14
"FNAF: SOTM v1.0.20250606_1754_319_197723"
1
13
"Find+Register GEngine"
Auto Assembler Script
[ENABLE]
{$lua}
if not syntaxcheck then
local function isValidPointer(addr)
if not addr or addr == 0 then return false end
if addr < 0x10000 then return false end
if addr % 8 ~= 0 then return false end
return true
end
local function hasValidVTable(objectPtr)
local success, vtable = pcall(readPointer, objectPtr)
if not success or not isValidPointer(vtable) then
return false
end
if vtable < 0x100000000 or vtable > 0x7FFFFFFFFFFF then
return false
end
return true
end
local function validateGEngine(gEngineAddr)
local enginePtr = readPointer(gEngineAddr)
if not isValidPointer(enginePtr) or not hasValidVTable(enginePtr) then
return false
end
for viewportOffset = 0x700, 0x900, 0x8 do
local success1, viewportPtr = pcall(readPointer, enginePtr + viewportOffset)
if success1 and isValidPointer(viewportPtr) and hasValidVTable(viewportPtr) then
for worldOffset = 0x70, 0x100, 0x8 do
local success2, worldPtr = pcall(readPointer, viewportPtr + worldOffset)
if success2 and isValidPointer(worldPtr) and hasValidVTable(worldPtr) then
for giOffset = 0x150, 0x200, 0x8 do
local success3, giPtr = pcall(readPointer, worldPtr + giOffset)
if success3 and isValidPointer(giPtr) and hasValidVTable(giPtr) then
return true
end
end
end
end
end
end
return false
end
local function findGEngine()
local patterns = {
{"48 8B 0D ?? ?? ?? ?? 48 85 C9 74", 3, 7},
{"48 8B 05 ?? ?? ?? ?? 48 8B 88 ?? ?? ?? ??", 3, 7},
{"48 8B 0D ?? ?? ?? ?? 48 8B 01 FF", 3, 7},
{"48 89 0D ?? ?? ?? ?? 48 85 C9", 3, 7},
{"48 8B 05 ?? ?? ?? ?? 48 85 C0 74", 3, 7},
{"48 8B 0D ?? ?? ?? ?? 4C 8B 01", 3, 7},
{"4C 8B 05 ?? ?? ?? ?? 4C 85 C0", 3, 7},
{"48 8B 15 ?? ?? ?? ?? 48 85 D2 74", 3, 7},
}
print("Scanning for GEngine - collecting candidates...")
local candidateCounts = {}
for i, patternData in ipairs(patterns) do
local pattern = patternData[1]
local offsetPos = patternData[2]
local instrLen = patternData[3]
local result = AOBScan(pattern)
if result and result.Count > 0 then
local maxCheck = math.min(result.Count, 50)
for j = 0, maxCheck - 1 do
pcall(function()
local instructionAddrStr = result.getString(j)
local instructionAddr = getAddress(instructionAddrStr)
local offsetAddr = instructionAddr + offsetPos
local ripOffset = readInteger(offsetAddr)
local gEngineAddr = instructionAddr + instrLen + ripOffset
if validateGEngine(gEngineAddr) then
candidateCounts[gEngineAddr] = (candidateCounts[gEngineAddr] or 0) + 1
end
end)
end
result.destroy()
end
end
-- Find candidate with highest count
local bestAddr = nil
local bestCount = 0
for addr, count in pairs(candidateCounts) do
print(string.format(" Candidate %X found in %d patterns", addr, count))
if count > bestCount then
bestAddr = addr
bestCount = count
end
end
if bestAddr then
registerSymbol("GEngine", bestAddr, true)
print("==========================================")
print(string.format("✓ GEngine registered at: %X (found in %d patterns)", bestAddr, bestCount))
print("==========================================")
return true
end
print("==========================================")
print("✗ GEngine not found!")
