1828
"********"
0
00FF00
4 Bytes
********** ver. 0.7.5 (build: 64591) EARLY ACCESS **********
1748
"Health/Ammo/1 Hit Kill"
FF00FF
Auto Assembler Script
{ Game : Witchfire-Win64-Shipping.exe
Version:
Date : 2025-09-13
Author : Mark
This script does blah blah blah
}
[ENABLE]
aobscanmodule(INJECT,Witchfire-Win64-Shipping.exe,0F 57 C0 F2 0F 5A C2 F3 0F 11 02) // should be unique
//alloc(newmem,$1000,INJECT)
alloc(newmem,$200,INJECT)
alloc(1hk_flag,1)
alloc(my_health_flag,1)
alloc(ammo_flag,1)
registersymbol(1hk_flag)
registersymbol(my_health_flag)
registersymbol(ammo_flag)
1hk_flag:
db 0
my_health_flag:
db 0
ammo_flag:
db 0
label(normal)
label(return)
label(is_it_ammo)
label(its_me)
label(write_value_and_return)
label(enemy_second_hit)
newmem:
// check health requirement
cmp [rdx+4],3f800000 //(float)1
jne is_it_ammo
my_health:
//************************* HEALTH ************************
cmp byte ptr[my_health_flag],1
jne check_1hk
cmp [rdx+10],40b00000 // Butcher (float)5.50
je its_me
cmp [rdx+10],40b33405 // Hunter or Shadow (float)5.60
je its_me
cmp [rdx+10],40bccccd // Slayer or Penitent (float)5.90
je its_me
cmp [rdx+10],40b9999a // Saint (float)5.80
je its_me
cmp [rdx+10],40000000 // (float)2 // *****did this because the numbers above didn't work once
je its_me
cmp [rdx+10],4099999a // float)4.8 // *****did this because the numbers above didn't work once
je its_me
//*************************** CHECK IF ENEMY *********************
check_1hk:
cmp byte ptr [1hk_flag],1 // is 1 hit kill ON
jne normal // 1 hit kill not on
cmp [rdx+10],(float)5
jne normal // not enemy requirement #1
cmp [rdx+18],(float)1
jne normal // not enemy requirement #2
//***************************** IS ENEMY *************************
// enemy value must be 1 before it is 0 or they won't die
push rax
movd eax,xmm0
cmp eax,0
je enemy_second_hit
mov eax,1 // set enemy health value to 1 so it dies easier
enemy_second_hit:
movd xmm0,eax
pop rax
jmp write_value_and_return
//**************************** IS ME *****************************
its_me:
push rax
mov eax,4479c000 // (float)999 // max health
movd xmm0,eax
pop rax
//********************** WRITE UPDATED VALUE FOR ME OR ENEMY *********
write_value_and_return:
movss [rdx],xmm0
jmp return
// ************************** ARE THE AMMO REQUIREMENTS MET **********
// **************************** AMMO FIRST REQUIREMENT *******************
// mov rax,42700000 // Butcher
// mov rax,41f00000 // Hunter
// mov rax,41f00000 // Saint
// mov rax,41a00000 // Slayer
// mov rax,40C00000 // Shadow
// mov rax,40C00000 // Penitent
{
************* Normal **************
Angelus- 428c0000 85
Midas- 42700000 84
Ricochet- 41F00000 83
Hypnosis- 41200000 82
All-Seeing Eye- 40C00000 81
Frostbite- 40C00000 81
Hangfire 40C00000 81
Duelist 41400000 82
Hunger 40C00000 81
Nemesis 40C00000 81
Cricket 41A00000 83
Psychopomp 41200000 82
Echo 40C00000 81
Basilisk 41200000 82
Hailstorm 40A00000 81
************ Demonic **************
Vulture- 40A00000 81
Falling Star- ??
Whisper- 40000000 80
-------------------------------------
Whisper- 40000000 80
Hailstorm 40A00000 81
Vulture- 40A00000 81
All-Seeing Eye- 40C00000 81
Frostbite- 40C00000 81
Hangfire 40C00000 81
Hunger 40C00000 81
Nemesis 40C00000 81
Echo 40C00000 81
Hypnosis- 41200000 82
Psychopomp 41200000 82
Basilisk 41200000 82
Duelist 41400000 82
Cricket 41A00000 83
Ricochet- 41F00000 83
Midas- 42700000 84
Angelus- 428c0000 85
Falling Star- ??
