114982
"<=== Attach to process and activate mono"
0000FF
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if(getCEVersion() < 7.4) then
ShowMessage('Warning! CE version should be 7.4 or above')
end
OpenProcess("Gloomwood.exe")
if(process == nil) then
ShowMessage('The process is NOT found!')
end
LaunchMonoDataCollector()
{$asm}
[DISABLE]
240392
"Fly-Hack"
Auto Assembler Script
define(address,Gloomwood.Players.PlayerMovement:FixedUpdate+35)
define(bytes,74 23)
[ENABLE]
assert(address,bytes)
address:
nop
nop
[DISABLE]
address:
db bytes
// je Gloomwood.Players.PlayerMovement:FixedUpdate+5a
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Gloomwood.Players.PlayerMovement:FixedUpdate+35
Gloomwood.Players.PlayerMovement:FixedUpdate+8: 48 89 75 E8 - mov [rbp-18],rsi
Gloomwood.Players.PlayerMovement:FixedUpdate+c: 48 89 7D F0 - mov [rbp-10],rdi
Gloomwood.Players.PlayerMovement:FixedUpdate+10: 4C 89 7D F8 - mov [rbp-08],r15
Gloomwood.Players.PlayerMovement:FixedUpdate+14: 48 8B F1 - mov rsi,rcx
Gloomwood.Players.PlayerMovement:FixedUpdate+17: 48 B8 C0 6E 3D AD E5 01 00 00 - mov rax,000001E5AD3D6EC0
Gloomwood.Players.PlayerMovement:FixedUpdate+21: 0F B6 00 - movzx eax,byte ptr [rax]
Gloomwood.Players.PlayerMovement:FixedUpdate+24: 85 C0 - test eax,eax
Gloomwood.Players.PlayerMovement:FixedUpdate+26: 0F 85 C6 01 00 00 - jne Gloomwood.Players.PlayerMovement:FixedUpdate+1f2
Gloomwood.Players.PlayerMovement:FixedUpdate+2c: 0F B6 86 33 02 00 00 - movzx eax,byte ptr [rsi+00000233]
Gloomwood.Players.PlayerMovement:FixedUpdate+33: 85 C0 - test eax,eax
// ---------- INJECTING HERE ----------
Gloomwood.Players.PlayerMovement:FixedUpdate+35: 74 23 - je Gloomwood.Players.PlayerMovement:FixedUpdate+5a
// ---------- DONE INJECTING ----------
Gloomwood.Players.PlayerMovement:FixedUpdate+37: C6 86 05 02 00 00 00 - mov byte ptr [rsi+00000205],00
Gloomwood.Players.PlayerMovement:FixedUpdate+3e: C6 86 06 02 00 00 00 - mov byte ptr [rsi+00000206],00
Gloomwood.Players.PlayerMovement:FixedUpdate+45: 66 0F 57 C0 - xorpd xmm0,xmm0
Gloomwood.Players.PlayerMovement:FixedUpdate+49: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0
Gloomwood.Players.PlayerMovement:FixedUpdate+4d: F3 0F 11 AE A4 02 00 00 - movss [rsi+000002A4],xmm5
Gloomwood.Players.PlayerMovement:FixedUpdate+55: E9 98 01 00 00 - jmp Gloomwood.Players.PlayerMovement:FixedUpdate+1f2
Gloomwood.Players.PlayerMovement:FixedUpdate+5a: F3 0F 10 05 CE 01 00 00 - movss xmm0,[Gloomwood.Players.PlayerMovement:FixedUpdate+230]
Gloomwood.Players.PlayerMovement:FixedUpdate+62: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
Gloomwood.Players.PlayerMovement:FixedUpdate+66: F2 0F 11 45 B8 - movsd [rbp-48],xmm0
