0
"[*] CLICK HERE FIRST -- Safe Attach + Watch/Pointers"
4080FF
Auto Assembler Script
[ENABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
-- attach process
local processName = "PRAGMATA.exe"
local pid = getProcessIDFromProcessName(processName)
if pid ~= nil and pid > 0 then
local currentPid = getOpenedProcessID() or 0
if currentPid ~= pid then
openProcess(processName)
print("Attached to: " .. processName)
Sleep(333)
else
print("Already attached to: " .. processName)
end
end
synchronize(function()
getLuaEngine().Close()
end)
local enableWatchScripts = {
8500, -- "Crash Watchdog"
1, -- "Toggle Compact View"
571, -- "[internal] table init"
573, -- "FAST_OVERDRIVE_PLUS_30" pointer scanner
6, -- "[internal] gravity scanner"
11, -- "Get Lunafilament / others amount (menus)"
21, -- HP pointer capture only; HP Mode defaults off
25, -- thrust pointer capture only; Thrust Mode defaults off
578, -- "Get app.HackingManager"
296, -- "Get app.InventoryManager"
30, -- "Get app.EnhanceManager"
44, -- "Get app.EnemyBattleSystem"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs({24}) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and memRec.Active then
memRec.Active = false
sleep(30)
end
end
local nodeMode = addressList.getMemoryRecordByID(9104)
if nodeMode and nodeMode.CurrentAddress ~= nil and tostring(nodeMode.CurrentAddress) ~= "??" then
nodeMode.Value = "0"
end
for _, id in ipairs(enableWatchScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and not memRec.Active then
memRec.Active = true
sleep(30)
end
addressList.refresh()
end
sleep(300)
for _, id in ipairs({8500, 21, 25}) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and not memRec.Active then
memRec.Active = true
sleep(80)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
[DISABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local disableBattleScripts = {
258, -- "_EraseCodeGridNum [System.Int32 x7]"
247, -- "_OverrideReaction02LoopTime [System.Single x8]"
568, -- "[89] [app.ItemInventoryInfo]"
565, -- "[88] [app.ItemInventoryInfo]"
562, -- "[87] [app.ItemInventoryInfo]"
559, -- "[86] [app.ItemInventoryInfo]"
556, -- "[85] [app.ItemInventoryInfo]"
553, -- "[84] [app.ItemInventoryInfo]"
550, -- "[83] [app.ItemInventoryInfo]"
547, -- "[82] [app.ItemInventoryInfo]"
544, -- "[81] [app.ItemInventoryInfo]"
541, -- "[80] [app.ItemInventoryInfo]"
538, -- "[79] [app.ItemInventoryInfo]"
535, -- "[78] [app.ItemInventoryInfo]"
532, -- "[77] [app.ItemInventoryInfo]"
529, -- "[76] [app.ItemInventoryInfo]"
526, -- "[75] [app.ItemInventoryInfo]"
523, -- "[74] [app.ItemInventoryInfo]"
520, -- "[73] [app.ItemInventoryInfo]"
517, -- "[72] [app.ItemInventoryInfo]"
514, -- "[71] [app.ItemInventoryInfo]"
511, -- "[70] [app.ItemInventoryInfo]"
508, -- "[69] [app.ItemInventoryInfo]"
505, -- "[68] [app.ItemInventoryInfo]"
502, -- "[67] [app.ItemInventoryInfo]"
499, -- "[66] [app.ItemInventoryInfo]"
496, -- "[65] [app.ItemInventoryInfo]"
493, -- "[64] [app.ItemInventoryInfo]"
490, -- "[63] [app.ItemInventoryInfo]"
487, -- "[62] [app.ItemInventoryInfo]"
484, -- "[61] [app.ItemInventoryInfo]"
481, -- "[60] [app.ItemInventoryInfo]"
478, -- "[59] [app.ItemInventoryInfo]"
475, -- "[58] [app.ItemInventoryInfo]"
472, -- "[57] [app.ItemInventoryInfo]"
469, -- "[56] [app.ItemInventoryInfo]"
466, -- "[55] [app.ItemInventoryInfo]"
463, -- "[54] [app.ItemInventoryInfo]"
460, -- "[53] [app.ItemInventoryInfo]"
457, -- "[52] [app.ItemInventoryInfo]"
454, -- "[51] [app.ItemInventoryInfo]"
451, -- "[50] [app.ItemInventoryInfo]"
448, -- "[49] [app.ItemInventoryInfo]"
445, -- "[48] [app.ItemInventoryInfo]"
442, -- "[47] [app.ItemInventoryInfo]"
439, -- "[46] [app.ItemInventoryInfo]"
436, -- "[45] [app.ItemInventoryInfo]"
433, -- "[44] [app.ItemInventoryInfo]"
430, -- "[43] [app.ItemInventoryInfo]"
427, -- "[42] [app.ItemInventoryInfo]"
424, -- "[41] [app.ItemInventoryInfo]"
421, -- "[40] [app.ItemInventoryInfo]"
418, -- "[39] [app.ItemInventoryInfo]"
415, -- "[38] [app.ItemInventoryInfo]"
412, -- "[37] [app.ItemInventoryInfo]"
409, -- "[36] [app.ItemInventoryInfo]"
406, -- "[35] [app.ItemInventoryInfo]"
403, -- "[34] [app.ItemInventoryInfo]"
400, -- "[33] [app.ItemInventoryInfo]"
397, -- "[32] [app.ItemInventoryInfo]"
394, -- "[31] [app.ItemInventoryInfo]"
391, -- "[30] [app.ItemInventoryInfo]"
388, -- "[29] [app.ItemInventoryInfo]"
385, -- "[28] [app.ItemInventoryInfo]"
382, -- "[27] [app.ItemInventoryInfo]"
379, -- "[26] [app.ItemInventoryInfo]"
376, -- "[25] [app.ItemInventoryInfo]"
373, -- "[24] [app.ItemInventoryInfo]"
370, -- "[23] [app.ItemInventoryInfo]"
367, -- "[22] [app.ItemInventoryInfo]"
364, -- "[21] [app.ItemInventoryInfo]"
361, -- "[20] [app.ItemInventoryInfo]"
358, -- "[19] [app.ItemInventoryInfo]"
355, -- "[18] [app.ItemInventoryInfo]"
352, -- "[17] [app.ItemInventoryInfo]"
349, -- "[16] [app.ItemInventoryInfo]"
346, -- "[15] [app.ItemInventoryInfo]"
343, -- "[14] [app.ItemInventoryInfo]"
340, -- "[13] [app.ItemInventoryInfo]"
337, -- "[12] [app.ItemInventoryInfo]"
334, -- "[11] [app.ItemInventoryInfo]"
331, -- "[10] [app.ItemInventoryInfo]"
328, -- "[9] [app.ItemInventoryInfo]"
325, -- "[8] [app.ItemInventoryInfo]"
322, -- "[7] [app.ItemInventoryInfo]"
319, -- "[6] [app.ItemInventoryInfo]"
316, -- "[5] [app.ItemInventoryInfo]"
313, -- "[4] [app.ItemInventoryInfo]"
310, -- "[3] [app.ItemInventoryInfo]"
307, -- "[2] [app.ItemInventoryInfo]"
304, -- "[1] [app.ItemInventoryInfo]"
301, -- "[0] [app.ItemInventoryInfo]"
257, -- "_DefaultUnit [app.EnemyBaseWeapon.EraseCodeGridUnit.Unit]"
245, -- "[0]"
300, -- "_items"
271, -- "_Wp7800HeatRate [System.Single x9]"
267, -- "_EraseCodeDamage [app.EnemyBaseWeapon.EraseCodeDamageUnit]"
256, -- "_EraseCodeGridUnit [app.EnemyBaseWeapon.EraseCodeGridUnit]"
244, -- "_OverrideReaction02LoopTimeUnits [app.EnemyBaseWeapon.OverrideReaction02LoopTimeUnit x1]"
229, -- "_AddHackingFataDamageArray"
207, -- "_ActiveModeRate [System.Single x9]"
198, -- "_ShockResistanceStackRate [System.Single x5]"
194, -- "_ShockPuzzleDamageRate [System.Single x3]"
190, -- "_ShockPuzzleDamageRateForNum [System.Single x3]"
184, -- "_HeatResistanceStackRate [System.Single x5]"
178, -- "_HeatResistanceTimeRate [System.Single x5]"
174, -- "_HeatHitFatalDamageRateForRank [System.Single x3]"
170, -- "_HeatFatalDamageRateForRank [System.Single x3]"
166, -- "_HeatDamageRateForRank [System.Single x3]"
162, -- "_HeatTimeForNum [System.Single x3]"
157, -- "_HeatTriggerFatalValueForRank [System.Int32 x3]"
147, -- "_MultiRadiusForRank [System.Single x3]"
143, -- "_MultiTargetNumForRank [System.Int32 x3]"
139, -- "_MultiOpenHackingTimeRateForNum [System.Single x3]"
135, -- "_HealRateForNum [System.Single x3]"
130, -- "_HealConvertRateForRank [via.AnimationCurve x3]"
123, -- "_ConfuseResistanceStackRate [System.Single x5]"
117, -- "_ConfuseResistanceTimeRate [System.Single x5]"
113, -- "_ConfuseDoReactionCoolTimeForRank [System.Single x3]"
109, -- "_ConfuseAttackRateForRank [System.Single x3]"
105, -- "_ConfuseAttackRateForNum [System.Single x3]"
101, -- "_ConfuseTimeForNum [System.Single x3]"
95, -- "_StunResistanceStackRate [System.Single x5]"
89, -- "_StunResistanceTimeRate [System.Single x5]"
85, -- "_StunAddTimeForRank [System.Single x3]"
81, -- "_StunTimeForNum [System.Single x3]"
74, -- "_DefenceDownResistanceStackRate [System.Single x5]"
68, -- "_DefenceDownResistanceTimeRate [System.Single x5]"
64, -- "_DefenceDownFinishBlowDamageRateForRank [System.Single x3]"
60, -- "_DefenceDownDownRateForRank [System.Single x3]"
56, -- "_DefenseDownFinishBlowRateForNum [System.Single x3]"
52, -- "_DefenseDownRateForNum [System.Single x3]"
48, -- "_DefenceDownTimeForNum [System.Single x3]"
41, -- "Skip slot capacity writeback"
39, -- "Skip slot capacity writeback"
583, -- "_AutoHackTotalBaseTime [System.Single x4]"
299, -- "System.Collections.Generic.List`1<app.ItemInventoryInfo>"
282, -- "_PowerHacking"
243, -- "_Weapon"
241, -- "_Hacking"
238, -- "_FriendHit"
235, -- "_DeathBlow"
222, -- "_FatalBreak"
217, -- "_FinishBlow"
47, -- "_Abnormal"
40, -- "<PassiveSkillCapacity>k__BackingField"
38, -- "<ActiveSkillCapacity>k__BackingField"
581, -- "_SnakePuzzleCommonUserData"
298, -- "app.InventoryManager.ItemSlotTable"
290, -- "_AttackPermitData"
46, -- "app.EnemyBaseParamUserData"
32, -- "_EquipmentPerkMainGame -> _BootingPerks"
604, -- "Enable Auto HP valid monitor"
579, -- "base"
573, -- "FAST_OVERDRIVE_PLUS_30"
297, -- "base"
45, -- "base"
31, -- "base"
21, -- "Enable HP clamp"
605, -- "Fast kill (normal attack)"
578, -- "Get app.HackingManager"
571, -- "PRAGMATA / https://opencheattables.com / CE 7.6+"
296, -- "Get app.InventoryManager"
44, -- "Get app.EnemyBattleSystem partial settings"
30, -- "Get app.EnhanceManager settings"
27, -- "Training: target time"
25, -- "Fast Diana's Overdrive / inf thruster"
24, -- "inf hacking nodes (active peaks)"
18, -- "Get char HP"
11, -- "Get Lunafilament / others amount (menus)"
8, -- "Set gravity"
6, -- "Get gravity (readonly)"
2, -- "Set min bullet num"
1, -- "Toggle Compact View"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(disableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and memRec.Active then
memRec.Active = false
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
-- Comments:
-- ID: 1, Description: "Toggle Compact View", Depth: 0
-- ID: 2, Description: "Set min bullet num", Depth: 0
-- ID: 6, Description: "Get gravity (readonly)", Depth: 0
-- ID: 8, Description: "Set gravity", Depth: 0
-- ID: 11, Description: "Get Lunafilament / others amount (menus)", Depth: 0
-- ID: 18, Description: "Get char HP", Depth: 0
-- ID: 604, Description: "Enable Auto HP valid monitor", Depth: 1
-- ID: 21, Description: "Enable HP clamp", Depth: 1
-- ID: 24, Description: "inf hacking nodes (active peaks)", Depth: 0
-- ID: 605, Description: "Fast kill (normal attack)", Depth: 0
-- ID: 25, Description: "Fast Diana's Overdrive / inf thruster", Depth: 0
-- ID: 27, Description: "Training: target time", Depth: 0
-- ID: 30, Description: "Get app.EnhanceManager settings", Depth: 0
-- ID: 31, Description: "base", Depth: 1
-- ID: 32, Description: "_EquipmentPerkMainGame -> _BootingPerks", Depth: 2
-- ID: 38, Description: "<ActiveSkillCapacity>k__BackingField", Depth: 3
-- ID: 39, Description: "Skip slot capacity writeback", Depth: 4
-- ID: 40, Description: "<PassiveSkillCapacity>k__BackingField", Depth: 3
-- ID: 41, Description: "Skip slot capacity writeback", Depth: 4
-- ID: 44, Description: "Get app.EnemyBattleSystem partial settings", Depth: 0
-- ID: 45, Description: "base", Depth: 1
-- ID: 46, Description: "app.EnemyBaseParamUserData", Depth: 2
-- ID: 47, Description: "_Abnormal", Depth: 3
-- ID: 48, Description: "_DefenceDownTimeForNum [System.Single x3]", Depth: 4
-- ID: 52, Description: "_DefenseDownRateForNum [System.Single x3]", Depth: 4
-- ID: 56, Description: "_DefenseDownFinishBlowRateForNum [System.Single x3]", Depth: 4
-- ID: 60, Description: "_DefenceDownDownRateForRank [System.Single x3]", Depth: 4
-- ID: 64, Description: "_DefenceDownFinishBlowDamageRateForRank [System.Single x3]", Depth: 4
-- ID: 68, Description: "_DefenceDownResistanceTimeRate [System.Single x5]", Depth: 4
-- ID: 74, Description: "_DefenceDownResistanceStackRate [System.Single x5]", Depth: 4
-- ID: 81, Description: "_StunTimeForNum [System.Single x3]", Depth: 4
-- ID: 85, Description: "_StunAddTimeForRank [System.Single x3]", Depth: 4
-- ID: 89, Description: "_StunResistanceTimeRate [System.Single x5]", Depth: 4
-- ID: 95, Description: "_StunResistanceStackRate [System.Single x5]", Depth: 4
-- ID: 101, Description: "_ConfuseTimeForNum [System.Single x3]", Depth: 4
-- ID: 105, Description: "_ConfuseAttackRateForNum [System.Single x3]", Depth: 4
