114982
"<=== Attach to process"
0000FF
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if(getCEVersion() < 7.4) then
ShowMessage('Warning! CE version should be 7.4 or above')
end
OpenProcess("Zoria AoS.exe")
if(process == nil) then
ShowMessage('The process is NOT found!')
end
{$asm}
[DISABLE]
114991
"GodMode and One-Hit-Kill 2"
Auto Assembler Script
// function: CharacterStats.SetHP
[ENABLE]
aobscanmodule(health,GameAssembly.dll,89 47 28 48 85 C9) // should be unique
alloc(newmem,$1000,health)
label(code)
label(return)
label(onehit)
label(godmode_on)
label(onehit_on)
newmem:
cmp dword ptr[rdi+88],0
je onehit // if zero => not good, get the hell out of here
godmode:
cmp byte ptr [godmode_on],1 // check if godmode-box is activated
jne code // if not, back to the normal code
mov eax,#9999 // fill up life
mov [rdi+34],eax // mana/energy
mov [rdi+3c],eax // focus
jmp code // and go back to the normal code
onehit:
cmp byte ptr [onehit_on],1 // check if one-hit-kill is activated
jne code // if not, back to the normal code
mov eax,#0 // set the new amount of enemys life to zero
code:
mov [rdi+28],eax
test rcx,rcx
jmp return
godmode_on:
db 0
onehit_on:
db 0
health:
jmp newmem
nop
return:
registersymbol(health godmode_on onehit_on)
[DISABLE]
health:
db 89 47 28 48 85 C9
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+2209AFC
GameAssembly.dll+2209ADE: 75 05 - jne GameAssembly.dll+2209AE5
GameAssembly.dll+2209AE0: E8 DB 44 FC FD - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+2209AE5: 45 33 C9 - xor r9d,r9d
GameAssembly.dll+2209AE8: 44 8B C5 - mov r8d,ebp
GameAssembly.dll+2209AEB: 33 D2 - xor edx,edx
GameAssembly.dll+2209AED: 8B CB - mov ecx,ebx
GameAssembly.dll+2209AEF: E8 9C 37 11 FF - call GameAssembly.dll+131D290
GameAssembly.dll+2209AF4: 48 8B 4F 70 - mov rcx,[rdi+70]
GameAssembly.dll+2209AF8: 8B D8 - mov ebx,eax
GameAssembly.dll+2209AFA: 2B DE - sub ebx,esi
// ---------- INJECTING HERE ----------
GameAssembly.dll+2209AFC: 89 47 28 - mov [rdi+28],eax
// ---------- DONE INJECTING ----------
GameAssembly.dll+2209AFF: 48 85 C9 - test rcx,rcx
GameAssembly.dll+2209B02: 74 17 - je GameAssembly.dll+2209B1B
GameAssembly.dll+2209B04: 4C 8B 51 18 - mov r10,[rcx+18]
GameAssembly.dll+2209B08: 44 8B C3 - mov r8d,ebx
GameAssembly.dll+2209B0B: 4C 8B 49 28 - mov r9,[rcx+28]
GameAssembly.dll+2209B0F: BA 0D 00 00 00 - mov edx,0000000D
GameAssembly.dll+2209B14: 48 8B 49 40 - mov rcx,[rcx+40]
GameAssembly.dll+2209B18: 41 FF D2 - call r10
GameAssembly.dll+2209B1B: 8B C3 - mov eax,ebx
GameAssembly.dll+2209B1D: 48 8B 5C 24 30 - mov rbx,[rsp+30]
}
114985
"GodMode"
Auto Assembler Script
[ENABLE]
godmode_on:
db 1
[DISABLE]
godmode_on:
db 0
114984
"OneHit Kill"
Auto Assembler Script
[ENABLE]
onehit_on:
db 1
[DISABLE]
onehit_on:
db 0
115018
