35
"Enable"
00FF00
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
fcEnabled = getAddress('AvP_DX11.exe+666534')
fcFOV = getAddress('AvP_DX11.exe+5CFD74')
fcUseFOV = getAddress('AvP_DX11.exe+666536')
soloLobby = getAddress('AvP_DX11.exe+5E9C14')
[DISABLE]
45
"Player"
FF8080
1
88
"Alien"
1
86
"Predator"
1
6
"PlayerHealth"
0
Float
"AvP_DX11.exe"+0066DDEC
408
0
0
87
"Human"
1
85
"Inf Ammo"
Auto Assembler Script
{ Game : AvP_DX11.exe
Version:
Date : 2026-01-02
Author : nightfall
}
[ENABLE]
aobscanmodule(writeAmmo,AvP_DX11.exe,C1 F3 0F 11 41 10 D9) // should be unique
registersymbol(writeAmmo)
writeAmmo+01:
db 90 90 90 90 90
[DISABLE]
writeAmmo+01:
db F3 0F 11 41 10
unregistersymbol(writeAmmo)
{
// ORIGINAL CODE - INJECTION POINT: AvP_DX11.exe+3A4D52
AvP_DX11.exe+3A4D2F: CC - int 3
AvP_DX11.exe+3A4D30: F3 0F 10 41 10 - movss xmm0,[ecx+10]
AvP_DX11.exe+3A4D35: F3 0F 10 4C 24 04 - movss xmm1,[esp+04]
AvP_DX11.exe+3A4D3B: 0F 2F C8 - comiss xmm1,xmm0
AvP_DX11.exe+3A4D3E: 76 0E - jna AvP_DX11.exe+3A4D4E
AvP_DX11.exe+3A4D40: 0F 57 C0 - xorps xmm0,xmm0
AvP_DX11.exe+3A4D43: F3 0F 11 41 10 - movss [ecx+10],xmm0
AvP_DX11.exe+3A4D48: D9 41 10 - fld dword ptr [ecx+10]
AvP_DX11.exe+3A4D4B: C2 04 00 - ret 0004
AvP_DX11.exe+3A4D4E: F3 0F 5C C1 - subss xmm0,xmm1
// ---------- INJECTING HERE ----------
AvP_DX11.exe+3A4D52: F3 0F 11 41 10 - movss [ecx+10],xmm0
// ---------- DONE INJECTING ----------
AvP_DX11.exe+3A4D57: D9 41 10 - fld dword ptr [ecx+10]
AvP_DX11.exe+3A4D5A: C2 04 00 - ret 0004
AvP_DX11.exe+3A4D5D: CC - int 3
AvP_DX11.exe+3A4D5E: CC - int 3
AvP_DX11.exe+3A4D5F: CC - int 3
AvP_DX11.exe+3A4D60: F3 0F 10 49 14 - movss xmm1,[ecx+14]
AvP_DX11.exe+3A4D65: F3 0F 10 41 10 - movss xmm0,[ecx+10]
AvP_DX11.exe+3A4D6A: F3 0F 10 54 24 04 - movss xmm2,[esp+04]
AvP_DX11.exe+3A4D70: 0F 28 D9 - movaps xmm3,xmm1
AvP_DX11.exe+3A4D73: F3 0F 5C D8 - subss xmm3,xmm0
}
36
"Freecam"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
writeInteger(fcEnabled, 1)
writeFloat(fcFOV, 120.0)
writeByte(fcUseFOV, 1)
[DISABLE]
writeInteger(fcEnabled, 0)
writeByte(fcUseFOV, 0)
38
"Visuals Changer"
Auto Assembler Script
[ENABLE]
alloc(changeType,8)
registersymbol(changeType)
changeType:
dd 01
[DISABLE]
unregistersymbol(changeType)
dealloc(*)
39
"Type"
1:Alien
2:Predator
3:Marine
0
4 Bytes
changeType
37
"<-- Change Visuals"
Auto Assembler Script
[ENABLE]
define(toPredatorFunc,AvP_DX11.exe+415620)
define(toAlienFunc,AvP_DX11.exe+415430)
