0
"Toggle Compact View"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not toggleCompactView then
function toggleCompactView(sender, forceEnable)
local isCompactMode = not (compactViewMenuItem.Caption == 'Compact View Mode')
if forceEnable ~= nil then
isCompactMode = not forceEnable
end
synchronize(function()
compactViewMenuItem.Caption = isCompactMode and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = isCompactMode
getMainForm().Panel4.Visible = isCompactMode
getMainForm().Panel5.Visible = isCompactMode
end)
end
end
if not createCompactViewMenu then
function createCompactViewMenu()
if isCompactMenuCreated then return end
synchronize(function()
local mainMenu = getMainForm().Menu.Items
compactViewMenuItem = createMenuItem(mainMenu)
compactViewMenuItem.Caption = 'Compact View Mode'
compactViewMenuItem.OnClick = toggleCompactView
mainMenu.add(compactViewMenuItem)
end)
isCompactMenuCreated = true
end
end
createCompactViewMenu()
toggleCompactView(nil, true)
[DISABLE]
{$lua}
if toggleCompactView then
toggleCompactView(nil, false)
end
2
"Toggle scripts"
4080FF
Auto Assembler Script
[ENABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local enableBattleScripts = {
0, -- "Toggle Compact View"
1, -- "啟用 / Enable"
15, -- "瀏覽道具後設定個數 / Browse & set item amount"
167, -- "單一任務資料檢視 / Quest viewer"
18, -- "戰鬥：傷害控制 / Battle: damage control"
3, -- "取得Mira和耀晶石 / Get Mira"
30, -- "戰鬥中道具無限 / Battle: inf item use"
31, -- "戰鬥：快速破防 / Battle: fast break gauge"
3481, -- "瀏覽食譜時自動設定食材量 / Auto set ingredient amt. when browsing recipes"
3487, -- "支援經驗值倍率 / Support XP multiplier"
3491, -- "快速超能驅動 / Fast overdrive (OD)"
3492, -- "超能驅動值不減 / inf. OD gauge"
35, -- "戰鬥結束後恢復BP / Restore break gauge after battle"
36, -- "原野無限戰技攻擊條倍率 / Field charge gauge multiplier"
38, -- "原野無限戰技攻擊條 / Field charge: inf charge use"
130, -- "戰鬥：擊暈倍率 / Battle: Stun multiplier"
27, -- "戰鬥：試著HP不變0 / Battle: player HP: try to keep non-zero"
28, -- "戰鬥：EP使用後回滿 / Battle: full EP after use"
29, -- "戰鬥：CP使用後回滿 / Battle: full CP after use"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(enableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and not memRec.Active then
memRec.Active = true
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
[DISABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local disableBattleScripts = {
29, -- "戰鬥：CP使用後回滿 / Battle: full CP after use"
28, -- "戰鬥：EP使用後回滿 / Battle: full EP after use"
27, -- "戰鬥：試著HP不變0 / Battle: player HP: try to keep non-zero"
25, -- "敵方HP選項 / Enemy HP option"
24, -- "被擊中後回CP?"
23, -- "被擊中後回EP?"
19, -- "一般設定 / Global setting"
159, -- "產生任務狀態列表 / Generate quests status"
151, -- "if item amount >="
150, -- "如果數量 >="
134, -- "設定數量為："
133, -- "道具目前數量必須 >="
130, -- "戰鬥：擊暈倍率 / Battle: Stun multiplier"
75, -- "取得進行中Rewards / Get on-going reward data / max 50"
45, -- "角色數值檢視器 / Char. stats viewer"
39, -- "取得擊殺數 / Get kill count"
38, -- "原野無限戰技攻擊條 / Field charge: inf charge use"
36, -- "原野無限戰技攻擊條倍率 / Field charge gauge multiplier"
35, -- "戰鬥結束後恢復BP / Restore break gauge after battle"
3492, -- "超能驅動值不減 / inf. OD gauge"
3491, -- "快速超能驅動 / Fast overdrive (OD)"
3487, -- "支援經驗值倍率 / Support XP multiplier"
3481, -- "瀏覽食譜時自動設定食材量 / Auto set ingredient amt. when browsing recipes"
31, -- "戰鬥：快速破防 / Battle: fast break gauge"
30, -- "戰鬥中道具無限 / Battle: inf item use"
3, -- "取得Mira和耀晶石 / Get Mira"
18, -- "戰鬥：傷害控制 / Battle: damage control"
167, -- "單一任務資料檢視 / Quest viewer"
156, -- "取得全部任務進度資料 / Get all quests progress"
15, -- "瀏覽道具後設定個數 / Browse & set item amount"
126, -- "空之軌跡 the 1st / https://opencheattables.com"
1, -- "啟用 / Enable"
0, -- "Toggle Compact View"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(disableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and memRec.Active then
memRec.Active = false
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
-- Comments:
-- ID: 0, Description: "Toggle Compact View", Depth: 0
-- ID: 1, Description: "啟用 / Enable", Depth: 0
-- ID: 3, Description: "取得Mira和耀晶石 / Get Mira", Depth: 1
-- ID: 15, Description: "瀏覽道具後設定個數 / Browse & set item amount", Depth: 1
-- ID: 133, Description: "道具目前數量必須 >=", Depth: 2
-- ID: 134, Description: "設定數量為：", Depth: 2
-- ID: 150, Description: "如果數量 >=", Depth: 2
-- ID: 151, Description: "if item amount >=", Depth: 2
-- ID: 18, Description: "戰鬥：傷害控制 / Battle: damage control", Depth: 1
-- ID: 19, Description: "一般設定 / Global setting", Depth: 2
-- ID: 23, Description: "被擊中後回EP?", Depth: 2
-- ID: 24, Description: "被擊中後回CP?", Depth: 2
-- ID: 25, Description: "敵方HP選項 / Enemy HP option", Depth: 2
-- ID: 27, Description: "戰鬥：試著HP不變0 / Battle: player HP: try to keep non-zero", Depth: 2
-- ID: 28, Description: "戰鬥：EP使用後回滿 / Battle: full EP after use", Depth: 2
-- ID: 29, Description: "戰鬥：CP使用後回滿 / Battle: full CP after use", Depth: 2
-- ID: 130, Description: "戰鬥：擊暈倍率 / Battle: Stun multiplier", Depth: 2
-- ID: 30, Description: "戰鬥中道具無限 / Battle: inf item use", Depth: 1
-- ID: 31, Description: "戰鬥：快速破防 / Battle: fast break gauge", Depth: 1
-- ID: 35, Description: "戰鬥結束後恢復BP / Restore break gauge after battle", Depth: 1
-- ID: 3487, Description: "支援經驗值倍率 / Support XP multiplier", Depth: 1
-- ID: 3491, Description: "快速超能驅動 / Fast overdrive (OD)", Depth: 1
-- ID: 3492, Description: "超能驅動值不減 / inf. OD gauge", Depth: 1
-- ID: 36, Description: "原野無限戰技攻擊條倍率 / Field charge gauge multiplier", Depth: 1
-- ID: 38, Description: "原野無限戰技攻擊條 / Field charge: inf charge use", Depth: 1
-- ID: 39, Description: "取得擊殺數 / Get kill count", Depth: 1
-- ID: 45, Description: "角色數值檢視器 / Char. stats viewer", Depth: 1
-- ID: 75, Description: "取得進行中Rewards / Get on-going reward data / max 50", Depth: 1
-- ID: 3481, Description: "瀏覽食譜時自動設定食材量 / Auto set ingredient amt. when browsing recipes", Depth: 1
-- ID: 167, Description: "單一任務資料檢視 / Quest viewer", Depth: 1
-- ID: 156, Description: "取得全部任務進度資料 / Get all quests progress", Depth: 1
-- ID: 159, Description: "產生任務狀態列表 / Generate quests status", Depth: 2
-- ID: 126, Description: "空之軌跡 the 1st / https://opencheattables.com", Depth: 0
1
"啟用 / Enable"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if memrec then print(memrec.Description) end
-- Clear lua engine log & close lua engine
if not closeLuaEngine2 then
function closeLuaEngine2()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine2')
if not closeLuaEngine then
function closeLuaEngine()
synchronize(function()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine')
synchronize(function()
getLuaEngine().MenuItem5.doClick()
AddressList.Header.OnSectionClick = nil
end)
closeLuaEngine2()
if _kuro_2_customInt == nil then
local p_proc = process
registerCustomTypeAutoAssembler([[
alloc(TypeName,256)
alloc(ByteSize,8)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(UsesFloat,1)
TypeName:
db 'Kueo2 integer',0
ByteSize:
dd 4
UsesFloat:
db 0
ConvertRoutine:
//at this point ecx contains the address where the bytes are stored
//return with rax/eax
xor rax,rax
mov eax, dword ptr [rcx]
and eax, 3FFFFFFF
ret
ConvertBackRoutine:
//at this point edx contains the address to write the value to
//and ecx contains the value
push rax
xor rax, rax
mov eax, ecx
or eax, 40000000
mov dword ptr [rdx], eax
pop rax
ret
]])
_kuro_2_customInt = true
process = p_proc
autoAssemble(string.format([[
unregistersymbol($process)
define($process, "%s")
registersymbol($process)
]], process))
closeLuaEngine2()
end
local processName = "sora_1st.exe"
local pid = getProcessIDFromProcessName(processName)
if pid ~= nil and pid > 0 then
-- 取得目前已經附加的 PID
local currentPid = getOpenedProcessID() or 0
if currentPid ~= pid then
-- 目前沒附加，或附加到別的 process → 執行 attach
openProcess(processName)
print("Attached to: " .. processName)
else
-- 已經附加在正確的 process → 不重複 attach
print("Already attached to: " .. processName)
end
end
closeLuaEngine()
[DISABLE]
{$lua}
if syntaxcheck then return end
closeLuaEngine2()
3
"取得Mira和耀晶石 / Get Mira"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://openchetatables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_MIRA,sora_1st.exe,8B 92 ?? ?? ?? 00 E8 ?? ?? ?? ?? 48 8B ?? E8) // should be unique
alloc(newmem,$1000,INJECT_GET_MIRA)
alloc(INJECT_GET_MIRAo, 6)
label(code)
label(return)
label(i_base_mira_addr i_base_mira_offset)
INJECT_GET_MIRAo:
readmem(INJECT_GET_MIRA, 6)
newmem:
push r15
xor r15, r15
db 41 bf //00 39 1f 00
readmem(INJECT_GET_MIRA+2, 4)
mov [i_base_mira_addr], rdx
mov [i_base_mira_offset], r15
pop r15
code:
reassemble(INJECT_GET_MIRA)
//mov edx,[rdx+001F3900]
jmp return
align 10 cc
i_base_mira_addr:
dq 0
i_base_mira_offset:
dq 0
INJECT_GET_MIRA:
jmp newmem
nop
return:
registersymbol(INJECT_GET_MIRA)
registersymbol(i_base_mira_addr i_base_mira_offset)
registersymbol(INJECT_GET_MIRAo)
[DISABLE]
INJECT_GET_MIRA:
//db 8B 92 00 39 1F 00
readmem(INJECT_GET_MIRAo, 6)
unregistersymbol(i_base_mira_addr i_base_mira_offset)
unregistersymbol(INJECT_GET_MIRA)
dealloc(newmem)
unregistersymbol(INJECT_GET_MIRAo)
dealloc(INJECT_GET_MIRAo)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+1AED13
sora_1st.exe+1AECED: 41 B8 FE FF FF 7F - mov r8d,7FFFFFFE
sora_1st.exe+1AECF3: E8 08 E3 29 00 - call sora_1st.exe+44D000
sora_1st.exe+1AECF8: 48 85 C0 - test rax,rax
sora_1st.exe+1AECFB: 75 0C - jne sora_1st.exe+1AED09
sora_1st.exe+1AECFD: 48 83 C3 08 - add rbx,08
sora_1st.exe+1AED01: 48 3B DE - cmp rbx,rsi
sora_1st.exe+1AED04: 75 DA - jne sora_1st.exe+1AECE0
sora_1st.exe+1AED06: 49 8B C4 - mov rax,r12
sora_1st.exe+1AED09: 48 8B 15 58 49 73 00 - mov rdx,[sora_1st.exe+8E3668]
sora_1st.exe+1AED10: 48 8B C8 - mov rcx,rax
// ---------- INJECTING HERE ----------
sora_1st.exe+1AED13: 8B 92 00 39 1F 00 - mov edx,[rdx+001F3900]
// ---------- DONE INJECTING ----------
sora_1st.exe+1AED19: E8 C2 C0 2F 00 - call sora_1st.exe+4AADE0
sora_1st.exe+1AED1E: 48 8B CF - mov rcx,rdi
sora_1st.exe+1AED21: E8 0A 13 00 00 - call sora_1st.exe+1B0030
sora_1st.exe+1AED26: 44 88 A7 A8 01 00 00 - mov [rdi+000001A8],r12b
sora_1st.exe+1AED2D: 48 8B 05 3C 49 73 00 - mov rax,[sora_1st.exe+8E3670]
sora_1st.exe+1AED34: F6 80 01 01 00 00 40 - test byte ptr [rax+00000101],40
sora_1st.exe+1AED3B: 0F 85 D1 00 00 00 - jne sora_1st.exe+1AEE12
sora_1st.exe+1AED41: 48 8B 05 60 15 73 00 - mov rax,[sora_1st.exe+8E02A8]
sora_1st.exe+1AED48: 44 38 A0 24 2D 00 00 - cmp [rax+00002D24],r12b
sora_1st.exe+1AED4F: 0F 85 BD 00 00 00 - jne sora_1st.exe+1AEE12
}
4
"地 / Earth"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-20
5
"水 / Water"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-1C
6
"火 / Fire"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-18
7
"風 / Wind"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-14
8
"時 / Time"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-10
9
"空 / Space"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-C
10
"幻 / Mirage"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-8
11
"耀晶石塊 / Exchange"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-4
12
"Mira"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]
13
"??"
