53
"Toggle Compact View"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not toggleCompactView then
function toggleCompactView(sender, forceEnable)
local isCompactMode = not (compactViewMenuItem.Caption == 'Compact View Mode')
if forceEnable ~= nil then
isCompactMode = not forceEnable
end
synchronize(function()
compactViewMenuItem.Caption = isCompactMode and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = isCompactMode
getMainForm().Panel4.Visible = isCompactMode
getMainForm().Panel5.Visible = isCompactMode
end)
end
end
if not createCompactViewMenu then
function createCompactViewMenu()
if isCompactMenuCreated then return end
synchronize(function()
local mainMenu = getMainForm().Menu.Items
compactViewMenuItem = createMenuItem(mainMenu)
compactViewMenuItem.Caption = 'Compact View Mode'
compactViewMenuItem.OnClick = toggleCompactView
mainMenu.add(compactViewMenuItem)
end)
isCompactMenuCreated = true
end
end
createCompactViewMenu()
toggleCompactView(nil, true)
[DISABLE]
{$lua}
if toggleCompactView then
toggleCompactView(nil, false)
end
76
"Enable"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if memrec then print(memrec.Description) end
-- Clear lua engine log & close lua engine
if not closeLuaEngine2 then
function closeLuaEngine2()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine2')
synchronize(function()
getLuaEngine().MenuItem5.doClick()
AddressList.Header.OnSectionClick = nil
end)
closeLuaEngine2()
if _kuro_2_customInt == nil then
local p_proc = process
registerCustomTypeAutoAssembler([[
alloc(TypeName,256)
alloc(ByteSize,8)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(UsesFloat,1)
TypeName:
db 'Kueo2 integer',0
ByteSize:
dd 4
UsesFloat:
db 0
ConvertRoutine:
//at this point ecx contains the address where the bytes are stored
//return with rax/eax
xor rax,rax
mov eax, dword ptr [rcx]
and eax, 3FFFFFFF
ret
ConvertBackRoutine:
//at this point edx contains the address to write the value to
//and ecx contains the value
push rax
xor rax, rax
mov eax, ecx
or eax, 40000000
mov dword ptr [rdx], eax
pop rax
ret
]])
_kuro_2_customInt = true
process = p_proc
autoAssemble(string.format([[
unregistersymbol($process)
define($process, "%s")
registersymbol($process)
]], process))
closeLuaEngine2()
end
[DISABLE]
{$lua}
if syntaxcheck then return end
closeLuaEngine2()
85
"Toggle scripts"
4080FF
Auto Assembler Script
[ENABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local enableBattleScripts = {
53, -- "Toggle Compact View"
1, -- "Get Mira"
55, -- "Battle: damage control"
6, -- "Browse & set item amount"
65, -- "Battle: inf item use"
69, -- "Battle: fast break gauge"
70, -- "Restore battle gauge after battle"
79, -- "Get kill count"
54, -- "Battle: player HP: try to keep non-zero"
61, -- "Battle: full EP after use"
62, -- "Battle: full CP after use"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(enableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and not memRec.Active then
memRec.Active = true
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
[DISABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local disableBattleScripts = {
56, -- "Criteria: player ID must <="
63, -- "Global setting"
62, -- "Battle: full CP after use"
61, -- "Battle: full EP after use"
58, -- "Enemy 1 HP?"
54, -- "Battle: player HP: try to keep non-zero"
90, -- "Get on-going reward data; max 50"
79, -- "Get kill count"
70, -- "Restore battle gauge after battle"
69, -- "Battle: fast break gauge"
65, -- "Battle: inf item use"
6, -- "Browse & set item amount"
55, -- "Battle: damage control"
19, -- "Char. stats viewer"
1, -- "Get Mira"
66, -- "Trails in the Sky 1st Chapter Demo / https://opencheattables.com"
53, -- "Toggle Compact View"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(disableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and memRec.Active then
memRec.Active = false
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
-- Comments:
-- ID: 53, Description: "Toggle Compact View", Depth: 0
-- ID: 76, Description: "Enable", Depth: 0
-- ID: 1, Description: "Get Mira", Depth: 1
-- ID: 6, Description: "Browse & set item amount", Depth: 1
-- ID: 19, Description: "Char. stats viewer", Depth: 1
-- ID: 55, Description: "Battle: damage control", Depth: 1
-- ID: 63, Description: "Global setting", Depth: 2
-- ID: 56, Description: "Criteria: player ID must <=", Depth: 3
-- ID: 58, Description: "Enemy 1 HP?", Depth: 2
-- ID: 54, Description: "Battle: player HP: try to keep non-zero", Depth: 2
-- ID: 61, Description: "Battle: full EP after use", Depth: 2
-- ID: 62, Description: "Battle: full CP after use", Depth: 2
-- ID: 65, Description: "Battle: inf item use", Depth: 1
-- ID: 69, Description: "Battle: fast break gauge", Depth: 1
