191
"Toggle Compact View"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not toggleCompactView then
function toggleCompactView(sender, forceEnable)
local isCompactMode = not (compactViewMenuItem.Caption == 'Compact View Mode')
if forceEnable ~= nil then
isCompactMode = not forceEnable
end
synchronize(function()
compactViewMenuItem.Caption = isCompactMode and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = isCompactMode
getMainForm().Panel4.Visible = isCompactMode
getMainForm().Panel5.Visible = isCompactMode
end)
end
end
if not createCompactViewMenu then
function createCompactViewMenu()
if isCompactMenuCreated then return end
synchronize(function()
local mainMenu = getMainForm().Menu.Items
compactViewMenuItem = createMenuItem(mainMenu)
compactViewMenuItem.Caption = 'Compact View Mode'
compactViewMenuItem.OnClick = toggleCompactView
mainMenu.add(compactViewMenuItem)
end)
isCompactMenuCreated = true
end
end
createCompactViewMenu()
toggleCompactView(nil, true)
[DISABLE]
{$lua}
if toggleCompactView then
toggleCompactView(nil, false)
end
276
"Toggle scripts (auto-attach)"
0072E3
Auto Assembler Script
[ENABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
-- attach process
local processName = "SAN8RPK.exe"
local pid = getProcessIDFromProcessName(processName)
if pid ~= nil and pid > 0 then
local currentPid = getOpenedProcessID() or 0
if currentPid ~= pid then
openProcess(processName)
print("Attached to: " .. processName)
Sleep(333)
else
print("Already attached to: " .. processName)
end
end
synchronize(function()
getLuaEngine().Close()
end)
local enableBattleScripts = {
1, -- "Get Grit / 胆力 / 膽識"
3, -- "Get stats, act pt. / 行動力 (in city phase)"
20, -- "Set min. action pt per turn"
33, -- "Selected char stat in basic data"
191, -- "Toggle Compact View"
192, -- "Get Opportunity value / 機運"
220, -- "Battleground: selected unit"
225, -- "Get selected city stat from info. menu"
249, -- "Get gift count when visit"
273, -- "Get Tech P Strategy phase)"
62, -- "Enable check point #2"
263, -- "Enable check point #2"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(enableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and not memRec.Active then
memRec.Active = true
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
[DISABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local disableBattleScripts = {
268, -- "Role, force & city dynamic ID"
265, -- "Unique Talent / 奇才"
245, -- "Role, force & city dynamic ID"
241, -- "Unique Talent / 奇才"
166, -- "List"
140, -- "List"
103, -- "List"
63, -- "List"
49, -- "List"
22, -- "List"
264, -- "**Danger Zone** - Dynamic Data"
263, -- "Enable check point #2"
242, -- "**Danger Zone** - Dynamic Data"
165, -- "Skills"
139, -- "Skills"
102, -- "Tactics"
86, -- "Tactics"
85, -- "Secrets / 秘訣"
84, -- "Secrets / 秘訣"
62, -- "Enable check point #2"
273, -- "Get Tech P Strategy phase)"
249, -- "Get gift count when visit"
225, -- "Get selected city stat from info. menu"
220, -- "Battleground: selected unit"
192, -- "Get Opportunity value / 機運"
191, -- "Toggle Compact View"
33, -- "Selected char stat in basic data"
20, -- "Set min. action pt per turn"
3, -- "Get stats, act pt. / 行動力 (in city phase)"
1, -- "Get Grit / 胆力 / 膽識"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(disableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and memRec.Active then
memRec.Active = false
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
-- Comments:
-- ID: 191, Description: "Toggle Compact View", Depth: 0
-- ID: 1, Description: "Get Grit / 胆力 / 膽識", Depth: 0
-- ID: 192, Description: "Get Opportunity value / 機運", Depth: 0
-- ID: 273, Description: "Get Tech P Strategy phase)", Depth: 0
-- ID: 249, Description: "Get gift count when visit", Depth: 0
-- ID: 220, Description: "Battleground: selected unit", Depth: 0
-- ID: 3, Description: "Get stats, act pt. / 行動力 (in city phase)", Depth: 0
-- ID: 62, Description: "Enable check point #2", Depth: 1
-- ID: 84, Description: "Secrets / 秘訣", Depth: 1
-- ID: 22, Description: "List", Depth: 2
-- ID: 86, Description: "Tactics", Depth: 1
-- ID: 63, Description: "List", Depth: 2
-- ID: 139, Description: "Skills", Depth: 1
-- ID: 140, Description: "List", Depth: 2
-- ID: 264, Description: "**Danger Zone** - Dynamic Data", Depth: 1
-- ID: 265, Description: "Unique Talent / 奇才", Depth: 2
-- ID: 268, Description: "Role, force & city dynamic ID", Depth: 2
-- ID: 20, Description: "Set min. action pt per turn", Depth: 0
-- ID: 33, Description: "Selected char stat in basic data", Depth: 0
-- ID: 263, Description: "Enable check point #2", Depth: 1
-- ID: 85, Description: "Secrets / 秘訣", Depth: 1
-- ID: 49, Description: "List", Depth: 2
-- ID: 102, Description: "Tactics", Depth: 1
-- ID: 103, Description: "List", Depth: 2
-- ID: 165, Description: "Skills", Depth: 1
-- ID: 166, Description: "List", Depth: 2
-- ID: 242, Description: "**Danger Zone** - Dynamic Data", Depth: 1
-- ID: 241, Description: "Unique Talent / 奇才", Depth: 2
-- ID: 245, Description: "Role, force & city dynamic ID", Depth: 2
-- ID: 225, Description: "Get selected city stat from info. menu", Depth: 0
1
"Get Grit / 胆力 / 膽識"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_GRIT,$process,41 8B 87 E0 5A 00 00) // should be unique
alloc(newmem,$1000,INJECT_GET_GRIT)
label(code)
label(return i_base_intre_addr)
newmem:
mov [i_base_intre_addr], r15
code:
mov eax,[r15+00005AE0]
jmp return
align 10 cc
i_base_intre_addr:
dq 0
INJECT_GET_GRIT:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_GRIT i_base_intre_addr)
[DISABLE]
INJECT_GET_GRIT:
db 41 8B 87 E0 5A 00 00
unregistersymbol(INJECT_GET_GRIT i_base_intre_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+1658DD0
SAN8RPK.exe+1658DA5: E8 06 BE 9B FE - call SAN8RPK.exe+14BB0
SAN8RPK.exe+1658DAA: 41 B9 01 00 00 00 - mov r9d,00000001
