0
"Toggle Compact View"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not toggleCompactView then
function toggleCompactView(sender, forceEnable)
local isCompactMode = not (compactViewMenuItem.Caption == 'Compact View Mode')
if forceEnable ~= nil then
isCompactMode = not forceEnable
end
synchronize(function()
compactViewMenuItem.Caption = isCompactMode and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = isCompactMode
getMainForm().Panel4.Visible = isCompactMode
getMainForm().Panel5.Visible = isCompactMode
end)
end
end
if not createCompactViewMenu then
function createCompactViewMenu()
if isCompactMenuCreated then return end
synchronize(function()
local mainMenu = getMainForm().Menu.Items
compactViewMenuItem = createMenuItem(mainMenu)
compactViewMenuItem.Caption = 'Compact View Mode'
compactViewMenuItem.OnClick = toggleCompactView
mainMenu.add(compactViewMenuItem)
end)
isCompactMenuCreated = true
end
end
createCompactViewMenu()
toggleCompactView(nil, true)
[DISABLE]
{$lua}
if toggleCompactView then
toggleCompactView(nil, false)
end
2
"Toggle scripts"
4080FF
Auto Assembler Script
[ENABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local enableBattleScripts = {
0, -- "Toggle Compact View"
1,
15, -- "Browse & set item amount"
18, -- "Battle: damage control"
3, -- "Get Mira"
30, -- "Battle: inf item use"
31, -- "Battle: fast break gauge"
35, -- "Restore break gauge after battle"
36, -- "Field charge gauge multiplier"
38, -- "Field charge: inf charge use"
27, -- "Battle: player HP: try to keep non-zero"
28, -- "Battle: full EP after use"
29, -- "Battle: full CP after use"
130,
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(enableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and not memRec.Active then
memRec.Active = true
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
[DISABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local disableBattleScripts = {
130,
29, -- "Battle: full CP after use"
28, -- "Battle: full EP after use"
27, -- "Battle: player HP: try to keep non-zero"
25, -- "Enemy 1 HP?"
19, -- "Global setting"
75, -- "Get on-going reward data; max 50"
45, -- "Char. stats viewer"
39, -- "Get kill count"
38, -- "Field charge: inf charge use"
36, -- "Field charge gauge multiplier"
35, -- "Restore break gauge after battle"
31, -- "Battle: fast break gauge"
30, -- "Battle: inf item use"
3, -- "Get Mira"
18, -- "Battle: damage control"
15, -- "Browse & set item amount"
126, -- "Trails in the Sky 1st Chapter Demo / https://opencheattables.com"
1,
0, -- "Toggle Compact View"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(disableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and memRec.Active then
memRec.Active = false
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
-- Comments:
-- ID: 0, Description: "Toggle Compact View", Depth: 0
-- ID: 1, Description: "Enable", Depth: 0
-- ID: 3, Description: "Get Mira", Depth: 1
-- ID: 15, Description: "Browse & set item amount", Depth: 1
-- ID: 18, Description: "Battle: damage control", Depth: 1
-- ID: 19, Description: "Global setting", Depth: 2
-- ID: 20, Description: "Criteria: player ID must <=", Depth: 3
-- ID: 25, Description: "Enemy 1 HP?", Depth: 2
-- ID: 27, Description: "Battle: player HP: try to keep non-zero", Depth: 2
-- ID: 28, Description: "Battle: full EP after use", Depth: 2
-- ID: 29, Description: "Battle: full CP after use", Depth: 2
-- ID: 30, Description: "Battle: inf item use", Depth: 1
-- ID: 31, Description: "Battle: fast break gauge", Depth: 1
-- ID: 35, Description: "Restore break gauge after battle", Depth: 1
-- ID: 36, Description: "Field charge gauge multiplier", Depth: 1
-- ID: 38, Description: "Field charge: inf charge use", Depth: 1
-- ID: 39, Description: "Get kill count", Depth: 1
-- ID: 45, Description: "Char. stats viewer", Depth: 1
-- ID: 75, Description: "Get on-going reward data; max 50", Depth: 1
-- ID: 126, Description: "Trails in the Sky 1st Chapter Demo / https://opencheattables.com", Depth: 0
1
"啟用 / Enable"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if memrec then print(memrec.Description) end
-- Clear lua engine log & close lua engine
if not closeLuaEngine2 then
function closeLuaEngine2()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine2')
synchronize(function()
getLuaEngine().MenuItem5.doClick()
AddressList.Header.OnSectionClick = nil
end)
closeLuaEngine2()
if _kuro_2_customInt == nil then
local p_proc = process
registerCustomTypeAutoAssembler([[
alloc(TypeName,256)
alloc(ByteSize,8)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(UsesFloat,1)
TypeName:
db 'Kueo2 integer',0
ByteSize:
dd 4
UsesFloat:
db 0
ConvertRoutine:
//at this point ecx contains the address where the bytes are stored
//return with rax/eax
xor rax,rax
mov eax, dword ptr [rcx]
and eax, 3FFFFFFF
ret
ConvertBackRoutine:
//at this point edx contains the address to write the value to
//and ecx contains the value
push rax
xor rax, rax
mov eax, ecx
or eax, 40000000
mov dword ptr [rdx], eax
pop rax
ret
]])
_kuro_2_customInt = true
process = p_proc
autoAssemble(string.format([[
unregistersymbol($process)
define($process, "%s")
registersymbol($process)
]], process))
closeLuaEngine2()
end
[DISABLE]
{$lua}
if syntaxcheck then return end
closeLuaEngine2()
3
"取得Mira和晶石 / Get Mira"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://openchetatables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_MIRA,sora_1st.exe,8B 92 ?? ?? ?? 00 E8 ?? ?? ?? ?? 48 8B ?? E8) // should be unique
alloc(newmem,$1000,INJECT_GET_MIRA)
alloc(INJECT_GET_MIRAo, 6)
label(code)
label(return)
label(i_base_mira_addr i_base_mira_offset)
INJECT_GET_MIRAo:
readmem(INJECT_GET_MIRA, 6)
newmem:
push r15
xor r15, r15
db 41 bf //00 39 1f 00
readmem(INJECT_GET_MIRA+2, 4)
mov [i_base_mira_addr], rdx
mov [i_base_mira_offset], r15
pop r15
code:
reassemble(INJECT_GET_MIRA)
//mov edx,[rdx+001F3900]
jmp return
align 10 cc
i_base_mira_addr:
dq 0
i_base_mira_offset:
dq 0
INJECT_GET_MIRA:
jmp newmem
nop
return:
registersymbol(INJECT_GET_MIRA)
registersymbol(i_base_mira_addr i_base_mira_offset)
registersymbol(INJECT_GET_MIRAo)
[DISABLE]
INJECT_GET_MIRA:
//db 8B 92 00 39 1F 00
readmem(INJECT_GET_MIRAo, 6)
unregistersymbol(i_base_mira_addr i_base_mira_offset)
unregistersymbol(INJECT_GET_MIRA)
dealloc(newmem)
unregistersymbol(INJECT_GET_MIRAo)
dealloc(INJECT_GET_MIRAo)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+1AED13
sora_1st.exe+1AECED: 41 B8 FE FF FF 7F - mov r8d,7FFFFFFE
sora_1st.exe+1AECF3: E8 08 E3 29 00 - call sora_1st.exe+44D000
sora_1st.exe+1AECF8: 48 85 C0 - test rax,rax
sora_1st.exe+1AECFB: 75 0C - jne sora_1st.exe+1AED09
sora_1st.exe+1AECFD: 48 83 C3 08 - add rbx,08
sora_1st.exe+1AED01: 48 3B DE - cmp rbx,rsi
sora_1st.exe+1AED04: 75 DA - jne sora_1st.exe+1AECE0
sora_1st.exe+1AED06: 49 8B C4 - mov rax,r12
sora_1st.exe+1AED09: 48 8B 15 58 49 73 00 - mov rdx,[sora_1st.exe+8E3668]
sora_1st.exe+1AED10: 48 8B C8 - mov rcx,rax
// ---------- INJECTING HERE ----------
sora_1st.exe+1AED13: 8B 92 00 39 1F 00 - mov edx,[rdx+001F3900]
// ---------- DONE INJECTING ----------
sora_1st.exe+1AED19: E8 C2 C0 2F 00 - call sora_1st.exe+4AADE0
sora_1st.exe+1AED1E: 48 8B CF - mov rcx,rdi
sora_1st.exe+1AED21: E8 0A 13 00 00 - call sora_1st.exe+1B0030
sora_1st.exe+1AED26: 44 88 A7 A8 01 00 00 - mov [rdi+000001A8],r12b
sora_1st.exe+1AED2D: 48 8B 05 3C 49 73 00 - mov rax,[sora_1st.exe+8E3670]
sora_1st.exe+1AED34: F6 80 01 01 00 00 40 - test byte ptr [rax+00000101],40
sora_1st.exe+1AED3B: 0F 85 D1 00 00 00 - jne sora_1st.exe+1AEE12
sora_1st.exe+1AED41: 48 8B 05 60 15 73 00 - mov rax,[sora_1st.exe+8E02A8]
sora_1st.exe+1AED48: 44 38 A0 24 2D 00 00 - cmp [rax+00002D24],r12b
sora_1st.exe+1AED4F: 0F 85 BD 00 00 00 - jne sora_1st.exe+1AEE12
}
4
"地 / Earth"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-20
5
"水 / Water"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-1C
6
"火 / Fire"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-18
7
"風 / Wind"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-14
8
"時 / Time"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-10
9
"空 / Space"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-C
10
"幻 / Mirage"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-8
11
"Exchange"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-4
12
"Mira"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]
13
"??"
