44
"Toggle Compact View"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not toggleCompactView then
function toggleCompactView(sender, forceEnable)
local isCompactMode = not (compactViewMenuItem.Caption == 'Compact View Mode')
if forceEnable ~= nil then
isCompactMode = not forceEnable
end
synchronize(function()
compactViewMenuItem.Caption = isCompactMode and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = isCompactMode
getMainForm().Panel4.Visible = isCompactMode
getMainForm().Panel5.Visible = isCompactMode
end)
end
end
if not createCompactViewMenu then
function createCompactViewMenu()
if isCompactMenuCreated then return end
synchronize(function()
local mainMenu = getMainForm().Menu.Items
compactViewMenuItem = createMenuItem(mainMenu)
compactViewMenuItem.Caption = 'Compact View Mode'
compactViewMenuItem.OnClick = toggleCompactView
mainMenu.add(compactViewMenuItem)
end)
isCompactMenuCreated = true
end
end
createCompactViewMenu()
toggleCompactView(nil, true)
[DISABLE]
{$lua}
if toggleCompactView then
toggleCompactView(nil, false)
end
16
"Fast friendship"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/03/20
}
[ENABLE]
aobscanmodule(INJECT_FAST_FRIENDSHIP,$process,?? 8B ?? 10 ?? 63 ?? ?? ?? ?? ?? ?? 3B ?? 7F)
// raw AOB: 48 C1 E2 04 48 03 90 18 01 00 00 45 84 ED 74 ?? 80 BA 8B 00 00 00 00 74 ?? 8B 42 04 44 0F A3 F0 73 ?? 48 8B 46 08 48 8B 40 68 49 8B D7 48 8B 88 40 01 00 00 E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 8B 48 10 48 63 05 ?? ?? ?? ?? 48 3B C1 7F ?? 48 63 05 ?? ?? ?? ?? 48 3B C8 7E ?? 8B 45 E8 3B 45 EC 72 ?? 41 B9 08 00 00 00 45 33 C0 48 8D 55 F0 48 8D 4D E0 E8 ?? ?? ?? ?? 8B 45 E8 8B D0 48 8B 0B
// injection point AOB: ?? 8B ?? 10 ?? 63 ?? ?? ?? ?? ?? ?? 3B ?? 7F ?? ?? 63 ?? ?? ?? ?? ?? ?? 3B ?? 7E ?? 8B ?? ?? 3B ?? ?? 72 ?? ?? ?? 08 00 00 00 ?? 33 ?? ?? 8D ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B
alloc(newmem,$1000,INJECT_FAST_FRIENDSHIP)
alloc(INJECT_FAST_FRIENDSHIPo, $B)
label(code)
label(return)
INJECT_FAST_FRIENDSHIPo:
readmem(INJECT_FAST_FRIENDSHIP, 11)
newmem:
cmp qword ptr [rax+10], 64
jae code
mov qword ptr [rax+10], 64
code:
// mov rcx,[rax+10]
reassemble(INJECT_FAST_FRIENDSHIP)
// movsxd rax,dword ptr [CrimsonDesert.exe+5C148F8]
reassemble(INJECT_FAST_FRIENDSHIP+4)
jmp return
align 10 cc
INJECT_FAST_FRIENDSHIP:
jmp newmem
nop 6
return:
registersymbol(INJECT_FAST_FRIENDSHIP INJECT_FAST_FRIENDSHIPo)
[DISABLE]
INJECT_FAST_FRIENDSHIP:
readmem(INJECT_FAST_FRIENDSHIPo, 11)
unregistersymbol(INJECT_FAST_FRIENDSHIP INJECT_FAST_FRIENDSHIPo)
dealloc(newmem)
dealloc(INJECT_FAST_FRIENDSHIPo)
{
// ORIGINAL CODE - INJECTION POINT: CrimsonDesert.exe+14DC89E
CrimsonDesert.exe+14DC860: 48 C1 E2 04 - shl rdx,04
CrimsonDesert.exe+14DC864: 48 03 90 18 01 00 00 - add rdx,[rax+00000118]
CrimsonDesert.exe+14DC86B: 45 84 ED - test r13b,r13b
CrimsonDesert.exe+14DC86E: 74 09 - je CrimsonDesert.exe+14DC879
CrimsonDesert.exe+14DC870: 80 BA 8B 00 00 00 00 - cmp byte ptr [rdx+0000008B],00
CrimsonDesert.exe+14DC877: 74 72 - je CrimsonDesert.exe+14DC8EB
CrimsonDesert.exe+14DC879: 8B 42 04 - mov eax,[rdx+04]
CrimsonDesert.exe+14DC87C: 44 0F A3 F0 - bt eax,r14d
CrimsonDesert.exe+14DC880: 73 69 - jae CrimsonDesert.exe+14DC8EB
CrimsonDesert.exe+14DC882: 48 8B 46 08 - mov rax,[rsi+08]
CrimsonDesert.exe+14DC886: 48 8B 40 68 - mov rax,[rax+68]
CrimsonDesert.exe+14DC88A: 49 8B D7 - mov rdx,r15
CrimsonDesert.exe+14DC88D: 48 8B 88 40 01 00 00 - mov rcx,[rax+00000140]
CrimsonDesert.exe+14DC894: E8 47 BA 3C 00 - call CrimsonDesert.exe+18A82E0
CrimsonDesert.exe+14DC899: 48 85 C0 - test rax,rax
CrimsonDesert.exe+14DC89C: 74 1C - je CrimsonDesert.exe+14DC8BA
// ---------- INJECTING HERE ----------
CrimsonDesert.exe+14DC89E: 48 8B 48 10 - mov rcx,[rax+10]
// ---------- DONE INJECTING ----------
CrimsonDesert.exe+14DC8A2: 48 63 05 4F 80 73 04 - movsxd rax,dword ptr [CrimsonDesert.exe+5C148F8]
CrimsonDesert.exe+14DC8A9: 48 3B C1 - cmp rax,rcx
CrimsonDesert.exe+14DC8AC: 7F 0C - jg CrimsonDesert.exe+14DC8BA
CrimsonDesert.exe+14DC8AE: 48 63 05 03 7F 73 04 - movsxd rax,dword ptr [CrimsonDesert.exe+5C147B8]
CrimsonDesert.exe+14DC8B5: 48 3B C8 - cmp rcx,rax
CrimsonDesert.exe+14DC8B8: 7E 31 - jle CrimsonDesert.exe+14DC8EB
CrimsonDesert.exe+14DC8BA: 8B 45 E8 - mov eax,[rbp-18]
CrimsonDesert.exe+14DC8BD: 3B 45 EC - cmp eax,[rbp-14]
CrimsonDesert.exe+14DC8C0: 72 19 - jb CrimsonDesert.exe+14DC8DB
CrimsonDesert.exe+14DC8C2: 41 B9 08 00 00 00 - mov r9d,00000008
CrimsonDesert.exe+14DC8C8: 45 33 C0 - xor r8d,r8d
CrimsonDesert.exe+14DC8CB: 48 8D 55 F0 - lea rdx,[rbp-10]
CrimsonDesert.exe+14DC8CF: 48 8D 4D E0 - lea rcx,[rbp-20]
CrimsonDesert.exe+14DC8D3: E8 E8 E5 DF FE - call CrimsonDesert.exe+2DAEC0
CrimsonDesert.exe+14DC8D8: 8B 45 E8 - mov eax,[rbp-18]
CrimsonDesert.exe+14DC8DB: 8B D0 - mov edx,eax
}
43
"inf: arrows, bullets (#36+) / keys (18) / Cube (9) / silver (980)... etc"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/03/20
}
[ENABLE]
aobscanmodule(INJECT_INF_ARROW_N_OTHERS,$process,?? 83 ?? 10 00 7E ?? ?? 8D ?? 08 66)
// raw AOB: 0F B7 E8 66 41 3B C4 0F 8D ?? ?? ?? ?? 48 89 5C 24 50 BA FF FF 00 00 48 89 7C 24 58 66 44 3B 7E 12 0F 8D ?? ?? ?? ?? 0F BF C5 48 8D 1C 40 48 C1 E3 06 48 03 1E 48 39 1D ?? ?? ?? ?? 74 ?? 66 3B 53 08 74 ?? 48 83 7B 10 00 7E ?? 48 8D 4B 08 66 41 FF C7 E8 ?? ?? ?? ?? 48 8B C8 41 8B 45 00 39 01 75 ?? 83 7E 20 00 0F B7 43 08 74 ?? 44 8B 4E 20 33 C9 45 85 C9 74 ?? 4C 8B 56 18
// injection point AOB: ?? 83 ?? 10 00 7E ?? ?? 8D ?? 08 66 ?? FF ?? E8 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? 00 39 ?? 75 ?? 83 ?? 20 00 0F B7 ?? 08 74 ?? ?? 8B ?? 20 33 ?? ?? 85 ?? 74 ?? ?? 8B ?? 18
alloc(newmem,$1000,INJECT_INF_ARROW_N_OTHERS)
alloc(INJECT_INF_ARROW_N_OTHERSo, $5)
label(code)
label(return)
label(is_chk_silver)
INJECT_INF_ARROW_N_OTHERSo:
readmem(INJECT_INF_ARROW_N_OTHERS, 5)
newmem:
cmp qword ptr [rbx], #10 // arrow
jb code
//cmp qword ptr [rbx], #94 // arrow
//ja code
cmp qword ptr [rbx], #10 // arrow
je set_amount42
cmp qword ptr [rbx], #16 // small cannonball
je set_amount42
cmp qword ptr [rbx], #18 // oats
je set_amount42
cmp qword ptr [rbx], #21 // Thick Hide - fix number
je set_amount42
cmp qword ptr [rbx], #23 // bullet
je set_amount42
cmp qword ptr [rbx], #26 // wool - fix number
je set_amount96
cmp qword ptr [rbx], #36 // water
je set_amount42
cmp qword ptr [rbx], #38 // sugar
je set_amount42
cmp qword ptr [rbx], #39 // salt
je set_amount42
cmp qword ptr [rbx], #40 // barley
je set_amount42
cmp qword ptr [rbx], #41 // cooking oil
je set_amount42
cmp qword ptr [rbx], #42 // apple
je set_amount42
cmp qword ptr [rbx], #43 // egg
je set_amount42
cmp qword ptr [rbx], #64
je set_amount42
cmp qword ptr [rbx], #94 // cloth piece - fix number
je set_amount42
cmp qword ptr [rbx], #104 // Pill - fix number
je set_amount9
cmp qword ptr [rbx], #114 // wine - fix number
je set_amount18
cmp qword ptr [rbx], #108 // beans
je set_amount42
cmp qword ptr [rbx], #119 // small bones - fix number
je set_amount42
cmp qword ptr [rbx], #125 // keys - fix number
je set_amount18
cmp qword ptr [rbx], #126 // Wood - fix number
je set_amount42
cmp qword ptr [rbx], #127 // Wood #2 - fix number
je set_amount42
cmp qword ptr [rbx], #171 // poison arrow
je set_amount
cmp qword ptr [rbx], #174 // iron ore - fix number
je set_amount42
cmp qword ptr [rbx], #175 // abyss cube - fix number
je set_amount9
cmp qword ptr [rbx], #188 // horse grain - fix number
je set_amount18
cmp qword ptr [rbx], #244 // fish meat - fix number
je set_amount42
cmp qword ptr [rbx], #242 // a.stone - fix number
je set_amount42
cmp qword ptr [rbx], #245
je set_amount18
cmp qword ptr [rbx], #255 // food 烤穀物
je set_amount18
cmp qword ptr [rbx], #270 // thin hide - fix number
je set_amount42
cmp qword ptr [rbx], #309 // Copper ore - fix number
je set_amount42
cmp qword ptr [rbx], #330 // feather - fix number
je set_amount42
cmp qword ptr [rbx], #332 // Grilled egg - fix number
je set_amount18
cmp qword ptr [rbx], #345 // Grilled meat - fix number