0
FF8080
4 Bytes
i_base_mira_addr
1F3904
14
"遊戲時間 / Time"
0
FF8080
Double
i_base_mira_addr
[i_base_mira_offset]+8
15
"瀏覽道具後設定個數 / Browse & set item amount"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
Note:
quartz: RBX = E74 - 1100
}
[ENABLE]
aobscanmodule(INJECT_BROWSE_ITEM_N_SET,sora_1st.exe,0F B7 94 98 ?? ?? ?? ?? 85 D2 75) // should be unique
alloc(newmem,$1000,INJECT_BROWSE_ITEM_N_SET)
alloc(INJECT_BROWSE_ITEM_N_SETo, 8)
label(code)
label(return)
label(iw_min_threshold iw_set_item_cnt_to i_item_addr_offset is_get_all_quartz is_get_all_accessory iw_min_threshold_100 iw_set_item_cnt_to_100)
INJECT_BROWSE_ITEM_N_SETo:
readmem(INJECT_BROWSE_ITEM_N_SET, 8)
newmem:
cmp qword ptr [i_item_addr_offset], 0
jne next1
push r15
xor r15, r15
db 41 bf
readmem(INJECT_BROWSE_ITEM_N_SET+4, 4)
mov [i_item_addr_offset], r15
pop r15
next1:
push r15
push r14
mov r14, [i_item_addr_offset]
lea r15, [rax+rbx*4]
lea r15, [r15+r14]
{
// rbx check
mov r14, 21445A283C8
cmp r15, r14
jne @F
nop
}
@@:
// check fill quartz
cmp dword ptr [is_get_all_quartz], 1 // is force all quartz?
jne next_accessory
mov r14, E74
cmp rbx, r14
jb next_accessory
mov r14, 1100
cmp rbx, r14
ja next_normal_100 // accessory high watermark = 71D, so ignore all
mov r14w, [iw_set_item_cnt_to]
mov [r15], r14w
jmp endp
next_accessory:
// check fill quartz
cmp dword ptr [is_get_all_accessory], 1 // is force all accessory?
jne next_normal_100
mov r14, 640
cmp rbx, r14
jb next_normal_100
mov r14, 71D
cmp rbx, r14
ja next_normal_100
mov r14w, [iw_set_item_cnt_to]
mov [r15], r14w
jmp endp
next_normal_100:
mov r14w, [r15]
cmp r14w, [iw_min_threshold_100]
jb next_normal
cmp r14w, [iw_set_item_cnt_to_100]
jae endp
mov r14w, [iw_set_item_cnt_to_100]
mov [r15], r14w
jmp endp
next_normal:
mov r14w, [r15]
cmp r14w, [iw_min_threshold]
jb endp
cmp r14w, [iw_set_item_cnt_to]
jae endp
mov r14w, [iw_set_item_cnt_to]
mov [r15], r14w
endp:
pop r14
pop r15
code:
reassemble(INJECT_BROWSE_ITEM_N_SET)
//movzx edx,word ptr [rax+rbx*4+00116724]
jmp return
align 10 cc
iw_min_threshold:
dw 2
iw_set_item_cnt_to:
dw 46
iw_min_threshold_100:
dw 64
iw_set_item_cnt_to_100:
dw #700
i_item_addr_offset:
dq 0
is_get_all_quartz:
dd 0
is_get_all_accessory:
dd 0
INJECT_BROWSE_ITEM_N_SET:
jmp newmem
nop 3
return:
registersymbol(INJECT_BROWSE_ITEM_N_SET)
registersymbol(INJECT_BROWSE_ITEM_N_SETo)
registersymbol(iw_min_threshold iw_set_item_cnt_to i_item_addr_offset is_get_all_quartz is_get_all_accessory iw_min_threshold_100 iw_set_item_cnt_to_100)
[DISABLE]
INJECT_BROWSE_ITEM_N_SET:
//db 0F B7 94 98 24 67 11 00
readmem(INJECT_BROWSE_ITEM_N_SETo, 8)
unregistersymbol(iw_min_threshold iw_set_item_cnt_to i_item_addr_offset is_get_all_quartz is_get_all_accessory iw_min_threshold_100 iw_set_item_cnt_to_100)
unregistersymbol(INJECT_BROWSE_ITEM_N_SET)
dealloc(newmem)
unregistersymbol(INJECT_BROWSE_ITEM_N_SETo)
dealloc(INJECT_BROWSE_ITEM_N_SETo)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+131D54
sora_1st.exe+131D29: E8 A2 61 31 00 - call sora_1st.exe+447ED0
sora_1st.exe+131D2E: EB 30 - jmp sora_1st.exe+131D60
sora_1st.exe+131D30: 8D 83 CA FE FF FF - lea eax,[rbx-00000136]
sora_1st.exe+131D36: 83 F8 07 - cmp eax,07
sora_1st.exe+131D39: 77 12 - ja sora_1st.exe+131D4D
sora_1st.exe+131D3B: 8B C8 - mov ecx,eax
sora_1st.exe+131D3D: 48 8B 05 24 19 7B 00 - mov rax,[sora_1st.exe+8E3668]
sora_1st.exe+131D44: 8B 94 88 E0 38 1F 00 - mov edx,[rax+rcx*4+001F38E0]
sora_1st.exe+131D4B: EB 0F - jmp sora_1st.exe+131D5C
sora_1st.exe+131D4D: 48 8B 05 14 19 7B 00 - mov rax,[sora_1st.exe+8E3668]
// ---------- INJECTING HERE ----------
sora_1st.exe+131D54: 0F B7 94 98 24 67 11 00 - movzx edx,word ptr [rax+rbx*4+00116724]
// ---------- DONE INJECTING ----------
sora_1st.exe+131D5C: 85 D2 - test edx,edx
sora_1st.exe+131D5E: 75 15 - jne sora_1st.exe+131D75
sora_1st.exe+131D60: 4C 8B C5 - mov r8,rbp
sora_1st.exe+131D63: BA FF FF FF FF - mov edx,FFFFFFFF
sora_1st.exe+131D68: E8 E3 68 18 00 - call sora_1st.exe+2B8650
sora_1st.exe+131D6D: 85 C0 - test eax,eax
sora_1st.exe+131D6F: 0F 84 38 01 00 00 - je sora_1st.exe+131EAD
sora_1st.exe+131D75: 48 8B 0D 1C 19 7B 00 - mov rcx,[sora_1st.exe+8E3698]
sora_1st.exe+131D7C: 48 85 C9 - test rcx,rcx
sora_1st.exe+131D7F: 74 10 - je sora_1st.exe+131D91
}
133
"道具目前數量必須 >="
0
C08000
2 Bytes
iw_min_threshold
16
"Avail. item amount must >="
0
C08000
2 Bytes
iw_min_threshold
134
"設定數量為："
0
C08000
2 Bytes
iw_set_item_cnt_to
17
"Set amount to"
0
C08000
2 Bytes
iw_set_item_cnt_to
150
"如果數量 >="
0
C08000
2 Bytes
iw_min_threshold_100
153
"則設定數量為："
0
C08000
2 Bytes
iw_set_item_cnt_to_100
151
"if item amount >="
0
C08000
2 Bytes
iw_min_threshold_100
152
"then set to:"
0
C08000
2 Bytes
iw_set_item_cnt_to_100
146
"強制結晶迴路? / Force quartz?"
0:No
1:Yes
0
C08000
4 Bytes
is_get_all_quartz
148
"強制配件? / force all accessories?"
0:No
1:Yes
0
C08000
4 Bytes
is_get_all_accessory
18
"戰鬥：傷害控制 / Battle: damage control"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_DAMAGE_CTRL,sora_1st.exe,89 56 0C 48 8B 74 24 38) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_DAMAGE_CTRL)
label(code)
label(return)
label(i_play_char_id vf_min_player_hp_ratio is_enemy_HP_option is_full_EP is_full_CP i_enemy_HP_limit vf_damage_multi)
newmem:
//push r15
//mov r15d, [i_play_char_id]
//cmp [rsi], r15d
//pop r15
//ja to_enemy
cmp dword ptr [rsi+44], 0 // RNG
je to_enemy
cmp dword ptr [rsi+78], 0 // STUN
jne to_enemy
to_player:
push r15
cmp dword ptr [is_full_EP], 1
jne @F
mov r15d, [rsi+18]
mov [rsi+14], r15d
@@:
cmp dword ptr [is_full_CP], 1
jne @F
mov r15d, [rsi+20]
mov [rsi+1C], r15d
@@:
// HP calc
mov r15d, [rsi+10]
vcvtsi2ss xmm15, xmm15, r15d
vmovss xmm14, [vf_min_player_hp_ratio]
vmulss xmm13, xmm14, xmm15
vcvtss2si r15d, xmm13
cmp edx, r15d
cmovb edx, r15d
pop r15
jmp code
to_enemy:
cmp dword ptr [is_enemy_HP_option], 0
je code
cmp dword ptr [is_enemy_HP_option], 1
je to_1HP
cmp dword ptr [is_enemy_HP_option], 2
je to_1HK
cmp dword ptr [is_enemy_HP_option], 3
je to_set_limit
cmp dword ptr [is_enemy_HP_option], 4
je to_damage_multi
cmp dword ptr [is_enemy_HP_option], 5
je to_1000_hp
jmp code
to_1HK:
mov edx, 0
jmp code
to_1HP:
cmp edx, 1
jbe code
mov edx, 1
jmp code
to_set_limit:
cmp edx, [i_enemy_HP_limit]
jbe code
mov edx, [i_enemy_HP_limit]
jmp code
to_damage_multi:
cmp r14d, 0
jge code
vcvtsi2ss xmm15, xmm15, r14d
vmovss xmm14, [vf_damage_multi]
vmulss xmm15, xmm14, xmm15
vcvtss2si r14d, xmm15
mov ecx,[rsi+0C]
mov edx,[rsi+10]
add ecx,r14d
cmp ecx,edx
cmovl edx,ecx
test edx,edx
cmovs edx,ecx
jmp code
to_1000_hp:
cmp edx, #800
jbe code
mov edx, #800
//jmp code
code:
mov [rsi+0C],edx
mov rsi,[rsp+38]
jmp return
align 10 cc
i_play_char_id:
dd 7
vf_min_player_hp_ratio:
dd (float)0.25
is_enemy_HP_option:
dd 0
i_enemy_HP_limit:
dd #40000
is_full_EP:
dd 1
is_full_CP:
dd 1
vf_damage_multi:
dd (float)3.3333333
INJECT_BATTLE_DAMAGE_CTRL:
jmp newmem
nop 3
return:
registersymbol(i_play_char_id vf_min_player_hp_ratio is_enemy_HP_option is_full_EP is_full_CP i_enemy_HP_limit vf_damage_multi)
registersymbol(INJECT_BATTLE_DAMAGE_CTRL)
[DISABLE]
INJECT_BATTLE_DAMAGE_CTRL:
db 89 56 0C 48 8B 74 24 38
unregistersymbol(i_play_char_id vf_min_player_hp_ratio is_enemy_HP_option is_full_EP is_full_CP i_enemy_HP_limit vf_damage_multi)
unregistersymbol(INJECT_BATTLE_DAMAGE_CTRL)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+DBB80
sora_1st.exe+DBB68: 41 5E - pop r14
sora_1st.exe+DBB6A: C3 - ret
sora_1st.exe+DBB6B: 8B 4E 0C - mov ecx,[rsi+0C]
sora_1st.exe+DBB6E: 8B 56 10 - mov edx,[rsi+10]
sora_1st.exe+DBB71: 41 03 CE - add ecx,r14d
sora_1st.exe+DBB74: 3B CA - cmp ecx,edx
sora_1st.exe+DBB76: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+DBB79: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB7B: 85 D2 - test edx,edx
sora_1st.exe+DBB7D: 0F 48 D1 - cmovs edx,ecx
// ---------- INJECTING HERE ----------
sora_1st.exe+DBB80: 89 56 0C - mov [rsi+0C],edx
// ---------- DONE INJECTING ----------
sora_1st.exe+DBB83: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBB88: 48 83 C4 20 - add rsp,20
sora_1st.exe+DBB8C: 41 5E - pop r14
sora_1st.exe+DBB8E: C3 - ret
sora_1st.exe+DBB8F: 8B 46 18 - mov eax,[rsi+18]
sora_1st.exe+DBB92: 44 3B F0 - cmp r14d,eax
sora_1st.exe+DBB95: 41 0F 4C C6 - cmovl eax,r14d
sora_1st.exe+DBB99: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB9B: 85 C0 - test eax,eax
sora_1st.exe+DBB9D: 0F 48 C1 - cmovs eax,ecx
}
19
"一般設定 / Global setting"
1
22
"最小玩家HP保持比率"
0
C08000
Float
vf_min_player_hp_ratio
135
"Min player HP ratio after hit"
0
C08000
Float
vf_min_player_hp_ratio
23
"被擊中後回EP?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_EP
136
"Full EP after get hit?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_EP
24
"被擊中後回CP?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_CP
137
"Full CP after get hit?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_CP
25
"敵方HP選項 / Enemy HP option"
0:無 / None
1:1 HP
2:一擊 / 1 hit kill