-- ID: 109, Description: "_ConfuseAttackRateForRank [System.Single x3]", Depth: 4
-- ID: 113, Description: "_ConfuseDoReactionCoolTimeForRank [System.Single x3]", Depth: 4
-- ID: 117, Description: "_ConfuseResistanceTimeRate [System.Single x5]", Depth: 4
-- ID: 123, Description: "_ConfuseResistanceStackRate [System.Single x5]", Depth: 4
-- ID: 130, Description: "_HealConvertRateForRank [via.AnimationCurve x3]", Depth: 4
-- ID: 135, Description: "_HealRateForNum [System.Single x3]", Depth: 4
-- ID: 139, Description: "_MultiOpenHackingTimeRateForNum [System.Single x3]", Depth: 4
-- ID: 143, Description: "_MultiTargetNumForRank [System.Int32 x3]", Depth: 4
-- ID: 147, Description: "_MultiRadiusForRank [System.Single x3]", Depth: 4
-- ID: 157, Description: "_HeatTriggerFatalValueForRank [System.Int32 x3]", Depth: 4
-- ID: 162, Description: "_HeatTimeForNum [System.Single x3]", Depth: 4
-- ID: 166, Description: "_HeatDamageRateForRank [System.Single x3]", Depth: 4
-- ID: 170, Description: "_HeatFatalDamageRateForRank [System.Single x3]", Depth: 4
-- ID: 174, Description: "_HeatHitFatalDamageRateForRank [System.Single x3]", Depth: 4
-- ID: 178, Description: "_HeatResistanceTimeRate [System.Single x5]", Depth: 4
-- ID: 184, Description: "_HeatResistanceStackRate [System.Single x5]", Depth: 4
-- ID: 190, Description: "_ShockPuzzleDamageRateForNum [System.Single x3]", Depth: 4
-- ID: 194, Description: "_ShockPuzzleDamageRate [System.Single x3]", Depth: 4
-- ID: 198, Description: "_ShockResistanceStackRate [System.Single x5]", Depth: 4
-- ID: 207, Description: "_ActiveModeRate [System.Single x9]", Depth: 4
-- ID: 217, Description: "_FinishBlow", Depth: 3
-- ID: 222, Description: "_FatalBreak", Depth: 3
-- ID: 229, Description: "_AddHackingFataDamageArray", Depth: 4
-- ID: 235, Description: "_DeathBlow", Depth: 3
-- ID: 238, Description: "_FriendHit", Depth: 3
-- ID: 241, Description: "_Hacking", Depth: 3
-- ID: 243, Description: "_Weapon", Depth: 3
-- ID: 244, Description: "_OverrideReaction02LoopTimeUnits [app.EnemyBaseWeapon.OverrideReaction02LoopTimeUnit x1]", Depth: 4
-- ID: 245, Description: "[0]", Depth: 5
-- ID: 247, Description: "_OverrideReaction02LoopTime [System.Single x8]", Depth: 6
-- ID: 256, Description: "_EraseCodeGridUnit [app.EnemyBaseWeapon.EraseCodeGridUnit]", Depth: 4
-- ID: 257, Description: "_DefaultUnit [app.EnemyBaseWeapon.EraseCodeGridUnit.Unit]", Depth: 5
-- ID: 258, Description: "_EraseCodeGridNum [System.Int32 x7]", Depth: 6
-- ID: 267, Description: "_EraseCodeDamage [app.EnemyBaseWeapon.EraseCodeDamageUnit]", Depth: 4
-- ID: 271, Description: "_Wp7800HeatRate [System.Single x9]", Depth: 4
-- ID: 282, Description: "_PowerHacking", Depth: 3
-- ID: 290, Description: "_AttackPermitData", Depth: 2
-- ID: 296, Description: "Get app.InventoryManager", Depth: 0
-- ID: 297, Description: "base", Depth: 1
-- ID: 298, Description: "app.InventoryManager.ItemSlotTable", Depth: 2
-- ID: 299, Description: "System.Collections.Generic.List`1<app.ItemInventoryInfo>", Depth: 3
-- ID: 300, Description: "_items", Depth: 4
-- ID: 301, Description: "[0] [app.ItemInventoryInfo]", Depth: 5
-- ID: 304, Description: "[1] [app.ItemInventoryInfo]", Depth: 5
-- ID: 307, Description: "[2] [app.ItemInventoryInfo]", Depth: 5
-- ID: 310, Description: "[3] [app.ItemInventoryInfo]", Depth: 5
-- ID: 313, Description: "[4] [app.ItemInventoryInfo]", Depth: 5
-- ID: 316, Description: "[5] [app.ItemInventoryInfo]", Depth: 5
-- ID: 319, Description: "[6] [app.ItemInventoryInfo]", Depth: 5
-- ID: 322, Description: "[7] [app.ItemInventoryInfo]", Depth: 5
-- ID: 325, Description: "[8] [app.ItemInventoryInfo]", Depth: 5
-- ID: 328, Description: "[9] [app.ItemInventoryInfo]", Depth: 5
-- ID: 331, Description: "[10] [app.ItemInventoryInfo]", Depth: 5
-- ID: 334, Description: "[11] [app.ItemInventoryInfo]", Depth: 5
-- ID: 337, Description: "[12] [app.ItemInventoryInfo]", Depth: 5
-- ID: 340, Description: "[13] [app.ItemInventoryInfo]", Depth: 5
-- ID: 343, Description: "[14] [app.ItemInventoryInfo]", Depth: 5
-- ID: 346, Description: "[15] [app.ItemInventoryInfo]", Depth: 5
-- ID: 349, Description: "[16] [app.ItemInventoryInfo]", Depth: 5
-- ID: 352, Description: "[17] [app.ItemInventoryInfo]", Depth: 5
-- ID: 355, Description: "[18] [app.ItemInventoryInfo]", Depth: 5
-- ID: 358, Description: "[19] [app.ItemInventoryInfo]", Depth: 5
-- ID: 361, Description: "[20] [app.ItemInventoryInfo]", Depth: 5
-- ID: 364, Description: "[21] [app.ItemInventoryInfo]", Depth: 5
-- ID: 367, Description: "[22] [app.ItemInventoryInfo]", Depth: 5
-- ID: 370, Description: "[23] [app.ItemInventoryInfo]", Depth: 5
-- ID: 373, Description: "[24] [app.ItemInventoryInfo]", Depth: 5
-- ID: 376, Description: "[25] [app.ItemInventoryInfo]", Depth: 5
-- ID: 379, Description: "[26] [app.ItemInventoryInfo]", Depth: 5
-- ID: 382, Description: "[27] [app.ItemInventoryInfo]", Depth: 5
-- ID: 385, Description: "[28] [app.ItemInventoryInfo]", Depth: 5
-- ID: 388, Description: "[29] [app.ItemInventoryInfo]", Depth: 5
-- ID: 391, Description: "[30] [app.ItemInventoryInfo]", Depth: 5
-- ID: 394, Description: "[31] [app.ItemInventoryInfo]", Depth: 5
-- ID: 397, Description: "[32] [app.ItemInventoryInfo]", Depth: 5
-- ID: 400, Description: "[33] [app.ItemInventoryInfo]", Depth: 5
-- ID: 403, Description: "[34] [app.ItemInventoryInfo]", Depth: 5
-- ID: 406, Description: "[35] [app.ItemInventoryInfo]", Depth: 5
-- ID: 409, Description: "[36] [app.ItemInventoryInfo]", Depth: 5
-- ID: 412, Description: "[37] [app.ItemInventoryInfo]", Depth: 5
-- ID: 415, Description: "[38] [app.ItemInventoryInfo]", Depth: 5
-- ID: 418, Description: "[39] [app.ItemInventoryInfo]", Depth: 5
-- ID: 421, Description: "[40] [app.ItemInventoryInfo]", Depth: 5
-- ID: 424, Description: "[41] [app.ItemInventoryInfo]", Depth: 5
-- ID: 427, Description: "[42] [app.ItemInventoryInfo]", Depth: 5
-- ID: 430, Description: "[43] [app.ItemInventoryInfo]", Depth: 5
-- ID: 433, Description: "[44] [app.ItemInventoryInfo]", Depth: 5
-- ID: 436, Description: "[45] [app.ItemInventoryInfo]", Depth: 5
-- ID: 439, Description: "[46] [app.ItemInventoryInfo]", Depth: 5
-- ID: 442, Description: "[47] [app.ItemInventoryInfo]", Depth: 5
-- ID: 445, Description: "[48] [app.ItemInventoryInfo]", Depth: 5
-- ID: 448, Description: "[49] [app.ItemInventoryInfo]", Depth: 5
-- ID: 451, Description: "[50] [app.ItemInventoryInfo]", Depth: 5
-- ID: 454, Description: "[51] [app.ItemInventoryInfo]", Depth: 5
-- ID: 457, Description: "[52] [app.ItemInventoryInfo]", Depth: 5
-- ID: 460, Description: "[53] [app.ItemInventoryInfo]", Depth: 5
-- ID: 463, Description: "[54] [app.ItemInventoryInfo]", Depth: 5
-- ID: 466, Description: "[55] [app.ItemInventoryInfo]", Depth: 5
-- ID: 469, Description: "[56] [app.ItemInventoryInfo]", Depth: 5
-- ID: 472, Description: "[57] [app.ItemInventoryInfo]", Depth: 5
-- ID: 475, Description: "[58] [app.ItemInventoryInfo]", Depth: 5
-- ID: 478, Description: "[59] [app.ItemInventoryInfo]", Depth: 5
-- ID: 481, Description: "[60] [app.ItemInventoryInfo]", Depth: 5
-- ID: 484, Description: "[61] [app.ItemInventoryInfo]", Depth: 5
-- ID: 487, Description: "[62] [app.ItemInventoryInfo]", Depth: 5
-- ID: 490, Description: "[63] [app.ItemInventoryInfo]", Depth: 5
-- ID: 493, Description: "[64] [app.ItemInventoryInfo]", Depth: 5
-- ID: 496, Description: "[65] [app.ItemInventoryInfo]", Depth: 5
-- ID: 499, Description: "[66] [app.ItemInventoryInfo]", Depth: 5
-- ID: 502, Description: "[67] [app.ItemInventoryInfo]", Depth: 5
-- ID: 505, Description: "[68] [app.ItemInventoryInfo]", Depth: 5
-- ID: 508, Description: "[69] [app.ItemInventoryInfo]", Depth: 5
-- ID: 511, Description: "[70] [app.ItemInventoryInfo]", Depth: 5
-- ID: 514, Description: "[71] [app.ItemInventoryInfo]", Depth: 5
-- ID: 517, Description: "[72] [app.ItemInventoryInfo]", Depth: 5
-- ID: 520, Description: "[73] [app.ItemInventoryInfo]", Depth: 5
-- ID: 523, Description: "[74] [app.ItemInventoryInfo]", Depth: 5
-- ID: 526, Description: "[75] [app.ItemInventoryInfo]", Depth: 5
-- ID: 529, Description: "[76] [app.ItemInventoryInfo]", Depth: 5
-- ID: 532, Description: "[77] [app.ItemInventoryInfo]", Depth: 5
-- ID: 535, Description: "[78] [app.ItemInventoryInfo]", Depth: 5
-- ID: 538, Description: "[79] [app.ItemInventoryInfo]", Depth: 5
-- ID: 541, Description: "[80] [app.ItemInventoryInfo]", Depth: 5
-- ID: 544, Description: "[81] [app.ItemInventoryInfo]", Depth: 5
-- ID: 547, Description: "[82] [app.ItemInventoryInfo]", Depth: 5
-- ID: 550, Description: "[83] [app.ItemInventoryInfo]", Depth: 5
-- ID: 553, Description: "[84] [app.ItemInventoryInfo]", Depth: 5
-- ID: 556, Description: "[85] [app.ItemInventoryInfo]", Depth: 5
-- ID: 559, Description: "[86] [app.ItemInventoryInfo]", Depth: 5
-- ID: 562, Description: "[87] [app.ItemInventoryInfo]", Depth: 5
-- ID: 565, Description: "[88] [app.ItemInventoryInfo]", Depth: 5
-- ID: 568, Description: "[89] [app.ItemInventoryInfo]", Depth: 5
-- ID: 578, Description: "Get app.HackingManager", Depth: 0
-- ID: 579, Description: "base", Depth: 1
-- ID: 581, Description: "_SnakePuzzleCommonUserData", Depth: 2
-- ID: 583, Description: "_AutoHackTotalBaseTime [System.Single x4]", Depth: 3
-- ID: 571, Description: "PRAGMATA / https://opencheattables.com / CE 7.6+", Depth: 0
-- ID: 573, Description: "FAST_OVERDRIVE_PLUS_30", Depth: 1
8500
"Crash Watchdog (auto-pauses risky cheats)"
Auto Assembler Script
// SAFETY WATCHDOG + FORENSIC LOGGER
// On enable:
// - Polls canary pointers every 250ms; auto-suspends risky cheats on transitions.
// - Tees Lua print() to disk so every script's output is persistent.
// - Writes a 30s state snapshot: active cheats, canary status, HP, ammo address values.
// - Catches errors via xpcall wrappers on its own callbacks.
// Logs live at: %TEMP%\pragmata_watchdog.log
[ENABLE]
{$lua}
if syntaxcheck then return end
local watchedIds = {2, 8, 24, 27, 39, 41, 604, 605, 9010, 9020, 9030, 9040, 9050, 9103}
local watchedValueIds = {9101, 9104}
local loggedValueIds = {9100, 9101, 9104}
local quarantinedIds = {24}
local allCheatIds = {2, 6, 8, 11, 18, 21, 24, 25, 27, 30, 39, 41, 44, 296, 571, 573, 578,
604, 605, 8500, 9010, 9020, 9030, 9040, 9050, 9103}
local canaries = {
"ptrCapture_INJECT_GET_CURRENT_HP_347018",
"i_base_last_data_addr",
"i_base_Lunafilament_addr",
"i_base_upgrades_addr",
"i_base_coin_addr",
"i_base_repair_pack_addr",
"i_base_data_13_addr",
"i_base_data_19_addr",
"i_base_gravirty_addr",
}
local function joinPath(dir, name)
if not dir or dir == "" then return name end
local last = dir:sub(-1)
if last == "\\" or last == "/" then return dir .. name end
return dir .. "\\" .. name
end
local logPath = joinPath(os.getenv("TEMP") or os.getenv("USERPROFILE") or getCheatEngineDir() or ".", "pragmata_watchdog.log")
if not _G.PRAGMATA_WATCHDOG then _G.PRAGMATA_WATCHDOG = {} end
local wd = _G.PRAGMATA_WATCHDOG
wd.suspendedByUs = {}
wd.suspendedValues = {}
wd.lastSafe = true
wd.tickCount = 0
-- ---- file logger ----
if wd.logFile then pcall(function() wd.logFile:close() end); wd.logFile = nil end
wd.logFile = io.open(logPath, "a")
local function w(line)
if wd.logFile then
wd.logFile:write(string.format("[%s] %s\n", os.date("%Y-%m-%d %H:%M:%S"), line))
wd.logFile:flush()
end
end
w("================================================================")
w("=== Watchdog session START ===")
w(string.format("CE version: %s | Process: %s", tostring(getCEVersion and getCEVersion() or "?"), tostring(process or "?")))
w("Log path: " .. tostring(logPath))
-- ---- tee print ----
if not wd.origPrint then wd.origPrint = print end
print = function(...)