je set_amount18
cmp qword ptr [rbx], #346 // Grilled fruit - fix number
je set_amount18
cmp qword ptr [rbx], #357 // food - fix number
je set_amount18
cmp qword ptr [rbx], #331 // soup - fix number
je set_amount18
cmp qword ptr [rbx], #333 // food - fix number
je set_amount18
cmp qword ptr [rbx], #363 // meat - fix number
je set_amount18
cmp qword ptr [rbx], #368 // fried egg fish - fix number
je set_amount18
cmp qword ptr [rbx], #27 // silver - fix number
je set_silver_amount
jmp code
set_amount:
cmp qword ptr [rbx+10], 24
jae code
mov qword ptr [rbx+10], 24
jmp code
set_amount9:
//cmp qword ptr [rbx+10], 9
//jae short code
mov qword ptr [rbx+10], 9
jmp short code
set_amount18:
//cmp qword ptr [rbx+10], 12
//jae short code
mov qword ptr [rbx+10], 12
jmp short code
set_amount42:
mov qword ptr [rbx+10], #42
jmp short code
set_amount96:
mov qword ptr [rbx+10], 60
jmp short code
set_silver_amount:
cmp dword ptr [is_chk_silver], 1
jne short code
mov [rbx+10], #98000
code:
// cmp qword ptr [rbx+10],00
reassemble(INJECT_INF_ARROW_N_OTHERS)
jmp return
align 10 cc
is_chk_silver:
dd 0 0
INJECT_INF_ARROW_N_OTHERS:
jmp newmem
return:
registersymbol(INJECT_INF_ARROW_N_OTHERS INJECT_INF_ARROW_N_OTHERSo)
registersymbol(is_chk_silver)
[DISABLE]
INJECT_INF_ARROW_N_OTHERS:
readmem(INJECT_INF_ARROW_N_OTHERSo, 5)
unregistersymbol(INJECT_INF_ARROW_N_OTHERS INJECT_INF_ARROW_N_OTHERSo)
unregistersymbol(is_chk_silver)
dealloc(newmem)
dealloc(INJECT_INF_ARROW_N_OTHERSo)
{
// ORIGINAL CODE - INJECTION POINT: CrimsonDesert.exe+1D1A9EA
CrimsonDesert.exe+1D1A9A6: 0F B7 E8 - movzx ebp,ax
CrimsonDesert.exe+1D1A9A9: 66 41 3B C4 - cmp ax,r12w
CrimsonDesert.exe+1D1A9AD: 0F 8D AB 00 00 00 - jnl CrimsonDesert.exe+1D1AA5E
CrimsonDesert.exe+1D1A9B3: 48 89 5C 24 50 - mov [rsp+50],rbx
CrimsonDesert.exe+1D1A9B8: BA FF FF 00 00 - mov edx,0000FFFF
CrimsonDesert.exe+1D1A9BD: 48 89 7C 24 58 - mov [rsp+58],rdi
CrimsonDesert.exe+1D1A9C2: 66 44 3B 7E 12 - cmp r15w,[rsi+12]
CrimsonDesert.exe+1D1A9C7: 0F 8D 84 00 00 00 - jnl CrimsonDesert.exe+1D1AA51
CrimsonDesert.exe+1D1A9CD: 0F BF C5 - movsx eax,bp
CrimsonDesert.exe+1D1A9D0: 48 8D 1C 40 - lea rbx,[rax+rax*2]
CrimsonDesert.exe+1D1A9D4: 48 C1 E3 06 - shl rbx,06
CrimsonDesert.exe+1D1A9D8: 48 03 1E - add rbx,[rsi]
CrimsonDesert.exe+1D1A9DB: 48 39 1D E6 C5 F0 03 - cmp [CrimsonDesert.exe+5C26FC8],rbx
CrimsonDesert.exe+1D1A9E2: 74 60 - je CrimsonDesert.exe+1D1AA44
CrimsonDesert.exe+1D1A9E4: 66 3B 53 08 - cmp dx,[rbx+08]
CrimsonDesert.exe+1D1A9E8: 74 5A - je CrimsonDesert.exe+1D1AA44
// ---------- INJECTING HERE ----------
CrimsonDesert.exe+1D1A9EA: 48 83 7B 10 00 - cmp qword ptr [rbx+10],00
// ---------- DONE INJECTING ----------
CrimsonDesert.exe+1D1A9EF: 7E 53 - jle CrimsonDesert.exe+1D1AA44
CrimsonDesert.exe+1D1A9F1: 48 8D 4B 08 - lea rcx,[rbx+08]
CrimsonDesert.exe+1D1A9F5: 66 41 FF C7 - inc r15w
CrimsonDesert.exe+1D1A9F9: E8 A2 A3 5B FE - call CrimsonDesert.exe+2D4DA0
CrimsonDesert.exe+1D1A9FE: 48 8B C8 - mov rcx,rax
CrimsonDesert.exe+1D1AA01: 41 8B 45 00 - mov eax,[r13+00]
CrimsonDesert.exe+1D1AA05: 39 01 - cmp [rcx],eax
CrimsonDesert.exe+1D1AA07: 75 36 - jne CrimsonDesert.exe+1D1AA3F
CrimsonDesert.exe+1D1AA09: 83 7E 20 00 - cmp dword ptr [rsi+20],00
CrimsonDesert.exe+1D1AA0D: 0F B7 43 08 - movzx eax,word ptr [rbx+08]
CrimsonDesert.exe+1D1AA11: 74 28 - je CrimsonDesert.exe+1D1AA3B
CrimsonDesert.exe+1D1AA13: 44 8B 4E 20 - mov r9d,[rsi+20]
CrimsonDesert.exe+1D1AA17: 33 C9 - xor ecx,ecx
CrimsonDesert.exe+1D1AA19: 45 85 C9 - test r9d,r9d
CrimsonDesert.exe+1D1AA1C: 74 1D - je CrimsonDesert.exe+1D1AA3B
CrimsonDesert.exe+1D1AA1E: 4C 8B 56 18 - mov r10,[rsi+18]
}
48
"Force set silver amount?"
YesNo
0
C08000
4 Bytes
is_chk_silver
25
"Menu: when add item amount: set item amount"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/03/20
}
[ENABLE]
aobscanmodule(INJECT_SET_ITEM_CNT,$process,?? 01 ?? 38 10 ?? 8B)
// raw AOB: 66 3B 41 08 0F 84 ?? ?? ?? ?? 4C 8B 61 10 4D 85 E4 0F 8E ?? ?? ?? ?? 48 8D 4C 24 68 48 89 6C 24 50 66 89 5C 24 68 E8 ?? ?? ?? ?? 0F B6 54 24 70 48 89 C1 E8 ?? ?? ?? ?? 49 8B 4D 10 48 89 C5 4D 8B 06 66 89 5C 24 68 49 01 4C 38 10 49 8B 0E 48 8B 7C 0F 10 48 8D 4C 24 68 E8 ?? ?? ?? ?? 0F B6 54 24 70 48 89 C1 E8 ?? ?? ?? ?? 48 8D 1D ?? ?? ?? ?? 48 C7 03 0F A2 C3 00 49 89 C2 31 C9 48 89 F8 48 99 49 F7 FA 49 89 C2 49 89 D1
// injection point AOB: ?? 01 ?? 38 10 ?? 8B ?? ?? 8B ?? 0F 10 ?? 8D ?? 24 ?? E8 ?? ?? ?? ?? 0F B6 ?? 24 ?? ?? 89 ?? E8 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? ?? C7 ?? 0F A2 C3 00 ?? 89 ?? 31 ?? ?? 89 ?? 48 99 ?? F7 ?? ?? 89 ?? ?? 89
alloc(newmem,$1000,INJECT_SET_ITEM_CNT)
alloc(INJECT_SET_ITEM_CNTo, $5)
label(code)
label(return)
label(i_item_threshold i_item_set_to)
label(i_item_threshold2 i_item_set_to2 i_item_threshold3 i_item_set_to3 i_item_threshold4 i_item_set_to4 i_item_add_options vf_item_add_multi)
label(i_last_idata_addr1 i_last_idata_addr2)
INJECT_SET_ITEM_CNTo:
readmem(INJECT_SET_ITEM_CNT, 5)
newmem:
test rcx, rcx
jz code
push r15
push r14
mov r15, i_last_idata_addr1
mov r14, [i_idx]
lea r15, [r15+r14*8]
lea r14, [r8+rdi]
mov [r15], r14
inc qword ptr [i_idx]
cmp qword ptr [i_idx], 2
jb short endp_pre
mov qword ptr [i_idx], 0
endp_pre:
pop r14
pop r15
cmp qword ptr [r8+rdi], #125 // normal key
je code
cmp qword ptr [r8+rdi], #175 // cube
je code
cmp qword ptr [r8+rdi], #26 // wool
je code
cmp qword ptr [r8+rdi], #27 // silver (currency)
je code
cmp dword ptr [i_item_add_options], 0
jne chk_next1
push r15
{
mov r15, [i_item_threshold4]
cmp [r8+rdi+10], r15
jb @F
mov r15, [i_item_set_to4]
cmp [r8+rdi+10], r15
jae @F
mov [r8+rdi+10], r15
jmp endp
@@:
mov r15, [i_item_threshold3]
cmp [r8+rdi+10], r15
jb @F
mov r15, [i_item_set_to3]
cmp [r8+rdi+10], r15
jae @F
mov [r8+rdi+10], r15
jmp endp
}
@@:
mov r15, [i_item_threshold2]
cmp [r8+rdi+10], r15
jb short @F
mov r15, [i_item_set_to2]
cmp [r8+rdi+10], r15
jae short @F
mov [r8+rdi+10], r15
jmp short endp
@@:
mov r15, [i_item_threshold]
cmp [r8+rdi+10], r15
jb short @F
mov r15, [i_item_set_to]
cmp [r8+rdi+10], r15
jae short @F
mov [r8+rdi+10], r15
jmp short endp
@@:
endp:
pop r15
jmp short code
chk_next1:
vmovss xmm14, [vf_item_add_multi]
vcvtsi2ss xmm15, xmm15, rcx
vmulss xmm15, xmm14, xmm14
vcvtss2si rcx, xmm15
code:
// add [r8+rdi+10],rcx
reassemble(INJECT_SET_ITEM_CNT)
jmp return
align 10 cc
i_item_threshold:
dq 2
i_item_set_to:
dq #29
i_item_threshold2:
dq #101
i_item_set_to2:
dq #900
i_item_threshold3:
dq #1001
i_item_set_to3:
dq #9800
i_item_threshold4:
dq #10001
i_item_set_to4:
dq #99800
i_item_add_options: // 0 = value clamp, 1 = multiplier
dd 0
vf_item_add_multi:
dd (float)3
i_idx:
dq 0
i_last_idata_addr1:
dq 0
i_last_idata_addr2:
dq 0
INJECT_SET_ITEM_CNT:
jmp newmem
return:
registersymbol(INJECT_SET_ITEM_CNT INJECT_SET_ITEM_CNTo)
registersymbol(i_item_threshold i_item_set_to)
registersymbol(i_last_idata_addr1 i_last_idata_addr2)
registersymbol(i_item_threshold2 i_item_set_to2 i_item_threshold3 i_item_set_to3 i_item_threshold4 i_item_set_to4 i_item_add_options vf_item_add_multi)
[DISABLE]
INJECT_SET_ITEM_CNT:
readmem(INJECT_SET_ITEM_CNTo, 5)
unregistersymbol(INJECT_SET_ITEM_CNT INJECT_SET_ITEM_CNTo)
unregistersymbol(i_item_threshold i_item_set_to)
unregistersymbol(i_last_idata_addr1 i_last_idata_addr2)
unregistersymbol(i_item_threshold2 i_item_set_to2 i_item_threshold3 i_item_set_to3 i_item_threshold4 i_item_set_to4 i_item_add_options vf_item_add_multi)
dealloc(newmem)
dealloc(INJECT_SET_ITEM_CNTo)
{
// ORIGINAL CODE - INJECTION POINT: CrimsonDesert.exe+FC948CA
CrimsonDesert.exe+FC94883: 66 3B 41 08 - cmp ax,[rcx+08]
CrimsonDesert.exe+FC94887: 0F 84 B2 00 00 00 - je CrimsonDesert.exe+FC9493F
CrimsonDesert.exe+FC9488D: 4C 8B 61 10 - mov r12,[rcx+10]
CrimsonDesert.exe+FC94891: 4D 85 E4 - test r12,r12
CrimsonDesert.exe+FC94894: 0F 8E A5 00 00 00 - jng CrimsonDesert.exe+FC9493F
CrimsonDesert.exe+FC9489A: 48 8D 4C 24 68 - lea rcx,[rsp+68]
CrimsonDesert.exe+FC9489F: 48 89 6C 24 50 - mov [rsp+50],rbp
CrimsonDesert.exe+FC948A4: 66 89 5C 24 68 - mov [rsp+68],bx