}
{
// ************** xmm0 needs to be = xmm6-1
push rax // save rax
push rbx // save rbx
movd eax,xmm6 // save xmm6 in eax
subss xmm6,xmm0 // subtract xmm0 from xmm6
movd ebx,xmm6 // save result in ebx
cmp ebx,(float)1 // is the difference = 1
movd xmm6,eax // restore xmm6
pop rbx
pop rax
jne normal // the difference is not equal 1
}
// ************ AND xmm3 needs to be = -1 ******************
is_it_ammo:
cmp byte ptr[ammo_flag],1
jne normal
push rax
movd eax,xmm3
cmp eax,(float)-1
pop rax
jne normal
// ************************ AMMO THIRD REQUIREMENT *******************
push rax
movd eax,xmm6
cmp eax,0
pop rax
je normal // if xmm6 == 0, it's not ammo
movss xmm0,xmm6 // otherwise, copy value from xmm6 and keep it
movss [rdx],xmm0
jmp return
//code:
normal:
xorps xmm0,xmm0
cvtsd2ss xmm0,xmm2
movss [rdx],xmm0
jmp return
INJECT:
jmp newmem
nop 2
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 0F 57 C0 F2 0F 5A C2
unregistersymbol(1hk_flag)
unregistersymbol(my_health_flag)
unregistersymbol(ammo_flag)
dealloc(1hk_flag)
dealloc(my_health_flag)
dealloc(ammo_flag)
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Witchfire-Win64-Shipping.exe+1F5A720
Witchfire-Win64-Shipping.exe+1F5A715: 89 02 - mov [rdx],eax
Witchfire-Win64-Shipping.exe+1F5A717: C3 - ret
Witchfire-Win64-Shipping.exe+1F5A718: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A719: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A71A: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A71B: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A71C: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A71D: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A71E: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A71F: CC - int 3
// ---------- INJECTING HERE ----------
Witchfire-Win64-Shipping.exe+1F5A720: 0F 57 C0 - xorps xmm0,xmm0
// ---------- DONE INJECTING ----------
Witchfire-Win64-Shipping.exe+1F5A723: F2 0F 5A C2 - cvtsd2ss xmm0,xmm2
Witchfire-Win64-Shipping.exe+1F5A727: F3 0F 11 02 - movss [rdx],xmm0
Witchfire-Win64-Shipping.exe+1F5A72B: C3 - ret
Witchfire-Win64-Shipping.exe+1F5A72C: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A72D: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A72E: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A72F: CC - int 3
Witchfire-Win64-Shipping.exe+1F5A730: F2 0F 11 12 - movsd [rdx],xmm2
Witchfire-Win64-Shipping.exe+1F5A734: C3 - ret
Witchfire-Win64-Shipping.exe+1F5A735: CC - int 3
}
1741
"Toggle 1 Hit Kill"
Auto Assembler Script
[ENABLE]
1hk_flag:
db 1
[DISABLE]
1hk_flag:
db 0
1749
"Toggle My Health"
Auto Assembler Script
[ENABLE]
my_health_flag:
db 1
[DISABLE]
my_health_flag:
db 0
1751
"Toggle Ammo"
Auto Assembler Script
[ENABLE]
ammo_flag:
db 1
[DISABLE]
ammo_flag:
db 0
1739
"One Hit Kill"
0
Byte
1hk_flag
1750
"My Health"
0
Byte
my_health_flag
1752
"Ammo"
0
Byte
ammo_flag
1728
"Witchfire to 1,000,000,000 on use"
FF00FF
Auto Assembler Script
{ Game : Witchfire-Win64-Shipping.exe
Version:
Date : 2025-09-15
Author : Mark
This script does blah blah blah
}
[ENABLE]
aobscanmodule(INJECT,Witchfire-Win64-Shipping.exe,41 8B 9C 06 98 02 00 00) // should be unique
alloc(newmem,$1000,INJECT)
label(code)
label(return)
newmem:
mov ebx,f423f
mov ebx,989680
mov ebx,3b9aca00
mov [r14+rax+00000298],ebx
code:
mov ebx,[r14+rax+00000298]
jmp return
INJECT:
jmp newmem
nop 3
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 41 8B 9C 06 98 02 00 00
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Witchfire-Win64-Shipping.exe+1878010
Witchfire-Win64-Shipping.exe+1877FE0: 49 63 45 00 - movsxd rax,dword ptr [r13+00]
Witchfire-Win64-Shipping.exe+1877FE4: 89 44 24 30 - mov [rsp+30],eax