print("==========================================")
return false
end
findGEngine()
end
{$asm}
[DISABLE]
{$lua}
if not syntaxcheck then
if getAddress("GEngine") then
unregisterSymbol("GEngine")
print("GEngine unregistered")
end
end
{$asm}
11
"AI Can't Find You (breaks interact capslock hotkey)"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT,FNAF_SOTM-Win64-Shipping.exe,88 04 29 48 83 C4 28)
alloc(newmem,$1000,INJECT)
label(code)
label(return)
newmem:
code:
// mov [rcx+rbp],al
add rsp,28
jmp return
INJECT:
jmp newmem
nop 2
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 88 04 29 48 83 C4 28
unregistersymbol(INJECT)
dealloc(newmem)
Toggle Activation
20
0
2
"MoveMode (1 walk - 5 fly)"
0
Byte
GEngine
168
288
250
30
0
38
180
078
780
3
"Clip (0 noclip - 3 clip)"
0
Byte
GEngine
2E8
290
250
30
0
38
180
078
780
7
"SPACE - up | CTRL - down (enable flight)"
Auto Assembler Script
[ENABLE]
{$lua}
if not syntaxcheck then
-- Clean up any existing hotkeys/timers first
if _G.verticalMoveTimer then
_G.verticalMoveTimer.destroy()
_G.verticalMoveTimer = nil
end
local upVelocity = 500.0
local downVelocity = -500.0
local function getZVelocityAddress()
local gEngine = getAddress("GEngine")
if not gEngine then return nil end
local addr = readPointer(gEngine)
if not addr then return nil end
addr = readPointer(addr + 0x780)
if not addr then return nil end
addr = readPointer(addr + 0x78)
if not addr then return nil end
addr = readPointer(addr + 0x180)
if not addr then return nil end
addr = readPointer(addr + 0x38)
if not addr then return nil end
addr = readPointer(addr + 0x0)
if not addr then return nil end
addr = readPointer(addr + 0x30)
if not addr then return nil end
addr = readPointer(addr + 0x250)
if not addr then return nil end
addr = readPointer(addr + 0x288)
if not addr then return nil end
return addr + 0xCC
end
local function updateVelocity()
local addr = getZVelocityAddress()
if not addr then return end
local spacePressed = isKeyPressed(VK_SPACE)
local ctrlPressed = isKeyPressed(VK_CONTROL)
if spacePressed and not ctrlPressed then
writeFloat(addr, upVelocity)
elseif ctrlPressed and not spacePressed then
writeFloat(addr, downVelocity)
else
writeFloat(addr, 0)
end
end
_G.verticalMoveTimer = createTimer(nil)
_G.verticalMoveTimer.Interval = 10
_G.verticalMoveTimer.OnTimer = updateVelocity
_G.verticalMoveTimer.Enabled = true
print("Vertical movement enabled!")
end
{$asm}
[DISABLE]
{$lua}
if not syntaxcheck then
if _G.verticalMoveTimer then
_G.verticalMoveTimer.Enabled = false
_G.verticalMoveTimer.destroy()
_G.verticalMoveTimer = nil
end
-- Reset velocity
local function getZVelocityAddress()
local gEngine = getAddress("GEngine")
if not gEngine then return nil end
local addr = readPointer(gEngine)
if not addr then return nil end
addr = readPointer(addr + 0x780)
if not addr then return nil end
addr = readPointer(addr + 0x78)
if not addr then return nil end
addr = readPointer(addr + 0x180)
if not addr then return nil end
addr = readPointer(addr + 0x38)
if not addr then return nil end
addr = readPointer(addr + 0x0)
if not addr then return nil end
addr = readPointer(addr + 0x30)
if not addr then return nil end
addr = readPointer(addr + 0x250)
if not addr then return nil end
addr = readPointer(addr + 0x288)
if not addr then return nil end
return addr + 0xCC
end
local addr = getZVelocityAddress()
if addr then
writeFloat(addr, 0)
end
print("Vertical movement disabled")
end
{$asm}
9
"SprintingEnabled"
0
Byte
GEngine
680
250
30
0
38
180
078
780
10
"CrouchingEnabled"
0
Byte
GEngine
698
250
30
0
38
180
078
780
12
"Useless (Data only)"
1
0
"Player"
1
0
8 Bytes
GEngine
250
30
0
38
180
078
780
1
"PlayerBackup"
1
0
8 Bytes
GEngine
2A0
30
0
38
180
078
780
4
"Velocity.X"
0
Float
GEngine
C4
288
250
30
0
38
180
078
780
5
"Velocity.Y"
0
Float
GEngine
C8
288
250
30
0
38
180
078
780
6
"Velocity.Z"
0
Float
GEngine
CC
288
250
30
0
38
180
078
780
8
"IsSeenByAI"
0
Byte
GEngine
60C
250
30
0
38
180
078
780