0
"Toggle Compact View"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not toggleCompactView then
function toggleCompactView(sender, forceEnable)
local isCompactMode = not (compactViewMenuItem.Caption == 'Compact View Mode')
if forceEnable ~= nil then
isCompactMode = not forceEnable
end
synchronize(function()
compactViewMenuItem.Caption = isCompactMode and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = isCompactMode
getMainForm().Panel4.Visible = isCompactMode
getMainForm().Panel5.Visible = isCompactMode
end)
end
end
if not createCompactViewMenu then
function createCompactViewMenu()
if isCompactMenuCreated then return end
synchronize(function()
local mainMenu = getMainForm().Menu.Items
compactViewMenuItem = createMenuItem(mainMenu)
compactViewMenuItem.Caption = 'Compact View Mode'
compactViewMenuItem.OnClick = toggleCompactView
mainMenu.add(compactViewMenuItem)
end)
isCompactMenuCreated = true
end
end
createCompactViewMenu()
toggleCompactView(nil, true)
[DISABLE]
{$lua}
if toggleCompactView then
toggleCompactView(nil, false)
end
2
"Toggle scripts"
4080FF
Auto Assembler Script
[ENABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local processName = "Hollow Knight Silksong.exe"
local pid = getProcessIDFromProcessName(processName)
if pid ~= nil and pid > 0 then
local currentPid = getOpenedProcessID() or 0
if currentPid ~= pid then
openProcess(processName)
print("Attached to: " .. processName)
sleep(300)
else
print("Already attached to: " .. processName)
end
end
synchronize(function()
getLuaEngine().Close()
end)
local enableBattleScripts = {
0, -- "Toggle Compact View"
1, -- "Enable mono"
3, -- "PlayerData"
1299, -- "HP no change (may die if get big damage)"
1300, -- "Max silk when get"
1301, -- "Silk no decrease when use"
1302, -- "Takes no damage, in general"
1304, -- "Not recommended:"
1309, -- "Try to keep sub weapon (i.e. Straight Pin) amount full"
1317, -- "inf. dart game retry"
1318, -- "Fast kill - multi hit attack"
1321, -- "Fast kill - general / single hit attack"
1324, -- "Get hero controller data"
1326, -- "Data"
2982, -- "Data+"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(enableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and not memRec.Active then
memRec.Active = true
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
[DISABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local disableBattleScripts = {
2982, -- "Data+"
1689, -- "Generate list ("base" must be non-zero)"
1326, -- "Data"
1307, -- "Takes no damage, type 2"
1694, -- "List layers"
1693, -- "Get hero Collider2D layer"
1685, -- "Get kill journal data"
1324, -- "Get hero controller data"
1321, -- "Fast kill - general / single hit attack"
1318, -- "Fast kill - multi hit attack"
1317, -- "inf. dart game retry"
1316, -- "Fast Sprint race win"
1309, -- "Try to keep sub weapon (i.e. Straight Pin) amount full"
1308, -- "Invulnerable - takes one more death attack"
1304, -- "Not recommended:"
1302, -- "Takes no damage, in general"
1301, -- "Silk no decrease when use"
1300, -- "Max silk when get"
1299, -- "HP no change (may die if get big damage)"
3, -- "PlayerData"
1691, -- "Hollow Knight: Silksong / https://opencheattables.com"
1, -- "Enable mono"
0, -- "Toggle Compact View"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(disableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and memRec.Active then
memRec.Active = false
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
-- Comments:
-- ID: 0, Description: "Toggle Compact View", Depth: 0
-- ID: 1, Description: "Enable mono", Depth: 0
-- ID: 3, Description: "PlayerData", Depth: 1
-- ID: 2982, Description: "Data+", Depth: 2
-- ID: 2983, Description: "Others", Depth: 3
-- ID: 1299, Description: "HP no change (may die if get big damage)", Depth: 1
-- ID: 1300, Description: "Max silk when get", Depth: 1
-- ID: 1301, Description: "Silk no decrease when use", Depth: 1
-- ID: 1302, Description: "Takes no damage, in general", Depth: 1
-- ID: 1304, Description: "Not recommended:", Depth: 1
-- ID: 1307, Description: "Takes no damage, type 2", Depth: 2
-- ID: 1308, Description: "Invulnerable - takes one more death attack", Depth: 1
-- ID: 1309, Description: "Try to keep sub weapon (i.e. Straight Pin) amount full", Depth: 1
-- ID: 1316, Description: "Fast Sprint race win", Depth: 1
-- ID: 1317, Description: "inf. dart game retry", Depth: 1
-- ID: 1318, Description: "Fast kill - multi hit attack", Depth: 1
-- ID: 1321, Description: "Fast kill - general / single hit attack", Depth: 1
-- ID: 1324, Description: "Get hero controller data", Depth: 1
-- ID: 1326, Description: "Data", Depth: 2
-- ID: 1685, Description: "Get kill journal data", Depth: 1
-- ID: 1689, Description: "Generate list ("base" must be non-zero)", Depth: 2
-- ID: 1691, Description: "Hollow Knight: Silksong / https://opencheattables.com", Depth: 0
-- ID: 1693, Description: "Get hero Collider2D layer", Depth: 1
-- ID: 1694, Description: "List layers", Depth: 1
1
"Enable mono"
Auto Assembler Script
[ENABLE]
{$asm}
{
define(ResourceManagerClearItemCountsProc, "ResourceManager.ClearItemCounts")
registersymbol(ResourceManagerClearItemCountsProc)
}
{$lua}
if syntaxcheck then return end
-- 📏 SafeMonoDestroy: Clean up all Mono-related state
if _G.SafeMonoDestroy == nil then
_G.SafeMonoDestroy = function()
print("🪚 SafeMonoDestroy: Begin cleanup...")
-- 1. Stop symbol enumeration thread if running
if monoSymbolEnum then
print("🚬 Terminating monoSymbolEnum thread...")
pcall(function()
monoSymbolEnum.terminate()
if not monoSymbolEnum.waitfor(3000) then
print("⚠ Timeout: monoSymbolEnum didn't terminate in time")
end
monoSymbolEnum.destroy()
monoSymbolEnum = nil
end)
end
-- 2. Stop progressbar timer
if monoSymbolList and monoSymbolList.progressbar then
monoSymbolList.progressbar.OnTimer = nil
end
-- 3. Unlock pipe (try unlock even if uncertain)
print("🔓 Attempting to unlock pipe...")
pcall(function()
if monopipe and monopipe.unlock then
monopipe.unlock()
end
end)
-- 4. Delay before destroy to let MonoCollector finish its work
print("⌛ Waiting before destroy (sleep 250ms)...")
sleep(250) -- let it flush pipe state
-- 5. Destroy main pipe
local t0 = os.clock()
print(string.format("🚨 Destroying monopipe，This may take several minutes (or longer)👺👺👺... [Start: %.3fs]", t0))
pcall(function()
if monopipe then
monopipe.destroy()
monopipe = nil
end
end)
local t1 = os.clock()
print(string.format("👻 monopipe.destroy() completed [End: %.3fs | Duration: %.3fs]", t1, t1 - t0))
-- 6. Destroy symbol list
if monoSymbolList then
monoSymbolList.destroy()
monoSymbolList = nil
end
-- 7. Destroy event pipe if exists
if monoeventpipe then
monoeventpipe.destroy()
monoeventpipe = nil
end
print("👻 SafeMonoDestroy: Cleanup complete.")
end
end
-- 📏 Register symbol by parameter type array (exact match)
if _G.mono_registerSymbolEx == nil then
_G.mono_registerSymbolEx = function(symbolname, namespace, classname, methodname, paramTypes)
local cls = mono_findClass(namespace, classname)
if not cls then
print(string.format("💔 Error: Class not found - %s.%s", namespace, classname))
return
end
local methods = mono_class_enumMethods(cls)
for _, m in ipairs(methods) do
if m.name == methodname then
local p = mono_method_get_parameters(m.method)
local matched = true
if #p.parameters ~= #paramTypes then
matched = false
else
for i = 1, #paramTypes do
if not string.find(p.parameters[i].typename, paramTypes[i], 1, true) then
matched = false
break
end
end
end
if matched then
local addr = mono_compile_method(m.method)
if addr == 0 then
print("💔 Error: Method found but failed to compile.")
return
end
registerSymbol(symbolname, addr)
print(string.format("🪧 Symbol registered: %s = %X", symbolname, addr))
return
end
end
end
print(string.format("💔 Error: No matching method found - %s.%s.%s", namespace, classname, methodname))
end
end
-- 📏 Register symbol by partial signature match (overload-safe, with excludes and match info)
if _G.mono_registerSymbolBySignatureMatch == nil then
_G.mono_registerSymbolBySignatureMatch = function(symbolname, namespace, classname, methodname, sigContains, sigExcludes)
local cls = mono_findClass(namespace, classname)
if not cls then
print(string.format("💔 Error: Class not found - %s.%s", namespace, classname))
return
end
local methods = mono_class_enumMethods(cls)
if not methods then
print(string.format("💔 Error: No methods found in %s.%s", namespace, classname))
return
end
for _, m in ipairs(methods) do
if m.name == methodname then
local sig = mono_method_getSignature(m.method)
local matched = true
-- Check required substrings
for _, kw in ipairs(sigContains) do
if not string.find(sig, kw, 1, true) then
matched = false
break
end
end
-- Check excluded substrings (if given)
if matched and sigExcludes then
for _, ex in ipairs(sigExcludes) do
if string.find(sig, ex, 1, true) then
matched = false
break
end
end
end
if matched then
local addr = mono_compile_method(m.method)
if addr == 0 then
print("💔 Error: Signature matched but failed to compile method.")
return
end
registerSymbol(symbolname, addr)
print(string.format("🪧 Symbol registered: %s = %X", symbolname, addr))
print(string.format("🔎 Matched Signature: %s", sig))
return
end
end
end
print(string.format("💔 Error: No matching signature found - %s.%s.%s", namespace, classname, methodname))
end
end
-- 📏 Register symbol by simple method name (first match)
if _G.mono_registerSymbol == nil then
_G.mono_registerSymbol = function(symbolname, namespace, classname, methodname)
local m = mono_findMethod(namespace, classname, methodname)
if m == nil or m == 0 then
print(string.format("💔 Error: Method not found - %s.%s.%s", namespace, classname, methodname))
return
end
local addr = mono_compile_method(m)
if addr == 0 then
print(string.format("💔 Error: Could not compile method - %s.%s.%s", namespace, classname, methodname))
return
end
registerSymbol(symbolname, addr)
print(string.format("🪧 Symbol registered: %s = %X", symbolname, addr))
end
end
-- 🌀 Attach Mono if needed
local pid = getOpenedProcessID()
if pid == 0 then
print("⚠ Warning: No process is currently open.")
return
end
if _G.lastMonoPID == nil then _G.lastMonoPID = -1 end
if monopipe == nil or _G.lastMonoPID ~= pid then
if monopipe ~= nil then
pcall(_G.SafeMonoDestroy)
end
pcall(LaunchMonoDataCollector)
_G.lastMonoPID = pid
end
-- ⚡ Example usage - Register Mono methods to CE symbol table
-- These functions compile (JIT) a Mono method and register it as a CE symbol
-- 🔹 1. mono_registerSymbol(symbolname, namespace, classname, methodname)
-- Description: Registers the first matched method with given name.
-- ⚠ Use this only when there's no overload (or you're fine with the first one).
-- Params:
-- symbolname: The name you want to register (used in CE as a label)
-- namespace: Mono namespace of the class (can be "" if none)
-- classname: Class name that contains the method
-- methodname: Method name to find (first match will be used)
-- Example:
--_G.mono_registerSymbol("MyAttack", "Game.Logic", "BattleManager", "Attack")
--_G.mono_registerSymbol("UseAbility_Any", "Elin", "Chara", "UseAbility")
-- 🔹 2. mono_registerSymbolEx(symbolname, namespace, classname, methodname, paramTypes)
-- Description: Registers a method that exactly matches the provided parameter types.
-- Use this when there are multiple overloads of a method.
-- Params:
-- symbolname: The name to register
-- namespace: Mono namespace
-- classname: Class name
-- methodname: Method name (exact match)
-- paramTypes: Array of expected parameter type strings (must match count & order)
-- These are matched using `string.find`, so partial match is allowed.
-- Example:
-- UseAbility(string idAct, Card tc, Point pos, bool pt)
--[[
_G.mono_registerSymbolEx("UseAbility_Exact", "Elin", "Chara", "UseAbility", {
"System.String", "Card", "Point", "System.Boolean"
})
--]]
-- 🔹 3. mono_registerSymbolBySignatureMatch(symbolname, namespace, classname, methodname, sigContains, sigExcludes)
-- Description: Registers the method whose signature contains all given substrings.
-- Flexible, and suitable when exact type names vary or signature format is uncertain.