0
FF8080
4 Bytes
i_base_mira_addr
1F3904
14
"遊戲時間 / Time"
0
FF8080
Double
i_base_mira_addr
[i_base_mira_offset]+8
15
"瀏覽道具後設定個數 / Browse & set item amount"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BROWSE_ITEM_N_SET,sora_1st.exe,0F B7 94 98 ?? ?? ?? ?? 85 D2 75) // should be unique
alloc(newmem,$1000,INJECT_BROWSE_ITEM_N_SET)
alloc(INJECT_BROWSE_ITEM_N_SETo, 8)
label(code)
label(return)
label(iw_min_threshold iw_set_item_cnt_to i_item_addr_offset)
INJECT_BROWSE_ITEM_N_SETo:
readmem(INJECT_BROWSE_ITEM_N_SET, 8)
newmem:
cmp qword ptr [i_item_addr_offset], 0
jne next1
push r15
xor r15, r15
db 41 bf
readmem(INJECT_BROWSE_ITEM_N_SET+4, 4)
mov [i_item_addr_offset], r15
pop r15
next1:
push r15
push r14
mov r14, [i_item_addr_offset]
lea r15, [rax+rbx*4]
lea r15, [r15+r14]
mov r14w, [r15]
cmp r14w, [iw_min_threshold]
jb endp
cmp r14w, [iw_set_item_cnt_to]
jae endp
mov r14w, [iw_set_item_cnt_to]
mov [r15], r14w
endp:
pop r14
pop r15
code:
reassemble(INJECT_BROWSE_ITEM_N_SET)
//movzx edx,word ptr [rax+rbx*4+00116724]
jmp return
align 10 cc
iw_min_threshold:
dw 2
iw_set_item_cnt_to:
dw 46
i_item_addr_offset:
dq 0
INJECT_BROWSE_ITEM_N_SET:
jmp newmem
nop 3
return:
registersymbol(INJECT_BROWSE_ITEM_N_SET)
registersymbol(INJECT_BROWSE_ITEM_N_SETo)
registersymbol(iw_min_threshold iw_set_item_cnt_to i_item_addr_offset)
[DISABLE]
INJECT_BROWSE_ITEM_N_SET:
//db 0F B7 94 98 24 67 11 00
readmem(INJECT_BROWSE_ITEM_N_SETo, 8)
unregistersymbol(iw_min_threshold iw_min_threshold)
unregistersymbol(INJECT_BROWSE_ITEM_N_SET)
dealloc(newmem)
unregistersymbol(INJECT_BROWSE_ITEM_N_SETo)
dealloc(INJECT_BROWSE_ITEM_N_SETo)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+131D54
sora_1st.exe+131D29: E8 A2 61 31 00 - call sora_1st.exe+447ED0
sora_1st.exe+131D2E: EB 30 - jmp sora_1st.exe+131D60
sora_1st.exe+131D30: 8D 83 CA FE FF FF - lea eax,[rbx-00000136]
sora_1st.exe+131D36: 83 F8 07 - cmp eax,07
sora_1st.exe+131D39: 77 12 - ja sora_1st.exe+131D4D
sora_1st.exe+131D3B: 8B C8 - mov ecx,eax
sora_1st.exe+131D3D: 48 8B 05 24 19 7B 00 - mov rax,[sora_1st.exe+8E3668]
sora_1st.exe+131D44: 8B 94 88 E0 38 1F 00 - mov edx,[rax+rcx*4+001F38E0]
sora_1st.exe+131D4B: EB 0F - jmp sora_1st.exe+131D5C
sora_1st.exe+131D4D: 48 8B 05 14 19 7B 00 - mov rax,[sora_1st.exe+8E3668]
// ---------- INJECTING HERE ----------
sora_1st.exe+131D54: 0F B7 94 98 24 67 11 00 - movzx edx,word ptr [rax+rbx*4+00116724]
// ---------- DONE INJECTING ----------
sora_1st.exe+131D5C: 85 D2 - test edx,edx
sora_1st.exe+131D5E: 75 15 - jne sora_1st.exe+131D75
sora_1st.exe+131D60: 4C 8B C5 - mov r8,rbp
sora_1st.exe+131D63: BA FF FF FF FF - mov edx,FFFFFFFF
sora_1st.exe+131D68: E8 E3 68 18 00 - call sora_1st.exe+2B8650
sora_1st.exe+131D6D: 85 C0 - test eax,eax
sora_1st.exe+131D6F: 0F 84 38 01 00 00 - je sora_1st.exe+131EAD
sora_1st.exe+131D75: 48 8B 0D 1C 19 7B 00 - mov rcx,[sora_1st.exe+8E3698]
sora_1st.exe+131D7C: 48 85 C9 - test rcx,rcx
sora_1st.exe+131D7F: 74 10 - je sora_1st.exe+131D91
}
133
"道具目前數量必須大於等於："
0
C08000
2 Bytes
iw_min_threshold
134
"設定數量為："
0
C08000
2 Bytes
iw_set_item_cnt_to
16
"Avail. item amount must >="
0
C08000
2 Bytes
iw_min_threshold
17
"Set amount to"
0
C08000
2 Bytes
iw_set_item_cnt_to
18
"戰鬥：傷害控制 / Battle: damage control"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_DAMAGE_CTRL,sora_1st.exe,89 56 0C 48 8B 74 24 38) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_DAMAGE_CTRL)
label(code)
label(return)
label(i_play_char_id vf_min_player_hp_ratio is_enemy_HP_option is_full_EP is_full_CP i_enemy_HP_limit vf_damage_multi)
newmem:
//push r15
//mov r15d, [i_play_char_id]
//cmp [rsi], r15d
//pop r15
//ja to_enemy
cmp dword ptr [rsi+44], 0 // RNG
je to_enemy
cmp dword ptr [rsi+78], 0 // STUN
jne to_enemy
to_player:
push r15
cmp dword ptr [is_full_EP], 1
jne @F
mov r15d, [rsi+18]
mov [rsi+14], r15d
@@:
cmp dword ptr [is_full_CP], 1
jne @F
mov r15d, [rsi+20]
mov [rsi+1C], r15d
@@:
// HP calc
mov r15d, [rsi+10]
vcvtsi2ss xmm15, xmm15, r15d
vmovss xmm14, [vf_min_player_hp_ratio]
vmulss xmm13, xmm14, xmm15
vcvtss2si r15d, xmm13
cmp edx, r15d
cmovb edx, r15d
pop r15
jmp code
to_enemy:
cmp dword ptr [is_enemy_HP_option], 0
je code
cmp dword ptr [is_enemy_HP_option], 1
je to_1HP
cmp dword ptr [is_enemy_HP_option], 2
je to_1HK
cmp dword ptr [is_enemy_HP_option], 3
je to_set_limit
cmp dword ptr [is_enemy_HP_option], 4
je to_damage_multi
jmp code
to_1HK:
mov edx, 0
jmp code
to_1HP:
cmp edx, 1
jbe code
mov edx, 1
jmp code
to_set_limit:
cmp edx, [i_enemy_HP_limit]
jbe code
mov edx, [i_enemy_HP_limit]
jmp code
to_damage_multi:
cmp r14d, 0
jge code
vcvtsi2ss xmm15, xmm15, r14d
vmovss xmm14, [vf_damage_multi]
vmulss xmm15, xmm14, xmm15