local args = {...}
local parts = {}
for i = 1, select("#", ...) do parts[i] = tostring(args[i]) end
local msg = table.concat(parts, "\t")
if wd.logFile then
wd.logFile:write(string.format("[%s] %s\n", os.date("%H:%M:%S"), msg))
wd.logFile:flush()
end
if wd.origPrint then wd.origPrint(msg) end
end
-- ---- helpers ----
local function safeReadQ(symName)
local ok, val = pcall(function()
local a = getAddressSafe(symName)
if a then return readQword(a) end
return nil
end)
if ok then return val end
return nil
end
local function safeReadI(symName)
local ok, val = pcall(function()
local a = getAddressSafe(symName)
if a then return readInteger(a) end
return nil
end)
if ok then return val end
return nil
end
local function safeWriteQ(symName, value)
local ok, wrote = pcall(function()
local a = getAddressSafe(symName)
if a then writeQword(a, value); return true end
return false
end)
return ok and wrote
end
local function recordNumber(al, id)
local r = al and al.getMemoryRecordByID(id)
if not r then return nil end
local ok, n = pcall(function() return tonumber(r.Value) end)
if ok then return n end
return nil
end
local function canaryValid()
for _, sym in ipairs(canaries) do
local p = safeReadQ(sym)
if p and p > 0x10000 and p < 0x7FFFFFFFFFFF then return true, sym end
end
return false, nil
end
local function activeCheats()
local al = getAddressList()
if not al then return {} end
local active = {}
for _, id in ipairs(allCheatIds) do
local r = al.getMemoryRecordByID(id)
if r and r.Active then
active[#active+1] = string.format("%d(%s)", id, tostring(r.Description):gsub('"',''):sub(1,30))
end
end
return active
end
local function quarantineUnsafe(al)
local disabled = {}
for _, id in ipairs(quarantinedIds) do
local r = al.getMemoryRecordByID(id)
if r and r.Active then
r.Active = false
disabled[#disabled+1] = string.format("%d(%s)", id, tostring(r.Description):gsub('"',''):sub(1,40))
end
end
if #disabled > 0 then
w(string.format("EVENT QUARANTINE disabled unsafe record(s): %s", table.concat(disabled, " | ")))
end
end
local function snapshot()
local active = activeCheats()
w(string.format("SNAPSHOT active=[%s]", table.concat(active, " | ")))
-- canaries
local cstate = {}
for _, sym in ipairs(canaries) do
local p = safeReadQ(sym)
cstate[#cstate+1] = string.format("%s=%s", sym, p and string.format("0x%X", p) or "NULL")
end
w(string.format("SNAPSHOT canaries=[%s]", table.concat(cstate, " | ")))
local flags = {}
local al = getAddressList()
for _, id in ipairs(loggedValueIds) do
local r = al and al.getMemoryRecordByID(id)
if r then flags[#flags+1] = string.format("%d(%s)=%s", id, tostring(r.Description):gsub('"',''):sub(1,30), tostring(r.Value)) end
end
if #flags > 0 then w(string.format("SNAPSHOT value_flags=[%s]", table.concat(flags, " | "))) end
local hpBase = safeReadQ("ptrCapture_INJECT_GET_CURRENT_HP_347018")
if hpBase then
local ok, hp = pcall(function() return readInteger(hpBase + 0x18) end)
if ok and hp then w(string.format("SNAPSHOT HP current=%d base=0x%X", hp, hpBase)) end
end
local thrustBase = safeReadQ("i_base_last_data_addr")
if thrustBase then
local ok, thrust = pcall(function() return readFloat(thrustBase + 0x10) end)
if ok and thrust then w(string.format("SNAPSHOT thrust current=%.3f base=0x%X", thrust, thrustBase)) end
end
local nodePtr = safeReadQ("hnode_last_ptr")
if nodePtr then
local nodeCount = safeReadI("hnode_last_count")
local nodeAux = safeReadI("hnode_last_aux")
local nodeWrites = safeReadI("hnode_writes")
local nodeRejects = safeReadI("hnode_rejects")
w(string.format("SNAPSHOT hacking_nodes ptr=0x%X count=%s aux=%s writes=%s rejects=%s",
nodePtr, tostring(nodeCount), tostring(nodeAux), tostring(nodeWrites), tostring(nodeRejects)))
end
end
local function repairStalePointers(al)
local hpMode = recordNumber(al, 9100) or 0
if hpMode == 0 then return end
local hpBase = safeReadQ("ptrCapture_INJECT_GET_CURRENT_HP_347018")
if not hpBase or hpBase == 0 then return end
local target = recordNumber(al, 23) or safeReadI("i_min_hp_value") or 1
local ok, hp = pcall(function() return readInteger(hpBase + 0x18) end)
local stale = (not ok) or (hp == nil) or (hp < target) or (hp > 2000)
if not stale then return end
if wd.lastHpPointerClearTick and (wd.tickCount - wd.lastHpPointerClearTick) < 20 then return end
wd.lastHpPointerClearTick = wd.tickCount
if safeWriteQ("ptrCapture_INJECT_GET_CURRENT_HP_347018", 0) then
w(string.format("EVENT STALE HP pointer cleared for recapture. oldBase=0x%X hp=%s target=%s mode=%s",
hpBase, tostring(hp), tostring(target), tostring(hpMode)))
end
end
-- ---- tick ----
local function tick()
wd.tickCount = wd.tickCount + 1
local safe, sym = canaryValid()
local al = getAddressList()
if not al then return end
quarantineUnsafe(al)
if wd.tickCount % 4 == 0 then
pcall(function() repairStalePointers(al) end)
end
if safe and not wd.lastSafe then
local restored = {}
for id, _ in pairs(wd.suspendedByUs) do
local r = al.getMemoryRecordByID(id)
if r and not r.Active then r.Active = true; restored[#restored+1] = tostring(id) end
end
local restoredValues = {}
for id, value in pairs(wd.suspendedValues) do
local r = al.getMemoryRecordByID(id)
local addrOk = r and r.CurrentAddress ~= nil and tostring(r.CurrentAddress) ~= "??"
if addrOk then r.Value = value; restoredValues[#restoredValues+1] = tostring(id) .. "=" .. tostring(value) end
end
wd.suspendedByUs = {}
wd.suspendedValues = {}
w(string.format("EVENT SAFE via %s. Restored: %s",
tostring(sym), (#restored > 0) and table.concat(restored, ",") or "(none)"))
if #restoredValues > 0 then
w(string.format("EVENT SAFE value flags restored: %s", table.concat(restoredValues, ",")))
end
elseif (not safe) and wd.lastSafe then
local paused = {}
for _, id in ipairs(watchedIds) do
local r = al.getMemoryRecordByID(id)
if r and r.Active then
wd.suspendedByUs[id] = true
r.Active = false
paused[#paused+1] = tostring(id)
end
end
for _, id in ipairs(watchedValueIds) do
local r = al.getMemoryRecordByID(id)
local addrOk = r and r.CurrentAddress ~= nil and tostring(r.CurrentAddress) ~= "??"
if addrOk and tostring(r.Value) ~= "0" then
wd.suspendedValues[id] = tostring(r.Value)
r.Value = "0"
paused[#paused+1] = tostring(id) .. "=0"
end
end
w(string.format("EVENT UNSAFE canaries dead. Paused: %s",
(#paused > 0) and table.concat(paused, ",") or "(none active)"))
end
wd.lastSafe = safe
-- snapshot every ~30 seconds (250ms * 120 = 30s)
if wd.tickCount % 120 == 0 then
pcall(snapshot)
end
end
wd.tick = function()
local ok, err = xpcall(tick, debug and debug.traceback or tostring)
if not ok then w("ERROR in tick: " .. tostring(err)) end
end
-- ---- start timer ----
if wd.timer then wd.timer.Enabled = false; wd.timer.destroy(); wd.timer = nil end
wd.timer = createTimer(getMainForm(), false)
wd.timer.Interval = 250
wd.timer.OnTimer = wd.tick
wd.timer.Enabled = true
w(string.format("INIT Started. Watching scripts: %s. Value flags: %s. Quarantined: %s. Canaries: %s",
table.concat(watchedIds, ","), table.concat(loggedValueIds, ","), table.concat(quarantinedIds, ","), table.concat(canaries, ",")))
pcall(snapshot)
[DISABLE]
{$lua}
if syntaxcheck then return end
local wd = _G.PRAGMATA_WATCHDOG
if not wd then return end
if wd.timer then wd.timer.Enabled = false; wd.timer.destroy(); wd.timer = nil end
local al = getAddressList()
if al and wd.suspendedByUs then
for id, _ in pairs(wd.suspendedByUs) do
local r = al.getMemoryRecordByID(id)
if r and not r.Active then r.Active = true end
end
end
if al and wd.suspendedValues then
for id, value in pairs(wd.suspendedValues) do
local r = al.getMemoryRecordByID(id)
local addrOk = r and r.CurrentAddress ~= nil and tostring(r.CurrentAddress) ~= "??"
if addrOk then r.Value = value end
end
end
wd.suspendedByUs = {}
wd.suspendedValues = {}
if wd.origPrint then
print("[Watchdog] Stopped.")
print = wd.origPrint
wd.origPrint = nil
end
if wd.logFile then
pcall(function()
wd.logFile:write(string.format("[%s] === Watchdog session END ===\n", os.date("%Y-%m-%d %H:%M:%S")))
wd.logFile:flush()
wd.logFile:close()
end)
wd.logFile = nil
end
8001
"=== SURVIVAL ==="
008000
1
18
"Health / HP"
1
19
"[NOTE] Safe attach only reads HP until HP Mode is changed"
8000FF
1
20
"[NOTE] HP Mode: 1 = minimum, 2 = freeze"
8000FF
1
604
"HP Safety Refresh (disabled - old mode toggler)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if hpMonitorTimer then
hpMonitorTimer.Enabled = false
hpMonitorTimer.destroy()
hpMonitorTimer = nil
end
if not _G.PRAGMATA_HP_REFRESH_NOTICE_SHOWN then
print("[PRAGMATA] HP Safety Refresh is disabled; HP Mode now handles minimum/freeze directly.")
_G.PRAGMATA_HP_REFRESH_NOTICE_SHOWN = true
end
local al = getAddressList()
local self = al and al.getMemoryRecordByID(604)
if self then
local t = createTimer(nil, false)
t.Interval = 50
t.OnTimer = function(timer)
timer.Enabled = false
timer.destroy()
self.Active = false
end
t.Enabled = true
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
if hpMonitorTimer then
hpMonitorTimer.Enabled = false
hpMonitorTimer.destroy()
hpMonitorTimer = nil
end
{$asm}
21
"HP Pointer Capture (required for HP Mode)"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/04/17
}
[ENABLE]
aobscanmodule(INJECT_GET_CURRENT_HP,$process,83 ?? 18 00 ?? 0F 9E ?? 31 ?? ?? 84 ?? ?? 0B)
// raw AOB: 48 8B 49 18 84 C0 74 ?? 48 85 C9 75 ?? 48 8B 47 20 48 85 C0 0F 84 ?? ?? ?? ?? 48 8B 80 A8 00 00 00 48 85 C0 0F 84 ?? ?? ?? ?? 48 8B 80 48 01 00 00 48 85 C0 0F 84 ?? ?? ?? ?? 80 78 27 00 0F 85 ?? ?? ?? ?? 83 78 18 00 40 0F 9E C7 31 C9 40 84 FF B8 0B 5B 0F CF 41 0F 44 C7 48 85 C9 44 0F 44 F8 31 ED 48 85 C9 41 0F 44 EF 48 8B 4C 24 38 48 31 E1 E8 ?? ?? ?? ?? 89 E8 48 83 C4 40 5B 5D
// injection point AOB: 83 ?? 18 00 ?? 0F 9E ?? 31 ?? ?? 84 ?? ?? 0B 5B 0F CF ?? 0F 44 ?? ?? 85 ?? ?? 0F 44 ?? 31 ?? ?? 85 ?? ?? 0F 44 ?? ?? 8B ?? 24 ?? ?? 31 ?? E8 ?? ?? ?? ?? 89 ?? 48 83 C4 40 ?? 5D
alloc(newmem,$1000,INJECT_GET_CURRENT_HP)
alloc(INJECT_GET_CURRENT_HPo, $8)
label(code)
label(return)
label(ptrCapture_INJECT_GET_CURRENT_HP_347018)
label(is_set_other_hp i_min_hp_value i_enable_hp_clamp)
INJECT_GET_CURRENT_HPo:
readmem(INJECT_GET_CURRENT_HP, $8)
newmem:
cmp qword ptr [ptrCapture_INJECT_GET_CURRENT_HP_347018], 0
jne short @F
// **** Begin Auto script: AddressCapture
// mode=Single
// Address Capture: publish base pointer
mov [ptrCapture_INJECT_GET_CURRENT_HP_347018], rax
// **** End Auto script: AddressCapture
@@:
cmp [ptrCapture_INJECT_GET_CURRENT_HP_347018], rax
jne short set_non_player_hp
cmp dword ptr [i_enable_hp_clamp], 0
je short code
push r15
mov r15d, [i_min_hp_value]
cmp dword ptr [i_enable_hp_clamp], 2
je short hold_hp_target
cmp [rax+18], r15d
jae short endp
hold_hp_target:
mov [rax+18], r15d
endp:
pop r15
jmp short code
set_non_player_hp:
cmp dword ptr [is_set_other_hp], 1
jne short code
cmp dword ptr [rax+18],00
//cmp [ptrCapture_INJECT_GET_CURRENT_HP_347018], rax
//je short code
cmp [rax+18], 64
jae short code
mov [rax+18], 64
code:
// cmp dword ptr [rax+18],00
reassemble(INJECT_GET_CURRENT_HP)
// setle dil
reassemble(INJECT_GET_CURRENT_HP+4)
jmp return
align 10 cc
ptrCapture_INJECT_GET_CURRENT_HP_347018:
dq 0
i_min_hp_value:
dd #750
i_enable_hp_clamp:
dd 0
is_set_other_hp:
dd 0
INJECT_GET_CURRENT_HP:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_CURRENT_HP INJECT_GET_CURRENT_HPo ptrCapture_INJECT_GET_CURRENT_HP_347018)
registersymbol(is_set_other_hp i_min_hp_value i_enable_hp_clamp)
[DISABLE]
INJECT_GET_CURRENT_HP:
readmem(INJECT_GET_CURRENT_HPo, $8)
unregistersymbol(INJECT_GET_CURRENT_HP INJECT_GET_CURRENT_HPo ptrCapture_INJECT_GET_CURRENT_HP_347018)
unregistersymbol(is_set_other_hp i_min_hp_value i_enable_hp_clamp)
dealloc(newmem)
dealloc(INJECT_GET_CURRENT_HPo)
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+15D6D9
PRAGMATA.exe+15D695: 48 8B 49 18 - mov rcx,[rcx+18]
PRAGMATA.exe+15D699: 84 C0 - test al,al
PRAGMATA.exe+15D69B: 74 59 - je PRAGMATA.exe+15D6F6
PRAGMATA.exe+15D69D: 48 85 C9 - test rcx,rcx
PRAGMATA.exe+15D6A0: 75 54 - jne PRAGMATA.exe+15D6F6
PRAGMATA.exe+15D6A2: 48 8B 47 20 - mov rax,[rdi+20]
PRAGMATA.exe+15D6A6: 48 85 C0 - test rax,rax
PRAGMATA.exe+15D6A9: 0F 84 A5 06 00 00 - je PRAGMATA.exe+15DD54
PRAGMATA.exe+15D6AF: 48 8B 80 A8 00 00 00 - mov rax,[rax+000000A8]
PRAGMATA.exe+15D6B6: 48 85 C0 - test rax,rax
PRAGMATA.exe+15D6B9: 0F 84 B6 06 00 00 - je PRAGMATA.exe+15DD75
PRAGMATA.exe+15D6BF: 48 8B 80 48 01 00 00 - mov rax,[rax+00000148]
PRAGMATA.exe+15D6C6: 48 85 C0 - test rax,rax
PRAGMATA.exe+15D6C9: 0F 84 C3 06 00 00 - je PRAGMATA.exe+15DD92
PRAGMATA.exe+15D6CF: 80 78 27 00 - cmp byte ptr [rax+27],00
PRAGMATA.exe+15D6D3: 0F 85 D8 06 00 00 - jne PRAGMATA.exe+15DDB1
// ---------- INJECTING HERE ----------
PRAGMATA.exe+15D6D9: 83 78 18 00 - cmp dword ptr [rax+18],00
// ---------- DONE INJECTING ----------
PRAGMATA.exe+15D6DD: 40 0F 9E C7 - setle dil
PRAGMATA.exe+15D6E1: 31 C9 - xor ecx,ecx
