29
"Scripts only available in shop only, or game may crash"
8000FF
1
2
"Get coin (Spend $ in shop)"
Auto Assembler Script
{ Game : Brotato.exe
Version:
Date : 2022-10-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_COIN,Brotato.exe,48 8B 53 08 48 2B 56 08) // should be unique
alloc(newmem,$1000,INJECT_GET_COIN)
label(code)
label(return)
label(i_base_coin_addr)
newmem:
push rax
test r12, r12
jne endp
test r13, r13
jne endp
mov rax, [rbx+08]
mov eax, [rbx+18]
cmp eax, 2
jne endp
mov eax, [rbx+00]
cmp eax, 2
jne endp
mov eax, [rbx+0C]
test eax, eax
jne endp
mov eax, [rbx+20]
test eax, eax
je endp
mov rax, [rbx+E8]
test rax, rax
je endp
mov [i_base_coin_addr], rbx
endp:
pop rax
code:
mov rdx,[rbx+08]
sub rdx,[rsi+08]
jmp return
align 10 cc
i_base_coin_addr:
dq 0
INJECT_GET_COIN:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_COIN)
registersymbol(i_base_coin_addr)
[DISABLE]
INJECT_GET_COIN:
db 48 8B 53 08 48 2B 56 08
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Brotato.exe+1AB03BB
Brotato.exe+1AB0392: 48 63 03 - movsxd rax,dword ptr [rbx]
Brotato.exe+1AB0395: 83 F8 1A - cmp eax,1A
Brotato.exe+1AB0398: 0F 87 F3 02 00 00 - ja Brotato.exe+1AB0691
Brotato.exe+1AB039E: 41 0F B6 84 00 44 28 AB 01 - movzx eax,byte ptr [r8+rax+01AB2844]
Brotato.exe+1AB03A7: 41 8B 8C 80 28 28 AB 01 - mov ecx,[r8+rax*4+01AB2828]
Brotato.exe+1AB03AF: 49 03 C8 - add rcx,r8
Brotato.exe+1AB03B2: FF E1 - jmp rcx
Brotato.exe+1AB03B4: 8B 06 - mov eax,[rsi]
Brotato.exe+1AB03B6: 83 F8 02 - cmp eax,02
Brotato.exe+1AB03B9: 75 3E - jne Brotato.exe+1AB03F9
// ---------- INJECTING HERE ----------
Brotato.exe+1AB03BB: 48 8B 53 08 - mov rdx,[rbx+08]
// ---------- DONE INJECTING ----------
Brotato.exe+1AB03BF: 48 2B 56 08 - sub rdx,[rsi+08]
Brotato.exe+1AB03C3: 48 8D 8D 78 1B 00 00 - lea rcx,[rbp+00001B78]
Brotato.exe+1AB03CA: E8 C1 ED FD FF - call Brotato.exe+1A8F190
Brotato.exe+1AB03CF: 90 - nop
Brotato.exe+1AB03D0: 48 8D 95 78 1B 00 00 - lea rdx,[rbp+00001B78]
Brotato.exe+1AB03D7: 49 8B CE - mov rcx,r14
Brotato.exe+1AB03DA: E8 B1 76 FE FF - call Brotato.exe+1A97A90
Brotato.exe+1AB03DF: 90 - nop
Brotato.exe+1AB03E0: 83 BD 78 1B 00 00 00 - cmp dword ptr [rbp+00001B78],00
Brotato.exe+1AB03E7: 0F 84 DF 20 00 00 - je Brotato.exe+1AB24CC
}
8
"Available in shop only"
8000FF
1
3
"Coin"
0
4 Bytes
i_base_coin_addr
8
6
"Get base max HP (Buy any HP modification item in shop screen)"
Auto Assembler Script
{ Game : Brotato.exe
Version:
Date : 2022-10-02
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_HP,Brotato.exe,48 8B 47 08 48 89 43 08 E9) // should be unique
alloc(newmem,$1000,INJECT_GET_HP)
label(code)
label(return)
label(i_base_hp_addr1)
label(i_base_hp_addr2)
label(i_base_hp_addr3)
label(i_base_hp_addr4)