vcvtss2si r14d, xmm15
mov ecx,[rsi+0C]
mov edx,[rsi+10]
add ecx,r14d
cmp ecx,edx
cmovl edx,ecx
test edx,edx
cmovs edx,ecx
// jmp code
code:
mov [rsi+0C],edx
mov rsi,[rsp+38]
jmp return
align 10 cc
i_play_char_id:
dd 7
vf_min_player_hp_ratio:
dd (float)0.25
is_enemy_HP_option:
dd 0
i_enemy_HP_limit:
dd #40000
is_full_EP:
dd 1
is_full_CP:
dd 1
vf_damage_multi:
dd (float)3.3333333
INJECT_BATTLE_DAMAGE_CTRL:
jmp newmem
nop 3
return:
registersymbol(i_play_char_id vf_min_player_hp_ratio is_enemy_HP_option is_full_EP is_full_CP i_enemy_HP_limit vf_damage_multi)
registersymbol(INJECT_BATTLE_DAMAGE_CTRL)
[DISABLE]
INJECT_BATTLE_DAMAGE_CTRL:
db 89 56 0C 48 8B 74 24 38
unregistersymbol(i_play_char_id vf_min_player_hp_ratio is_enemy_HP_option is_full_EP is_full_CP i_enemy_HP_limit vf_damage_multi)
unregistersymbol(INJECT_BATTLE_DAMAGE_CTRL)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+DBB80
sora_1st.exe+DBB68: 41 5E - pop r14
sora_1st.exe+DBB6A: C3 - ret
sora_1st.exe+DBB6B: 8B 4E 0C - mov ecx,[rsi+0C]
sora_1st.exe+DBB6E: 8B 56 10 - mov edx,[rsi+10]
sora_1st.exe+DBB71: 41 03 CE - add ecx,r14d
sora_1st.exe+DBB74: 3B CA - cmp ecx,edx
sora_1st.exe+DBB76: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+DBB79: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB7B: 85 D2 - test edx,edx
sora_1st.exe+DBB7D: 0F 48 D1 - cmovs edx,ecx
// ---------- INJECTING HERE ----------
sora_1st.exe+DBB80: 89 56 0C - mov [rsi+0C],edx
// ---------- DONE INJECTING ----------
sora_1st.exe+DBB83: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBB88: 48 83 C4 20 - add rsp,20
sora_1st.exe+DBB8C: 41 5E - pop r14
sora_1st.exe+DBB8E: C3 - ret
sora_1st.exe+DBB8F: 8B 46 18 - mov eax,[rsi+18]
sora_1st.exe+DBB92: 44 3B F0 - cmp r14d,eax
sora_1st.exe+DBB95: 41 0F 4C C6 - cmovl eax,r14d
sora_1st.exe+DBB99: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB9B: 85 C0 - test eax,eax
sora_1st.exe+DBB9D: 0F 48 C1 - cmovs eax,ecx
}
19
"Global setting"
1
22
"最小玩家HP比率"
0
C08000
Float
vf_min_player_hp_ratio
135
"Min player HP ratio after hit"
0
C08000
Float
vf_min_player_hp_ratio
23
"被擊中後回EP?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_EP
24
"被擊中後回CP?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_CP
136
"Full EP after get hit?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_EP
137
"Full CP after get hit?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_CP
25
"Enemy HP option"
0:None
1:1 HP
2:1 hit kill
3:set limit as below
4:damage multiplier as below
0
C08000
4 Bytes
is_enemy_HP_option
140
"警告：可能影響友方NPC"
8000FF
1
141
"友方NPC可能因此中一招即亡"
8000FF
1
26
"Warning: may affect friendly NPCs"
8000FF
1
132
"friendly NPC may be killed when battle start"
8000FF
1
127
"敵方HP上限"
0
C08000
4 Bytes
i_enemy_HP_limit
128
"傷害倍率"
0
C08000
Float
vf_damage_multi
138
"Enemy HP limit:"
0
C08000
4 Bytes
i_enemy_HP_limit
139
"damage multiplier"
0
C08000
Float
vf_damage_multi
27
"戰鬥：試著HP不變0 / Battle: player HP: try to keep non-zero"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_HP_NO_0,sora_1st.exe,03 D0 41 39 50 0C 7F ?? 48 8D 15 ?? ?? ?? ?? 48 8B CB) // should be unique
alloc(newmem,$1000,INJECT_HP_NO_0)
label(code)
label(return)
newmem:
code:
add edx,eax
cmp [r8+0C],edx
jg endp
pushfq
cmp edx, 0
jl next1
mov [r8+0C], edx
inc dword ptr [r8+0C]
jmp end_inner
next1:
push r15
mov r15d, [r8+10]
vcvtsi2ss xmm15, xmm15, r15d
vmovss xmm14, [vf_min_player_hp_ratio]
vmulss xmm14, xmm14, xmm15
vcvtss2si r15d, xmm14
mov [r8+0C], r15d
pop r15
end_inner:
popfq
cmp [r8+0C], edx
endp:
jmp return
align 10 cc
INJECT_HP_NO_0:
jmp newmem
nop
return:
registersymbol(INJECT_HP_NO_0)
[DISABLE]
INJECT_HP_NO_0:
db 03 D0 41 39 50 0C
unregistersymbol(INJECT_HP_NO_0)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+1CF283
sora_1st.exe+1CF265: 74 44 - je sora_1st.exe+1CF2AB
sora_1st.exe+1CF267: 4D 8B 00 - mov r8,[r8]
sora_1st.exe+1CF26A: 41 8B 40 10 - mov eax,[r8+10]
sora_1st.exe+1CF26E: 8D 0C 80 - lea ecx,[rax+rax*4]
sora_1st.exe+1CF271: B8 1F 85 EB 51 - mov eax,51EB851F
sora_1st.exe+1CF276: C1 E1 02 - shl ecx,02
sora_1st.exe+1CF279: F7 E9 - imul ecx
sora_1st.exe+1CF27B: C1 FA 05 - sar edx,05
sora_1st.exe+1CF27E: 8B C2 - mov eax,edx
sora_1st.exe+1CF280: C1 E8 1F - shr eax,1F
// ---------- INJECTING HERE ----------
sora_1st.exe+1CF283: 03 D0 - add edx,eax
// ---------- DONE INJECTING ----------
sora_1st.exe+1CF285: 41 39 50 0C - cmp [r8+0C],edx
sora_1st.exe+1CF289: 7F 20 - jg sora_1st.exe+1CF2AB
sora_1st.exe+1CF28B: 48 8D 15 26 C8 60 00 - lea rdx,[sora_1st.exe+7DBAB8]
sora_1st.exe+1CF292: 48 8B CB - mov rcx,rbx
sora_1st.exe+1CF295: E8 B6 90 FF FF - call sora_1st.exe+1C8350
sora_1st.exe+1CF29A: 84 C0 - test al,al