SAN8RPK.exe+1658DB0: 4C 8B C7 - mov r8,rdi
SAN8RPK.exe+1658DB3: 48 8B CE - mov rcx,rsi
SAN8RPK.exe+1658DB6: 41 8D 51 07 - lea edx,[r9+07]
SAN8RPK.exe+1658DBA: E8 A1 81 69 00 - call SAN8RPK.exe+1CF0F60
SAN8RPK.exe+1658DBF: BA 08 00 00 00 - mov edx,00000008
SAN8RPK.exe+1658DC4: 48 8B CE - mov rcx,rsi
SAN8RPK.exe+1658DC7: 44 8D 42 F9 - lea r8d,[rdx-07]
SAN8RPK.exe+1658DCB: E8 80 82 69 00 - call SAN8RPK.exe+1CF1050
// ---------- INJECTING HERE ----------
SAN8RPK.exe+1658DD0: 41 8B 87 E0 5A 00 00 - mov eax,[r15+00005AE0]
// ---------- DONE INJECTING ----------
SAN8RPK.exe+1658DD7: 89 85 B0 01 00 00 - mov [rbp+000001B0],eax
SAN8RPK.exe+1658DDD: 89 85 F4 01 00 00 - mov [rbp+000001F4],eax
SAN8RPK.exe+1658DE3: 89 85 F0 01 00 00 - mov [rbp+000001F0],eax
SAN8RPK.exe+1658DE9: 44 89 A5 F8 01 00 00 - mov [rbp+000001F8],r12d
SAN8RPK.exe+1658DF0: 83 7E 10 12 - cmp dword ptr [rsi+10],12
SAN8RPK.exe+1658DF4: 7E 4D - jle SAN8RPK.exe+1658E43
SAN8RPK.exe+1658DF6: 48 8B 46 08 - mov rax,[rsi+08]
SAN8RPK.exe+1658DFA: 48 8B 88 90 00 00 00 - mov rcx,[rax+00000090]
SAN8RPK.exe+1658E01: 48 85 C9 - test rcx,rcx
SAN8RPK.exe+1658E04: 74 3D - je SAN8RPK.exe+1658E43
}
4
"pt"
0
FF8080
2 Bytes
i_base_intre_addr
5AE0
192
"Get Opportunity value / 機運"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_FORTUNE,$process,0F B6 98 D0 BD 1E 00 E8 ?? ?? ?? ?? 3B 98 78 12 00 00) // should be unique
alloc(newmem,$1000,INJECT_GET_FORTUNE)
label(code)
label(return i_base_fortune_addr)
newmem:
mov [i_base_fortune_addr], rax
code:
movzx ebx,byte ptr [rax+001EBDD0]
jmp return
align 10 cc
i_base_fortune_addr:
dq 0
INJECT_GET_FORTUNE:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_FORTUNE i_base_fortune_addr)
[DISABLE]
INJECT_GET_FORTUNE:
db 0F B6 98 D0 BD 1E 00
unregistersymbol(INJECT_GET_FORTUNE i_base_fortune_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+131B772
SAN8RPK.exe+131B753: 48 8B 01 - mov rax,[rcx]
SAN8RPK.exe+131B756: FF 50 18 - call qword ptr [rax+18]
SAN8RPK.exe+131B759: 84 C0 - test al,al
SAN8RPK.exe+131B75B: 74 09 - je SAN8RPK.exe+131B766
SAN8RPK.exe+131B75D: 8D 47 02 - lea eax,[rdi+02]
SAN8RPK.exe+131B760: 48 83 C4 20 - add rsp,20
SAN8RPK.exe+131B764: 5F - pop rdi
SAN8RPK.exe+131B765: C3 - ret
SAN8RPK.exe+131B766: 48 8B 05 8B A3 B4 01 - mov rax,[SAN8RPK.exe+2E65AF8]
SAN8RPK.exe+131B76D: 48 89 5C 24 30 - mov [rsp+30],rbx
// ---------- INJECTING HERE ----------
SAN8RPK.exe+131B772: 0F B6 98 D0 BD 1E 00 - movzx ebx,byte ptr [rax+001EBDD0]
// ---------- DONE INJECTING ----------
SAN8RPK.exe+131B779: E8 F2 83 36 FF - call SAN8RPK.exe+683B70
SAN8RPK.exe+131B77E: 3B 98 78 12 00 00 - cmp ebx,[rax+00001278]
SAN8RPK.exe+131B784: 48 8B 5C 24 30 - mov rbx,[rsp+30]
SAN8RPK.exe+131B789: 40 0F 9D C7 - setge dil
SAN8RPK.exe+131B78D: 8B C7 - mov eax,edi
SAN8RPK.exe+131B78F: 48 83 C4 20 - add rsp,20
SAN8RPK.exe+131B793: 5F - pop rdi
SAN8RPK.exe+131B794: C3 - ret
SAN8RPK.exe+131B795: CC - int 3
SAN8RPK.exe+131B796: CC - int 3
}
193
"Opportunity / 機運"
0
FF8080
Byte
i_base_fortune_addr
1EBDD0
273
"Get Tech P Strategy phase)"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-03
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_TECH_P,$process,0F B6 83 4A 02 00 00 38 44) // should be unique
alloc(newmem,$1000,INJECT_GET_TECH_P)
label(code)
label(return i_base_tech_p_addr)
newmem:
mov [i_base_tech_p_addr], rbx
code:
movzx eax,byte ptr [rbx+0000024A]
jmp return
align 10 cc
i_base_tech_p_addr:
dq 0
INJECT_GET_TECH_P:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_TECH_P i_base_tech_p_addr)
[DISABLE]
INJECT_GET_TECH_P:
db 0F B6 83 4A 02 00 00
unregistersymbol(INJECT_GET_TECH_P i_base_tech_p_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+178BE72
SAN8RPK.exe+178BE53: 48 83 F8 05 - cmp rax,05
SAN8RPK.exe+178BE57: 72 04 - jb SAN8RPK.exe+178BE5D
SAN8RPK.exe+178BE59: 32 C0 - xor al,al
SAN8RPK.exe+178BE5B: EB 0C - jmp SAN8RPK.exe+178BE69
SAN8RPK.exe+178BE5D: 40 0F B6 C7 - movzx eax,dil
SAN8RPK.exe+178BE61: 0F B6 84 18 04 02 00 00 - movzx eax,byte ptr [rax+rbx+00000204]
SAN8RPK.exe+178BE69: 0F B6 C0 - movzx eax,al
SAN8RPK.exe+178BE6C: FF C0 - inc eax
SAN8RPK.exe+178BE6E: 3B C6 - cmp eax,esi
SAN8RPK.exe+178BE70: 75 31 - jne SAN8RPK.exe+178BEA3
// ---------- INJECTING HERE ----------
SAN8RPK.exe+178BE72: 0F B6 83 4A 02 00 00 - movzx eax,byte ptr [rbx+0000024A]
// ---------- DONE INJECTING ----------
SAN8RPK.exe+178BE79: 38 44 11 22 - cmp [rcx+rdx+22],al
SAN8RPK.exe+178BE7D: 77 24 - ja SAN8RPK.exe+178BEA3
SAN8RPK.exe+178BE7F: 44 8B C6 - mov r8d,esi
SAN8RPK.exe+178BE82: 48 8B CB - mov rcx,rbx
SAN8RPK.exe+178BE85: E8 96 EC FC FF - call SAN8RPK.exe+175AB20
SAN8RPK.exe+178BE8A: 85 C0 - test eax,eax
SAN8RPK.exe+178BE8C: 74 15 - je SAN8RPK.exe+178BEA3
SAN8RPK.exe+178BE8E: B8 01 00 00 00 - mov eax,00000001
SAN8RPK.exe+178BE93: 48 8B 5C 24 30 - mov rbx,[rsp+30]
SAN8RPK.exe+178BE98: 48 8B 74 24 38 - mov rsi,[rsp+38]
}
275
"Menu: Military -> tech"
8000FF
1
274
"value"
0
FF8080
Byte
i_base_tech_p_addr
24A
249
"Get gift count when visit"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-03
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_GIFT_COUNT,$process,44 0F B7 A9 E8 00 00 00) // should be unique
alloc(newmem,$1000,INJECT_GET_GIFT_COUNT)
label(code)
label(return i_base_gift_cnt_addr)
newmem:
mov [i_base_gift_cnt_addr], rcx
code:
movzx r13d,word ptr [rcx+000000E8]
jmp return
align 10 cc
i_base_gift_cnt_addr:
dq 0
INJECT_GET_GIFT_COUNT:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_GIFT_COUNT i_base_gift_cnt_addr)
[DISABLE]
INJECT_GET_GIFT_COUNT:
db 44 0F B7 A9 E8 00 00 00
unregistersymbol(INJECT_GET_GIFT_COUNT i_base_gift_cnt_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+180DF72
SAN8RPK.exe+180DF44: BA 12 71 02 00 - mov edx,00027112
SAN8RPK.exe+180DF49: 48 8D 0D 40 52 42 01 - lea rcx,[SAN8RPK.exe+2C33190]
SAN8RPK.exe+180DF50: E8 5B 1F EF FF - call SAN8RPK.exe+16FFEB0