3:設為下列上限 / set limit as below
4:下列傷害倍率 / damage multiplier as below
5:hit to HP 800
0
C08000
4 Bytes
is_enemy_HP_option
140
"※警告：可能影響友方NPC"
8000FF
1
141
"※友方NPC可能因此中一招即亡"
8000FF
1
26
"Warning: may affect friendly NPCs"
8000FF
1
132
"friendly NPC may be killed when battle start"
8000FF
1
127
"敵方HP上限"
0
C08000
4 Bytes
i_enemy_HP_limit
128
"傷害倍率"
0
C08000
Float
vf_damage_multi
138
"Enemy HP limit:"
0
C08000
4 Bytes
i_enemy_HP_limit
139
"damage multiplier"
0
C08000
Float
vf_damage_multi
27
"戰鬥：試著HP不變0 / Battle: player HP: try to keep non-zero"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_HP_NO_0,sora_1st.exe,03 D0 41 39 50 0C 7F ?? 48 8D 15 ?? ?? ?? ?? 48 8B CB) // should be unique
alloc(newmem,$1000,INJECT_HP_NO_0)
label(code)
label(return)
newmem:
code:
add edx,eax
cmp [r8+0C],edx
jg endp
pushfq
cmp edx, 0
jl next1
mov [r8+0C], edx
inc dword ptr [r8+0C]
jmp end_inner
next1:
push r15
mov r15d, [r8+10]
vcvtsi2ss xmm15, xmm15, r15d
vmovss xmm14, [vf_min_player_hp_ratio]
vmulss xmm14, xmm14, xmm15
vcvtss2si r15d, xmm14
mov [r8+0C], r15d
pop r15
end_inner:
popfq
cmp [r8+0C], edx
endp:
jmp return
align 10 cc
INJECT_HP_NO_0:
jmp newmem
nop
return:
registersymbol(INJECT_HP_NO_0)
[DISABLE]
INJECT_HP_NO_0:
db 03 D0 41 39 50 0C
unregistersymbol(INJECT_HP_NO_0)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+1CF283
sora_1st.exe+1CF265: 74 44 - je sora_1st.exe+1CF2AB
sora_1st.exe+1CF267: 4D 8B 00 - mov r8,[r8]
sora_1st.exe+1CF26A: 41 8B 40 10 - mov eax,[r8+10]
sora_1st.exe+1CF26E: 8D 0C 80 - lea ecx,[rax+rax*4]
sora_1st.exe+1CF271: B8 1F 85 EB 51 - mov eax,51EB851F
sora_1st.exe+1CF276: C1 E1 02 - shl ecx,02
sora_1st.exe+1CF279: F7 E9 - imul ecx
sora_1st.exe+1CF27B: C1 FA 05 - sar edx,05
sora_1st.exe+1CF27E: 8B C2 - mov eax,edx
sora_1st.exe+1CF280: C1 E8 1F - shr eax,1F
// ---------- INJECTING HERE ----------
sora_1st.exe+1CF283: 03 D0 - add edx,eax
// ---------- DONE INJECTING ----------
sora_1st.exe+1CF285: 41 39 50 0C - cmp [r8+0C],edx
sora_1st.exe+1CF289: 7F 20 - jg sora_1st.exe+1CF2AB
sora_1st.exe+1CF28B: 48 8D 15 26 C8 60 00 - lea rdx,[sora_1st.exe+7DBAB8]
sora_1st.exe+1CF292: 48 8B CB - mov rcx,rbx
sora_1st.exe+1CF295: E8 B6 90 FF FF - call sora_1st.exe+1C8350
sora_1st.exe+1CF29A: 84 C0 - test al,al
sora_1st.exe+1CF29C: 74 0D - je sora_1st.exe+1CF2AB
sora_1st.exe+1CF29E: 89 7C 24 28 - mov [rsp+28],edi
sora_1st.exe+1CF2A2: 4C 8D 05 0F C8 60 00 - lea r8,[sora_1st.exe+7DBAB8]
sora_1st.exe+1CF2A9: EB 0D - jmp sora_1st.exe+1CF2B8
}
28
"戰鬥：EP使用後回滿 / Battle: full EP after use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_EP,sora_1st.exe,8B 4E 14 8B 56 18) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_EP)
label(code)
label(return)
newmem:
cmp dword ptr [rsi+44], 0 // RNG
je code
cmp dword ptr [rsi+78], 0 // RNG
jne code
mov edx, [rsi+18]
mov [rsi+14], edx
xor r14d, r14d
code:
mov ecx,[rsi+14]
mov edx,[rsi+18]
jmp return
INJECT_BATTLE_INF_EP:
jmp newmem
nop
return:
registersymbol(INJECT_BATTLE_INF_EP)
[DISABLE]
INJECT_BATTLE_INF_EP:
db 8B 4E 14 8B 56 18
unregistersymbol(INJECT_BATTLE_INF_EP)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+DBBAF
sora_1st.exe+DBB92: 44 3B F0 - cmp r14d,eax
sora_1st.exe+DBB95: 41 0F 4C C6 - cmovl eax,r14d
sora_1st.exe+DBB99: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB9B: 85 C0 - test eax,eax
sora_1st.exe+DBB9D: 0F 48 C1 - cmovs eax,ecx
sora_1st.exe+DBBA0: 89 46 14 - mov [rsi+14],eax
sora_1st.exe+DBBA3: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBBA8: 48 83 C4 20 - add rsp,20
sora_1st.exe+DBBAC: 41 5E - pop r14
sora_1st.exe+DBBAE: C3 - ret
// ---------- INJECTING HERE ----------
sora_1st.exe+DBBAF: 8B 4E 14 - mov ecx,[rsi+14]
// ---------- DONE INJECTING ----------
sora_1st.exe+DBBB2: 8B 56 18 - mov edx,[rsi+18]
sora_1st.exe+DBBB5: 41 03 CE - add ecx,r14d
sora_1st.exe+DBBB8: 3B CA - cmp ecx,edx
sora_1st.exe+DBBBA: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+DBBBD: 33 C9 - xor ecx,ecx
sora_1st.exe+DBBBF: 85 D2 - test edx,edx
sora_1st.exe+DBBC1: 0F 48 D1 - cmovs edx,ecx
sora_1st.exe+DBBC4: 89 56 14 - mov [rsi+14],edx
sora_1st.exe+DBBC7: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBBCC: 48 83 C4 20 - add rsp,20
}
29
"戰鬥：CP使用後回滿 / Battle: full CP after use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://openchetatables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_CP,sora_1st.exe,8B 4E 1C 8B 56 20) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_CP)
label(code)
label(return)
newmem:
cmp dword ptr [rsi+44], 0 // RNG
je code
cmp dword ptr [rsi+78], 0
jne code
mov edx, [rsi+20]
mov [rsi+1C], edx
xor r14d, r14d
code:
mov ecx,[rsi+1C]
mov edx,[rsi+20]
jmp return
INJECT_BATTLE_INF_CP:
jmp newmem
nop
return:
registersymbol(INJECT_BATTLE_INF_CP)
[DISABLE]
INJECT_BATTLE_INF_CP:
db 8B 4E 1C 8B 56 20
unregistersymbol(INJECT_BATTLE_INF_CP)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+DBBF3
sora_1st.exe+DBBD6: 44 3B F0 - cmp r14d,eax
sora_1st.exe+DBBD9: 41 0F 4C C6 - cmovl eax,r14d
sora_1st.exe+DBBDD: 33 C9 - xor ecx,ecx
sora_1st.exe+DBBDF: 85 C0 - test eax,eax
sora_1st.exe+DBBE1: 0F 48 C1 - cmovs eax,ecx
sora_1st.exe+DBBE4: 89 46 1C - mov [rsi+1C],eax
sora_1st.exe+DBBE7: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBBEC: 48 83 C4 20 - add rsp,20
sora_1st.exe+DBBF0: 41 5E - pop r14
sora_1st.exe+DBBF2: C3 - ret
// ---------- INJECTING HERE ----------
sora_1st.exe+DBBF3: 8B 4E 1C - mov ecx,[rsi+1C]
// ---------- DONE INJECTING ----------
sora_1st.exe+DBBF6: 8B 56 20 - mov edx,[rsi+20]
sora_1st.exe+DBBF9: 41 03 CE - add ecx,r14d
sora_1st.exe+DBBFC: 3B CA - cmp ecx,edx
sora_1st.exe+DBBFE: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+DBC01: 33 C9 - xor ecx,ecx
sora_1st.exe+DBC03: 85 D2 - test edx,edx
sora_1st.exe+DBC05: 0F 48 D1 - cmovs edx,ecx
sora_1st.exe+DBC08: 89 56 1C - mov [rsi+1C],edx
sora_1st.exe+DBC0B: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBC10: 48 83 C4 20 - add rsp,20
}
130
"戰鬥：擊暈倍率 / Battle: Stun multiplier"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_STUN_MULTI,sora_1st.exe,F3 41 0F 58 C0 F3 0F 5D) // should be unique
alloc(newmem,$1000,INJECT_STUN_MULTI)
label(code)
label(return)
label(vf_stun_multi)
newmem:
cmp dword ptr [rcx+44], 0 // RNG
je code
cmp dword ptr [rcx+78], 0
jne code
mulss xmm8, dword ptr [vf_stun_multi]
code:
addss xmm0,xmm8
jmp return
align 10 cc
vf_stun_multi:
dd (float)3.333333333
INJECT_STUN_MULTI:
jmp newmem
return:
registersymbol(INJECT_STUN_MULTI)
registersymbol(vf_stun_multi)
[DISABLE]
INJECT_STUN_MULTI:
db F3 41 0F 58 C0
unregistersymbol(vf_stun_multi)
unregistersymbol(INJECT_STUN_MULTI)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+C8B27
sora_1st.exe+C8AFE: 40 84 F6 - test sil,sil
sora_1st.exe+C8B01: F3 44 0F 11 4C 24 20 - movss [rsp+20],xmm9
sora_1st.exe+C8B08: 49 0F 44 C7 - cmove rax,r15
sora_1st.exe+C8B0C: 4C 8B 7C 24 70 - mov r15,[rsp+70]
sora_1st.exe+C8B11: F3 0F 10 51 78 - movss xmm2,[rcx+78]
sora_1st.exe+C8B16: 44 0F 2F CA - comiss xmm9,xmm2
sora_1st.exe+C8B1A: 73 5A - jae sora_1st.exe+C8B76
sora_1st.exe+C8B1C: F3 0F 10 59 74 - movss xmm3,[rcx+74]
sora_1st.exe+C8B21: 0F 28 CA - movaps xmm1,xmm2
sora_1st.exe+C8B24: 0F 28 C3 - movaps xmm0,xmm3
// ---------- INJECTING HERE ----------
sora_1st.exe+C8B27: F3 41 0F 58 C0 - addss xmm0,xmm8
// ---------- DONE INJECTING ----------
sora_1st.exe+C8B2C: F3 0F 5D C8 - minss xmm1,xmm0
sora_1st.exe+C8B30: 40 84 ED - test bpl,bpl
sora_1st.exe+C8B33: 74 0C - je sora_1st.exe+C8B41
sora_1st.exe+C8B35: 0F 2F CA - comiss xmm1,xmm2
sora_1st.exe+C8B38: 72 07 - jb sora_1st.exe+C8B41
sora_1st.exe+C8B3A: 0F 28 CA - movaps xmm1,xmm2
sora_1st.exe+C8B3D: F3 0F 5C CC - subss xmm1,xmm4
sora_1st.exe+C8B41: 48 85 C0 - test rax,rax
sora_1st.exe+C8B44: 74 11 - je sora_1st.exe+C8B57
sora_1st.exe+C8B46: F3 0F 5C CB - subss xmm1,xmm3
}
131
"multiplier"
0
C08000
Float
vf_stun_multi
30
"戰鬥中道具無限 / Battle: inf item use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.scom
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_ITEM,sora_1st.exe,2B CD C7 44 24 20 FF FF 00 00) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_ITEM)
label(code)
label(return)
newmem:
cmp ebp, 0
jl code
xor ebp, ebp
code:
sub ecx,ebp
mov [rsp+20],0000FFFF
jmp return
INJECT_BATTLE_INF_ITEM:
jmp newmem
nop 5
return:
registersymbol(INJECT_BATTLE_INF_ITEM)
[DISABLE]
INJECT_BATTLE_INF_ITEM:
db 2B CD C7 44 24 20 FF FF 00 00
unregistersymbol(INJECT_BATTLE_INF_ITEM)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+353C1F
sora_1st.exe+353BF1: 8B 86 FC 38 1F 00 - mov eax,[rsi+001F38FC]
sora_1st.exe+353BF7: 2B C5 - sub eax,ebp
sora_1st.exe+353BF9: 85 C0 - test eax,eax
sora_1st.exe+353BFB: 0F 4F F8 - cmovg edi,eax
sora_1st.exe+353BFE: 89 BE FC 38 1F 00 - mov [rsi+001F38FC],edi
sora_1st.exe+353C04: E9 02 01 00 00 - jmp sora_1st.exe+353D0B
sora_1st.exe+353C09: 48 8D 14 9E - lea rdx,[rsi+rbx*4]
sora_1st.exe+353C0D: 89 7C 24 78 - mov [rsp+78],edi