-- Params:
-- symbolname: The symbol name to register
-- namespace: Mono namespace
-- classname: Class name
-- methodname: Method name (will scan all overloads)
-- sigContains: Array of strings that should all appear in the method signature
-- e.g., { "Act", "Card", "Point", "bool" }
-- sigExcludes: Signatures to exclude
-- Example:
-- Will match method like: UseAbility(Act a, Card tc, Point pos, bool pt)
--[[
_G.mono_registerSymbolBySignatureMatch("UseAbility_Act", "Elin", "Chara", "UseAbility", {
"Act", "Card", "Point", "bool"
})
_G.mono_registerSymbolBySignatureMatch("GetItemCount_Item", "Assembly-CSharp", "ItemStorage", "GetItemCount",
{"Item"}, -- sigContains
{"List"} -- sigExcludes
)
Signatures above:
System.Collections.Generic.List<Item>
Item
** Both have "Item" but first one have "List"
--]]
--[[
Type Mapping (for overload filtering)
-------------------------------------
String System.String C#: string
int System.Int32 C#: int
float System.Single C#: float
bool System.Boolean C#: bool
Vector3 UnityEngine.Vector3
Color UnityEngine.Color
Point (Game defined)
Card (Game defined)
Act (Game defined)
--]]
[DISABLE]
{$lua}
if syntaxcheck then return end
--pcall(_G.SafeMonoDestroy)
{$asm}
//unregistersymbol(*)
3
"PlayerData"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-05
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_GET_PLAYER_DATA,HeroAnimationController:IsHurt+f,HeroAnimationController:IsHurt+1f,48 63 80 24 02 00 00) // should be unique
alloc(newmem,$1000,INJECT_GET_PLAYER_DATA)
label(code)
label(return i_base_playerdata_addr)
newmem:
cmp rax, [i_base_playerdata_addr]
je code
mov [i_base_playerdata_addr], rax
code:
movsxd rax,dword ptr [rax+00000224]
jmp return
align 10 cc
i_base_playerdata_addr:
dq 0
INJECT_GET_PLAYER_DATA:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_PLAYER_DATA i_base_playerdata_addr)
[DISABLE]
INJECT_GET_PLAYER_DATA:
db 48 63 80 24 02 00 00
unregistersymbol(INJECT_GET_PLAYER_DATA i_base_playerdata_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: HeroAnimationController:IsHurt+f
253F39238B5: 00 00 - add [rax],al
253F39238B7: 00 00 - add [rax],al
253F39238B9: 00 00 - add [rax],al
253F39238BB: 00 00 - add [rax],al
253F39238BD: 00 00 - add [rax],al
253F39238BF: 00 48 83 - add [rax-7D],cl
HeroAnimationController:IsHurt+2: EC - in al,dx
HeroAnimationController:IsHurt+3: 08 48 89 - or [rax-77],cl
HeroAnimationController:IsHurt+6: 34 24 - xor al,24
HeroAnimationController:IsHurt+8: 48 8B F1 - mov rsi,rcx
// ---------- INJECTING HERE ----------
HeroAnimationController:IsHurt+b: 48 8B 46 40 - mov rax,[rsi+40]
// ---------- DONE INJECTING ----------
HeroAnimationController:IsHurt+f: 48 63 80 24 02 00 00 - movsxd rax,dword ptr [rax+00000224]
HeroAnimationController:IsHurt+16: 83 F8 01 - cmp eax,01
HeroAnimationController:IsHurt+19: 75 10 - jne HeroAnimationController:IsHurt+2b
HeroAnimationController:IsHurt+1b: 48 8B 46 40 - mov rax,[rsi+40]
HeroAnimationController:IsHurt+1f: 48 63 80 30 02 00 00 - movsxd rax,dword ptr [rax+00000230]
HeroAnimationController:IsHurt+26: 83 F8 01 - cmp eax,01
HeroAnimationController:IsHurt+29: 7C 27 - jl HeroAnimationController:IsHurt+52
HeroAnimationController:IsHurt+2b: 0F B6 86 51 01 00 00 - movzx eax,byte ptr [rsi+00000151]
HeroAnimationController:IsHurt+32: 85 C0 - test eax,eax
HeroAnimationController:IsHurt+34: 75 1C - jne HeroAnimationController:IsHurt+52
}
2982
"Data+"
1
1695
"profileID"
FF8080
4 Bytes
[i_base_playerdata_addr]+1F4
1696
"playTime"
FF8080
Float
[i_base_playerdata_addr]+1F8
1943
"isInvincible"
infiniteAirJump
FF8080
Byte
[i_base_playerdata_addr]+3D7
1944
"infiniteAirJump"
0:No
1:Yes
FF80FF
Byte
[i_base_playerdata_addr]+3D8
1697
"openingCreditsPlayed"
FF8080
Byte
[i_base_playerdata_addr]+1FC
1698
"permadeathMode"
FF8080
4 Bytes
[i_base_playerdata_addr]+200
1699
"CollectedDockDemoKey"
FF8080
Byte
[i_base_playerdata_addr]+204
1700
"HasStoredMemoryState"
FF8080
Byte
[i_base_playerdata_addr]+220
1701
"health"
FF8080
4 Bytes
[i_base_playerdata_addr]+224
1702
"maxHealth"
FF8080
4 Bytes
[i_base_playerdata_addr]+228
1703
"maxHealthBase"
FF8080
4 Bytes
[i_base_playerdata_addr]+22C
1704
"healthBlue"
FF8080
4 Bytes
[i_base_playerdata_addr]+230
1705
"damagedBlue"
FF8080
Byte
[i_base_playerdata_addr]+234
1706
"damagedPurple"
FF8080
Byte
[i_base_playerdata_addr]+235
1707
"prevHealth"
FF8080
4 Bytes
[i_base_playerdata_addr]+238
1708
"heartPieces"
FF8080
4 Bytes
[i_base_playerdata_addr]+23C
1709
"SeenBindPrompt"
FF8080
Byte
[i_base_playerdata_addr]+240
1710
"geo / ロザリー"
FF8080
4 Bytes
[i_base_playerdata_addr]+244
2944
"ShellShards"
FF8080
4 Bytes
[i_base_playerdata_addr]+910
1711
"silk"
FF8080
4 Bytes
[i_base_playerdata_addr]+248
1712
"silkMax"
FF8080
4 Bytes
[i_base_playerdata_addr]+24C
1713
"silkRegenMax"
FF8080
4 Bytes
[i_base_playerdata_addr]+250
1714
"silkParts"
FF8080
4 Bytes
[i_base_playerdata_addr]+254
1715
"IsSilkSpoolBroken"
FF8080
Byte
[i_base_playerdata_addr]+258
1716
"UnlockSilkFinalCutscene"
FF8080
Byte
[i_base_playerdata_addr]+259
1717
"silkSpoolParts"
FF8080
4 Bytes
[i_base_playerdata_addr]+25C
1718
"atBench"
FF8080
Byte
[i_base_playerdata_addr]+260
1719
"mapZone"
FF8080
4 Bytes
[i_base_playerdata_addr]+264
1720
"extraRestZone"
FF8080
4 Bytes
[i_base_playerdata_addr]+268
1299
"HP no change (may die if get big damage)"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-05
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_HP_NO_CHG,PlayerData:TakeHealth+27a,PlayerData:TakeHealth+2Aa,41 2B C7 41 89 86) // should be unique
INJECT_HP_NO_CHG:
nop 3
registersymbol(INJECT_HP_NO_CHG)
[DISABLE]
INJECT_HP_NO_CHG:
db 41 2B C7
unregistersymbol(INJECT_HP_NO_CHG)
{
// ORIGINAL CODE - INJECTION POINT: PlayerData:TakeHealth+281
PlayerData:TakeHealth+254: 7F 24 - jg PlayerData:TakeHealth+27a
PlayerData:TakeHealth+256: 48 B8 58 3F B0 0A A8 01 00 00 - mov rax,000001A80AB03F58
PlayerData:TakeHealth+260: 48 63 10 - movsxd rdx,dword ptr [rax]
PlayerData:TakeHealth+263: B9 01 00 00 00 - mov ecx,00000001
PlayerData:TakeHealth+268: 33 C0 - xor eax,eax
PlayerData:TakeHealth+26a: 83 FA 03 - cmp edx,03
PlayerData:TakeHealth+26d: 48 0F 44 C1 - cmove rax,rcx
PlayerData:TakeHealth+271: 41 89 86 1C 02 00 00 - mov [r14+0000021C],eax
PlayerData:TakeHealth+278: EB 11 - jmp PlayerData:TakeHealth+28b
PlayerData:TakeHealth+27a: 49 63 86 1C 02 00 00 - movsxd rax,dword ptr [r14+0000021C]
// ---------- INJECTING HERE ----------
PlayerData:TakeHealth+281: 41 2B C7 - sub eax,r15d
// ---------- DONE INJECTING ----------
PlayerData:TakeHealth+284: 41 89 86 1C 02 00 00 - mov [r14+0000021C],eax
PlayerData:TakeHealth+28b: 48 8B 75 D8 - mov rsi,[rbp-28]
PlayerData:TakeHealth+28f: 4C 8B 65 E0 - mov r12,[rbp-20]
PlayerData:TakeHealth+293: 4C 8B 6D E8 - mov r13,[rbp-18]
PlayerData:TakeHealth+297: 4C 8B 75 F0 - mov r14,[rbp-10]
PlayerData:TakeHealth+29b: 4C 8B 7D F8 - mov r15,[rbp-08]
PlayerData:TakeHealth+29f: 48 8D 65 00 - lea rsp,[rbp+00]
PlayerData:TakeHealth+2a3: 5D - pop rbp
PlayerData:TakeHealth+2a4: C3 - ret
1A6A481B805: 00 00 - add [rax],al
}
1300
"Max silk when get"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-05
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_ONE_HIT_MAX_SILK,PlayerData:AddSilk+27,PlayerData:AddSilk+47,89 87 48 02 00 00) // should be unique
alloc(newmem,$1000,INJECT_ONE_HIT_MAX_SILK)
label(code)
label(return)
newmem:
mov eax, [rdi+0000024c]
code:
mov [rdi+00000248],eax
jmp return
INJECT_ONE_HIT_MAX_SILK:
jmp newmem
nop
return:
registersymbol(INJECT_ONE_HIT_MAX_SILK)
[DISABLE]
INJECT_ONE_HIT_MAX_SILK:
db 89 87 48 02 00 00
unregistersymbol(INJECT_ONE_HIT_MAX_SILK)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: PlayerData:AddSilk+29
PlayerData:AddSilk+1: 48 8B EC - mov rbp,rsp
PlayerData:AddSilk+4: 48 83 EC 40 - sub rsp,40
PlayerData:AddSilk+8: 48 89 75 F0 - mov [rbp-10],rsi
PlayerData:AddSilk+c: 48 89 7D F8 - mov [rbp-08],rdi
PlayerData:AddSilk+10: 48 8B F9 - mov rdi,rcx
PlayerData:AddSilk+13: 48 8B F2 - mov rsi,rdx
PlayerData:AddSilk+16: 48 63 87 48 02 00 00 - movsxd rax,dword ptr [rdi+00000248]
PlayerData:AddSilk+1d: 89 45 E8 - mov [rbp-18],eax
PlayerData:AddSilk+20: 48 63 87 48 02 00 00 - movsxd rax,dword ptr [rdi+00000248]
PlayerData:AddSilk+27: 03 C6 - add eax,esi
// ---------- INJECTING HERE ----------
PlayerData:AddSilk+29: 89 87 48 02 00 00 - mov [rdi+00000248],eax
// ---------- DONE INJECTING ----------
PlayerData:AddSilk+2f: 48 8B CF - mov rcx,rdi
PlayerData:AddSilk+32: 48 8D 6D 00 - lea rbp,[rbp+00]
PlayerData:AddSilk+36: 49 BB D0 3D BF E7 53 02 00 00 - mov r11,PlayerData:get_CurrentSilkMax
PlayerData:AddSilk+40: 41 FF D3 - call r11
PlayerData:AddSilk+43: 48 8B F0 - mov rsi,rax
PlayerData:AddSilk+46: 48 63 87 48 02 00 00 - movsxd rax,dword ptr [rdi+00000248]
PlayerData:AddSilk+4d: 3B C6 - cmp eax,esi
PlayerData:AddSilk+4f: 7C 10 - jl PlayerData:AddSilk+61
PlayerData:AddSilk+51: C7 87 54 02 00 00 00 00 00 00 - mov [rdi+00000254],00000000
PlayerData:AddSilk+5b: 89 B7 48 02 00 00 - mov [rdi+00000248],esi
}
1301
"Silk no decrease when use"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-05
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_INF_SILK,PlayerData:TakeSilk+1d,PlayerData:TakeSilk+3d,89 87 48 02 00 00) // should be unique
alloc(newmem,$1000,INJECT_INF_SILK)
label(code)
label(return)
newmem:
mov eax, [rdi+0000024C]
code:
mov [rdi+00000248],eax
jmp return
INJECT_INF_SILK:
jmp newmem
nop
return:
registersymbol(INJECT_INF_SILK)
[DISABLE]
INJECT_INF_SILK:
db 89 87 48 02 00 00
unregistersymbol(INJECT_INF_SILK)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: PlayerData:TakeSilk+22
253E7C4F11E: 00 00 - add [rax],al
PlayerData:TakeSilk: 48 83 EC 18 - sub rsp,18
PlayerData:TakeSilk+4: 48 89 3C 24 - mov [rsp],rdi
PlayerData:TakeSilk+8: 48 8B F9 - mov rdi,rcx
PlayerData:TakeSilk+b: 48 89 54 24 08 - mov [rsp+08],rdx
PlayerData:TakeSilk+10: 48 63 87 48 02 00 00 - movsxd rax,dword ptr [rdi+00000248]
PlayerData:TakeSilk+17: 2B 44 24 08 - sub eax,[rsp+08]
PlayerData:TakeSilk+1b: 33 C9 - xor ecx,ecx
PlayerData:TakeSilk+1d: 3B C1 - cmp eax,ecx