SAN8RPK.exe+180DF55: 48 8B D0 - mov rdx,rax
SAN8RPK.exe+180DF58: 49 8B CC - mov rcx,r12
SAN8RPK.exe+180DF5B: E8 20 52 EF FF - call SAN8RPK.exe+1703180
SAN8RPK.exe+180DF60: 48 8D 4C 24 40 - lea rcx,[rsp+40]
SAN8RPK.exe+180DF65: E8 06 D6 80 FE - call SAN8RPK.exe+1B570
SAN8RPK.exe+180DF6A: 90 - nop
SAN8RPK.exe+180DF6B: 48 8B 0D 86 7B 65 01 - mov rcx,[SAN8RPK.exe+2E65AF8]
// ---------- INJECTING HERE ----------
SAN8RPK.exe+180DF72: 44 0F B7 A9 E8 00 00 00 - movzx r13d,word ptr [rcx+000000E8]
// ---------- DONE INJECTING ----------
SAN8RPK.exe+180DF7A: 48 8B 0D 5F 4F 42 01 - mov rcx,[SAN8RPK.exe+2C32EE0]
SAN8RPK.exe+180DF81: 80 79 0C 01 - cmp byte ptr [rcx+0C],01
SAN8RPK.exe+180DF85: 75 25 - jne SAN8RPK.exe+180DFAC
SAN8RPK.exe+180DF87: 48 85 C9 - test rcx,rcx
SAN8RPK.exe+180DF8A: 74 20 - je SAN8RPK.exe+180DFAC
SAN8RPK.exe+180DF8C: 80 79 14 00 - cmp byte ptr [rcx+14],00
SAN8RPK.exe+180DF90: 75 1A - jne SAN8RPK.exe+180DFAC
SAN8RPK.exe+180DF92: 8B 51 10 - mov edx,[rcx+10]
SAN8RPK.exe+180DF95: 48 03 D1 - add rdx,rcx
SAN8RPK.exe+180DF98: 0F B7 41 0A - movzx eax,word ptr [rcx+0A]
}
250
"count"
0
FF8080
2 Bytes
i_base_gift_cnt_addr
E8
220
"Battleground: selected unit"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BATT_SELECTED_UNIT,$process,08 0F B6 80 80 00 00 00) // should be unique
alloc(newmem,$1000,INJECT_BATT_SELECTED_UNIT)
label(code)
label(return i_base_batt_sel_unit_addr)
newmem:
mov [i_base_batt_sel_unit_addr], rax
code:
movzx eax,byte ptr [rax+00000080]
jmp return
align 10 cc
i_base_batt_sel_unit_addr:
dq 0
INJECT_BATT_SELECTED_UNIT+01:
jmp newmem
nop 2
return:
registersymbol(INJECT_BATT_SELECTED_UNIT i_base_batt_sel_unit_addr)
[DISABLE]
INJECT_BATT_SELECTED_UNIT+01:
db 0F B6 80 80 00 00 00
unregistersymbol(INJECT_BATT_SELECTED_UNIT i_base_batt_sel_unit_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+1E13FC4
SAN8RPK.exe+1E13FB4: 48 83 C0 78 - add rax,78
SAN8RPK.exe+1E13FB8: C3 - ret
SAN8RPK.exe+1E13FB9: CC - int 3
SAN8RPK.exe+1E13FBA: CC - int 3
SAN8RPK.exe+1E13FBB: CC - int 3
SAN8RPK.exe+1E13FBC: CC - int 3
SAN8RPK.exe+1E13FBD: CC - int 3
SAN8RPK.exe+1E13FBE: CC - int 3
SAN8RPK.exe+1E13FBF: CC - int 3
SAN8RPK.exe+1E13FC0: 48 8B 41 08 - mov rax,[rcx+08]
// ---------- INJECTING HERE ----------
SAN8RPK.exe+1E13FC4: 0F B6 80 80 00 00 00 - movzx eax,byte ptr [rax+00000080]
// ---------- DONE INJECTING ----------
SAN8RPK.exe+1E13FCB: C3 - ret
SAN8RPK.exe+1E13FCC: CC - int 3
SAN8RPK.exe+1E13FCD: CC - int 3
SAN8RPK.exe+1E13FCE: CC - int 3
SAN8RPK.exe+1E13FCF: CC - int 3
SAN8RPK.exe+1E13FD0: CC - int 3
SAN8RPK.exe+1E13FD1: CC - int 3
SAN8RPK.exe+1E13FD2: CC - int 3
SAN8RPK.exe+1E13FD3: CC - int 3
SAN8RPK.exe+1E13FD4: CC - int 3
}
221
"Soldiers / 兵数"
0
FF8080
2 Bytes
i_base_batt_sel_unit_addr
38
222
"Will to Fight / 戦意"
0
FF8080
Byte
i_base_batt_sel_unit_addr
80
223
"??"
0
FF8080
4 Bytes
i_base_batt_sel_unit_addr
84
3
"Get stats, act pt. / 行動力 (in city phase)"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_ACT_PT,$process,45 0F B6 A7 EE 00 00 00) // should be unique
alloc(newmem,$1000,INJECT_GET_ACT_PT)
label(code)
label(return i_base_act_pt_addr)
newmem:
mov [i_base_act_pt_addr], r15
code:
movzx r12d,byte ptr [r15+000000EE]
jmp return
align 10 cc
i_base_act_pt_addr:
dq 0
INJECT_GET_ACT_PT:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_ACT_PT i_base_act_pt_addr)
[DISABLE]
INJECT_GET_ACT_PT:
db 45 0F B6 A7 EE 00 00 00
unregistersymbol(INJECT_GET_ACT_PT i_base_act_pt_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+150118E
SAN8RPK.exe+1501168: 84 C0 - test al,al
SAN8RPK.exe+150116A: 75 0D - jne SAN8RPK.exe+1501179
SAN8RPK.exe+150116C: BF 01 00 00 00 - mov edi,00000001
SAN8RPK.exe+1501171: 41 89 3E - mov [r14],edi
SAN8RPK.exe+1501174: E9 98 06 00 00 - jmp SAN8RPK.exe+1501811
SAN8RPK.exe+1501179: 45 85 E4 - test r12d,r12d
SAN8RPK.exe+150117C: 0F 84 D5 03 00 00 - je SAN8RPK.exe+1501557
SAN8RPK.exe+1501182: 4D 85 ED - test r13,r13
SAN8RPK.exe+1501185: 0F 84 CC 03 00 00 - je SAN8RPK.exe+1501557
SAN8RPK.exe+150118B: 44 8B EB - mov r13d,ebx
// ---------- INJECTING HERE ----------
SAN8RPK.exe+150118E: 45 0F B6 A7 EE 00 00 00 - movzx r12d,byte ptr [r15+000000EE]
// ---------- DONE INJECTING ----------
SAN8RPK.exe+1501196: 44 88 65 67 - mov [rbp+67],r12b
SAN8RPK.exe+150119A: BF 01 00 00 00 - mov edi,00000001
SAN8RPK.exe+150119F: 40 80 FE 1F - cmp sil,1F
SAN8RPK.exe+15011A3: 0F 85 B6 00 00 00 - jne SAN8RPK.exe+150125F
SAN8RPK.exe+15011A9: 41 0F B6 8F F8 00 00 00 - movzx ecx,byte ptr [r15+000000F8]
SAN8RPK.exe+15011B1: 84 C9 - test cl,cl
SAN8RPK.exe+15011B3: 0F 84 8D 00 00 00 - je SAN8RPK.exe+1501246
SAN8RPK.exe+15011B9: E8 D2 9F 28 00 - call SAN8RPK.exe+178B190
SAN8RPK.exe+15011BE: 0F B6 D0 - movzx edx,al
SAN8RPK.exe+15011C1: 48 8B 0D 30 49 96 01 - mov rcx,[SAN8RPK.exe+2E65AF8]
}
62
"Enable check point #2"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_ACT_PT2,$process,41 0F B6 86 EE 00 00 00 89 85) // should be unique
alloc(newmem,$1000,INJECT_GET_ACT_PT2)
label(code)
label(return)
newmem:
mov [i_base_act_pt_addr], r14
code:
movzx eax,byte ptr [r14+000000EE]
jmp return
INJECT_GET_ACT_PT2:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_ACT_PT2)
[DISABLE]
INJECT_GET_ACT_PT2:
db 41 0F B6 86 EE 00 00 00
unregistersymbol(INJECT_GET_ACT_PT2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+1658B84
SAN8RPK.exe+1658B60: FF 12 - call qword ptr [rdx]
SAN8RPK.exe+1658B62: 48 85 C0 - test rax,rax
SAN8RPK.exe+1658B65: 74 07 - je SAN8RPK.exe+1658B6E
SAN8RPK.exe+1658B67: 83 A7 04 01 00 00 BF - and dword ptr [rdi+00000104],-41
SAN8RPK.exe+1658B6E: 48 85 DB - test rbx,rbx
SAN8RPK.exe+1658B71: 74 11 - je SAN8RPK.exe+1658B84
SAN8RPK.exe+1658B73: 48 8B 03 - mov rax,[rbx]
SAN8RPK.exe+1658B76: BA 01 00 00 00 - mov edx,00000001
SAN8RPK.exe+1658B7B: 48 8B CB - mov rcx,rbx