CrimsonDesert.exe+FC948A9: E8 F2 04 64 F0 - call CrimsonDesert.exe+2D4DA0
CrimsonDesert.exe+FC948AE: 0F B6 54 24 70 - movzx edx,byte ptr [rsp+70]
CrimsonDesert.exe+FC948B3: 48 89 C1 - mov rcx,rax
CrimsonDesert.exe+FC948B6: E8 A5 DF 08 F2 - call CrimsonDesert.exe+1D22860
CrimsonDesert.exe+FC948BB: 49 8B 4D 10 - mov rcx,[r13+10]
CrimsonDesert.exe+FC948BF: 48 89 C5 - mov rbp,rax
CrimsonDesert.exe+FC948C2: 4D 8B 06 - mov r8,[r14]
CrimsonDesert.exe+FC948C5: 66 89 5C 24 68 - mov [rsp+68],bx
// ---------- INJECTING HERE ----------
CrimsonDesert.exe+FC948CA: 49 01 4C 38 10 - add [r8+rdi+10],rcx
// ---------- DONE INJECTING ----------
CrimsonDesert.exe+FC948CF: 49 8B 0E - mov rcx,[r14]
CrimsonDesert.exe+FC948D2: 48 8B 7C 0F 10 - mov rdi,[rdi+rcx+10]
CrimsonDesert.exe+FC948D7: 48 8D 4C 24 68 - lea rcx,[rsp+68]
CrimsonDesert.exe+FC948DC: E8 BF 04 64 F0 - call CrimsonDesert.exe+2D4DA0
CrimsonDesert.exe+FC948E1: 0F B6 54 24 70 - movzx edx,byte ptr [rsp+70]
CrimsonDesert.exe+FC948E6: 48 89 C1 - mov rcx,rax
CrimsonDesert.exe+FC948E9: E8 72 DF 08 F2 - call CrimsonDesert.exe+1D22860
CrimsonDesert.exe+FC948EE: 48 8D 1D 9C C5 D3 07 - lea rbx,[CrimsonDesert.exe+179D0E91]
CrimsonDesert.exe+FC948F5: 48 C7 03 0F A2 C3 00 - mov qword ptr [rbx],00C3A20F
CrimsonDesert.exe+FC948FC: 49 89 C2 - mov r10,rax
CrimsonDesert.exe+FC948FF: 31 C9 - xor ecx,ecx
CrimsonDesert.exe+FC94901: 48 89 F8 - mov rax,rdi
CrimsonDesert.exe+FC94904: 48 99 - cqo
CrimsonDesert.exe+FC94906: 49 F7 FA - idiv r10
CrimsonDesert.exe+FC94909: 49 89 C2 - mov r10,rax
CrimsonDesert.exe+FC9490C: 49 89 D1 - mov r9,rdx
}
1337211263
"ignores known keys and cubes, others in "inf: arrows, bullets...." script"
8000FF
1
52
"mode"
0:value clamp
1:multiplier
0
C08000
4 Bytes
i_item_add_options
69
"_debug"
1
65
"ID #1"
0
FF8080
8 Bytes
i_last_idata_addr1
0
66
"amount #1"
0
FF8080
8 Bytes
i_last_idata_addr2
10
67
"ID #2"
0
FF8080
8 Bytes
i_last_idata_addr2
0
68
"amount #2"
0
FF8080
8 Bytes
i_last_idata_addr2
10
54
"value clamp"
1
6
"cur. amount must >="
0
C08000
8 Bytes
i_item_threshold
7
"set amount to"
0
C08000
8 Bytes
i_item_set_to
17
"#2: cur. amount must >="
0
C08000
8 Bytes
i_item_threshold2
18
"#2: set amount to"
0
C08000
8 Bytes
i_item_set_to2
53
"multiplier"
0
C08000
Float
vf_item_add_multi
1337211275
"Bag bonus slot multiplier"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/03/22
}
[ENABLE]
aobscanmodule(INJECT_BAG_BONUS_MULTI,$process,66 01 ?? 16 ?? 8B)
// raw AOB: E8 ?? ?? ?? ?? 44 0F B7 4B 14 45 33 F6 66 44 39 48 14 7D ?? 41 0F B7 FE EB ?? 48 8D 4B 10 E8 ?? ?? ?? ?? 44 0F B7 4B 14 0F B7 48 14 66 41 2B C9 66 3B CF 66 0F 4C F9 48 8B 6C 24 38 66 44 03 CF 66 01 7B 16 48 8B C6 48 8B 7C 24 48 66 44 89 4B 14 48 8B 5C 24 30 44 89 36 48 8B 74 24 40 48 83 C4 20 41 5E C3 CC CC CC 48 89 5C 24 08 4C 8B 05 ?? ?? ?? ?? 66 39 51 0C 7E ?? 0F BF C2
// injection point AOB: 66 01 ?? 16 ?? 8B ?? ?? 8B ?? 24 ?? 66 ?? 89 ?? 14 ?? 8B ?? 24 ?? ?? 89 ?? ?? 8B ?? 24 ?? 48 83 C4 20 ?? ?? C3 CC CC CC ?? 89 ?? 24 ?? ?? 8B ?? ?? ?? ?? ?? 66 39 ?? 0C 7E ?? 0F BF
alloc(newmem,$1000,INJECT_BAG_BONUS_MULTI)
alloc(INJECT_BAG_BONUS_MULTIo, $7)
label(code)
label(return)
label(vf_mult_348928 iw_min_bonus)
INJECT_BAG_BONUS_MULTIo:
readmem(INJECT_BAG_BONUS_MULTI, 7)
newmem:
// **** Begin Auto script: Multiplier
// value=3, rule=R1_MemReg, template=P1_IntToFloat, NegDeltaCheck, PreserveXmm
sub rsp, 20
movaps [rsp], xmm15
movaps [rsp+10], xmm14
and edi, 0000FFFF
test edi, edi
// Multiplier: delta in di
vmovss xmm15, [vf_mult_348928]
vcvtsi2ss xmm14, xmm14, edi
vmulss xmm14, xmm14, xmm15
vcvtss2si edi, xmm14
skip_mult_348928:
movaps xmm15, [rsp]
movaps xmm14, [rsp+10]
add rsp, 20
// **** End Auto script: Multiplier
code:
// add [rbx+16],di
reassemble(INJECT_BAG_BONUS_MULTI)
// mov rax,rsi
reassemble(INJECT_BAG_BONUS_MULTI+4)
jmp return
align 10 cc
vf_mult_348928:
dd (float)3
iw_min_bonus:
dw 64
INJECT_BAG_BONUS_MULTI:
jmp newmem
nop 2
return:
registersymbol(INJECT_BAG_BONUS_MULTI INJECT_BAG_BONUS_MULTIo vf_mult_348928 iw_min_bonus)
[DISABLE]
INJECT_BAG_BONUS_MULTI:
readmem(INJECT_BAG_BONUS_MULTIo, 7)
unregistersymbol(INJECT_BAG_BONUS_MULTI INJECT_BAG_BONUS_MULTIo vf_mult_348928 iw_min_bonus)
dealloc(newmem)
dealloc(INJECT_BAG_BONUS_MULTIo)
{
// ORIGINAL CODE - INJECTION POINT: CrimsonDesert.exe+1D1A6E8
CrimsonDesert.exe+1D1A6A8: E8 A3 DA 79 FE - call CrimsonDesert.exe+4B8150
CrimsonDesert.exe+1D1A6AD: 44 0F B7 4B 14 - movzx r9d,word ptr [rbx+14]
CrimsonDesert.exe+1D1A6B2: 45 33 F6 - xor r14d,r14d
CrimsonDesert.exe+1D1A6B5: 66 44 39 48 14 - cmp [rax+14],r9w
CrimsonDesert.exe+1D1A6BA: 7D 06 - jnl CrimsonDesert.exe+1D1A6C2
CrimsonDesert.exe+1D1A6BC: 41 0F B7 FE - movzx edi,r14w
CrimsonDesert.exe+1D1A6C0: EB 1D - jmp CrimsonDesert.exe+1D1A6DF
CrimsonDesert.exe+1D1A6C2: 48 8D 4B 10 - lea rcx,[rbx+10]
CrimsonDesert.exe+1D1A6C6: E8 85 DA 79 FE - call CrimsonDesert.exe+4B8150
CrimsonDesert.exe+1D1A6CB: 44 0F B7 4B 14 - movzx r9d,word ptr [rbx+14]
CrimsonDesert.exe+1D1A6D0: 0F B7 48 14 - movzx ecx,word ptr [rax+14]
CrimsonDesert.exe+1D1A6D4: 66 41 2B C9 - sub cx,r9w
CrimsonDesert.exe+1D1A6D8: 66 3B CF - cmp cx,di
CrimsonDesert.exe+1D1A6DB: 66 0F 4C F9 - cmovl di,cx
CrimsonDesert.exe+1D1A6DF: 48 8B 6C 24 38 - mov rbp,[rsp+38]
CrimsonDesert.exe+1D1A6E4: 66 44 03 CF - add r9w,di
// ---------- INJECTING HERE ----------
CrimsonDesert.exe+1D1A6E8: 66 01 7B 16 - add [rbx+16],di
// ---------- DONE INJECTING ----------
CrimsonDesert.exe+1D1A6EC: 48 8B C6 - mov rax,rsi
CrimsonDesert.exe+1D1A6EF: 48 8B 7C 24 48 - mov rdi,[rsp+48]
CrimsonDesert.exe+1D1A6F4: 66 44 89 4B 14 - mov [rbx+14],r9w
CrimsonDesert.exe+1D1A6F9: 48 8B 5C 24 30 - mov rbx,[rsp+30]
CrimsonDesert.exe+1D1A6FE: 44 89 36 - mov [rsi],r14d
CrimsonDesert.exe+1D1A701: 48 8B 74 24 40 - mov rsi,[rsp+40]
CrimsonDesert.exe+1D1A706: 48 83 C4 20 - add rsp,20
CrimsonDesert.exe+1D1A70A: 41 5E - pop r14
CrimsonDesert.exe+1D1A70C: C3 - ret
CrimsonDesert.exe+1D1A70D: CC - int 3
CrimsonDesert.exe+1D1A70E: CC - int 3
CrimsonDesert.exe+1D1A70F: CC - int 3
CrimsonDesert.exe+1D1A710: 48 89 5C 24 08 - mov [rsp+08],rbx
CrimsonDesert.exe+1D1A715: 4C 8B 05 AC C8 F0 03 - mov r8,[CrimsonDesert.exe+5C26FC8]
CrimsonDesert.exe+1D1A71C: 66 39 51 0C - cmp [rcx+0C],dx
CrimsonDesert.exe+1D1A720: 7E 69 - jle CrimsonDesert.exe+1D1A78B
}
1337211282
"base min bonus"
0
C08000
2 Bytes
iw_min_bonus
1337211276
"multiplier"
0
C08000
Float
vf_mult_348928
1337211286
"Set min reputation when gain"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/03/22
}
[ENABLE]
aobscanmodule(INJECT_SET_MIN_REP_WHEN_GAIN,$process,?? 89 ?? 10 89 ?? 0C ?? 8B ?? 24 ?? 00)
// raw AOB: 48 8D 69 18 41 8B F1 48 8D 8C 24 98 00 00 00 41 8B F8 0F B7 DA E8 ?? ?? ?? ?? 48 8B D0 48 8B CD E8 ?? ?? ?? ?? 48 85 C0 74 ?? 89 78 08 39 78 04 7D ?? 89 78 04 48 8B 8C 24 B0 00 00 00 48 89 48 10 89 70 0C 48 8B 9C 24 A0 00 00 00 48 83 C4 70 5F 5E 5D C3 48 8B 84 24 B0 00 00 00 48 8D 8C 24 90 00 00 00 48 89 44 24 50 66 89 5C 24 40 89 7C 24 44 89 7C 24 48 89 74 24 4C 66 89 9C 24 90 00 00 00 E8 ?? ?? ?? ?? 4C 8D 4C 24 40
// injection point AOB: ?? 89 ?? 10 89 ?? 0C ?? 8B ?? 24 ?? 00 00 00 48 83 C4 70 ?? ?? 5D C3 ?? 8B ?? 24 ?? 00 00 00 ?? 8D ?? 24 ?? 00 00 00 ?? 89 ?? 24 ?? 66 89 ?? 24 ?? 89 ?? 24 ?? 89 ?? 24 ?? 89 ?? 24 ?? 66 89 ?? 24 ?? 00 00 00 E8 ?? ?? ?? ?? ?? 8D ?? 24
alloc(newmem,$1000,INJECT_SET_MIN_REP_WHEN_GAIN)
alloc(INJECT_SET_MIN_REP_WHEN_GAINo, $7)
label(code)
label(return)
label(i_min_rep_dot_value i_min_rep_value)
INJECT_SET_MIN_REP_WHEN_GAINo:
readmem(INJECT_SET_MIN_REP_WHEN_GAIN, 7)
newmem:
mov rbx, [i_min_rep_dot_value]
cmp rcx, rbx
jae short @F
mov rcx, rbx
@@:
mov rbx, [i_min_rep_value]
cmp [rax+8], rbx
jae short @F
mov [rax+8], rbx
code:
// mov [rax+10],rcx
reassemble(INJECT_SET_MIN_REP_WHEN_GAIN)
// mov [rax+0C],esi
reassemble(INJECT_SET_MIN_REP_WHEN_GAIN+4)
jmp return
align 10 cc
i_min_rep_dot_value:
dq #98
i_min_rep_value:
dq 14
INJECT_SET_MIN_REP_WHEN_GAIN:
jmp newmem
nop 2
return:
registersymbol(INJECT_SET_MIN_REP_WHEN_GAIN INJECT_SET_MIN_REP_WHEN_GAINo)
registersymbol(i_min_rep_dot_value i_min_rep_value)
[DISABLE]
INJECT_SET_MIN_REP_WHEN_GAIN:
readmem(INJECT_SET_MIN_REP_WHEN_GAINo, 7)
unregistersymbol(INJECT_SET_MIN_REP_WHEN_GAIN INJECT_SET_MIN_REP_WHEN_GAINo)
unregistersymbol(i_min_rep_dot_value i_min_rep_value)
dealloc(newmem)
dealloc(INJECT_SET_MIN_REP_WHEN_GAINo)
{
// ORIGINAL CODE - INJECTION POINT: CrimsonDesert.exe+1B3057E
CrimsonDesert.exe+1B30541: 48 8D 69 18 - lea rbp,[rcx+18]
CrimsonDesert.exe+1B30545: 41 8B F1 - mov esi,r9d
CrimsonDesert.exe+1B30548: 48 8D 8C 24 98 00 00 00 - lea rcx,[rsp+00000098]
CrimsonDesert.exe+1B30550: 41 8B F8 - mov edi,r8d
CrimsonDesert.exe+1B30553: 0F B7 DA - movzx ebx,dx
CrimsonDesert.exe+1B30556: E8 25 92 7C FE - call CrimsonDesert.exe+2F9780
CrimsonDesert.exe+1B3055B: 48 8B D0 - mov rdx,rax
CrimsonDesert.exe+1B3055E: 48 8B CD - mov rcx,rbp
CrimsonDesert.exe+1B30561: E8 2A 82 7A FE - call CrimsonDesert.exe+2D8790
CrimsonDesert.exe+1B30566: 48 85 C0 - test rax,rax
CrimsonDesert.exe+1B30569: 74 2A - je CrimsonDesert.exe+1B30595
CrimsonDesert.exe+1B3056B: 89 78 08 - mov [rax+08],edi
CrimsonDesert.exe+1B3056E: 39 78 04 - cmp [rax+04],edi
CrimsonDesert.exe+1B30571: 7D 03 - jnl CrimsonDesert.exe+1B30576
CrimsonDesert.exe+1B30573: 89 78 04 - mov [rax+04],edi
CrimsonDesert.exe+1B30576: 48 8B 8C 24 B0 00 00 00 - mov rcx,[rsp+000000B0]
// ---------- INJECTING HERE ----------
CrimsonDesert.exe+1B3057E: 48 89 48 10 - mov [rax+10],rcx
// ---------- DONE INJECTING ----------
CrimsonDesert.exe+1B30582: 89 70 0C - mov [rax+0C],esi
CrimsonDesert.exe+1B30585: 48 8B 9C 24 A0 00 00 00 - mov rbx,[rsp+000000A0]
CrimsonDesert.exe+1B3058D: 48 83 C4 70 - add rsp,70
CrimsonDesert.exe+1B30591: 5F - pop rdi
CrimsonDesert.exe+1B30592: 5E - pop rsi
CrimsonDesert.exe+1B30593: 5D - pop rbp
CrimsonDesert.exe+1B30594: C3 - ret
CrimsonDesert.exe+1B30595: 48 8B 84 24 B0 00 00 00 - mov rax,[rsp+000000B0]
CrimsonDesert.exe+1B3059D: 48 8D 8C 24 90 00 00 00 - lea rcx,[rsp+00000090]
CrimsonDesert.exe+1B305A5: 48 89 44 24 50 - mov [rsp+50],rax
CrimsonDesert.exe+1B305AA: 66 89 5C 24 40 - mov [rsp+40],bx
CrimsonDesert.exe+1B305AF: 89 7C 24 44 - mov [rsp+44],edi
CrimsonDesert.exe+1B305B3: 89 7C 24 48 - mov [rsp+48],edi
CrimsonDesert.exe+1B305B7: 89 74 24 4C - mov [rsp+4C],esi
CrimsonDesert.exe+1B305BB: 66 89 9C 24 90 00 00 00 - mov [rsp+00000090],bx
CrimsonDesert.exe+1B305C3: E8 B8 91 7C FE - call CrimsonDesert.exe+2F9780
}
1337211287
"min. rep. value"
0
C08000
8 Bytes
i_min_rep_value
32
"Get HP address: Step 1 & 2 - AOB mode"
1
33
"+Step 1 Usage: open item menu"
8000FF
1
37
"Enable step 1"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/03/20
}
[ENABLE]
aobscanmodule(INJECT_GET_HP_1_3,$process,0F 85 ?? ?? ?? ?? ?? 8B ?? 38 ?? 3B ?? 0F 86)
// raw AOB: CC CC CC CC CC 48 89 5C 24 08 48 89 74 24 10 48 89 7C 24 18 41 56 48 83 EC 20 4D 8B F1 49 8B F0 48 8B FA 48 8B D9 E8 ?? ?? ?? ?? 80 78 11 02 0F 85 ?? ?? ?? ?? 48 8B 43 38 48 3B F0 0F 86 ?? ?? ?? ?? 80 7B 53 00 0F 8F ?? ?? ?? ?? 4C 8B 4B 08 4C 8B 53 28 4D 3B CA 7F ?? 48 3B 73 40 E9 ?? ?? ?? ?? 90 F2 0F 10 0D ?? ?? ?? ?? 0F 57 D2 F2 48 0F 2A 53 10 48 8B 53 40
// injection point AOB: 0F 85 ?? ?? ?? ?? ?? 8B ?? 38 ?? 3B ?? 0F 86 ?? ?? ?? ?? 80 ?? 53 00 0F 8F ?? ?? ?? ?? ?? 8B ?? 08 ?? 8B ?? 28 ?? 3B ?? 7F ?? ?? 3B ?? 40 E9 ?? ?? ?? ?? 90 F2 0F 10 ?? ?? ?? ?? ?? 0F 57 ?? F2 ?? 0F 2A ?? 10 ?? 8B ?? 40
alloc(newmem,$1000,INJECT_GET_HP_1_3)
alloc(INJECT_GET_HP_1_3o, $6)
label(code)
label(return)
label(i_base_hp_addr_1 i_base_hp_addr_1_2)
INJECT_GET_HP_1_3o:
readmem(INJECT_GET_HP_1_3, 6)
newmem:
jne save_address_1
jmp code
save_address_1:
pushfq
cmp qword ptr [i_base_hp_addr_1], rbx
je short endp
cmp qword ptr [i_base_hp_addr_1_2], rbx
je short endp
cmp qword ptr [i_base_hp_addr_1], 0
jne write_2
mov [i_base_hp_addr_1], rbx // rbx+08 = HP
jmp short endp
write_2:
cmp qword ptr [i_base_hp_addr_1_2], 0
jne short endp
mov [i_base_hp_addr_1_2], rbx // rbx+08 = HP
endp:
popfq
code:
// jne CrimsonDesert.exe+12BDB64
reassemble(INJECT_GET_HP_1_3)
jmp return
align 10 cc
i_base_hp_addr_1:
dq 0
i_base_hp_addr_1_2:
dq 0
INJECT_GET_HP_1_3:
jmp newmem
nop 1
return:
registersymbol(INJECT_GET_HP_1_3 INJECT_GET_HP_1_3o)
registersymbol(i_base_hp_addr_1 i_base_hp_addr_1_2)
[DISABLE]
INJECT_GET_HP_1_3:
readmem(INJECT_GET_HP_1_3o, 6)
unregistersymbol(INJECT_GET_HP_1_3 INJECT_GET_HP_1_3o)
unregistersymbol(i_base_hp_addr_1 i_base_hp_addr_1_2)
dealloc(newmem)
dealloc(INJECT_GET_HP_1_3o)
{
// ORIGINAL CODE - INJECTION POINT: CrimsonDesert.exe+12BDA5A
CrimsonDesert.exe+12BDA2B: CC - int 3
CrimsonDesert.exe+12BDA2C: CC - int 3
CrimsonDesert.exe+12BDA2D: CC - int 3
CrimsonDesert.exe+12BDA2E: CC - int 3
CrimsonDesert.exe+12BDA2F: CC - int 3
CrimsonDesert.exe+12BDA30: 48 89 5C 24 08 - mov [rsp+08],rbx
CrimsonDesert.exe+12BDA35: 48 89 74 24 10 - mov [rsp+10],rsi
CrimsonDesert.exe+12BDA3A: 48 89 7C 24 18 - mov [rsp+18],rdi
CrimsonDesert.exe+12BDA3F: 41 56 - push r14
CrimsonDesert.exe+12BDA41: 48 83 EC 20 - sub rsp,20
CrimsonDesert.exe+12BDA45: 4D 8B F1 - mov r14,r9
CrimsonDesert.exe+12BDA48: 49 8B F0 - mov rsi,r8
CrimsonDesert.exe+12BDA4B: 48 8B FA - mov rdi,rdx
CrimsonDesert.exe+12BDA4E: 48 8B D9 - mov rbx,rcx
CrimsonDesert.exe+12BDA51: E8 6A 35 14 FF - call CrimsonDesert.exe+400FC0
CrimsonDesert.exe+12BDA56: 80 78 11 02 - cmp byte ptr [rax+11],02
// ---------- INJECTING HERE ----------
CrimsonDesert.exe+12BDA5A: 0F 85 04 01 00 00 - jne CrimsonDesert.exe+12BDB64
// ---------- DONE INJECTING ----------
CrimsonDesert.exe+12BDA60: 48 8B 43 38 - mov rax,[rbx+38]
CrimsonDesert.exe+12BDA64: 48 3B F0 - cmp rsi,rax
CrimsonDesert.exe+12BDA67: 0F 86 F7 00 00 00 - jbe CrimsonDesert.exe+12BDB64
CrimsonDesert.exe+12BDA6D: 80 7B 53 00 - cmp byte ptr [rbx+53],00
CrimsonDesert.exe+12BDA71: 0F 8F ED 00 00 00 - jg CrimsonDesert.exe+12BDB64
CrimsonDesert.exe+12BDA77: 4C 8B 4B 08 - mov r9,[rbx+08]
CrimsonDesert.exe+12BDA7B: 4C 8B 53 28 - mov r10,[rbx+28]
CrimsonDesert.exe+12BDA7F: 4D 3B CA - cmp r9,r10
CrimsonDesert.exe+12BDA82: 7F 0A - jg CrimsonDesert.exe+12BDA8E
CrimsonDesert.exe+12BDA84: 48 3B 73 40 - cmp rsi,[rbx+40]
INJECT_GET_HP_1: E9 73 25 D3 FE - jmp 13FFF0000
CrimsonDesert.exe+12BDA8D: 90 - nop
CrimsonDesert.exe+12BDA8E: F2 0F 10 0D A2 B2 B1 03 - movsd xmm1,[CrimsonDesert.exe+4DD8D38]
CrimsonDesert.exe+12BDA96: 0F 57 D2 - xorps xmm2,xmm2
CrimsonDesert.exe+12BDA99: F2 48 0F 2A 53 10 - cvtsi2sd xmm2,[rbx+10]
CrimsonDesert.exe+12BDA9F: 48 8B 53 40 - mov rdx,[rbx+40]
}
34
"HP #1a (char tab)"
0
FF8080
8 Bytes
i_base_hp_addr_1
8
45
"Sta #1a (char tab)"
0
FF8080
8 Bytes
i_base_hp_addr_1
488
57
"HP #1b (horse tab)"
0
FF8080
8 Bytes
i_base_hp_addr_1_2
8
58
"Sta #1b (horse tab)"
0
FF8080
8 Bytes
i_base_hp_addr_1_2
488
38
"+Step 2 Usage: open item menu"
8000FF
1
39
"Enable step 2 (char tab)"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/03/20
}
[ENABLE]
aobscanmodule(INJECT_GET_HP_2,$process,?? 8B ?? 08 ?? 0F B7 ?? ?? 8B ?? E8 ?? ?? ?? ?? ?? 85)
// raw AOB: 32 C0 48 8B 9C 24 30 03 00 00 48 81 C4 E0 02 00 00 41 5F 41 5E 41 5D 41 5C 5F 5E 5D C3 0F B6 80 6A 02 00 00 88 44 24 44 0F B7 D3 49 8B CD E8 ?? ?? ?? ?? 48 8B 70 08 41 0F B7 D6 49 8B CD E8 ?? ?? ?? ?? 48 85 F6 7F ?? 48 85 FF 79 ?? B0 01 EB ?? 32 C0 4C 8D 7C 24 4C 48 8D 4C 24 48 84 C0 4C 0F 44 F9 0F B7 D3 49 8B CD E8
// injection point AOB: ?? 8B ?? 08 ?? 0F B7 ?? ?? 8B ?? E8 ?? ?? ?? ?? ?? 85 ?? 7F ?? ?? 85 ?? 79 ?? ?? 01 EB ?? 32 ?? ?? 8D ?? 24 ?? ?? 8D ?? 24 ?? 84 ?? ?? 0F 44 ?? 0F B7 ?? ?? 8B ?? E8
alloc(newmem,$1000,INJECT_GET_HP_2)
alloc(INJECT_GET_HP_2o, $8)
label(code)
label(return)
label(i_base_hp_addr_2)
INJECT_GET_HP_2o:
readmem(INJECT_GET_HP_2, 8)
newmem:
cmp qword ptr [i_base_hp_addr_2], 0
jne code
mov [i_base_hp_addr_2], rax
code:
// mov rsi,[rax+08]
reassemble(INJECT_GET_HP_2)
// movzx edx,r14w
reassemble(INJECT_GET_HP_2+4)
jmp return
align 10 cc
i_base_hp_addr_2:
dq 0
INJECT_GET_HP_2:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_HP_2 INJECT_GET_HP_2o)