-- ID: 70, Description: "Restore battle gauge after battle", Depth: 1
-- ID: 79, Description: "Get kill count", Depth: 1
-- ID: 90, Description: "Get on-going reward data; max 50", Depth: 1
-- ID: 66, Description: "Trails in the Sky 1st Chapter Demo / https://opencheattables.com", Depth: 0
1
"Get Mira"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-02
Author : bbfox@https://openchetatables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_MIRA,$process,8B 92 ?? ?? ?? 00 E8 ?? ?? ?? ?? 48 8B CF) // should be unique
alloc(newmem,$1000,INJECT_GET_MIRA)
alloc(INJECT_GET_MIRAo, 6)
label(code)
label(return)
label(i_base_mira_addr i_base_mira_offset)
INJECT_GET_MIRAo:
readmem(INJECT_GET_MIRA, 6)
newmem:
push r15
xor r15, r15
db 41 bf //00 39 1f 00
readmem(INJECT_GET_MIRA+2, 4)
mov [i_base_mira_addr], rdx
mov [i_base_mira_offset], r15
pop r15
code:
reassemble(INJECT_GET_MIRA)
//mov edx,[rdx+001F3900]
jmp return
align 10 cc
i_base_mira_addr:
dq 0
i_base_mira_offset:
dq 0
INJECT_GET_MIRA:
jmp newmem
nop
return:
registersymbol(INJECT_GET_MIRA)
registersymbol(i_base_mira_addr i_base_mira_offset)
registersymbol(INJECT_GET_MIRAo)
[DISABLE]
INJECT_GET_MIRA:
//db 8B 92 00 39 1F 00
readmem(INJECT_GET_MIRAo, 6)
unregistersymbol(i_base_mira_addr i_base_mira_offset)
unregistersymbol(INJECT_GET_MIRA)
dealloc(newmem)
unregistersymbol(INJECT_GET_MIRAo)
dealloc(INJECT_GET_MIRAo)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+1AED13
sora_1st.exe+1AECED: 41 B8 FE FF FF 7F - mov r8d,7FFFFFFE
sora_1st.exe+1AECF3: E8 08 E3 29 00 - call sora_1st.exe+44D000
sora_1st.exe+1AECF8: 48 85 C0 - test rax,rax
sora_1st.exe+1AECFB: 75 0C - jne sora_1st.exe+1AED09
sora_1st.exe+1AECFD: 48 83 C3 08 - add rbx,08
sora_1st.exe+1AED01: 48 3B DE - cmp rbx,rsi
sora_1st.exe+1AED04: 75 DA - jne sora_1st.exe+1AECE0
sora_1st.exe+1AED06: 49 8B C4 - mov rax,r12
sora_1st.exe+1AED09: 48 8B 15 58 49 73 00 - mov rdx,[sora_1st.exe+8E3668]
sora_1st.exe+1AED10: 48 8B C8 - mov rcx,rax
// ---------- INJECTING HERE ----------
sora_1st.exe+1AED13: 8B 92 00 39 1F 00 - mov edx,[rdx+001F3900]
// ---------- DONE INJECTING ----------
sora_1st.exe+1AED19: E8 C2 C0 2F 00 - call sora_1st.exe+4AADE0
sora_1st.exe+1AED1E: 48 8B CF - mov rcx,rdi
sora_1st.exe+1AED21: E8 0A 13 00 00 - call sora_1st.exe+1B0030
sora_1st.exe+1AED26: 44 88 A7 A8 01 00 00 - mov [rdi+000001A8],r12b
sora_1st.exe+1AED2D: 48 8B 05 3C 49 73 00 - mov rax,[sora_1st.exe+8E3670]
sora_1st.exe+1AED34: F6 80 01 01 00 00 40 - test byte ptr [rax+00000101],40
sora_1st.exe+1AED3B: 0F 85 D1 00 00 00 - jne sora_1st.exe+1AEE12
sora_1st.exe+1AED41: 48 8B 05 60 15 73 00 - mov rax,[sora_1st.exe+8E02A8]
sora_1st.exe+1AED48: 44 38 A0 24 2D 00 00 - cmp [rax+00002D24],r12b
sora_1st.exe+1AED4F: 0F 85 BD 00 00 00 - jne sora_1st.exe+1AEE12
}
2
"Earth"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-20
10
"Water"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-1C
11
"Fire"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-18
12
"Wind"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-14
13
"Time"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-10
14
"Space"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-C
15
"Mirage"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-8
16
"Exchange"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-4
9
"Mira"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]
67
"??"
0
FF8080
4 Bytes
i_base_mira_addr
1F3904
3
"Time?"
0
FF8080
Double
i_base_mira_addr
[i_base_mira_offset]+8
6
"Browse & set item amount"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BROWSE_ITEM_N_SET,$process,0F B7 94 98 ?? ?? ?? ?? 85 D2 75) // should be unique
alloc(newmem,$1000,INJECT_BROWSE_ITEM_N_SET)
alloc(INJECT_BROWSE_ITEM_N_SETo, 8)
label(code)
label(return)
label(iw_min_threshold iw_set_item_cnt_to i_item_addr_offset)
INJECT_BROWSE_ITEM_N_SETo:
readmem(INJECT_BROWSE_ITEM_N_SET, 8)
newmem:
cmp qword ptr [i_item_addr_offset], 0
jne next1
push r15
xor r15, r15
db 41 bf
readmem(INJECT_BROWSE_ITEM_N_SET+4, 4)
mov [i_item_addr_offset], r15
pop r15
next1:
push r15
push r14
mov r14, [i_item_addr_offset]
lea r15, [rax+rbx*4]
lea r15, [r15+r14]
mov r14w, [r15]
cmp r14w, [iw_min_threshold]
jb endp
cmp r14w, [iw_set_item_cnt_to]
jae endp
mov r14w, [iw_set_item_cnt_to]
mov [r15], r14w
endp:
pop r14
pop r15
code:
reassemble(INJECT_BROWSE_ITEM_N_SET)
//movzx edx,word ptr [rax+rbx*4+00116724]
jmp return
align 10 cc
iw_min_threshold:
dw 2
iw_set_item_cnt_to:
dw 46
i_item_addr_offset:
dq 0
INJECT_BROWSE_ITEM_N_SET:
jmp newmem
nop 3
return:
registersymbol(INJECT_BROWSE_ITEM_N_SET)
registersymbol(INJECT_BROWSE_ITEM_N_SETo)
registersymbol(iw_min_threshold iw_set_item_cnt_to i_item_addr_offset)
[DISABLE]
