114982 "<=== Attach to process and activate mono" 0000FF Auto Assembler Script [ENABLE] {$lua} if syntaxcheck then return end if(getCEVersion() < 7.4) then ShowMessage('Warning! CE version should be 7.4 or above') end OpenProcess("Moorhuhn X.exe") if(process == nil) then ShowMessage('The process is NOT found!') end LaunchMonoDataCollector() {$asm} // LuaCall(function cycleFullCompact(sender,force) local state = not(compactmenuitem.Caption == 'Compact View Mode'); if force~=nil then state = not force end; compactmenuitem.Caption = state and 'Compact View Mode' or 'Full View Mode'; getMainForm().Splitter1.Visible = state; getMainForm().Panel4.Visible = state; getMainForm().Panel5.Visible = state; end; function addCompactMenu() if compactmenualreadyexists then return end; local parent = getMainForm().Menu.Items; compactmenuitem = createMenuItem(parent); parent.add(compactmenuitem); compactmenuitem.Caption = 'Compact View Mode'; compactmenuitem.OnClick = cycleFullCompact; compactmenualreadyexists = 'yes'; end; addCompactMenu(); cycleFullCompact(nil,true)) [DISABLE] // LuaCall(cycleFullCompact(nil,false)) 114992 "Don't start CodestageAntiCheat (not sure if even active, but does not harm to deactivate)" Auto Assembler Script define(address1,CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically) define(bytes1,55 48 8B EC 48 83 EC 30) define(address2,CodeStage.AntiCheat.Detectors.TimeCheatingDetector:Update) define(bytes2,55 48 8B EC 48 83 EC 40) define(address3,CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetection) define(bytes3,55 48 8B EC 48 83 EC 30) define(address4,CodeStage.AntiCheat.Detectors.TimeCheatingDetector:OnApplicationPause) define(bytes4,55 48 8B EC 48 83 EC 30) define(address5,CodeStage.AntiCheat.Detectors.TimeCheatingDetector:Init) define(bytes5,55 48 8B EC 48 83 EC 40) [ENABLE] assert(address1,bytes1) assert(address2,bytes2) assert(address3,bytes3) assert(address4,bytes4) assert(address5,bytes5) address1: ret address2: ret address3: ret address4: ret address5: ret [DISABLE] address1: db bytes1 address2: db bytes2 address3: db bytes3 address4: db bytes4 address5: db bytes5 dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically BarrelMoorhuhnScript:OnShooted+88: 48 8D 65 00 - lea rsp,[rbp+00] BarrelMoorhuhnScript:OnShooted+8c: 5D - pop rbp BarrelMoorhuhnScript:OnShooted+8d: C3 - ret 1B3E5B0F8DE: 00 00 - add [rax],al 1B3E5B0F8E0: 01 04 02 - add [rdx+rax],eax 1B3E5B0F8E3: 05 04 03 01 50 - add eax,50010304 1B3E5B0F8E8: 00 00 - add [rax],al 1B3E5B0F8EA: 00 00 - add [rax],al 1B3E5B0F8EC: 00 00 - add [rax],al 1B3E5B0F8EE: 00 00 - add [rax],al // ---------- INJECTING HERE ---------- CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically: 55 - push rbp // ---------- DONE INJECTING ---------- CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically+1: 48 8B EC - mov rbp,rsp CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically+4: 48 83 EC 30 - sub rsp,30 CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically+8: 48 89 75 F8 - mov [rbp-08],rsi CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically+c: 48 8B F1 - mov rsi,rcx CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically+f: F3 0F 10 86 B8 00 00 00 - movss xmm0,[rsi+000000B8] CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically+17: F3 0F 5A C0 - cvtss2sd xmm0,xmm0 CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically+1b: 48 8B CE - mov rcx,rsi CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically+1e: 45 33 C0 - xor r8d,r8d CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically+21: F2 0F 10 C8 - movsd xmm1,xmm0 CodeStage.AntiCheat.Detectors.TimeCheatingDetector:StartDetectionAutomatically+25: F2 0F 5A C9 - cvtsd2ss xmm1,xmm1 } 114988 "Unlimited Ammo" Auto Assembler Script define(address,CrosshairScript:Shoot+292) define(bytes,FF C8 89 86 90 00 00 00) [ENABLE] assert(address,bytes) alloc(newmem,$1000,CrosshairScript:Shoot+292) label(code) label(return) newmem: mov eax,8 code: // dec eax mov [rsi+00000090],eax jmp return address: jmp newmem nop 3 return: [DISABLE] address: db bytes // dec eax // mov [rsi+00000090],eax dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: CrosshairScript:Shoot+292 CrosshairScript:Shoot+269: 89 4D E0 - mov [rbp-20],ecx CrosshairScript:Shoot+26c: 48 63 4D D4 - movsxd rcx,dword ptr [rbp-2C] CrosshairScript:Shoot+270: 89 4D E4 - mov [rbp-1C],ecx CrosshairScript:Shoot+273: 48 8B C8 - mov rcx,rax CrosshairScript:Shoot+276: 48 8B 55 E0 - mov rdx,[rbp-20] CrosshairScript:Shoot+27a: 83 38 00 - cmp dword ptr [rax],00 CrosshairScript:Shoot+27d: 90 - nop CrosshairScript:Shoot+27e: 49 BB D0 B8 B0 E5 B3 01 00 00 - mov r11,ShootableScript:Shooted CrosshairScript:Shoot+288: 41 FF D3 - call r11 CrosshairScript:Shoot+28b: 48 63 86 90 00 00 00 - movsxd rax,dword ptr [rsi+00000090] // ---------- INJECTING HERE ---------- CrosshairScript:Shoot+292: FF C8 - dec eax // ---------- DONE INJECTING ---------- CrosshairScript:Shoot+294: 89 86 90 00 00 00 - mov [rsi+00000090],eax CrosshairScript:Shoot+29a: 48 8B 46 40 - mov rax,[rsi+40] CrosshairScript:Shoot+29e: 48 8B 56 28 - mov rdx,[rsi+28] CrosshairScript:Shoot+2a2: 48 8B C8 - mov rcx,rax CrosshairScript:Shoot+2a5: 83 38 00 - cmp dword ptr [rax],00 CrosshairScript:Shoot+2a8: 48 8D 64 24 00 - lea rsp,[rsp+00] CrosshairScript:Shoot+2ad: 90 - nop CrosshairScript:Shoot+2ae: 49 BB 20 05 AD E5 B3 01 00 00 - mov r11,UnityEngine.AudioSource:PlayOneShot CrosshairScript:Shoot+2b8: 41 FF D3 - call r11 CrosshairScript:Shoot+2bb: 48 B8 20 77 DE E1 B3 01 00 00 - mov rax,000001B3E1DE7720 } 114990 "Get 10x the Points for each shot and no point loss when hitting wrong things" Auto Assembler Script define(address,LevelManagerScript:AddPoints+1a) define(bytes,03 C6 89 47 74) [ENABLE] assert(address,bytes) alloc(newmem,$1000,LevelManagerScript:AddPoints+1a) label(code) label(return) label(plus) newmem: cmp esi,0 // check if number is negative jge plus // if not, continue with multiplier mov esi,#15 // if negative, turn it into standard value of 15 plus: imul esi,#10 // multiply the points which will be added code: add eax,esi mov [rdi+74],eax jmp return address: jmp newmem return: [DISABLE] address: db bytes // add eax,esi // mov [rdi+74],eax dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: LevelManagerScript:AddPoints+1a 1B3E5B0C56C: B3 01 - mov bl,01 1B3E5B0C56E: 00 00 - add [rax],al LevelManagerScript:AddPoints: 55 - push rbp LevelManagerScript:AddPoints+1: 48 8B EC - mov rbp,rsp LevelManagerScript:AddPoints+4: 48 83 EC 50 - sub rsp,50 LevelManagerScript:AddPoints+8: 48 89 75 F0 - mov [rbp-10],rsi LevelManagerScript:AddPoints+c: 48 89 7D F8 - mov [rbp-08],rdi LevelManagerScript:AddPoints+10: 48 8B F9 - mov rdi,rcx LevelManagerScript:AddPoints+13: 48 8B F2 - mov rsi,rdx LevelManagerScript:AddPoints+16: 48 63 47 74 - movsxd rax,dword ptr [rdi+74] // ---------- INJECTING HERE ---------- LevelManagerScript:AddPoints+1a: 03 C6 - add eax,esi // ---------- DONE INJECTING ---------- LevelManagerScript:AddPoints+1c: 89 47 74 - mov [rdi+74],eax LevelManagerScript:AddPoints+1f: 48 63 47 74 - movsxd rax,dword ptr [rdi+74] LevelManagerScript:AddPoints+23: 85 C0 - test eax,eax LevelManagerScript:AddPoints+25: 7D 07 - jnl LevelManagerScript:AddPoints+2e LevelManagerScript:AddPoints+27: C7 47 74 00 00 00 00 - mov [rdi+74],00000000 LevelManagerScript:AddPoints+2e: 48 B8 20 77 DE E1 B3 01 00 00 - mov rax,000001B3E1DE7720 LevelManagerScript:AddPoints+38: 48 8B 00 - mov rax,[rax] LevelManagerScript:AddPoints+3b: 48 8B C8 - mov rcx,rax LevelManagerScript:AddPoints+3e: 48 8B F1 - mov rsi,rcx LevelManagerScript:AddPoints+41: 48 85 C0 - test rax,rax } 114991 "Chicken slow down instead of doubling their speed for 2 seconds" Auto Assembler Script define(address,NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+50) define(bytes,F2 0F 59 C1 F2 0F 5A E8 F3 41 0F 11 6F 70) [ENABLE] assert(address,bytes) alloc(newmem,$1000) label(code) label(return) newmem: code: divsd xmm0,xmm1 cvtsd2ss xmm5,xmm0 movss [r15+70],xmm5 jmp return address: jmp far newmem return: [DISABLE] address: db bytes // mulsd xmm0,xmm1 // cvtsd2ss xmm5,xmm0 // movss [r15+70],xmm5 dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+50 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+21: 