define(toMarineFunc,AvP_DX11.exe+415540)
alloc(cmem,$1000,toAlienFunc)
registersymbol(cmem,toAlienFunc,toPredatorFunc,toMarineFunc)
CreateThread(cmem)
cmem:
cmp [changeType],0
je @f
{$ccode}
extern __cdecl int toPredatorFunc(char arg1);
extern __cdecl int toAlienFunc(char arg1);
extern __cdecl int toMarineFunc(char arg1);
extern int changeType;
char arg = 0;
switch (changeType){
case 1:
toAlienFunc(arg);
break;
case 2:
toPredatorFunc(arg);
break;
case 3:
toMarineFunc(arg);
break;
default:
break;
}
{$asm}
@@:
xor rax,rax
ret
[DISABLE]
dealloc(*)
unregistersymbol(*)
46
"Game"
0080FF
1
40
"Unlock all Levels"
Auto Assembler Script
[ENABLE]
define(OpenAllLevels,AvP_DX11.exe+416A10)
alloc(omem,$200,AvP_DX11.exe+416A10)
registersymbol(omem,OpenAllLevels)
CreateThread(omem)
omem:
{$ccode}
extern __cdecl void* OpenAllLevels(char arg1);
OpenAllLevels(0);
{$asm}
xor eax,eax
ret
[DISABLE]
unregistersymbol(*)
dealloc(*)
74
"Unlock all Skins"
Auto Assembler Script
{ Game : AvP_DX11.exe
Version:
Date : 2025-12-30
Author : nightfall
}
[ENABLE]
aobscanmodule(skins,AvP_DX11.exe,76 D8 68 34 4F 8C 00)
skins:
db EB D8 68 34 4F 8C 00
[DISABLE]
skins:
db 76 D8 68 34 4F 8C 00
{
// ORIGINAL CODE - INJECTION POINT: AvP_DX11.exe+38EE44
AvP_DX11.exe+38EE27: 74 1D - je AvP_DX11.exe+38EE46
AvP_DX11.exe+38EE29: 8D 4C 24 14 - lea ecx,[esp+14]
AvP_DX11.exe+38EE2D: 6A 01 - push 01
AvP_DX11.exe+38EE2F: 51 - push ecx
AvP_DX11.exe+38EE30: E8 CB A2 D8 FF - call AvP_DX11.exe+119100
AvP_DX11.exe+38EE35: 83 C4 04 - add esp,04
AvP_DX11.exe+38EE38: 50 - push eax
AvP_DX11.exe+38EE39: 8B CD - mov ecx,ebp
AvP_DX11.exe+38EE3B: E8 C0 37 D6 FF - call AvP_DX11.exe+F2600
AvP_DX11.exe+38EE40: 3B 44 24 10 - cmp eax,[esp+10]
// ---------- INJECTING HERE ----------
AvP_DX11.exe+38EE44: 76 D8 - jna AvP_DX11.exe+38EE1E
// ---------- DONE INJECTING ----------
AvP_DX11.exe+38EE46: 68 34 4F 8C 00 - push AvP_DX11.exe+4C4F34
AvP_DX11.exe+38EE4B: E8 80 B9 DF FF - call AvP_DX11.exe+18A7D0
AvP_DX11.exe+38EE50: 83 C4 04 - add esp,04
AvP_DX11.exe+38EE53: 5F - pop edi
AvP_DX11.exe+38EE54: 5E - pop esi
AvP_DX11.exe+38EE55: 5D - pop ebp
AvP_DX11.exe+38EE56: 5B - pop ebx
AvP_DX11.exe+38EE57: 8B 4C 24 44 - mov ecx,[esp+44]
AvP_DX11.exe+38EE5B: 33 CC - xor ecx,esp
AvP_DX11.exe+38EE5D: B0 01 - mov al,01
}
41
"Skip Current Level"
Auto Assembler Script
[ENABLE]
define(SkipLevel,AvP_DX11.exe+39C9B0)
alloc(smem,$200,AvP_DX11.exe+39C9B0)