PlayerData:TakeSilk+1f: 0F 4C C1 - cmovl eax,ecx
// ---------- INJECTING HERE ----------
PlayerData:TakeSilk+22: 89 87 48 02 00 00 - mov [rdi+00000248],eax
// ---------- DONE INJECTING ----------
PlayerData:TakeSilk+28: 48 8B 3C 24 - mov rdi,[rsp]
PlayerData:TakeSilk+2c: 48 83 C4 18 - add rsp,18
PlayerData:TakeSilk+30: C3 - ret
253E7C4F151: 00 00 - add [rax],al
253E7C4F153: 00 00 - add [rax],al
253E7C4F155: 00 00 - add [rax],al
253E7C4F157: 00 01 - add [rcx],al
253E7C4F159: 04 01 - add al,01
253E7C4F15B: 00 04 22 - add [rdx],al
253E7C4F15E: 00 00 - add [rax],al
}
1302
"Takes no damage, in general"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-06
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_SET_CAN_DAMAGE,DamageHero:get_CanCauseDamage+3f,DamageHero:get_CanCauseDamage+6f,40 0F 94 C0 48 0F B6 C0) // should be unique
INJECT_SET_CAN_DAMAGE:
db 48 31 c0
nop 5
registersymbol(INJECT_SET_CAN_DAMAGE)
[DISABLE]
INJECT_SET_CAN_DAMAGE:
db 40 0F 94 C0 48 0F B6 C0
unregistersymbol(INJECT_SET_CAN_DAMAGE)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: DamageHero:get_CanCauseDamage+3f
DamageHero:get_CanCauseDamage+16: 49 BB 10 29 C8 B6 F5 01 00 00 - mov r11,UnityEngine.Time:get_timeAsDouble
DamageHero:get_CanCauseDamage+20: 41 FF D3 - call r11
DamageHero:get_CanCauseDamage+23: F2 0F 10 8E D0 00 00 00 - movsd xmm1,[rsi+000000D0]
DamageHero:get_CanCauseDamage+2b: 48 33 C0 - xor rax,rax
DamageHero:get_CanCauseDamage+2e: 66 0F 2F C8 - comisd xmm1,xmm0
DamageHero:get_CanCauseDamage+32: 7A 06 - jp DamageHero:get_CanCauseDamage+3a
DamageHero:get_CanCauseDamage+34: 40 0F 97 C0 - seta al
DamageHero:get_CanCauseDamage+38: EB 03 - jmp DamageHero:get_CanCauseDamage+3d
DamageHero:get_CanCauseDamage+3a: 48 FF C0 - inc rax
DamageHero:get_CanCauseDamage+3d: 85 C0 - test eax,eax
// ---------- INJECTING HERE ----------
DamageHero:get_CanCauseDamage+3f: 40 0F 94 C0 - sete al
// ---------- DONE INJECTING ----------
DamageHero:get_CanCauseDamage+43: 48 0F B6 C0 - movzx rax,al
DamageHero:get_CanCauseDamage+47: 48 8B 75 F8 - mov rsi,[rbp-08]
DamageHero:get_CanCauseDamage+4b: 48 8D 65 00 - lea rsp,[rbp+00]
DamageHero:get_CanCauseDamage+4f: 5D - pop rbp
DamageHero:get_CanCauseDamage+50: C3 - ret
1F66604A8B1: 00 00 - add [rax],al
1F66604A8B3: 00 00 - add [rax],al
1F66604A8B5: 00 00 - add [rax],al
1F66604A8B7: 00 01 - add [rcx],al
1F66604A8B9: 04 02 - add al,02
}
1303
"Disable when hero must die"
8000FF
1
1304
"Not recommended:"
1
1305
"Will not die in traps, but may stuck there"
8000FF
1
1306
"Disable this script when stucked"
8000FF
1
1307
"Takes no damage, type 2"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-09
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_HERO_TAKE_DAMAGE,HeroController:TakeDamage,HeroController:TakeDamage+10,55 48 8B EC) // should be unique
INJECT_HERO_TAKE_DAMAGE:
ret
registersymbol(INJECT_HERO_TAKE_DAMAGE)
[DISABLE]
INJECT_HERO_TAKE_DAMAGE:
db 55
unregistersymbol(INJECT_HERO_TAKE_DAMAGE)
{
// ORIGINAL CODE - INJECTION POINT: HeroController:TakeDamage
HutongGames.PlayMaker.Actions.DamageHeroDirectly:OnEnter+2ab: 5D - pop rbp
HutongGames.PlayMaker.Actions.DamageHeroDirectly:OnEnter+2ac: C3 - ret
170530AD53D: 00 00 - add [rax],al
170530AD53F: 00 01 - add [rcx],al
170530AD541: 04 02 - add al,02
170530AD543: 05 04 03 01 50 - add eax,50010304
170530AD548: 00 00 - add [rax],al
170530AD54A: 00 00 - add [rax],al
170530AD54C: 00 00 - add [rax],al
170530AD54E: 00 00 - add [rax],al
// ---------- INJECTING HERE ----------
HeroController:TakeDamage: 55 - push rbp
// ---------- DONE INJECTING ----------
HeroController:TakeDamage+1: 48 8B EC - mov rbp,rsp
HeroController:TakeDamage+4: 48 81 EC 40 05 00 00 - sub rsp,00000540
HeroController:TakeDamage+b: 48 89 5D D0 - mov [rbp-30],rbx
HeroController:TakeDamage+f: 48 89 75 D8 - mov [rbp-28],rsi
HeroController:TakeDamage+13: 48 89 7D E0 - mov [rbp-20],rdi
HeroController:TakeDamage+17: 4C 89 65 E8 - mov [rbp-18],r12
HeroController:TakeDamage+1b: 4C 89 6D F0 - mov [rbp-10],r13
HeroController:TakeDamage+1f: 4C 89 7D F8 - mov [rbp-08],r15
HeroController:TakeDamage+23: 4C 8B E1 - mov r12,rcx
HeroController:TakeDamage+26: 4C 8B EA - mov r13,rdx
}
1308
"Invulnerable - takes one more death attack"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-09
Author :
}
[ENABLE]
aobscanregion(INJECT_SET_INVUL,HeroControllerStates:get_Invulnerable+b,HeroControllerStates:get_Invulnerable+1b,0F B6 46 53 85 C0) // should be unique
alloc(newmem,$1000,INJECT_SET_INVUL)
label(code)
label(return)
newmem:
mov byte ptr [rsi+53], 1
mov byte ptr [rsi+54], 0
code:
movzx eax,byte ptr [rsi+53]
test eax,eax
jmp return
INJECT_SET_INVUL:
jmp newmem
nop
return:
registersymbol(INJECT_SET_INVUL)
[DISABLE]
INJECT_SET_INVUL:
db 0F B6 46 53 85 C0
unregistersymbol(INJECT_SET_INVUL)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: HeroControllerStates:get_Invulnerable+b
170530AA582: 00 00 - add [rax],al
170530AA584: 00 00 - add [rax],al
170530AA586: 00 00 - add [rax],al
170530AA588: 00 00 - add [rax],al
170530AA58A: 00 00 - add [rax],al
170530AA58C: 00 00 - add [rax],al
170530AA58E: 00 00 - add [rax],al
HeroControllerStates:get_Invulnerable: 48 83 EC 08 - sub rsp,08
HeroControllerStates:get_Invulnerable+4: 48 89 34 24 - mov [rsp],rsi
HeroControllerStates:get_Invulnerable+8: 48 8B F1 - mov rsi,rcx
// ---------- INJECTING HERE ----------
HeroControllerStates:get_Invulnerable+b: 0F B6 46 53 - movzx eax,byte ptr [rsi+53]
// ---------- DONE INJECTING ----------
HeroControllerStates:get_Invulnerable+f: 85 C0 - test eax,eax
HeroControllerStates:get_Invulnerable+11: 75 10 - jne HeroControllerStates:get_Invulnerable+23
HeroControllerStates:get_Invulnerable+13: 48 63 46 54 - movsxd rax,dword ptr [rsi+54]
HeroControllerStates:get_Invulnerable+17: 85 C0 - test eax,eax
HeroControllerStates:get_Invulnerable+19: 40 0F 9F C0 - setg al
HeroControllerStates:get_Invulnerable+1d: 48 0F B6 C0 - movzx rax,al
HeroControllerStates:get_Invulnerable+21: EB 05 - jmp HeroControllerStates:get_Invulnerable+28
HeroControllerStates:get_Invulnerable+23: B8 01 00 00 00 - mov eax,00000001
HeroControllerStates:get_Invulnerable+28: 48 8B 34 24 - mov rsi,[rsp]
HeroControllerStates:get_Invulnerable+2c: 48 83 C4 08 - add rsp,08
}
1309
"Try to keep sub weapon (i.e. Straight Pin) amount full"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-06
Author : bbfox@https://openchetatables.com
}
[ENABLE]
aobscanregion(INJECT_SET_TOOLS_CNT,PlayerData:SetToolData+8c,PlayerData:SetToolData+bc,89 4D EC 48 8B C8) // should be unique
alloc(newmem,$1000,INJECT_SET_TOOLS_CNT)
label(code)
label(return)
label(i_cur_tool_amount i_cur_tool_amount2 i_cur_tool_amount3 i_cur_tool_amount4 i_cur_tool_amount5)
newmem:
push r15
mov r15d, [i_cur_tool_amount]
dec r15d
cmp ecx, r15d
je set_value
mov r15d, [i_cur_tool_amount2]
dec r15d
cmp ecx, r15d
je set_value
mov r15d, [i_cur_tool_amount3]
dec r15d
cmp ecx, r15d
je set_value
mov r15d, [i_cur_tool_amount4]
dec r15d
cmp ecx, r15d
je set_value
mov r15d, [i_cur_tool_amount5]
dec r15d
cmp ecx, r15d
je set_value
jmp endp
set_value:
//inc ecx
mov ecx, 40
//mov ecx, C
mov [rbp-24], ecx
endp:
pop r15
code:
mov [rbp-14],ecx
mov rcx,rax
jmp return
align 10 cc
i_cur_tool_amount:
dd C
i_cur_tool_amount2:
dd 6
i_cur_tool_amount3:
dd 3
i_cur_tool_amount4:
dd A
i_cur_tool_amount5:
dd 7
INJECT_SET_TOOLS_CNT:
jmp newmem
nop
return:
registersymbol(INJECT_SET_TOOLS_CNT i_cur_tool_amount i_cur_tool_amount2 i_cur_tool_amount3 i_cur_tool_amount4 i_cur_tool_amount5)
[DISABLE]
INJECT_SET_TOOLS_CNT:
db 89 4D EC 48 8B C8
unregistersymbol(INJECT_SET_TOOLS_CNT i_cur_tool_amount i_cur_tool_amount2 i_cur_tool_amount3 i_cur_tool_amount4 i_cur_tool_amount5)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: PlayerData:SetToolData+9c
PlayerData:SetToolData+70: 83 38 00 - cmp dword ptr [rax],00
PlayerData:SetToolData+73: 66 66 90 - nop 3
PlayerData:SetToolData+76: 49 BB D9 B5 23 02 32 02 00 00 - mov r11,000002320223B5D9
PlayerData:SetToolData+80: 41 FF D3 - call r11
PlayerData:SetToolData+83: 48 63 45 E4 - movsxd rax,dword ptr [rbp-1C]
PlayerData:SetToolData+87: 89 45 DC - mov [rbp-24],eax
PlayerData:SetToolData+8a: 48 8B 87 A0 01 00 00 - mov rax,[rdi+000001A0]
PlayerData:SetToolData+91: 48 63 4D D8 - movsxd rcx,dword ptr [rbp-28]
PlayerData:SetToolData+95: 89 4D E8 - mov [rbp-18],ecx
PlayerData:SetToolData+98: 48 63 4D DC - movsxd rcx,dword ptr [rbp-24]
// ---------- INJECTING HERE ----------
PlayerData:SetToolData+9c: 89 4D EC - mov [rbp-14],ecx
// ---------- DONE INJECTING ----------
PlayerData:SetToolData+9f: 48 8B C8 - mov rcx,rax
PlayerData:SetToolData+a2: 48 8B D6 - mov rdx,rsi
PlayerData:SetToolData+a5: 4C 8B 45 E8 - mov r8,[rbp-18]
PlayerData:SetToolData+a9: 83 38 00 - cmp dword ptr [rax],00
PlayerData:SetToolData+ac: 66 90 - nop 2
PlayerData:SetToolData+ae: 49 BB 10 8F 27 CB 30 02 00 00 - mov r11,SerializableNamedList`2[ToolItemsData+Data,ToolItemsData+NamedData]:SetData
PlayerData:SetToolData+b8: 41 FF D3 - call r11
PlayerData:SetToolData+bb: 48 8B 75 F0 - mov rsi,[rbp-10]
PlayerData:SetToolData+bf: 48 8B 7D F8 - mov rdi,[rbp-08]
PlayerData:SetToolData+c3: 48 8D 65 00 - lea rsp,[rbp+00]
}
1310
"only works if cur. amount = settings below"
8000FF
1
1311
"Current amount #1"
6:6
12:12
0
C08000
4 Bytes
i_cur_tool_amount
1312
"Current amount #2"
0
C08000
4 Bytes
i_cur_tool_amount2
1313
"Current amount #3"
0
C08000
4 Bytes
i_cur_tool_amount3
1314
"Current amount #4"
0
C08000
4 Bytes
i_cur_tool_amount4
1315
"Current amount #5"
0
C08000
4 Bytes
i_cur_tool_amount5
1316
"Fast Sprint race win"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-07
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_FAST_SPRINT_RACE_WIN,SprintRaceController:ReportHeroLapMarkerHit+d1,SprintRaceController:ReportHeroLapMarkerHit+f1,49 63 46 74 FF C0) // should be unique
alloc(newmem,$1000,INJECT_FAST_SPRINT_RACE_WIN)
label(code)
label(return)
newmem:
code:
//movsxd rax,dword ptr [r14+74]
//inc eax
mov rax, 3
jmp return
INJECT_FAST_SPRINT_RACE_WIN:
jmp newmem
nop
return:
registersymbol(INJECT_FAST_SPRINT_RACE_WIN)