INJECT_BROWSE_ITEM_N_SET:
//db 0F B7 94 98 24 67 11 00
readmem(INJECT_BROWSE_ITEM_N_SETo, 8)
unregistersymbol(iw_min_threshold iw_min_threshold)
unregistersymbol(INJECT_BROWSE_ITEM_N_SET)
dealloc(newmem)
unregistersymbol(INJECT_BROWSE_ITEM_N_SETo)
dealloc(INJECT_BROWSE_ITEM_N_SETo)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+131D54
sora_1st.exe+131D29: E8 A2 61 31 00 - call sora_1st.exe+447ED0
sora_1st.exe+131D2E: EB 30 - jmp sora_1st.exe+131D60
sora_1st.exe+131D30: 8D 83 CA FE FF FF - lea eax,[rbx-00000136]
sora_1st.exe+131D36: 83 F8 07 - cmp eax,07
sora_1st.exe+131D39: 77 12 - ja sora_1st.exe+131D4D
sora_1st.exe+131D3B: 8B C8 - mov ecx,eax
sora_1st.exe+131D3D: 48 8B 05 24 19 7B 00 - mov rax,[sora_1st.exe+8E3668]
sora_1st.exe+131D44: 8B 94 88 E0 38 1F 00 - mov edx,[rax+rcx*4+001F38E0]
sora_1st.exe+131D4B: EB 0F - jmp sora_1st.exe+131D5C
sora_1st.exe+131D4D: 48 8B 05 14 19 7B 00 - mov rax,[sora_1st.exe+8E3668]
// ---------- INJECTING HERE ----------
sora_1st.exe+131D54: 0F B7 94 98 24 67 11 00 - movzx edx,word ptr [rax+rbx*4+00116724]
// ---------- DONE INJECTING ----------
sora_1st.exe+131D5C: 85 D2 - test edx,edx
sora_1st.exe+131D5E: 75 15 - jne sora_1st.exe+131D75
sora_1st.exe+131D60: 4C 8B C5 - mov r8,rbp
sora_1st.exe+131D63: BA FF FF FF FF - mov edx,FFFFFFFF
sora_1st.exe+131D68: E8 E3 68 18 00 - call sora_1st.exe+2B8650
sora_1st.exe+131D6D: 85 C0 - test eax,eax
sora_1st.exe+131D6F: 0F 84 38 01 00 00 - je sora_1st.exe+131EAD
sora_1st.exe+131D75: 48 8B 0D 1C 19 7B 00 - mov rcx,[sora_1st.exe+8E3698]
sora_1st.exe+131D7C: 48 85 C9 - test rcx,rcx
sora_1st.exe+131D7F: 74 10 - je sora_1st.exe+131D91
}
7
"Avail. item amount must >="
0
C08000
2 Bytes
iw_min_threshold
8
"Set amount to"
0
C08000
2 Bytes
iw_set_item_cnt_to
55
"Battle: damage control"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-03
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_DAMAGE_CTRL,$process,89 56 0C 48 8B 74 24 38) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_DAMAGE_CTRL)
label(code)
label(return)
label(i_play_char_id vf_min_player_hp_ratio is_enemy_1_HP is_full_EP is_full_CP)
newmem:
push r15
mov r15d, [i_play_char_id]
cmp [rsi], r15d
pop r15
ja to_enemy
cmp dword ptr [rsi+44], 0 // RNG
je to_enemy
to_player:
push r15
cmp dword ptr [is_full_EP], 1
jne @F
mov r15d, [rsi+18]
mov [rsi+14], r15d
@@:
cmp dword ptr [is_full_CP], 1
jne @F
mov r15d, [rsi+20]
mov [rsi+1C], r15d
@@:
// HP calc
mov r15d, [rsi+10]
vcvtsi2ss xmm15, xmm15, r15d
vmovss xmm14, [vf_min_player_hp_ratio]
vmulss xmm13, xmm14, xmm15
vcvtss2si r15d, xmm13
cmp edx, r15d
cmovb edx, r15d
pop r15
jmp code
to_enemy:
cmp dword ptr [is_enemy_1_HP], 1
jne code
cmp edx, 1
jbe code
mov edx, 1
code:
mov [rsi+0C],edx
mov rsi,[rsp+38]
jmp return
align 10 cc
i_play_char_id:
dd 7
vf_min_player_hp_ratio:
dd (float)0.5
is_enemy_1_HP:
dd 0
is_full_EP:
dd 1
is_full_CP:
dd 1
INJECT_BATTLE_DAMAGE_CTRL:
jmp newmem
nop 3
return:
registersymbol(i_play_char_id vf_min_player_hp_ratio is_enemy_1_HP is_full_EP is_full_CP)
registersymbol(INJECT_BATTLE_DAMAGE_CTRL)
[DISABLE]
INJECT_BATTLE_DAMAGE_CTRL:
db 89 56 0C 48 8B 74 24 38
unregistersymbol(i_play_char_id vf_min_player_hp_ratio is_enemy_1_HP is_full_EP is_full_CP)
unregistersymbol(INJECT_BATTLE_DAMAGE_CTRL)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+DBB80
sora_1st.exe+DBB68: 41 5E - pop r14
sora_1st.exe+DBB6A: C3 - ret
sora_1st.exe+DBB6B: 8B 4E 0C - mov ecx,[rsi+0C]
sora_1st.exe+DBB6E: 8B 56 10 - mov edx,[rsi+10]
sora_1st.exe+DBB71: 41 03 CE - add ecx,r14d
sora_1st.exe+DBB74: 3B CA - cmp ecx,edx
sora_1st.exe+DBB76: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+DBB79: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB7B: 85 D2 - test edx,edx
sora_1st.exe+DBB7D: 0F 48 D1 - cmovs edx,ecx
// ---------- INJECTING HERE ----------
sora_1st.exe+DBB80: 89 56 0C - mov [rsi+0C],edx
// ---------- DONE INJECTING ----------
sora_1st.exe+DBB83: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBB88: 48 83 C4 20 - add rsp,20
sora_1st.exe+DBB8C: 41 5E - pop r14
sora_1st.exe+DBB8E: C3 - ret
sora_1st.exe+DBB8F: 8B 46 18 - mov eax,[rsi+18]
sora_1st.exe+DBB92: 44 3B F0 - cmp r14d,eax
sora_1st.exe+DBB95: 41 0F 4C C6 - cmovl eax,r14d
sora_1st.exe+DBB99: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB9B: 85 C0 - test eax,eax
sora_1st.exe+DBB9D: 0F 48 C1 - cmovs eax,ecx
}
63
"Global setting"
1
56
"Criteria: player ID must <="
0
C08000
4 Bytes
i_play_char_id
141
"Warning: may affect friendly NPCs"
8000FF
1
57
"Min player HP ratio after hit"
0
C08000
Float
vf_min_player_hp_ratio
59
"Full EP after get hit?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_EP
60
"Full CP after get hit?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_CP
58
"Enemy 1 HP?"