"Gain 3x the Mats/Gold when looting"
Auto Assembler Script
// Function: ResourceItemInfo.Add
[ENABLE]
aobscanmodule(gainmats,GameAssembly.dll,8B 49 38 03 CA) // should be unique
alloc(newmem,$1000,gainmats)
label(code)
label(return)
newmem:
mov ecx,[rcx+38]
add ecx,edx
add ecx,edx
add ecx,edx
code:
jmp return
gainmats:
jmp newmem
return:
registersymbol(gainmats)
[DISABLE]
gainmats:
db 8B 49 38 03 CA
unregistersymbol(gainmats)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+2218A73
GameAssembly.dll+2218A5D: CC - int 3
GameAssembly.dll+2218A5E: CC - int 3
GameAssembly.dll+2218A5F: CC - int 3
ResourceItemInfo.Add: 48 89 5C 24 08 - mov [rsp+08],rbx
GameAssembly.dll+2218A65: 57 - push rdi
GameAssembly.dll+2218A66: 48 83 EC 20 - sub rsp,20
GameAssembly.dll+2218A6A: 8B FA - mov edi,edx
GameAssembly.dll+2218A6C: 48 8B D9 - mov rbx,rcx
GameAssembly.dll+2218A6F: 85 D2 - test edx,edx
GameAssembly.dll+2218A71: 74 23 - je GameAssembly.dll+2218A96
// ---------- INJECTING HERE ----------
GameAssembly.dll+2218A73: 8B 49 38 - mov ecx,[rcx+38]
// ---------- DONE INJECTING ----------
GameAssembly.dll+2218A76: 03 CA - add ecx,edx
GameAssembly.dll+2218A78: 89 4B 38 - mov [rbx+38],ecx
GameAssembly.dll+2218A7B: 45 84 C0 - test r8b,r8b
GameAssembly.dll+2218A7E: 74 26 - je GameAssembly.dll+2218AA6
GameAssembly.dll+2218A80: 33 D2 - xor edx,edx
GameAssembly.dll+2218A82: 48 8B CB - mov rcx,rbx
GameAssembly.dll+2218A85: E8 46 96 FE FF - call UserResources.SyncResource
GameAssembly.dll+2218A8A: 8B 4B 38 - mov ecx,[rbx+38]
GameAssembly.dll+2218A8D: 84 C0 - test al,al
GameAssembly.dll+2218A8F: 75 12 - jne GameAssembly.dll+2218AA3
}
103
"Instead of loosing money/supplies/mats: get +100 each time"
Auto Assembler Script
// function: ResourceItemInfo.Remove
[ENABLE]
aobscanmodule(spending,GameAssembly.dll,29 43 38 40 84 F6) // should be unique
alloc(newmem,$1000,spending)
label(code)
label(return)
newmem:
mov eax,#100
code:
add [rbx+38],eax
test sil,sil
jmp return
spending:
jmp newmem
nop
return:
registersymbol(spending)
[DISABLE]
spending:
db 29 43 38 40 84 F6
unregistersymbol(spending)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+2218B93
GameAssembly.dll+2218B73: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll+2218B7A: 75 05 - jne GameAssembly.dll+2218B81
GameAssembly.dll+2218B7C: E8 3F 54 FB FD - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+2218B81: 45 33 C0 - xor r8d,r8d
GameAssembly.dll+2218B84: 8B D7 - mov edx,edi
GameAssembly.dll+2218B86: 8B CD - mov ecx,ebp
GameAssembly.dll+2218B88: E8 F3 D8 10 FF - call Rewired.Utils.MathTools.Min
GameAssembly.dll+2218B8D: 8B F8 - mov edi,eax
GameAssembly.dll+2218B8F: 85 C0 - test eax,eax
GameAssembly.dll+2218B91: 74 1F - je GameAssembly.dll+2218BB2
// ---------- INJECTING HERE ----------