[DISABLE]
INJECT_FAST_SPRINT_RACE_WIN:
db 49 63 46 74 FF C0
unregistersymbol(INJECT_FAST_SPRINT_RACE_WIN)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SprintRaceController:ReportHeroLapMarkerHit+e1
SprintRaceController:ReportHeroLapMarkerHit+bb: E9 6B 00 00 00 - jmp SprintRaceController:ReportHeroLapMarkerHit+12b
SprintRaceController:ReportHeroLapMarkerHit+c0: 49 63 46 78 - movsxd rax,dword ptr [r14+78]
SprintRaceController:ReportHeroLapMarkerHit+c4: FF C0 - inc eax
SprintRaceController:ReportHeroLapMarkerHit+c6: 41 89 46 78 - mov [r14+78],eax
SprintRaceController:ReportHeroLapMarkerHit+ca: C6 06 01 - mov byte ptr [rsi],01
SprintRaceController:ReportHeroLapMarkerHit+cd: 49 63 46 78 - movsxd rax,dword ptr [r14+78]
SprintRaceController:ReportHeroLapMarkerHit+d1: 49 8B 56 38 - mov rdx,[r14+38]
SprintRaceController:ReportHeroLapMarkerHit+d5: 48 63 4A 18 - movsxd rcx,dword ptr [rdx+18]
SprintRaceController:ReportHeroLapMarkerHit+d9: 3B C1 - cmp eax,ecx
SprintRaceController:ReportHeroLapMarkerHit+db: 0F 8C 4A 00 00 00 - jl SprintRaceController:ReportHeroLapMarkerHit+12b
// ---------- INJECTING HERE ----------
SprintRaceController:ReportHeroLapMarkerHit+e1: 49 63 46 74 - movsxd rax,dword ptr [r14+74]
// ---------- DONE INJECTING ----------
SprintRaceController:ReportHeroLapMarkerHit+e5: FF C0 - inc eax
SprintRaceController:ReportHeroLapMarkerHit+e7: 41 89 46 74 - mov [r14+74],eax
SprintRaceController:ReportHeroLapMarkerHit+eb: 41 C7 46 78 00 00 00 00 - mov [r14+78],00000000
SprintRaceController:ReportHeroLapMarkerHit+f3: 49 8B 46 40 - mov rax,[r14+40]
SprintRaceController:ReportHeroLapMarkerHit+f7: 49 63 56 74 - movsxd rdx,dword ptr [r14+74]
SprintRaceController:ReportHeroLapMarkerHit+fb: 48 8B C8 - mov rcx,rax
SprintRaceController:ReportHeroLapMarkerHit+fe: 83 38 00 - cmp dword ptr [rax],00
SprintRaceController:ReportHeroLapMarkerHit+101: 48 8D 64 24 00 - lea rsp,[rsp+00]
SprintRaceController:ReportHeroLapMarkerHit+106: 49 BB 30 F9 2B C6 71 02 00 00 - mov r11,SimpleCounter:SetCurrent
SprintRaceController:ReportHeroLapMarkerHit+110: 41 FF D3 - call r11
}
1317
"inf. dart game retry"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-08
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_INF_DART_GAME,HutongGames.PlayMaker.Actions.IntAdd:OnEnter+53,HutongGames.PlayMaker.Actions.IntAdd:OnEnter+A3,89 48 30 0F B6 46 58) // should be unique
alloc(newmem,$1000,INJECT_INF_DART_GAME)
label(code)
label(return)
newmem:
xor ecx, ecx
code:
mov [rax+30],ecx
movzx eax,byte ptr [rsi+58]
jmp return
INJECT_INF_DART_GAME:
jmp newmem
nop 2
return:
registersymbol(INJECT_INF_DART_GAME)
[DISABLE]
INJECT_INF_DART_GAME:
db 89 48 30 0F B6 46 58
unregistersymbol(INJECT_INF_DART_GAME)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: HutongGames.PlayMaker.Actions.IntAdd:OnEnter+63
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+3b: 48 8B C8 - mov rcx,rax
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+3e: 83 38 00 - cmp dword ptr [rax],00
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+41: 48 8D 64 24 00 - lea rsp,[rsp+00]
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+46: 49 BB 20 76 FE 43 93 02 00 00 - mov r11,HutongGames.PlayMaker.FsmInt:get_Value
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+50: 41 FF D3 - call r11
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+53: 48 8B D0 - mov rdx,rax
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+56: 48 8B 45 F0 - mov rax,[rbp-10]
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+5a: 48 8B 4D E8 - mov rcx,[rbp-18]
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+5e: 03 CA - add ecx,edx
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+60: 83 38 00 - cmp dword ptr [rax],00
// ---------- INJECTING HERE ----------
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+63: 89 48 30 - mov [rax+30],ecx
// ---------- DONE INJECTING ----------
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+66: 0F B6 46 58 - movzx eax,byte ptr [rsi+58]
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+6a: 85 C0 - test eax,eax
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+6c: 75 15 - jne HutongGames.PlayMaker.Actions.IntAdd:OnEnter+83
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+6e: 48 8B CE - mov rcx,rsi
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+71: 48 8D 64 24 00 - lea rsp,[rsp+00]
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+76: 49 BB 00 A3 02 58 93 02 00 00 - mov r11,HutongGames.PlayMaker.FsmStateAction:Finish
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+80: 41 FF D3 - call r11
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+83: 48 8B 75 F8 - mov rsi,[rbp-08]
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+87: 48 8D 65 00 - lea rsp,[rbp+00]
HutongGames.PlayMaker.Actions.IntAdd:OnEnter+8b: 5D - pop rbp
}
1318
"Fast kill - multi hit attack"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-08
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_FAST_KILL2,DamageEnemies:HandlesMultiHitsDeath+8,DamageEnemies:HandlesMultiHitsDeath+28,48 8B F1 0F B6 86 F4 01 00 00) // should be unique
alloc(newmem,$1000,INJECT_FAST_KILL2)
label(code)
label(return vf_damage_multi2)
newmem:
mov esi, [vf_damage_multi2]
mov dword ptr [rcx+00000254], esi
code:
mov rsi,rcx
movzx eax,byte ptr [rsi+000001F4]
jmp return
align 10 cc
vf_damage_multi2:
dd (float)100
INJECT_FAST_KILL2:
jmp newmem
nop 5
return:
registersymbol(INJECT_FAST_KILL2 vf_damage_multi2)
[DISABLE]
INJECT_FAST_KILL2:
db 48 8B F1 0F B6 86 F4 01 00 00
unregistersymbol(INJECT_FAST_KILL2 vf_damage_multi2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: DamageEnemies:HandlesMultiHitsDeath+b
28F6E9D2173: 00 00 - add [rax],al
28F6E9D2175: 00 00 - add [rax],al
28F6E9D2177: 00 00 - add [rax],al
28F6E9D2179: 00 00 - add [rax],al
28F6E9D217B: 00 00 - add [rax],al
28F6E9D217D: 00 00 - add [rax],al
28F6E9D217F: 00 48 83 - add [rax-7D],cl
DamageEnemies:HandlesMultiHitsDeath+2: EC - in al,dx
DamageEnemies:HandlesMultiHitsDeath+3: 08 48 89 - or [rax-77],cl
DamageEnemies:HandlesMultiHitsDeath+6: 34 24 - xor al,24
// ---------- INJECTING HERE ----------
DamageEnemies:HandlesMultiHitsDeath+8: 48 8B F1 - mov rsi,rcx
// ---------- DONE INJECTING ----------
DamageEnemies:HandlesMultiHitsDeath+b: 0F B6 86 F4 01 00 00 - movzx eax,byte ptr [rsi+000001F4]
DamageEnemies:HandlesMultiHitsDeath+12: 85 C0 - test eax,eax
DamageEnemies:HandlesMultiHitsDeath+14: 74 13 - je DamageEnemies:HandlesMultiHitsDeath+29
DamageEnemies:HandlesMultiHitsDeath+16: 48 63 86 FC 01 00 00 - movsxd rax,dword ptr [rsi+000001FC]
DamageEnemies:HandlesMultiHitsDeath+1d: 85 C0 - test eax,eax
DamageEnemies:HandlesMultiHitsDeath+1f: 40 0F 9F C0 - setg al
DamageEnemies:HandlesMultiHitsDeath+23: 48 0F B6 C0 - movzx rax,al
DamageEnemies:HandlesMultiHitsDeath+27: EB 02 - jmp DamageEnemies:HandlesMultiHitsDeath+2b
DamageEnemies:HandlesMultiHitsDeath+29: 33 C0 - xor eax,eax
DamageEnemies:HandlesMultiHitsDeath+2b: 48 8B 34 24 - mov rsi,[rsp]
}
1319
"Prmanent in game session"
8000FF
1
1320
"multiplier"
0
C08000
Float
vf_damage_multi2
1321
"Fast kill - general / single hit attack"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-08
Author : bbfox@https://opencheattables.scom
}
[ENABLE]
aobscanregion(INJECT_FAST_KILL,DamageEnemies:StartDamage+5d,DamageEnemies:StartDamage+Ad,00 C6 86 50 02 00 00 00) // should be unique
alloc(newmem,$1000,INJECT_FAST_KILL)
label(code)
label(return vf_damage_multi)
newmem:
mov eax, [vf_damage_multi]
mov dword ptr [rsi+00000254], eax
code:
mov byte ptr [rsi+00000250],00
jmp return
align 10 cc
vf_damage_multi:
dd (float)100
INJECT_FAST_KILL+01:
jmp newmem
nop 2
return:
registersymbol(INJECT_FAST_KILL vf_damage_multi)
[DISABLE]
INJECT_FAST_KILL+01:
db C6 86 50 02 00 00 00
unregistersymbol(INJECT_FAST_KILL vf_damage_multi)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: DamageEnemies:StartDamage+7d
DamageEnemies:StartDamage+55: 90 - nop
DamageEnemies:StartDamage+56: 49 BB 80 21 9D 6E 8F 02 00 00 - mov r11,DamageEnemies:HandlesMultiHitsDeath
DamageEnemies:StartDamage+60: 41 FF D3 - call r11
DamageEnemies:StartDamage+63: 48 8B FE - mov rdi,rsi
DamageEnemies:StartDamage+66: 85 C0 - test eax,eax
DamageEnemies:StartDamage+68: 75 05 - jne DamageEnemies:StartDamage+6f
DamageEnemies:StartDamage+6a: 45 33 FF - xor r15d,r15d
DamageEnemies:StartDamage+6d: EB 07 - jmp DamageEnemies:StartDamage+76
DamageEnemies:StartDamage+6f: 4C 63 BE FC 01 00 00 - movsxd r15,dword ptr [rsi+000001FC]
DamageEnemies:StartDamage+76: 44 89 BF 38 02 00 00 - mov [rdi+00000238],r15d
// ---------- INJECTING HERE ----------
DamageEnemies:StartDamage+7d: C6 86 50 02 00 00 00 - mov byte ptr [rsi+00000250],00
// ---------- DONE INJECTING ----------
DamageEnemies:StartDamage+84: C6 86 51 02 00 00 00 - mov byte ptr [rsi+00000251],00
DamageEnemies:StartDamage+8b: C6 86 3C 02 00 00 00 - mov byte ptr [rsi+0000023C],00
DamageEnemies:StartDamage+92: 48 8B 86 48 01 00 00 - mov rax,[rsi+00000148]
DamageEnemies:StartDamage+99: 48 8B C8 - mov rcx,rax
DamageEnemies:StartDamage+9c: 83 38 00 - cmp dword ptr [rax],00
DamageEnemies:StartDamage+9f: 48 8D AD 00 00 00 00 - lea rbp,[rbp+00000000]
DamageEnemies:StartDamage+a6: 49 BB D0 9F 9D 56 8F 02 00 00 - mov r11,System.Collections.Generic.HashSet`1[T_REF]:Clear
DamageEnemies:StartDamage+b0: 41 FF D3 - call r11
DamageEnemies:StartDamage+b3: 48 8B 86 18 01 00 00 - mov rax,[rsi+00000118]
DamageEnemies:StartDamage+ba: 48 8B C8 - mov rcx,rax
}
1322
"Prmanent in game session"
8000FF
1
1323
"multiplier"
0
C08000
Float
vf_damage_multi
1324
"Get hero controller data"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-12
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_GET_HERO_CTRL,HeroController:Move+57,HeroController:Move+A7,48 8B 87 48 02 00 00) // should be unique
alloc(newmem,$1000,INJECT_GET_HERO_CTRL)
label(code)
label(return i_base_hero_ctrl_addr)
newmem:
mov [i_base_hero_ctrl_addr],rdi
code:
mov rax,[rdi+00000248]
jmp return
align 10 cc
i_base_hero_ctrl_addr:
dq 0