SAN8RPK.exe+1658B7E: FF 90 08 01 00 00 - call qword ptr [rax+00000108]
// ---------- INJECTING HERE ----------
SAN8RPK.exe+1658B84: 41 0F B6 86 EE 00 00 00 - movzx eax,byte ptr [r14+000000EE]
// ---------- DONE INJECTING ----------
SAN8RPK.exe+1658B8C: 89 85 A8 01 00 00 - mov [rbp+000001A8],eax
SAN8RPK.exe+1658B92: 89 85 C4 01 00 00 - mov [rbp+000001C4],eax
SAN8RPK.exe+1658B98: 89 85 C0 01 00 00 - mov [rbp+000001C0],eax
SAN8RPK.exe+1658B9E: 44 89 A5 C8 01 00 00 - mov [rbp+000001C8],r12d
SAN8RPK.exe+1658BA5: 83 7E 10 04 - cmp dword ptr [rsi+10],04
SAN8RPK.exe+1658BA9: 7E 4A - jle SAN8RPK.exe+1658BF5
SAN8RPK.exe+1658BAB: 48 8B 46 08 - mov rax,[rsi+08]
SAN8RPK.exe+1658BAF: 48 8B 48 20 - mov rcx,[rax+20]
SAN8RPK.exe+1658BB3: 48 85 C9 - test rcx,rcx
SAN8RPK.exe+1658BB6: 74 3D - je SAN8RPK.exe+1658BF5
}
277
"Auto fill act pt. / 行動力"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
local targetDescription = "Hero act pt. / 行動力"
local minBaseValue = 200
local checkInterval = 1000 -- 1000ms = 1秒
local validMin = 0
local validMax = 250
print("Hero Action Point Auto-Adjust Script")
print(string.format("Target: %s", targetDescription))
print(string.format("Check interval: %d ms", checkInterval))
print(string.format("Min base value: %d", minBaseValue))
print("Script enabled")
-- 創建 Timer
if heroActPtTimer then
heroActPtTimer.Destroy()
heroActPtTimer = nil
end
heroActPtTimer = createTimer()
heroActPtTimer.Interval = checkInterval
heroActPtTimer.OnTimer = function(timer)
local addressList = getAddressList()
-- 查找目標 memory record
local targetRecord = addressList.getMemoryRecordByDescription(targetDescription)
if not targetRecord then
-- Memory record 不存在，跳過此次檢查
return
end
-- 嘗試讀取當前值
local currentValue = targetRecord.Value
-- 檢查值是否 valid (能否成功讀取且為數字)
if not currentValue or currentValue == "??" or currentValue == "" then
-- 值無效（可能因 pointer 失效），跳過此次檢查
return
end
-- 轉換為數字
local numValue = tonumber(currentValue)
if not numValue then
-- 無法轉換為數字，跳過
return
end
-- 檢查值是否在有效範圍內 (0-250)
if numValue < validMin or numValue > validMax then
-- 超出有效範圍，跳過
return
end
-- 檢查是否小於基準值 200
if numValue < minBaseValue then
-- 設定為 200
targetRecord.Value = tostring(minBaseValue)
-- print(string.format("[%s] Adjusted: %d -> %d", os.date("%H:%M:%S"), numValue, minBaseValue))
end
end
-- 啟動 Timer
heroActPtTimer.Enabled = true
closeLuaEngine()
[DISABLE]
{$lua}
if syntaxcheck then return end
-- 停止並銷毀 Timer
if heroActPtTimer then
heroActPtTimer.Enabled = false
heroActPtTimer.Destroy()
heroActPtTimer = nil
print("Hero Action Point Auto-Adjust Script disabled")
end
closeLuaEngine()
278
"Auto fill Strategy Points / 戦略P"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
local targetDescription = "Hero Strategy Points / 戦略P"
local minBaseValue = 3
local checkInterval = 2000 -- 1000ms = 1秒
local validMin = 0
local validMax = 20
print("Hero Action Point Auto-Adjust Script")
print(string.format("Target: %s", targetDescription))
print(string.format("Check interval: %d ms", checkInterval))
print(string.format("Min base value: %d", minBaseValue))
print("Script enabled")
-- 創建 Timer
if heroStaPtTimer then
heroStaPtTimer.Destroy()
heroStaPtTimer = nil
end
heroStaPtTimer = createTimer()
heroStaPtTimer.Interval = checkInterval
heroStaPtTimer.OnTimer = function(timer)
local addressList = getAddressList()
local targetRecord = addressList.getMemoryRecordByDescription(targetDescription)
if not targetRecord then
return
end
local currentValue = targetRecord.Value
if not currentValue or currentValue == "??" or currentValue == "" then
return
end
local numValue = tonumber(currentValue)
if not numValue then
return
end
if numValue < validMin or numValue > validMax then
return
end
if numValue < minBaseValue then
targetRecord.Value = tostring(minBaseValue)
-- print(string.format("[%s] Adjusted: %d -> %d", os.date("%H:%M:%S"), numValue, minBaseValue))
end
end
heroStaPtTimer.Enabled = true
closeLuaEngine()
[DISABLE]
{$lua}
if syntaxcheck then return end
if heroStaPtTimer then
heroStaPtTimer.Enabled = false
heroStaPtTimer.Destroy()
heroStaPtTimer = nil
print("Hero Action Point Auto-Adjust Script disabled")
end
closeLuaEngine()
196
"addr"
1
0
808080
8 Bytes
i_base_act_pt_addr
240
"Loyalty / 忠誠"
0
FF8080
Byte
i_base_act_pt_addr
EC
197
"Hero Strategy Points / 戦略P"
0
FF8080
Byte
i_base_act_pt_addr
ED
5
"Hero act pt. / 行動力"
0
FF8080
Byte
i_base_act_pt_addr
EE
9
"Pocket money"
0
FF8080
4 Bytes
i_base_act_pt_addr
300
260
"Appearance Year / 登場年"
0
FF8080
2 Bytes
i_base_act_pt_addr
32
261
"Birth Year / 誕生年"
0
FF8080
2 Bytes
i_base_act_pt_addr
34
262
"Death Year / 没年"
0
FF8080
2 Bytes
i_base_act_pt_addr
36
214
"Honor, Fidelity / 義理"
0
FF8080
Binary
0
4
0
i_base_act_pt_addr
5E
215
"Strategic Tendency / 戦略傾向"
0
FF8080
Byte
i_base_act_pt_addr
60
216
"Personality / 性格"
0
FF8080
Byte
i_base_act_pt_addr
64
199
"Condition"
0:Healthy
0
FF8080
Byte
i_base_act_pt_addr
119
10
"LEA / 統率"
0
FF8080
Byte
i_base_act_pt_addr
AA
11
"WAR / 武力"
0
FF8080
Byte
i_base_act_pt_addr
AB
12
"INT / 知力"
0
FF8080
Byte
i_base_act_pt_addr
AC
13
"POL / 政治"
0
FF8080
Byte
i_base_act_pt_addr
AD
14
"CHA / 魅力"
0
FF8080
Byte
i_base_act_pt_addr
AE
15
"LEA exp"
0
FF8080
2 Bytes
i_base_act_pt_addr
B0
16
"WAR exp"
0
FF8080
2 Bytes
i_base_act_pt_addr
B2
17
"INT exp"
0
FF8080
2 Bytes
i_base_act_pt_addr
B4
18
"POL exp"
0
FF8080
2 Bytes
i_base_act_pt_addr
B6
19
"CHA exp"
0
FF8080
2 Bytes
i_base_act_pt_addr
B8
6
"Civil / 文名"
0
FF8080
2 Bytes
i_base_act_pt_addr
104
7
"Martial / 武名"
0
FF8080
2 Bytes
i_base_act_pt_addr
106
8
"Infamy / 惡名"
0
FF8080
2 Bytes
i_base_act_pt_addr
108
84
"Secrets / 秘訣"
1
22
"List"
0
FF8080
1
i_base_act_pt_addr
C4
21
"Infantry / 步兵"
0
FF8080
Byte
+0
23
"Cavalry / 騎兵"
0
FF8080
Byte
+1
24
"Archer / 弓兵"
0
FF8080
Byte
+2
25
"Navy / 船艦"
0
FF8080
Byte
+3
26
"Military Strategy / 軍略"
0
FF8080
Byte
+4
27
"Support / 補助"
0
FF8080
Byte
+5
28