Witchfire-Win64-Shipping.exe+1877FE8: 85 F6 - test esi,esi
Witchfire-Win64-Shipping.exe+1877FEA: 0F 88 B6 02 00 00 - js Witchfire-Win64-Shipping.exe+18782A6
Witchfire-Win64-Shipping.exe+1877FF0: 4C 69 F0 A0 02 00 00 - imul r14,rax,000002A0
Witchfire-Win64-Shipping.exe+1877FF7: 48 8B 87 58 02 00 00 - mov rax,[rdi+00000258]
Witchfire-Win64-Shipping.exe+1877FFE: 48 8D 54 24 40 - lea rdx,[rsp+40]
Witchfire-Win64-Shipping.exe+1878003: 89 8C 24 B8 00 00 00 - mov [rsp+000000B8],ecx
Witchfire-Win64-Shipping.exe+187800A: 44 8B FE - mov r15d,esi
Witchfire-Win64-Shipping.exe+187800D: 48 8B CF - mov rcx,rdi
// ---------- INJECTING HERE ----------
Witchfire-Win64-Shipping.exe+1878010: 41 8B 9C 06 98 02 00 00 - mov ebx,[r14+rax+00000298]
// ---------- DONE INJECTING ----------
Witchfire-Win64-Shipping.exe+1878018: 3B DE - cmp ebx,esi
Witchfire-Win64-Shipping.exe+187801A: 45 8B 84 06 78 02 00 00 - mov r8d,[r14+rax+00000278]
Witchfire-Win64-Shipping.exe+1878022: 44 0F 4E FB - cmovle r15d,ebx
Witchfire-Win64-Shipping.exe+1878026: 41 2B DF - sub ebx,r15d
Witchfire-Win64-Shipping.exe+1878029: E8 62 93 FD FF - call Witchfire-Win64-Shipping.exe+1851390
Witchfire-Win64-Shipping.exe+187802E: 8B 4C 24 40 - mov ecx,[rsp+40]
Witchfire-Win64-Shipping.exe+1878032: 33 D2 - xor edx,edx
Witchfire-Win64-Shipping.exe+1878034: E8 57 E6 52 00 - call Witchfire-Win64-Shipping.exe+1DA6690
Witchfire-Win64-Shipping.exe+1878039: 84 C0 - test al,al
Witchfire-Win64-Shipping.exe+187803B: 41 0F 94 C4 - sete r12b
}
1827
"1000 items after pressing TAB"
FF00FF
Auto Assembler Script
{ Game : Witchfire-Win64-Shipping.exe
Version:
Date : 2025-09-18
Author : Mark
This script does blah blah blah
}
[ENABLE]
aobscanmodule(INJECT,Witchfire-Win64-Shipping.exe,41 8B 84 00 98 02 00 00) // should be unique
alloc(newmem,$1000,INJECT)
label(code)
label(return)
label(dont_change)
newmem:
pushf
push rax
mov eax,[r8+rax+00000298]
cmp eax,(int)1000
pop rax
jg dont_change
ja dont_change
mov [r8+rax+00000298],(int)1000
dont_change:
popf
code:
mov eax,[r8+rax+00000298]
jmp return
INJECT:
jmp newmem
nop 3
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 41 8B 84 00 98 02 00 00
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Witchfire-Win64-Shipping.exe+185D0BF
Witchfire-Win64-Shipping.exe+185D09D: CC - int 3
Witchfire-Win64-Shipping.exe+185D09E: CC - int 3
Witchfire-Win64-Shipping.exe+185D09F: CC - int 3
Witchfire-Win64-Shipping.exe+185D0A0: 40 53 - push rbx
Witchfire-Win64-Shipping.exe+185D0A2: 48 83 EC 20 - sub rsp,20
Witchfire-Win64-Shipping.exe+185D0A6: 48 8B D9 - mov rbx,rcx
Witchfire-Win64-Shipping.exe+185D0A9: E8 E2 3D FF FF - call Witchfire-Win64-Shipping.exe+1850E90
Witchfire-Win64-Shipping.exe+185D0AE: 48 63 D0 - movsxd rdx,eax
Witchfire-Win64-Shipping.exe+185D0B1: 48 8B 83 58 02 00 00 - mov rax,[rbx+00000258]
Witchfire-Win64-Shipping.exe+185D0B8: 4C 69 C2 A0 02 00 00 - imul r8,rdx,000002A0
// ---------- INJECTING HERE ----------
Witchfire-Win64-Shipping.exe+185D0BF: 41 8B 84 00 98 02 00 00 - mov eax,[r8+rax+00000298]
// ---------- DONE INJECTING ----------
Witchfire-Win64-Shipping.exe+185D0C7: 48 83 C4 20 - add rsp,20
Witchfire-Win64-Shipping.exe+185D0CB: 5B - pop rbx
Witchfire-Win64-Shipping.exe+185D0CC: C3 - ret
Witchfire-Win64-Shipping.exe+185D0CD: CC - int 3
Witchfire-Win64-Shipping.exe+185D0CE: CC - int 3
Witchfire-Win64-Shipping.exe+185D0CF: CC - int 3
Witchfire-Win64-Shipping.exe+185D0D0: 4C 8B DC - mov r11,rsp
Witchfire-Win64-Shipping.exe+185D0D3: 49 89 6B 10 - mov [r11+10],rbp
Witchfire-Win64-Shipping.exe+185D0D7: 49 89 73 18 - mov [r11+18],rsi
Witchfire-Win64-Shipping.exe+185D0DB: 57 - push rdi
}