INJECT_GET_HERO_CTRL:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_HERO_CTRL i_base_hero_ctrl_addr)
[DISABLE]
INJECT_GET_HERO_CTRL:
db 48 8B 87 48 02 00 00
unregistersymbol(INJECT_GET_HERO_CTRL i_base_hero_ctrl_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: HeroController:Move+67
HeroController:Move+3b: 48 89 85 68 FF FF FF - mov [rbp-00000098],rax
HeroController:Move+42: 48 89 85 70 FF FF FF - mov [rbp-00000090],rax
HeroController:Move+49: 48 89 85 78 FF FF FF - mov [rbp-00000088],rax
HeroController:Move+50: 48 89 45 80 - mov [rbp-80],rax
HeroController:Move+54: 48 89 45 88 - mov [rbp-78],rax
HeroController:Move+58: 89 45 90 - mov [rbp-70],eax
HeroController:Move+5b: 89 45 94 - mov [rbp-6C],eax
HeroController:Move+5e: 89 45 98 - mov [rbp-68],eax
HeroController:Move+61: 89 45 9C - mov [rbp-64],eax
HeroController:Move+64: 89 45 A0 - mov [rbp-60],eax
// ---------- INJECTING HERE ----------
HeroController:Move+67: 48 8B 87 48 02 00 00 - mov rax,[rdi+00000248]
// ---------- DONE INJECTING ----------
HeroController:Move+6e: 0F B6 40 19 - movzx eax,byte ptr [rax+19]
HeroController:Move+72: 85 C0 - test eax,eax
HeroController:Move+74: 74 15 - je HeroController:Move+8b
HeroController:Move+76: 48 8B CF - mov rcx,rdi
HeroController:Move+79: 33 D2 - xor edx,edx
HeroController:Move+7b: 66 66 90 - nop 3
HeroController:Move+7e: 49 BB F0 9D 69 7F 6A 02 00 00 - mov r11,HeroController:SetState
HeroController:Move+88: 41 FF D3 - call r11
HeroController:Move+8b: 48 8B 87 48 02 00 00 - mov rax,[rdi+00000248]
HeroController:Move+92: 0F B6 40 46 - movzx eax,byte ptr [rax+46]
}
1325
"addr"
1
0
808080
8 Bytes
i_base_hero_ctrl_addr
1326
"Data"
1
1327
"verboseMode"
0
FF8080
Byte
[i_base_hero_ctrl_addr]+758
1328
"RUN_SPEED"
FF80FF
Float
[i_base_hero_ctrl_addr]+75C
1329
"WALK_SPEED"
FF80FF
Float
[i_base_hero_ctrl_addr]+760
1330
"JUMP_SPEED"
FF80FF
Float
[i_base_hero_ctrl_addr]+764
1331
"MIN_JUMP_SPEED"
FF8080
Float
[i_base_hero_ctrl_addr]+768
1332
"JUMP_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+76C
1333
"JUMP_STEPS_MIN"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+770
1334
"AIR_HANG_GRAVITY"
FF8080
Float
[i_base_hero_ctrl_addr]+774
1335
"AIR_HANG_ACCEL"
FF8080
Float
[i_base_hero_ctrl_addr]+778
1336
"SHUTTLECOCK_SPEED"
FF8080
Float
[i_base_hero_ctrl_addr]+77C
1337
"FLOAT_SPEED"
FF8080
Float
[i_base_hero_ctrl_addr]+780
1338
"DOUBLE_JUMP_RISE_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+784
1339
"DOUBLE_JUMP_FALL_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+788
1340
"JUMP_ABILITY_GROUND_RAY_LENGTH"
FF8080
Float
[i_base_hero_ctrl_addr]+78C
1341
"WALLJUMP_RAY_LENGTH"
FF8080
Float
[i_base_hero_ctrl_addr]+790
1342
"WALLJUMP_BROLLY_RAY_LENGTH"
FF8080
Float
[i_base_hero_ctrl_addr]+794
1343
"WJLOCK_STEPS_SHORT"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+798
1344
"WJLOCK_STEPS_LONG"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+79C
1345
"WJLOCK_CHAIN_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+7A0
1346
"WJ_KICKOFF_SPEED"
FF8080
Float
[i_base_hero_ctrl_addr]+7A4
1347
"WALL_STICKY_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+7A8
1348
"DASH_SPEED"
FF80FF
Float
[i_base_hero_ctrl_addr]+7AC
1349
"DASH_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+7B0
1350
"AIR_DASH_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+7B4
1351
"DOWN_DASH_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+7B8
1352
"DASH_QUEUE_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+7BC
1353
"DASH_COOLDOWN"
FF8080
Float
[i_base_hero_ctrl_addr]+7C0
1354
"WALLSLIDE_STICK_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+7C4
1355
"WALLSLIDE_ACCEL"
FF8080
Float
[i_base_hero_ctrl_addr]+7C8
1356
"WALLSLIDE_SHUTTLECOCK_VEL"
FF8080
Float
[i_base_hero_ctrl_addr]+7CC
1357
"WALLCLING_DECEL"
FF8080
Float
[i_base_hero_ctrl_addr]+7D0
1358
"WALLCLING_COOLDOWN"
FF8080
Float
[i_base_hero_ctrl_addr]+7D4
1359
"NAIL_CHARGE_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+7D8
1360
"NAIL_CHARGE_TIME_QUICK"
FF8080
Float
[i_base_hero_ctrl_addr]+7DC
1361
"NAIL_CHARGE_BEGIN_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+7E0
1362
"NAIL_CHARGE_BEGIN_TIME_QUICK"
FF8080
Float
[i_base_hero_ctrl_addr]+7E4
1363
"TIME_TO_ENTER_SCENE_BOT"
FF8080
Float
[i_base_hero_ctrl_addr]+7E8
1364
"SPEED_TO_ENTER_SCENE_HOR"
FF8080
Float
[i_base_hero_ctrl_addr]+7EC
1365
"SPEED_TO_ENTER_SCENE_UP"
FF8080
Float
[i_base_hero_ctrl_addr]+7F0
1366
"SPEED_TO_ENTER_SCENE_DOWN"
FF8080
Float
[i_base_hero_ctrl_addr]+7F4
1367
"DEFAULT_GRAVITY"
FF80FF
Float
[i_base_hero_ctrl_addr]+7F8
1368
"UNDERWATER_GRAVITY"
FF80FF
Float
[i_base_hero_ctrl_addr]+7FC
1369
"ALT_ATTACK_RESET"
FF8080
Float
[i_base_hero_ctrl_addr]+800
1370
"DOWNSPIKE_REBOUND_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+804
1371
"DOWNSPIKE_REBOUND_SPEED"
FF8080
Float
[i_base_hero_ctrl_addr]+808
1372
"DOWNSPIKE_LAND_RECOVERY_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+80C
1373
"DOWNSPIKE_ANTIC_DECELERATION"
FF8080
Float
[i_base_hero_ctrl_addr]+810
1374
"DOWNSPIKE_ANTIC_CLAMP_VEL_Y"
FF8080
Float
[i_base_hero_ctrl_addr]+814
1375
"DOWNSPIKE_ANTIC_CLAMP_VEL_?"
FF8080
Float
[i_base_hero_ctrl_addr]+818
1376
"JUMP_SPEED_UPDRAFT_EXIT"
FF8080
Float
[i_base_hero_ctrl_addr]+81C
1377
"DOWNSPIKE_INVULNERABILITY_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+820
1378
"DOWNSPIKE_INVULNERABILITY_STEPS_LONG"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+824
1379
"BOUNCE_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+828
1380
"BOUNCE_VELOCITY"
FF8080
Float
[i_base_hero_ctrl_addr]+82C
1381
"SHROOM_BOUNCE_VELOCITY"
FF8080
Float
[i_base_hero_ctrl_addr]+830
1382
"RECOIL_HOR_VELOCITY"
FF8080
Float
[i_base_hero_ctrl_addr]+834
1383
"RECOIL_HOR_VELOCITY_LONG"
FF8080
Float
[i_base_hero_ctrl_addr]+838
1384
"RECOIL_HOR_VELOCITY_DRILLDASH"
FF8080
Float
[i_base_hero_ctrl_addr]+83C
1385
"RECOIL_HOR_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+840
1386
"RECOIL_DOWN_VELOCITY"
FF8080
Float
[i_base_hero_ctrl_addr]+844
1387
"BIG_FALL_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+848
1388
"HARD_LANDING_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+84C
1389
"DOWN_DASH_RECOVER_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+850
1390
"MAX_FALL_VELOCITY"
FF8080
Float
[i_base_hero_ctrl_addr]+854
1391
"MAX_FALL_VELOCITY_WEIGHTED"
FF8080
Float
[i_base_hero_ctrl_addr]+858
1392
"MAX_FALL_VELOCITY_DJUMP"
FF8080
Float
[i_base_hero_ctrl_addr]+85C
1393
"RECOIL_DURATION"
FF8080
Float
[i_base_hero_ctrl_addr]+860
1394
"RECOIL_VELOCITY"
FF8080
Float
[i_base_hero_ctrl_addr]+864
1395
"DAMAGE_FREEZE_DOWN"
FF8080
Float
[i_base_hero_ctrl_addr]+868
1396
"DAMAGE_FREEZE_WAIT"
FF8080
Float
[i_base_hero_ctrl_addr]+86C
1397
"DAMAGE_FREEZE_UP"
FF8080
Float
[i_base_hero_ctrl_addr]+870
1398
"DAMAGE_FREEZE_SPEED"
FF8080
Float
[i_base_hero_ctrl_addr]+874
1399
"INVUL_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+878
1400
"INVUL_TIME_PARRY"
FF8080
Float
[i_base_hero_ctrl_addr]+87C
1401
"INVUL_TIME_QUAKE"
FF8080
Float
[i_base_hero_ctrl_addr]+880
1402
"INVUL_TIME_CROSS_STITCH"
FF8080
Float
[i_base_hero_ctrl_addr]+884
1403
"INVUL_TIME_SILKDASH"
FF8080
Float
[i_base_hero_ctrl_addr]+888
1404
"REVENGE_WINDOW_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+88C
1405
"DASHCOMBO_WINDOW_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+890
1406
"CAST_RECOIL_VELOCITY"
FF8080
Float
[i_base_hero_ctrl_addr]+894
1407
"WALLSLIDE_CLIP_DELAY"
FF8080
Float
[i_base_hero_ctrl_addr]+898
1408
"QUICKENING_DURATION"
FF8080
Float
[i_base_hero_ctrl_addr]+89C
1409
"QUICKENING_RUN_SPEED"
FF8080
Float
[i_base_hero_ctrl_addr]+8A0
1410
"QUICKENING_WALK_SPEED"
FF8080
Float
[i_base_hero_ctrl_addr]+8A4
1411
"FIRST_SILK_REGEN_DELAY"
FF8080
Float
[i_base_hero_ctrl_addr]+8A8
1412
"FIRST_SILK_REGEN_DURATION"
FF8080
Float
[i_base_hero_ctrl_addr]+8AC
1413
"SILK_REGEN_DELAY"
FF8080
Float
[i_base_hero_ctrl_addr]+8B0
1414
"SILK_REGEN_DURATION"
FF8080
Float
[i_base_hero_ctrl_addr]+8B4
1415
"CURSED_SILK_EAT_DELAY_FIRST"
FF8080
Float
[i_base_hero_ctrl_addr]+8B8
1416
"CURSED_SILK_EAT_DELAY"
FF8080
Float
[i_base_hero_ctrl_addr]+8BC
1417
"CURSED_SILK_EAT_DURATION"
FF8080
Float
[i_base_hero_ctrl_addr]+8C0
1418
"MAGGOTED_SILK_EAT_DELAY_FIRST"
FF8080
Float
[i_base_hero_ctrl_addr]+8C4
1419
"MAGGOTED_SILK_EAT_DELAY"
FF8080
Float
[i_base_hero_ctrl_addr]+8C8
1420
"MAGGOTED_SILK_EAT_DURATION"
FF8080
Float
[i_base_hero_ctrl_addr]+8CC
1421
"JUMP_QUEUE_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+8D0
1422
"JUMP_RELEASE_QUEUE_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+8D4
1423
"DOUBLE_JUMP_QUEUE_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+8D8
1424
"ATTACK_QUEUE_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+8DC
1425
"TOOLTHROW_QUEUE_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+8E0
1426
"HARPOON_QUEUE_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+8E4
1427
"LOOK_DELAY"
FF8080
Float
[i_base_hero_ctrl_addr]+8E8
1428
"LOOK_ANIM_DELAY"
FF8080
Float
[i_base_hero_ctrl_addr]+8EC
1429
"DEATH_WAIT"
FF8080
Float
[i_base_hero_ctrl_addr]+8F0
1430
"HAZARD_DEATH_CHECK_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+8F4
1431
"FLOATING_CHECK_TIME"
FF8080
Float
[i_base_hero_ctrl_addr]+8F8
1432
"LANDING_BUFFER_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+8FC
1433
"LEDGE_BUFFER_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+900
1434
"HEAD_BUMP_STEPS"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+904
1435
"FIND_GROUND_POINT_DISTANCE"
FF8080
Float
[i_base_hero_ctrl_addr]+908
1436
"FIND_GROUND_POINT_DISTANCE_EXT"
FF8080
Float
[i_base_hero_ctrl_addr]+90C
1437
"HARPOON_DASH_TIME"
FF8080
Double
[i_base_hero_ctrl_addr]+910
1438
"hero_state"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+918
1439
"prev_hero_state"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+91C
1440
"transitionState"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+920
1441
"damageMode"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+924
1442
"<HeroLockState>k__BackingField"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+928
1443