0:No
1:Yes
0
C08000
4 Bytes
is_enemy_1_HP
142
"Warning: may affect friendly NPCs"
8000FF
1
54
"Battle: player HP: try to keep non-zero"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-03
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_HP_NO_0,$process,03 D0 41 39 50 0C 7F 1A) // should be unique
alloc(newmem,$1000,INJECT_HP_NO_0)
label(code)
label(return)
newmem:
code:
add edx,eax
cmp [r8+0C],edx
jg endp
pushfq
cmp edx, 0
jl next1
mov [r8+0C], edx
inc dword ptr [r8+0C]
jmp end_inner
next1:
push r15
mov r15d, [r8+10]
vcvtsi2ss xmm15, xmm15, r15d
vmovss xmm14, [vf_min_player_hp_ratio]
vmulss xmm14, xmm14, xmm15
vcvtss2si r15d, xmm14
mov [r8+0C], r15d
pop r15
end_inner:
popfq
cmp [r8+0C], edx
endp:
jmp return
align 10 cc
INJECT_HP_NO_0:
jmp newmem
nop
return:
registersymbol(INJECT_HP_NO_0)
[DISABLE]
INJECT_HP_NO_0:
db 03 D0 41 39 50 0C
unregistersymbol(INJECT_HP_NO_0)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+1C79CF
sora_1st.exe+1C79B1: 74 3E - je sora_1st.exe+1C79F1
sora_1st.exe+1C79B3: 4D 8B 00 - mov r8,[r8]
sora_1st.exe+1C79B6: 41 8B 40 10 - mov eax,[r8+10]
sora_1st.exe+1C79BA: 8D 0C 80 - lea ecx,[rax+rax*4]
sora_1st.exe+1C79BD: B8 1F 85 EB 51 - mov eax,51EB851F
sora_1st.exe+1C79C2: C1 E1 02 - shl ecx,02
sora_1st.exe+1C79C5: F7 E9 - imul ecx
sora_1st.exe+1C79C7: C1 FA 05 - sar edx,05
sora_1st.exe+1C79CA: 8B C2 - mov eax,edx
sora_1st.exe+1C79CC: C1 E8 1F - shr eax,1F
// ---------- INJECTING HERE ----------
sora_1st.exe+1C79CF: 03 D0 - add edx,eax
// ---------- DONE INJECTING ----------
sora_1st.exe+1C79D1: 41 39 50 0C - cmp [r8+0C],edx
sora_1st.exe+1C79D5: 7F 1A - jg sora_1st.exe+1C79F1
sora_1st.exe+1C79D7: 48 8D 15 CA CD 5F 00 - lea rdx,[sora_1st.exe+7C47A8]
sora_1st.exe+1C79DE: 48 8B CB - mov rcx,rbx
sora_1st.exe+1C79E1: E8 BA 92 FF FF - call sora_1st.exe+1C0CA0
sora_1st.exe+1C79E6: 4C 8D 05 BB CD 5F 00 - lea r8,[sora_1st.exe+7C47A8]
sora_1st.exe+1C79ED: 84 C0 - test al,al
sora_1st.exe+1C79EF: 75 07 - jne sora_1st.exe+1C79F8
sora_1st.exe+1C79F1: 4C 8D 05 A0 CD 5F 00 - lea r8,[sora_1st.exe+7C4798]
sora_1st.exe+1C79F8: F3 0F 10 05 C0 49 63 00 - movss xmm0,[sora_1st.exe+7FC3C0]
}
61
"Battle: full EP after use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-03
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_EP,$process,8B 4E 14 8B 56 18) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_EP)
label(code)
label(return)
newmem:
push r15
mov r15d, [i_play_char_id]
cmp [rsi], r15d
pop r15
ja code
cmp dword ptr [rsi+44], 0 // RNG
je code
mov edx, [rsi+18]
mov [rsi+14], edx
xor r14d, r14d
code:
mov ecx,[rsi+14]
mov edx,[rsi+18]
jmp return
INJECT_BATTLE_INF_EP:
jmp newmem
nop
return:
registersymbol(INJECT_BATTLE_INF_EP)
[DISABLE]
INJECT_BATTLE_INF_EP:
db 8B 4E 14 8B 56 18
unregistersymbol(INJECT_BATTLE_INF_EP)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+DBBAF
sora_1st.exe+DBB92: 44 3B F0 - cmp r14d,eax
sora_1st.exe+DBB95: 41 0F 4C C6 - cmovl eax,r14d
sora_1st.exe+DBB99: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB9B: 85 C0 - test eax,eax
sora_1st.exe+DBB9D: 0F 48 C1 - cmovs eax,ecx
sora_1st.exe+DBBA0: 89 46 14 - mov [rsi+14],eax
sora_1st.exe+DBBA3: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBBA8: 48 83 C4 20 - add rsp,20
sora_1st.exe+DBBAC: 41 5E - pop r14
sora_1st.exe+DBBAE: C3 - ret
// ---------- INJECTING HERE ----------
sora_1st.exe+DBBAF: 8B 4E 14 - mov ecx,[rsi+14]
// ---------- DONE INJECTING ----------
sora_1st.exe+DBBB2: 8B 56 18 - mov edx,[rsi+18]
sora_1st.exe+DBBB5: 41 03 CE - add ecx,r14d
sora_1st.exe+DBBB8: 3B CA - cmp ecx,edx
sora_1st.exe+DBBBA: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+DBBBD: 33 C9 - xor ecx,ecx
sora_1st.exe+DBBBF: 85 D2 - test edx,edx
sora_1st.exe+DBBC1: 0F 48 D1 - cmovs edx,ecx
sora_1st.exe+DBBC4: 89 56 14 - mov [rsi+14],edx
sora_1st.exe+DBBC7: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBBCC: 48 83 C4 20 - add rsp,20
}
62
"Battle: full CP after use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-03
Author : bbfox@https://openchetatables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_CP,$process,8B 4E 1C 8B 56 20) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_CP)
label(code)
label(return)
newmem:
push r15
mov r15d, [i_play_char_id]
cmp [rsi], r15d
pop r15
ja code
cmp dword ptr [rsi+44], 0 // RNG
je code
mov edx, [rsi+20]
mov [rsi+1C], edx
xor r14d, r14d
code:
mov ecx,[rsi+1C]
mov edx,[rsi+20]
jmp return
INJECT_BATTLE_INF_CP:
jmp newmem
nop
return:
registersymbol(INJECT_BATTLE_INF_CP)
[DISABLE]
INJECT_BATTLE_INF_CP:
db 8B 4E 1C 8B 56 20
unregistersymbol(INJECT_BATTLE_INF_CP)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+DBBF3
sora_1st.exe+DBBD6: 44 3B F0 - cmp r14d,eax
sora_1st.exe+DBBD9: 41 0F 4C C6 - cmovl eax,r14d
sora_1st.exe+DBBDD: 33 C9 - xor ecx,ecx