Gloomwood.Players.PlayerMovement:FixedUpdate+6b: 48 8B 7E 28 - mov rdi,[rsi+28]
Or, as DNSpy says:
Private Sub FixedUpdate()
If GameManager.IsPaused Then
Return
End If
If Me.inNoclip Then << thats what we are NOPing out
Me.isGrounded = False
Me.isNearGrounded = False
Me.gravityForce = 0F
Return
End If
Me.CheckGrounded(1.25F, Me.config.groundLayer, Me.groundCol)
Me.isGrounded = Me.charController.isGrounded
Me.hasLanded = False
If Me.moveVelocity.sqrMagnitude > 0F AndAlso Not Me.isSwimming Then
Me.isBlocked = Me.IsCharacterBlocked(Me.moveDirection)
End If
End Sub
}
240390
"Stealth-Mode"
1
240389
"GetSightLevel"
Auto Assembler Script
define(address,Gloomwood.AI.AISense:GetSightLevel)
define(bytes,55)
[ENABLE]
assert(address,bytes)
address:
ret
[DISABLE]
address:
db bytes
// push rbp
{
// ORIGINAL CODE - INJECTION POINT: Gloomwood.AI.AISense:GetSightLevel
1E6960F8D2B: 00 04 02 - add [rdx+rax],al
1E6960F8D2E: 00 00 - add [rax],al
1E6960F8D30: 00 00 - add [rax],al
1E6960F8D32: 00 00 - add [rax],al
1E6960F8D34: 00 00 - add [rax],al
1E6960F8D36: 00 00 - add [rax],al
1E6960F8D38: 00 00 - add [rax],al
1E6960F8D3A: 00 00 - add [rax],al
1E6960F8D3C: 00 00 - add [rax],al
1E6960F8D3E: 00 00 - add [rax],al
// ---------- INJECTING HERE ----------
Gloomwood.AI.AISense:GetSightLevel: 55 - push rbp
// ---------- DONE INJECTING ----------
Gloomwood.AI.AISense:GetSightLevel+1: 48 8B EC - mov rbp,rsp
Gloomwood.AI.AISense:GetSightLevel+4: 48 81 EC E0 04 00 00 - sub rsp,000004E0
Gloomwood.AI.AISense:GetSightLevel+b: 48 89 5D C8 - mov [rbp-38],rbx
Gloomwood.AI.AISense:GetSightLevel+f: 48 89 75 D0 - mov [rbp-30],rsi
Gloomwood.AI.AISense:GetSightLevel+13: 48 89 7D D8 - mov [rbp-28],rdi
Gloomwood.AI.AISense:GetSightLevel+17: 4C 89 65 E0 - mov [rbp-20],r12
Gloomwood.AI.AISense:GetSightLevel+1b: 4C 89 6D E8 - mov [rbp-18],r13
Gloomwood.AI.AISense:GetSightLevel+1f: 4C 89 75 F0 - mov [rbp-10],r14
Gloomwood.AI.AISense:GetSightLevel+23: 4C 89 7D F8 - mov [rbp-08],r15
Gloomwood.AI.AISense:GetSightLevel+27: 4C 8B F1 - mov r14,rcx
}
240391
"GetHearLevel"
Auto Assembler Script
define(address,Gloomwood.AI.AISense:GetHearLevel)
define(bytes,55 48 8B EC 48 81 EC E0 00 00 00)
[ENABLE]
assert(address,bytes)
address:
ret
[DISABLE]
address:
db bytes
// push rbp
{
// ORIGINAL CODE - INJECTION POINT: Gloomwood.AI.AISense:GetHearLevel
1E6960F9FBB: 00 00 - add [rax],al
1E6960F9FBD: 00 00 - add [rax],al
1E6960F9FBF: 00 01 - add [rcx],al
1E6960F9FC1: 04 01 - add al,01
1E6960F9FC3: 00 04 42 - add [rdx+rax*2],al
1E6960F9FC6: 00 00 - add [rax],al
1E6960F9FC8: 00 00 - add [rax],al
1E6960F9FCA: 00 00 - add [rax],al
1E6960F9FCC: 00 00 - add [rax],al
1E6960F9FCE: 00 00 - add [rax],al