"unlockRequests"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+92C
1444
"move_input"
FF8080
Float
[i_base_hero_ctrl_addr]+930
1445
"vertical_input"
FF8080
Float
[i_base_hero_ctrl_addr]+934
1446
"controller_deadzone"
FF8080
Float
[i_base_hero_ctrl_addr]+938
1447
"current_velocity"
FF8080
Float
[i_base_hero_ctrl_addr]+93C
1448
"current_velocity"
FF8080
Float
[i_base_hero_ctrl_addr]+940
1449
"isGameplayScene"
FF8080
Byte
[i_base_hero_ctrl_addr]+944
1450
"isEnteringFirstLevel"
FF8080
Byte
[i_base_hero_ctrl_addr]+945
1451
"isDashStabBouncing"
FF8080
Byte
[i_base_hero_ctrl_addr]+946
1452
"canSoftLand"
FF8080
Byte
[i_base_hero_ctrl_addr]+947
1453
"softLandTime"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+948
1454
"blockSteepSlopes"
FF8080
Byte
[i_base_hero_ctrl_addr]+94C
1455
"slashOffset"
FF8080
Float
[i_base_hero_ctrl_addr]+950
1456
"slashOffset"
FF8080
Float
[i_base_hero_ctrl_addr]+954
1457
"upSlashOffset"
FF8080
Float
[i_base_hero_ctrl_addr]+958
1458
"upSlashOffset"
FF8080
Float
[i_base_hero_ctrl_addr]+95C
1459
"downwardSlashOffset"
FF8080
Float
[i_base_hero_ctrl_addr]+960
1460
"downwardSlashOffset"
FF8080
Float
[i_base_hero_ctrl_addr]+964
1461
"spell1Offset"
FF8080
Float
[i_base_hero_ctrl_addr]+968
1462
"spell1Offset"
FF8080
Float
[i_base_hero_ctrl_addr]+96C
1463
"jump_steps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+970
1464
"jumped_steps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+974
1465
"doubleJump_steps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+978
1466
"dash_timer"
FF8080
Float
[i_base_hero_ctrl_addr]+97C
1467
"dash_time"
FF8080
Float
[i_base_hero_ctrl_addr]+980
1468
"attack_time"
FF8080
Float
[i_base_hero_ctrl_addr]+984
1469
"attack_cooldown"
FF8080
Float
[i_base_hero_ctrl_addr]+988
1470
"throwToolCooldown"
FF8080
Float
[i_base_hero_ctrl_addr]+98C
1471
"downspike_rebound_steps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+990
1472
"transition_vel"
FF8080
Float
[i_base_hero_ctrl_addr]+994
1473
"transition_vel"
FF8080
Float
[i_base_hero_ctrl_addr]+998
1474
"altAttackTime"
FF8080
Float
[i_base_hero_ctrl_addr]+99C
1475
"lookDelayTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9A0
1476
"bounceTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9A4
1477
"<fallTimer>k__BackingField"
FF8080
Float
[i_base_hero_ctrl_addr]+9A8
1478
"hardLandingTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9AC
1479
"dashLandingTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9B0
1480
"recoilTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9B4
1481
"recoilStepsLeft"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+9B8
1482
"landingBufferSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+9BC
1483
"dashQueueSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+9C0
1484
"dashQueuing"
FF8080
Byte
[i_base_hero_ctrl_addr]+9C4
1485
"shadowDashTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9C8
1486
"dashCooldownTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9CC
1487
"nailChargeTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9D0
1488
"wallLockSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+9D4
1489
"wallJumpChainStepsLeft"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+9D8
1490
"wallslideClipTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9DC
1491
"hardLandFailSafeTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9E0
1492
"hazardDeathTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9E4
1493
"floatingBufferTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9E8
1494
"attackDuration"
FF8080
Float
[i_base_hero_ctrl_addr]+9EC
1495
"prevAttackDir"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+9F0
1496
"parryInvulnTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9F4
1497
"revengeWindowTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9F8
1498
"wandererDashComboWindowTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+9FC
1499
"downSpikeTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+A00
1500
"downSpikeRecoveryTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+A04
1501
"toolThrowTime"
FF8080
Float
[i_base_hero_ctrl_addr]+A08
1502
"toolThrowDuration"
FF8080
Float
[i_base_hero_ctrl_addr]+A0C
1503
"wallStickTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+A10
1504
"wallStickStartVelocity"
FF8080
Float
[i_base_hero_ctrl_addr]+A14
1505
"lavaBellCooldownTimeLeft"
FF8080
Float
[i_base_hero_ctrl_addr]+A18
1506
"shuttlecockTime"
FF8080
Float
[i_base_hero_ctrl_addr]+A1C
1507
"shuttlecockTimeResetTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+A20
1508
"wallClingCooldownTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+A24
1509
"evadingDidClash"
FF8080
Byte
[i_base_hero_ctrl_addr]+A28
1510
"doMaxSilkRegen"
FF8080
Byte
[i_base_hero_ctrl_addr]+A29
1511
"maxSilkRegenTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+A2C
1512
"shuttleCockJumpSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+A30
1513
"<IsGravityApplied>k__BackingField"
FF8080
Byte
[i_base_hero_ctrl_addr]+A34
1514
"prevGravityScale"
FF8080
Float
[i_base_hero_ctrl_addr]+A38
1515
"recoilVector"
FF8080
Float
[i_base_hero_ctrl_addr]+A3C
1516
"recoilVector"
FF8080
Float
[i_base_hero_ctrl_addr]+A40
1517
"lastInputState"
FF8080
Float
[i_base_hero_ctrl_addr]+A44
1518
"lastInputState"
FF8080
Float
[i_base_hero_ctrl_addr]+A48
1519
"velocity_crt"
FF8080
Float
[i_base_hero_ctrl_addr]+A4C
1520
"velocity_crt"
FF8080
Float
[i_base_hero_ctrl_addr]+A50
1521
"velocity_prev"
FF8080
Float
[i_base_hero_ctrl_addr]+A54
1522
"velocity_prev"
FF8080
Float
[i_base_hero_ctrl_addr]+A58
1523
"gatePosition"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+A5C
1524
"hardLanded"
FF8080
Byte
[i_base_hero_ctrl_addr]+A60
1525
"fallRumble"
FF8080
Byte
[i_base_hero_ctrl_addr]+A61
1526
"acceptingInput"
FF8080
Byte
[i_base_hero_ctrl_addr]+A62
1527
"fallTrailGenerated"
FF8080
Byte
[i_base_hero_ctrl_addr]+A63
1528
"dashBumpCorrection"
FF8080
Float
[i_base_hero_ctrl_addr]+A64
1529
"controlReqlinquished"
FF8080
Byte
[i_base_hero_ctrl_addr]+A68
1530
"enterWithoutInput"
FF8080
Byte
[i_base_hero_ctrl_addr]+A69
1531
"skipNormalEntry"
FF8080
Byte
[i_base_hero_ctrl_addr]+A6A
1532
"downspike_rebound_xspeed"
FF8080
Float
[i_base_hero_ctrl_addr]+A6C
1533
"downSpikeHorizontalSpeed"
FF8080
Float
[i_base_hero_ctrl_addr]+A70
1534
"shuttlecockSpeed"
FF8080
Float
[i_base_hero_ctrl_addr]+A74
1535
"currentGravity"
FF8080
Float
[i_base_hero_ctrl_addr]+A78
1536
"didAirHang"
FF8080
Byte
[i_base_hero_ctrl_addr]+A7C
1537
"updraftsEntered"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+A80
1538
"harpoonDashCooldown"
FF8080
Float
[i_base_hero_ctrl_addr]+A84
1539
"lastLookDirection"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+A88
1540
"controlRelinquishedFrame"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+A8C
1541
"jumpQueueSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+A90
1542
"jumpQueuing"
FF8080
Byte
[i_base_hero_ctrl_addr]+A94
1543
"doubleJumpQueueSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+A98
1544
"doubleJumpQueuing"
FF8080
Byte
[i_base_hero_ctrl_addr]+A9C
1545
"jumpReleaseQueueSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+AA0
1546
"jumpReleaseQueuing"
FF8080
Byte
[i_base_hero_ctrl_addr]+AA4
1547
"attackQueueSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+AA8
1548
"attackQueuing"
FF8080
Byte
[i_base_hero_ctrl_addr]+AAC
1549
"harpoonQueueSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+AB0
1550
"harpoonQueuing"
FF8080
Byte
[i_base_hero_ctrl_addr]+AB4
1551
"toolThrowQueueSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+AB8
1552
"toolThrowQueueing"
FF8080
Byte
[i_base_hero_ctrl_addr]+ABC
1553
"touchingWallL"
FF8080
Byte
[i_base_hero_ctrl_addr]+ABD
1554
"touchingWallR"
FF8080
Byte
[i_base_hero_ctrl_addr]+ABE
1555
"wallSlidingL"
FF8080
Byte
[i_base_hero_ctrl_addr]+ABF
1556
"wallSlidingR"
FF8080
Byte
[i_base_hero_ctrl_addr]+AC0
1557
"airDashed"
FF8080
Byte
[i_base_hero_ctrl_addr]+AC1
1558
"dashingDown"
FF8080
Byte
[i_base_hero_ctrl_addr]+AC2
1559
"startWithWallslide"
FF8080
Byte
[i_base_hero_ctrl_addr]+AC3
1560
"startWithJump"
FF8080
Byte
[i_base_hero_ctrl_addr]+AC4
1561
"startWithAnyJump"
FF8080
Byte
[i_base_hero_ctrl_addr]+AC5
1562
"startWithTinyJump"
FF8080
Byte
[i_base_hero_ctrl_addr]+AC6
1563
"startWithShuttlecock"
FF8080
Byte
[i_base_hero_ctrl_addr]+AC7
1564
"startWithFullJump"
FF8080
Byte
[i_base_hero_ctrl_addr]+AC8
1565
"startWithFlipJump"
FF8080
Byte
[i_base_hero_ctrl_addr]+AC9
1566
"startWithBackflipJump"
FF8080
Byte
[i_base_hero_ctrl_addr]+ACA
1567
"startWithBrolly"
FF8080
Byte
[i_base_hero_ctrl_addr]+ACB
1568
"startWithDoubleJump"
FF8080
Byte
[i_base_hero_ctrl_addr]+ACC
1569
"startWithWallsprintLaunch"
FF8080
Byte
[i_base_hero_ctrl_addr]+ACD
1570
"startWithDash"
FF8080
Byte
[i_base_hero_ctrl_addr]+ACE
1571
"dashCurrentFacing"
FF8080
Byte
[i_base_hero_ctrl_addr]+ACF
1572
"startWithDownSpikeBounce"
FF8080
Byte
[i_base_hero_ctrl_addr]+AD0
1573
"startWithDownSpikeBounceSlightlyShort"
FF8080
Byte
[i_base_hero_ctrl_addr]+AD1
1574
"startWithDownSpikeBounceShort"
FF8080
Byte
[i_base_hero_ctrl_addr]+AD2
1575
"startWithDownSpikeEnd"
FF8080
Byte
[i_base_hero_ctrl_addr]+AD3
1576
"startWithHarpoonBounce"
FF8080
Byte
[i_base_hero_ctrl_addr]+AD4
1577
"startWithWitchSprintBounce"
FF8080
Byte
[i_base_hero_ctrl_addr]+AD5
1578
"startWithBalloonBounce"
FF8080
Byte
[i_base_hero_ctrl_addr]+AD6
1579
"startWithUpdraftExit"
FF8080
Byte
[i_base_hero_ctrl_addr]+AD7
1580
"useUpdraftExitJumpSpeed"
FF8080
Byte
[i_base_hero_ctrl_addr]+AD8
1581
"startWithScrambleLeap"
FF8080
Byte
[i_base_hero_ctrl_addr]+AD9
1582
"startWithRecoilBack"
FF8080
Byte
[i_base_hero_ctrl_addr]+ADA
1583
"startWithRecoilBackLong"
FF8080
Byte
[i_base_hero_ctrl_addr]+ADB
1584
"startWithWhipPullRecoil"
FF8080
Byte
[i_base_hero_ctrl_addr]+ADC
1585
"startWithAttack"
FF8080
Byte
[i_base_hero_ctrl_addr]+ADD
1586
"startWithToolThrow"
FF8080
Byte
[i_base_hero_ctrl_addr]+ADE
1587
"wallSlashing"
FF8080
Byte
[i_base_hero_ctrl_addr]+ADF
1588
"doubleJumped"
FF8080
Byte
[i_base_hero_ctrl_addr]+AE0
1589
"wallJumpedR"