sora_1st.exe+DBBDF: 85 C0 - test eax,eax
sora_1st.exe+DBBE1: 0F 48 C1 - cmovs eax,ecx
sora_1st.exe+DBBE4: 89 46 1C - mov [rsi+1C],eax
sora_1st.exe+DBBE7: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBBEC: 48 83 C4 20 - add rsp,20
sora_1st.exe+DBBF0: 41 5E - pop r14
sora_1st.exe+DBBF2: C3 - ret
// ---------- INJECTING HERE ----------
sora_1st.exe+DBBF3: 8B 4E 1C - mov ecx,[rsi+1C]
// ---------- DONE INJECTING ----------
sora_1st.exe+DBBF6: 8B 56 20 - mov edx,[rsi+20]
sora_1st.exe+DBBF9: 41 03 CE - add ecx,r14d
sora_1st.exe+DBBFC: 3B CA - cmp ecx,edx
sora_1st.exe+DBBFE: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+DBC01: 33 C9 - xor ecx,ecx
sora_1st.exe+DBC03: 85 D2 - test edx,edx
sora_1st.exe+DBC05: 0F 48 D1 - cmovs edx,ecx
sora_1st.exe+DBC08: 89 56 1C - mov [rsi+1C],edx
sora_1st.exe+DBC0B: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBC10: 48 83 C4 20 - add rsp,20
}
65
"Battle: inf item use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-03
Author : bbfox@https://opencheattables.scom
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_ITEM,$process,2B CD C7 44 24 20 FF FF 00 00) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_ITEM)
label(code)
label(return)
newmem:
cmp ebp, 0
jl code
xor ebp, ebp
code:
sub ecx,ebp
mov [rsp+20],0000FFFF
jmp return
INJECT_BATTLE_INF_ITEM:
jmp newmem
nop 5
return:
registersymbol(INJECT_BATTLE_INF_ITEM)
[DISABLE]
INJECT_BATTLE_INF_ITEM:
db 2B CD C7 44 24 20 FF FF 00 00
unregistersymbol(INJECT_BATTLE_INF_ITEM)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+353C1F
sora_1st.exe+353BF1: 8B 86 FC 38 1F 00 - mov eax,[rsi+001F38FC]
sora_1st.exe+353BF7: 2B C5 - sub eax,ebp
sora_1st.exe+353BF9: 85 C0 - test eax,eax
sora_1st.exe+353BFB: 0F 4F F8 - cmovg edi,eax
sora_1st.exe+353BFE: 89 BE FC 38 1F 00 - mov [rsi+001F38FC],edi
sora_1st.exe+353C04: E9 02 01 00 00 - jmp sora_1st.exe+353D0B
sora_1st.exe+353C09: 48 8D 14 9E - lea rdx,[rsi+rbx*4]
sora_1st.exe+353C0D: 89 7C 24 78 - mov [rsp+78],edi
sora_1st.exe+353C11: 0F B7 8A 24 67 11 00 - movzx ecx,word ptr [rdx+00116724]
sora_1st.exe+353C18: 48 8D 35 21 E3 48 00 - lea rsi,[sora_1st.exe+7E1F40]
// ---------- INJECTING HERE ----------
sora_1st.exe+353C1F: 2B CD - sub ecx,ebp
// ---------- DONE INJECTING ----------
sora_1st.exe+353C21: C7 44 24 20 FF FF 00 00 - mov [rsp+20],0000FFFF
sora_1st.exe+353C29: 85 C9 - test ecx,ecx
sora_1st.exe+353C2B: 4C 8D 4C 24 78 - lea r9,[rsp+78]
sora_1st.exe+353C30: 66 0F 4F C1 - cmovg ax,cx
sora_1st.exe+353C34: 48 8B 0D 35 FA 58 00 - mov rcx,[sora_1st.exe+8E3670]
sora_1st.exe+353C3B: 66 89 82 24 67 11 00 - mov [rdx+00116724],ax
sora_1st.exe+353C42: 81 E3 FF FF FF 3F - and ebx,3FFFFFFF
sora_1st.exe+353C48: 0F BA EB 1E - bts ebx,1E
sora_1st.exe+353C4C: 45 33 C0 - xor r8d,r8d
sora_1st.exe+353C4F: 48 8B D6 - mov rdx,rsi
}
69
"Battle: fast break gauge"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-03
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_FAST_BREAK_GUAGE,$process,41 0F 48 CD 41 89 48 38) // should be unique
alloc(newmem,$1000,INJECT_FAST_BREAK_GUAGE)
label(code)
label(return i_base_bbp_addr)
newmem:
code:
cmovs ecx,r13d
//
cmp ecx, #500
jae @F
mov ecx, 500
@@:
//
mov [r8+38],ecx
mov [i_base_bbp_addr], r8
jmp return
align 10 cc
i_base_bbp_addr:
dq 0
INJECT_FAST_BREAK_GUAGE:
jmp newmem
nop 3
return:
registersymbol(INJECT_FAST_BREAK_GUAGE i_base_bbp_addr)
[DISABLE]
INJECT_FAST_BREAK_GUAGE:
db 41 0F 48 CD 41 89 48 38
unregistersymbol(INJECT_FAST_BREAK_GUAGE i_base_bbp_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+C0562
sora_1st.exe+C0535: 4C 8B 7C 24 58 - mov r15,[rsp+58]
sora_1st.exe+C053A: 48 8B 05 67 FD 81 00 - mov rax,[sora_1st.exe+8E02A8]
sora_1st.exe+C0541: 48 8B 88 50 2C 00 00 - mov rcx,[rax+00002C50]
sora_1st.exe+C0548: 4C 8B 81 50 02 00 00 - mov r8,[rcx+00000250]
sora_1st.exe+C054F: B9 F4 01 00 00 - mov ecx,000001F4
sora_1st.exe+C0554: 41 8B 50 38 - mov edx,[r8+38]
sora_1st.exe+C0558: 8D 04 1A - lea eax,[rdx+rbx]
sora_1st.exe+C055B: 3B C1 - cmp eax,ecx
sora_1st.exe+C055D: 0F 4C C8 - cmovl ecx,eax
sora_1st.exe+C0560: 85 C9 - test ecx,ecx
// ---------- INJECTING HERE ----------
sora_1st.exe+C0562: 41 0F 48 CD - cmovs ecx,r13d
// ---------- DONE INJECTING ----------
sora_1st.exe+C0566: 41 89 48 38 - mov [r8+38],ecx
sora_1st.exe+C056A: 3B CA - cmp ecx,edx
sora_1st.exe+C056C: 74 05 - je sora_1st.exe+C0573
sora_1st.exe+C056E: 41 C6 40 40 01 - mov byte ptr [r8+40],01
sora_1st.exe+C0573: 48 8B 5C 24 60 - mov rbx,[rsp+60]
sora_1st.exe+C0578: 48 83 C4 20 - add rsp,20
sora_1st.exe+C057C: 41 5D - pop r13
sora_1st.exe+C057E: 41 5C - pop r12
sora_1st.exe+C0580: 5F - pop rdi
sora_1st.exe+C0581: 5E - pop rsi
}
71
"real value"
0
FF8080
4 Bytes
i_base_bbp_addr
38
72
"can use #"
0
FF8080
4 Bytes
i_base_bbp_addr
3C
86
"??"