"Mystic / 遁甲"
0
FF8080
Byte
+6
29
"Mission / 任務"
0
FF8080
Byte
+7
30
"Strategy / 智謀"
0
FF8080
Byte
+8
31
"Unit Type / 兵科"
0
FF8080
Byte
+9
32
"Military / 軍事"
0
FF8080
Byte
+A
86
"Tactics"
1
63
"List"
0
FF8080
1
i_base_act_pt_addr
139
64
"Mighty Strike / 剛撃"
0
FF8080
Byte
+0
65
"Rapid Strike / 乱撃"
0
FF8080
Byte
+1
66
"Disturbance / 攪乱"
0
FF8080
Byte
+2
67
"Fierce Charge / 猛衝"
0
FF8080
Byte
+3
68
"Pike Wall / 槍陣"
0
FF8080
Byte
+4
69
"Consecutive Strike / 連撃"
0
FF8080
Byte
+5
70
"Assault / 突撃"
0
FF8080
Byte
+6
71
"Surprise Attack / 急襲"
0
FF8080
Byte
+7
72
"Horse Archery / 騎射"
0
FF8080
Byte
+8
73
"Circular Formation / 円陣"
0
FF8080
Byte
+9
74
"Volley / 斉射"
0
FF8080
Byte
+A
75
"Rapid Fire / 乱射"
0
FF8080
Byte
+B
76
"Fire Arrow / 火矢"
0
FF8080
Byte
+C
77
"Long Range / 遠射"
0
FF8080
Byte
+D
78
"Arrow Rain / 箭雨"
0
FF8080
Byte
+E
79
"Fire Arrow (Naval) / 火箭"
0
FF8080
Byte
+F
80
"Melee / 混戦"
0
FF8080
Byte
+10
81
"Chain / 連環"
0
FF8080
Byte
+11
82
"Pierce / 突貫"
0
FF8080
Byte
+12
83
"Explosive Ship / 爆船"
0
FF8080
Byte
+13
87
"Blaze / 烈火"
0
FF8080
Byte
+14
88
"Torrent / 激流"
0
FF8080
Byte
+15
89
"Falling Rocks / 落石"
0
FF8080
Byte
+16
90
"Ambush / 伏撃"
0
FF8080
Byte
+17
91
"Infighting / 相残"
0
FF8080
Byte
+18
92
"Rouse / 奮起"
0
FF8080
Byte
+19
93
"Inspire / 鼓舞"
0
FF8080
Byte
+1A
94
"Taunt / 謾罵"
0
FF8080
Byte
+1B
95
"Heal / 治療"
0
FF8080
Byte
+1C
96
"Aura / Revelation / 天啓"
0
FF8080
Byte
+1D
97
"Wind Change / 風変"
0
FF8080
Byte
+1E
98
"Weather Change / 天変"
0
FF8080
Byte
+1F
99
"Sorcery / 妖術"
0
FF8080
Byte
+20
100
"Illusion / 幻術"
0
FF8080
Byte
+21
101
"Lightning / 落雷"
0
FF8080
Byte
+22
139
"Skills"
1
140
"List"
0
FF8080
1
i_base_act_pt_addr
1D0
141
"Cultivation / 耕作"
0
FF8080
Byte
+0
142
"Commerce / 商才"
0
FF8080
Byte
+1
143
"Engineering / 築城"
0
FF8080
Byte
+2
144
"Vigilance / 戒備"
0
FF8080
Byte
+3
145
"Invention / 発明"
0
FF8080
Byte
+4
146
"Natural Talent / 天資"
0
FF8080
Byte
+5
147
"Negotiation / 交渉"
0
FF8080
Byte
+6
148
"False Report / 偽報"
0
FF8080
Byte
+7
149
"Stratagem / 施計"
0
FF8080
Byte
+8
150
"Oratory / 話術"
0
FF8080
Byte
+9
151
"Debate / 激弁"
0
FF8080
Byte
+A
152
"Mastermind / 鬼謀"
0
FF8080
Byte
+B
153
"Infantry Commander / 歩将"
0
FF8080
Byte
+C
154
"Cavalry Commander / 騎将"
0
FF8080
Byte
+D
155
"Archer Commander / 弓将"
0
FF8080
Byte
+E
156
"Naval Training / 水練"
0
FF8080
Byte
+F
157
"Siege Mastery / 操器"
0
FF8080
Byte
+10
158
"Divine Strategy / 神算"
0
FF8080
Byte
+11
159
"Support / 支援"
0
FF8080
Byte
+12
160
"Gate Crasher / 破城"
0
FF8080
Byte
+13
161
"March / 行軍"
0
FF8080
Byte
+14
162
"Strength / 臂力"
0
FF8080
Byte
+15
163
"Decisive / 果敢"
0
FF8080
Byte
+16
164
"Majesty / 威風"
0
FF8080
Byte
+17
264
"**Danger Zone** - Dynamic Data"
1
265
"Unique Talent / 奇才"
1
266
"#1"
1
0
FF8080
8 Bytes
i_base_act_pt_addr
88
267
"#2"
1
0
FF8080
8 Bytes
i_base_act_pt_addr
90
268
"Role, force & city dynamic ID"
1
269
"StatusData (Status / 身分)"
1
0
FF8080
8 Bytes
i_base_act_pt_addr
10
270
"ForceData (Affiliation / 所属)"
1
0
FF8080
8 Bytes
i_base_act_pt_addr
18
271
"CityData (location)"
1
0
FF8080
8 Bytes
i_base_act_pt_addr
20
272
"ClassData"
1
0
FF8080
8 Bytes
i_base_act_pt_addr
F0
20
"Set min. action pt per turn"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_SET_MIN_ACT_PER_TURN,$process,80 BF EE 00 00 00 14) // should be unique
alloc(newmem,$1000,INJECT_SET_MIN_ACT_PER_TURN)
label(code)
label(return)
newmem:
cmp byte ptr [rdi+000000EE], DC
jae code
mov byte ptr [rdi+000000EE], DC
code:
cmp byte ptr [rdi+000000EE],14
jmp return
INJECT_SET_MIN_ACT_PER_TURN:
jmp newmem
nop 2
return:
registersymbol(INJECT_SET_MIN_ACT_PER_TURN)
[DISABLE]
INJECT_SET_MIN_ACT_PER_TURN:
db 80 BF EE 00 00 00 14
unregistersymbol(INJECT_SET_MIN_ACT_PER_TURN)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+180F930
SAN8RPK.exe+180F90C: 75 22 - jne SAN8RPK.exe+180F930
SAN8RPK.exe+180F90E: 48 8B 0D 2B CA 65 01 - mov rcx,[SAN8RPK.exe+2E6C340]
SAN8RPK.exe+180F915: 8B 41 1C - mov eax,[rcx+1C]
SAN8RPK.exe+180F918: 0B 41 04 - or eax,[rcx+04]
SAN8RPK.exe+180F91B: 0B 01 - or eax,[rcx]
SAN8RPK.exe+180F91D: 75 11 - jne SAN8RPK.exe+180F930
SAN8RPK.exe+180F91F: 39 41 14 - cmp [rcx+14],eax
SAN8RPK.exe+180F922: 75 0C - jne SAN8RPK.exe+180F930
SAN8RPK.exe+180F924: E8 87 B0 B5 FF - call SAN8RPK.exe+136A9B0
SAN8RPK.exe+180F929: 4C 8B 0D C8 61 65 01 - mov r9,[SAN8RPK.exe+2E65AF8]
// ---------- INJECTING HERE ----------
SAN8RPK.exe+180F930: 80 BF EE 00 00 00 14 - cmp byte ptr [rdi+000000EE],14
// ---------- DONE INJECTING ----------
SAN8RPK.exe+180F937: 73 1C - jae SAN8RPK.exe+180F955
SAN8RPK.exe+180F939: 41 0F B7 81 BC 5B 00 00 - movzx eax,word ptr [r9+00005BBC]
SAN8RPK.exe+180F941: B9 FF FF 00 00 - mov ecx,0000FFFF
SAN8RPK.exe+180F946: FF C0 - inc eax
SAN8RPK.exe+180F948: 3B C1 - cmp eax,ecx
SAN8RPK.exe+180F94A: 0F 47 C1 - cmova eax,ecx
SAN8RPK.exe+180F94D: 66 41 89 81 BC 5B 00 00 - mov [r9+00005BBC],ax
SAN8RPK.exe+180F955: E8 C6 F6 89 FE - call SAN8RPK.exe+AF020
SAN8RPK.exe+180F95A: 48 8B 18 - mov rbx,[rax]
SAN8RPK.exe+180F95D: 48 8B CB - mov rcx,rbx
}
33
"Selected char stat in basic data"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_SELECTED_CHAR_STATS,$process,0F B6 8C 18 A9 00 00 00) // should be unique
alloc(newmem,$1000,INJECT_GET_SELECTED_CHAR_STATS)
label(code)
label(return i_base_sel_char_stat)
newmem:
lea rdi, [rbx]
mov [i_base_sel_char_stat], rdi
code:
movzx ecx,byte ptr [rax+rbx+000000A9]
jmp return
align 10 cc
i_base_sel_char_stat:
dq 0
INJECT_GET_SELECTED_CHAR_STATS:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_SELECTED_CHAR_STATS i_base_sel_char_stat)
[DISABLE]
INJECT_GET_SELECTED_CHAR_STATS:
db 0F B6 8C 18 A9 00 00 00
unregistersymbol(INJECT_GET_SELECTED_CHAR_STATS i_base_sel_char_stat)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+177C957
SAN8RPK.exe+177C937: 8D 4F FF - lea ecx,[rdi-01]
SAN8RPK.exe+177C93A: 0F B6 D0 - movzx edx,al
SAN8RPK.exe+177C93D: 80 F9 04 - cmp cl,04