sora_1st.exe+1CF29C: 74 0D - je sora_1st.exe+1CF2AB
sora_1st.exe+1CF29E: 89 7C 24 28 - mov [rsp+28],edi
sora_1st.exe+1CF2A2: 4C 8D 05 0F C8 60 00 - lea r8,[sora_1st.exe+7DBAB8]
sora_1st.exe+1CF2A9: EB 0D - jmp sora_1st.exe+1CF2B8
}
28
"戰鬥：EP使用後回滿 / Battle: full EP after use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_EP,sora_1st.exe,8B 4E 14 8B 56 18) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_EP)
label(code)
label(return)
newmem:
cmp dword ptr [rsi+44], 0 // RNG
je code
cmp dword ptr [rsi+78], 0 // RNG
jne code
mov edx, [rsi+18]
mov [rsi+14], edx
xor r14d, r14d
code:
mov ecx,[rsi+14]
mov edx,[rsi+18]
jmp return
INJECT_BATTLE_INF_EP:
jmp newmem
nop
return:
registersymbol(INJECT_BATTLE_INF_EP)
[DISABLE]
INJECT_BATTLE_INF_EP:
db 8B 4E 14 8B 56 18
unregistersymbol(INJECT_BATTLE_INF_EP)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+DBBAF
sora_1st.exe+DBB92: 44 3B F0 - cmp r14d,eax
sora_1st.exe+DBB95: 41 0F 4C C6 - cmovl eax,r14d
sora_1st.exe+DBB99: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB9B: 85 C0 - test eax,eax
sora_1st.exe+DBB9D: 0F 48 C1 - cmovs eax,ecx
sora_1st.exe+DBBA0: 89 46 14 - mov [rsi+14],eax
sora_1st.exe+DBBA3: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBBA8: 48 83 C4 20 - add rsp,20
sora_1st.exe+DBBAC: 41 5E - pop r14
sora_1st.exe+DBBAE: C3 - ret
// ---------- INJECTING HERE ----------
sora_1st.exe+DBBAF: 8B 4E 14 - mov ecx,[rsi+14]
// ---------- DONE INJECTING ----------
sora_1st.exe+DBBB2: 8B 56 18 - mov edx,[rsi+18]
sora_1st.exe+DBBB5: 41 03 CE - add ecx,r14d
sora_1st.exe+DBBB8: 3B CA - cmp ecx,edx
sora_1st.exe+DBBBA: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+DBBBD: 33 C9 - xor ecx,ecx
sora_1st.exe+DBBBF: 85 D2 - test edx,edx
sora_1st.exe+DBBC1: 0F 48 D1 - cmovs edx,ecx
sora_1st.exe+DBBC4: 89 56 14 - mov [rsi+14],edx
sora_1st.exe+DBBC7: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBBCC: 48 83 C4 20 - add rsp,20
}
29
"戰鬥：CP使用後回滿 / Battle: full CP after use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://openchetatables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_CP,sora_1st.exe,8B 4E 1C 8B 56 20) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_CP)
label(code)
label(return)
newmem:
cmp dword ptr [rsi+44], 0 // RNG
je code
cmp dword ptr [rsi+78], 0
jne code
mov edx, [rsi+20]
mov [rsi+1C], edx
xor r14d, r14d
code:
mov ecx,[rsi+1C]
mov edx,[rsi+20]
jmp return
INJECT_BATTLE_INF_CP:
jmp newmem
nop
return:
registersymbol(INJECT_BATTLE_INF_CP)
[DISABLE]
INJECT_BATTLE_INF_CP:
db 8B 4E 1C 8B 56 20
unregistersymbol(INJECT_BATTLE_INF_CP)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+DBBF3
sora_1st.exe+DBBD6: 44 3B F0 - cmp r14d,eax
sora_1st.exe+DBBD9: 41 0F 4C C6 - cmovl eax,r14d
sora_1st.exe+DBBDD: 33 C9 - xor ecx,ecx
sora_1st.exe+DBBDF: 85 C0 - test eax,eax
sora_1st.exe+DBBE1: 0F 48 C1 - cmovs eax,ecx
sora_1st.exe+DBBE4: 89 46 1C - mov [rsi+1C],eax
sora_1st.exe+DBBE7: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBBEC: 48 83 C4 20 - add rsp,20
sora_1st.exe+DBBF0: 41 5E - pop r14
sora_1st.exe+DBBF2: C3 - ret
// ---------- INJECTING HERE ----------
sora_1st.exe+DBBF3: 8B 4E 1C - mov ecx,[rsi+1C]
// ---------- DONE INJECTING ----------
sora_1st.exe+DBBF6: 8B 56 20 - mov edx,[rsi+20]
sora_1st.exe+DBBF9: 41 03 CE - add ecx,r14d
sora_1st.exe+DBBFC: 3B CA - cmp ecx,edx
sora_1st.exe+DBBFE: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+DBC01: 33 C9 - xor ecx,ecx
sora_1st.exe+DBC03: 85 D2 - test edx,edx
sora_1st.exe+DBC05: 0F 48 D1 - cmovs edx,ecx
sora_1st.exe+DBC08: 89 56 1C - mov [rsi+1C],edx
sora_1st.exe+DBC0B: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBC10: 48 83 C4 20 - add rsp,20
}
130
"戰鬥：擊暈倍率 / Battle: Stun multiplier"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_STUN_MULTI,sora_1st.exe,F3 41 0F 58 C0 F3 0F 5D) // should be unique
alloc(newmem,$1000,INJECT_STUN_MULTI)
label(code)
label(return)
label(vf_stun_multi)
newmem:
cmp dword ptr [rcx+44], 0 // RNG
je code
cmp dword ptr [rcx+78], 0
jne code
mulss xmm8, dword ptr [vf_stun_multi]
code:
addss xmm0,xmm8
jmp return
align 10 cc
vf_stun_multi:
dd (float)3.333333333
INJECT_STUN_MULTI:
jmp newmem
return:
registersymbol(INJECT_STUN_MULTI)
registersymbol(vf_stun_multi)
[DISABLE]
INJECT_STUN_MULTI:
db F3 41 0F 58 C0
unregistersymbol(vf_stun_multi)
unregistersymbol(INJECT_STUN_MULTI)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+C8B27
sora_1st.exe+C8AFE: 40 84 F6 - test sil,sil
sora_1st.exe+C8B01: F3 44 0F 11 4C 24 20 - movss [rsp+20],xmm9
sora_1st.exe+C8B08: 49 0F 44 C7 - cmove rax,r15
sora_1st.exe+C8B0C: 4C 8B 7C 24 70 - mov r15,[rsp+70]
sora_1st.exe+C8B11: F3 0F 10 51 78 - movss xmm2,[rcx+78]
sora_1st.exe+C8B16: 44 0F 2F CA - comiss xmm9,xmm2