FF8080
Byte
[i_base_hero_ctrl_addr]+AE1
1590
"wallJumpedL"
FF8080
Byte
[i_base_hero_ctrl_addr]+AE2
1591
"wallLocked"
FF8080
Byte
[i_base_hero_ctrl_addr]+AE3
1592
"currentWalljumpSpeed"
FF8080
Float
[i_base_hero_ctrl_addr]+AE4
1593
"walljumpSpeedDecel"
FF8080
Float
[i_base_hero_ctrl_addr]+AE8
1594
"wallUnstickSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+AEC
1595
"recoilVelocity"
FF8080
Float
[i_base_hero_ctrl_addr]+AF0
1596
"conveyorSpeed"
FF8080
Float
[i_base_hero_ctrl_addr]+AF4
1597
"enteringVertically"
FF8080
Byte
[i_base_hero_ctrl_addr]+AF8
1598
"playingWallslideClip"
FF8080
Byte
[i_base_hero_ctrl_addr]+AF9
1599
"playedMantisClawClip"
FF8080
Byte
[i_base_hero_ctrl_addr]+AFA
1600
"exitedSuperDashing"
FF8080
Byte
[i_base_hero_ctrl_addr]+AFB
1601
"exitedQuake"
FF8080
Byte
[i_base_hero_ctrl_addr]+AFC
1602
"exitedSprinting"
FF8080
Byte
[i_base_hero_ctrl_addr]+AFD
1603
"fallCheckFlagged"
FF8080
Byte
[i_base_hero_ctrl_addr]+AFE
1604
"ledgeBufferSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+B00
1605
"sprintBufferSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+B04
1606
"syncBufferSteps"
FF8080
Byte
[i_base_hero_ctrl_addr]+B08
1607
"noShuttlecockTime"
FF8080
Double
[i_base_hero_ctrl_addr]+B10
1608
"headBumpSteps"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+B18
1609
"takeNoDamage"
FF8080
Byte
[i_base_hero_ctrl_addr]+B1C
1610
"joniBeam"
FF8080
Byte
[i_base_hero_ctrl_addr]+B1D
1611
"fadedSceneIn"
FF8080
Byte
[i_base_hero_ctrl_addr]+B1E
1612
"stopWalkingOut"
FF8080
Byte
[i_base_hero_ctrl_addr]+B1F
1613
"boundsChecking"
FF8080
Byte
[i_base_hero_ctrl_addr]+B20
1614
"blockerFix"
FF8080
Byte
[i_base_hero_ctrl_addr]+B21
1615
"doFullJump"
FF8080
Byte
[i_base_hero_ctrl_addr]+B22
1616
"startFromMantle"
FF8080
Byte
[i_base_hero_ctrl_addr]+B23
1617
"allowMantle"
FF8080
Byte
[i_base_hero_ctrl_addr]+B24
1618
"allowAttackCancellingDownspikeRecovery"
FF8080
Byte
[i_base_hero_ctrl_addr]+B25
1619
"queuedWallJumpInterrupt"
FF8080
Byte
[i_base_hero_ctrl_addr]+B26
1620
"startWithWallJump"
FF8080
Byte
[i_base_hero_ctrl_addr]+B27
1621
"jumpPressedWhileRelinquished"
FF8080
Byte
[i_base_hero_ctrl_addr]+B28
1622
"regainControlJumpQueued"
FF8080
Byte
[i_base_hero_ctrl_addr]+B29
1623
"tilemapTestActive"
FF8080
Byte
[i_base_hero_ctrl_addr]+B2A
1624
"allowNailChargingWhileRelinquished"
FF8080
Byte
[i_base_hero_ctrl_addr]+B2B
1625
"allowRecoilWhileRelinquished"
FF8080
Byte
[i_base_hero_ctrl_addr]+B2C
1626
"recoilZeroVelocity"
FF8080
Byte
[i_base_hero_ctrl_addr]+B2D
1627
"silkRegenDelayLeft"
FF8080
Float
[i_base_hero_ctrl_addr]+B30
1628
"silkRegenDurationLeft"
FF8080
Float
[i_base_hero_ctrl_addr]+B34
1629
"isSilkRegenBlocked"
FF8080
Byte
[i_base_hero_ctrl_addr]+B38
1630
"hasSilkSpoolAppeared"
FF8080
Byte
[i_base_hero_ctrl_addr]+B39
1631
"isNextSilkRegenUpgraded"
FF8080
Byte
[i_base_hero_ctrl_addr]+B3A
1632
"blockFsmMove"
FF8080
Byte
[i_base_hero_ctrl_addr]+B3B
1633
"maggotedSilkTracker"
1
FF8080
8 Bytes
[i_base_hero_ctrl_addr]+B3C
1634
"maggotCharmTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+B48
1635
"mossCreep1Hits"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+B4C
1636
"mossCreep2Hits"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+B50
1637
"frostAmount"
FF8080
Float
[i_base_hero_ctrl_addr]+B54
1638
"frostDamageTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+B58
1639
"isInFrostRegion"
FF8080
Byte
[i_base_hero_ctrl_addr]+B5C
1640
"doingHazardRespawn"
FF8080
Byte
[i_base_hero_ctrl_addr]+B5D
1641
"lastHazardRespawnTime"
FF8080
Double
[i_base_hero_ctrl_addr]+B60
1642
"luckyDiceShieldedHits"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+B68
1643
"forceWalkingSound"
FF8080
Byte
[i_base_hero_ctrl_addr]+B6C
1644
"<ForceRunningSound>k__BackingField"
FF8080
Byte
[i_base_hero_ctrl_addr]+B6D
1645
"silkTauntEffectTimeLeft"
FF8080
Float
[i_base_hero_ctrl_addr]+B70
1646
"ringTauntEffectTimeLeft"
FF8080
Float
[i_base_hero_ctrl_addr]+B74
1647
"refillSoundSuppressFramesLeft"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+B78
1648
"groundRayOriginC"
FF8080
Float
[i_base_hero_ctrl_addr]+B7C
1649
"groundRayOriginC"
FF8080
Float
[i_base_hero_ctrl_addr]+B80
1650
"groundRayOriginL"
FF8080
Float
[i_base_hero_ctrl_addr]+B84
1651
"groundRayOriginL"
FF8080
Float
[i_base_hero_ctrl_addr]+B88
1652
"groundRayOriginR"
FF8080
Float
[i_base_hero_ctrl_addr]+B8C
1653
"groundRayOriginR"
FF8080
Float
[i_base_hero_ctrl_addr]+B90
1654
"frostedAudioLoopFadeOut"
FF8080
Float
[i_base_hero_ctrl_addr]+B94
1655
"isHeroInPosition"
FF8080
Byte
[i_base_hero_ctrl_addr]+B98
1656
"jumpReleaseQueueingEnabled"
FF8080
Byte
[i_base_hero_ctrl_addr]+B99
1657
"queuedAutoThrowTool"
FF8080
Byte
[i_base_hero_ctrl_addr]+B9A
1658
"lookDownBlocked"
FF8080
Byte
[i_base_hero_ctrl_addr]+B9B
1659
"warriorState"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+B9C
1660
"warriorState"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+BA0
1661
"silkPartsTimeLeft"
FF8080
Float
[i_base_hero_ctrl_addr]+BAC
1662
"reaperState"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+BB0
1663
"reaperState"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+BB4
1664
"hunterUpgState"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+BB8
1665
"<WandererState>k__BackingField"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+BBC
1666
"hunterUpgState"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+BBC
1667
"quickeningTimeLeft"
FF8080
Float
[i_base_hero_ctrl_addr]+BC0
1668
"<WandererState>k__BackingField"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+BC0
1669
"didCheckEdgeAdjust"
FF8080
Byte
[i_base_hero_ctrl_addr]+BC4
1670
"<IsInLifebloodState>k__BackingField"
FF8080
Byte
[i_base_hero_ctrl_addr]+BC5
1671
"<PoisonHealthCount>k__BackingField"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+BC8
1672
"<ForceClampTerminalVelocity>k__BackingField"
FF8080
Byte
[i_base_hero_ctrl_addr]+BCC
1673
"tryShove"
FF8080
Byte
[i_base_hero_ctrl_addr]+BCD
1674
"onFlatGround"
FF8080
Byte
[i_base_hero_ctrl_addr]+BCE
1675
"canThrowTime"
FF8080
Double
[i_base_hero_ctrl_addr]+BD0
1676
"tryCancelDownSlash"
FF8080
Byte
[i_base_hero_ctrl_addr]+BD8
1677
"parriedAttack"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+BDC
1678
"announceNextFixedUpdate"
FF8080
Byte
[i_base_hero_ctrl_addr]+BE0
1679
"recoilAllowTime"
FF8080
Double
[i_base_hero_ctrl_addr]+BE8
1680
"preventCastByDialogueEndTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+BF0
1681
"<AnimationControlVersion>k__BackingField"
FF8080
4 Bytes
[i_base_hero_ctrl_addr]+BF4
1682
"preventSoftLandTimer"
FF8080
Float
[i_base_hero_ctrl_addr]+BF8
1683
"invulnerableFreezeDuration"
FF8080
Float
[i_base_hero_ctrl_addr]+BFC
1684
"invulnerableDuration"
FF8080
Float
[i_base_hero_ctrl_addr]+C00
1685
"Get kill journal data"
Auto Assembler Script
{ Game : Hollow Knight Silksong.exe
Version:
Date : 2025-09-08
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanregion(INJECT_GET_KILL_DATA_JOURNAL,EnemyJournalKillData:GetKillData+21,EnemyJournalKillData:GetKillData+4f,48 8B 47 18 48 8B C8) // should be unique
alloc(newmem,$1000,INJECT_GET_KILL_DATA_JOURNAL)
label(code)
label(return)
label(i_base_killdata_addr i_killdata_size i_killdata_count)
newmem:
push r15
push r14
mov r15, [rdi+18] // dictionary
test r15, r15
jz endp
mov r14d, [r15+40] // _count
mov [i_killdata_count], r14d
mov r15, [r15+18] // _entries
test r15, r15
jz endp
mov r14d, [r15+18] // Count
mov [i_killdata_size], r14d
mov [i_base_killdata_addr], r15
endp:
pop r14
pop r15
code:
mov rax,[rdi+18]
mov rcx,rax
jmp return
align 10 cc
i_base_killdata_addr:
dq 0
i_killdata_size:
dd 0
i_killdata_count:
dd 0
INJECT_GET_KILL_DATA_JOURNAL:
jmp newmem
nop 2
return:
registersymbol(i_base_killdata_addr i_killdata_size i_killdata_count)
registersymbol(INJECT_GET_KILL_DATA_JOURNAL)
[DISABLE]
INJECT_GET_KILL_DATA_JOURNAL:
db 48 8B 47 18 48 8B C8
unregistersymbol(i_base_killdata_addr i_killdata_size i_killdata_count)
unregistersymbol(INJECT_GET_KILL_DATA_JOURNAL)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: EnemyJournalKillData:GetKillData+2f
EnemyJournalKillData:GetKillData: 55 - push rbp
EnemyJournalKillData:GetKillData+1: 48 8B EC - mov rbp,rsp
EnemyJournalKillData:GetKillData+4: 48 83 EC 50 - sub rsp,50
EnemyJournalKillData:GetKillData+8: 48 89 7D F8 - mov [rbp-08],rdi
EnemyJournalKillData:GetKillData+c: 48 8B F9 - mov rdi,rcx
EnemyJournalKillData:GetKillData+f: 48 89 55 D8 - mov [rbp-28],rdx
EnemyJournalKillData:GetKillData+13: C7 45 E0 00 00 00 00 - mov [rbp-20],00000000
EnemyJournalKillData:GetKillData+1a: C7 45 E4 00 00 00 00 - mov [rbp-1C],00000000
EnemyJournalKillData:GetKillData+21: C7 45 E8 00 00 00 00 - mov [rbp-18],00000000
EnemyJournalKillData:GetKillData+28: C7 45 EC 00 00 00 00 - mov [rbp-14],00000000
// ---------- INJECTING HERE ----------
EnemyJournalKillData:GetKillData+2f: 48 8B 47 18 - mov rax,[rdi+18]
// ---------- DONE INJECTING ----------
EnemyJournalKillData:GetKillData+33: 48 8B C8 - mov rcx,rax
EnemyJournalKillData:GetKillData+36: 48 8B 55 D8 - mov rdx,[rbp-28]
EnemyJournalKillData:GetKillData+3a: 4C 8B C5 - mov r8,rbp
EnemyJournalKillData:GetKillData+3d: 49 83 C0 E0 - add r8,-20
EnemyJournalKillData:GetKillData+41: 83 38 00 - cmp dword ptr [rax],00
EnemyJournalKillData:GetKillData+44: 66 90 - nop 2
EnemyJournalKillData:GetKillData+46: 49 BB C0 9B 72 E7 55 02 00 00 - mov r11,System.Collections.Generic.Dictionary`2[System.String,EnemyJournalKillData+KillData]:TryGetValue
EnemyJournalKillData:GetKillData+50: 41 FF D3 - call r11
EnemyJournalKillData:GetKillData+53: 85 C0 - test eax,eax
EnemyJournalKillData:GetKillData+55: 0F 85 1E 00 00 00 - jne EnemyJournalKillData:GetKillData+79
}
1692
"Usage: open monster journal book after enabled"
8000FF
1
1686
"base"
1
0
808080
8 Bytes
i_base_killdata_addr
1687
"_size"
0
808080
4 Bytes
i_killdata_size
1688
"Count"
0
808080
4 Bytes
i_killdata_count
1689
"Generate list ("base" must be non-zero)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
closeLuaEngine2()
local PARENT_NAME = "+List (do not delete this)"