label(i_base_hp_addr5)
label(i_base_hp_addr6)
label(i_base_hp_addr7)
label(i_base_hp_addr8)
label(i_base_hp_addr9)
label(i_base_hp_addr10)
label(i_base_elemental_damage)
label(i_base_crit_chance)
newmem:
push rax
push rcx
test r12, r12
jne endp
cmp r8d, B
jne endp
mov eax, [rbx+0C]
test eax, eax
jne endp
mov eax, [rbx]
cmp eax, 2
jne endp
mov rax, [rbx+18]
test rax, rax
je endp
mov rax, [rbx+28]
test rax, rax
je endp
{
mov rax, [rax+00]
test rax, rax
je endp
mov rax, [rax+00]
test rax, rax
je endp
mov rax, [rax+08]
test rax, rax
je endp
mov ecx, [rax]
cmp ecx, 00740073
jne endp
mov ecx, [rax+04]
cmp ecx, 00740061
jne endp
mov ecx, [rax+08]
cmp ecx, 006D005F
jne endp
mov ecx, [rax+0C]
cmp ecx, 00780061
jne endp
mov ecx, [rax+10]
cmp ecx, 0068005F
jne endp
}
cmp qword ptr [i_base_hp_addr1], rbx
je endp
cmp qword ptr [i_base_hp_addr1], 0
jne set_next2
mov [i_base_hp_addr1], rbx
jmp endp_final
set_next2:
cmp qword ptr [i_base_hp_addr2], rbx
je endp
cmp qword ptr [i_base_hp_addr2], 0
jne set_next3
mov [i_base_hp_addr2], rbx
jmp endp_final
set_next3:
cmp qword ptr [i_base_hp_addr3], rbx
je endp
cmp qword ptr [i_base_hp_addr3], 0
jne set_next4
mov [i_base_hp_addr3], rbx
jmp endp_final
set_next4:
cmp qword ptr [i_base_hp_addr4], rbx
je endp
cmp qword ptr [i_base_hp_addr4], 0
jne set_next5
mov [i_base_hp_addr4], rbx
jmp endp_final
set_next5:
cmp qword ptr [i_base_hp_addr5], rbx
je endp
cmp qword ptr [i_base_hp_addr5], 0
jne set_next6
mov [i_base_hp_addr5], rbx
jmp endp_final
set_next6:
{
cmp qword ptr [i_base_hp_addr6], rbx
je endp
cmp qword ptr [i_base_hp_addr6], 0
jne set_next7
mov [i_base_hp_addr6], rbx
jmp endp_final
set_next7:
cmp qword ptr [i_base_hp_addr7], rbx
je endp
cmp qword ptr [i_base_hp_addr7], 0
jne set_next8
mov [i_base_hp_addr7], rbx
jmp endp_final
set_next8:
cmp qword ptr [i_base_hp_addr8], rbx
je endp
cmp qword ptr [i_base_hp_addr8], 0
jne set_next9
mov [i_base_hp_addr8], rbx
jmp endp_final
set_next9:
cmp qword ptr [i_base_hp_addr9], rbx
je endp
cmp qword ptr [i_base_hp_addr9], 0
jne set_next10
mov [i_base_hp_addr9], rbx
jmp endp_final
set_next10:
cmp qword ptr [i_base_hp_addr10], rbx
je endp
cmp qword ptr [i_base_hp_addr10], 0
jne endp
mov [i_base_hp_addr10], rbx
jmp endp_final
}
endp:
check_ele_dmg:
test r12, r12
jne endp1
cmp r8d, 15
jne endp1
cmp r13d, 11
jne endp1
mov eax, [rbx+0C]
test eax, eax
jne endp1
mov rax, [rbx+18]
test rax, rax
je endp1
mov rax, [rbx+60]
test rax, rax
je endp1
mov [i_base_elemental_damage], rbx
jmp endp_final
endp1:
jmp endp_final
chk_crit:
test r12, r12
jne endp2
cmp r8d, 10
jne endp2
cmp r13d, 11
jne endp2
mov eax, [rbx+0C]
test eax, eax
jne endp2
mov eax, [rbx]
test eax, 2
jne endp2
mov rax, [rbx+18]
test rax, rax
je endp2
mov rax, [rbx+28]
