D8
130
68
78
"pointerscan result"
0
Float
"u4.exe"+036D44D0
130
68
79
"pointerscan result"
0
Float
"u4.exe"+036D44C8
130
68
80
"pointerscan result"
0
Float
"u4.exe"+036D44C0
130
68
81
"pointerscan result"
0
Float
"u4.exe"+036D44B8
130
68
82
"pointerscan result"
0
Float
"u4.exe"+036D44B0
130
68
83
"pointerscan result"
0
Float
"u4.exe"+036D44A8
130
68
84
"pointerscan result"
0
Float
"u4.exe"+036D43E8
130
68
85
"pointerscan result"
0
Float
"u4.exe"+036D4410
130
168
86
"pointerscan result"
0
Float
"u4.exe"+036D4408
130
168
87
"pointerscan result"
0
Float
"u4.exe"+036D4400
130
168
88
"pointerscan result"
0
Float
"u4.exe"+036D43F8
130
168
89
"pointerscan result"
0
Float
"u4.exe"+036D43F0
130
168
90
"pointerscan result"
0
Float
"u4.exe"+036D4438
130
168
91
"pointerscan result"
0
Float
"u4.exe"+036D4430
130
168
92
"pointerscan result"
0
Float
"u4.exe"+036D4420
130
168
93
"pointerscan result"
0
Float
"u4.exe"+036D43E8
130
168
94
"pointerscan result"
0
Float
"u4.exe"+036D4428
130
168
95
"pointerscan result"
0
Float
"u4.exe"+036D4418
130
168
96
"pointerscan result"
0
Float
"u4.exe"+036D4448
130
168
97
"pointerscan result"
0
Float
"u4.exe"+036D4498
130
168
98
"pointerscan result"
0
Float
"u4.exe"+036D4490
130
168
99
"pointerscan result"
0
Float
"u4.exe"+036D4470
130
168
100
"pointerscan result"
0
Float
"u4.exe"+036D4458
130
168
101
"pointerscan result"
0
Float
"u4.exe"+036D44C8
130
168
102
"pointerscan result"
0
Float
"u4.exe"+036D44B0
130
168
103
"pointerscan result"
0
Float
"u4.exe"+036D4408
130
268
104
"pointerscan result"
0
Float
"u4.exe"+036D43F0
130
268
105
"pointerscan result"
0
Float
"u4.exe"+036D4428
130
268
106
"pointerscan result"
0
Float
"u4.exe"+036D4490
130
268
107
"pointerscan result"
0
Float
"u4.exe"+036D4480
130
268
108
"pointerscan result"
0
Float
"u4.exe"+036D4470
130
268
109
"pointerscan result"
0
Float
"u4.exe"+036D4460
130
268
110
"pointerscan result"
0
Float
"u4.exe"+036D44D0
130
268
111
"pointerscan result"
0
Float
"u4.exe"+036D44B8
130
268
112
"pointerscan result"
0
Float
"u4.exe"+036D44A8
130
268
113
"pointerscan result"
0
Float
"u4.exe"+062C2268
820
178
0
114
"pointerscan result"
0
Float
"u4.exe"+069C0B88
290
200
0
115
"pointerscan result"
0
Float
"u4.exe"+062C2268
CB0
408
0
116
"pointerscan result"
0
Float
"u4.exe"+062C2268
8B0
3E0
0
117
"pointerscan result"
0
Float
"u4.exe"+069C0B88
290
1E0
0
119
"pointerscan result"
0
Float
"u4.exe"+062C2268
4D0
210
8
120
"pointerscan result"
0
Float
"u4.exe"+062C2268
CB0
408
8
121
"pointerscan result"
0
Float
"u4.exe"+069C0B88
4B0
228
8
122
"pointerscan result"
0
Float
"u4.exe"+062C2268
4C0
230
8
123
"pointerscan result"
0
Float
"u4.exe"+069C7540
CB0
30
10
124
"pointerscan result"
0
Float
"u4.exe"+069C0B88
130
0
10
125
"pointerscan result"