// ---------- INJECTING HERE ----------
Gloomwood.AI.AISense:GetHearLevel: 55 - push rbp
// ---------- DONE INJECTING ----------
Gloomwood.AI.AISense:GetHearLevel+1: 48 8B EC - mov rbp,rsp
Gloomwood.AI.AISense:GetHearLevel+4: 48 81 EC E0 00 00 00 - sub rsp,000000E0
Gloomwood.AI.AISense:GetHearLevel+b: 48 89 5D C8 - mov [rbp-38],rbx
Gloomwood.AI.AISense:GetHearLevel+f: 48 89 75 D0 - mov [rbp-30],rsi
Gloomwood.AI.AISense:GetHearLevel+13: 48 89 7D D8 - mov [rbp-28],rdi
Gloomwood.AI.AISense:GetHearLevel+17: 4C 89 65 E0 - mov [rbp-20],r12
Gloomwood.AI.AISense:GetHearLevel+1b: 4C 89 6D E8 - mov [rbp-18],r13
Gloomwood.AI.AISense:GetHearLevel+1f: 4C 89 75 F0 - mov [rbp-10],r14
Gloomwood.AI.AISense:GetHearLevel+23: 4C 89 7D F8 - mov [rbp-08],r15
Gloomwood.AI.AISense:GetHearLevel+27: 4C 8B F1 - mov r14,rcx
}
240397
"Unlock Doors without Key (Skip Thief-Mode-Check)"
Auto Assembler Script
define(address,Gloomwood.World.KeyLock:TryUnlock+ce)
define(bytes,85 C0)
[ENABLE]
assert(address,bytes)
address:
nop 2
[DISABLE]
address:
db bytes
// test eax,eax
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Gloomwood.World.KeyLock:TryUnlock+ce
Gloomwood.World.KeyLock:TryUnlock+96: 49 BB A0 BE 15 76 E6 01 00 00 - mov r11,UnityEngine.Object:op_Equality
Gloomwood.World.KeyLock:TryUnlock+a0: 41 FF D3 - call r11
Gloomwood.World.KeyLock:TryUnlock+a3: 48 C7 45 C0 00 00 00 00 - mov qword ptr [rbp-40],00000000
Gloomwood.World.KeyLock:TryUnlock+ab: 85 C0 - test eax,eax
Gloomwood.World.KeyLock:TryUnlock+ad: 0F 84 C2 00 00 00 - je Gloomwood.World.KeyLock:TryUnlock+175
Gloomwood.World.KeyLock:TryUnlock+b3: 48 8B 87 B8 00 00 00 - mov rax,[rdi+000000B8]
Gloomwood.World.KeyLock:TryUnlock+ba: 48 8B C8 - mov rcx,rax
Gloomwood.World.KeyLock:TryUnlock+bd: 83 39 00 - cmp dword ptr [rcx],00
Gloomwood.World.KeyLock:TryUnlock+c0: 48 8B 80 98 00 00 00 - mov rax,[rax+00000098]
Gloomwood.World.KeyLock:TryUnlock+c7: 0F B6 80 99 00 00 00 - movzx eax,byte ptr [rax+00000099]
// ---------- INJECTING HERE ----------
Gloomwood.World.KeyLock:TryUnlock+ce: 85 C0 - test eax,eax
// ---------- DONE INJECTING ----------
Gloomwood.World.KeyLock:TryUnlock+d0: 74 0E - je Gloomwood.World.KeyLock:TryUnlock+e0
Gloomwood.World.KeyLock:TryUnlock+d2: B8 01 00 00 00 - mov eax,00000001
Gloomwood.World.KeyLock:TryUnlock+d7: 4C 0F B6 F8 - movzx r15,al
Gloomwood.World.KeyLock:TryUnlock+db: E9 95 00 00 00 - jmp Gloomwood.World.KeyLock:TryUnlock+175
Gloomwood.World.KeyLock:TryUnlock+e0: 4C 8B 77 68 - mov r14,[rdi+68]
Gloomwood.World.KeyLock:TryUnlock+e4: 45 33 ED - xor r13d,r13d
Gloomwood.World.KeyLock:TryUnlock+e7: E9 7C 00 00 00 - jmp Gloomwood.World.KeyLock:TryUnlock+168
Gloomwood.World.KeyLock:TryUnlock+ec: 48 8D 6D 00 - lea rbp,[rbp+00]