registersymbol(i_base_hp_addr_2)
[DISABLE]
INJECT_GET_HP_2:
readmem(INJECT_GET_HP_2o, 8)
unregistersymbol(INJECT_GET_HP_2 INJECT_GET_HP_2o)
unregistersymbol(i_base_hp_addr_2)
dealloc(newmem)
dealloc(INJECT_GET_HP_2o)
{
// ORIGINAL CODE - INJECTION POINT: CrimsonDesert.exe+12B6B5E
CrimsonDesert.exe+12B6B2B: 32 C0 - xor al,al
CrimsonDesert.exe+12B6B2D: 48 8B 9C 24 30 03 00 00 - mov rbx,[rsp+00000330]
CrimsonDesert.exe+12B6B35: 48 81 C4 E0 02 00 00 - add rsp,000002E0
CrimsonDesert.exe+12B6B3C: 41 5F - pop r15
CrimsonDesert.exe+12B6B3E: 41 5E - pop r14
CrimsonDesert.exe+12B6B40: 41 5D - pop r13
CrimsonDesert.exe+12B6B42: 41 5C - pop r12
CrimsonDesert.exe+12B6B44: 5F - pop rdi
CrimsonDesert.exe+12B6B45: 5E - pop rsi
CrimsonDesert.exe+12B6B46: 5D - pop rbp
CrimsonDesert.exe+12B6B47: C3 - ret
CrimsonDesert.exe+12B6B48: 0F B6 80 6A 02 00 00 - movzx eax,byte ptr [rax+0000026A]
CrimsonDesert.exe+12B6B4F: 88 44 24 44 - mov [rsp+44],al
CrimsonDesert.exe+12B6B53: 0F B7 D3 - movzx edx,bx
CrimsonDesert.exe+12B6B56: 49 8B CD - mov rcx,r13
CrimsonDesert.exe+12B6B59: E8 92 18 00 00 - call CrimsonDesert.exe+12B83F0
// ---------- INJECTING HERE ----------
CrimsonDesert.exe+12B6B5E: 48 8B 70 08 - mov rsi,[rax+08]
// ---------- DONE INJECTING ----------
CrimsonDesert.exe+12B6B62: 41 0F B7 D6 - movzx edx,r14w
CrimsonDesert.exe+12B6B66: 49 8B CD - mov rcx,r13
CrimsonDesert.exe+12B6B69: E8 82 18 00 00 - call CrimsonDesert.exe+12B83F0
CrimsonDesert.exe+12B6B6E: 48 85 F6 - test rsi,rsi
CrimsonDesert.exe+12B6B71: 7F 09 - jg CrimsonDesert.exe+12B6B7C
CrimsonDesert.exe+12B6B73: 48 85 FF - test rdi,rdi
CrimsonDesert.exe+12B6B76: 79 04 - jns CrimsonDesert.exe+12B6B7C
CrimsonDesert.exe+12B6B78: B0 01 - mov al,01
CrimsonDesert.exe+12B6B7A: EB 02 - jmp CrimsonDesert.exe+12B6B7E
CrimsonDesert.exe+12B6B7C: 32 C0 - xor al,al
CrimsonDesert.exe+12B6B7E: 4C 8D 7C 24 4C - lea r15,[rsp+4C]
CrimsonDesert.exe+12B6B83: 48 8D 4C 24 48 - lea rcx,[rsp+48]
CrimsonDesert.exe+12B6B88: 84 C0 - test al,al
CrimsonDesert.exe+12B6B8A: 4C 0F 44 F9 - cmove r15,rcx
CrimsonDesert.exe+12B6B8E: 0F B7 D3 - movzx edx,bx
CrimsonDesert.exe+12B6B91: 49 8B CD - mov rcx,r13
}
63
"Use item to recover HP even HP is full"
8000FF
1
40
"HP #2a"
0
FF8080
8 Bytes
i_base_hp_addr_2
8
46
"Sta #2a"
0
FF8080
8 Bytes
i_base_hp_addr_2
488
59
"Enable step 2 (horse tab)"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/03/21
}
[ENABLE]
aobscanmodule(INJECT_GET_HP_2_2,$process,?? 89 ?? 08 ?? 8B ?? 24 ?? ?? 89 ?? 38 66)
// raw AOB: 4C 8D 4C 24 58 49 89 F0 48 8D 54 24 40 48 89 F9 E8 ?? ?? ?? ?? 48 8B 4F 30 48 39 08 7C ?? C6 47 52 00 31 D2 48 89 D8 48 2B 47 18 48 39 5F 18 48 0F 4F C2 48 89 47 20 48 FF 47 48 48 89 5F 08 48 8B 5C 24 48 48 89 77 38 66 89 6F 50 48 83 C4 20 5F 5E 5D C3 CC 14 EA 4B E3 ?? 8B 04 24 48 83 C4 08 9D E9 ?? ?? ?? ?? 41 54 29 D2
// injection point AOB: ?? 89 ?? 08 ?? 8B ?? 24 ?? ?? 89 ?? 38 66 89 ?? 50 48 83 C4 20 ?? ?? 5D C3 CC 14 EA 4B E3 ?? 8B ?? 24 48 83 C4 08 9D E9 ?? ?? ?? ?? ?? ?? 29
alloc(newmem,$1000,INJECT_GET_HP_2_2)
alloc(INJECT_GET_HP_2_2o, $9)
label(code)
label(return)
label(i_base_hp_addr_2_2)
INJECT_GET_HP_2_2o:
readmem(INJECT_GET_HP_2_2, 9)
newmem:
cmp qword ptr [i_base_hp_addr_2_2], 0
jne short code
mov [i_base_hp_addr_2_2], rdi
code:
// mov [rdi+08],rbx
reassemble(INJECT_GET_HP_2_2)
// mov rbx,[rsp+48]
reassemble(INJECT_GET_HP_2_2+4)
jmp return
align 10 cc
i_base_hp_addr_2_2:
dq 0
INJECT_GET_HP_2_2:
jmp newmem
nop 4
return:
registersymbol(INJECT_GET_HP_2_2 INJECT_GET_HP_2_2o i_base_hp_addr_2_2)
[DISABLE]
INJECT_GET_HP_2_2:
readmem(INJECT_GET_HP_2_2o, 9)
unregistersymbol(INJECT_GET_HP_2_2 INJECT_GET_HP_2_2o i_base_hp_addr_2_2)
dealloc(newmem)
dealloc(INJECT_GET_HP_2_2o)
{
// ORIGINAL CODE - INJECTION POINT: CrimsonDesert.exe+C791503
CrimsonDesert.exe+C7914C8: 4C 8D 4C 24 58 - lea r9,[rsp+58]
CrimsonDesert.exe+C7914CD: 49 89 F0 - mov r8,rsi
CrimsonDesert.exe+C7914D0: 48 8D 54 24 40 - lea rdx,[rsp+40]
CrimsonDesert.exe+C7914D5: 48 89 F9 - mov rcx,rdi
CrimsonDesert.exe+C7914D8: E8 53 C5 B2 F4 - call CrimsonDesert.exe+12BDA30
CrimsonDesert.exe+C7914DD: 48 8B 4F 30 - mov rcx,[rdi+30]
CrimsonDesert.exe+C7914E1: 48 39 08 - cmp [rax],rcx
CrimsonDesert.exe+C7914E4: 7C 04 - jl CrimsonDesert.exe+C7914EA
CrimsonDesert.exe+C7914E6: C6 47 52 00 - mov byte ptr [rdi+52],00
CrimsonDesert.exe+C7914EA: 31 D2 - xor edx,edx
CrimsonDesert.exe+C7914EC: 48 89 D8 - mov rax,rbx
CrimsonDesert.exe+C7914EF: 48 2B 47 18 - sub rax,[rdi+18]
CrimsonDesert.exe+C7914F3: 48 39 5F 18 - cmp [rdi+18],rbx
CrimsonDesert.exe+C7914F7: 48 0F 4F C2 - cmovg rax,rdx
CrimsonDesert.exe+C7914FB: 48 89 47 20 - mov [rdi+20],rax
CrimsonDesert.exe+C7914FF: 48 FF 47 48 - inc qword ptr [rdi+48]
// ---------- INJECTING HERE ----------
CrimsonDesert.exe+C791503: 48 89 5F 08 - mov [rdi+08],rbx
// ---------- DONE INJECTING ----------
CrimsonDesert.exe+C791507: 48 8B 5C 24 48 - mov rbx,[rsp+48]
CrimsonDesert.exe+C79150C: 48 89 77 38 - mov [rdi+38],rsi
CrimsonDesert.exe+C791510: 66 89 6F 50 - mov [rdi+50],bp
CrimsonDesert.exe+C791514: 48 83 C4 20 - add rsp,20
CrimsonDesert.exe+C791518: 5F - pop rdi
CrimsonDesert.exe+C791519: 5E - pop rsi
CrimsonDesert.exe+C79151A: 5D - pop rbp
CrimsonDesert.exe+C79151B: C3 - ret
CrimsonDesert.exe+C79151C: CC - int 3
CrimsonDesert.exe+C79151D: 14 EA - adc al,-16
CrimsonDesert.exe+C79151F: 4B E3 48 - jecxz CrimsonDesert.exe+C79156A
CrimsonDesert.exe+C791522: 8B 04 24 - mov eax,[rsp]
CrimsonDesert.exe+C791525: 48 83 C4 08 - add rsp,08
CrimsonDesert.exe+C791529: 9D - popfq
CrimsonDesert.exe+C79152A: E9 6C 5C 20 FC - jmp CrimsonDesert.exe+899719B
CrimsonDesert.exe+C79152F: 41 54 - push r12
}
61
"**Bypass this if you think it's too complex**"
D500D5
1
64
"Unequip -> equip saddle (trigger horse HP change)"
8000FF
1
60
"HP #2b"
0
FF8080
8 Bytes
i_base_hp_addr_2_2
8
62
"Sta #2b"
0
FF8080
8 Bytes
i_base_hp_addr_2_2
488
1337211261
"Get HP - Pointer map mode"
1
1337211240
"Get HP #1 - Pointer map"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not AOBScanModule then
function AOBScanModule(moduleName, signature)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then return nil end
local ms = createMemScan()
synchronize(function()
ms.firstScan(soExactValue, vtByteArray, nil, signature,
nil, baseAddr, maxAddr, '+X-C-W', fsmNotAligned, '1', true, true, false, false)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
results.destroy()
ms.destroy()
return addr
end
end
local AOBs = {
{name='Player_Base', aob='?? 89 ?? ?? ?? ?? ?? ?? 8D ?? 00 01 00 00 ?? 89 ?? ?? ?? ?? ?? ?? 8D ?? A0 01 00 00', pos=3, aoblen=7, symbol='Player_Base_addr'},
}
local module_name = process
for _, entry in ipairs(AOBs) do
local aob_addr_str = AOBScanModule(module_name, entry.aob)
if aob_addr_str then
local aob_addr_val = tonumber(aob_addr_str, 16)
local offset_addr = aob_addr_val + entry.pos
local relative_offset = readInteger(offset_addr, true)
local final_addr = relative_offset + aob_addr_val + entry.aoblen
synchronize(function()
unregisterSymbol(entry.symbol)
registerSymbol(entry.symbol, final_addr)
end)
print(string.format('[SymbolScanner] %s registered at: %X', entry.name, final_addr))
else
print(string.format('[SymbolScanner] WARNING: AOB scan failed for %s', entry.name))
end
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
unregisterSymbol('Player_Base_addr')
{$asm}
1337211314
"Char #1 - Kliff"
1
1337211319
"HP #1.1 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
8
58
18
20
68
D0
28
1337211320
"Sta #1.1 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
488
58
18
20
68
D0
28
1337211321
"Spi #1.1 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
518
58
18
20
68
D0
28
1337211316
"Char #2 - Damine"
1
1337211313
"HP #1.2 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
8
58
18
20
68
D8
28
1337211317
"Sta #1.2 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
488
58
18
20
68
D8
28
1337211318
"Spi #1.2 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
518
58
18
20
68
D8
28
1337211325
"Char #3 - Oongka?"