PRAGMATA.exe+15D6E3: 40 84 FF - test dil,dil
PRAGMATA.exe+15D6E6: B8 0B 5B 0F CF - mov eax,CF0F5B0B
PRAGMATA.exe+15D6EB: 41 0F 44 C7 - cmove eax,r15d
PRAGMATA.exe+15D6EF: 48 85 C9 - test rcx,rcx
PRAGMATA.exe+15D6F2: 44 0F 44 F8 - cmove r15d,eax
PRAGMATA.exe+15D6F6: 31 ED - xor ebp,ebp
PRAGMATA.exe+15D6F8: 48 85 C9 - test rcx,rcx
PRAGMATA.exe+15D6FB: 41 0F 44 EF - cmove ebp,r15d
PRAGMATA.exe+15D6FF: 48 8B 4C 24 38 - mov rcx,[rsp+38]
PRAGMATA.exe+15D704: 48 31 E1 - xor rcx,rsp
PRAGMATA.exe+15D707: E8 E4 7C EC 04 - call PRAGMATA.AK::SoundEngine::Term+7F0
PRAGMATA.exe+15D70C: 89 E8 - mov eax,ebp
PRAGMATA.exe+15D70E: 48 83 C4 40 - add rsp,40
PRAGMATA.exe+15D712: 5B - pop rbx
}
22
"Current HP (read-only)"
0
FF8080
4 Bytes
ptrCapture_INJECT_GET_CURRENT_HP_347018
18
23
"HP Target Value"
0
C08000
4 Bytes
i_min_hp_value
9100
"HP Mode"
0:Off
1:Minimum based on HP Target Value
2:Freeze HP Value
0
C08000
4 Bytes
i_enable_hp_clamp
25
"Thrust / Booster"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/04/17
}
[ENABLE]
aobscanmodule(FAST_DIANA_OVERDRIVE,$process,C5 ?? 11 ?? 10 ?? 8B ?? 50 ?? 83 ?? 18 00 74 ?? C5 ?? 57)
// raw AOB: C5 F8 2E DA 73 ?? C5 F8 2E C1 C5 FA 10 5A 14 76 ?? C5 F8 2E D3 72 ?? C3 C5 F8 2E C1 77 ?? C5 EA 5D C1 C5 EA 5C C9 C5 F2 5D D3 C5 E0 57 DB C5 F2 C2 CB 01 C5 F0 55 CA C5 FA 11 4A 10 48 8B 41 50 48 83 78 18 00 74 ?? C5 F8 57 C0 EB ?? C4 E2 79 18 05 ?? ?? ?? ?? C5 F0 57 C0 C5 E2 5C E2 C5 DA 5D C0 EB ?? CC CC CC CC CC CC
// injection point AOB: C5 ?? 11 ?? 10 ?? 8B ?? 50 ?? 83 ?? 18 00 74 ?? C5 ?? 57 ?? EB ?? C4 ?? ?? 18 ?? ?? ?? ?? ?? C5 ?? 57 ?? C5 ?? 5C ?? C5 ?? 5D ?? EB ?? CC CC CC CC CC CC
alloc(newmem,$1000,FAST_DIANA_OVERDRIVE)
alloc(FAST_DIANA_OVERDRIVEo, $5)
label(code)
label(return)
label(i_base_last_data_addr i_enable_thrust_fill f_thrust_fill_target)
// 100f = overdrive full
// 1000f = thruster full
FAST_DIANA_OVERDRIVEo:
readmem(FAST_DIANA_OVERDRIVE, $5)
newmem:
mov [i_base_last_data_addr], rdx
cmp dword ptr [i_enable_thrust_fill], 1
jne short code
movss xmm1, [f_thrust_fill_target]
jmp short code
code:
// vmovss [rdx+10],xmm1
reassemble(FAST_DIANA_OVERDRIVE)
jmp return
align 10 cc
vf_100:
dd (float)100
vf_500:
dd (float)500
vf_800:
dd (float)800
i_base_last_data_addr:
dq 0
i_enable_thrust_fill:
dd 0
f_thrust_fill_target:
dd (float)1000
FAST_DIANA_OVERDRIVE:
jmp newmem
return:
registersymbol(FAST_DIANA_OVERDRIVE FAST_DIANA_OVERDRIVEo)
registersymbol(i_base_last_data_addr i_enable_thrust_fill f_thrust_fill_target)
[DISABLE]
FAST_DIANA_OVERDRIVE:
readmem(FAST_DIANA_OVERDRIVEo, $5)
unregistersymbol(FAST_DIANA_OVERDRIVE FAST_DIANA_OVERDRIVEo)
unregistersymbol(i_base_last_data_addr i_enable_thrust_fill f_thrust_fill_target)
dealloc(newmem)
dealloc(FAST_DIANA_OVERDRIVEo)
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+899D48
PRAGMATA.exe+899D11: C5 F8 2E DA - vucomiss xmm3,xmm2
PRAGMATA.exe+899D15: 73 11 - jae PRAGMATA.exe+899D28
PRAGMATA.exe+899D17: C5 F8 2E C1 - vucomiss xmm0,xmm1
PRAGMATA.exe+899D1B: C5 FA 10 5A 14 - vmovss xmm3,[rdx+14]
PRAGMATA.exe+899D20: 76 07 - jna PRAGMATA.exe+899D29
PRAGMATA.exe+899D22: C5 F8 2E D3 - vucomiss xmm2,xmm3
PRAGMATA.exe+899D26: 72 01 - jb PRAGMATA.exe+899D29
PRAGMATA.exe+899D28: C3 - ret
PRAGMATA.exe+899D29: C5 F8 2E C1 - vucomiss xmm0,xmm1
PRAGMATA.exe+899D2D: 77 2F - ja PRAGMATA.exe+899D5E
PRAGMATA.exe+899D2F: C5 EA 5D C1 - vminss xmm0,xmm2,xmm1
PRAGMATA.exe+899D33: C5 EA 5C C9 - vsubss xmm1,xmm2,xmm1
PRAGMATA.exe+899D37: C5 F2 5D D3 - vminss xmm2,xmm1,xmm3
PRAGMATA.exe+899D3B: C5 E0 57 DB - vxorps xmm3,xmm3,xmm3
PRAGMATA.exe+899D3F: C5 F2 C2 CB 01 - vcmpltss xmm1,xmm1,xmm3
PRAGMATA.exe+899D44: C5 F0 55 CA - vandnps xmm1,xmm1,xmm2
// ---------- INJECTING HERE ----------
PRAGMATA.exe+899D48: C5 FA 11 4A 10 - vmovss [rdx+10],xmm1
// ---------- DONE INJECTING ----------
PRAGMATA.exe+899D4D: 48 8B 41 50 - mov rax,[rcx+50]
PRAGMATA.exe+899D51: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+899D56: 74 D0 - je PRAGMATA.exe+899D28
PRAGMATA.exe+899D58: C5 F8 57 C0 - vxorps xmm0,xmm0,xmm0
PRAGMATA.exe+899D5C: EB CA - jmp PRAGMATA.exe+899D28
PRAGMATA.exe+899D5E: C4 E2 79 18 05 31 E3 71 08 - vbroadcastss xmm0,[PRAGMATA.exe+8FB8098]
PRAGMATA.exe+899D67: C5 F0 57 C0 - vxorps xmm0,xmm1,xmm0
PRAGMATA.exe+899D6B: C5 E2 5C E2 - vsubss xmm4,xmm3,xmm2
PRAGMATA.exe+899D6F: C5 DA 5D C0 - vminss xmm0,xmm4,xmm0
PRAGMATA.exe+899D73: EB BE - jmp PRAGMATA.exe+899D33
PRAGMATA.exe+899D75: CC - int 3
PRAGMATA.exe+899D76: CC - int 3
PRAGMATA.exe+899D77: CC - int 3
PRAGMATA.exe+899D78: CC - int 3
PRAGMATA.exe+899D79: CC - int 3
PRAGMATA.exe+899D7A: CC - int 3
}
26
"Current Thrust (read-only; updates after thrust use)"
0
FF8080
Float
i_base_last_data_addr
10
9101
"Thrust Mode"
0:Off
1:Freeze Thrust at Target Value
0
C08000
4 Bytes
i_enable_thrust_fill
9102
"Thrust Target Value"
0
C08000
Float
f_thrust_fill_target
8002
"=== WEAPONS ==="
C00000
1
2
"Ammo: Keep Minimum / Refill"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/04/17
}
[ENABLE]
aobscanmodule(INJECT_GET_REM_BULLETS,$process,8B ?? 18 ?? 31 ?? ?? ?? F8 FF)
// raw AOB: 8B 48 08 E8 ?? ?? ?? ?? 48 89 44 24 50 4C 89 7C 24 48 48 85 DB 0F 84 ?? ?? ?? ?? 4C 8D 44 24 30 48 89 F1 48 89 DA E8 ?? ?? ?? ?? 48 8B 4E 50 4C 8B 71 18 4D 85 F6 0F 85 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 8B 58 18 45 31 F6 49 BC F8 FF FF FF FF FF FF 7F 49 21 FC 4D 8B 3C 24 4D 85 FF 74 ?? E8 ?? ?? ?? ?? 48 98 41 8A 4C 07 58 84 C9 7E ?? FE C9 41 88 4C 07 58 75 ?? 49 83 C7 10 4C 89 F9 E8
// injection point AOB: 8B ?? 18 ?? 31 ?? ?? ?? F8 FF FF FF FF FF FF 7F ?? 21 ?? ?? 8B ?? 24 ?? 85 ?? 74 ?? E8 ?? ?? ?? ?? 48 98 ?? 8A ?? 07 58 84 ?? 7E ?? FE ?? ?? 88 ?? 07 58 75 ?? ?? 83 ?? 10 ?? 89 ?? E8
alloc(newmem,$1000,INJECT_GET_REM_BULLETS)
alloc(INJECT_GET_REM_BULLETSo, $6)
label(code)
label(return)
label(vc_min_864515)
label(vc_min_t3 vc_min_t2)
INJECT_GET_REM_BULLETSo:
readmem(INJECT_GET_REM_BULLETS, $6)
// app.InventManager->GadgetSlotTable-><GadgetSlotInfo>
newmem:
// **** Begin Auto script: Clamp
// min=3
code:
// mov ebx,[rax+18]
reassemble(INJECT_GET_REM_BULLETS)
// Clamp: min check
cmp ebx, [vc_min_t3]
jge short set_100
cmp ebx, [vc_min_t2]
jge short set_21
cmp ebx, [vc_min_864515]
jge skip_min_864515
mov ebx, [vc_min_864515]
mov [rax+18], ebx
jmp short skip_min_864515
set_21:
mov ebx, #50
mov [rax+18], ebx
jmp short skip_min_864515
set_100:
mov ebx, #300
mov [rax+18], ebx
skip_min_864515:
// **** End Auto script: Clamp
// xor r14d,r14d
reassemble(INJECT_GET_REM_BULLETS+3)
jmp return
align 10 cc
vc_min_864515:
dd 3
vc_min_t3:
dd 40
vc_min_t2:
dd D
INJECT_GET_REM_BULLETS:
jmp newmem
nop 1
return:
registersymbol(INJECT_GET_REM_BULLETS INJECT_GET_REM_BULLETSo vc_min_864515)
registersymbol(vc_min_t3 vc_min_t2)
[DISABLE]
INJECT_GET_REM_BULLETS:
readmem(INJECT_GET_REM_BULLETSo, $6)
unregistersymbol(INJECT_GET_REM_BULLETS INJECT_GET_REM_BULLETSo vc_min_864515)
unregistersymbol(vc_min_t3 vc_min_t2)
dealloc(newmem)
dealloc(INJECT_GET_REM_BULLETSo)
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+D3068
PRAGMATA.exe+D3023: 8B 48 08 - mov ecx,[rax+08]
PRAGMATA.exe+D3026: E8 D5 4A BE 04 - call PRAGMATA.exe+4CB7B00
PRAGMATA.exe+D302B: 48 89 44 24 50 - mov [rsp+50],rax
PRAGMATA.exe+D3030: 4C 89 7C 24 48 - mov [rsp+48],r15
PRAGMATA.exe+D3035: 48 85 DB - test rbx,rbx
PRAGMATA.exe+D3038: 0F 84 16 01 00 00 - je PRAGMATA.exe+D3154
PRAGMATA.exe+D303E: 4C 8D 44 24 30 - lea r8,[rsp+30]
PRAGMATA.exe+D3043: 48 89 F1 - mov rcx,rsi
PRAGMATA.exe+D3046: 48 89 DA - mov rdx,rbx
PRAGMATA.exe+D3049: E8 72 E0 D6 04 - call PRAGMATA.exe+4E410C0
PRAGMATA.exe+D304E: 48 8B 4E 50 - mov rcx,[rsi+50]
PRAGMATA.exe+D3052: 4C 8B 71 18 - mov r14,[rcx+18]
PRAGMATA.exe+D3056: 4D 85 F6 - test r14,r14
PRAGMATA.exe+D3059: 0F 85 0F 01 00 00 - jne PRAGMATA.exe+D316E
PRAGMATA.exe+D305F: 48 85 C0 - test rax,rax
PRAGMATA.exe+D3062: 0F 84 9C 00 00 00 - je PRAGMATA.exe+D3104
// ---------- INJECTING HERE ----------
PRAGMATA.exe+D3068: 8B 58 18 - mov ebx,[rax+18]
// ---------- DONE INJECTING ----------
PRAGMATA.exe+D306B: 45 31 F6 - xor r14d,r14d
PRAGMATA.exe+D306E: 49 BC F8 FF FF FF FF FF FF 7F - mov r12,7FFFFFFFFFFFFFF8
PRAGMATA.exe+D3078: 49 21 FC - and r12,rdi
PRAGMATA.exe+D307B: 4D 8B 3C 24 - mov r15,[r12]
PRAGMATA.exe+D307F: 4D 85 FF - test r15,r15
PRAGMATA.exe+D3082: 74 4B - je PRAGMATA.exe+D30CF
PRAGMATA.exe+D3084: E8 B7 34 BE 04 - call PRAGMATA.exe+4CB6540
PRAGMATA.exe+D3089: 48 98 - cdqe
PRAGMATA.exe+D308B: 41 8A 4C 07 58 - mov cl,[r15+rax+58]
PRAGMATA.exe+D3090: 84 C9 - test cl,cl
PRAGMATA.exe+D3092: 7E 22 - jle PRAGMATA.exe+D30B6
PRAGMATA.exe+D3094: FE C9 - dec cl
PRAGMATA.exe+D3096: 41 88 4C 07 58 - mov [r15+rax+58],cl
PRAGMATA.exe+D309B: 75 19 - jne PRAGMATA.exe+D30B6
PRAGMATA.exe+D309D: 49 83 C7 10 - add r15,10
PRAGMATA.exe+D30A1: 4C 89 F9 - mov rcx,r15
}
3
"Ammo Minimum (default 3)"
0
C08000
4 Bytes
vc_min_864515
4
"Ammo Refill Tier 2 Threshold (default 13)"
0
C08000
4 Bytes
vc_min_t2
5
"Ammo Refill Tier 3 Threshold (default 64)"
0
C08000
4 Bytes
vc_min_t3
605
"Damage: One-Hit Kill (normal combat)"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/04/26
}
[ENABLE]
aobscanmodule(INJECT_FAST_KILL,$process,0F 84 ?? ?? ?? ?? 80 ?? 27 00 75 ?? 83 ?? 18 00 0F 9E ?? 84 ?? 75)
// raw AOB: 48 8B 87 90 00 00 00 48 85 C0 0F 84 ?? ?? ?? ?? F6 80 81 00 00 00 40 75 ?? 48 8B 93 68 02 00 00 48 85 D2 74 ?? 48 89 F1 49 89 F8 E8 ?? ?? ?? ?? 48 8B 46 50 48 83 78 18 00 0F 85 ?? ?? ?? ?? 48 8B 83 48 01 00 00 48 85 C0 0F 84 ?? ?? ?? ?? 80 78 27 00 75 ?? 83 78 18 00 0F 9E C0 84 C0 75 ?? 48 8B 93 58 01 00 00 48 85 D2 74 ?? 48 89 F1 49 89 F8 E8 ?? ?? ?? ?? 48 8B 46 50 48 83 78 18 00 75 ?? 48 8B 03
// injection point AOB: 0F 84 ?? ?? ?? ?? 80 ?? 27 00 75 ?? 83 ?? 18 00 0F 9E ?? 84 ?? 75 ?? ?? 8B ?? 58 01 00 00 ?? 85 ?? 74 ?? ?? 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? ?? 8B ?? 50 ?? 83 ?? 18 00 75 ?? ?? 8B
alloc(newmem,$1000)
alloc(INJECT_FAST_KILLo, $10)
label(code)
label(return)
INJECT_FAST_KILLo:
readmem(INJECT_FAST_KILL, $10)
newmem:
code:
// je PRAGMATA.exe+6C905D
reassemble(INJECT_FAST_KILL)
// cmp byte ptr [rax+27],00
reassemble(INJECT_FAST_KILL+6)
// jne PRAGMATA.exe+6C8FE7
reassemble(INJECT_FAST_KILL+A)
// code start
cmp dword ptr [rax+38], 0 // or 5C float=1 = player
jne short @F
cmp dword ptr [rax+18], 1
jbe short @F
mov dword ptr [rax+18], 1
@@:
// code end
// cmp dword ptr [rax+18],00
reassemble(INJECT_FAST_KILL+C)
jmp far return
align 10 cc
INJECT_FAST_KILL:
jmp far newmem
nop 2
return:
registersymbol(INJECT_FAST_KILL INJECT_FAST_KILLo)
[DISABLE]
INJECT_FAST_KILL:
readmem(INJECT_FAST_KILLo, $10)
unregistersymbol(INJECT_FAST_KILL INJECT_FAST_KILLo)
dealloc(newmem)
dealloc(INJECT_FAST_KILLo)
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+6C8FD0
PRAGMATA.exe+6C8F87: 48 8B 87 90 00 00 00 - mov rax,[rdi+00000090]
PRAGMATA.exe+6C8F8E: 48 85 C0 - test rax,rax
PRAGMATA.exe+6C8F91: 0F 84 8F 00 00 00 - je PRAGMATA.exe+6C9026
PRAGMATA.exe+6C8F97: F6 80 81 00 00 00 40 - test byte ptr [rax+00000081],40
PRAGMATA.exe+6C8F9E: 75 26 - jne PRAGMATA.exe+6C8FC6
PRAGMATA.exe+6C8FA0: 48 8B 93 68 02 00 00 - mov rdx,[rbx+00000268]
PRAGMATA.exe+6C8FA7: 48 85 D2 - test rdx,rdx
PRAGMATA.exe+6C8FAA: 74 7A - je PRAGMATA.exe+6C9026
PRAGMATA.exe+6C8FAC: 48 89 F1 - mov rcx,rsi
PRAGMATA.exe+6C8FAF: 49 89 F8 - mov r8,rdi
PRAGMATA.exe+6C8FB2: E8 C9 00 00 00 - call PRAGMATA.exe+6C9080
PRAGMATA.exe+6C8FB7: 48 8B 46 50 - mov rax,[rsi+50]
PRAGMATA.exe+6C8FBB: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+6C8FC0: 0F 85 8F 00 00 00 - jne PRAGMATA.exe+6C9055
PRAGMATA.exe+6C8FC6: 48 8B 83 48 01 00 00 - mov rax,[rbx+00000148]
PRAGMATA.exe+6C8FCD: 48 85 C0 - test rax,rax
// ---------- INJECTING HERE ----------
PRAGMATA.exe+6C8FD0: 0F 84 87 00 00 00 - je PRAGMATA.exe+6C905D
// ---------- DONE INJECTING ----------
PRAGMATA.exe+6C8FD6: 80 78 27 00 - cmp byte ptr [rax+27],00
PRAGMATA.exe+6C8FDA: 75 0B - jne PRAGMATA.exe+6C8FE7
PRAGMATA.exe+6C8FDC: 83 78 18 00 - cmp dword ptr [rax+18],00
PRAGMATA.exe+6C8FE0: 0F 9E C0 - setle al
PRAGMATA.exe+6C8FE3: 84 C0 - test al,al
PRAGMATA.exe+6C8FE5: 75 6E - jne PRAGMATA.exe+6C9055
PRAGMATA.exe+6C8FE7: 48 8B 93 58 01 00 00 - mov rdx,[rbx+00000158]
PRAGMATA.exe+6C8FEE: 48 85 D2 - test rdx,rdx
PRAGMATA.exe+6C8FF1: 74 33 - je PRAGMATA.exe+6C9026
PRAGMATA.exe+6C8FF3: 48 89 F1 - mov rcx,rsi
PRAGMATA.exe+6C8FF6: 49 89 F8 - mov r8,rdi
PRAGMATA.exe+6C8FF9: E8 E2 B7 00 00 - call PRAGMATA.exe+6D47E0
PRAGMATA.exe+6C8FFE: 48 8B 46 50 - mov rax,[rsi+50]
PRAGMATA.exe+6C9002: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+6C9007: 75 4C - jne PRAGMATA.exe+6C9055
PRAGMATA.exe+6C9009: 48 8B 03 - mov rax,[rbx]
}
9010
"Weapon: No Recoil"
Auto Assembler Script
// ===========================================================
// NO RECOIL
// ===========================================================
// Hook target: the recoil decision in PRAGMATA's weapon code.