SAN8RPK.exe+177C940: 76 11 - jna SAN8RPK.exe+177C953
SAN8RPK.exe+177C942: 32 C9 - xor cl,cl
SAN8RPK.exe+177C944: 48 8B 5C 24 30 - mov rbx,[rsp+30]
SAN8RPK.exe+177C949: 48 83 C4 20 - add rsp,20
SAN8RPK.exe+177C94D: 5F - pop rdi
SAN8RPK.exe+177C94E: E9 BD 19 01 00 - jmp SAN8RPK.exe+178E310
SAN8RPK.exe+177C953: 40 0F B6 C7 - movzx eax,dil
// ---------- INJECTING HERE ----------
SAN8RPK.exe+177C957: 0F B6 8C 18 A9 00 00 00 - movzx ecx,byte ptr [rax+rbx+000000A9]
// ---------- DONE INJECTING ----------
SAN8RPK.exe+177C95F: 48 8B 5C 24 30 - mov rbx,[rsp+30]
SAN8RPK.exe+177C964: 48 83 C4 20 - add rsp,20
SAN8RPK.exe+177C968: 5F - pop rdi
SAN8RPK.exe+177C969: E9 A2 19 01 00 - jmp SAN8RPK.exe+178E310
SAN8RPK.exe+177C96E: 48 8B 5C 24 30 - mov rbx,[rsp+30]
SAN8RPK.exe+177C973: 33 C0 - xor eax,eax
SAN8RPK.exe+177C975: 48 83 C4 20 - add rsp,20
SAN8RPK.exe+177C979: 5F - pop rdi
SAN8RPK.exe+177C97A: C3 - ret
SAN8RPK.exe+177C97B: CC - int 3
}
263
"Enable check point #2"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-03
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_SELECTED_CHAR_STATS2,$process,0F B6 84 38 A9 00 00 00 0F B6 C0 4C) // should be unique
alloc(newmem,$1000,INJECT_GET_SELECTED_CHAR_STATS2)
label(code)
label(return)
newmem:
lea r9, [rdi]
mov [i_base_sel_char_stat], r9
code:
movzx eax,byte ptr [rax+rdi+000000A9]
jmp return
INJECT_GET_SELECTED_CHAR_STATS2:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_SELECTED_CHAR_STATS2)
[DISABLE]
INJECT_GET_SELECTED_CHAR_STATS2:
db 0F B6 84 38 A9 00 00 00
unregistersymbol(INJECT_GET_SELECTED_CHAR_STATS2)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+16EE983
SAN8RPK.exe+16EE965: 66 0F 6E C0 - movd xmm0,eax
SAN8RPK.exe+16EE969: 8D 46 FF - lea eax,[rsi-01]
SAN8RPK.exe+16EE96C: 0F 5B C0 - cvtdq2ps xmm0,xmm0
SAN8RPK.exe+16EE96F: F3 0F 59 C8 - mulss xmm1,xmm0
SAN8RPK.exe+16EE973: F3 0F 5C D1 - subss xmm2,xmm1
SAN8RPK.exe+16EE977: 3C 04 - cmp al,04
SAN8RPK.exe+16EE979: 76 04 - jna SAN8RPK.exe+16EE97F
SAN8RPK.exe+16EE97B: 32 C0 - xor al,al
SAN8RPK.exe+16EE97D: EB 0C - jmp SAN8RPK.exe+16EE98B
SAN8RPK.exe+16EE97F: 40 0F B6 C6 - movzx eax,sil
// ---------- INJECTING HERE ----------
SAN8RPK.exe+16EE983: 0F B6 84 38 A9 00 00 00 - movzx eax,byte ptr [rax+rdi+000000A9]
// ---------- DONE INJECTING ----------
SAN8RPK.exe+16EE98B: 0F B6 C0 - movzx eax,al
SAN8RPK.exe+16EE98E: 4C 8B CD - mov r9,rbp
SAN8RPK.exe+16EE991: 4D 8B C6 - mov r8,r14
SAN8RPK.exe+16EE994: 40 0F B6 D6 - movzx edx,sil
SAN8RPK.exe+16EE998: 48 8B CF - mov rcx,rdi
SAN8RPK.exe+16EE99B: 66 0F 6E C0 - movd xmm0,eax
SAN8RPK.exe+16EE99F: 0F 5B C0 - cvtdq2ps xmm0,xmm0
SAN8RPK.exe+16EE9A2: F3 0F 59 C2 - mulss xmm0,xmm2
SAN8RPK.exe+16EE9A6: F3 0F 59 05 6E 03 09 01 - mulss xmm0,[SAN8RPK.exe+277ED1C]
SAN8RPK.exe+16EE9AE: F3 0F 2C D8 - cvttss2si ebx,xmm0
}
44
"Base"
1
0
808080
8 Bytes
i_base_sel_char_stat
194
"Loyalty / 忠誠"
0
FF8080
Byte
i_base_sel_char_stat
EC
198
"Strategy Points / 戦略P"
0
FF8080
Byte
i_base_sel_char_stat
ED
195
"Act pt. / 行動力"
0
FF8080
Byte
i_base_sel_char_stat
EE
45
"Pocket money"
0
FF8080
4 Bytes
i_base_sel_char_stat
300
257
"Appearance Year / 登場年"
0
FF8080
2 Bytes
i_base_sel_char_stat
32
258
"Birth Year / 誕生年"
0
FF8080
2 Bytes
i_base_sel_char_stat
34
259
"Death Year / 没年"
0
FF8080
2 Bytes
i_base_sel_char_stat
36
204
"Honor, Fidelity / 義理"
0
FF8080
Binary
0
4
0
i_base_sel_char_stat
5E
213
"Strategic Tendency / 戦略傾向"
0
FF8080
Byte
i_base_sel_char_stat
60
212
"Personality / 性格"
0
FF8080
Byte
i_base_sel_char_stat
64
217
"Condition"
0:Healthy
0
FF8080
Byte
i_base_sel_char_stat
119
200
"LEA / 統率"
0
FF8080
Byte
i_base_sel_char_stat
AA
35
"WAR / 武力"
0
FF8080
Byte
i_base_sel_char_stat
AB
36
"INT / 知力"
0
FF8080
Byte
i_base_sel_char_stat
AC
37
"POL / 政治"
0
FF8080
Byte
i_base_sel_char_stat
AD
38
"CHA / 魅力"
0
FF8080
Byte
i_base_sel_char_stat
AE
39
"LEA exp"
0
FF8080
2 Bytes
i_base_sel_char_stat
B0
40
"WAR exp"
0
FF8080
2 Bytes
i_base_sel_char_stat
B2
41
"INT exp"
0
FF8080
2 Bytes
i_base_sel_char_stat
B4
42
"POL exp"
0
FF8080
2 Bytes
i_base_sel_char_stat
B6
43
"CHA exp"
0
FF8080
2 Bytes
i_base_sel_char_stat
B8
46
"Merit / 功績"
0
FF8080
2 Bytes
i_base_sel_char_stat
100
210
"Civil / 文名"
0
FF8080
2 Bytes
i_base_sel_char_stat
104
47
"Martial / 武名"
0
FF8080
2 Bytes
i_base_sel_char_stat
106
48
"Infamy / 惡名"
0
FF8080
2 Bytes
i_base_sel_char_stat
108
256
"(End of data)"
0
808080
4 Bytes
i_base_sel_char_stat
3CC
85
"Secrets / 秘訣"
1
49
"List"
0
FF8080
1
i_base_sel_char_stat
C4
50
"Infantry / 步兵"
0
FF8080
Byte
+0
51
"Cavalry / 騎兵"
0
FF8080
Byte
+1
52
"Archer / 弓兵"
0
FF8080
Byte
+2
53
"Navy / 船艦"
0
FF8080
Byte
+3
54
"Military Strategy / 軍略"
0
FF8080
Byte
+4
55
"Support / 補助"
0
FF8080
Byte
+5
56
"Mystic / 遁甲"
0
FF8080
Byte
+6
57
"Mission / 任務"
0
FF8080
Byte
+7
58
"Strategy / 智謀"
0
FF8080
Byte
+8
59
"Unit Type / 兵科"
0
FF8080
Byte
+9
60
"Military / 軍事"
0
FF8080
Byte
+A
102
"Tactics"
1
103
"List"
0
FF8080
1
i_base_sel_char_stat
139
104
"Mighty Strike / 剛撃"
0
FF8080
Byte
+0
105
"Rapid Strike / 乱撃"
0
FF8080
Byte
+1
106
"Disturbance / 攪乱"
0
FF8080
Byte
+2
107
"Fierce Charge / 猛衝"
0
FF8080
Byte
+3
108
"Pike Wall / 槍陣"
0
FF8080
Byte
+4
109
"Consecutive Strike / 連撃"
0
FF8080
Byte
+5
110
"Assault / 突撃"
0
FF8080
Byte
+6
111
"Surprise Attack / 急襲"
0
FF8080
Byte
+7
112
"Horse Archery / 騎射"
0
FF8080
Byte
+8
113
"Circular Formation / 円陣"
0
FF8080
Byte
+9
114
"Volley / 斉射"
0
FF8080
Byte
+A
115
"Rapid Fire / 乱射"
0
FF8080
Byte
+B
116
"Fire Arrow / 火矢"
0
FF8080
Byte
+C
117
"Long Range / 遠射"
0
FF8080
Byte
+D
118
"Arrow Rain / 箭雨"
0
FF8080
Byte
+E
119
"Fire Arrow (Naval) / 火箭"
0
FF8080
Byte
+F
120
"Melee / 混戦"
0
FF8080
Byte
+10
121
"Chain / 連環"
0
FF8080
Byte
+11
122
"Pierce / 突貫"
0
FF8080
Byte
+12
123
"Explosive Ship / 爆船"
0
FF8080
Byte
+13
124
"Blaze / 烈火"
0
FF8080
Byte
+14
125
"Torrent / 激流"
0
FF8080
Byte
+15
126
"Falling Rocks / 落石"