Gloomwood.World.KeyLock:TryUnlock+f0: 49 63 C5 - movsxd rax,r13d
Gloomwood.World.KeyLock:TryUnlock+f3: 41 39 46 18 - cmp [r14+18],eax
}
240378
"Get Player Data"
Auto Assembler Script
{ Game : Gloomwood.exe
Version:
Date : 2022-09-06
Author : Marc
Gets the address of PlayerHealth
}
define(address,Gloomwood.Players.PlayerHealth:Update+c)
define(bytes,48 8B F1 48 8D AD 00 00 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,1E69610E90C)
alloc(player,8)
label(code)
label(return)
newmem:
mov [player],rcx
code:
mov rsi,rcx
lea rbp,[rbp+00000000]
jmp return
address:
jmp newmem
nop 5
return:
registersymbol(player)
[DISABLE]
address:
db bytes
// mov rsi,rcx
// lea rbp,[rbp+00000000]
dealloc(*)
unregistersymbol(player)
{
// ORIGINAL CODE - INJECTION POINT: Gloomwood.Players.PlayerHealth:Update+c
1E69610E8F4: 00 00 - add [rax],al
1E69610E8F6: 00 00 - add [rax],al
1E69610E8F8: 00 00 - add [rax],al
1E69610E8FA: 00 00 - add [rax],al
1E69610E8FC: 00 00 - add [rax],al
1E69610E8FE: 00 00 - add [rax],al
Gloomwood.Players.PlayerHealth:Update: 55 - push rbp
Gloomwood.Players.PlayerHealth:Update+1: 48 8B EC - mov rbp,rsp
Gloomwood.Players.PlayerHealth:Update+4: 48 83 EC 30 - sub rsp,30
Gloomwood.Players.PlayerHealth:Update+8: 48 89 75 F8 - mov [rbp-08],rsi
// ---------- INJECTING HERE ----------
Gloomwood.Players.PlayerHealth:Update+c: 48 8B F1 - mov rsi,rcx
// ---------- DONE INJECTING ----------
Gloomwood.Players.PlayerHealth:Update+f: 48 8D AD 00 00 00 00 - lea rbp,[rbp+00000000]
Gloomwood.Players.PlayerHealth:Update+16: 49 BB 80 47 02 96 E6 01 00 00 - mov r11,Gloomwood.Entity.EntityHealth:Update
Gloomwood.Players.PlayerHealth:Update+20: 41 FF D3 - call r11
Gloomwood.Players.PlayerHealth:Update+23: 0F B6 86 18 01 00 00 - movzx eax,byte ptr [rsi+00000118]
Gloomwood.Players.PlayerHealth:Update+2a: 85 C0 - test eax,eax
Gloomwood.Players.PlayerHealth:Update+2c: 0F 84 31 00 00 00 - je Gloomwood.Players.PlayerHealth:Update+63
Gloomwood.Players.PlayerHealth:Update+32: 48 8D 6D 00 - lea rbp,[rbp+00]
Gloomwood.Players.PlayerHealth:Update+36: 49 BB 10 6E BD 89 E6 01 00 00 - mov r11,UnityEngine.Time:get_deltaTime
Gloomwood.Players.PlayerHealth:Update+40: 41 FF D3 - call r11
Gloomwood.Players.PlayerHealth:Update+43: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
}
240379
"Player"
0
1
player
0
240382
"Health"
0
4 Bytes
+ac
240398
"==== values below: 1=on, 0=off (who would've thought...) ====="
1
240380
"Invulnerability"
0
0000FF
Byte
+a0
240383
"inWoundedState"
0
Byte
+11B
240384
"onPainkiller"
0
Byte
+11C
240388
"developerMode"
inNoclip (Fly Hack + No Collision)
Byte
[player]+C8
59
240394
"inNoclip (Fly Hack + No Collision)"
Byte
[player]+18
233
30