registersymbol(smem,SkipLevel)
CreateThread(smem)
smem:
{$ccode}
extern __cdecl void* SkipLevel(char arg1);
SkipLevel(0);
{$asm}
xor eax,eax
ret
[DISABLE]
unregistersymbol(*)
dealloc(*)
69
"ConsoleHook"
Auto Assembler Script
{ Game : AvP_DX11.exe
Version:
Date : 2025-12-30
Author : nightfall
}
[ENABLE]
aobscanmodule(setGlobalFlags,AvP_DX11.exe,80 3D 58 1C 9E 00 00)
alloc(newmem,$1000)
label(code)
label(return)
label(openConsole)
newmem:
cmp [openConsole],0
je @f
mov eax,1
mov [openConsole],0
ret
code:
cmp byte ptr [AvP_DX11.exe+5E1C58],00
jmp return
openConsole:
db 00
setGlobalFlags:
jmp newmem
nop 2
return:
registersymbol(setGlobalFlags openConsole)
[DISABLE]
setGlobalFlags:
db 80 3D 58 1C 9E 00 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: AvP_DX11.exe+39D4E0
AvP_DX11.exe+39D4D5: B0 01 - mov al,01
AvP_DX11.exe+39D4D7: C3 - ret
AvP_DX11.exe+39D4D8: CC - int 3
AvP_DX11.exe+39D4D9: CC - int 3
AvP_DX11.exe+39D4DA: CC - int 3
AvP_DX11.exe+39D4DB: CC - int 3
AvP_DX11.exe+39D4DC: CC - int 3
AvP_DX11.exe+39D4DD: CC - int 3
AvP_DX11.exe+39D4DE: CC - int 3
AvP_DX11.exe+39D4DF: CC - int 3
// ---------- INJECTING HERE ----------
AvP_DX11.exe+39D4E0: 80 3D 58 1C 9E 00 00 - cmp byte ptr [AvP_DX11.exe+5E1C58],00
// ---------- DONE INJECTING ----------
AvP_DX11.exe+39D4E7: 74 18 - je AvP_DX11.exe+39D501
AvP_DX11.exe+39D4E9: 80 3D C8 15 9E 00 00 - cmp byte ptr [AvP_DX11.exe+5E15C8],00
AvP_DX11.exe+39D4F0: 75 0F - jne AvP_DX11.exe+39D501
AvP_DX11.exe+39D4F2: 83 3D 38 FD 9F 00 00 - cmp dword ptr [AvP_DX11.exe+5FFD38],00
AvP_DX11.exe+39D4F9: 75 06 - jne AvP_DX11.exe+39D501
AvP_DX11.exe+39D4FB: B8 01 00 00 00 - mov eax,00000001
AvP_DX11.exe+39D500: C3 - ret
AvP_DX11.exe+39D501: 33 C0 - xor eax,eax
AvP_DX11.exe+39D503: C3 - ret
AvP_DX11.exe+39D504: CC - int 3
}
72
"Open Console"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
writeByte('openConsole',1)
[DISABLE]
writeByte('openConsole',1)
Toggle Activation
220
0
51
"HookConsoleSettings"
Auto Assembler Script
{ Game : AvP_DX11.exe
Version:
Date : 2025-12-30
Author : nightfall
This script does blah blah blah
}
[ENABLE]
aobscanmodule(consoleWrapperHook,AvP_DX11.exe,8B 0D A0 77 9E 00 8B 01 8B 50 1C) // should be unique
alloc(newmem,$1000)
label(return)
label(console)
newmem:
mov ecx,[AvP_DX11.exe+5E77A0]
mov [console],ecx
jmp return
console:
dd 00
consoleWrapperHook:
jmp newmem
nop
return:
registersymbol(consoleWrapperHook console)
[DISABLE]