// Original: JNE (0F 85) — jumps OVER the no-recoil branch when recoil should apply.
// Patch: NOP + JMP unconditional (90 E9) — always takes the no-recoil branch.
// Net effect: every shot resolves as "no recoil applied".
// ===========================================================
[ENABLE]
aobscanmodule(aobrecoil,PRAGMATA.exe,0F 85 ?? ?? 00 00 ?? 8B ?? ?? ?? 85 ?? 0F 84 ?? ?? 00 00 ?? 8B ?? ?? ?? 85 ?? 0F 84 ?? ?? 00 00 C5 ?? 28 ?? C5 ?? 5A ?? 20)
aobrecoil:
db 90 E9 // NOP + JMP rel8 (was JNE rel32)
registersymbol(aobrecoil)
[DISABLE]
aobrecoil:
db 0F 85 // restore original JNE opcode
unregistersymbol(aobrecoil)
9020
"Weapon: Rapid Fire"
Auto Assembler Script
// RAPID FIRE (with pointer guard)
// Skips our cooldown override if rax (weapon struct) is invalid.
[ENABLE]
aobscanmodule(aobrapidfire,PRAGMATA.exe,48 C7 40 24 00 00 00 00 C6 ?? 2C 00 ?? 8B ?? ?? ?? 83 ?? ?? 00 75 ?? ?? 8B ?? ?? ?? 85 ?? 74 ?? ?? 8B ?? ?? ?? 85 ?? 74 ?? ?? 8B ?? ?? ?? 85)
alloc(newmem,$1000,aobrapidfire)
label(safe_run)
label(skip_cheat)
label(return)
label(min_value)
newmem:
// pointer guard: rax must look like a real heap pointer (above 0x10000)
test rax,rax
jz skip_cheat
cmp rax,10000
jbe skip_cheat
safe_run:
mov qword ptr [rax+24],00000000
movups [newmem+F00],xmm0
movss xmm0,[rax+14]
subss xmm0,[min_value]
movss [rax+24],xmm0
movups xmm0,[newmem+F00]
jmp return
skip_cheat:
// run original behaviour: just zero the cooldown slot (this is what the game intended)
mov qword ptr [rax+24],00000000
jmp return
newmem+300:
min_value:
dd (float)0.01
aobrapidfire:
jmp newmem
nop 3
return:
registersymbol(aobrapidfire)
[DISABLE]
aobrapidfire:
db 48 C7 40 24 00 00 00 00
unregistersymbol(aobrapidfire)
dealloc(newmem)
8003
"=== HACKING ==="
800080
1
24
"Legacy Hacking Nodes (disabled; use Safe Test)"
Auto Assembler Script
// QUARANTINED
// Old implementation injected into active perk list construction and wrote:
// or dword ptr [r15+14], 2
// The crash evidence points at hacking-start code after this structural count write.
// This record is now intentionally a no-op. Use the other hacking records for timer,
// gauge/open-style behavior, and damage; do not mutate ActiveSkillUnits counts here.
[ENABLE]
{$lua}
if syntaxcheck then return end
local msg = "[PRAGMATA] Infinite Hacking Nodes is quarantined: unsafe ActiveSkillUnits count write removed."
if not _G.PRAGMATA_HNODE_QUARANTINE_NOTICE_SHOWN then
print(msg)
_G.PRAGMATA_HNODE_QUARANTINE_NOTICE_SHOWN = true
end
local wd = rawget(_G, "PRAGMATA_WATCHDOG")
if wd and wd.logFile then
wd.logFile:write(string.format("[%s] %s\n", os.date("%Y-%m-%d %H:%M:%S"), msg))
wd.logFile:flush()
end
local al = getAddressList()
local self = al and al.getMemoryRecordByID(24)
if self then
local t = createTimer(nil, false)
t.Interval = 100
t.OnTimer = function(timer)
timer.Enabled = false
timer.destroy()
self.Active = false
end
t.Enabled = true
end
{$asm}
[DISABLE]
9103
"Hacking Nodes: Safe Test"
Auto Assembler Script
// SAFE HACKING NODES TEST
// Replaces the old crashy active-skill count write:
// old: or dword ptr [r15+14], 2
// This hook defaults to observe-only. When enabled through Hacking Nodes Mode,
// it only raises small sane counts to the target value and logs rejects.
[ENABLE]
aobscanmodule(INJECT_HACKNODE_SAFE,$process,?? 8B ?? 14 ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? ?? 31 ?? E8 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? 10 ?? 8B ?? 50 ?? 8B ?? 18 ?? 85 ?? 0F 85 ?? ?? ?? ?? ?? 89)
alloc(newmem_hnode,$1000,INJECT_HACKNODE_SAFE)
alloc(INJECT_HACKNODE_SAFEo,$B)
label(code_hnode)
label(return_hnode)
label(skip_hnode)
label(reject_hnode)
label(hnode_mode hnode_target hnode_last_ptr hnode_last_aux hnode_last_count hnode_hits hnode_writes hnode_rejects)
INJECT_HACKNODE_SAFEo:
readmem(INJECT_HACKNODE_SAFE,$B)
newmem_hnode:
push rax
push rcx
test r15,r15
jz skip_hnode
cmp r15,10000
jbe skip_hnode
mov [hnode_last_ptr],r15
mov eax,[r15+10]
mov [hnode_last_aux],eax
mov eax,[r15+14]
mov [hnode_last_count],eax
inc dword ptr [hnode_hits]
cmp dword ptr [hnode_mode],1
jne skip_hnode
// Only touch plausible small positive counts. Never create nodes from 0.
cmp eax,1
jl reject_hnode
cmp eax,4
ja reject_hnode
mov ecx,[hnode_target]
cmp ecx,1
jl reject_hnode
cmp ecx,4
ja reject_hnode
cmp eax,ecx
jae skip_hnode
mov [r15+14],ecx
mov [hnode_last_count],ecx
inc dword ptr [hnode_writes]
jmp skip_hnode
reject_hnode:
inc dword ptr [hnode_rejects]
skip_hnode:
pop rcx
pop rax
code_hnode:
// mov edi,[r15+14]
reassemble(INJECT_HACKNODE_SAFE)
// mov rdx,[PRAGMATA.exe+B93F700]
reassemble(INJECT_HACKNODE_SAFE+4)
jmp return_hnode
align 10 cc
hnode_mode:
dd 0
hnode_target:
dd 2
hnode_last_ptr:
dq 0
hnode_last_aux:
dd 0
hnode_last_count:
dd 0
hnode_hits:
dd 0
hnode_writes:
dd 0
hnode_rejects:
dd 0
INJECT_HACKNODE_SAFE:
jmp newmem_hnode
nop 6
return_hnode:
registersymbol(INJECT_HACKNODE_SAFE INJECT_HACKNODE_SAFEo)
registersymbol(hnode_mode hnode_target hnode_last_ptr hnode_last_aux hnode_last_count hnode_hits hnode_writes hnode_rejects)
[DISABLE]
INJECT_HACKNODE_SAFE:
readmem(INJECT_HACKNODE_SAFEo,$B)
unregistersymbol(INJECT_HACKNODE_SAFE INJECT_HACKNODE_SAFEo)
unregistersymbol(hnode_mode hnode_target hnode_last_ptr hnode_last_aux hnode_last_count hnode_hits hnode_writes hnode_rejects)
dealloc(newmem_hnode)
dealloc(INJECT_HACKNODE_SAFEo)
9104
"Hacking Nodes Mode"
0:Observe only
1:Minimum based on Hacking Nodes Target Value
0
C08000
4 Bytes
hnode_mode
9105
"Hacking Nodes Target Value (1-4)"
0
C08000
4 Bytes
hnode_target
9106
"Observed Node Count (read-only)"
0
FF8080
4 Bytes
hnode_last_count
9107
"Observed Aux Count (read-only)"
0
FF8080
4 Bytes
hnode_last_aux
9108
"Observed Hook Hits (read-only)"
0
FF8080
4 Bytes
hnode_hits
9109
"Safe Writes Applied (read-only)"
0
FF8080
4 Bytes
hnode_writes
9110
"Unsafe Writes Rejected (read-only)"
0
FF8080
4 Bytes
hnode_rejects
9050
"Hacking Timer: Freeze / Max"
Auto Assembler Script
// INFINITE HACKING TIMER (with pointer guard)
// Skips xmm0 override if rdi (hacking ctx) is invalid.
[ENABLE]
aobscanmodule(aobinfhackingtimer,PRAGMATA.exe,48 8B 97 ?? ?? 00 00 ?? 85 ?? 0F 84 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? C5 F8 28 D0 FF ?? ?? ?? 00 00)
alloc(newmem,$1000,aobinfhackingtimer)
label(skip)
label(original)
label(return)
newmem:
// guard: rdi must be a heap pointer
test rdi,rdi
jz skip
cmp rdi,10000
jbe skip
mov edx,(float)99999
movd xmm0,edx
skip:
original:
readmem(aobinfhackingtimer,7)
jmp return
aobinfhackingtimer:
jmp newmem
nop 2
return:
registersymbol(aobinfhackingtimer)
[DISABLE]
aobinfhackingtimer:
readmem(original,7)
unregistersymbol(aobinfhackingtimer)
dealloc(newmem)
9040
"Puzzle Timer: Freeze"
Auto Assembler Script
// PUZZLE TIMER FREEZE (with pointer guard)
// Skips our zero-write if rcx (puzzle struct) is invalid.
[ENABLE]
aobscanmodule(aobpuzzletimer,PRAGMATA.exe,76 ?? ?? 85 ?? 75 ?? C5 F2 5C 41 24 C5 ?? 5D ?? C5)
alloc(newmem,$1000,aobpuzzletimer)
label(skip)
label(return)
newmem:
// guard: rcx must be a heap pointer
test rcx,rcx
jz skip
cmp rcx,10000
jbe skip
mov [rcx+24],0
skip:
vsubss xmm0,xmm1,[rcx+24]
jmp return
aobpuzzletimer+7:
jmp newmem
return:
registersymbol(aobpuzzletimer)
[DISABLE]
aobpuzzletimer+7:
db C5 F2 5C 41 24
unregistersymbol(aobpuzzletimer)
dealloc(newmem)
9030
"Hacking Damage"
Auto Assembler Script
// HACKING DAMAGE BOOST (with pointer guards)
// Skips writes if r8 (per-tick) or rbx (fatal) are invalid.