0
FF8080
Byte
+16
127
"Ambush / 伏撃"
0
FF8080
Byte
+17
128
"Infighting / 相残"
0
FF8080
Byte
+18
129
"Rouse / 奮起"
0
FF8080
Byte
+19
130
"Inspire / 鼓舞"
0
FF8080
Byte
+1A
131
"Taunt / 謾罵"
0
FF8080
Byte
+1B
132
"Heal / 治療"
0
FF8080
Byte
+1C
133
"Aura / Revelation / 天啓"
0
FF8080
Byte
+1D
134
"Wind Change / 風変"
0
FF8080
Byte
+1E
135
"Weather Change / 天変"
0
FF8080
Byte
+1F
136
"Sorcery / 妖術"
0
FF8080
Byte
+20
137
"Illusion / 幻術"
0
FF8080
Byte
+21
138
"Lightning / 落雷"
0
FF8080
Byte
+22
165
"Skills"
1
166
"List"
0
FF8080
1
i_base_sel_char_stat
1D0
167
"Cultivation / 耕作"
0
FF8080
Byte
+0
168
"Commerce / 商才"
0
FF8080
Byte
+1
169
"Engineering / 築城"
0
FF8080
Byte
+2
170
"Vigilance / 戒備"
0
FF8080
Byte
+3
171
"Invention / 発明"
0
FF8080
Byte
+4
172
"Natural Talent / 天資"
0
FF8080
Byte
+5
173
"Negotiation / 交渉"
0
FF8080
Byte
+6
174
"False Report / 偽報"
0
FF8080
Byte
+7
175
"Stratagem / 施計"
0
FF8080
Byte
+8
176
"Oratory / 話術"
0
FF8080
Byte
+9
177
"Debate / 激弁"
0
FF8080
Byte
+A
178
"Mastermind / 鬼謀"
0
FF8080
Byte
+B
179
"Infantry Commander / 歩将"
0
FF8080
Byte
+C
180
"Cavalry Commander / 騎将"
0
FF8080
Byte
+D
181
"Archer Commander / 弓将"
0
FF8080
Byte
+E
182
"Naval Training / 水練"
0
FF8080
Byte
+F
183
"Siege Mastery / 操器"
0
FF8080
Byte
+10
184
"Divine Strategy / 神算"
0
FF8080
Byte
+11
185
"Support / 支援"
0
FF8080
Byte
+12
186
"Gate Crasher / 破城"
0
FF8080
Byte
+13
187
"March / 行軍"
0
FF8080
Byte
+14
188
"Strength / 臂力"
0
FF8080
Byte
+15
189
"Decisive / 果敢"
0
FF8080
Byte
+16
190
"Majesty / 威風"
0
FF8080
Byte
+17
242
"**Danger Zone** - Dynamic Data"
1
241
"Unique Talent / 奇才"
1
243
"#1"
1
0
FF8080
8 Bytes
i_base_sel_char_stat
88
244
"#2"
1
0
FF8080
8 Bytes
i_base_sel_char_stat
90
245
"Role, force & city dynamic ID"
1
246
"StatusData (Status / 身分)"
1
0
FF8080
8 Bytes
i_base_sel_char_stat
10
247
"ForceData (Affiliation / 所属)"
1
0
FF8080
8 Bytes
i_base_sel_char_stat
18
248
"CityData (location)"
1
0
FF8080
8 Bytes
i_base_sel_char_stat
20
252
"ClassData"
1
0
FF8080
8 Bytes
i_base_sel_char_stat
F0
225
"Get selected city stat from info. menu"
Auto Assembler Script
{ Game : SAN8RPK.exe
Version:
Date : 2026-02-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_CITY_STAT,$process,0F B7 83 D6 00 00 00 EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2 00 00 00) // should be unique
alloc(newmem,$1000,INJECT_GET_CITY_STAT)
label(code)
label(return i_base_city_stat_addr)
newmem:
mov [i_base_city_stat_addr], rbx
code:
movzx eax,word ptr [rbx+000000D6]
jmp return
align 10 cc
i_base_city_stat_addr:
dq 0
INJECT_GET_CITY_STAT:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_CITY_STAT i_base_city_stat_addr)
[DISABLE]
INJECT_GET_CITY_STAT:
db 0F B7 83 D6 00 00 00
unregistersymbol(INJECT_GET_CITY_STAT i_base_city_stat_addr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: SAN8RPK.exe+1CCC2B9
SAN8RPK.exe+1CCC29C: 83 E9 01 - sub ecx,01
SAN8RPK.exe+1CCC29F: 74 21 - je SAN8RPK.exe+1CCC2C2
SAN8RPK.exe+1CCC2A1: 83 E9 01 - sub ecx,01
SAN8RPK.exe+1CCC2A4: 74 13 - je SAN8RPK.exe+1CCC2B9
SAN8RPK.exe+1CCC2A6: 83 F9 01 - cmp ecx,01
SAN8RPK.exe+1CCC2A9: 74 05 - je SAN8RPK.exe+1CCC2B0
SAN8RPK.exe+1CCC2AB: 0F B7 C6 - movzx eax,si
SAN8RPK.exe+1CCC2AE: EB 2B - jmp SAN8RPK.exe+1CCC2DB
SAN8RPK.exe+1CCC2B0: 0F B7 83 DA 00 00 00 - movzx eax,word ptr [rbx+000000DA]
SAN8RPK.exe+1CCC2B7: EB 22 - jmp SAN8RPK.exe+1CCC2DB
// ---------- INJECTING HERE ----------
SAN8RPK.exe+1CCC2B9: 0F B7 83 D6 00 00 00 - movzx eax,word ptr [rbx+000000D6]
// ---------- DONE INJECTING ----------
SAN8RPK.exe+1CCC2C0: EB 19 - jmp SAN8RPK.exe+1CCC2DB
SAN8RPK.exe+1CCC2C2: 0F B6 83 DE 00 00 00 - movzx eax,byte ptr [rbx+000000DE]
SAN8RPK.exe+1CCC2C9: EB 10 - jmp SAN8RPK.exe+1CCC2DB
SAN8RPK.exe+1CCC2CB: 0F B7 83 D2 00 00 00 - movzx eax,word ptr [rbx+000000D2]
SAN8RPK.exe+1CCC2D2: EB 07 - jmp SAN8RPK.exe+1CCC2DB
SAN8RPK.exe+1CCC2D4: 0F B7 83 CE 00 00 00 - movzx eax,word ptr [rbx+000000CE]
SAN8RPK.exe+1CCC2DB: 44 0F B7 E0 - movzx r12d,ax
SAN8RPK.exe+1CCC2DF: 48 8B 05 12 98 19 01 - mov rax,[SAN8RPK.exe+2E65AF8]
SAN8RPK.exe+1CCC2E6: 4C 8B B0 D0 00 00 00 - mov r14,[rax+000000D0]
SAN8RPK.exe+1CCC2ED: 4D 85 F6 - test r14,r14
}
226
"Gold / 金銭"
0
FF8080
4 Bytes
i_base_city_stat_addr
BC
236
"Provisions / 軍糧"
0
FF8080
4 Bytes
i_base_city_stat_addr
C0
237
"Troops / 士兵 (Current)"
0
FF8080
4 Bytes
i_base_city_stat_addr
C4
239
"Troops / 士兵 (Capacity)"
0
FF8080
4 Bytes
i_base_city_stat_addr
100
238
"Military Population / 兵役人口"
0
FF8080
4 Bytes
i_base_city_stat_addr
C8
235
"Development / 開發"
0
FF8080
2 Bytes
i_base_city_stat_addr
CE
227
"Development max"
0
FF8080
2 Bytes
i_base_city_stat_addr
D0
228
"Commerce / 商業"
0
FF8080
2 Bytes
i_base_city_stat_addr
D2
229
"Commerce max"
0
FF8080
2 Bytes
i_base_city_stat_addr
D4
232
"Technology / 技術"
0
FF8080
2 Bytes
i_base_city_stat_addr
DA
233
"Technology max"
0
FF8080
2 Bytes
i_base_city_stat_addr
DC
230
"Defense / 防禦"
0
FF8080
2 Bytes
i_base_city_stat_addr
D6
231
"Defense max"
0
FF8080
2 Bytes
i_base_city_stat_addr
D8
234
"Public Order / 治安"
0
FF8080
Byte
i_base_city_stat_addr
DE
279
"San8 Remark Powerup kit / 三國志8 REMAKE パワーアップキット / https://opencheattables.com / CE 7.6"
009D00
1
--[[
[ENABLE]
{$lua}
if syntaxcheck then return end
]]--
-- **デバッグモードの設定 (デフォルト: 無効)**
local debugMode = false
-- AOBScanModule関数
if not AOBScanModule then
function AOBScanModule(moduleName, signature, scanOptions)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then
if debugMode then print("❗ Error: Module " .. moduleName .. " not found!") end
return nil
end
if debugMode then
print(string.format("✔️ %s Base Address: 0x%X", moduleName, baseAddr))
print(string.format("🔬 Scanning Range: 0x%X - 0x%X", baseAddr, maxAddr))
end
local ms = createMemScan()
synchronize(function()
ms.firstScan(
soExactValue,
vtByteArray,
nil,
signature,
nil,
baseAddr,
maxAddr,
scanOptions or "+X+R",
fsmNotAligned,
"1",