local baseSym = "i_base_killdata_addr"
local cntSym = "i_killdata_count"
local STRIDE = 0x18
local NAME_SLOT_OFF = 0x28
local NAME_INNER_OFF = 0x14
local KILL_OFF = 0x30
local UNK_OFF = 0x34
local MAX_CAP = 256
local evenColor = 0xFF8000 -- 水藍
local evenColor2 = 0xAA8044
local color_index = 0
local addressList = getAddressList()
-- 先解一次指標：[[i_base_killdata_addr]]
local basePtr = readPointer(baseSym)
if not basePtr or basePtr == 0 then
print("i_base_killdata_addr read error: " .. baseSym)
return
end
-- [i_killdata_count] 裡是 32-bit 筆數
local totalCount = readInteger(cntSym)
if not totalCount then
print("i_killdata_count read error: " .. cntSym)
return
end
if totalCount < 0 then totalCount = 0 end
if totalCount > MAX_CAP then
print(string.format("Too many records (>256)", totalCount, MAX_CAP))
totalCount = MAX_CAP
end
synchronize(function()
-- 取得/建立父節點
local parent = addressList.getMemoryRecordByDescription(PARENT_NAME)
if not parent then
parent = addressList.createMemoryRecord()
parent.Description = PARENT_NAME
parent.IsGroupHeader = true
parent.Options = "[moHideChildren]"
end
-- 清掉舊子節點
for i = addressList.Count - 1, 0, -1 do
local mr = addressList[i]
if mr.Parent == parent then mr.delete() end
end
-- 逐筆建立
for n = 0, totalCount - 1 do
local row = addressList.createMemoryRecord()
row.Description = string.format("Row[%03d]", n + 1)
row.IsGroupHeader = true
row.Parent = parent
row.Color = (n % 2 == 0) and evenColor or evenColor2
-- [[base]+0x28+stride] + 0x14 → Unicode 名稱
local nameSlotPtr = readPointer(basePtr + NAME_SLOT_OFF + STRIDE * n) or 0
local nameAddr = (nameSlotPtr ~= 0) and (nameSlotPtr + NAME_INNER_OFF) or 0
local nameRec = addressList.createMemoryRecord()
nameRec.Description = string.format("Name.%03d", n + 1)
nameRec.Address = string.format("%X", nameAddr)
nameRec.Vartype = vtString
nameRec.String.Size = 32
nameRec.String.Unicode = true
nameRec.String.ZeroTerminate = true
nameRec.Parent = row
nameRec.Color = (n % 2 == 0) and evenColor or evenColor2
-- [base + 0x30 + stride] → Kill count (uint32)
local killRec = addressList.createMemoryRecord()
killRec.Description = "Kill count"
killRec.Address = string.format("%X", basePtr + KILL_OFF + STRIDE * n)
killRec.Vartype = vtDword
killRec.ShowAsHex = false
killRec.Parent = row
-- [base + 0x34 + stride] → ?? (uint32)
local unkRec = addressList.createMemoryRecord()
unkRec.Description = "??"
unkRec.Address = string.format("%X", basePtr + UNK_OFF + STRIDE * n)
unkRec.Vartype = vtDword
unkRec.ShowAsHex = false
unkRec.Parent = row
end
parent.IsExpanded = true
end)
print(string.format("%d records built to '%s'.", totalCount, PARENT_NAME))
closeLuaEngine()
[DISABLE]
{$lua}
if syntaxcheck then return end
local PARENT_NAME = "+List (do not delete this)"
local addressList = getAddressList()
synchronize(function()
local parent = addressList.getMemoryRecordByDescription(PARENT_NAME)
if not parent then
print("Cannot find partnt node: " .. PARENT_NAME)
return
end
for i = addressList.Count - 1, 0, -1 do
local mr = addressList[i]
if mr.Parent == parent then mr.delete() end
end
parent.Active = false
end)
print("Nodes cleared.")
closeLuaEngine()
1690
"+List (do not delete this)"
1
1691
"Hollow Knight: Silksong / https://opencheattables.com"
00B700
1
1693
"Get hero Collider2D layer"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
local get_layer = mono_findMethod("UnityEngine","GameObject","get_layer")
local get_go = mono_findMethod("UnityEngine","Component","get_gameObject")
-- 例如主角的 Collider
local go = mono_invoke_method(nil, get_go, collider_inst, {})
local layerId = mono_invoke_method(nil, get_layer, go, {})
print("Player is on Layer:", layerId)
[DISABLE]
{$asm}
1694
"List layers"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
local layerToName = mono_findMethod("UnityEngine","LayerMask","LayerToName")
for i=0,31 do
local name = mono_invoke_method(nil, layerToName, nil, {{type=vtDword,value=i}})
print(i, name)
end
{$asm}
[DISABLE]
{$asm}
Modify item amount:
Load the game and scan for the following AOB pattern.
If no results are found, open your inventory once and scan again.
Code: Select all
48 83 C0 10 48 63 08 89 4D D8 48 63 48 04 89 4D DC 48 63 40 08 89 45 E0 48 63 45 D8 89 06 48 63 45 DC 89
You should get two results (addresses).
For each result:
Right-click on the address.
Select "Disassemble this memory region".
In the memory viewer:
Locate the instruction movsxd rcx,dword ptr [rax].
Right-click on that line and choose "Find out what addresses this instruction accesses".
Wait for Cheat Engine to complete the analysis.
In-game: go to a rest area and open your inventory.
In the value list window:
If all values are above 255, it's likely the wrong address.
Try the other address from step 2 and repeat from step 3.
If the values look correct, right-click on one and choose "Change value" to edit it.
--[[
[ENABLE]
{$lua}
if syntaxcheck then return end
]]--
-- **デバッグモードの設定 (デフォルト: 無効)**
local debugMode = false
-- AOBScanModule関数
if not AOBScanModule then
function AOBScanModule(moduleName, signature, scanOptions)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then
if debugMode then print("❗ Error: Module " .. moduleName .. " not found!") end
return nil
end
if debugMode then
print(string.format("✔️ %s Base Address: 0x%X", moduleName, baseAddr))
print(string.format("🔬 Scanning Range: 0x%X - 0x%X", baseAddr, maxAddr))
end
local ms = createMemScan()
synchronize(function()
ms.firstScan(
soExactValue,
vtByteArray,
nil,
signature,
nil,
baseAddr,
maxAddr,
scanOptions or "+X+R",
fsmNotAligned,
"1",
true,
true,
false,
false
)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
if addr then
if debugMode then print("🔦 AOB found at: 0x" .. addr) end
else
if debugMode then print("💔 AOB not found in " .. moduleName) end
end
results.destroy()
ms.destroy()
return addr
end
end
registerLuaFunctionHighlight('AOBScanModule')
--[[
test AOBScanModule()
local aob_addr_str = AOBScanModule("???.exe", "48 8B 05 ?? ?? ?? ?? 33 ED 48 8B 88", "+X+R")
if aob_addr_str then
print("🔦 Final AOB Address: 0x" .. aob_addr_str)
else
print("💔 AOB not found in ???.exe")
end
]]--
-- Lua scripts that table checkbox will not be checked with "NO_ACTIVATE" in comment/script body
if not onMemRecPostExecute then
function onMemRecPostExecute(memoryrecord, newState, succeeded)
if memoryrecord.Type == vtAutoAssembler and memoryrecord.Script:find("NO_ACTIVATE") and newState and succeeded then
synchronize(function()
memoryrecord.disableWithoutExecute()
end)
end
end
end
-- Memory record IDs now allowed to be 'locked'
IDs = {999999, 9999999}
-- Determine event trigger sequence
if not contains then
function contains(table, val)
for i = 1, #table do
if table[i] == val then
return true
end
end
return false
end
end
if not onMemRecPreExecute then
function onMemRecPreExecute(memoryrecord, newstate)
if contains(IDs, memoryrecord.ID) and newstate then
synchronize(function()
if not memoryrecord.OnActivate then
memoryrecord.OnActivate = function(memoryrecord, before, currentstate)
return false
end
end
end)
end
end
end
-- Utility Functions
-- Clear lua engine log
if not clearLuaLog then
function clearLuaLog()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
end)
end
end
registerLuaFunctionHighlight('clearLuaLog')
-- Close lua engine log
if not closeLuaEngine then
function closeLuaEngine()
synchronize(function()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine')
-- Clear lua engine log & close lua engine
if not closeLuaEngine2 then
function closeLuaEngine2()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine2')
if not getProcessNameFromPID then
function getProcessNameFromPID(pid)
local sl = createStringList()
getProcessList(sl)
local hexPid = string.format("%X", pid):upper()
for i = 0, sl.Count - 1 do
local entry = sl[i]
local hexid, name = entry:match("^(%x+)%-(.+)$")
if hexid and name then
if tonumber(hexid, 16) == pid then
return name
end
end
end
return "(unknown)"
end
end
registerLuaFunctionHighlight('getProcessNameFromPID')
if not printProcessInfo then
function printProcessInfo()
local pid = getOpenedProcessID()
local name = getProcessNameFromPID(pid)
print(string.format("📎 Attached to process: %s (PID: %d / 0x%X)", name, pid, pid))
end
end
registerLuaFunctionHighlight('printProcessInfo')
if not dumpProcessListAndFindPID then
function dumpProcessListAndFindPID()
local pid = getOpenedProcessID()
print(string.format("💭 Current PID: %d / 0x%X", pid, pid))
local sl = createStringList()
getProcessList(sl)
print("🧾 Dumping process list:")
for i = 0, sl.Count - 1 do
local entry = sl[i]
print(string.format("[%d] %s", i, entry))
-- 嘗試解析並比對 PID
local name, hexid = entry:match("(.+)%-(%x+)$")
if name and hexid then
local parsed = tonumber(hexid, 16)
if parsed == pid then
print("🔦 Match found in process list:")
print(string.format("Name: %s | PID: %s (0x%s)", name, parsed, hexid))
end
end
end
end
end
registerLuaFunctionHighlight('dumpProcessListAndFindPID')
if not toHex32 then
function toHex32(num)
local hexstr = "0123456789ABCDEF"
local result = ""
if num < 0 then
num = (num + (1 << 32)) % (1 << 32) -- 轉成32-bit補數
end
for i = 1, 8 do -- 32-bit 一共8個hex位
local n = num & 0xF -- 取最低4 bit
result = hexstr:sub(n + 1, n + 1) .. result
num = num >> 4 -- 右移4 bit
end
return result
end
end
registerLuaFunctionHighlight('toHex32')
if not toHex then
function toHex(num)
local hexstr = "0123456789ABCDEF"
local result = ""
if num < 0 then
num = (num + (1 << 64)) % (1 << 64) -- 轉成64-bit補數
end
for i = 1, 16 do -- 每4 bit 一個 hex字，64-bit總共16個hex位
local n = num & 0xF -- 取最低4bit
result = hexstr:sub(n + 1, n + 1) .. result
num = num >> 4 -- 右移4bit
end
return result
end
end
registerLuaFunctionHighlight('toHex')
synchronize(function() AddressList.Header.OnSectionClick = nil end)
--[[
[DISABLE]
{$lua}
if AOBScanModule then
AOBScanModule = nil
end
if onMemRecPostExecute then
onMemRecPostExecute = nil
end
if onMemRecPreExecute then
onMemRecPreExecute = nil
end
if clearLuaLog then
clearLuaLog = nil
end
if closeLuaEngine then
closeLuaEngine = nil
end
if closeLuaEngine2 then
closeLuaEngine2 = nil
end
]]--