sora_1st.exe+C8B1A: 73 5A - jae sora_1st.exe+C8B76
sora_1st.exe+C8B1C: F3 0F 10 59 74 - movss xmm3,[rcx+74]
sora_1st.exe+C8B21: 0F 28 CA - movaps xmm1,xmm2
sora_1st.exe+C8B24: 0F 28 C3 - movaps xmm0,xmm3
// ---------- INJECTING HERE ----------
sora_1st.exe+C8B27: F3 41 0F 58 C0 - addss xmm0,xmm8
// ---------- DONE INJECTING ----------
sora_1st.exe+C8B2C: F3 0F 5D C8 - minss xmm1,xmm0
sora_1st.exe+C8B30: 40 84 ED - test bpl,bpl
sora_1st.exe+C8B33: 74 0C - je sora_1st.exe+C8B41
sora_1st.exe+C8B35: 0F 2F CA - comiss xmm1,xmm2
sora_1st.exe+C8B38: 72 07 - jb sora_1st.exe+C8B41
sora_1st.exe+C8B3A: 0F 28 CA - movaps xmm1,xmm2
sora_1st.exe+C8B3D: F3 0F 5C CC - subss xmm1,xmm4
sora_1st.exe+C8B41: 48 85 C0 - test rax,rax
sora_1st.exe+C8B44: 74 11 - je sora_1st.exe+C8B57
sora_1st.exe+C8B46: F3 0F 5C CB - subss xmm1,xmm3
}
131
"multiplier"
0
C08000
Float
vf_stun_multi
30
"戰鬥中道具無限 / Battle: inf item use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.scom
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_ITEM,sora_1st.exe,2B CD C7 44 24 20 FF FF 00 00) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_ITEM)
label(code)
label(return)
newmem:
cmp ebp, 0
jl code
xor ebp, ebp
code:
sub ecx,ebp
mov [rsp+20],0000FFFF
jmp return
INJECT_BATTLE_INF_ITEM:
jmp newmem
nop 5
return:
registersymbol(INJECT_BATTLE_INF_ITEM)
[DISABLE]
INJECT_BATTLE_INF_ITEM:
db 2B CD C7 44 24 20 FF FF 00 00
unregistersymbol(INJECT_BATTLE_INF_ITEM)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+353C1F
sora_1st.exe+353BF1: 8B 86 FC 38 1F 00 - mov eax,[rsi+001F38FC]
sora_1st.exe+353BF7: 2B C5 - sub eax,ebp
sora_1st.exe+353BF9: 85 C0 - test eax,eax
sora_1st.exe+353BFB: 0F 4F F8 - cmovg edi,eax
sora_1st.exe+353BFE: 89 BE FC 38 1F 00 - mov [rsi+001F38FC],edi
sora_1st.exe+353C04: E9 02 01 00 00 - jmp sora_1st.exe+353D0B
sora_1st.exe+353C09: 48 8D 14 9E - lea rdx,[rsi+rbx*4]
sora_1st.exe+353C0D: 89 7C 24 78 - mov [rsp+78],edi
sora_1st.exe+353C11: 0F B7 8A 24 67 11 00 - movzx ecx,word ptr [rdx+00116724]
sora_1st.exe+353C18: 48 8D 35 21 E3 48 00 - lea rsi,[sora_1st.exe+7E1F40]
// ---------- INJECTING HERE ----------
sora_1st.exe+353C1F: 2B CD - sub ecx,ebp
// ---------- DONE INJECTING ----------
sora_1st.exe+353C21: C7 44 24 20 FF FF 00 00 - mov [rsp+20],0000FFFF
sora_1st.exe+353C29: 85 C9 - test ecx,ecx
sora_1st.exe+353C2B: 4C 8D 4C 24 78 - lea r9,[rsp+78]
sora_1st.exe+353C30: 66 0F 4F C1 - cmovg ax,cx
sora_1st.exe+353C34: 48 8B 0D 35 FA 58 00 - mov rcx,[sora_1st.exe+8E3670]
sora_1st.exe+353C3B: 66 89 82 24 67 11 00 - mov [rdx+00116724],ax
sora_1st.exe+353C42: 81 E3 FF FF FF 3F - and ebx,3FFFFFFF
sora_1st.exe+353C48: 0F BA EB 1E - bts ebx,1E
sora_1st.exe+353C4C: 45 33 C0 - xor r8d,r8d
sora_1st.exe+353C4F: 48 8B D6 - mov rdx,rsi
}
31
"戰鬥：快速破防 / Battle: fast break gauge"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_FAST_BREAK_GUAGE,sora_1st.exe,41 0F 48 CD 41 89 48 38) // should be unique
alloc(newmem,$1000,INJECT_FAST_BREAK_GUAGE)
label(code)
label(return i_base_bbp_addr)
newmem:
code:
cmovs ecx,r13d
//
cmp ecx, #500
jae @F
mov ecx, 500
@@:
//
mov [r8+38],ecx
mov [i_base_bbp_addr], r8
jmp return
align 10 cc
i_base_bbp_addr:
dq 0
INJECT_FAST_BREAK_GUAGE:
jmp newmem
nop 3
return:
registersymbol(INJECT_FAST_BREAK_GUAGE i_base_bbp_addr)
[DISABLE]
INJECT_FAST_BREAK_GUAGE:
db 41 0F 48 CD 41 89 48 38
unregistersymbol(INJECT_FAST_BREAK_GUAGE i_base_bbp_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+C0562
sora_1st.exe+C0535: 4C 8B 7C 24 58 - mov r15,[rsp+58]
sora_1st.exe+C053A: 48 8B 05 67 FD 81 00 - mov rax,[sora_1st.exe+8E02A8]
sora_1st.exe+C0541: 48 8B 88 50 2C 00 00 - mov rcx,[rax+00002C50]
sora_1st.exe+C0548: 4C 8B 81 50 02 00 00 - mov r8,[rcx+00000250]
sora_1st.exe+C054F: B9 F4 01 00 00 - mov ecx,000001F4
sora_1st.exe+C0554: 41 8B 50 38 - mov edx,[r8+38]
sora_1st.exe+C0558: 8D 04 1A - lea eax,[rdx+rbx]
sora_1st.exe+C055B: 3B C1 - cmp eax,ecx
sora_1st.exe+C055D: 0F 4C C8 - cmovl ecx,eax
sora_1st.exe+C0560: 85 C9 - test ecx,ecx
// ---------- INJECTING HERE ----------
sora_1st.exe+C0562: 41 0F 48 CD - cmovs ecx,r13d
// ---------- DONE INJECTING ----------
sora_1st.exe+C0566: 41 89 48 38 - mov [r8+38],ecx
sora_1st.exe+C056A: 3B CA - cmp ecx,edx
sora_1st.exe+C056C: 74 05 - je sora_1st.exe+C0573
sora_1st.exe+C056E: 41 C6 40 40 01 - mov byte ptr [r8+40],01
sora_1st.exe+C0573: 48 8B 5C 24 60 - mov rbx,[rsp+60]
sora_1st.exe+C0578: 48 83 C4 20 - add rsp,20
sora_1st.exe+C057C: 41 5D - pop r13
sora_1st.exe+C057E: 41 5C - pop r12
sora_1st.exe+C0580: 5F - pop rdi
sora_1st.exe+C0581: 5E - pop rsi
}
32
"real value"
0
FF8080
4 Bytes
i_base_bbp_addr
38
33
"can use #"
0
FF8080
4 Bytes
i_base_bbp_addr
3C
34
"??"