sora_1st.exe+353C11: 0F B7 8A 24 67 11 00 - movzx ecx,word ptr [rdx+00116724]
sora_1st.exe+353C18: 48 8D 35 21 E3 48 00 - lea rsi,[sora_1st.exe+7E1F40]
// ---------- INJECTING HERE ----------
sora_1st.exe+353C1F: 2B CD - sub ecx,ebp
// ---------- DONE INJECTING ----------
sora_1st.exe+353C21: C7 44 24 20 FF FF 00 00 - mov [rsp+20],0000FFFF
sora_1st.exe+353C29: 85 C9 - test ecx,ecx
sora_1st.exe+353C2B: 4C 8D 4C 24 78 - lea r9,[rsp+78]
sora_1st.exe+353C30: 66 0F 4F C1 - cmovg ax,cx
sora_1st.exe+353C34: 48 8B 0D 35 FA 58 00 - mov rcx,[sora_1st.exe+8E3670]
sora_1st.exe+353C3B: 66 89 82 24 67 11 00 - mov [rdx+00116724],ax
sora_1st.exe+353C42: 81 E3 FF FF FF 3F - and ebx,3FFFFFFF
sora_1st.exe+353C48: 0F BA EB 1E - bts ebx,1E
sora_1st.exe+353C4C: 45 33 C0 - xor r8d,r8d
sora_1st.exe+353C4F: 48 8B D6 - mov rdx,rsi
}
31
"戰鬥：快速破防 / Battle: fast break gauge"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_FAST_BREAK_GUAGE,sora_1st.exe,41 0F 48 CD 41 89 48 38) // should be unique
alloc(newmem,$1000,INJECT_FAST_BREAK_GUAGE)
label(code)
label(return i_base_bbp_addr)
newmem:
code:
cmovs ecx,r13d
//
cmp ecx, #500
jae @F
mov ecx, 500
@@:
//
mov [r8+38],ecx
mov [i_base_bbp_addr], r8
jmp return
align 10 cc
i_base_bbp_addr:
dq 0
INJECT_FAST_BREAK_GUAGE:
jmp newmem
nop 3
return:
registersymbol(INJECT_FAST_BREAK_GUAGE i_base_bbp_addr)
[DISABLE]
INJECT_FAST_BREAK_GUAGE:
db 41 0F 48 CD 41 89 48 38
unregistersymbol(INJECT_FAST_BREAK_GUAGE i_base_bbp_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+C0562
sora_1st.exe+C0535: 4C 8B 7C 24 58 - mov r15,[rsp+58]
sora_1st.exe+C053A: 48 8B 05 67 FD 81 00 - mov rax,[sora_1st.exe+8E02A8]
sora_1st.exe+C0541: 48 8B 88 50 2C 00 00 - mov rcx,[rax+00002C50]
sora_1st.exe+C0548: 4C 8B 81 50 02 00 00 - mov r8,[rcx+00000250]
sora_1st.exe+C054F: B9 F4 01 00 00 - mov ecx,000001F4
sora_1st.exe+C0554: 41 8B 50 38 - mov edx,[r8+38]
sora_1st.exe+C0558: 8D 04 1A - lea eax,[rdx+rbx]
sora_1st.exe+C055B: 3B C1 - cmp eax,ecx
sora_1st.exe+C055D: 0F 4C C8 - cmovl ecx,eax
sora_1st.exe+C0560: 85 C9 - test ecx,ecx
// ---------- INJECTING HERE ----------
sora_1st.exe+C0562: 41 0F 48 CD - cmovs ecx,r13d
// ---------- DONE INJECTING ----------
sora_1st.exe+C0566: 41 89 48 38 - mov [r8+38],ecx
sora_1st.exe+C056A: 3B CA - cmp ecx,edx
sora_1st.exe+C056C: 74 05 - je sora_1st.exe+C0573
sora_1st.exe+C056E: 41 C6 40 40 01 - mov byte ptr [r8+40],01
sora_1st.exe+C0573: 48 8B 5C 24 60 - mov rbx,[rsp+60]
sora_1st.exe+C0578: 48 83 C4 20 - add rsp,20
sora_1st.exe+C057C: 41 5D - pop r13
sora_1st.exe+C057E: 41 5C - pop r12
sora_1st.exe+C0580: 5F - pop rdi
sora_1st.exe+C0581: 5E - pop rsi
}
32
"real value"
0
FF8080
4 Bytes
i_base_bbp_addr
38
33
"can use #"
0
FF8080
4 Bytes
i_base_bbp_addr
3C
34
"??"
0
FF8080
4 Bytes
i_base_bbp_addr
40
35
"戰鬥結束後恢復BP / Restore break gauge after battle"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_RESTORE_BP_AFTER_BATTLE,sora_1st.exe,48 8B 88 50 02 00 00 8B) // should be unique
alloc(newmem,$1000,INJECT_RESTORE_BP_AFTER_BATTLE)
label(code)
label(return)
newmem:
code:
mov rcx,[rax+00000250]
//
cmp dword ptr [rcx+38], #500
//
jmp return
INJECT_RESTORE_BP_AFTER_BATTLE:
jmp newmem
nop 2
return:
registersymbol(INJECT_RESTORE_BP_AFTER_BATTLE)
[DISABLE]
INJECT_RESTORE_BP_AFTER_BATTLE:
db 48 8B 88 50 02 00 00
unregistersymbol(INJECT_RESTORE_BP_AFTER_BATTLE)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+35305B
sora_1st.exe+353022: 41 3B BA 50 24 00 00 - cmp edi,[r10+00002450]
sora_1st.exe+353029: 72 B5 - jb sora_1st.exe+352FE0
sora_1st.exe+35302B: 4C 8B 25 E6 05 59 00 - mov r12,[sora_1st.exe+8E3618]
sora_1st.exe+353032: 49 83 BC 24 40 06 00 00 00 - cmp qword ptr [r12+00000640],00
sora_1st.exe+35303B: 74 2E - je sora_1st.exe+35306B
sora_1st.exe+35303D: 49 8B 82 50 2C 00 00 - mov rax,[r10+00002C50]
sora_1st.exe+353044: 48 8B 88 58 02 00 00 - mov rcx,[rax+00000258]
sora_1st.exe+35304B: 8B 41 70 - mov eax,[rcx+70]
sora_1st.exe+35304E: 89 86 50 26 11 00 - mov [rsi+00112650],eax
sora_1st.exe+353054: 49 8B 82 50 2C 00 00 - mov rax,[r10+00002C50]
// ---------- INJECTING HERE ----------
sora_1st.exe+35305B: 48 8B 88 50 02 00 00 - mov rcx,[rax+00000250]
// ---------- DONE INJECTING ----------
sora_1st.exe+353062: 8B 41 38 - mov eax,[rcx+38]
sora_1st.exe+353065: 89 86 54 26 11 00 - mov [rsi+00112654],eax
sora_1st.exe+35306B: 48 8B 15 E6 05 59 00 - mov rdx,[sora_1st.exe+8E3658]
sora_1st.exe+353072: 48 83 C2 08 - add rdx,08
sora_1st.exe+353076: 48 8D 8E 28 D6 1E 00 - lea rcx,[rsi+001ED628]
sora_1st.exe+35307D: 41 B8 00 50 00 00 - mov r8d,00005000
sora_1st.exe+353083: E8 68 8F 3F 00 - call sora_1st.exe+74BFF0
sora_1st.exe+353088: 48 8B 1D 01 D2 58 00 - mov rbx,[sora_1st.exe+8E0290]
sora_1st.exe+35308F: 44 89 B6 48 39 1F 00 - mov [rsi+001F3948],r14d
sora_1st.exe+353096: 0F 57 C0 - xorps xmm0,xmm0
}
3487
"支援經驗值倍率 / Support XP multiplier"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-20
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_SUPPORT_EXP_MULTI,sora_1st.exe,03 D6 3B D7 0F 4C FA 85) // should be unique
alloc(newmem,$1000,INJECT_SUPPORT_EXP_MULTI)
label(code)
label(return vf_support_exp_multi)
newmem:
vmovss xmm14, [vf_support_exp_multi]
vcvtsi2ss xmm15, xmm15, esi
vmulss xmm15, xmm14, xmm15
vcvtss2si esi, xmm15
code:
add edx,esi
cmp edx,edi
cmovl edi,edx
jmp return
align 10 cc
vf_support_exp_multi:
dd (float)3.3333333
INJECT_SUPPORT_EXP_MULTI:
jmp newmem
nop 2
return:
registersymbol(INJECT_SUPPORT_EXP_MULTI vf_support_exp_multi)
[DISABLE]
INJECT_SUPPORT_EXP_MULTI:
db 03 D6 3B D7 0F 4C FA
unregistersymbol(INJECT_SUPPORT_EXP_MULTI vf_support_exp_multi)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+D6870
sora_1st.exe+D6849: 8B F8 - mov edi,eax
sora_1st.exe+D684B: 8B 93 8C 02 00 00 - mov edx,[rbx+0000028C]
sora_1st.exe+D6851: 8B 0B - mov ecx,[rbx]
sora_1st.exe+D6853: E8 A8 AF 00 00 - call sora_1st.exe+E1800
sora_1st.exe+D6858: 8B D8 - mov ebx,eax
sora_1st.exe+D685A: 83 FE 01 - cmp esi,01
sora_1st.exe+D685D: B8 01 00 00 00 - mov eax,00000001
sora_1st.exe+D6862: 0F 4C F0 - cmovl esi,eax
sora_1st.exe+D6865: 48 8B 44 24 70 - mov rax,[rsp+70]
sora_1st.exe+D686A: 8B 90 8C 02 00 00 - mov edx,[rax+0000028C]
// ---------- INJECTING HERE ----------
sora_1st.exe+D6870: 03 D6 - add edx,esi
// ---------- DONE INJECTING ----------
sora_1st.exe+D6872: 3B D7 - cmp edx,edi
sora_1st.exe+D6874: 0F 4C FA - cmovl edi,edx
sora_1st.exe+D6877: 85 FF - test edi,edi
sora_1st.exe+D6879: B8 00 00 00 00 - mov eax,00000000
sora_1st.exe+D687E: 0F 48 F8 - cmovs edi,eax
sora_1st.exe+D6881: 48 8B 74 24 70 - mov rsi,[rsp+70]
sora_1st.exe+D6886: 89 BE 8C 02 00 00 - mov [rsi+0000028C],edi
sora_1st.exe+D688C: 44 8B 06 - mov r8d,[rsi]
sora_1st.exe+D688F: BA 3A 00 00 00 - mov edx,0000003A
sora_1st.exe+D6894: 48 8B 0D CD 4E 82 00 - mov rcx,[sora_1st.exe+8FB768]
}
3488
"multiplier"
0
C08000
Float
vf_support_exp_multi
3491
"快速超能驅動 / Fast overdrive (OD)"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-21
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_FAST_OVERDRIVE,sora_1st.exe,03 CF 3B CA 0F 4C D1) // should be unique
alloc(newmem,$1000,INJECT_FAST_OVERDRIVE)
label(code)
label(return)
newmem:
mov edi, 64
code:
add ecx,edi
cmp ecx,edx
cmovl edx,ecx
jmp return
INJECT_FAST_OVERDRIVE:
jmp newmem
nop 2
return:
registersymbol(INJECT_FAST_OVERDRIVE)
[DISABLE]
INJECT_FAST_OVERDRIVE:
db 03 CF 3B CA 0F 4C D1
unregistersymbol(INJECT_FAST_OVERDRIVE)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+CFE8E
sora_1st.exe+CFE6A: 74 12 - je sora_1st.exe+CFE7E
sora_1st.exe+CFE6C: 0F 1F 40 00 - nop dword ptr [rax+00]
sora_1st.exe+CFE70: 83 38 35 - cmp dword ptr [rax],35
sora_1st.exe+CFE73: 74 31 - je sora_1st.exe+CFEA6
sora_1st.exe+CFE75: 48 83 C0 48 - add rax,48
sora_1st.exe+CFE79: 48 3B C1 - cmp rax,rcx
sora_1st.exe+CFE7C: 75 F2 - jne sora_1st.exe+CFE70
sora_1st.exe+CFE7E: 4D 8B 00 - mov r8,[r8]
sora_1st.exe+CFE81: BA 64 00 00 00 - mov edx,00000064
sora_1st.exe+CFE86: 41 0F B6 88 8B 02 00 00 - movzx ecx,byte ptr [r8+0000028B]
// ---------- INJECTING HERE ----------
sora_1st.exe+CFE8E: 03 CF - add ecx,edi
// ---------- DONE INJECTING ----------
sora_1st.exe+CFE90: 3B CA - cmp ecx,edx
sora_1st.exe+CFE92: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+CFE95: 33 C9 - xor ecx,ecx
sora_1st.exe+CFE97: 85 D2 - test edx,edx
sora_1st.exe+CFE99: 0F B6 C2 - movzx eax,dl
sora_1st.exe+CFE9C: 0F 48 C1 - cmovs eax,ecx
sora_1st.exe+CFE9F: 41 88 80 8B 02 00 00 - mov [r8+0000028B],al
sora_1st.exe+CFEA6: 48 8B 5C 24 30 - mov rbx,[rsp+30]
sora_1st.exe+CFEAB: 48 83 C4 20 - add rsp,20
sora_1st.exe+CFEAF: 5F - pop rdi
}
3492
"超能驅動值不減 / inf. OD gauge"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-21
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_OVERDRIVE_NO_DEC,sora_1st.exe,C6 81 8B 02 00 00 00) // should be unique
INJECT_OVERDRIVE_NO_DEC+6:
db 64
registersymbol(INJECT_OVERDRIVE_NO_DEC)
[DISABLE]
INJECT_OVERDRIVE_NO_DEC+6:
db 00