0
FF8080
4 Bytes
i_base_bbp_addr
40
70
"Restore battle gauge after battle"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-03
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_RESTORE_BP_AFTER_BATTLE,$process,48 8B 88 50 02 00 00 8B) // should be unique
alloc(newmem,$1000,INJECT_RESTORE_BP_AFTER_BATTLE)
label(code)
label(return)
newmem:
code:
mov rcx,[rax+00000250]
//
cmp dword ptr [rcx+38], #500
//
jmp return
INJECT_RESTORE_BP_AFTER_BATTLE:
jmp newmem
nop 2
return:
registersymbol(INJECT_RESTORE_BP_AFTER_BATTLE)
[DISABLE]
INJECT_RESTORE_BP_AFTER_BATTLE:
db 48 8B 88 50 02 00 00
unregistersymbol(INJECT_RESTORE_BP_AFTER_BATTLE)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+35305B
sora_1st.exe+353022: 41 3B BA 50 24 00 00 - cmp edi,[r10+00002450]
sora_1st.exe+353029: 72 B5 - jb sora_1st.exe+352FE0
sora_1st.exe+35302B: 4C 8B 25 E6 05 59 00 - mov r12,[sora_1st.exe+8E3618]
sora_1st.exe+353032: 49 83 BC 24 40 06 00 00 00 - cmp qword ptr [r12+00000640],00
sora_1st.exe+35303B: 74 2E - je sora_1st.exe+35306B
sora_1st.exe+35303D: 49 8B 82 50 2C 00 00 - mov rax,[r10+00002C50]
sora_1st.exe+353044: 48 8B 88 58 02 00 00 - mov rcx,[rax+00000258]
sora_1st.exe+35304B: 8B 41 70 - mov eax,[rcx+70]
sora_1st.exe+35304E: 89 86 50 26 11 00 - mov [rsi+00112650],eax
sora_1st.exe+353054: 49 8B 82 50 2C 00 00 - mov rax,[r10+00002C50]
// ---------- INJECTING HERE ----------
sora_1st.exe+35305B: 48 8B 88 50 02 00 00 - mov rcx,[rax+00000250]
// ---------- DONE INJECTING ----------
sora_1st.exe+353062: 8B 41 38 - mov eax,[rcx+38]
sora_1st.exe+353065: 89 86 54 26 11 00 - mov [rsi+00112654],eax
sora_1st.exe+35306B: 48 8B 15 E6 05 59 00 - mov rdx,[sora_1st.exe+8E3658]
sora_1st.exe+353072: 48 83 C2 08 - add rdx,08
sora_1st.exe+353076: 48 8D 8E 28 D6 1E 00 - lea rcx,[rsi+001ED628]
sora_1st.exe+35307D: 41 B8 00 50 00 00 - mov r8d,00005000
sora_1st.exe+353083: E8 68 8F 3F 00 - call sora_1st.exe+74BFF0
sora_1st.exe+353088: 48 8B 1D 01 D2 58 00 - mov rbx,[sora_1st.exe+8E0290]
sora_1st.exe+35308F: 44 89 B6 48 39 1F 00 - mov [rsi+001F3948],r14d
sora_1st.exe+353096: 0F 57 C0 - xorps xmm0,xmm0
}
79
"Get kill count"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-03
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_KILL_CNT,$process,8B 88 5C 12 01 00) // should be unique
alloc(newmem,$1000,INJECT_GET_KILL_CNT)
label(code)
label(return)
label(i_base_kill_cnt_addr)
newmem:
push r15
lea r15, [rax+1125C]
mov [i_base_kill_cnt_addr], r15
pop r15
code:
mov ecx,[rax+0001125C]
jmp return
align 10 cc
i_base_kill_cnt_addr:
dq 0
INJECT_GET_KILL_CNT:
jmp newmem
nop
return:
registersymbol(INJECT_GET_KILL_CNT)
registersymbol(i_base_kill_cnt_addr)
[DISABLE]
INJECT_GET_KILL_CNT:
db 8B 88 5C 12 01 00
unregistersymbol(i_base_kill_cnt_addr)
unregistersymbol(INJECT_GET_KILL_CNT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+33D4D2
sora_1st.exe+33D4A9: 83 F8 02 - cmp eax,02
sora_1st.exe+33D4AC: 75 11 - jne sora_1st.exe+33D4BF
sora_1st.exe+33D4AE: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
sora_1st.exe+33D4B5: 66 0F 6E C0 - movd xmm0,eax
sora_1st.exe+33D4B9: F3 0F 2C D0 - cvttss2si edx,xmm0
sora_1st.exe+33D4BD: EB 02 - jmp sora_1st.exe+33D4C1
sora_1st.exe+33D4BF: 8B D6 - mov edx,esi
sora_1st.exe+33D4C1: 48 8B 4C 24 30 - mov rcx,[rsp+30]
sora_1st.exe+33D4C6: E8 15 D9 16 00 - call sora_1st.exe+4AADE0
sora_1st.exe+33D4CB: 48 8B 05 9E 61 5A 00 - mov rax,[sora_1st.exe+8E3670]
// ---------- INJECTING HERE ----------
sora_1st.exe+33D4D2: 8B 88 5C 12 01 00 - mov ecx,[rax+0001125C]
// ---------- DONE INJECTING ----------
sora_1st.exe+33D4D8: 8B C1 - mov eax,ecx
sora_1st.exe+33D4DA: C1 E8 1E - shr eax,1E
sora_1st.exe+33D4DD: 83 F8 01 - cmp eax,01
sora_1st.exe+33D4E0: 75 0C - jne sora_1st.exe+33D4EE
sora_1st.exe+33D4E2: 8D 14 8D 00 00 00 00 - lea edx,[rcx*4+00000000]
sora_1st.exe+33D4E9: C1 FA 02 - sar edx,02
sora_1st.exe+33D4EC: EB 18 - jmp sora_1st.exe+33D506
sora_1st.exe+33D4EE: 83 F8 02 - cmp eax,02
sora_1st.exe+33D4F1: 75 11 - jne sora_1st.exe+33D504
sora_1st.exe+33D4F3: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
}
83
"Usage: Open memo menu"
8000FF
1
80
"Kill count"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
0
81
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
4
82
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
8
84
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
C
19
"Char. stats viewer"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-03
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_CHAR_STAT,$process,8B 55 14 48 8B CF) // should be unique
alloc(newmem,$1000,INJECT_GET_CHAR_STAT)
label(code)
label(return)
label(i_base_char_stat_addr)
newmem:
mov [i_base_char_stat_addr], rbp
code:
mov edx,[rbp+14] // c. EP
mov rcx,rdi