GameAssembly.dll+2218B93: 29 43 38 - sub [rbx+38],eax
// ---------- DONE INJECTING ----------
GameAssembly.dll+2218B96: 40 84 F6 - test sil,sil
GameAssembly.dll+2218B99: 74 1E - je GameAssembly.dll+2218BB9
GameAssembly.dll+2218B9B: 33 D2 - xor edx,edx
GameAssembly.dll+2218B9D: 48 8B CB - mov rcx,rbx
GameAssembly.dll+2218BA0: E8 2B 95 FE FF - call UserResources.SyncResource
GameAssembly.dll+2218BA5: 8B 4B 38 - mov ecx,[rbx+38]
GameAssembly.dll+2218BA8: 84 C0 - test al,al
GameAssembly.dll+2218BAA: 75 0A - jne GameAssembly.dll+2218BB6
GameAssembly.dll+2218BAC: 8D 04 39 - lea eax,[rcx+rdi]
GameAssembly.dll+2218BAF: 89 43 38 - mov [rbx+38],eax
}
118
"Items with more than 1 item in stock do not decrease"
Auto Assembler Script
// function ResourceItemInfo.InitAmount
[ENABLE]
aobscanmodule(dealer,GameAssembly.dll,89 51 38 89 51 3C) // should be unique
alloc(newmem,$100,dealer)
label(code)
label(return)
newmem:
code:
mov [rcx+38],edx
// mov [rcx+3C],edx
jmp return
dealer:
jmp newmem
nop
return:
registersymbol(dealer)
[DISABLE]
dealer:
db 89 51 38 89 51 3C
unregistersymbol(dealer)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+1D0DF40
GameAssembly.dll+1D0DF36: CC - int 3
GameAssembly.dll+1D0DF37: CC - int 3
GameAssembly.dll+1D0DF38: CC - int 3
GameAssembly.dll+1D0DF39: CC - int 3
GameAssembly.dll+1D0DF3A: CC - int 3
GameAssembly.dll+1D0DF3B: CC - int 3
GameAssembly.dll+1D0DF3C: CC - int 3
GameAssembly.dll+1D0DF3D: CC - int 3
GameAssembly.dll+1D0DF3E: CC - int 3
GameAssembly.dll+1D0DF3F: CC - int 3
// ---------- INJECTING HERE ----------
GameAssembly.dll+1D0DF40: 89 51 38 - mov [rcx+38],edx
// ---------- DONE INJECTING ----------
GameAssembly.dll+1D0DF43: 89 51 3C - mov [rcx+3C],edx
GameAssembly.dll+1D0DF46: C3 - ret
GameAssembly.dll+1D0DF47: CC - int 3
GameAssembly.dll+1D0DF48: CC - int 3
GameAssembly.dll+1D0DF49: CC - int 3
GameAssembly.dll+1D0DF4A: CC - int 3
GameAssembly.dll+1D0DF4B: CC - int 3
GameAssembly.dll+1D0DF4C: CC - int 3
GameAssembly.dll+1D0DF4D: CC - int 3
GameAssembly.dll+1D0DF4E: CC - int 3
}
114998
"set fatigue to zero when opening character"
Auto Assembler Script
// function FollowerViewStatsInfo.ReSync
[ENABLE]
aobscanmodule(fatigue,GameAssembly.dll,8B 40 10 48 8D 4C 24 50 33) // should be unique
alloc(newmem,$1000,fatigue)
label(code)
label(return)
newmem:
push ebx
mov ebx,0
mov [rax+10], ebx
pop ebx
code:
mov eax,[rax+10]
lea rcx,[rsp+50]
jmp return
fatigue:
jmp newmem
nop 3
return:
registersymbol(fatigue)
[DISABLE]
fatigue:
db 8B 40 10 48 8D 4C 24 50
unregistersymbol(fatigue)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+1FB26C9
GameAssembly.dll+1FB26A0: F3 0F 5E 0D 00 D5 1B 00 - divss xmm1,[GameAssembly.dll+216FBA8]
GameAssembly.dll+1FB26A8: E8 73 73 02 00 - call GameAssembly.dll+1FD9A20
GameAssembly.dll+1FB26AD: 48 8B 7B 50 - mov rdi,[rbx+50]