unregistersymbol(INJECT_OVERDRIVE_NO_DEC)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+CF59D
sora_1st.exe+CF57D: EB 0B - jmp sora_1st.exe+CF58A
sora_1st.exe+CF57F: 41 B0 01 - mov r8b,01
sora_1st.exe+CF582: 48 8B CF - mov rcx,rdi
sora_1st.exe+CF585: E8 F6 69 FA FF - call sora_1st.exe+75F80
sora_1st.exe+CF58A: 48 FF C3 - inc rbx
sora_1st.exe+CF58D: 48 3B DE - cmp rbx,rsi
sora_1st.exe+CF590: 75 BE - jne sora_1st.exe+CF550
sora_1st.exe+CF592: 49 8B 06 - mov rax,[r14]
sora_1st.exe+CF595: 48 8B 74 24 78 - mov rsi,[rsp+78]
sora_1st.exe+CF59A: 48 8B 08 - mov rcx,[rax]
// ---------- INJECTING HERE ----------
sora_1st.exe+CF59D: C6 81 8B 02 00 00 00 - mov byte ptr [rcx+0000028B],00
// ---------- DONE INJECTING ----------
sora_1st.exe+CF5A4: 49 8B 1E - mov rbx,[r14]
sora_1st.exe+CF5A7: 48 8B 8B 60 05 00 00 - mov rcx,[rbx+00000560]
sora_1st.exe+CF5AE: 48 85 C9 - test rcx,rcx
sora_1st.exe+CF5B1: 74 71 - je sora_1st.exe+CF624
sora_1st.exe+CF5B3: 48 8B 01 - mov rax,[rcx]
sora_1st.exe+CF5B6: FF 50 10 - call qword ptr [rax+10]
sora_1st.exe+CF5B9: 3D 3A 1E B5 B6 - cmp eax,B6B51E3A
sora_1st.exe+CF5BE: 75 64 - jne sora_1st.exe+CF624
sora_1st.exe+CF5C0: 48 8B 93 60 05 00 00 - mov rdx,[rbx+00000560]
sora_1st.exe+CF5C7: 48 85 D2 - test rdx,rdx
}
36
"原野無限戰技攻擊條倍率 / Field charge gauge multiplier"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_FAST_FIELD_CHARGE,sora_1st.exe,41 03 50 70 B9 C8 00 00 00) // should be unique
alloc(newmem,$1000,INJECT_FAST_FIELD_CHARGE)
label(code)
label(return)
label(vf_field_charge_multi)
newmem:
cmp edx, 0
jle code
vcvtsi2ss xmm15, xmm15, edx
vmovss xmm14, [vf_field_charge_multi]
vmulss xmm14, xmm14, xmm15
vcvtss2si edx, xmm14
code:
add edx,[r8+70]
mov ecx,000000C8
jmp return
align 10 cc
vf_field_charge_multi:
dd (float)3
INJECT_FAST_FIELD_CHARGE:
jmp newmem
nop 4
return:
registersymbol(INJECT_FAST_FIELD_CHARGE)
registersymbol(vf_field_charge_multi)
[DISABLE]
INJECT_FAST_FIELD_CHARGE:
db 41 03 50 70 B9 C8 00 00 00
unregistersymbol(vf_field_charge_multi)
unregistersymbol(INJECT_FAST_FIELD_CHARGE)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+C38B9
sora_1st.exe+C3886: 66 0F 6E C8 - movd xmm1,eax
sora_1st.exe+C388A: 0F 5B C9 - cvtdq2ps xmm1,xmm1
sora_1st.exe+C388D: F3 0F 5E 0D 3F 14 75 00 - divss xmm1,[sora_1st.exe+814CD4]
sora_1st.exe+C3895: 48 8B 05 EC 7E 83 00 - mov rax,[sora_1st.exe+8FB788]
sora_1st.exe+C389C: 48 8B 88 50 2C 00 00 - mov rcx,[rax+00002C50]
sora_1st.exe+C38A3: 4C 8B 81 58 02 00 00 - mov r8,[rcx+00000258]
sora_1st.exe+C38AA: 66 0F 6E 07 - movd xmm0,[rdi]
sora_1st.exe+C38AE: 0F 5B C0 - cvtdq2ps xmm0,xmm0
sora_1st.exe+C38B1: F3 0F 59 C1 - mulss xmm0,xmm1
sora_1st.exe+C38B5: F3 0F 2C D0 - cvttss2si edx,xmm0
// ---------- INJECTING HERE ----------
sora_1st.exe+C38B9: 41 03 50 70 - add edx,[r8+70]
// ---------- DONE INJECTING ----------
sora_1st.exe+C38BD: B9 C8 00 00 00 - mov ecx,000000C8
sora_1st.exe+C38C2: 3B D1 - cmp edx,ecx
sora_1st.exe+C38C4: 0F 4C CA - cmovl ecx,edx
sora_1st.exe+C38C7: 85 C9 - test ecx,ecx
sora_1st.exe+C38C9: 41 0F 48 CD - cmovs ecx,r13d
sora_1st.exe+C38CD: 41 89 48 70 - mov [r8+70],ecx
sora_1st.exe+C38D1: 41 8B 40 7C - mov eax,[r8+7C]
sora_1st.exe+C38D5: 41 89 40 74 - mov [r8+74],eax
sora_1st.exe+C38D9: 41 89 48 78 - mov [r8+78],ecx
sora_1st.exe+C38DD: 49 C7 80 80 00 00 00 CD CC 4C 3E - mov qword ptr [r8+00000080],3E4CCCCD
}
37
"multiplier"
0
C08000
Float
vf_field_charge_multi
38
"原野無限戰技攻擊條 / Field charge: inf charge use"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_CHARGE_NO_DEC,sora_1st.exe,83 C0 9C 3B C1) // should be unique
INJECT_CHARGE_NO_DEC+2:
db 0
registersymbol(INJECT_CHARGE_NO_DEC)
[DISABLE]
INJECT_CHARGE_NO_DEC:
db 83 C0 9C 3B C1
unregistersymbol(INJECT_CHARGE_NO_DEC)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+26EB64
sora_1st.exe+26EB2A: 44 0F B6 81 D1 38 11 00 - movzx r8d,byte ptr [rcx+001138D1]
sora_1st.exe+26EB32: 41 FF C0 - inc r8d
sora_1st.exe+26EB35: E8 66 F0 0E 00 - call sora_1st.exe+35DBA0
sora_1st.exe+26EB3A: 48 8B 05 47 CC 68 00 - mov rax,[sora_1st.exe+8FB788]
sora_1st.exe+26EB41: F6 83 20 03 00 00 02 - test byte ptr [rbx+00000320],02
sora_1st.exe+26EB48: 0F 85 24 FF FF FF - jne sora_1st.exe+26EA72
sora_1st.exe+26EB4E: 48 8B 80 50 2C 00 00 - mov rax,[rax+00002C50]
sora_1st.exe+26EB55: B9 C8 00 00 00 - mov ecx,000000C8
sora_1st.exe+26EB5A: 48 8B 90 58 02 00 00 - mov rdx,[rax+00000258]
sora_1st.exe+26EB61: 8B 42 70 - mov eax,[rdx+70]
// ---------- INJECTING HERE ----------
sora_1st.exe+26EB64: 83 C0 9C - add eax,-64
// ---------- DONE INJECTING ----------
sora_1st.exe+26EB67: 3B C1 - cmp eax,ecx
sora_1st.exe+26EB69: 0F 4C C8 - cmovl ecx,eax
sora_1st.exe+26EB6C: 45 33 C0 - xor r8d,r8d
sora_1st.exe+26EB6F: 85 C9 - test ecx,ecx
sora_1st.exe+26EB71: 41 0F 48 C8 - cmovs ecx,r8d
sora_1st.exe+26EB75: 89 4A 70 - mov [rdx+70],ecx
sora_1st.exe+26EB78: 8B 42 7C - mov eax,[rdx+7C]
sora_1st.exe+26EB7B: 89 42 74 - mov [rdx+74],eax
sora_1st.exe+26EB7E: 89 4A 78 - mov [rdx+78],ecx
sora_1st.exe+26EB81: 48 C7 82 80 00 00 00 CD CC 4C 3E - mov qword ptr [rdx+00000080],3E4CCCCD
}
39
"取得擊殺數 / Get kill count"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_KILL_CNT,sora_1st.exe,8B 88 5C 12 01 00) // should be unique
alloc(newmem,$1000,INJECT_GET_KILL_CNT)
label(code)
label(return)
label(i_base_kill_cnt_addr)
newmem:
push r15
lea r15, [rax+1125C]
mov [i_base_kill_cnt_addr], r15
pop r15
code:
mov ecx,[rax+0001125C]
jmp return
align 10 cc
i_base_kill_cnt_addr:
dq 0
INJECT_GET_KILL_CNT:
jmp newmem
nop
return:
registersymbol(INJECT_GET_KILL_CNT)
registersymbol(i_base_kill_cnt_addr)
[DISABLE]
INJECT_GET_KILL_CNT:
db 8B 88 5C 12 01 00
unregistersymbol(i_base_kill_cnt_addr)
unregistersymbol(INJECT_GET_KILL_CNT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+33D4D2
sora_1st.exe+33D4A9: 83 F8 02 - cmp eax,02
sora_1st.exe+33D4AC: 75 11 - jne sora_1st.exe+33D4BF
sora_1st.exe+33D4AE: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
sora_1st.exe+33D4B5: 66 0F 6E C0 - movd xmm0,eax
sora_1st.exe+33D4B9: F3 0F 2C D0 - cvttss2si edx,xmm0
sora_1st.exe+33D4BD: EB 02 - jmp sora_1st.exe+33D4C1
sora_1st.exe+33D4BF: 8B D6 - mov edx,esi
sora_1st.exe+33D4C1: 48 8B 4C 24 30 - mov rcx,[rsp+30]
sora_1st.exe+33D4C6: E8 15 D9 16 00 - call sora_1st.exe+4AADE0
sora_1st.exe+33D4CB: 48 8B 05 9E 61 5A 00 - mov rax,[sora_1st.exe+8E3670]
// ---------- INJECTING HERE ----------
sora_1st.exe+33D4D2: 8B 88 5C 12 01 00 - mov ecx,[rax+0001125C]
// ---------- DONE INJECTING ----------
sora_1st.exe+33D4D8: 8B C1 - mov eax,ecx
sora_1st.exe+33D4DA: C1 E8 1E - shr eax,1E
sora_1st.exe+33D4DD: 83 F8 01 - cmp eax,01
sora_1st.exe+33D4E0: 75 0C - jne sora_1st.exe+33D4EE
sora_1st.exe+33D4E2: 8D 14 8D 00 00 00 00 - lea edx,[rcx*4+00000000]
sora_1st.exe+33D4E9: C1 FA 02 - sar edx,02
sora_1st.exe+33D4EC: EB 18 - jmp sora_1st.exe+33D506
sora_1st.exe+33D4EE: 83 F8 02 - cmp eax,02
sora_1st.exe+33D4F1: 75 11 - jne sora_1st.exe+33D504
sora_1st.exe+33D4F3: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
}
40
"※使用：開啟記錄"
8000FF
1
142
"Usage: Open memo menu"
8000FF
1
41
"Kill count"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
0
42
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
4
43
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
8
44
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
C
45
"角色數值檢視器 / Char. stats viewer"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_CHAR_STAT,sora_1st.exe,8B 56 14 48 8B CF) // should be unique
alloc(newmem,$1000,INJECT_GET_CHAR_STAT)
label(code)
label(return)
label(i_base_char_stat_addr)
newmem:
mov [i_base_char_stat_addr], rsi
code:
mov edx,[rsi+14] // current EP
mov rcx,rdi
jmp return
align 10 cc
i_base_char_stat_addr:
dq 0
INJECT_GET_CHAR_STAT:
jmp newmem
nop
return:
registersymbol(INJECT_GET_CHAR_STAT)
registersymbol(i_base_char_stat_addr)
[DISABLE]
INJECT_GET_CHAR_STAT:
db 8B 56 14 48 8B CF
unregistersymbol(i_base_char_stat_addr)
unregistersymbol(INJECT_GET_CHAR_STAT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+4453EF
sora_1st.exe+4453CD: 41 B1 01 - mov r9b,01
sora_1st.exe+4453D0: 41 B8 FE FF FF 7F - mov r8d,7FFFFFFE
sora_1st.exe+4453D6: E8 75 18 01 00 - call sora_1st.exe+456C50
sora_1st.exe+4453DB: 48 8B E8 - mov rbp,rax
sora_1st.exe+4453DE: 48 85 C0 - test rax,rax
sora_1st.exe+4453E1: 75 0C - jne sora_1st.exe+4453EF
sora_1st.exe+4453E3: 48 83 C3 08 - add rbx,08
sora_1st.exe+4453E7: 49 3B DF - cmp rbx,r15
sora_1st.exe+4453EA: 75 D7 - jne sora_1st.exe+4453C3
sora_1st.exe+4453EC: 49 8B ED - mov rbp,r13
// ---------- INJECTING HERE ----------
sora_1st.exe+4453EF: 8B 56 14 - mov edx,[rsi+14]
// ---------- DONE INJECTING ----------
sora_1st.exe+4453F2: 48 8B CF - mov rcx,rdi
sora_1st.exe+4453F5: E8 C6 04 07 00 - call sora_1st.exe+4B58C0
sora_1st.exe+4453FA: 8B 56 18 - mov edx,[rsi+18]
sora_1st.exe+4453FD: 48 8B CD - mov rcx,rbp
sora_1st.exe+445400: E8 BB 04 07 00 - call sora_1st.exe+4B58C0
sora_1st.exe+445405: 8B 46 18 - mov eax,[rsi+18]