1
1337211326
"HP #1.3 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
8
58
18
20
68
E0
28
1337211327
"Sta #1.3 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
488
58
18
20
68
E0
28
1337211328
"Spi #1.3 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
518
58
18
20
68
E0
28
1337211315
"Bag"
1
1337211238
"Used slots (read only)"
0
FF8080
2 Bytes
Player_Base_addr
12
8
18
B8
68
20
1337211264
"Bag slots (read only)"
0
FF8080
2 Bytes
Player_Base_addr
14
8
18
B8
68
20
1337211262
"Bonus Slots (max 190)"
0
FF8080
2 Bytes
Player_Base_addr
16
8
18
B8
68
20
1337211322
"Used slots (read only) path #2"
0
FF8080
2 Bytes
Player_Base_addr
12
8
18
B8
68
D0
28
1337211323
"Bag slots (read only) Path #2"
0
FF8080
2 Bytes
Player_Base_addr
14
8
18
B8
68
D0
28
1337211324
"Bonus Slots (max 190) Path #2"
0
FF8080
2 Bytes
Player_Base_addr
16
8
18
B8
68
D0
28
1337211258
"Get HP #2 - Pointer map"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not AOBScanModule then
function AOBScanModule(moduleName, signature)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then return nil end
local ms = createMemScan()
synchronize(function()
ms.firstScan(soExactValue, vtByteArray, nil, signature,
nil, baseAddr, maxAddr, '+X-C-W', fsmNotAligned, '1', true, true, false, false)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
results.destroy()
ms.destroy()
return addr
end
end
local AOBs = {
{name='Play_Base2', aob='?? 8B ?? ?? ?? ?? ?? ?? 89 ?? 24 ?? ?? 0F B6 ?? ?? E8 ?? ?? ?? ?? ?? 8B ?? F8 00 00 00 ?? 8B ?? 00 01 00 00', pos=3, aoblen=7, symbol='Play_Base2_addr'},
}
local module_name = process
for _, entry in ipairs(AOBs) do
local aob_addr_str = AOBScanModule(module_name, entry.aob)
if aob_addr_str then
local aob_addr_val = tonumber(aob_addr_str, 16)
local offset_addr = aob_addr_val + entry.pos
local relative_offset = readInteger(offset_addr, true)
local final_addr = relative_offset + aob_addr_val + entry.aoblen
synchronize(function()
unregisterSymbol(entry.symbol)
registerSymbol(entry.symbol, final_addr)
end)
print(string.format('[SymbolScanner] %s registered at: %X', entry.name, final_addr))
else
print(string.format('[SymbolScanner] WARNING: AOB scan failed for %s', entry.name))
end
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
unregisterSymbol('Play_Base2_addr')
{$asm}
1337211331
"Char #1 - Kliff"
1
1337211290
"Auto fill HP (only when HP1/2 pointer map enabled)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if hpRefillTimer1 then
hpRefillTimer1.destroy()
hpRefillTimer1 = nil
end
-- 快取上次註冊的地址
lastRegistered1_1 = nil
lastRegistered1_2 = nil
hpRefillTimer1 = createTimer(nil, false)
hpRefillTimer1.Interval = 300
hpRefillTimer1.OnTimer = function(t)
local al = getAddressList()
local mr1 = al.getMemoryRecordByDescription('HP #1.1 (ptr map)')
local mr2 = al.getMemoryRecordByDescription('HP #2.1 (ptr map)')
if mr1 == nil or mr2 == nil then return end
local addr1 = mr1.CurrentAddress
local addr2 = mr2.CurrentAddress
if addr1 == nil or addr2 == nil then return end
local resolved1 = getAddress(addr1)
local resolved2 = getAddress(addr2)
if resolved1 == 0 or resolved2 == 0 then return end
local maxHP = readQword(resolved1 + 0x10)
if maxHP == nil or maxHP == 0 then return end
writeQword(resolved1, maxHP)
writeQword(resolved2, maxHP)
-- 地址有變動時才重新註冊
if resolved1 ~= lastRegistered1_1 then
registerSymbol('char_hp_ptr_1_1', resolved1, true)
lastRegistered1_1 = resolved1
end
if resolved2 ~= lastRegistered1_2 then
registerSymbol('char_hp_ptr_1_2', resolved2, true)
lastRegistered1_2 = resolved2
end
end
hpRefillTimer1.Enabled = true
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
if hpRefillTimer1 then
hpRefillTimer1.Enabled = false
hpRefillTimer1.destroy()
hpRefillTimer1 = nil
end
lastRegistered1_1 = nil
lastRegistered1_2 = nil
unregisterSymbol('char_hp_ptr_1_1')
unregisterSymbol('char_hp_ptr_1_2')
{$asm}
1337211303
"HP1"
0
FF8080
8 Bytes
char_hp_ptr_1_1
1337211304
"HP2"
0
FF8080
8 Bytes
char_hp_ptr_1_2
1337211291
"Auto fill Sta (only when Sta1/2 pointer map enabled)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if staRefillTimer1 then
staRefillTimer1.destroy()
staRefillTimer1 = nil
end
lastStaRegistered1_1 = nil
lastStaRegistered1_2 = nil
staRefillTimer1 = createTimer(nil, false)
staRefillTimer1.Interval = 300
staRefillTimer1.OnTimer = function(t)
local al = getAddressList()
local mr1 = al.getMemoryRecordByDescription('Sta #1.1 (ptr map)')
local mr2 = al.getMemoryRecordByDescription('Sta #2.1 (ptr map)')
if mr1 == nil or mr2 == nil then return end
local addr1 = mr1.CurrentAddress
local addr2 = mr2.CurrentAddress
if addr1 == nil or addr2 == nil then return end
local resolved1 = getAddress(addr1)
local resolved2 = getAddress(addr2)
if resolved1 == 0 or resolved2 == 0 then return end
local maxSta = readQword(resolved1 + 0x10)
if maxSta == nil or maxSta == 0 then return end
writeQword(resolved1, maxSta)
writeQword(resolved2, maxSta)
if resolved1 ~= lastStaRegistered1_1 then
registerSymbol('char_sta_ptr_1_1', resolved1, true)
lastStaRegistered1_1 = resolved1
end
if resolved2 ~= lastStaRegistered1_2 then
registerSymbol('char_sta_ptr_1_2', resolved2, true)
lastStaRegistered1_2 = resolved2
end
end
staRefillTimer1.Enabled = true
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
if staRefillTimer1 then
staRefillTimer1.Enabled = false
staRefillTimer1.destroy()
staRefillTimer1 = nil
end
lastStaRegistered1_1 = nil
lastStaRegistered1_2 = nil
unregisterSymbol('char_sta_ptr_1_1')
unregisterSymbol('char_sta_ptr_1_2')
{$asm}
1337211305
"Sta1"
0
FF8080
8 Bytes
char_sta_ptr_1_1
1337211306
"Sta2"
0
FF8080
8 Bytes
char_sta_ptr_1_2
1337211253
"HP #2.1 (ptr map)"
0
FF8080
8 Bytes
Play_Base2_addr
8
58
18
20
68
D0
A0
18
1337211267
"Sta #2.1 (ptr map)"
0
FF8080
8 Bytes
Play_Base2_addr
488
58
18
20
68
D0
A0
18
1337211268
"Spi #2.1 (ptr map)"
0
FF8080
8 Bytes
Play_Base2_addr
518
58
18
20
68
D0
A0
18
1337211332
"Char #2 - Damine"
1
1337211342
"Auto fill HP (only when HP1/2 pointer map enabled)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if hpRefillTimer2 then
hpRefillTimer2.destroy()
hpRefillTimer2 = nil
end
-- 快取上次註冊的地址
lastRegistered2_1 = nil
lastRegistered2_2 = nil
hpRefillTimer2 = createTimer(nil, false)
hpRefillTimer2.Interval = 300
hpRefillTimer2.OnTimer = function(t)
local al = getAddressList()
local mr1 = al.getMemoryRecordByDescription('HP #1.2 (ptr map)')
local mr2 = al.getMemoryRecordByDescription('HP #2.2 (ptr map)')
if mr1 == nil or mr2 == nil then return end
local addr1 = mr1.CurrentAddress
local addr2 = mr2.CurrentAddress
if addr1 == nil or addr2 == nil then return end
local resolved1 = getAddress(addr1)
local resolved2 = getAddress(addr2)
if resolved1 == 0 or resolved2 == 0 then return end
local maxHP = readQword(resolved1 + 0x10)
if maxHP == nil or maxHP == 0 then return end
writeQword(resolved1, maxHP)
writeQword(resolved2, maxHP)
-- 地址有變動時才重新註冊
if resolved1 ~= lastRegistered2_1 then
registerSymbol('char_hp_ptr_2_1', resolved1, true)
lastRegistered2_1 = resolved1
end
if resolved2 ~= lastRegistered2_2 then
registerSymbol('char_hp_ptr_2_2', resolved2, true)
lastRegistered2_2 = resolved2
end
end
hpRefillTimer2.Enabled = true
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
if hpRefillTimer2 then
hpRefillTimer2.Enabled = false
hpRefillTimer2.destroy()
hpRefillTimer2 = nil
end
lastRegistered2_1 = nil
lastRegistered2_2 = nil
unregisterSymbol('char_hp_ptr_2_1')
unregisterSymbol('char_hp_ptr_2_2')
{$asm}
1337211343
"HP1"
0
FF8080
8 Bytes
char_hp_ptr_2_1
1337211344
"HP2"
0
FF8080
8 Bytes
char_hp_ptr_2_2
1337211348
"Auto fill Sta (only when Sta1/2 pointer map enabled)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if staRefillTimer2 then
staRefillTimer2.destroy()
staRefillTimer2 = nil
end
lastStaRegistered2_1 = nil
lastStaRegistered2_2 = nil
staRefillTimer2 = createTimer(nil, false)
staRefillTimer2.Interval = 300
staRefillTimer2.OnTimer = function(t)
local al = getAddressList()
local mr1 = al.getMemoryRecordByDescription('Sta #1.2 (ptr map)')
local mr2 = al.getMemoryRecordByDescription('Sta #2.2 (ptr map)')
if mr1 == nil or mr2 == nil then return end
local addr1 = mr1.CurrentAddress
local addr2 = mr2.CurrentAddress
if addr1 == nil or addr2 == nil then return end
local resolved1 = getAddress(addr1)
local resolved2 = getAddress(addr2)
if resolved1 == 0 or resolved2 == 0 then return end
local maxSta = readQword(resolved1 + 0x10)
if maxSta == nil or maxSta == 0 then return end
writeQword(resolved1, maxSta)
writeQword(resolved2, maxSta)
if resolved1 ~= lastStaRegistered2_1 then
registerSymbol('char_sta_ptr_2_1', resolved1, true)
lastStaRegistered2_1 = resolved1
end
if resolved2 ~= lastStaRegistered2_2 then
registerSymbol('char_sta_ptr_2_2', resolved2, true)
lastStaRegistered2_2 = resolved2
end
end
staRefillTimer2.Enabled = true
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
if staRefillTimer2 then
staRefillTimer2.Enabled = false
staRefillTimer2.destroy()
staRefillTimer2 = nil
end
lastStaRegistered2_1 = nil
lastStaRegistered2_2 = nil
unregisterSymbol('char_sta_ptr_2_1')
unregisterSymbol('char_sta_ptr_2_2')
{$asm}
1337211349
"Sta1"
0
FF8080
8 Bytes
char_sta_ptr_2_1
1337211350
"Sta2"
0
FF8080
8 Bytes
char_sta_ptr_2_2
1337211333
"HP #2.2 (ptr map)"
0
FF8080
8 Bytes
Play_Base2_addr
8
58
18
20
68
D8
A0
18
1337211334
"Sta #2.2 (ptr map)"
0
FF8080
8 Bytes
Play_Base2_addr
488
58
18
20
68
D8
A0
18
1337211335
"Spi #2.2 (ptr map)"
0
FF8080
8 Bytes
Play_Base2_addr
518
58
18
20
68
D8
A0
18
1337211337
"Char #3 - Oongka?"