0
Float
"u4.exe"+069C7540
CB0
28
10
126
"pointerscan result"
0
Float
"u4.exe"+069C7590
CB0
58
18
127
"pointerscan result"
0
Float
"u4.exe"+069C7450
4B0
58
18
128
"pointerscan result"
0
Float
"u4.exe"+03BAF970
4B0
8
18
129
"pointerscan result"
0
Float
"u4.exe"+03D4C4E0
4B0
8
18
130
"pointerscan result"
0
Float
"u4.exe"+06502300
4B0
8
18
131
"pointerscan result"
0
Float
"u4.exe"+065029C8
4B0
8
18
132
"pointerscan result"
0
Float
"u4.exe"+03BAF970
4B0
0
18
133
"pointerscan result"
0
Float
"u4.exe"+03D4C4E0
4B0
0
18
134
"pointerscan result"
0
Float
"u4.exe"+062C2818
4B0
0
18
135
"pointerscan result"
0
Float
"u4.exe"+065029C8
4B0
0
18
136
"pointerscan result"
0
Float
"u4.exe"+069C7450
4B0
50
18
137
"pointerscan result"
0
Float
"u4.exe"+069C7450
4B0
228
28
138
"pointerscan result"
0
Float
"u4.exe"+069C7590
CB0
408
28
139
"pointerscan result"
0
Float
"u4.exe"+069C7450
2D0
C0
28
140
"pointerscan result"
0
Float
"u4.exe"+069C7590
4D0
210
30
141
"pointerscan result"
0
Float
"u4.exe"+069C7590
8B0
3C0
30
142
"pointerscan result"
0
Float
"u4.exe"+069C7450
290
1E0
30
326
"y velocity pointerscan"
1
320
"No Description"
0
Float
10D74FE8B4
321
"No Description"
0
Float
10D74FC4B4
322
"pointerscan result"
4 Bytes
"u4.exe"+03D2D380
4A4
1E8
8
323
"pointerscan result"
4 Bytes
"u4.exe"+03D2D380
4A4
1E8
0
324
"pointerscan result"
4 Bytes
"u4.exe"+03D2D380
4A4
1E8
410
1B8
0
325
"pointerscan result"
4 Bytes
"u4.exe"+03D2D380
4A4
1E8
410
1B8
8
217
"Player X Velocity (display)"
0
Float
"u4.exe"+03D2D380
130+140
0
215
"Player Z Velocity (display)"
0
Float
"u4.exe"+03D2D380
130+148
0
216
"Player Y Velocity (display)"
0
Float
"u4.exe"+03D2D380
130+144
0
health :vcvtsi2ss xmm6,esi,[rcx+38]
u4.exe+1EA5186
40
C5
C8
57
F6
C5
CA
2A
71
38
C5
F8
29
7C
24
health 2 (shared) :mov ebx,[rcx+38]
u4.exe+1EA4B75
8B
01
48
8B
F9
8B
59
38
FF
90
C0
00
00
health (write) :mov [rcx+38],edx
u4.exe+1EA4A14
8B
FA
48
8B
D9
89
51
38
74
47
48
8B
01
ammo clip (write) :dec word ptr [rdi+000008C0]
u4.exe+1451D13
45
84
DB
75
15
66
FF
8F
C0
08
00
00
45
38
5C
24
05
player Z coord :vmovups [rcx+30],xmm1
u4.exe+159AAB3
01
C5
E8
58
CF
C5
F8
11
49
30
C5
F8
77
C5
F8
pitch :vmovups [rcx+00000370],xmm0
u4.exe+151E01
82
70
03
00
00
C5
F8
11
81
70
03
00
00
C5
F8
10
8A
80
cam Z coord :vmovss [rax],xmm0
u4.exe+1044B6E
00
C5
F2
58
00
C5
FA
11
00
C5
E8
58
83
B0
cam Z coord :vmovss [rbx+00003620],xmm0
u4.exe+1045768
9B
30
36
00
00
C5
FA
11
83
20
36
00
00
C4
C1
60
5C
C2
cam X or Y coord? :vmovups [rbx+00003630],xmm0
u4.exe+1044B5B
83
30
36
00
00
CC
F8
11
83
30
36
00
00
48
8D
83
20
36
safe landing (ret) :mov rax,rsp
u4.exe+C215C0
CC
CC
CC
CC
CC
48
8B
C4
55
41
54
41
55
velX :vmovups xmm0,[rax+00000170]
u4.exe+10902C5
A9
C8
30
00
00
C5
F8
10
80
70
01
00
00
C5
F8
59
D8
C5