0
FF8080
4 Bytes
i_base_bbp_addr
40
35
"戰鬥結束後恢復BP / Restore break gauge after battle"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_RESTORE_BP_AFTER_BATTLE,sora_1st.exe,48 8B 88 50 02 00 00 8B) // should be unique
alloc(newmem,$1000,INJECT_RESTORE_BP_AFTER_BATTLE)
label(code)
label(return)
newmem:
code:
mov rcx,[rax+00000250]
//
cmp dword ptr [rcx+38], #500
//
jmp return
INJECT_RESTORE_BP_AFTER_BATTLE:
jmp newmem
nop 2
return:
registersymbol(INJECT_RESTORE_BP_AFTER_BATTLE)
[DISABLE]
INJECT_RESTORE_BP_AFTER_BATTLE:
db 48 8B 88 50 02 00 00
unregistersymbol(INJECT_RESTORE_BP_AFTER_BATTLE)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+35305B
sora_1st.exe+353022: 41 3B BA 50 24 00 00 - cmp edi,[r10+00002450]
sora_1st.exe+353029: 72 B5 - jb sora_1st.exe+352FE0
sora_1st.exe+35302B: 4C 8B 25 E6 05 59 00 - mov r12,[sora_1st.exe+8E3618]
sora_1st.exe+353032: 49 83 BC 24 40 06 00 00 00 - cmp qword ptr [r12+00000640],00
sora_1st.exe+35303B: 74 2E - je sora_1st.exe+35306B
sora_1st.exe+35303D: 49 8B 82 50 2C 00 00 - mov rax,[r10+00002C50]
sora_1st.exe+353044: 48 8B 88 58 02 00 00 - mov rcx,[rax+00000258]
sora_1st.exe+35304B: 8B 41 70 - mov eax,[rcx+70]
sora_1st.exe+35304E: 89 86 50 26 11 00 - mov [rsi+00112650],eax
sora_1st.exe+353054: 49 8B 82 50 2C 00 00 - mov rax,[r10+00002C50]
// ---------- INJECTING HERE ----------
sora_1st.exe+35305B: 48 8B 88 50 02 00 00 - mov rcx,[rax+00000250]
// ---------- DONE INJECTING ----------
sora_1st.exe+353062: 8B 41 38 - mov eax,[rcx+38]
sora_1st.exe+353065: 89 86 54 26 11 00 - mov [rsi+00112654],eax
sora_1st.exe+35306B: 48 8B 15 E6 05 59 00 - mov rdx,[sora_1st.exe+8E3658]
sora_1st.exe+353072: 48 83 C2 08 - add rdx,08
sora_1st.exe+353076: 48 8D 8E 28 D6 1E 00 - lea rcx,[rsi+001ED628]
sora_1st.exe+35307D: 41 B8 00 50 00 00 - mov r8d,00005000
sora_1st.exe+353083: E8 68 8F 3F 00 - call sora_1st.exe+74BFF0
sora_1st.exe+353088: 48 8B 1D 01 D2 58 00 - mov rbx,[sora_1st.exe+8E0290]
sora_1st.exe+35308F: 44 89 B6 48 39 1F 00 - mov [rsi+001F3948],r14d
sora_1st.exe+353096: 0F 57 C0 - xorps xmm0,xmm0
}
36
"原野無限戰技攻擊條倍率 / Field charge gauge multiplier"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_FAST_FIELD_CHARGE,sora_1st.exe,41 03 50 70 B9 C8 00 00 00) // should be unique
alloc(newmem,$1000,INJECT_FAST_FIELD_CHARGE)
label(code)
label(return)
label(vf_field_charge_multi)
newmem:
cmp edx, 0
jle code
vcvtsi2ss xmm15, xmm15, edx
vmovss xmm14, [vf_field_charge_multi]
vmulss xmm14, xmm14, xmm15
vcvtss2si edx, xmm14
code:
add edx,[r8+70]
mov ecx,000000C8
jmp return
align 10 cc
vf_field_charge_multi:
dd (float)3
INJECT_FAST_FIELD_CHARGE:
jmp newmem
nop 4
return:
registersymbol(INJECT_FAST_FIELD_CHARGE)
registersymbol(vf_field_charge_multi)
[DISABLE]
INJECT_FAST_FIELD_CHARGE:
db 41 03 50 70 B9 C8 00 00 00
unregistersymbol(vf_field_charge_multi)
unregistersymbol(INJECT_FAST_FIELD_CHARGE)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+C38B9
sora_1st.exe+C3886: 66 0F 6E C8 - movd xmm1,eax
sora_1st.exe+C388A: 0F 5B C9 - cvtdq2ps xmm1,xmm1
sora_1st.exe+C388D: F3 0F 5E 0D 3F 14 75 00 - divss xmm1,[sora_1st.exe+814CD4]
sora_1st.exe+C3895: 48 8B 05 EC 7E 83 00 - mov rax,[sora_1st.exe+8FB788]
sora_1st.exe+C389C: 48 8B 88 50 2C 00 00 - mov rcx,[rax+00002C50]
sora_1st.exe+C38A3: 4C 8B 81 58 02 00 00 - mov r8,[rcx+00000258]
sora_1st.exe+C38AA: 66 0F 6E 07 - movd xmm0,[rdi]
sora_1st.exe+C38AE: 0F 5B C0 - cvtdq2ps xmm0,xmm0
sora_1st.exe+C38B1: F3 0F 59 C1 - mulss xmm0,xmm1
sora_1st.exe+C38B5: F3 0F 2C D0 - cvttss2si edx,xmm0
// ---------- INJECTING HERE ----------
sora_1st.exe+C38B9: 41 03 50 70 - add edx,[r8+70]
// ---------- DONE INJECTING ----------
sora_1st.exe+C38BD: B9 C8 00 00 00 - mov ecx,000000C8
sora_1st.exe+C38C2: 3B D1 - cmp edx,ecx
sora_1st.exe+C38C4: 0F 4C CA - cmovl ecx,edx
sora_1st.exe+C38C7: 85 C9 - test ecx,ecx
sora_1st.exe+C38C9: 41 0F 48 CD - cmovs ecx,r13d
sora_1st.exe+C38CD: 41 89 48 70 - mov [r8+70],ecx
sora_1st.exe+C38D1: 41 8B 40 7C - mov eax,[r8+7C]
sora_1st.exe+C38D5: 41 89 40 74 - mov [r8+74],eax
sora_1st.exe+C38D9: 41 89 48 78 - mov [r8+78],ecx
sora_1st.exe+C38DD: 49 C7 80 80 00 00 00 CD CC 4C 3E - mov qword ptr [r8+00000080],3E4CCCCD
}
37
"multiplier"
0
C08000
Float
vf_field_charge_multi
38
"原野無限戰技攻擊條 / Field charge: inf charge use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_CHARGE_NO_DEC,sora_1st.exe,83 C0 9C 3B C1) // should be unique
INJECT_CHARGE_NO_DEC+2:
db 0
registersymbol(INJECT_CHARGE_NO_DEC)
[DISABLE]
INJECT_CHARGE_NO_DEC:
db 83 C0 9C 3B C1
unregistersymbol(INJECT_CHARGE_NO_DEC)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+26EB64
sora_1st.exe+26EB2A: 44 0F B6 81 D1 38 11 00 - movzx r8d,byte ptr [rcx+001138D1]
sora_1st.exe+26EB32: 41 FF C0 - inc r8d
sora_1st.exe+26EB35: E8 66 F0 0E 00 - call sora_1st.exe+35DBA0
sora_1st.exe+26EB3A: 48 8B 05 47 CC 68 00 - mov rax,[sora_1st.exe+8FB788]
sora_1st.exe+26EB41: F6 83 20 03 00 00 02 - test byte ptr [rbx+00000320],02
sora_1st.exe+26EB48: 0F 85 24 FF FF FF - jne sora_1st.exe+26EA72