test rax, rax
je endp2
mov rax, [rbx+60]
test rax, rax
je endp2
mov [i_base_crit_chance], rbx
jmp endp_final
endp2:
endp_final:
pop rcx
pop rax
code:
mov rax,[rdi+08]
mov [rbx+08],rax
jmp return
align 10 cc
i_base_hp_addr1:
dq 0
i_base_hp_addr2:
dq 0
i_base_hp_addr3:
dq 0
i_base_hp_addr4:
dq 0
i_base_hp_addr5:
dq 0
i_base_hp_addr6:
dq 0
i_base_hp_addr7:
dq 0
i_base_hp_addr8:
dq 0
i_base_hp_addr9:
dq 0
i_base_hp_addr10:
dq 0
i_base_elemental_damage:
dq 0
i_base_crit_chance:
dq 0
INJECT_GET_HP:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_HP)
registersymbol(i_base_hp_addr1)
registersymbol(i_base_hp_addr2)
registersymbol(i_base_hp_addr3)
registersymbol(i_base_hp_addr4)
registersymbol(i_base_hp_addr5)
registersymbol(i_base_hp_addr6)
registersymbol(i_base_hp_addr7)
registersymbol(i_base_hp_addr8)
registersymbol(i_base_hp_addr9)
registersymbol(i_base_hp_addr10)
registersymbol(i_base_elemental_damage)
registersymbol(i_base_crit_chance)
[DISABLE]
INJECT_GET_HP:
db 48 8B 47 08 48 89 43 08
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Brotato.exe+1A97AF4
Brotato.exe+1A97ACA: 83 F8 19 - cmp eax,19
Brotato.exe+1A97ACD: 0F 87 2A 03 00 00 - ja Brotato.exe+1A97DFD
Brotato.exe+1A97AD3: 48 98 - cdqe
Brotato.exe+1A97AD5: 48 8D 15 24 85 56 FE - lea rdx,[Brotato.exe]
Brotato.exe+1A97ADC: 8B 8C 82 20 7E A9 01 - mov ecx,[rdx+rax*4+01A97E20]
Brotato.exe+1A97AE3: 48 03 CA - add rcx,rdx
Brotato.exe+1A97AE6: FF E1 - jmp rcx
Brotato.exe+1A97AE8: 0F B6 47 08 - movzx eax,byte ptr [rdi+08]
Brotato.exe+1A97AEC: 88 43 08 - mov [rbx+08],al
Brotato.exe+1A97AEF: E9 09 03 00 00 - jmp Brotato.exe+1A97DFD
// ---------- INJECTING HERE ----------
Brotato.exe+1A97AF4: 48 8B 47 08 - mov rax,[rdi+08]
// ---------- DONE INJECTING ----------
Brotato.exe+1A97AF8: 48 89 43 08 - mov [rbx+08],rax
Brotato.exe+1A97AFC: E9 FC 02 00 00 - jmp Brotato.exe+1A97DFD
Brotato.exe+1A97B01: 48 8D 57 08 - lea rdx,[rdi+08]
Brotato.exe+1A97B05: 48 8D 4B 08 - lea rcx,[rbx+08]
Brotato.exe+1A97B09: E8 A2 77 58 FE - call Brotato.exe+1F2B0
Brotato.exe+1A97B0E: 4C 89 7C 24 70 - mov [rsp+70],r15
Brotato.exe+1A97B13: 48 8D 53 08 - lea rdx,[rbx+08]
Brotato.exe+1A97B17: 48 8D 4C 24 70 - lea rcx,[rsp+70]
Brotato.exe+1A97B1C: E8 8F 77 58 FE - call Brotato.exe+1F2B0
Brotato.exe+1A97B21: 90 - nop
}
21
"Available in shop only"
8000FF
1
7
"Possible base max HP #1"
0
4 Bytes
i_base_hp_addr1
8
12
"Possible base max HP #2"
0
4 Bytes
i_base_hp_addr2
8
24
"Possible base max HP #3"
0
4 Bytes
i_base_hp_addr3
8
25
"Possible base max HP #4"
0
4 Bytes
i_base_hp_addr4
8
26
"Possible base max HP #5"
0
4 Bytes
i_base_hp_addr5
8
28
"Possible elemental damage"
1
4 Bytes
i_base_elemental_damage
8
30
"Brotato EA 0.5.10 / https://opencheattables.com / CE 7.4+"
400080
1