[ENABLE]
aobscanmodule(aobhackingdmg,PRAGMATA.exe,41 8B 40 50 89 42 68 ?? 8B ?? ?? ?? 83 ?? ?? 00 0F 85 ?? ?? 00 00)
alloc(newmem_hd,$1000,aobhackingdmg)
label(code_hd)
label(return_hd)
label(hackingdmg)
label(hackingdmgmul_f)
registersymbol(hackingdmg)
registersymbol(hackingdmgmul_f)
newmem_hd:
// guard: r8 must be a heap pointer
test r8,r8
jz code_hd
cmp r8,10000
jbe code_hd
cmp [hackingdmgmul_f],0
jle @f
fild [r8+4C]
fmul [hackingdmgmul_f]
fistp [r8+4C]
fild [r8+50]
fmul [hackingdmgmul_f]
fistp [r8+50]
@@:
cmp [hackingdmg],0
jle code_hd
mov [r8+4C],#999999
mov [r8+50],#999999
code_hd:
mov eax,[r8+50]
mov [rdx+68],eax
jmp return_hd
newmem_hd+200:
hackingdmg:
dd 0
hackingdmgmul_f:
dd (float)1.0
aobhackingdmg:
jmp newmem_hd
nop 2
return_hd:
registersymbol(aobhackingdmg)
aobscanmodule(aobhackingfataldmg,PRAGMATA.exe,C5 FB 2C E8 89 6B 50 ?? 8B ?? ?? ?? 83 ?? ?? 00)
alloc(newmem_hfd,$1000,aobhackingfataldmg)
label(code_hfd)
label(return_hfd)
newmem_hfd:
cvtsd2ss xmm0,xmm0
// guard: rbx must be a heap pointer for the fatal-damage write
test rbx,rbx
jz code_hfd
cmp rbx,10000
jbe code_hfd
cmp [hackingdmgmul_f],0
jle @f
mulss xmm0,[hackingdmgmul_f]
@@:
cmp [hackingdmg],1
jne code_hfd
mov eax,(float)999999
movd xmm0,eax
code_hfd:
cvtss2si ebp,xmm0
mov [rbx+50],ebp
jmp return_hfd
aobhackingfataldmg:
jmp newmem_hfd
nop 2
return_hfd:
registersymbol(aobhackingfataldmg)
[DISABLE]
aobhackingfataldmg:
db C5 FB 2C E8 89 6B 50
unregistersymbol(aobhackingfataldmg)
dealloc(newmem_hfd)
aobhackingdmg:
db 41 8B 40 50 89 42 68
unregistersymbol(aobhackingdmg)
unregistersymbol(hackingdmg)
unregistersymbol(hackingdmgmul_f)
dealloc(newmem_hd)
9031
"Hacking One-Hit Kill"
0:Off
1:On (999999 damage)
0
4 Bytes
hackingdmg
9032
"Hacking Damage Multiplier"
3F800000:1x (Normal)
40000000:2x
40400000:3x
40A00000:5x
41200000:10x
42C80000:100x
0
Float
hackingdmgmul_f
578
"Hacking Timing Values (advanced)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not AOBScanModule then
function AOBScanModule(moduleName, signature)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then return nil end
local ms = createMemScan()
synchronize(function()
ms.firstScan(soExactValue, vtByteArray, nil, signature,
nil, baseAddr, maxAddr, '+X-C-W', fsmNotAligned, '1', true, true, false, false)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
results.destroy()
ms.destroy()
return addr
end
end
local AOBs = {
{name='HackingManager', aob='?? 8B ?? ?? ?? ?? ?? ?? 85 ?? 74 ?? ?? 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? ?? 8B ?? 50 ?? 83 ?? 18 00 75 ?? ?? 89 ?? ?? 89 ?? 48 83 C4 28 ?? ?? E9 ?? ?? ?? ?? 90 48 83 C4 28 ?? ?? C3 ?? 89 ?? ?? 38 00 00 00 ?? 31 ?? 48 83 C4 28 ?? ?? E9 ?? ?? ?? ?? CC CC ?? ?? ?? ?? ?? ?? ?? ?? ?? 48', pos=3, aoblen=7, symbol='HackingManager_addr'},
}
local module_name = process
for _, entry in ipairs(AOBs) do
local aob_addr_str = AOBScanModule(module_name, entry.aob)
if aob_addr_str then
local aob_addr_val = tonumber(aob_addr_str, 16)
local offset_addr = aob_addr_val + entry.pos
local relative_offset = readInteger(offset_addr, true)
local final_addr = relative_offset + aob_addr_val + entry.aoblen
synchronize(function()
unregisterSymbol(entry.symbol)
registerSymbol(entry.symbol, final_addr)
end)
print(string.format('[SymbolScanner] %s registered at: %X', entry.name, final_addr))
else
print(string.format('[SymbolScanner] WARNING: AOB scan failed for %s', entry.name))
end
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
unregisterSymbol('HackingManager_addr')
{$asm}
579
"base"
1
0
8 Bytes
HackingManager_addr
0
581
"_SnakePuzzleCommonUserData"
1
0
1
+60
0
582
"_MoveCoolTime"
0
Float
+3C
583
"_AutoHackTotalBaseTime [System.Single x4]"
1
0
1
+20
0
584
"[0]"
0
Float
+20
585
"[1]"
0
Float
+24
586
"[2]"
0
Float
+28
587
"[3]"
0
Float
+2C
588
"_AutoHackAdditionalRate"
0
Float
+30
589
"_BlockInputTimeWhenGridChanging"
0
Float
+34
590
"_GridResetTime"
0
Float
+38
596
"_DeadFilamentDefaultCount"
1
4 Bytes
+40
597
"_DeadFilamentMaxCount"
1
4 Bytes
+44
598
"_DeadFilamentGenerateTime"
0
Float
+48
600
"_DeadFilamentMoveBlockTime"
0
Float
+50
601
"_MouseControlCameraMoveDisableTime"
0
Float
+54
602
"_MouseMaxSensitivity"
0
Float
+58
603
"_MouseMinSensitivity"
0
Float
+5C
8004
"=== RESOURCES ==="
B07000
1
11
"Resources: Currency / Key Items"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/04/17
}
[ENABLE]
aobscanmodule(INJECT_GET_Lunafilament,$process,8B ?? 14 ?? 31 ?? ?? ?? F8 FF FF FF FF FF FF 7F ?? 21 ?? ?? 8B ?? 24 ?? 85 ?? 74 ?? E8 ?? ?? ?? ?? 48 98 ?? 8A ?? 07 58 84 ?? 7E ?? FE ?? ?? 88 ?? 07 58 75 ?? ?? 83 ?? 10 ?? 89 ?? E8 ?? ?? ?? ?? 84 ?? 74 ?? ?? 89 ?? FF ?? ?? ?? ?? ?? ?? 8B ?? 50 ?? 85 ?? 0F 99 ?? ?? 83 ?? 18 00 75 ?? 84 ?? 0F)
// raw AOB: 8B 48 08 E8 ?? ?? ?? ?? 48 89 44 24 50 4C 89 7C 24 48 48 85 DB 0F 84 ?? ?? ?? ?? 4C 8D 44 24 30 48 89 F1 48 89 DA E8 ?? ?? ?? ?? 48 8B 4E 50 4C 8B 71 18 4D 85 F6 0F 85 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 8B 58 14 45 31 F6 49 BC F8 FF FF FF FF FF FF 7F 49 21 FC 4D 8B 3C 24 4D 85 FF 74 ?? E8 ?? ?? ?? ?? 48 98 41 8A 4C 07 58 84 C9 7E ?? FE C9 41 88 4C 07 58 75 ?? 49 83 C7 10 4C 89 F9 E8
// injection point AOB: 8B ?? 14 ?? 31 ?? ?? ?? F8 FF FF FF FF FF FF 7F ?? 21 ?? ?? 8B ?? 24 ?? 85 ?? 74 ?? E8 ?? ?? ?? ?? 48 98 ?? 8A ?? 07 58 84 ?? 7E ?? FE ?? ?? 88 ?? 07 58 75 ?? ?? 83 ?? 10 ?? 89 ?? E8
alloc(newmem,$1000,INJECT_GET_Lunafilament)
alloc(INJECT_GET_Lunafilamento, $6)
label(code)
label(return)
label(i_base_Lunafilament_addr i_base_upgrades_addr i_base_coin_addr i_base_repair_pack_addr)
label(i_base_data_13_addr i_base_data_19_addr)
INJECT_GET_Lunafilamento:
readmem(INJECT_GET_Lunafilament, $6)
// Lunafilament: app.InventoryManager > ItemSlotTable [5], _ID = 2227368435 (0x10)
// Upgrades: app.InventoryManager > ItemSlotTable [11], _ID = 187746965 (0x10)
// Coin: app.InventoryManager > ItemSlotTable [12], _ID = 701076331 (0x10)
// Repair pack: 2870192522
// Pure Lunum: 2107318115
// Red zone key: 2429803748
newmem:
cmp dword ptr [rax+10], #2227368435
jne short @F
mov [i_base_Lunafilament_addr], rax
jmp code
@@:
cmp dword ptr [rax+10], #187746965
jne short @F
mov [i_base_upgrades_addr], rax
jmp code
@@:
cmp dword ptr [rax+10], #701076331
jne short @F
mov [i_base_coin_addr], rax
jmp code
@@:
cmp dword ptr [rax+10], #2870192522
jne short @F
mov [i_base_repair_pack_addr], rax
jmp code
@@:
cmp dword ptr [rax+10], #2107318115
jne short @F
mov [i_base_data_13_addr], rax
jmp code
@@:
cmp dword ptr [rax+10], #2429803748
jne short @F
mov [i_base_data_19_addr], rax
code:
// mov ebx,[rax+14]
reassemble(INJECT_GET_Lunafilament)
// xor r14d,r14d
reassemble(INJECT_GET_Lunafilament+3)
jmp return
align 10 cc
i_base_Lunafilament_addr:
dq 0
i_base_upgrades_addr:
dq 0
i_base_coin_addr:
dq 0
i_base_repair_pack_addr:
dq 0
i_base_data_13_addr:
dq 0
i_base_data_19_addr:
dq 0
INJECT_GET_Lunafilament:
jmp newmem
nop 1
return:
registersymbol(INJECT_GET_Lunafilament INJECT_GET_Lunafilamento)
registersymbol(i_base_Lunafilament_addr i_base_upgrades_addr i_base_coin_addr i_base_repair_pack_addr)
registersymbol(i_base_data_13_addr i_base_data_19_addr)
[DISABLE]
INJECT_GET_Lunafilament:
readmem(INJECT_GET_Lunafilamento, $6)
unregistersymbol(INJECT_GET_Lunafilament INJECT_GET_Lunafilamento)
unregistersymbol(i_base_Lunafilament_addr i_base_upgrades_addr i_base_coin_addr i_base_repair_pack_addr)
unregistersymbol(i_base_data_13_addr i_base_data_19_addr)
dealloc(newmem)
dealloc(INJECT_GET_Lunafilamento)
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+299367
PRAGMATA.exe+299322: 8B 48 08 - mov ecx,[rax+08]
PRAGMATA.exe+299325: E8 D6 E7 A1 04 - call PRAGMATA.exe+4CB7B00
PRAGMATA.exe+29932A: 48 89 44 24 50 - mov [rsp+50],rax
PRAGMATA.exe+29932F: 4C 89 7C 24 48 - mov [rsp+48],r15
PRAGMATA.exe+299334: 48 85 DB - test rbx,rbx
PRAGMATA.exe+299337: 0F 84 BE 00 00 00 - je PRAGMATA.exe+2993FB
PRAGMATA.exe+29933D: 4C 8D 44 24 30 - lea r8,[rsp+30]
PRAGMATA.exe+299342: 48 89 F1 - mov rcx,rsi
PRAGMATA.exe+299345: 48 89 DA - mov rdx,rbx
PRAGMATA.exe+299348: E8 73 7D BA 04 - call PRAGMATA.exe+4E410C0
PRAGMATA.exe+29934D: 48 8B 4E 50 - mov rcx,[rsi+50]
PRAGMATA.exe+299351: 4C 8B 71 18 - mov r14,[rcx+18]
PRAGMATA.exe+299355: 4D 85 F6 - test r14,r14
PRAGMATA.exe+299358: 0F 85 CF 00 00 00 - jne PRAGMATA.exe+29942D
PRAGMATA.exe+29935E: 48 85 C0 - test rax,rax
PRAGMATA.exe+299361: 0F 84 D0 00 00 00 - je PRAGMATA.exe+299437
// ---------- INJECTING HERE ----------
PRAGMATA.exe+299367: 8B 58 14 - mov ebx,[rax+14]
// ---------- DONE INJECTING ----------
PRAGMATA.exe+29936A: 45 31 F6 - xor r14d,r14d
PRAGMATA.exe+29936D: 49 BC F8 FF FF FF FF FF FF 7F - mov r12,7FFFFFFFFFFFFFF8
PRAGMATA.exe+299377: 49 21 FC - and r12,rdi
PRAGMATA.exe+29937A: 4D 8B 3C 24 - mov r15,[r12]
PRAGMATA.exe+29937E: 4D 85 FF - test r15,r15
PRAGMATA.exe+299381: 74 4B - je PRAGMATA.exe+2993CE
PRAGMATA.exe+299383: E8 B8 D1 A1 04 - call PRAGMATA.exe+4CB6540
PRAGMATA.exe+299388: 48 98 - cdqe
PRAGMATA.exe+29938A: 41 8A 4C 07 58 - mov cl,[r15+rax+58]
PRAGMATA.exe+29938F: 84 C9 - test cl,cl
PRAGMATA.exe+299391: 7E 22 - jle PRAGMATA.exe+2993B5
PRAGMATA.exe+299393: FE C9 - dec cl
PRAGMATA.exe+299395: 41 88 4C 07 58 - mov [r15+rax+58],cl
PRAGMATA.exe+29939A: 75 19 - jne PRAGMATA.exe+2993B5
PRAGMATA.exe+29939C: 49 83 C7 10 - add r15,10
PRAGMATA.exe+2993A0: 4C 89 F9 - mov rcx,r15
}
12
"Lunafilament"
0
FF8080
4 Bytes
i_base_Lunafilament_addr
14
13
"Upgrade component"
0
FF8080
4 Bytes
i_base_upgrades_addr
14
14
"Cabin Coin"
0
FF8080
4 Bytes
i_base_coin_addr
14
15
"Repair Kits"
0
FF8080
4 Bytes
i_base_repair_pack_addr
14
16
"Pure Lunum"
0
FF8080
4 Bytes
i_base_data_13_addr
14
17
"Red zone key"
0
FF8080
4 Bytes
i_base_data_19_addr
14
296
"Inventory Slots (advanced)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not AOBScanModule then
function AOBScanModule(moduleName, signature)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then return nil end
local ms = createMemScan()
synchronize(function()
ms.firstScan(soExactValue, vtByteArray, nil, signature,
nil, baseAddr, maxAddr, '+X-C-W', fsmNotAligned, '1', true, true, false, false)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
results.destroy()
ms.destroy()
return addr
end
end