GameAssembly.dll+1FB26B1: 0F 10 30 - movups xmm6,[rax]
GameAssembly.dll+1FB26B4: 48 8B 83 88 00 00 00 - mov rax,[rbx+00000088]
GameAssembly.dll+1FB26BB: 48 85 C0 - test rax,rax
GameAssembly.dll+1FB26BE: 74 7B - je GameAssembly.dll+1FB273B
GameAssembly.dll+1FB26C0: 48 8B 40 48 - mov rax,[rax+48]
GameAssembly.dll+1FB26C4: 48 85 C0 - test rax,rax
GameAssembly.dll+1FB26C7: 74 72 - je GameAssembly.dll+1FB273B
// ---------- INJECTING HERE ----------
GameAssembly.dll+1FB26C9: 8B 40 10 - mov eax,[rax+10]
// ---------- DONE INJECTING ----------
GameAssembly.dll+1FB26CC: 48 8D 4C 24 50 - lea rcx,[rsp+50]
GameAssembly.dll+1FB26D1: 33 D2 - xor edx,edx
GameAssembly.dll+1FB26D3: 89 44 24 50 - mov [rsp+50],eax
GameAssembly.dll+1FB26D7: E8 54 86 2A FF - call GameAssembly.dll+125AD30
GameAssembly.dll+1FB26DC: 48 8B 0D 15 9B 9E 00 - mov rcx,[GameAssembly.dll+299C1F8]
GameAssembly.dll+1FB26E3: 48 8B D8 - mov rbx,rax
GameAssembly.dll+1FB26E6: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll+1FB26ED: 75 05 - jne GameAssembly.dll+1FB26F4
GameAssembly.dll+1FB26EF: E8 8C 21 21 FE - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+1FB26F4: 45 33 C0 - xor r8d,r8d
}
115022
"get additional 500 XP when gaining XP"
Auto Assembler Script
// function FollowerStats.RewardXP
[ENABLE]
aobscanmodule(xpbooster,GameAssembly.dll,03 BB 80 00 00 00 89) // should be unique
alloc(newmem,$100,xpbooster)
label(code)
label(return)
newmem:
add edi,#500
code:
add edi,[rbx+00000080]
jmp return
xpbooster:
jmp newmem
nop
return:
registersymbol(xpbooster)
[DISABLE]
xpbooster:
db 03 BB 80 00 00 00
unregistersymbol(xpbooster)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+222E247
GameAssembly.dll+222E21B: E8 B0 73 CC FE - call GameAssembly.dll+EF55D0
GameAssembly.dll+222E220: 48 85 C0 - test rax,rax
GameAssembly.dll+222E223: 0F 84 96 01 00 00 - je GameAssembly.dll+222E3BF
GameAssembly.dll+222E229: F3 0F 10 48 24 - movss xmm1,[rax+24]
GameAssembly.dll+222E22E: EB 08 - jmp GameAssembly.dll+222E238
GameAssembly.dll+222E230: F3 0F 10 0D 10 39 09 00 - movss xmm1,[GameAssembly.dll+22C1B48]
GameAssembly.dll+222E238: 66 0F 6E C5 - movd xmm0,ebp
GameAssembly.dll+222E23C: 0F 5B C0 - cvtdq2ps xmm0,xmm0
GameAssembly.dll+222E23F: F3 0F 59 C1 - mulss xmm0,xmm1
GameAssembly.dll+222E243: F3 0F 2C F8 - cvttss2si edi,xmm0
// ---------- INJECTING HERE ----------
GameAssembly.dll+222E247: 03 BB 80 00 00 00 - add edi,[rbx+00000080]
// ---------- DONE INJECTING ----------
GameAssembly.dll+222E24D: 89 BB 80 00 00 00 - mov [rbx+00000080],edi
GameAssembly.dll+222E253: 48 8B 0D 1E B7 91 00 - mov rcx,[GameAssembly.dll+2B49978]
GameAssembly.dll+222E25A: 83 B9 E0 00 00 00 00 - cmp dword ptr [rcx+000000E0],00
GameAssembly.dll+222E261: 75 05 - jne GameAssembly.dll+222E268