consoleWrapperHook:
db 8B 0D A0 77 9E 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: AvP_DX11.exe+18CE8E
AvP_DX11.exe+18CE63: 84 C0 - test al,al
AvP_DX11.exe+18CE65: 0F 94 C0 - sete al
AvP_DX11.exe+18CE68: A2 A9 77 9E 00 - mov [AvP_DX11.exe+5E77A9],al
AvP_DX11.exe+18CE6D: C6 05 A8 77 9E 00 01 - mov byte ptr [AvP_DX11.exe+5E77A8],01
AvP_DX11.exe+18CE74: C7 05 A4 77 9E 00 00 00 00 00 - mov [AvP_DX11.exe+5E77A4],00000000
AvP_DX11.exe+18CE7E: C3 - ret
AvP_DX11.exe+18CE7F: CC - int 3
AvP_DX11.exe+18CE80: E8 6B 0B 00 00 - call AvP_DX11.exe+18D9F0
AvP_DX11.exe+18CE85: 80 3D A9 77 9E 00 00 - cmp byte ptr [AvP_DX11.exe+5E77A9],00
AvP_DX11.exe+18CE8C: 74 2C - je AvP_DX11.exe+18CEBA
// ---------- INJECTING HERE ----------
AvP_DX11.exe+18CE8E: 8B 0D A0 77 9E 00 - mov ecx,[AvP_DX11.exe+5E77A0]
// ---------- DONE INJECTING ----------
AvP_DX11.exe+18CE94: 8B 01 - mov eax,[ecx]
AvP_DX11.exe+18CE96: 8B 50 1C - mov edx,[eax+1C]
AvP_DX11.exe+18CE99: FF D2 - call edx
AvP_DX11.exe+18CE9B: 84 C0 - test al,al
AvP_DX11.exe+18CE9D: 74 14 - je AvP_DX11.exe+18CEB3
AvP_DX11.exe+18CE9F: 8B 0D A0 77 9E 00 - mov ecx,[AvP_DX11.exe+5E77A0]
AvP_DX11.exe+18CEA5: 8B 01 - mov eax,[ecx]
AvP_DX11.exe+18CEA7: 8B 50 20 - mov edx,[eax+20]
AvP_DX11.exe+18CEAA: 68 C0 CD 58 00 - push AvP_DX11.exe+18CDC0
AvP_DX11.exe+18CEAF: FF D2 - call edx
}
55
"size"
0
Float
[console]+C
71
"Background"
0
Float
[console]+1C
80
"Launch Solo Lobby"
Auto Assembler Script
{ Game : AvP_DX11.exe
Version:
Date : 2025-12-31
Author : nightfall
Enable this script once you have set up your lobby.
Pressing ESCAPE or picking up items in this kind of lobby will cause a crash (this still need to be fixed)
}
[ENABLE]
aobscanmodule(noKick,AvP_DX11.exe,A8 02 74 13 8B 56 0C) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
cmp eax,14100B
je AvP_DX11.exe+40F3D2
code:
test al,02
je AvP_DX11.exe+40F371
mov edx,[esi+0C]
jmp return
noKick:
jmp newmem
nop 2
return:
registersymbol(noKick)
{$lua}
if syntaxcheck then return end
ShowMessage("Leave this script enabled while you're inside the lobby and don't press ESCAPE")
writeInteger(soloLobby,8)
{$asm}
[DISABLE]
noKick:
db A8 02 74 13 8B 56 0C
unregistersymbol(noKick)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: AvP_DX11.exe+40F35A
AvP_DX11.exe+40F34B: CC - int 3
AvP_DX11.exe+40F34C: CC - int 3
AvP_DX11.exe+40F34D: CC - int 3
AvP_DX11.exe+40F34E: CC - int 3
AvP_DX11.exe+40F34F: CC - int 3
AvP_DX11.exe+40F350: 56 - push esi