sora_1st.exe+445408: 0F 28 C6 - movaps xmm0,xmm6
sora_1st.exe+44540B: 0F 28 CE - movaps xmm1,xmm6
sora_1st.exe+44540E: 39 46 14 - cmp [rsi+14],eax
sora_1st.exe+445411: 75 10 - jne sora_1st.exe+445423
}
46
"ID?"
0
FF8080
4 Bytes
i_base_char_stat_addr
0
47
"Lv"
0
FF8080
4 Bytes
i_base_char_stat_addr
4
48
"XP"
0
FF8080
4 Bytes
i_base_char_stat_addr
8
49
"HP"
0
FF8080
4 Bytes
i_base_char_stat_addr
C
50
"Max HP"
0
FF8080
4 Bytes
i_base_char_stat_addr
10
51
"EP"
0
FF8080
4 Bytes
i_base_char_stat_addr
14
52
"Max EP"
0
FF8080
4 Bytes
i_base_char_stat_addr
18
53
"CP"
0
FF8080
4 Bytes
i_base_char_stat_addr
1C
54
"Max CP"
0
FF8080
4 Bytes
i_base_char_stat_addr
20
55
"STR"
0
FF8080
4 Bytes
i_base_char_stat_addr
24
56
"DEF"
0
FF8080
4 Bytes
i_base_char_stat_addr
28
57
"ATS"
0
FF8080
4 Bytes
i_base_char_stat_addr
2C
58
"ADF"
0
FF8080
4 Bytes
i_base_char_stat_addr
30
59
"SPD"
0
FF8080
4 Bytes
i_base_char_stat_addr
34
60
"AGL"
0
FF8080
4 Bytes
i_base_char_stat_addr
38
61
"DEX"
0
FF8080
4 Bytes
i_base_char_stat_addr
3C
62
"MOV"
0
FF8080
4 Bytes
i_base_char_stat_addr
40
63
"RNG"
0
FF8080
4 Bytes
i_base_char_stat_addr
44
64
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
48
65
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
4C
66
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
50
67
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
54
68
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
58
69
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
5C
70
"Hit %"
0
FF8080
4 Bytes
i_base_char_stat_addr
60
71
"Evade %"
0
FF8080
4 Bytes
i_base_char_stat_addr
64
72
"Mgi Evade %"
0
FF8080
4 Bytes
i_base_char_stat_addr
68
73
"Crit %"
0
FF8080
4 Bytes
i_base_char_stat_addr
6C
74
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
70
3485
"??"
0
FF8080
Byte
i_base_char_stat_addr
28A
3489
"Overdrive"
0
FF8080
Byte
i_base_char_stat_addr
28B
3486
"Support EXP"
0
FF8080
4 Bytes
i_base_char_stat_addr
28C
75
"取得進行中Rewards / Get on-going reward data / max 50"
Auto Assembler Script
{ Game : ed9.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_ACHIEVEMENT,sora_1st.exe,8B 8B ?? ?? ?? 00 8B C1 C1 E8 1E 83 F8 01) // should be unique
alloc(newmem,$1000,INJECT_GET_ACHIEVEMENT)
alloc(INJECT_GET_ACHIEVEMENTo, 6)
label(code)
label(return i_base_achi_addr)
INJECT_GET_ACHIEVEMENTo:
readmem(INJECT_GET_ACHIEVEMENT, 6)
newmem:
push r15
push r14
push rcx
xor ecx, ecx
mov dword ptr [i_idx], 0
mov ecx, [INJECT_GET_ACHIEVEMENTo+2]
lea r15, [rbx+rcx]
loop1:
mov ecx, [i_idx]
mov r14, i_base_achi_addr
lea r14, [r14+rcx*8]
cmp qword ptr [r14], r15
je endp
cmp qword ptr [r14], 0
je write_it
jmp chk_next
write_it:
mov [r14], r15
jmp endp
db EB 3B 54
db 68 69 73 20 74
db 61 62 6C 65 20 63 6F 6D 65 73 20 66 72 6F 6D 20 68 74
db 74 70 73 3A 2F
db 2F 6F 70 65 6E 63 68 65
db 61 74 74 61 62 6C 65 73
db 2E 63 6F 6D
db 20 2F 20 43 45 20 37 2E 34 2B
chk_next:
inc dword ptr [i_idx]
cmp dword ptr [i_idx], 33
jb loop1
endp:
pop rcx
pop r14
pop r15
code:
// mov ecx,[rbx+00011100]
reassemble(INJECT_GET_ACHIEVEMENT)
jmp return
align 10 cc
i_idx:
dd 0 0
i_base_achi_addr:
dq 0
align 100 0
db 0
align 100 0
db 0
align 100 0
db 0
INJECT_GET_ACHIEVEMENT:
jmp newmem
nop
return:
registersymbol(INJECT_GET_ACHIEVEMENT i_base_achi_addr)
registersymbol(INJECT_GET_ACHIEVEMENTo)
[DISABLE]
INJECT_GET_ACHIEVEMENT:
//db 8B 8B 00 11 01 00
readmem(INJECT_GET_ACHIEVEMENTo, 6)
unregistersymbol(INJECT_GET_ACHIEVEMENT i_base_achi_addr)
dealloc(newmem)
unregistersymbol(INJECT_GET_ACHIEVEMENTo)
dealloc(INJECT_GET_ACHIEVEMENTo)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+239E4
sora_1st.exe+239B4: 3D 00 01 00 00 - cmp eax,00000100
sora_1st.exe+239B9: 72 25 - jb sora_1st.exe+239E0
sora_1st.exe+239BB: 4C 8D 0D 86 89 7D 00 - lea r9,[sora_1st.exe+7FC348]
sora_1st.exe+239C2: 41 B8 5F 02 00 00 - mov r8d,0000025F
sora_1st.exe+239C8: 48 8D 15 81 88 7D 00 - lea rdx,[sora_1st.exe+7FC250]
sora_1st.exe+239CF: B9 03 00 00 00 - mov ecx,00000003
sora_1st.exe+239D4: E8 97 DD 42 00 - call sora_1st.exe+451770
sora_1st.exe+239D9: 44 8B 54 24 78 - mov r10d,[rsp+78]
sora_1st.exe+239DE: EB 04 - jmp sora_1st.exe+239E4
sora_1st.exe+239E0: 48 8D 1C 83 - lea rbx,[rbx+rax*4]
// ---------- INJECTING HERE ----------
sora_1st.exe+239E4: 8B 8B 00 11 01 00 - mov ecx,[rbx+00011100]
// ---------- DONE INJECTING ----------
sora_1st.exe+239EA: 8B C1 - mov eax,ecx
sora_1st.exe+239EC: C1 E8 1E - shr eax,1E
sora_1st.exe+239EF: 83 F8 01 - cmp eax,01
sora_1st.exe+239F2: 75 0C - jne sora_1st.exe+23A00
sora_1st.exe+239F4: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
sora_1st.exe+239FB: C1 F8 02 - sar eax,02
sora_1st.exe+239FE: EB 18 - jmp sora_1st.exe+23A18
sora_1st.exe+23A00: 83 F8 02 - cmp eax,02
sora_1st.exe+23A03: 75 11 - jne sora_1st.exe+23A16
sora_1st.exe+23A05: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
}
76
"#1"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr
0
77
"#2"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+8
0
78
"#3"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+10
0
79
"#4"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+18
0
80
"#5"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+20
0
81
"#6"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+28
0
82
"#7"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+30
0
83
"#8"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+38
0
84
"#9"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+40
0
85
"#10"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+48
0
86
"#11"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+50
0
87
"#12"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+58
0
88
"#13"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+60
0
89
"#14"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+68
0
90
"#15"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+70
0
91
"#16"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+78
0
92
"#17"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+80
0
93
"#18"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+88
0
94
"#19"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+90
0
95
"#20"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+98
0
96
"#21"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+A0
0
97
"#22"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+A8
0
98
"#23"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+B0
0
99
"#24"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+B8
0
100
"#25"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+C0
0
101
"#26"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+C8
0
102
"#27"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+D0
0
103
"#28"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+D8
0
104
"#29"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+E0
0
105
"#30"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+E8
0
106
"#31"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+F0
0
107
"#32"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+F8
0
108
"#33"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+100
0
109
"#34"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+108
0
110
"#35"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+110
0
111
"#36"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+118
0
112
"#37"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+120
0
113
"#38"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+128
0
114
"#39"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+130
0
115
"#40"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+138
0
116
"#41"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+140
0
117
"#42"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+148
0
118
"#43"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+150
0
119
"#44"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+158
0
120
"#45"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+160
0
121
"#46"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+168
0
122
"#47"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+170
0
123
"#48"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+178
0
124
"#49"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+180
0
125
"#50"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+188
0
3481
"瀏覽食譜時自動設定食材量 / Auto set ingredient amt. when browsing recipes"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-20
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_AUTO_COOKING_INGREDIENTS,sora_1st.exe,44 0F B7 A4 88 24 67 11 00 49) // should be unique
alloc(newmem,$1000,INJECT_AUTO_COOKING_INGREDIENTS)
label(code)
label(return iw_ingredient_set_to)
newmem:
mov bx, [iw_ingredient_set_to]
cmp word ptr [rax+rcx*4+00116724], bx
jae code
mov [rax+rcx*4+00116724], bx
code:
movzx r12d,word ptr [rax+rcx*4+00116724]
jmp return
align 10 cc
iw_ingredient_set_to:
dw #70
INJECT_AUTO_COOKING_INGREDIENTS:
jmp newmem
nop 4
return:
registersymbol(INJECT_AUTO_COOKING_INGREDIENTS iw_ingredient_set_to)
[DISABLE]