GameAssembly.dll+222E263: E8 58 FD F9 FD - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+222E268: 33 D2 - xor edx,edx
GameAssembly.dll+222E26A: 8B CF - mov ecx,edi
GameAssembly.dll+222E26C: E8 FF 62 F2 FF - call GameFormulas.Leveling.GetLevelFromXP
GameAssembly.dll+222E271: 8B 7B 2C - mov edi,[rbx+2C]
GameAssembly.dll+222E274: 8B F0 - mov esi,eax
}
77
"Get Adress of selected character (activate and select a char)"
Auto Assembler Script
// function: FollowerViewStatsInfo.SetFollower
[ENABLE]
aobscanmodule(getchar,GameAssembly.dll,48 8B 16 48 8B CE 48 8B 5F 20) // should be unique
alloc(newmem,$100,getchar)
label(code)
label(return)
newmem:
mov [character],rsi
code:
mov rdx,[rsi]
mov rcx,rsi
jmp return
character:
dq 0
getchar:
jmp newmem
nop
return:
registersymbol(getchar character)
[DISABLE]
getchar:
db 48 8B 16 48 8B CE
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+20E951B
GameAssembly.dll+20E94E4: 48 8B D6 - mov rdx,rsi
GameAssembly.dll+20E94E7: 4C 89 74 24 40 - mov [rsp+40],r14
GameAssembly.dll+20E94EC: 48 89 B7 80 00 00 00 - mov [rdi+00000080],rsi
GameAssembly.dll+20E94F3: E8 68 3B 0E FE - call GameAssembly.il2cpp_value_box+20
GameAssembly.dll+20E94F8: 48 85 F6 - test rsi,rsi
GameAssembly.dll+20E94FB: 0F 84 2F 03 00 00 - je GameAssembly.dll+20E9830
GameAssembly.dll+20E9501: 48 8B 96 98 00 00 00 - mov rdx,[rsi+00000098]
GameAssembly.dll+20E9508: 48 8D 8F 88 00 00 00 - lea rcx,[rdi+00000088]
GameAssembly.dll+20E950F: 48 89 97 88 00 00 00 - mov [rdi+00000088],rdx
GameAssembly.dll+20E9516: E8 45 3B 0E FE - call GameAssembly.il2cpp_value_box+20
// ---------- INJECTING HERE ----------
GameAssembly.dll+20E951B: 48 8B 16 - mov rdx,[rsi]
// ---------- DONE INJECTING ----------
GameAssembly.dll+20E951E: 48 8B CE - mov rcx,rsi
GameAssembly.dll+20E9521: 48 8B 5F 20 - mov rbx,[rdi+20]
GameAssembly.dll+20E9525: 48 8B 82 78 01 00 00 - mov rax,[rdx+00000178]
GameAssembly.dll+20E952C: 48 8B 92 80 01 00 00 - mov rdx,[rdx+00000180]
GameAssembly.dll+20E9533: FF D0 - call rax
GameAssembly.dll+20E9535: 48 85 DB - test rbx,rbx
GameAssembly.dll+20E9538: 0F 84 F2 02 00 00 - je GameAssembly.dll+20E9830
GameAssembly.dll+20E953E: 4C 8B 03 - mov r8,[rbx]
GameAssembly.dll+20E9541: 48 8B D0 - mov rdx,rax
GameAssembly.dll+20E9544: 48 8B CB - mov rcx,rbx
}
84
"Characters Base Address (put this in Dissect Data for more fun...)"
0
1
character
0
115008
"Name"
0
String
14
1
0
1
+70
14
79
"XP"
0
4 Bytes
+20
80
115032
"Available Stats Points"
0
4 Bytes
+20
84
rbx = base address
rbx+28 = health (4byte int). there are 2 floats but these are mirrored values
rbx +48 +30 +30 = gameCharacterType. 1=PC
this would, in theory, be the best way to do it.
But checking this crashes the game...
possible alternatives:
rbx +cc (0 = we)
rbx +dc (0 = they)
rbx +e4 (0 = they)