1
1337211345
"Auto fill HP (only when HP1/2 pointer map enabled)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if hpRefillTimer3 then
hpRefillTimer3.destroy()
hpRefillTimer3 = nil
end
-- 快取上次註冊的地址
lastRegistered3_1 = nil
lastRegistered3_2 = nil
hpRefillTimer3 = createTimer(nil, false)
hpRefillTimer3.Interval = 300
hpRefillTimer3.OnTimer = function(t)
local al = getAddressList()
local mr1 = al.getMemoryRecordByDescription('HP #1.3 (ptr map)')
local mr2 = al.getMemoryRecordByDescription('HP #2.3 (ptr map)')
if mr1 == nil or mr2 == nil then return end
local addr1 = mr1.CurrentAddress
local addr2 = mr2.CurrentAddress
if addr1 == nil or addr2 == nil then return end
local resolved1 = getAddress(addr1)
local resolved2 = getAddress(addr2)
if resolved1 == 0 or resolved2 == 0 then return end
local maxHP = readQword(resolved1 + 0x10)
if maxHP == nil or maxHP == 0 then return end
writeQword(resolved1, maxHP)
writeQword(resolved2, maxHP)
-- 地址有變動時才重新註冊
if resolved1 ~= lastRegistered3_1 then
registerSymbol('char_hp_ptr_3_1', resolved1, true)
lastRegistered3_1 = resolved1
end
if resolved2 ~= lastRegistered3_2 then
registerSymbol('char_hp_ptr_3_2', resolved2, true)
lastRegistered3_2 = resolved2
end
end
hpRefillTimer3.Enabled = true
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
if hpRefillTimer3 then
hpRefillTimer3.Enabled = false
hpRefillTimer3.destroy()
hpRefillTimer3 = nil
end
lastRegistered3_1 = nil
lastRegistered3_2 = nil
unregisterSymbol('char_hp_ptr_3_1')
unregisterSymbol('char_hp_ptr_3_2')
{$asm}
1337211346
"HP1"
0
FF8080
8 Bytes
char_hp_ptr_3_1
1337211347
"HP2"
0
FF8080
8 Bytes
char_hp_ptr_3_2
1337211351
"Auto fill Sta (only when Sta1/2 pointer map enabled)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if staRefillTimer3 then
staRefillTimer3.destroy()
staRefillTimer3 = nil
end
lastStaRegistered3_1 = nil
lastStaRegistered3_2 = nil
staRefillTimer3 = createTimer(nil, false)
staRefillTimer3.Interval = 300
staRefillTimer3.OnTimer = function(t)
local al = getAddressList()
local mr1 = al.getMemoryRecordByDescription('Sta #1.3 (ptr map)')
local mr2 = al.getMemoryRecordByDescription('Sta #2.3 (ptr map)')
if mr1 == nil or mr2 == nil then return end
local addr1 = mr1.CurrentAddress
local addr2 = mr2.CurrentAddress
if addr1 == nil or addr2 == nil then return end
local resolved1 = getAddress(addr1)
local resolved2 = getAddress(addr2)
if resolved1 == 0 or resolved2 == 0 then return end
local maxSta = readQword(resolved1 + 0x10)
if maxSta == nil or maxSta == 0 then return end
writeQword(resolved1, maxSta)
writeQword(resolved2, maxSta)
if resolved1 ~= lastStaRegistered3_1 then
registerSymbol('char_sta_ptr_3_1', resolved1, true)
lastStaRegistered3_1 = resolved1
end
if resolved2 ~= lastStaRegistered3_2 then
registerSymbol('char_sta_ptr_3_2', resolved2, true)
lastStaRegistered3_2 = resolved2
end
end
staRefillTimer3.Enabled = true
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
if staRefillTimer3 then
staRefillTimer3.Enabled = false
staRefillTimer3.destroy()
staRefillTimer3 = nil
end
lastStaRegistered3_1 = nil
lastStaRegistered3_2 = nil
unregisterSymbol('char_sta_ptr_3_1')
unregisterSymbol('char_sta_ptr_3_2')
{$asm}
1337211352
"Sta1"
0
FF8080
8 Bytes
char_sta_ptr_3_1
1337211353
"Sta2"
0
FF8080
8 Bytes
char_sta_ptr_3_2
1337211338
"HP #2.3 (ptr map)"
0
FF8080
8 Bytes
Play_Base2_addr
8
58
18
20
68
E0
A0
18
1337211339
"Sta #2.3 (ptr map)"
0
FF8080
8 Bytes
Play_Base2_addr
488
58
18
20
68
E0
A0
18
1337211340
"Spi #2.3 (ptr map)"
0
FF8080
8 Bytes
Play_Base2_addr
518
58
18
20
68
E0
A0
18
1337211365
"Horse"
1
1337211364
"Horse HP #2.1"
0
FF8080
4 Bytes
Play_Base2_addr
8
58
18
420
68
D0
A0
18
1337211366
"Horse Sta #2.1"
0
FF8080
4 Bytes
Play_Base2_addr
488
58
18
420
68
D0
A0
18
1337211336
"Bag"
1
1337211278
"Used slots (read only)"
0
FF8080
2 Bytes
Play_Base2_addr
12
8
18
B8
68
D0
A0
18
1337211280
"Bag slots (read only)"
0
FF8080
2 Bytes
Play_Base2_addr
14
8
18
B8
68
D0
A0
18
1337211279
"Bag bonus"
0
FF8080
2 Bytes
Play_Base2_addr
16
8
18
B8
68
D0
A0
18
47
"Crimson Desert / https://opencheattables.com / CE 7.6+"
008E00
1
49
"YesNo"
0:No
1:Yes
1
1337211241
"Player_Base_alt1"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not AOBScanModule then
function AOBScanModule(moduleName, signature)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then return nil end
local ms = createMemScan()
synchronize(function()
ms.firstScan(soExactValue, vtByteArray, nil, signature,
nil, baseAddr, maxAddr, '+X-C-W', fsmNotAligned, '1', true, true, false, false)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
results.destroy()
ms.destroy()
return addr
end
end
local AOBs = {
{name='Player_Base_alt1', aob='?? 8D ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? 00 00 E8 ?? ?? ?? ?? 90 C6 ?? ?? 00 0F 57 ?? 33 ?? 0F 11', pos=3, aoblen=7, symbol='Player_Base_alt1_addr'},
}
local module_name = process
for _, entry in ipairs(AOBs) do
local aob_addr_str = AOBScanModule(module_name, entry.aob)
if aob_addr_str then
local aob_addr_val = tonumber(aob_addr_str, 16)
local offset_addr = aob_addr_val + entry.pos
local relative_offset = readInteger(offset_addr, true)
local final_addr = relative_offset + aob_addr_val + entry.aoblen
synchronize(function()
unregisterSymbol(entry.symbol)
registerSymbol(entry.symbol, final_addr)
end)
print(string.format('[SymbolScanner] %s registered at: %X', entry.name, final_addr))
else
print(string.format('[SymbolScanner] WARNING: AOB scan failed for %s', entry.name))
end
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
unregisterSymbol('Player_Base_alt1_addr')
{$asm}
1337211281
"INJECT_GET_BAG_BONUS_SLOTS_2_AOB"
Auto Assembler Script
{ Game : CrimsonDesert.exe
Version:
Date : 2026-03-22
Author : Andyc
Description :
<Optional info>
}
[ENABLE]
aobscanmodule(INJECT_GET_BAG_BONUS_SLOTS_2_AOB,CrimsonDesert.exe,0F B7 46 16 66 89 45 9A) // should be unique
alloc(newmem,$1000,INJECT_GET_BAG_BONUS_SLOTS_2_AOB)
label(code)
label(return)
newmem:
code:
movzx eax,word ptr [rsi+16]
mov [rbp-66],ax
jmp return
INJECT_GET_BAG_BONUS_SLOTS_2_AOB:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_BAG_BONUS_SLOTS_2_AOB)
[DISABLE]
INJECT_GET_BAG_BONUS_SLOTS_2_AOB:
db 0F B7 46 16 66 89 45 9A
unregistersymbol(INJECT_GET_BAG_BONUS_SLOTS_2_AOB)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: CrimsonDesert.exe+1A9F798
CrimsonDesert.exe+1A9F76A: 48 8D 15 57 BE EA 02 - lea rdx,[CrimsonDesert.exe+494B5C8]
CrimsonDesert.exe+1A9F771: 48 8D 4D B8 - lea rcx,[rbp-48]
CrimsonDesert.exe+1A9F775: E8 D6 8E 41 FF - call CrimsonDesert.exe+EB8650
CrimsonDesert.exe+1A9F77A: 44 89 65 BC - mov [rbp-44],r12d
CrimsonDesert.exe+1A9F77E: 0F B7 46 10 - movzx eax,word ptr [rsi+10]
CrimsonDesert.exe+1A9F782: 66 89 44 24 30 - mov [rsp+30],ax
CrimsonDesert.exe+1A9F787: 48 8D 4C 24 30 - lea rcx,[rsp+30]
CrimsonDesert.exe+1A9F78C: E8 BF 89 A1 FE - call CrimsonDesert.exe+4B8150
CrimsonDesert.exe+1A9F791: 0F B7 08 - movzx ecx,word ptr [rax]
CrimsonDesert.exe+1A9F794: 66 89 4D 98 - mov [rbp-68],cx
// ---------- INJECTING HERE ----------
CrimsonDesert.exe+1A9F798: 0F B7 46 16 - movzx eax,word ptr [rsi+16]
// ---------- DONE INJECTING ----------
CrimsonDesert.exe+1A9F79C: 66 89 45 9A - mov [rbp-66],ax
CrimsonDesert.exe+1A9F7A0: 0F B7 FB - movzx edi,bx
CrimsonDesert.exe+1A9F7A3: 0F B7 46 0C - movzx eax,word ptr [rsi+0C]
CrimsonDesert.exe+1A9F7A7: 66 3B D8 - cmp bx,ax
CrimsonDesert.exe+1A9F7AA: 0F 8D 4D 01 00 00 - jnl CrimsonDesert.exe+1A9F8FD
CrimsonDesert.exe+1A9F7B0: 4C 8D 2D 81 AF C9 02 - lea r13,[CrimsonDesert.exe+473A738]
CrimsonDesert.exe+1A9F7B7: 4C 8D 3D EA 99 E1 02 - lea r15,[CrimsonDesert.exe+48B91A8]
CrimsonDesert.exe+1A9F7BE: 4C 8D 25 43 97 E1 02 - lea r12,[CrimsonDesert.exe+48B8F08]
CrimsonDesert.exe+1A9F7C5: 4C 8D 35 34 01 F5 02 - lea r14,[CrimsonDesert.exe+49EF900]
CrimsonDesert.exe+1A9F7CC: 66 3B C3 - cmp ax,bx
}
1337211341
"Kilff HP/Sta backup (old)"
1
1337211248
"(backup) HP #1 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
8
58
18
20
68
20
1337211259
"(backup) Sta #1 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
488
58
18
20
68
20
1337211265
"(backup) Spi #1 (ptr map)"
0
FF8080
8 Bytes
Player_Base_addr
518
58
18
20
68
20
Code :add [rbx+16],di
CrimsonDesert.exe+1D1A6E8
38
66
44
03
CF
66
01
7B
16
48
8B
C6
48
8B
Code :movzx eax,word ptr [rsi+16]
CrimsonDesert.exe+1A9F798
08
66
89
4D
98
0F
B7
46
16
66
89
45
9A
0F
For HP #1
`pa::ClientActorManager` -> 0x20 `Pointer to instance of pa::ClientChildOnlyInGameActor` -> 0x68 -> 0xB8 `Pointer to instance of pa::ClientInventoryActorComponent` -> 0x18 -> 0x8 -> 0x16, word = Bag Bonus