AvP_DX11.exe+40F351: 8B F1 - mov esi,ecx
AvP_DX11.exe+40F353: 8B 46 04 - mov eax,[esi+04]
AvP_DX11.exe+40F356: A8 01 - test al,01
AvP_DX11.exe+40F358: 74 78 - je AvP_DX11.exe+40F3D2
// ---------- INJECTING HERE ----------
AvP_DX11.exe+40F35A: A8 02 - test al,02
// ---------- DONE INJECTING ----------
AvP_DX11.exe+40F35C: 74 13 - je AvP_DX11.exe+40F371
AvP_DX11.exe+40F35E: 8B 56 0C - mov edx,[esi+0C]
AvP_DX11.exe+40F361: 8B C8 - mov ecx,eax
AvP_DX11.exe+40F363: C1 E9 02 - shr ecx,02
AvP_DX11.exe+40F366: 81 E1 FF 00 00 00 - and ecx,000000FF
AvP_DX11.exe+40F36C: 8B 0C 8A - mov ecx,[edx+ecx*4]
AvP_DX11.exe+40F36F: EB 02 - jmp AvP_DX11.exe+40F373
AvP_DX11.exe+40F371: 33 C9 - xor ecx,ecx
AvP_DX11.exe+40F373: 8B 56 0C - mov edx,[esi+0C]
AvP_DX11.exe+40F376: C1 E8 0A - shr eax,0A
}
73
"Testing"
808080
1
8
"Pointers"
808080
1
7
"PlayerHealthBase"
1
0
4 Bytes
"AvP_DX11.exe"+0066DDEC
3D4
0
0
34
"Freecam"
1
30
"Freecam Enabled"
0
4 Bytes
AvP_DX11.exe+666534
33
"useFreecamFOV"
0
Byte
AvP_DX11.exe+666536
31
"FreecamFOV"
0
Float
AvP_DX11.exe+5CFD74
44
"TeamPtr"
0
4 Bytes
AvP_DX11.exe+671E3C
75
"mp_lobby_state"
8:Start Match
0
4 Bytes
AvP_DX11.exe+5E9C14
Change of movss [esi+34],xmm0
AvP_DX11.exe+14738C
24
0C
0F
2F
C8
F3
0F
11
46
34
72
0E
8B
06
8B
Change of je AvP_DX11.exe+18CEBA
AvP_DX11.exe+18CE8C
A9
77
9E
00
00
74
2C
8B
0D
A0
77
9E
Change of je AvP_DX11.exe+18CEB3
AvP_DX11.exe+18CE9D
1C
FF
D2
84
C0
74
14
8B
0D
A0
77
9E
Change of je AvP_DX11.exe+18CF16
AvP_DX11.exe+18CECA
06
21
00
84
C0
74
4A
E8
6F
DB
25
00
Change of je AvP_DX11.exe+18CF16
AvP_DX11.exe+18CED3
DB
25
00
84
C0
74
41
80
3D
A9
77
9E
Change of jne AvP_DX11.exe+18CEF4
AvP_DX11.exe+18CEDC
A9
77
9E
00
00
75
16
80
3D
A8
77
9E
Change of je AvP_DX11.exe+18CEF4
AvP_DX11.exe+18CEE5
A8
77
9E
00
00
74
0D
68
CC
77
9E
00
Change of je AvP_DX11.exe+18CF16
AvP_DX11.exe+18CEC1
A8
77
9E
00
00
74
53
E8
18
06
21
00
Change of mov byte ptr [AvP_DX11.exe+5E77A9],01
AvP_DX11.exe+18CF03
14
6A
00
6A
01
C6
05
A9
77
9E
00
01
FF
D2
C7
05
B4
Change of je AvP_DX11.exe+40A075
AvP_DX11.exe+40A06E
58
8A
9E
00
00
74
05
E8
9B
40
D9
FF
Change of je AvP_DX11.exe+40A08B
AvP_DX11.exe+40A077
40
D9
FF
85
F6
74
12
80
3D
4D
A2
9E
Change of call AvP_DX11.exe+47E9E2
AvP_DX11.exe+1267D4
68
F8
1B
9E
00
E8
09
82
35
00
68
9C
00
00
00
Change of call AvP_DX11.exe+3F86A0
AvP_DX11.exe+413D69
FF
84
C0
74
05
E8
32
49
FE
FF
C6
05
26
1E
A7
^
"AvP_DX11.exe"+14738C
decreaseHealth