sora_1st.exe+26EB4E: 48 8B 80 50 2C 00 00 - mov rax,[rax+00002C50]
sora_1st.exe+26EB55: B9 C8 00 00 00 - mov ecx,000000C8
sora_1st.exe+26EB5A: 48 8B 90 58 02 00 00 - mov rdx,[rax+00000258]
sora_1st.exe+26EB61: 8B 42 70 - mov eax,[rdx+70]
// ---------- INJECTING HERE ----------
sora_1st.exe+26EB64: 83 C0 9C - add eax,-64
// ---------- DONE INJECTING ----------
sora_1st.exe+26EB67: 3B C1 - cmp eax,ecx
sora_1st.exe+26EB69: 0F 4C C8 - cmovl ecx,eax
sora_1st.exe+26EB6C: 45 33 C0 - xor r8d,r8d
sora_1st.exe+26EB6F: 85 C9 - test ecx,ecx
sora_1st.exe+26EB71: 41 0F 48 C8 - cmovs ecx,r8d
sora_1st.exe+26EB75: 89 4A 70 - mov [rdx+70],ecx
sora_1st.exe+26EB78: 8B 42 7C - mov eax,[rdx+7C]
sora_1st.exe+26EB7B: 89 42 74 - mov [rdx+74],eax
sora_1st.exe+26EB7E: 89 4A 78 - mov [rdx+78],ecx
sora_1st.exe+26EB81: 48 C7 82 80 00 00 00 CD CC 4C 3E - mov qword ptr [rdx+00000080],3E4CCCCD
}
39
"取得擊殺數 / Get kill count"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_KILL_CNT,sora_1st.exe,8B 88 5C 12 01 00) // should be unique
alloc(newmem,$1000,INJECT_GET_KILL_CNT)
label(code)
label(return)
label(i_base_kill_cnt_addr)
newmem:
push r15
lea r15, [rax+1125C]
mov [i_base_kill_cnt_addr], r15
pop r15
code:
mov ecx,[rax+0001125C]
jmp return
align 10 cc
i_base_kill_cnt_addr:
dq 0
INJECT_GET_KILL_CNT:
jmp newmem
nop
return:
registersymbol(INJECT_GET_KILL_CNT)
registersymbol(i_base_kill_cnt_addr)
[DISABLE]
INJECT_GET_KILL_CNT:
db 8B 88 5C 12 01 00
unregistersymbol(i_base_kill_cnt_addr)
unregistersymbol(INJECT_GET_KILL_CNT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+33D4D2
sora_1st.exe+33D4A9: 83 F8 02 - cmp eax,02
sora_1st.exe+33D4AC: 75 11 - jne sora_1st.exe+33D4BF
sora_1st.exe+33D4AE: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
sora_1st.exe+33D4B5: 66 0F 6E C0 - movd xmm0,eax
sora_1st.exe+33D4B9: F3 0F 2C D0 - cvttss2si edx,xmm0
sora_1st.exe+33D4BD: EB 02 - jmp sora_1st.exe+33D4C1
sora_1st.exe+33D4BF: 8B D6 - mov edx,esi
sora_1st.exe+33D4C1: 48 8B 4C 24 30 - mov rcx,[rsp+30]
sora_1st.exe+33D4C6: E8 15 D9 16 00 - call sora_1st.exe+4AADE0
sora_1st.exe+33D4CB: 48 8B 05 9E 61 5A 00 - mov rax,[sora_1st.exe+8E3670]
// ---------- INJECTING HERE ----------
sora_1st.exe+33D4D2: 8B 88 5C 12 01 00 - mov ecx,[rax+0001125C]
// ---------- DONE INJECTING ----------
sora_1st.exe+33D4D8: 8B C1 - mov eax,ecx
sora_1st.exe+33D4DA: C1 E8 1E - shr eax,1E
sora_1st.exe+33D4DD: 83 F8 01 - cmp eax,01
sora_1st.exe+33D4E0: 75 0C - jne sora_1st.exe+33D4EE
sora_1st.exe+33D4E2: 8D 14 8D 00 00 00 00 - lea edx,[rcx*4+00000000]
sora_1st.exe+33D4E9: C1 FA 02 - sar edx,02
sora_1st.exe+33D4EC: EB 18 - jmp sora_1st.exe+33D506
sora_1st.exe+33D4EE: 83 F8 02 - cmp eax,02
sora_1st.exe+33D4F1: 75 11 - jne sora_1st.exe+33D504
sora_1st.exe+33D4F3: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
}
40
"使用：開啟記錄"
8000FF
1
142
"Usage: Open memo menu"
8000FF
1
41
"Kill count"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
0
42
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
4
43
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
8
44
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
C
45
"角色數值檢視器 / Char. stats viewer"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_CHAR_STAT,sora_1st.exe,8B 56 14 48 8B CF) // should be unique
alloc(newmem,$1000,INJECT_GET_CHAR_STAT)
label(code)
label(return)
label(i_base_char_stat_addr)
newmem:
mov [i_base_char_stat_addr], rsi
code:
mov edx,[rsi+14] // current EP
mov rcx,rdi
jmp return
align 10 cc
i_base_char_stat_addr:
dq 0
INJECT_GET_CHAR_STAT:
jmp newmem
nop
return:
registersymbol(INJECT_GET_CHAR_STAT)
registersymbol(i_base_char_stat_addr)
[DISABLE]
INJECT_GET_CHAR_STAT:
db 8B 56 14 48 8B CF
unregistersymbol(i_base_char_stat_addr)
unregistersymbol(INJECT_GET_CHAR_STAT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+4453EF
sora_1st.exe+4453CD: 41 B1 01 - mov r9b,01
sora_1st.exe+4453D0: 41 B8 FE FF FF 7F - mov r8d,7FFFFFFE
sora_1st.exe+4453D6: E8 75 18 01 00 - call sora_1st.exe+456C50
sora_1st.exe+4453DB: 48 8B E8 - mov rbp,rax
sora_1st.exe+4453DE: 48 85 C0 - test rax,rax
sora_1st.exe+4453E1: 75 0C - jne sora_1st.exe+4453EF
sora_1st.exe+4453E3: 48 83 C3 08 - add rbx,08
sora_1st.exe+4453E7: 49 3B DF - cmp rbx,r15
sora_1st.exe+4453EA: 75 D7 - jne sora_1st.exe+4453C3
sora_1st.exe+4453EC: 49 8B ED - mov rbp,r13
// ---------- INJECTING HERE ----------
sora_1st.exe+4453EF: 8B 56 14 - mov edx,[rsi+14]
// ---------- DONE INJECTING ----------
sora_1st.exe+4453F2: 48 8B CF - mov rcx,rdi
sora_1st.exe+4453F5: E8 C6 04 07 00 - call sora_1st.exe+4B58C0
sora_1st.exe+4453FA: 8B 56 18 - mov edx,[rsi+18]
sora_1st.exe+4453FD: 48 8B CD - mov rcx,rbp
sora_1st.exe+445400: E8 BB 04 07 00 - call sora_1st.exe+4B58C0
sora_1st.exe+445405: 8B 46 18 - mov eax,[rsi+18]
sora_1st.exe+445408: 0F 28 C6 - movaps xmm0,xmm6
sora_1st.exe+44540B: 0F 28 CE - movaps xmm1,xmm6
sora_1st.exe+44540E: 39 46 14 - cmp [rsi+14],eax
sora_1st.exe+445411: 75 10 - jne sora_1st.exe+445423
}
46
"ID?"