local AOBs = {
{name='InventoryManager', aob='?? 8B ?? ?? ?? ?? ?? ?? 85 ?? 74 ?? ?? 89 ?? E8 ?? ?? ?? ?? ?? 8B ?? 50 ?? 83 ?? 18 00 75 ?? 85 ?? 7E ?? ?? 0F', pos=3, aoblen=7, symbol='InventoryManager_addr'},
}
local module_name = process
for _, entry in ipairs(AOBs) do
local aob_addr_str = AOBScanModule(module_name, entry.aob)
if aob_addr_str then
local aob_addr_val = tonumber(aob_addr_str, 16)
local offset_addr = aob_addr_val + entry.pos
local relative_offset = readInteger(offset_addr, true)
local final_addr = relative_offset + aob_addr_val + entry.aoblen
synchronize(function()
unregisterSymbol(entry.symbol)
registerSymbol(entry.symbol, final_addr)
end)
print(string.format('[SymbolScanner] %s registered at: %X', entry.name, final_addr))
else
print(string.format('[SymbolScanner] WARNING: AOB scan failed for %s', entry.name))
end
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
unregisterSymbol('InventoryManager_addr')
{$asm}
297
"base"
1
0
8 Bytes
InventoryManager_addr
0
298
"app.InventoryManager.ItemSlotTable"
1
0
1
+30
0
299
"System.Collections.Generic.List`1<app.ItemInventoryInfo>"
1
0
1
+10
0
300
"_items"
1
0
1
+10
0
301
"[0] [app.ItemInventoryInfo]"
1
0
1
+20
0
302
"_ID"
0
4 Bytes
+10
303
"_Quantity"
1
4 Bytes
+14
304
"[1] [app.ItemInventoryInfo]"
1
0
1
+28
0
305
"_ID"
0
4 Bytes
+10
306
"_Quantity"
1
4 Bytes
+14
307
"[2] [app.ItemInventoryInfo]"
1
0
1
+30
0
308
"_ID"
0
4 Bytes
+10
309
"_Quantity"
1
4 Bytes
+14
310
"[3] [app.ItemInventoryInfo]"
1
0
1
+38
0
311
"_ID"
0
4 Bytes
+10
312
"_Quantity"
1
4 Bytes
+14
313
"[4] [app.ItemInventoryInfo]"
1
0
1
+40
0
314
"_ID"
0
4 Bytes
+10
315
"_Quantity"
1
4 Bytes
+14
316
"[5] [app.ItemInventoryInfo]"
1
0
1
+48
0
317
"_ID"
0
4 Bytes
+10
318
"_Quantity"
1
4 Bytes
+14
319
"[6] [app.ItemInventoryInfo]"
1
0
1
+50
0
320
"_ID"
0
4 Bytes
+10
321
"_Quantity"
1
4 Bytes
+14
322
"[7] [app.ItemInventoryInfo]"
1
0
1
+58
0
323
"_ID"
0
4 Bytes
+10
324
"_Quantity"
1
4 Bytes
+14
325
"[8] [app.ItemInventoryInfo]"
1
0
1
+60
0
326
"_ID"
0
4 Bytes
+10
327
"_Quantity"
1
4 Bytes
+14
328
"[9] [app.ItemInventoryInfo]"
1
0
1
+68
0
329
"_ID"
0
4 Bytes
+10
330
"_Quantity"
1
4 Bytes
+14
331
"[10] [app.ItemInventoryInfo]"
1
0
1
+70
0
332
"_ID"
0
4 Bytes
+10
333
"_Quantity"
1
4 Bytes
+14
334
"[11] [app.ItemInventoryInfo]"
1
0
1
+78
0
335
"_ID"
0
4 Bytes
+10
336
"_Quantity"
1
4 Bytes
+14
337
"[12] [app.ItemInventoryInfo]"
1
0
1
+80
0
338
"_ID"
0
4 Bytes
+10
339
"_Quantity"
1
4 Bytes
+14
340
"[13] [app.ItemInventoryInfo]"
1
0
1
+88
0
341
"_ID"
0
4 Bytes
+10
342
"_Quantity"
1
4 Bytes
+14
343
"[14] [app.ItemInventoryInfo]"
1
0
1
+90
0
344
"_ID"
0
4 Bytes
+10
345
"_Quantity"
1
4 Bytes
+14
346
"[15] [app.ItemInventoryInfo]"
1
0
1
+98
0
347
"_ID"
0
4 Bytes
+10
348
"_Quantity"
1
4 Bytes
+14
349
"[16] [app.ItemInventoryInfo]"
1
0
1
+A0
0
350
"_ID"
0
4 Bytes
+10
351
"_Quantity"
1
4 Bytes
+14
352
"[17] [app.ItemInventoryInfo]"
1
0
1
+A8
0
353
"_ID"
0
4 Bytes
+10
354
"_Quantity"
1
4 Bytes
+14
355
"[18] [app.ItemInventoryInfo]"
1
0
1
+B0
0
356
"_ID"
0
4 Bytes
+10
357
"_Quantity"
1
4 Bytes
+14
358
"[19] [app.ItemInventoryInfo]"
1
0
1
+B8
0
359
"_ID"
0
4 Bytes
+10
360
"_Quantity"
1
4 Bytes
+14
361
"[20] [app.ItemInventoryInfo]"
1
0
1
+C0
0
362
"_ID"
0
4 Bytes
+10
363
"_Quantity"
1
4 Bytes
+14
364
"[21] [app.ItemInventoryInfo]"
1
0
1
+C8
0
365
"_ID"
0
4 Bytes
+10
366
"_Quantity"
1
4 Bytes
+14
367
"[22] [app.ItemInventoryInfo]"
1
0
1
+D0
0
368
"_ID"
0
4 Bytes
+10
369
"_Quantity"
1
4 Bytes
+14
370
"[23] [app.ItemInventoryInfo]"
1
0
1
+D8
0
371
"_ID"
0
4 Bytes
+10
372
"_Quantity"
1
4 Bytes
+14
373
"[24] [app.ItemInventoryInfo]"
1
0
1
+E0
0
374
"_ID"
0
4 Bytes
+10
375
"_Quantity"
1
4 Bytes
+14
376
"[25] [app.ItemInventoryInfo]"
1
0
1
+E8
0
377
"_ID"
0
4 Bytes
+10
378
"_Quantity"
1
4 Bytes
+14
379
"[26] [app.ItemInventoryInfo]"
1
0
1
+F0
0
380
"_ID"
0
4 Bytes
+10
381
"_Quantity"
1
4 Bytes
+14
382
"[27] [app.ItemInventoryInfo]"
1
0
1
+F8
0
383
"_ID"
0
4 Bytes
+10
384
"_Quantity"
1
4 Bytes
+14
385
"[28] [app.ItemInventoryInfo]"
1
0
1
+100
0
386
"_ID"
0
4 Bytes
+10
387
"_Quantity"
1
4 Bytes
+14
388
"[29] [app.ItemInventoryInfo]"
1
0
1
+108
0
389
"_ID"
0
4 Bytes
+10
390
"_Quantity"
1
4 Bytes
+14
391
"[30] [app.ItemInventoryInfo]"
1
0
1
+110
0
392
"_ID"
0
4 Bytes
+10
393
"_Quantity"
1
4 Bytes
+14
394
"[31] [app.ItemInventoryInfo]"
1
0
1
+118
0
395
"_ID"
0
4 Bytes
+10
396
"_Quantity"
1
4 Bytes
+14
397
"[32] [app.ItemInventoryInfo]"
1
0
1
+120
0
398
"_ID"
0
4 Bytes
+10
399
"_Quantity"
1
4 Bytes
+14
400
"[33] [app.ItemInventoryInfo]"
1
0
1
+128
0
401
"_ID"
0
4 Bytes
+10
402
"_Quantity"
1
4 Bytes
+14
403
"[34] [app.ItemInventoryInfo]"
1
0
1
+130
0
404
"_ID"
0
4 Bytes
+10
405
"_Quantity"
1
4 Bytes
+14
406
"[35] [app.ItemInventoryInfo]"
1
0
1
+138
0
407
"_ID"
0
4 Bytes
+10
408
"_Quantity"
1
4 Bytes
+14
409
"[36] [app.ItemInventoryInfo]"
1
0
1
+140
0
410
"_ID"
0
4 Bytes
+10
411
"_Quantity"
1
4 Bytes
+14
412
"[37] [app.ItemInventoryInfo]"
1
0
1
+148
0
413
"_ID"
0
4 Bytes
+10
414
"_Quantity"
1
4 Bytes
+14
415
"[38] [app.ItemInventoryInfo]"
1
0
1
+150
0
416
"_ID"
0
4 Bytes
+10
417
"_Quantity"
1
4 Bytes
+14
418
"[39] [app.ItemInventoryInfo]"
1
0
1
+158
0
419
"_ID"
0
4 Bytes
+10
420
"_Quantity"
1
4 Bytes
+14
421
"[40] [app.ItemInventoryInfo]"
1
0
1
+160
0
422
"_ID"
0
4 Bytes
+10
423
"_Quantity"
1
4 Bytes
+14
424
"[41] [app.ItemInventoryInfo]"
1
0
1
+168
0
425
"_ID"
0
4 Bytes
+10
426
"_Quantity"
1
4 Bytes
+14
427
"[42] [app.ItemInventoryInfo]"
1
0
1
+170
0
428
"_ID"
0
4 Bytes
+10
429
"_Quantity"
1
4 Bytes
+14
430
"[43] [app.ItemInventoryInfo]"
1
0
1
+178
0
431
"_ID"
0
4 Bytes
+10
432
"_Quantity"
1
4 Bytes
+14
433
"[44] [app.ItemInventoryInfo]"
1
0
1
+180
0
434
"_ID"
0
4 Bytes
+10
435
"_Quantity"
1
4 Bytes
+14
436
"[45] [app.ItemInventoryInfo]"
1
0
1
+188
0
437
"_ID"
0
4 Bytes
+10
438
"_Quantity"
1
4 Bytes
+14
439
"[46] [app.ItemInventoryInfo]"
1
0
1
+190
0
440
"_ID"
0
4 Bytes
+10
441
"_Quantity"
1
4 Bytes
+14
442
"[47] [app.ItemInventoryInfo]"
1
0
1
+198
0
443
"_ID"
0
4 Bytes
+10
444
"_Quantity"
1
4 Bytes
+14
445
"[48] [app.ItemInventoryInfo]"
1
0
1
+1A0
0
446
"_ID"
0
4 Bytes
+10
447
"_Quantity"
1
4 Bytes
+14
448
"[49] [app.ItemInventoryInfo]"
1
0
1
+1A8
0
449
"_ID"
0
4 Bytes
+10
450
"_Quantity"
1
4 Bytes
+14
451
"[50] [app.ItemInventoryInfo]"
1
0
1
+1B0
0
452
"_ID"
0
4 Bytes
+10
453
"_Quantity"
1
4 Bytes
+14
454
"[51] [app.ItemInventoryInfo]"
1
0
1
+1B8
0
455
"_ID"
0
4 Bytes
+10
456
"_Quantity"
1
4 Bytes
+14
457
"[52] [app.ItemInventoryInfo]"
1
0
1
+1C0
0
458
"_ID"
0
4 Bytes
+10
459
"_Quantity"
1
4 Bytes
+14
460
"[53] [app.ItemInventoryInfo]"
1
0
1
+1C8
0
461
"_ID"
0
4 Bytes
+10
462
"_Quantity"
1
4 Bytes
+14
463
"[54] [app.ItemInventoryInfo]"
1
0
1
+1D0
0
464
"_ID"
0
4 Bytes
+10
465
"_Quantity"
1
4 Bytes
+14
466
"[55] [app.ItemInventoryInfo]"
1
0
1
+1D8
0
467
"_ID"
0
4 Bytes
+10
468
"_Quantity"
1
4 Bytes
+14
469
"[56] [app.ItemInventoryInfo]"
1
0
1
+1E0
0
470
"_ID"
0
4 Bytes
+10
471
"_Quantity"
1
4 Bytes
+14
472
"[57] [app.ItemInventoryInfo]"
1
0
1
+1E8
0
473
"_ID"
0
4 Bytes
+10
474
"_Quantity"
1
4 Bytes
+14
475
"[58] [app.ItemInventoryInfo]"
1
0
1
+1F0
0
476
"_ID"
0
4 Bytes
+10
477
"_Quantity"
1
4 Bytes
+14
478
"[59] [app.ItemInventoryInfo]"
1
0
1
+1F8
0
479
"_ID"
0
4 Bytes
+10
480
"_Quantity"
1
4 Bytes
+14
481
"[60] [app.ItemInventoryInfo]"
1
0
1
+200
0
482
"_ID"
0
4 Bytes
+10
483
"_Quantity"
1
4 Bytes
+14
484
"[61] [app.ItemInventoryInfo]"
1
0
1
+208
0
485
"_ID"
0
4 Bytes
+10
486
"_Quantity"
1
4 Bytes
+14
487
"[62] [app.ItemInventoryInfo]"
1
0
1
+210
0
488
"_ID"
0
4 Bytes
+10
489
"_Quantity"
1
4 Bytes
+14
490
"[63] [app.ItemInventoryInfo]"
1
0
1
+218
0
491
"_ID"
0
4 Bytes
+10
492
"_Quantity"
1
4 Bytes
+14
493
"[64] [app.ItemInventoryInfo]"
1
0
1
+220
0
494
"_ID"
0
4 Bytes
+10
495
"_Quantity"
1
4 Bytes
+14
496
"[65] [app.ItemInventoryInfo]"
1
0
1
+228
0
497
"_ID"
0
4 Bytes
+10
498
"_Quantity"
1
4 Bytes
+14
499
"[66] [app.ItemInventoryInfo]"
1
0
1
+230
0
500
"_ID"
0
4 Bytes
+10
501
"_Quantity"
1
4 Bytes
+14
502
"[67] [app.ItemInventoryInfo]"
1
0
1
+238
0
503
"_ID"
0
4 Bytes
+10
504
"_Quantity"
1
4 Bytes
+14
505
"[68] [app.ItemInventoryInfo]"
1
0
1
+240
0
506
"_ID"
0
4 Bytes
+10
507
"_Quantity"
1
4 Bytes
+14
508
"[69] [app.ItemInventoryInfo]"
1
0
1
+248
0
509
"_ID"
0
4 Bytes
+10
510
"_Quantity"
1
4 Bytes
+14
511
"[70] [app.ItemInventoryInfo]"
1
0
1
+250
0
512
"_ID"
0
4 Bytes
+10
513
"_Quantity"
1
4 Bytes
+14
514
"[71] [app.ItemInventoryInfo]"
1
0
1
+258
0
515
"_ID"
0
4 Bytes
+10
516
"_Quantity"
1
4 Bytes
+14
517
"[72] [app.ItemInventoryInfo]"
1
0
1
+260
0
518
"_ID"
0
4 Bytes
+10
519
"_Quantity"
1
4 Bytes
+14
520
"[73] [app.ItemInventoryInfo]"
1
0
1
+268
0
521
"_ID"
0
4 Bytes
+10
522
"_Quantity"
1
4 Bytes
+14
523
"[74] [app.ItemInventoryInfo]"
1
0
1
+270
0
524
"_ID"
0
4 Bytes
+10
525
"_Quantity"
1
4 Bytes
+14
526
"[75] [app.ItemInventoryInfo]"
1
0
1
+278
0
527
"_ID"
0
4 Bytes
+10
528
"_Quantity"
1
4 Bytes
+14
529
"[76] [app.ItemInventoryInfo]"
1
0
1
+280
0
530
"_ID"
0
4 Bytes
+10
531
"_Quantity"
1
4 Bytes
+14
532
"[77] [app.ItemInventoryInfo]"
1
0
1
+288
0
533
"_ID"
0
4 Bytes
+10
534
"_Quantity"
1
4 Bytes
+14
535
"[78] [app.ItemInventoryInfo]"
1
0
1
+290
0
536
"_ID"
0
4 Bytes
+10
537
"_Quantity"
1
4 Bytes
+14
538
"[79] [app.ItemInventoryInfo]"
1
0
1
+298
0
539
"_ID"
0
4 Bytes
+10
540
"_Quantity"
1
4 Bytes
+14
541
"[80] [app.ItemInventoryInfo]"
1
0
1
+2A0
0
542
"_ID"
0
4 Bytes
+10
543
"_Quantity"
1
4 Bytes
+14
544
"[81] [app.ItemInventoryInfo]"
1
0
1
+2A8
0
545
"_ID"
0
4 Bytes
+10
546
"_Quantity"
1
4 Bytes
+14
547
"[82] [app.ItemInventoryInfo]"
1
0
1
+2B0
0
548
"_ID"
0
4 Bytes
+10
549
"_Quantity"
1
4 Bytes
+14
550
"[83] [app.ItemInventoryInfo]"
1
0
1
+2B8
0
551
"_ID"
0
4 Bytes
+10
552
"_Quantity"
1
4 Bytes
+14
553
"[84] [app.ItemInventoryInfo]"
1
0
1
+2C0
0
554
"_ID"
0
4 Bytes
+10
555
"_Quantity"
1
4 Bytes
+14
556
"[85] [app.ItemInventoryInfo]"
1
0
1
+2C8
0
557
"_ID"
0
4 Bytes
+10
558
"_Quantity"
1
4 Bytes
+14
559
"[86] [app.ItemInventoryInfo]"
1
0
1
+2D0
0
560
"_ID"
0
4 Bytes
+10
561
"_Quantity"
1
4 Bytes
+14
562
"[87] [app.ItemInventoryInfo]"
1
0
1
+2D8
0
563
"_ID"
0
4 Bytes
+10
564
"_Quantity"
1
4 Bytes
+14
565
"[88] [app.ItemInventoryInfo]"
1
0
1
+2E0
0
566
"_ID"
0
4 Bytes
+10
567
"_Quantity"