jmp return
align 10 cc
i_base_char_stat_addr:
dq 0
INJECT_GET_CHAR_STAT:
jmp newmem
nop
return:
registersymbol(INJECT_GET_CHAR_STAT)
registersymbol(i_base_char_stat_addr)
[DISABLE]
INJECT_GET_CHAR_STAT:
db 8B 55 14 48 8B CF
unregistersymbol(i_base_char_stat_addr)
unregistersymbol(INJECT_GET_CHAR_STAT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+43BD7F
sora_1st.exe+43BD5D: 41 B1 01 - mov r9b,01
sora_1st.exe+43BD60: 41 B8 FE FF FF 7F - mov r8d,7FFFFFFE
sora_1st.exe+43BD66: E8 95 12 01 00 - call sora_1st.exe+44D000
sora_1st.exe+43BD6B: 48 8B F0 - mov rsi,rax
sora_1st.exe+43BD6E: 48 85 C0 - test rax,rax
sora_1st.exe+43BD71: 75 0C - jne sora_1st.exe+43BD7F
sora_1st.exe+43BD73: 48 83 C3 08 - add rbx,08
sora_1st.exe+43BD77: 49 3B DF - cmp rbx,r15
sora_1st.exe+43BD7A: 75 D7 - jne sora_1st.exe+43BD53
sora_1st.exe+43BD7C: 49 8B F5 - mov rsi,r13
// ---------- INJECTING HERE ----------
sora_1st.exe+43BD7F: 8B 55 14 - mov edx,[rbp+14]
// ---------- DONE INJECTING ----------
sora_1st.exe+43BD82: 48 8B CF - mov rcx,rdi
sora_1st.exe+43BD85: E8 56 F0 06 00 - call sora_1st.exe+4AADE0
sora_1st.exe+43BD8A: 8B 55 18 - mov edx,[rbp+18]
sora_1st.exe+43BD8D: 48 8B CE - mov rcx,rsi
sora_1st.exe+43BD90: E8 4B F0 06 00 - call sora_1st.exe+4AADE0
sora_1st.exe+43BD95: 8B 45 18 - mov eax,[rbp+18]
sora_1st.exe+43BD98: 0F 28 C6 - movaps xmm0,xmm6
sora_1st.exe+43BD9B: 0F 28 CE - movaps xmm1,xmm6
sora_1st.exe+43BD9E: 39 45 14 - cmp [rbp+14],eax
sora_1st.exe+43BDA1: 75 10 - jne sora_1st.exe+43BDB3
}
20
"ID?"
0
FF8080
4 Bytes
i_base_char_stat_addr
0
21
"Lv"
0
FF8080
4 Bytes
i_base_char_stat_addr
4
22
"XP"
0
FF8080
4 Bytes
i_base_char_stat_addr
8
23
"HP"
0
FF8080
4 Bytes
i_base_char_stat_addr
C
24
"Max HP"
0
FF8080
4 Bytes
i_base_char_stat_addr
10
25
"EP"
0
FF8080
4 Bytes
i_base_char_stat_addr
14
26
"Max EP"
0
FF8080
4 Bytes
i_base_char_stat_addr
18
27
"CP"
0
FF8080
4 Bytes
i_base_char_stat_addr
1C
28
"Max CP"
0
FF8080
4 Bytes
i_base_char_stat_addr
20
33
"STR"
0
FF8080
4 Bytes
i_base_char_stat_addr
24
34
"DEF"
0
FF8080
4 Bytes
i_base_char_stat_addr
28
35
"ATS"
0
FF8080
4 Bytes
i_base_char_stat_addr
2C
36
"ADF"
0
FF8080
4 Bytes
i_base_char_stat_addr
30
37
"SPD"
0
FF8080
4 Bytes
i_base_char_stat_addr
34
38
"AGL"
0
FF8080
4 Bytes
i_base_char_stat_addr
38
39
"DEX"
0
FF8080
4 Bytes
i_base_char_stat_addr
3C
40
"MOV"
0
FF8080
4 Bytes
i_base_char_stat_addr
40
41
"RNG"
0
FF8080
4 Bytes
i_base_char_stat_addr
44
47
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
48
48
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
4C
49
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
50
50
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
54
51
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
58
52
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
5C
42
"Hit %"
0
FF8080
4 Bytes
i_base_char_stat_addr
60
43
"Evade %"
0
FF8080
4 Bytes
i_base_char_stat_addr
64
44
"Mgi Evade %"
0
FF8080
4 Bytes
i_base_char_stat_addr
68
45
"Crit %"
0
FF8080
4 Bytes
i_base_char_stat_addr
6C
46
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
70
90
"Get on-going reward data; max 50"
Auto Assembler Script
{ Game : ed9.exe
Version:
Date : 2025-01-28
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_ACHIEVEMENT,sora_1st.exe,8B 8B 00 11 01 00 8B C1 C1 E8 1E 83 F8 01 75 0F) // should be unique
alloc(newmem,$1000,INJECT_GET_ACHIEVEMENT)
alloc(INJECT_GET_ACHIEVEMENTo, 6)
label(code)
label(return i_base_achi_addr)
INJECT_GET_ACHIEVEMENTo:
readmem(INJECT_GET_ACHIEVEMENT, 6)
newmem:
push r15
push r14
push rcx
xor ecx, ecx
mov dword ptr [i_idx], 0
mov ecx, [INJECT_GET_ACHIEVEMENTo+2]
lea r15, [rbx+rcx]
loop1:
mov ecx, [i_idx]
mov r14, i_base_achi_addr
lea r14, [r14+rcx*8]
cmp qword ptr [r14], r15
je endp
cmp qword ptr [r14], 0
je write_it
jmp chk_next
write_it:
mov [r14], r15
jmp endp
db EB 3B 54
db 68 69 73 20 74
db 61 62 6C 65 20 63 6F 6D 65 73 20 66 72 6F 6D 20 68 74
db 74 70 73 3A 2F
db 2F 6F 70 65 6E 63 68 65
db 61 74 74 61 62 6C 65 73
db 2E 63 6F 6D
db 20 2F 20 43 45 20 37 2E 34 2B
chk_next:
inc dword ptr [i_idx]
cmp dword ptr [i_idx], 33
jb loop1
endp:
pop rcx
pop r14
pop r15
code:
//mov edx,[rbx+00012110]
// mov ecx,[rbx+00011100]
reassemble(INJECT_GET_ACHIEVEMENT)
jmp return
align 10 cc
i_idx:
dd 0 0
i_base_achi_addr:
dq 0
align 100 0
db 0
align 100 0
db 0
align 100 0
db 0
INJECT_GET_ACHIEVEMENT:
jmp newmem
nop
return:
registersymbol(INJECT_GET_ACHIEVEMENT i_base_achi_addr)
registersymbol(INJECT_GET_ACHIEVEMENTo)
[DISABLE]
INJECT_GET_ACHIEVEMENT:
//db 8B 8B 00 11 01 00
readmem(INJECT_GET_ACHIEVEMENTo, 6)
unregistersymbol(INJECT_GET_ACHIEVEMENT i_base_achi_addr)
dealloc(newmem)
unregistersymbol(INJECT_GET_ACHIEVEMENTo)
dealloc(INJECT_GET_ACHIEVEMENTo)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+10809D