0
FF8080
4 Bytes
i_base_char_stat_addr
0
47
"Lv"
0
FF8080
4 Bytes
i_base_char_stat_addr
4
48
"XP"
0
FF8080
4 Bytes
i_base_char_stat_addr
8
49
"HP"
0
FF8080
4 Bytes
i_base_char_stat_addr
C
50
"Max HP"
0
FF8080
4 Bytes
i_base_char_stat_addr
10
51
"EP"
0
FF8080
4 Bytes
i_base_char_stat_addr
14
52
"Max EP"
0
FF8080
4 Bytes
i_base_char_stat_addr
18
53
"CP"
0
FF8080
4 Bytes
i_base_char_stat_addr
1C
54
"Max CP"
0
FF8080
4 Bytes
i_base_char_stat_addr
20
55
"STR"
0
FF8080
4 Bytes
i_base_char_stat_addr
24
56
"DEF"
0
FF8080
4 Bytes
i_base_char_stat_addr
28
57
"ATS"
0
FF8080
4 Bytes
i_base_char_stat_addr
2C
58
"ADF"
0
FF8080
4 Bytes
i_base_char_stat_addr
30
59
"SPD"
0
FF8080
4 Bytes
i_base_char_stat_addr
34
60
"AGL"
0
FF8080
4 Bytes
i_base_char_stat_addr
38
61
"DEX"
0
FF8080
4 Bytes
i_base_char_stat_addr
3C
62
"MOV"
0
FF8080
4 Bytes
i_base_char_stat_addr
40
63
"RNG"
0
FF8080
4 Bytes
i_base_char_stat_addr
44
64
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
48
65
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
4C
66
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
50
67
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
54
68
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
58
69
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
5C
70
"Hit %"
0
FF8080
4 Bytes
i_base_char_stat_addr
60
71
"Evade %"
0
FF8080
4 Bytes
i_base_char_stat_addr
64
72
"Mgi Evade %"
0
FF8080
4 Bytes
i_base_char_stat_addr
68
73
"Crit %"
0
FF8080
4 Bytes
i_base_char_stat_addr
6C
74
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
70
75
"取得進行中Rewards / Get on-going reward data / max 50"
Auto Assembler Script
{ Game : ed9.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_ACHIEVEMENT,sora_1st.exe,8B 8B ?? ?? ?? 00 8B C1 C1 E8 1E 83 F8 01) // should be unique
alloc(newmem,$1000,INJECT_GET_ACHIEVEMENT)
alloc(INJECT_GET_ACHIEVEMENTo, 6)
label(code)
label(return i_base_achi_addr)
INJECT_GET_ACHIEVEMENTo:
readmem(INJECT_GET_ACHIEVEMENT, 6)
newmem:
push r15
push r14
push rcx
xor ecx, ecx
mov dword ptr [i_idx], 0
mov ecx, [INJECT_GET_ACHIEVEMENTo+2]
lea r15, [rbx+rcx]
loop1:
mov ecx, [i_idx]
mov r14, i_base_achi_addr
lea r14, [r14+rcx*8]
cmp qword ptr [r14], r15
je endp
cmp qword ptr [r14], 0
je write_it
jmp chk_next
write_it:
mov [r14], r15
jmp endp
db EB 3B 54
db 68 69 73 20 74
db 61 62 6C 65 20 63 6F 6D 65 73 20 66 72 6F 6D 20 68 74
db 74 70 73 3A 2F
db 2F 6F 70 65 6E 63 68 65
db 61 74 74 61 62 6C 65 73
db 2E 63 6F 6D
db 20 2F 20 43 45 20 37 2E 34 2B
chk_next:
inc dword ptr [i_idx]
cmp dword ptr [i_idx], 33
jb loop1
endp:
pop rcx
pop r14
pop r15
code:
// mov ecx,[rbx+00011100]
reassemble(INJECT_GET_ACHIEVEMENT)
jmp return
align 10 cc
i_idx:
dd 0 0
i_base_achi_addr:
dq 0
align 100 0
db 0
align 100 0
db 0
align 100 0
db 0
INJECT_GET_ACHIEVEMENT:
jmp newmem
nop
return:
registersymbol(INJECT_GET_ACHIEVEMENT i_base_achi_addr)
registersymbol(INJECT_GET_ACHIEVEMENTo)
[DISABLE]
INJECT_GET_ACHIEVEMENT:
//db 8B 8B 00 11 01 00
readmem(INJECT_GET_ACHIEVEMENTo, 6)
unregistersymbol(INJECT_GET_ACHIEVEMENT i_base_achi_addr)
dealloc(newmem)
unregistersymbol(INJECT_GET_ACHIEVEMENTo)
dealloc(INJECT_GET_ACHIEVEMENTo)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+239E4
sora_1st.exe+239B4: 3D 00 01 00 00 - cmp eax,00000100
sora_1st.exe+239B9: 72 25 - jb sora_1st.exe+239E0
sora_1st.exe+239BB: 4C 8D 0D 86 89 7D 00 - lea r9,[sora_1st.exe+7FC348]
sora_1st.exe+239C2: 41 B8 5F 02 00 00 - mov r8d,0000025F
sora_1st.exe+239C8: 48 8D 15 81 88 7D 00 - lea rdx,[sora_1st.exe+7FC250]
sora_1st.exe+239CF: B9 03 00 00 00 - mov ecx,00000003
sora_1st.exe+239D4: E8 97 DD 42 00 - call sora_1st.exe+451770
sora_1st.exe+239D9: 44 8B 54 24 78 - mov r10d,[rsp+78]
sora_1st.exe+239DE: EB 04 - jmp sora_1st.exe+239E4
sora_1st.exe+239E0: 48 8D 1C 83 - lea rbx,[rbx+rax*4]
// ---------- INJECTING HERE ----------
sora_1st.exe+239E4: 8B 8B 00 11 01 00 - mov ecx,[rbx+00011100]
// ---------- DONE INJECTING ----------
sora_1st.exe+239EA: 8B C1 - mov eax,ecx
sora_1st.exe+239EC: C1 E8 1E - shr eax,1E
sora_1st.exe+239EF: 83 F8 01 - cmp eax,01
sora_1st.exe+239F2: 75 0C - jne sora_1st.exe+23A00
sora_1st.exe+239F4: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
sora_1st.exe+239FB: C1 F8 02 - sar eax,02
sora_1st.exe+239FE: EB 18 - jmp sora_1st.exe+23A18
sora_1st.exe+23A00: 83 F8 02 - cmp eax,02
sora_1st.exe+23A03: 75 11 - jne sora_1st.exe+23A16
sora_1st.exe+23A05: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
}
76
"#1"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr
0
77
"#2"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+8
0
78
"#3"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+10
0
79
"#4"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+18
0
80
"#5"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+20
0
81
"#6"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+28
0
82
"#7"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+30
0
83
"#8"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+38
0
84
"#9"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+40
0
85
"#10"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+48
0
86
"#11"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+50
0
87
"#12"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+58
0
88
"#13"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+60
0
89
"#14"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+68
0
90
"#15"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+70
0
91
"#16"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+78
0
92
"#17"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+80
0
93
"#18"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+88
0
94
"#19"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+90
0
95
"#20"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+98
0
96
"#21"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+A0
0
97
"#22"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+A8
0
98
"#23"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+B0
0
99
"#24"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+B8
0
100
"#25"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+C0
0
101
"#26"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+C8
0
102
"#27"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+D0
0
103
"#28"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+D8
0
104
"#29"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+E0
0
105
"#30"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+E8
0
106
"#31"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+F0
0
107
"#32"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+F8
0
108
"#33"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+100
0
109
"#34"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+108
0
110
"#35"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+110
0
111
"#36"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+118
0
112
"#37"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+120
0
113
"#38"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+128
0
114
"#39"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+130
0
115
"#40"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+138
0
116
"#41"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+140
0
117
"#42"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+148
0
118
"#43"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+150
0
119
"#44"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+158
0
120
"#45"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+160
0
121
"#46"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+168
0
122
"#47"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+170
0
123
"#48"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+178
0
124
"#49"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+180
0
125
"#50"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+188
0
126
"空之軌跡 the 1st / https://opencheattables.com"
00B300
1