Also see:
0x14, word = Bag total
0x12, word = Bag used
`pa::ClientActorManager` -> 0x20 `Pointer to instance of pa::ClientChildOnlyInGameActor` -> 0x78 -> 0x20 `Pointer to instance of pa::ClientStatusActorComponent` -> 0x18 -> 0x58 -> 8 (HP #1)
For HP #2
[Player_Base2_Addr] -> 0x18 `Pointer to instance of pa::NwVirtualAsyncSession` -> 0xA0 `Pointer to instance of pa::ServerUserActor` -> 0xD0 `Pointer to instance of pa::ServerChildOnlyInGameActor` -> 0x68 -> 0x20 `Pointer to instance of pa::ServerStatusActorComponent` -> 0x18 -> 0x58 -> 8 (HP #2)
`pa::ClientActorManager` = Player_Base_addr
//
CrimsonDesert.exe+6B52E2 - 8F - db 8f
CrimsonDesert.exe+6B52E3 - 64 05 E8024760 - add eax,604702E8
CrimsonDesert.exe+6B52E9 - 03 EB - add ebp,ebx
CrimsonDesert.exe+6B52EB - 03 45 33 - add eax,[rbp+33]
CrimsonDesert.exe+6B52EE - ED - in eax,dx
// ---------- INJECTING HERE ----------
CrimsonDesert.exe+6B52EF - 48 89 35 3A8F6405 - mov [Player_Base_addr],rsi
// ---------- DONE INJECTING ----------
CrimsonDesert.exe+6B52F6 - 48 8D 86 00010000 - lea rax,[rsi+00000100]
CrimsonDesert.exe+6B52FD - 48 89 05 348F6405 - mov [CrimsonDesert.exe+5CFE238],rax
CrimsonDesert.exe+6B5304 - 48 8D 86 A0010000 - lea rax,[rsi+000001A0]
CrimsonDesert.exe+6B530B - 48 89 05 2E8F6405 - mov [CrimsonDesert.exe+5CFE240],rax
CrimsonDesert.exe+6B5312 - 44 0FB6 A5 C8020000 - movzx r12d,byte ptr [rbp+000002C8]
CrimsonDesert.exe+6B531A - 44 88 25 278F6405 - mov [CrimsonDesert.exe+5CFE248],r12b
CrimsonDesert.exe+6B5321 - 8B 3D A1564F05 - mov edi,[CrimsonDesert.exe+5BAA9C8]
CrimsonDesert.exe+6B5327 - 39 3D 2B8F6405 - cmp [CrimsonDesert.exe+5CFE258],edi
CrimsonDesert.exe+6B532D - 74 0E - je CrimsonDesert.exe+6B533D
CrimsonDesert.exe+6B532F - 8B D7 - mov edx,edi
CrimsonDesert.exe+6B5331 - 48 8D 0D 188F6405 - lea rcx,[CrimsonDesert.exe+5CFE250]
CrimsonDesert.exe+6B5338 - E8 D3800000 - call CrimsonDesert.exe+6BD410
CrimsonDesert.exe+6B533D - 39 3D 258F6405 - cmp [CrimsonDesert.exe+5CFE268],edi
CrimsonDesert.exe+6B5343 - 74 0E - je CrimsonDesert.exe+6B5353
CrimsonDesert.exe+6B5345 - 8B D7 - mov edx,edi
CrimsonDesert.exe+6B5347 - 48 8D 0D 128F6405 - lea rcx,[CrimsonDesert.exe+5CFE260]
CrimsonDesert.exe+6B534E - E8 BD800000 - call CrimsonDesert.exe+6BD410
CrimsonDesert.exe+6B5353 - 39 3D 1F8F6405 - cmp [CrimsonDesert.exe+5CFE278],edi
CrimsonDesert.exe+6B5359 - 74 0E - je CrimsonDesert.exe+6B5369
CrimsonDesert.exe+6B535B - 8B D7 - mov edx,edi
CrimsonDesert.exe+6B535D - 48 8D 0D 0C8F6405 - lea rcx,[CrimsonDesert.exe+5CFE270]
CrimsonDesert.exe+6B5364 - E8 A7800000 - call CrimsonDesert.exe+6BD410
CrimsonDesert.exe+6B5369 - 39 3D 198F6405 - cmp [CrimsonDesert.exe+5CFE288],edi
CrimsonDesert.exe+6B536F - 74 0E - je CrimsonDesert.exe+6B537F
CrimsonDesert.exe+6B5371 - 8B D7 - mov edx,edi
CrimsonDesert.exe+6B5373 - 48 8D 0D 068F6405 - lea rcx,[CrimsonDesert.exe+5CFE280]
CrimsonDesert.exe+6B537A - E8 B1890000 - call CrimsonDesert.exe+6BDD30
CrimsonDesert.exe+6B537F - 39 3D 138F6405 - cmp [CrimsonDesert.exe+5CFE298],edi
CrimsonDesert.exe+6B5385 - 74 0E - je CrimsonDesert.exe+6B5395
CrimsonDesert.exe+6B5387 - 8B D7 - mov edx,edi
CrimsonDesert.exe+6B5389 - 48 8D 0D 008F6405 - lea rcx,[CrimsonDesert.exe+5CFE290]
CrimsonDesert.exe+6B5390 - E8 7B800000 - call CrimsonDesert.exe+6BD410
CrimsonDesert.exe+6B5395 - 39 3D 0D8F6405 - cmp [CrimsonDesert.exe+5CFE2A8],edi
CrimsonDesert.exe+6B539B - 74 0E - je CrimsonDesert.exe+6B53AB
CrimsonDesert.exe+6B539D - 8B D7 - mov edx,edi
CrimsonDesert.exe+6B539F - 48 8D 0D FA8E6405 - lea rcx,[CrimsonDesert.exe+5CFE2A0]
CrimsonDesert.exe+6B53A6 - E8 65800000 - call CrimsonDesert.exe+6BD410
CrimsonDesert.exe+6B53AB - 39 3D 078F6405 - cmp [CrimsonDesert.exe+5CFE2B8],edi
CrimsonDesert.exe+6B53B1 - 74 0E - je CrimsonDesert.exe+6B53C1
CrimsonDesert.exe+6B53B3 - 8B D7 - mov edx,edi
CrimsonDesert.exe+6B53B5 - 48 8D 0D F48E6405 - lea rcx,[CrimsonDesert.exe+5CFE2B0]
CrimsonDesert.exe+6B53BC - E8 4F800000 - call CrimsonDesert.exe+6BD410
CrimsonDesert.exe+6B53C1 - 39 3D 018F6405 - cmp [CrimsonDesert.exe+5CFE2C8],edi
CrimsonDesert.exe+6B53C7 - 74 0E - je CrimsonDesert.exe+6B53D7
CrimsonDesert.exe+6B53C9 - 8B D7 - mov edx,edi
CrimsonDesert.exe+6B53CB - 48 8D 0D EE8E6405 - lea rcx,[CrimsonDesert.exe+5CFE2C0]
CrimsonDesert.exe+6B53D2 - E8 39800000 - call CrimsonDesert.exe+6BD410
CrimsonDesert.exe+6B53D7 - 85 FF - test edi,edi
CrimsonDesert.exe+6B53D9 - 74 77 - je CrimsonDesert.exe+6B5452
CrimsonDesert.exe+6B53DB - 49 8B DD - mov rbx,r13
CrimsonDesert.exe+6B53DE - 4D 8B F5 - mov r14,r13
CrimsonDesert.exe+6B53E1 - 48 8B 05 688E6405 - mov rax,[CrimsonDesert.exe+5CFE250]
CrimsonDesert.exe+6B53E8 - 44 89 6C 18 08 - mov [rax+rbx+08],r13d
CrimsonDesert.exe+6B53ED - 48 8B 05 6C8E6405 - mov rax,[CrimsonDesert.exe+5CFE260]
CrimsonDesert.exe+6B53F4 - 44 89 6C 18 08 - mov [rax+rbx+08],r13d
CrimsonDesert.exe+6B53F9 - 48 8B 05 708E6405 - mov rax,[CrimsonDesert.exe+5CFE270]
CrimsonDesert.exe+6B5400 - 44 89 6C 18 08 - mov [rax+rbx+08],r13d
CrimsonDesert.exe+6B5405 - 48 8B 0D 748E6405 - mov rcx,[CrimsonDesert.exe+5CFE280]
CrimsonDesert.exe+6B540C - 49 03 CE - add rcx,r14
CrimsonDesert.exe+6B540F - E8 0C29C6FF - call CrimsonDesert.exe+317D20
CrimsonDesert.exe+6B5414 - 48 8B 05 758E6405 - mov rax,[CrimsonDesert.exe+5CFE290]
CrimsonDesert.exe+6B541B - 44 89 6C 18 08 - mov [rax+rbx+08],r13d
CrimsonDesert.exe+6B5420 - 48 8B 05 798E6405 - mov rax,[CrimsonDesert.exe+5CFE2A0]
CrimsonDesert.exe+6B5427 - 44 89 6C 18 08 - mov [rax+rbx+08],r13d
CrimsonDesert.exe+6B542C - 48 8B 05 7D8E6405 - mov rax,[CrimsonDesert.exe+5CFE2B0]
CrimsonDesert.exe+6B5433 - 44 89 6C 18 08 - mov [rax+rbx+08],r13d
CrimsonDesert.exe+6B5438 - 48 8B 05 818E6405 - mov rax,[CrimsonDesert.exe+5CFE2C0]
CrimsonDesert.exe+6B543F - 44 89 6C 18 08 - mov [rax+rbx+08],r13d
CrimsonDesert.exe+6B5444 - 49 83 C6 10 - add r14,10
CrimsonDesert.exe+6B5448 - 48 8D 5B 10 - lea rbx,[rbx+10]
CrimsonDesert.exe+6B544C - 48 83 EF 01 - sub rdi,01
CrimsonDesert.exe+6B5450 - 75 8F - jne CrimsonDesert.exe+6B53E1
CrimsonDesert.exe+6B5452 - 48 8D 15 D78D6405 - lea rdx,[Player_Base_addr]
CrimsonDesert.exe+6B5459 - 48 8D 8D 40010000 - lea rcx,[rbp+00000140]
CrimsonDesert.exe+6B5460 - E8 7B8A0000 - call CrimsonDesert.exe+6BDEE0
CrimsonDesert.exe+6B5465 - 90 - nop
CrimsonDesert.exe+6B5466 - C6 45 C0 00 - mov byte ptr [rbp-40],00
CrimsonDesert.exe+6B546A - 0F57 C0 - xorps xmm0,xmm0
CrimsonDesert.exe+6B546D - 33 C0 - xor eax,eax
`Player_Base2_addr`:
CrimsonDesert.exe+233B38F - C7 03 00 00 00 00 - mov [rbx],00000000
CrimsonDesert.exe+233B395 - 48 8B 5C 24 30 - mov rbx,[rsp+30]
CrimsonDesert.exe+233B39A - 48 83 C4 20 - add rsp,20
CrimsonDesert.exe+233B39E - 5F - pop rdi
CrimsonDesert.exe+233B39F - C3 - ret
CrimsonDesert.exe+233B3A0 - 40 53 - push rbx
CrimsonDesert.exe+233B3A2 - 55 - push rbp
CrimsonDesert.exe+233B3A3 - 56 - push rsi
CrimsonDesert.exe+233B3A4 - 48 83 EC 20 - sub rsp,20
CrimsonDesert.exe+233B3A8 - 49 8B 30 - mov rsi,[r8]
CrimsonDesert.exe+233B3AB - 48 8B DA - mov rbx,rdx
CrimsonDesert.exe+233B3AE - 49 8B 68 18 - mov rbp,[r8+18]
CrimsonDesert.exe+233B3B2 - 48 85 F6 - test rsi,rsi
CrimsonDesert.exe+233B3B5 - 0F 84 E6 00 00 00 - je CrimsonDesert.exe+233B4A1
CrimsonDesert.exe+233B3BB - 48 89 7C 24 40 - mov [rsp+40],rdi
CrimsonDesert.exe+233B3C0 - 48 8D 4C 24 50 - lea rcx,[rsp+50]
// INJECTING HERE
CrimsonDesert.exe+233B3C5 - 48 8B 3D 64 15 95 03 - mov rdi,[145C8C930]
// DONE INJECTING
CrimsonDesert.exe+233B3CC - 4C 89 74 24 48 - mov [rsp+48],r14
CrimsonDesert.exe+233B3D1 - 44 0F B6 75 03 - movzx r14d,byte ptr [rbp+03]
CrimsonDesert.exe+233B3D6 - E8 05 0A F7 FD - call CrimsonDesert.AK::MemoryMgr::StartProfileThreadUsage+20
CrimsonDesert.exe+233B3DB - 48 8B 8F F8 00 00 00 - mov rcx,[rdi+000000F8]
CrimsonDesert.exe+233B3E2 - 44 8B 87 00 01 00 00 - mov r8d,[rdi+00000100]
CrimsonDesert.exe+233B3E9 - 49 C1 E0 04 - shl r8,04
CrimsonDesert.exe+233B3ED - 4C 03 C1 - add r8,rcx
CrimsonDesert.exe+233B3F0 - 49 3B C8 - cmp rcx,r8
CrimsonDesert.exe+233B3F3 - 74 23 - je CrimsonDesert.exe+233B418
CrimsonDesert.exe+233B3F5 - 8B 44 24 50 - mov eax,[rsp+50]
CrimsonDesert.exe+233B3F9 - 0F 1F 80 00 00 00 00 - nop dword ptr [rax+00000000]
CrimsonDesert.exe+233B400 - 48 8B 51 08 - mov rdx,[rcx+08]
CrimsonDesert.exe+233B404 - C6 02 01 - mov byte ptr [rdx],01
CrimsonDesert.exe+233B407 - 39 01 - cmp [rcx],eax
CrimsonDesert.exe+233B409 - 75 04 - jne CrimsonDesert.exe+233B40F
CrimsonDesert.exe+233B40B - C6 42 01 01 - mov byte ptr [rdx+01],01