INJECT_AUTO_COOKING_INGREDIENTS:
db 44 0F B7 A4 88 24 67 11 00
unregistersymbol(INJECT_AUTO_COOKING_INGREDIENTS iw_ingredient_set_to)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+33AB89
sora_1st.exe+33AB5C: E8 0F 6C 11 00 - call sora_1st.exe+451770
sora_1st.exe+33AB61: EB 2F - jmp sora_1st.exe+33AB92
sora_1st.exe+33AB63: 8D 88 CA FE FF FF - lea ecx,[rax-00000136]
sora_1st.exe+33AB69: 83 F9 07 - cmp ecx,07
sora_1st.exe+33AB6C: 77 11 - ja sora_1st.exe+33AB7F
sora_1st.exe+33AB6E: 48 8B 05 BB 41 5C 00 - mov rax,[sora_1st.exe+8FED30]
sora_1st.exe+33AB75: 44 8B A4 88 E0 38 1F 00 - mov r12d,[rax+rcx*4+001F38E0]
sora_1st.exe+33AB7D: EB 13 - jmp sora_1st.exe+33AB92
sora_1st.exe+33AB7F: 48 8B C8 - mov rcx,rax
sora_1st.exe+33AB82: 48 8B 05 A7 41 5C 00 - mov rax,[sora_1st.exe+8FED30]
// ---------- INJECTING HERE ----------
sora_1st.exe+33AB89: 44 0F B7 A4 88 24 67 11 00 - movzx r12d,word ptr [rax+rcx*4+00116724]
// ---------- DONE INJECTING ----------
sora_1st.exe+33AB92: 49 8B 9E 58 02 00 00 - mov rbx,[r14+00000258]
sora_1st.exe+33AB99: 49 8B 86 60 02 00 00 - mov rax,[r14+00000260]
sora_1st.exe+33ABA0: 48 8D 3C C3 - lea rdi,[rbx+rax*8]
sora_1st.exe+33ABA4: 48 3B DF - cmp rbx,rdi
sora_1st.exe+33ABA7: 74 2D - je sora_1st.exe+33ABD6
sora_1st.exe+33ABA9: 0F 1F 80 00 00 00 00 - nop dword ptr [rax+00000000]
sora_1st.exe+33ABB0: 48 8B 0B - mov rcx,[rbx]
sora_1st.exe+33ABB3: 48 8D 15 BE DC 4B 00 - lea rdx,[sora_1st.exe+7F8878]
sora_1st.exe+33ABBA: 41 B1 01 - mov r9b,01
sora_1st.exe+33ABBD: 45 33 C0 - xor r8d,r8d
}
3483
"使用：瀏覽相關食譜後、重開料理選單"
8000FF
1
3484
"Usage: Browse the related recipe, then reopen the cooking menu
"
8000FF
1
3482
"最小值 / min. value"
0
C08000
2 Bytes
iw_ingredient_set_to
167
"單一任務資料檢視 / Quest viewer"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-20
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_SINGLE_QUEST_VIEWER,sora_1st.exe,0F B6 44 D5 0A) // should be unique
alloc(newmem,$1000,INJECT_SINGLE_QUEST_VIEWER)
label(code)
label(return)
label(i_base_quest_addr)
newmem:
push r15
lea r15, [rbp+rdx*8]
mov [i_base_quest_addr], r15
pop r15
code:
movzx eax,byte ptr [rbp+rdx*8+0A]
jmp return
align 10 cc
i_base_quest_addr:
dq 0
INJECT_SINGLE_QUEST_VIEWER:
jmp newmem
return:
registersymbol(INJECT_SINGLE_QUEST_VIEWER)
registersymbol(i_base_quest_addr)
[DISABLE]
INJECT_SINGLE_QUEST_VIEWER:
db 0F B6 44 D5 0A
unregistersymbol(i_base_quest_addr)
unregistersymbol(INJECT_SINGLE_QUEST_VIEWER)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+346618
sora_1st.exe+3465D2: C7 84 24 A8 00 00 00 02 00 00 00 - mov [rsp+000000A8],00000002
sora_1st.exe+3465DD: C7 84 24 AC 00 00 00 29 2C E0 A2 - mov [rsp+000000AC],A2E02C29
sora_1st.exe+3465E8: C7 84 24 B0 00 00 00 20 00 00 00 - mov [rsp+000000B0],00000020
sora_1st.exe+3465F3: C7 84 24 B4 00 00 00 A0 88 28 D8 - mov [rsp+000000B4],D82888A0
sora_1st.exe+3465FE: E8 5D C1 D2 FF - call sora_1st.exe+72760
sora_1st.exe+346603: 41 8B CF - mov ecx,r15d
sora_1st.exe+346606: 4C 8D 84 24 98 00 00 00 - lea r8,[rsp+00000098]
sora_1st.exe+34660E: 44 8B C8 - mov r9d,eax
sora_1st.exe+346611: 48 8D 14 89 - lea rdx,[rcx+rcx*4]
sora_1st.exe+346615: 48 03 D2 - add rdx,rdx
// ---------- INJECTING HERE ----------
sora_1st.exe+346618: 0F B6 44 D5 0A - movzx eax,byte ptr [rbp+rdx*8+0A]
// ---------- DONE INJECTING ----------
sora_1st.exe+34661D: 0F 1F 00 - nop dword ptr [rax]
sora_1st.exe+346620: 49 8B 08 - mov rcx,[r8]
sora_1st.exe+346623: 85 C1 - test ecx,eax
sora_1st.exe+346625: 75 13 - jne sora_1st.exe+34663A
sora_1st.exe+346627: 49 83 C0 08 - add r8,08
sora_1st.exe+34662B: 48 8D 8C 24 B8 00 00 00 - lea rcx,[rsp+000000B8]
sora_1st.exe+346633: 4C 3B C1 - cmp r8,rcx
sora_1st.exe+346636: 75 E8 - jne sora_1st.exe+346620
sora_1st.exe+346638: EB 07 - jmp sora_1st.exe+346641
sora_1st.exe+34663A: 4C 8B C9 - mov r9,rcx
}
3478
"使用：查看委託"
8000FF
1
3479
"Usage: View quests"
8000FF
1
168
"base"
1
0
808080
8 Bytes
i_base_quest_addr
3475
"任務狀態 / Status"
Quest.StatusID
0
FF8080
Byte
i_base_quest_addr
A
3476
"是否回報 / Reported"
Quest.Completed
0
FF8080
Byte
i_base_quest_addr
B
3477
"BP獎勵 / Bonus BP"
0
FF8080
Byte
i_base_quest_addr
4C
156
"取得全部任務進度資料 / Get all quests progress"
Auto Assembler Script
{ Game : sora_1st.exe
Version:
Date : 2025-09-20
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_QUEST_PROGRESS,sora_1st.exe,F6 44 CF 0A 04) // should be unique
alloc(newmem,$1000,INJECT_GET_QUEST_PROGRESS)
label(code)
label(return)
label(i_base_quest_data_addrs)
newmem:
push r15
push r14
push r13
xor r13, r13
lea r15, [rdi+rcx*8]
loop1:
mov r14, i_base_quest_data_addrs
lea r14, [r14+r13*8]
cmp [r14], r15
je endp
cmp qword ptr [r14], 0
jne @F
//write data
mov [r14], r15
jmp endp
@@:
inc r13
cmp r13, #88
jae endp
jmp loop1
endp:
pop r13
pop r14
pop r15
code:
test byte ptr [rdi+rcx*8+0A],04
jmp return
align 10 cc
i_base_quest_data_addrs:
dq 0
align 200 0 0
db 0
align 200 0 0
db 0
align 200 0 0
db 0
align 200 0 0
db 0
INJECT_GET_QUEST_PROGRESS:
jmp newmem
return:
registersymbol(INJECT_GET_QUEST_PROGRESS)
registersymbol(i_base_quest_data_addrs)
[DISABLE]
INJECT_GET_QUEST_PROGRESS:
db F6 44 CF 0A 04
unregistersymbol(i_base_quest_data_addrs)
unregistersymbol(INJECT_GET_QUEST_PROGRESS)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+352ACC
sora_1st.exe+352AA4: 44 8B 7C CF 44 - mov r15d,[rdi+rcx*8+44]
sora_1st.exe+352AA9: 48 8B 3D 70 C2 5A 00 - mov rdi,[sora_1st.exe+8FED20]
sora_1st.exe+352AB0: 44 8B C5 - mov r8d,ebp
sora_1st.exe+352AB3: 44 0F AF C2 - imul r8d,edx
sora_1st.exe+352AB7: 4D 03 C7 - add r8,r15
sora_1st.exe+352ABA: 41 0F B7 04 18 - movzx eax,word ptr [r8+rbx]
sora_1st.exe+352ABF: 66 41 3B C4 - cmp ax,r12w
sora_1st.exe+352AC3: 73 1E - jae sora_1st.exe+352AE3
sora_1st.exe+352AC5: 48 8D 0C 80 - lea rcx,[rax+rax*4]
sora_1st.exe+352AC9: 48 03 C9 - add rcx,rcx
// ---------- INJECTING HERE ----------
sora_1st.exe+352ACC: F6 44 CF 0A 04 - test byte ptr [rdi+rcx*8+0A],04
// ---------- DONE INJECTING ----------
sora_1st.exe+352AD1: 74 10 - je sora_1st.exe+352AE3
sora_1st.exe+352AD3: 0F B7 4C CF 4C - movzx ecx,word ptr [rdi+rcx*8+4C]
sora_1st.exe+352AD8: 41 0F B6 44 18 28 - movzx eax,byte ptr [r8+rbx+28]
sora_1st.exe+352ADE: 03 C8 - add ecx,eax
sora_1st.exe+352AE0: 41 01 0B - add [r11],ecx
sora_1st.exe+352AE3: FF C2 - inc edx
sora_1st.exe+352AE5: 3B D6 - cmp edx,esi
sora_1st.exe+352AE7: 72 C7 - jb sora_1st.exe+352AB0
sora_1st.exe+352AE9: 4C 8B 3C 24 - mov r15,[rsp]
sora_1st.exe+352AED: 4C 8B 64 24 08 - mov r12,[rsp+08]
}
164
"使用：向公會任務NPC回報"
8000FF
1
165
"Usage: report to guild quests NPC"
8000FF
1
157
"base"
1
0
808080
8 Bytes
i_base_quest_data_addrs
159
"產生任務狀態列表 / Generate quests status"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
closeLuaEngine2()
-- ====== 可調參數 ======
local PARENT_NAME = "+Quest List (勿刪除 / do not delete this)"
local BASE_SYM = "i_base_quest_data_addrs" -- 這裡存放的是 指標陣列 的起始位址
local PTR_COUNT = 87 -- 一共 87 組
local PTR_STRIDE = 0x8 -- 每個指標 8 bytes（64-bit）
-- 顏色（交錯上色，方便閱讀）
local evenColor = 0xFF8000
local oddColor = 0xAA8044
-- ====== 欄位位移定義 ======
local OFF_QUEST_STATUS = 0x0A -- 1 byte
local OFF_COMPLETED = 0x0B -- 1 byte
local OFF_BONUS_BP = 0x4C -- 2 bytes
local OFF_UNKNOWN_04 = 0x04 -- 1 byte
local OFF_QUEST_TYPE = 0x05 -- 1 byte
-- Quest log 子區間：0x0C ~ 0x4A，步長 2
local LOG_BEGIN = 0x0C
local LOG_END = 0x4A
local LOG_STEP = 0x02
local addressList = getAddressList()
-- 讀出指標陣列起點位址（這裡 BASE_SYM 本身是個位址，裡面每 8 bytes 存一個指標）
local baseAddr = getAddress(BASE_SYM)
if not baseAddr or baseAddr == 0 then
print("Read error: cannot resolve symbol '" .. BASE_SYM .. "'")
return
end
-- 小工具：建立單一記錄
local function addRec(desc, addr, vt, parent, opts)
local r = addressList.createMemoryRecord()
r.Description = desc
r.Address = string.format("%X", addr or 0)
r.Vartype = vt
r.Parent = parent
if opts then
if opts.hex ~= nil then r.ShowAsHex = opts.hex end
if opts.color then r.Color = opts.color end
if opts.ddLinked then r.DropDownLinked = opts.ddLinked end
if opts.ddMemrec then r.DropDownLinkedMemrec = opts.ddMemrec end
end
return r
end
synchronize(function()
-- 取得/建立父節點
local parent = addressList.getMemoryRecordByDescription(PARENT_NAME)
if not parent then
parent = addressList.createMemoryRecord()
parent.Description = PARENT_NAME
parent.IsGroupHeader = true
parent.Options = "[moHideChildren]"
end
-- 清掉舊子節點
for i = addressList.Count - 1, 0, -1 do
local mr = addressList[i]
if mr.Parent == parent then mr.delete() end
end
-- 逐筆讀取指標並建立節點
for n = 0, PTR_COUNT - 1 do
-- 讀出第 n 筆任務資料指標
local ptrSlotAddr = baseAddr + (PTR_STRIDE * n)
local questPtr = readPointer(ptrSlotAddr) or 0
-- 外層 Row
local row = addressList.createMemoryRecord()
row.Description = string.format("Row[%03d]", n + 1)
row.IsGroupHeader = true
row.Parent = parent
row.Color = (n % 2 == 0) and evenColor or oddColor
-- === 基本欄位 ===
-- Quest status (1 byte)
addRec("任務狀態 / Status", questPtr + OFF_QUEST_STATUS, vtByte, row, {ddLinked = true, ddMemrec = "Quest.StatusID"})