74 10 - je NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+33 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+23: 83 FF 01 - cmp edi,01 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+26: 0F 84 AC 00 00 00 - je NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+d8 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+2c: 33 C0 - xor eax,eax NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+2e: E9 D2 00 00 00 - jmp NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+105 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+33: C7 46 20 FF FF FF FF - mov [rsi+20],FFFFFFFF NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+3a: F3 41 0F 10 47 70 - movss xmm0,[r15+70] NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+40: F3 0F 5A C0 - cvtss2sd xmm0,xmm0 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+44: F3 0F 10 0D F4 00 00 00 - movss xmm1,[NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+140] NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+4c: F3 0F 5A C9 - cvtss2sd xmm1,xmm1 // ---------- INJECTING HERE ---------- NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+50: F2 0F 59 C1 - mulsd xmm0,xmm1 // ---------- DONE INJECTING ---------- NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+54: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+58: F3 41 0F 11 6F 70 - movss [r15+70],xmm5 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+5e: F3 0F 10 05 CA 00 00 00 - movss xmm0,[NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+130] NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+66: F3 0F 5A C0 - cvtss2sd xmm0,xmm0 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+6a: F2 0F 11 45 D0 - movsd [rbp-30],xmm0 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+6f: 48 B9 C8 89 39 E1 B3 01 00 00 - mov rcx,000001B3E13989C8 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+79: 48 8D 64 24 00 - lea rsp,[rsp+00] NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+7e: 49 BB 80 10 4A 62 B2 01 00 00 - mov r11,System.Object:__icall_wrapper_ves_icall_object_new_specific NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+88: 41 FF D3 - call r11 NormalChickenScript+<IncreaseSpeedTimer>d__36:MoveNext+8b: F2 0F 10 45 D0 - movsd xmm0,[rbp-30] } 114994 "Time Freeze (F1 to toggle)" Auto Assembler Script define(address,LevelManagerScript:Update+8c) define(bytes,F2 0F 5C C1) [ENABLE] assert(address,bytes) address: nop 4 return: [DISABLE] address: db bytes // subsd xmm0,xmm1 dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: LevelManagerScript:Update+8c LevelManagerScript:Update+5b: 85 C0 - test eax,eax LevelManagerScript:Update+5d: 0F 84 C8 00 00 00 - je LevelManagerScript:Update+12b LevelManagerScript:Update+63: F3 0F 10 46 6C - movss xmm0,[rsi+6C] LevelManagerScript:Update+68: F3 0F 5A C0 - cvtss2sd xmm0,xmm0 LevelManagerScript:Update+6c: F2 0F 11 45 E8 - movsd [rbp-18],xmm0 LevelManagerScript:Update+71: 48 8D 64 24 00 - lea rsp,[rsp+00] LevelManagerScript:Update+76: 49 BB 20 E2 A1 E2 B3 01 00 00 - mov r11,UnityEngine.Time:get_deltaTime LevelManagerScript:Update+80: 41 FF D3 - call r11 LevelManagerScript:Update+83: F3 0F 5A C8 - cvtss2sd xmm1,xmm0 LevelManagerScript:Update+87: F2 0F 10 45 E8 - movsd xmm0,[rbp-18] // ---------- INJECTING HERE ---------- LevelManagerScript:Update+8c: F2 0F 5C C1 - subsd xmm0,xmm1 // ---------- DONE INJECTING ---------- LevelManagerScript:Update+90: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0 LevelManagerScript:Update+94: F3 0F 11 6E 6C - movss [rsi+6C],xmm5 LevelManagerScript:Update+99: F3 0F 10 46 6C - movss xmm0,[rsi+6C] LevelManagerScript:Update+9e: F3 0F 5A C0 - cvtss2sd xmm0,xmm0 LevelManagerScript:Update+a2: 66 0F 57 C9 - xorpd xmm1,xmm1 LevelManagerScript:Update+a6: 66 0F 2F C8 - comisd xmm1,xmm0 LevelManagerScript:Update+aa: 0F 82 13 00 00 00 - jb LevelManagerScript:Update+c3 LevelManagerScript:Update+b0: 48 8B CE - mov rcx,rsi LevelManagerScript:Update+b3: 66 66 90 - nop 3 LevelManagerScript:Update+b6: 49 BB 40 CC 47 4B B3 01 00 00 - mov r11,LevelManagerScript:LevelTimeFinished } Toggle Activation 112 0 Activated Deactivated