true,
true,
false,
false
)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
if addr then
if debugMode then print("🔦 AOB found at: 0x" .. addr) end
else
if debugMode then print("💔 AOB not found in " .. moduleName) end
end
results.destroy()
ms.destroy()
return addr
end
end
registerLuaFunctionHighlight('AOBScanModule')
--[[
test AOBScanModule()
local aob_addr_str = AOBScanModule("???.exe", "48 8B 05 ?? ?? ?? ?? 33 ED 48 8B 88", "+X+R")
if aob_addr_str then
print("🔦 Final AOB Address: 0x" .. aob_addr_str)
else
print("💔 AOB not found in ???.exe")
end
]]--
-- AOBScanModuleN関数
if not AOBScanModuleN then
function AOBScanModuleN(moduleName, signature, maxResults, scanOptions)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then
if debugMode then print("❗ Error: Module " .. moduleName .. " not found!") end
return nil
end
if debugMode then
print(string.format("✔️ %s Base Address: 0x%X", moduleName, baseAddr))
print(string.format("🔬 Scanning Range: 0x%X - 0x%X", baseAddr, maxAddr))
end
local ms = createMemScan()
synchronize(function()
ms.firstScan(
soExactValue,
vtByteArray,
nil,
signature,
nil,
baseAddr,
maxAddr,
scanOptions or "+X+R",
fsmNotAligned,
"1",
true,
true,
false,
false
)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addrs = {}
synchronize(function()
local count = results.getCount()
for i = 0, math.min(maxResults - 1, count - 1) do
table.insert(addrs, results[i])
if debugMode then
print(string.format("🔦 AOB[%d] found at: 0x%s", i + 1, results[i]))
end
end
end)
if #addrs == 0 and debugMode then
print("💔 AOB not found in " .. moduleName)
end
results.destroy()
ms.destroy()
return addrs
end
end
registerLuaFunctionHighlight('AOBScanModuleN')
-- 搜尋並取出最多5筆結果
--[[
local list = AOBScanModuleN("GameModule.exe", "12 34 56 ?? 78", 5)
if list then
for i, addr in ipairs(list) do
print(string.format("地址 %d: 0x%s", i, addr))
end
end
]]--
-- Lua scripts that table checkbox will not be checked with "NO_ACTIVATE" in comment/script body
if not onMemRecPostExecute then
function onMemRecPostExecute(memoryrecord, newState, succeeded)
if memoryrecord.Type == vtAutoAssembler and memoryrecord.Script:find("NO_ACTIVATE") and newState and succeeded then
synchronize(function()
memoryrecord.disableWithoutExecute()
end)
end
end
end
-- Memory record IDs now allowed to be 'locked'
IDs = {999999, 9999999}
-- Determine event trigger sequence
if not contains then
function contains(table, val)
for i = 1, #table do
if table[i] == val then
return true
end
end
return false
end
end
if not onMemRecPreExecute then
function onMemRecPreExecute(memoryrecord, newstate)
if contains(IDs, memoryrecord.ID) and newstate then
synchronize(function()
if not memoryrecord.OnActivate then
memoryrecord.OnActivate = function(memoryrecord, before, currentstate)
return false
end
end
end)
end
end
end
-- Utility Functions
-- Clear lua engine log
if not clearLuaLog then
function clearLuaLog()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
end)
end
end
registerLuaFunctionHighlight('clearLuaLog')
-- Close lua engine log
if not closeLuaEngine then
function closeLuaEngine()
synchronize(function()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine')
-- Clear lua engine log & close lua engine
if not closeLuaEngine2 then
function closeLuaEngine2()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine2')
if not getProcessNameFromPID then
function getProcessNameFromPID(pid)
local sl = createStringList()
getProcessList(sl)
local hexPid = string.format("%X", pid):upper()
for i = 0, sl.Count - 1 do
local entry = sl[i]
local hexid, name = entry:match("^(%x+)%-(.+)$")
if hexid and name then
if tonumber(hexid, 16) == pid then
return name
end
end
end
return "(unknown)"
end
end
registerLuaFunctionHighlight('getProcessNameFromPID')
if not printProcessInfo then
function printProcessInfo()
local pid = getOpenedProcessID()
local name = getProcessNameFromPID(pid)
print(string.format("📎 Attached to process: %s (PID: %d / 0x%X)", name, pid, pid))
end
end
registerLuaFunctionHighlight('printProcessInfo')
if not dumpProcessListAndFindPID then
function dumpProcessListAndFindPID()
local pid = getOpenedProcessID()
print(string.format("💭 Current PID: %d / 0x%X", pid, pid))
local sl = createStringList()
getProcessList(sl)
print("🧾 Dumping process list:")
for i = 0, sl.Count - 1 do
local entry = sl[i]
print(string.format("[%d] %s", i, entry))
-- 嘗試解析並比對 PID
local name, hexid = entry:match("(.+)%-(%x+)$")
if name and hexid then
local parsed = tonumber(hexid, 16)
if parsed == pid then
print("🔦 Match found in process list:")
print(string.format("Name: %s | PID: %s (0x%s)", name, parsed, hexid))
end
end
end
end
end
registerLuaFunctionHighlight('dumpProcessListAndFindPID')
if not toHex32 then
function toHex32(num)
local hexstr = "0123456789ABCDEF"
local result = ""
if num < 0 then
num = (num + (1 << 32)) % (1 << 32) -- 轉成32-bit補數
end
for i = 1, 8 do -- 32-bit 一共8個hex位
local n = num & 0xF -- 取最低4 bit
result = hexstr:sub(n + 1, n + 1) .. result
num = num >> 4 -- 右移4 bit
end
return result
end
end
registerLuaFunctionHighlight('toHex32')
if not toHex then
function toHex(num)
local hexstr = "0123456789ABCDEF"
local result = ""
if num < 0 then
num = (num + (1 << 64)) % (1 << 64) -- 轉成64-bit補數
end
for i = 1, 16 do -- 每4 bit 一個 hex字，64-bit總共16個hex位
local n = num & 0xF -- 取最低4bit
result = hexstr:sub(n + 1, n + 1) .. result
num = num >> 4 -- 右移4bit
end
return result
end
end
registerLuaFunctionHighlight('toHex')
synchronize(function() AddressList.Header.OnSectionClick = nil end)
--[[
[DISABLE]
{$lua}
if AOBScanModule then
AOBScanModule = nil
end
if onMemRecPostExecute then
onMemRecPostExecute = nil
end
if onMemRecPreExecute then
onMemRecPreExecute = nil
end
if clearLuaLog then
clearLuaLog = nil
end
if closeLuaEngine then
closeLuaEngine = nil
end
if closeLuaEngine2 then
closeLuaEngine2 = nil
end
]]--