-- 讀任務狀態 (byte)
row.Options = "[moHideChildren,moDeactivateChildrenAsWell]"
local statusVal = readBytes(questPtr + OFF_QUEST_STATUS, 1, false) or 0
if statusVal == 0 then
row.Collapsed = true -- 預設收合
row.Active = false
else
row.Collapsed = false -- 預設展開
row.Active = true
end
-- Completed or not (1 byte)
addRec("是否回報 / Reported", questPtr + OFF_COMPLETED, vtByte, row, {ddLinked = true, ddMemrec = "Quest.Completed"})
-- Bonus BP (2 bytes)
addRec("BP獎勵 / Bonus BP", questPtr + OFF_BONUS_BP, vtWord, row, {color = row.Color})
-- Unknown @0x04 (1 byte)
--addRec("Unknown (0x04)", questPtr + OFF_UNKNOWN_04, vtByte, row)
-- Quest type? @0x05 (1 byte)
addRec("種類? / Quest type?", questPtr + OFF_QUEST_TYPE, vtByte, row)
-- === Quest log 子節點（預設收合） ===
local logGroup = addressList.createMemoryRecord()
logGroup.Description = "任務記錄 / Quest log"
logGroup.IsGroupHeader = true
logGroup.Parent = row
logGroup.Options = "[moHideChildren]" -- 允許收合
logGroup.Active = false -- 預設收合
logGroup.Color = (n % 2 == 0) and evenColor or oddColor
-- 0x0C ~ 0x4A，每 2 bytes 一筆（vtWord）
local idx = 1
for off = LOG_BEGIN, LOG_END, LOG_STEP do
addRec(string.format("log ID %d", idx), questPtr + off, vtWord, logGroup, {ddLinked = true, ddMemrec = "Quest.LogID"})
idx = idx + 1
end
end
parent.IsExpanded = true
end)
print(string.format("%d quest rows built to '%s'.", PTR_COUNT, PARENT_NAME))
closeLuaEngine()
[DISABLE]
{$lua}
if syntaxcheck then return end
local PARENT_NAME = "+Quest List (勿刪除 / do not delete this)"
local addressList = getAddressList()
synchronize(function()
local parent = addressList.getMemoryRecordByDescription(PARENT_NAME)
if not parent then
print("Cannot find parent node: " .. PARENT_NAME)
return
end
for i = addressList.Count - 1, 0, -1 do
local mr = addressList[i]
if mr.Parent == parent then mr.delete() end
end
parent.Active = false
end)
print("Quest nodes cleared.")
closeLuaEngine()
160
""base" 不得為0 / "base" cannot be 0"
8000FF
1
158
"+Quest List (勿刪除 / do not delete this)"
1
126
"空之軌跡 the 1st / https://opencheattables.com"
00B300
1
161
"Quest.Completed"
0:否 / No
1:是 / Yes
1
162
"Quest.StatusID"
0:尚未開始 / not started
4:(未確認) 失敗? / Failed?
16:承接前 / before accept
48:進行中 / in progress
50:已達成 / completed
54:已回報 / reported
1
163
"Quest.LogID"
255:空 / Empty
1
Code :movzx ecx,word ptr [rdi+rcx*8+4C]
sora_1st.exe+352AD3
CF
0A
04
74
10
0F
B7
4C
CF
4C
41
0F
B6
44
18
--[[
[ENABLE]
{$lua}
if syntaxcheck then return end
]]--
-- **デバッグモードの設定 (デフォルト: 無効)**
local debugMode = false
-- AOBScanModule関数
if not AOBScanModule then
function AOBScanModule(moduleName, signature, scanOptions)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then
if debugMode then print("❗ Error: Module " .. moduleName .. " not found!") end
return nil
end
if debugMode then
print(string.format("✔️ %s Base Address: 0x%X", moduleName, baseAddr))
print(string.format("🔬 Scanning Range: 0x%X - 0x%X", baseAddr, maxAddr))
end
local ms = createMemScan()
synchronize(function()
ms.firstScan(
soExactValue,
vtByteArray,
nil,
signature,
nil,
baseAddr,
maxAddr,
scanOptions or "+X+R",
fsmNotAligned,
"1",
true,
true,
false,
false
)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
if addr then
if debugMode then print("🔦 AOB found at: 0x" .. addr) end
else
if debugMode then print("💔 AOB not found in " .. moduleName) end
end
results.destroy()
ms.destroy()
return addr
end
end
registerLuaFunctionHighlight('AOBScanModule')
--[[
test AOBScanModule()
local aob_addr_str = AOBScanModule("???.exe", "48 8B 05 ?? ?? ?? ?? 33 ED 48 8B 88", "+X+R")
if aob_addr_str then
print("🔦 Final AOB Address: 0x" .. aob_addr_str)
else
print("💔 AOB not found in ???.exe")
end
]]--
-- AOBScanModuleN関数
if not AOBScanModuleN then
function AOBScanModuleN(moduleName, signature, maxResults, scanOptions)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then
if debugMode then print("❗ Error: Module " .. moduleName .. " not found!") end
return nil
end
if debugMode then
print(string.format("✔️ %s Base Address: 0x%X", moduleName, baseAddr))
print(string.format("🔬 Scanning Range: 0x%X - 0x%X", baseAddr, maxAddr))
end
local ms = createMemScan()
synchronize(function()
ms.firstScan(
soExactValue,
vtByteArray,
nil,
signature,
nil,
baseAddr,
maxAddr,
scanOptions or "+X+R",
fsmNotAligned,
"1",
true,
true,
false,
false
)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addrs = {}
synchronize(function()
local count = results.getCount()
for i = 0, math.min(maxResults - 1, count - 1) do
table.insert(addrs, results[i])
if debugMode then
print(string.format("🔦 AOB[%d] found at: 0x%s", i + 1, results[i]))
end
end
end)
if #addrs == 0 and debugMode then
print("💔 AOB not found in " .. moduleName)
end
results.destroy()
ms.destroy()
return addrs
end
end
registerLuaFunctionHighlight('AOBScanModuleN')
-- 搜尋並取出最多5筆結果
--[[
local list = AOBScanModuleN("GameModule.exe", "12 34 56 ?? 78", 5)
if list then
for i, addr in ipairs(list) do
print(string.format("地址 %d: 0x%s", i, addr))
end
end
]]--
-- Lua scripts that table checkbox will not be checked with "NO_ACTIVATE" in comment/script body
if not onMemRecPostExecute then
function onMemRecPostExecute(memoryrecord, newState, succeeded)
if memoryrecord.Type == vtAutoAssembler and memoryrecord.Script:find("NO_ACTIVATE") and newState and succeeded then
synchronize(function()
memoryrecord.disableWithoutExecute()
end)
end
end
end
-- Memory record IDs now allowed to be 'locked'
IDs = {999999, 9999999}
-- Determine event trigger sequence
if not contains then
function contains(table, val)
for i = 1, #table do
if table[i] == val then
return true
end
end
return false
end
end
if not onMemRecPreExecute then
function onMemRecPreExecute(memoryrecord, newstate)
if contains(IDs, memoryrecord.ID) and newstate then
synchronize(function()
if not memoryrecord.OnActivate then
memoryrecord.OnActivate = function(memoryrecord, before, currentstate)
return false
end
end
end)
end
end
end
-- Utility Functions
-- Clear lua engine log
if not clearLuaLog then
function clearLuaLog()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
end)
end
end
registerLuaFunctionHighlight('clearLuaLog')
-- Close lua engine log
if not closeLuaEngine then
function closeLuaEngine()
synchronize(function()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine')
-- Clear lua engine log & close lua engine
if not closeLuaEngine2 then
function closeLuaEngine2()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine2')
if not getProcessNameFromPID then
function getProcessNameFromPID(pid)
local sl = createStringList()
getProcessList(sl)
local hexPid = string.format("%X", pid):upper()
for i = 0, sl.Count - 1 do
local entry = sl[i]
local hexid, name = entry:match("^(%x+)%-(.+)$")
if hexid and name then
if tonumber(hexid, 16) == pid then
return name
end
end
end
return "(unknown)"
end
end
registerLuaFunctionHighlight('getProcessNameFromPID')
if not printProcessInfo then
function printProcessInfo()
local pid = getOpenedProcessID()
local name = getProcessNameFromPID(pid)
print(string.format("📎 Attached to process: %s (PID: %d / 0x%X)", name, pid, pid))
end
end
registerLuaFunctionHighlight('printProcessInfo')
if not dumpProcessListAndFindPID then
function dumpProcessListAndFindPID()
local pid = getOpenedProcessID()
print(string.format("💭 Current PID: %d / 0x%X", pid, pid))
local sl = createStringList()
getProcessList(sl)
print("🧾 Dumping process list:")
for i = 0, sl.Count - 1 do
local entry = sl[i]
print(string.format("[%d] %s", i, entry))
-- 嘗試解析並比對 PID
local name, hexid = entry:match("(.+)%-(%x+)$")
if name and hexid then
local parsed = tonumber(hexid, 16)
if parsed == pid then
print("🔦 Match found in process list:")
print(string.format("Name: %s | PID: %s (0x%s)", name, parsed, hexid))
end
end
end
end
end
registerLuaFunctionHighlight('dumpProcessListAndFindPID')
if not toHex32 then
function toHex32(num)
local hexstr = "0123456789ABCDEF"
local result = ""
if num < 0 then
num = (num + (1 << 32)) % (1 << 32) -- 轉成32-bit補數
end
for i = 1, 8 do -- 32-bit 一共8個hex位
local n = num & 0xF -- 取最低4 bit
result = hexstr:sub(n + 1, n + 1) .. result
num = num >> 4 -- 右移4 bit
end
return result
end
end
registerLuaFunctionHighlight('toHex32')
if not toHex then
function toHex(num)
local hexstr = "0123456789ABCDEF"
local result = ""
if num < 0 then
num = (num + (1 << 64)) % (1 << 64) -- 轉成64-bit補數
end
for i = 1, 16 do -- 每4 bit 一個 hex字，64-bit總共16個hex位
local n = num & 0xF -- 取最低4bit
result = hexstr:sub(n + 1, n + 1) .. result
num = num >> 4 -- 右移4bit
end
return result
end
end
registerLuaFunctionHighlight('toHex')
synchronize(function() AddressList.Header.OnSectionClick = nil end)
--[[
[DISABLE]
{$lua}
if AOBScanModule then
AOBScanModule = nil
end
if onMemRecPostExecute then
onMemRecPostExecute = nil
end
if onMemRecPreExecute then
onMemRecPreExecute = nil
end
if clearLuaLog then
clearLuaLog = nil
end
if closeLuaEngine then
closeLuaEngine = nil
end
if closeLuaEngine2 then
closeLuaEngine2 = nil
end
]]--