sora_1st.exe+10806F: 8B 46 08 - mov eax,[rsi+08]
sora_1st.exe+108072: 3D 00 01 00 00 - cmp eax,00000100
sora_1st.exe+108077: 72 20 - jb sora_1st.exe+108099
sora_1st.exe+108079: 4C 8D 0D D8 C5 6D 00 - lea r9,[sora_1st.exe+7E4658]
sora_1st.exe+108080: 41 B8 5F 02 00 00 - mov r8d,0000025F
sora_1st.exe+108086: 48 8D 15 93 C5 6D 00 - lea rdx,[sora_1st.exe+7E4620]
sora_1st.exe+10808D: B9 03 00 00 00 - mov ecx,00000003
sora_1st.exe+108092: E8 39 FE 33 00 - call sora_1st.exe+447ED0
sora_1st.exe+108097: EB 04 - jmp sora_1st.exe+10809D
sora_1st.exe+108099: 48 8D 1C 83 - lea rbx,[rbx+rax*4]
// ---------- INJECTING HERE ----------
sora_1st.exe+10809D: 8B 8B 00 11 01 00 - mov ecx,[rbx+00011100]
// ---------- DONE INJECTING ----------
sora_1st.exe+1080A3: 8B C1 - mov eax,ecx
sora_1st.exe+1080A5: C1 E8 1E - shr eax,1E
sora_1st.exe+1080A8: 83 F8 01 - cmp eax,01
sora_1st.exe+1080AB: 75 0F - jne sora_1st.exe+1080BC
sora_1st.exe+1080AD: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
sora_1st.exe+1080B4: C1 F8 02 - sar eax,02
sora_1st.exe+1080B7: 45 33 FF - xor r15d,r15d
sora_1st.exe+1080BA: EB 1C - jmp sora_1st.exe+1080D8
sora_1st.exe+1080BC: 45 33 FF - xor r15d,r15d
sora_1st.exe+1080BF: 83 F8 02 - cmp eax,02
}
91
"#1"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr
0
92
"#2"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+8
0
93
"#3"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+10
0
94
"#4"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+18
0
95
"#5"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+20
0
96
"#6"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+28
0
97
"#7"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+30
0
98
"#8"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+38
0
99
"#9"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+40
0
100
"#10"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+48
0
101
"#11"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+50
0
102
"#12"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+58
0
103
"#13"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+60
0
104
"#14"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+68
0
105
"#15"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+70
0
106
"#16"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+78
0
107
"#17"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+80
0
108
"#18"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+88
0
109
"#19"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+90
0
110
"#20"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+98
0
111
"#21"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+A0
0
112
"#22"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+A8
0
113
"#23"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+B0
0
114
"#24"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+B8
0
115
"#25"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+C0
0
116
"#26"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+C8
0
117
"#27"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+D0
0
118
"#28"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+D8
0
119
"#29"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+E0
0
120
"#30"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+E8
0
121
"#31"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+F0
0
122
"#32"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+F8
0
123
"#33"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+100
0
124
"#34"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+108
0
125
"#35"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+110
0
126
"#36"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+118
0
127
"#37"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+120
0
128
"#38"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+128
0
129
"#39"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+130
0
130
"#40"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+138
0
131
"#41"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+140
0
132
"#42"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+148
0
133
"#43"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+150
0
134
"#44"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+158
0
135
"#45"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+160
0
136
"#46"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+168
0
137
"#47"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+170
0
138
"#48"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+178
0
139
"#49"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+180
0
140
"#50"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+188
0
66
"Trails in the Sky 1st Chapter Demo / https://opencheattables.com"
00B300
1