1
4 Bytes
+14
568
"[89] [app.ItemInventoryInfo]"
1
0
1
+2E8
0
569
"_ID"
0
4 Bytes
+10
570
"_Quantity"
1
4 Bytes
+14
8005
"=== CHARACTER ==="
0080C0
1
30
"Equipment Capacities [EXPAND, then set values to 99]"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not AOBScanModule then
function AOBScanModule(moduleName, signature)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then return nil end
local ms = createMemScan()
synchronize(function()
ms.firstScan(soExactValue, vtByteArray, nil, signature,
nil, baseAddr, maxAddr, '+X-C-W', fsmNotAligned, '1', true, true, false, false)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
results.destroy()
ms.destroy()
return addr
end
end
local AOBs = {
{name='EnhanceManager', aob='?? 8B ?? ?? ?? ?? ?? ?? 85 ?? 74 ?? ?? 8B ?? 48 ?? 89 ?? E8 ?? ?? ?? ?? ?? 8B ?? 50 ?? 83 ?? 18 00 0F 85 ?? ?? ?? ?? ?? 85 ?? 74 ?? ?? 8B ?? 28 ?? 85 ?? 74 ?? 8B', pos=3, aoblen=7, symbol='EnhanceManager_addr'},
}
local module_name = process
for _, entry in ipairs(AOBs) do
local aob_addr_str = AOBScanModule(module_name, entry.aob)
if aob_addr_str then
local aob_addr_val = tonumber(aob_addr_str, 16)
local offset_addr = aob_addr_val + entry.pos
local relative_offset = readInteger(offset_addr, true)
local final_addr = relative_offset + aob_addr_val + entry.aoblen
synchronize(function()
unregisterSymbol(entry.symbol)
registerSymbol(entry.symbol, final_addr)
end)
print(string.format('[SymbolScanner] %s registered at: %X', entry.name, final_addr))
else
print(string.format('[SymbolScanner] WARNING: AOB scan failed for %s', entry.name))
end
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
unregisterSymbol('EnhanceManager_addr')
{$asm}
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+15E93C
PRAGMATA.exe+15E91F: C5 FA 2A 78 20 - vcvtsi2ss xmm7,xmm0,[rax+20]
PRAGMATA.exe+15E924: 31 C9 - xor ecx,ecx
PRAGMATA.exe+15E926: 48 85 C9 - test rcx,rcx
PRAGMATA.exe+15E929: 74 04 - je PRAGMATA.exe+15E92F
PRAGMATA.exe+15E92B: C5 C0 57 FF - vxorps xmm7,xmm7,xmm7
PRAGMATA.exe+15E92F: 31 DB - xor ebx,ebx
PRAGMATA.exe+15E931: C5 F8 2E FE - vucomiss xmm7,xmm6
PRAGMATA.exe+15E935: 77 75 - ja PRAGMATA.exe+15E9AC
PRAGMATA.exe+15E937: 48 85 C9 - test rcx,rcx
PRAGMATA.exe+15E93A: 75 70 - jne PRAGMATA.exe+15E9AC
// ---------- INJECTING HERE ----------
PRAGMATA.exe+15E93C: 48 8B 15 AD 1D 84 0B - mov rdx,[PRAGMATA.exe+B9A06F0]
// ---------- DONE INJECTING ----------
PRAGMATA.exe+15E943: 48 85 D2 - test rdx,rdx
PRAGMATA.exe+15E946: 74 7E - je PRAGMATA.exe+15E9C6
PRAGMATA.exe+15E948: 44 8B 42 48 - mov r8d,[rdx+48]
PRAGMATA.exe+15E94C: 48 89 F1 - mov rcx,rsi
PRAGMATA.exe+15E94F: E8 1C 01 B7 04 - call PRAGMATA.exe+4CCEA70
PRAGMATA.exe+15E954: 48 8B 4E 50 - mov rcx,[rsi+50]
PRAGMATA.exe+15E958: 48 83 79 18 00 - cmp qword ptr [rcx+18],00
PRAGMATA.exe+15E95D: 0F 85 45 01 00 00 - jne PRAGMATA.exe+15EAA8
PRAGMATA.exe+15E963: 48 85 C0 - test rax,rax
PRAGMATA.exe+15E966: 74 72 - je PRAGMATA.exe+15E9DA
}
31
"base"
1
0
8 Bytes
EnhanceManager_addr
0
32
"_EquipmentPerkMainGame -> _BootingPerks"
1
0
1
+18
0
+28
33
"<RepairKitCapacity>k__BackingField"
1
FF8080
4 Bytes
+60
34
"<MainGadgetCapacity>k__BackingField"
1
FF8080
4 Bytes
+64
35
"<AssaultGadgetCapacity>k__BackingField"
1
FF8080
4 Bytes
+68
36
"<StrategyGadgetCapacity>k__BackingField"
1
FF8080
4 Bytes
+6C
37
"<SupportGadgetCapacity>k__BackingField"
1
FF8080
4 Bytes
+70
38
"<ActiveSkillCapacity>k__BackingField"
1
FF8080
4 Bytes
+74
39
"Skip slot capacity writeback"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/04/18
}
[ENABLE]
aobscanmodule(INJECT_SKIP_AS_SLOT_NUM_DOWN,$process,89 ?? 74 ?? 8B ?? 50 ?? 83 ?? 18 00 0F 85 ?? ?? ?? ?? ?? 8B ?? 20)
// raw AOB: 48 89 D6 48 89 CF 48 8B 52 20 48 85 D2 0F 84 ?? ?? ?? ?? 41 B8 F6 B8 BA 7D E8 ?? ?? ?? ?? 48 8B 47 50 48 8B 40 18 48 85 C0 74 ?? C5 F8 57 C0 48 85 C0 0F 85 ?? ?? ?? ?? C5 FA 2C C0 FF C0 89 46 74 48 8B 47 50 48 83 78 18 00 0F 85 ?? ?? ?? ?? 48 8B 56 20 48 89 F9 48 85 D2 0F 84 ?? ?? ?? ?? 41 B8 D1 A6 2B D9 E8 ?? ?? ?? ?? 48 8B 47 50 48 8B 40 18 48 85 C0 74 ?? C5 F8 57 C0 48 85 C0 0F 85 ?? ?? ?? ?? C5 FA 2C C0
// injection point AOB: 89 ?? 74 ?? 8B ?? 50 ?? 83 ?? 18 00 0F 85 ?? ?? ?? ?? ?? 8B ?? 20 ?? 89 ?? ?? 85 ?? 0F 84 ?? ?? ?? ?? ?? ?? D1 A6 2B D9 E8 ?? ?? ?? ?? ?? 8B ?? 50 ?? 8B ?? 18 ?? 85 ?? 74 ?? C5 ?? 57 ?? ?? 85 ?? 0F 85 ?? ?? ?? ?? C5 ?? 2C
alloc(newmem,$1000,INJECT_SKIP_AS_SLOT_NUM_DOWN)
alloc(INJECT_SKIP_AS_SLOT_NUM_DOWNo, $7)
label(code)
label(return)
INJECT_SKIP_AS_SLOT_NUM_DOWNo:
readmem(INJECT_SKIP_AS_SLOT_NUM_DOWN, $7)
newmem:
cmp [rsi+74],eax
ja short skip_overwrite
code:
// mov [rsi+74],eax
reassemble(INJECT_SKIP_AS_SLOT_NUM_DOWN)
// mov rax,[rdi+50]
skip_overwrite:
reassemble(INJECT_SKIP_AS_SLOT_NUM_DOWN+3)
jmp return
align 10 cc
INJECT_SKIP_AS_SLOT_NUM_DOWN:
jmp newmem
nop 2
return:
registersymbol(INJECT_SKIP_AS_SLOT_NUM_DOWN INJECT_SKIP_AS_SLOT_NUM_DOWNo)
[DISABLE]
INJECT_SKIP_AS_SLOT_NUM_DOWN:
readmem(INJECT_SKIP_AS_SLOT_NUM_DOWNo, $7)
unregistersymbol(INJECT_SKIP_AS_SLOT_NUM_DOWN INJECT_SKIP_AS_SLOT_NUM_DOWNo)
dealloc(newmem)
dealloc(INJECT_SKIP_AS_SLOT_NUM_DOWNo)
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+59F8917
PRAGMATA.exe+59F88D9: 48 89 D6 - mov rsi,rdx
PRAGMATA.exe+59F88DC: 48 89 CF - mov rdi,rcx
PRAGMATA.exe+59F88DF: 48 8B 52 20 - mov rdx,[rdx+20]
PRAGMATA.exe+59F88E3: 48 85 D2 - test rdx,rdx
PRAGMATA.exe+59F88E6: 0F 84 65 02 00 00 - je PRAGMATA.exe+59F8B51
PRAGMATA.exe+59F88EC: 41 B8 F6 B8 BA 7D - mov r8d,7DBAB8F6
PRAGMATA.exe+59F88F2: E8 C9 49 50 FF - call PRAGMATA.exe+4EFD2C0
PRAGMATA.exe+59F88F7: 48 8B 47 50 - mov rax,[rdi+50]
PRAGMATA.exe+59F88FB: 48 8B 40 18 - mov rax,[rax+18]
PRAGMATA.exe+59F88FF: 48 85 C0 - test rax,rax
PRAGMATA.exe+59F8902: 74 04 - je PRAGMATA.exe+59F8908
PRAGMATA.exe+59F8904: C5 F8 57 C0 - vxorps xmm0,xmm0,xmm0
PRAGMATA.exe+59F8908: 48 85 C0 - test rax,rax
PRAGMATA.exe+59F890B: 0F 85 B4 01 00 00 - jne PRAGMATA.exe+59F8AC5
PRAGMATA.exe+59F8911: C5 FA 2C C0 - vcvttss2si eax,xmm0
PRAGMATA.exe+59F8915: FF C0 - inc eax
// ---------- INJECTING HERE ----------
PRAGMATA.exe+59F8917: 89 46 74 - mov [rsi+74],eax
// ---------- DONE INJECTING ----------
PRAGMATA.exe+59F891A: 48 8B 47 50 - mov rax,[rdi+50]
PRAGMATA.exe+59F891E: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+59F8923: 0F 85 9C 01 00 00 - jne PRAGMATA.exe+59F8AC5
PRAGMATA.exe+59F8929: 48 8B 56 20 - mov rdx,[rsi+20]
PRAGMATA.exe+59F892D: 48 89 F9 - mov rcx,rdi
PRAGMATA.exe+59F8930: 48 85 D2 - test rdx,rdx
PRAGMATA.exe+59F8933: 0F 84 32 02 00 00 - je PRAGMATA.exe+59F8B6B
PRAGMATA.exe+59F8939: 41 B8 D1 A6 2B D9 - mov r8d,D92BA6D1
PRAGMATA.exe+59F893F: E8 7C 49 50 FF - call PRAGMATA.exe+4EFD2C0
PRAGMATA.exe+59F8944: 48 8B 47 50 - mov rax,[rdi+50]
PRAGMATA.exe+59F8948: 48 8B 40 18 - mov rax,[rax+18]
PRAGMATA.exe+59F894C: 48 85 C0 - test rax,rax
PRAGMATA.exe+59F894F: 74 04 - je PRAGMATA.exe+59F8955
PRAGMATA.exe+59F8951: C5 F8 57 C0 - vxorps xmm0,xmm0,xmm0
PRAGMATA.exe+59F8955: 48 85 C0 - test rax,rax
PRAGMATA.exe+59F8958: 0F 85 67 01 00 00 - jne PRAGMATA.exe+59F8AC5
}
40
"<PassiveSkillCapacity>k__BackingField"
1
FF8080
4 Bytes
+78
41
"Skip slot capacity writeback"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/04/18
}
[ENABLE]
aobscanmodule(INJECT_SKIP_SLOT_NUM_DOWN,$process,89 ?? 78 ?? 8B ?? 50 ?? 83 ?? 18 00 0F 85 ?? ?? ?? ?? ?? 8B ?? 20 ?? 89)
// raw AOB: 0F 85 ?? ?? ?? ?? 48 8B 56 20 48 89 F9 48 85 D2 0F 84 ?? ?? ?? ?? 41 B8 D1 A6 2B D9 E8 ?? ?? ?? ?? 48 8B 47 50 48 8B 40 18 48 85 C0 74 ?? C5 F8 57 C0 48 85 C0 0F 85 ?? ?? ?? ?? C5 FA 2C C0 FF C0 89 46 78 48 8B 47 50 48 83 78 18 00 0F 85 ?? ?? ?? ?? 48 8B 56 20 48 89 F9 48 85 D2 0F 84 ?? ?? ?? ?? 41 B8 8E D9 C7 92 E8 ?? ?? ?? ?? 48 8B 47 50 48 8B 40 18 C5 FA 2C D0 FF C2 48 85 C0 B9 01 00 00 00 0F 44 CA 48 85 C0
// injection point AOB: 89 ?? 78 ?? 8B ?? 50 ?? 83 ?? 18 00 0F 85 ?? ?? ?? ?? ?? 8B ?? 20 ?? 89 ?? ?? 85 ?? 0F 84 ?? ?? ?? ?? ?? ?? 8E D9 C7 92 E8 ?? ?? ?? ?? ?? 8B ?? 50 ?? 8B ?? 18 C5 ?? 2C ?? FF ?? ?? 85 ?? ?? 01 00 00 00 0F 44 ?? ?? 85
alloc(newmem,$1000,INJECT_SKIP_SLOT_NUM_DOWN)
alloc(INJECT_SKIP_SLOT_NUM_DOWNo, $7)
label(code)
label(return)
INJECT_SKIP_SLOT_NUM_DOWNo:
readmem(INJECT_SKIP_SLOT_NUM_DOWN, $7)
newmem:
cmp [rsi+78],eax
ja short skip_overwrite
code:
// mov [rsi+78],eax
reassemble(INJECT_SKIP_SLOT_NUM_DOWN)
skip_overwrite:
// mov rax,[rdi+50]
reassemble(INJECT_SKIP_SLOT_NUM_DOWN+3)
jmp return
align 10 cc
INJECT_SKIP_SLOT_NUM_DOWN:
jmp newmem
nop 2
return:
registersymbol(INJECT_SKIP_SLOT_NUM_DOWN INJECT_SKIP_SLOT_NUM_DOWNo)
[DISABLE]
INJECT_SKIP_SLOT_NUM_DOWN:
readmem(INJECT_SKIP_SLOT_NUM_DOWNo, $7)
unregistersymbol(INJECT_SKIP_SLOT_NUM_DOWN INJECT_SKIP_SLOT_NUM_DOWNo)
dealloc(newmem)
dealloc(INJECT_SKIP_SLOT_NUM_DOWNo)
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+59F8964
PRAGMATA.exe+59F8923: 0F 85 9C 01 00 00 - jne PRAGMATA.exe+59F8AC5
PRAGMATA.exe+59F8929: 48 8B 56 20 - mov rdx,[rsi+20]
PRAGMATA.exe+59F892D: 48 89 F9 - mov rcx,rdi
PRAGMATA.exe+59F8930: 48 85 D2 - test rdx,rdx
PRAGMATA.exe+59F8933: 0F 84 32 02 00 00 - je PRAGMATA.exe+59F8B6B
PRAGMATA.exe+59F8939: 41 B8 D1 A6 2B D9 - mov r8d,D92BA6D1
PRAGMATA.exe+59F893F: E8 7C 49 50 FF - call PRAGMATA.exe+4EFD2C0
PRAGMATA.exe+59F8944: 48 8B 47 50 - mov rax,[rdi+50]
PRAGMATA.exe+59F8948: 48 8B 40 18 - mov rax,[rax+18]
PRAGMATA.exe+59F894C: 48 85 C0 - test rax,rax
PRAGMATA.exe+59F894F: 74 04 - je PRAGMATA.exe+59F8955
PRAGMATA.exe+59F8951: C5 F8 57 C0 - vxorps xmm0,xmm0,xmm0
PRAGMATA.exe+59F8955: 48 85 C0 - test rax,rax
PRAGMATA.exe+59F8958: 0F 85 67 01 00 00 - jne PRAGMATA.exe+59F8AC5
PRAGMATA.exe+59F895E: C5 FA 2C C0 - vcvttss2si eax,xmm0
PRAGMATA.exe+59F8962: FF C0 - inc eax
// ---------- INJECTING HERE ----------
PRAGMATA.exe+59F8964: 89 46 78 - mov [rsi+78],eax
// ---------- DONE INJECTING ----------
PRAGMATA.exe+59F8967: 48 8B 47 50 - mov rax,[rdi+50]
PRAGMATA.exe+59F896B: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+59F8970: 0F 85 4F 01 00 00 - jne PRAGMATA.exe+59F8AC5
PRAGMATA.exe+59F8976: 48 8B 56 20 - mov rdx,[rsi+20]
PRAGMATA.exe+59F897A: 48 89 F9 - mov rcx,rdi
PRAGMATA.exe+59F897D: 48 85 D2 - test rdx,rdx
PRAGMATA.exe+59F8980: 0F 84 FF 01 00 00 - je PRAGMATA.exe+59F8B85
PRAGMATA.exe+59F8986: 41 B8 8E D9 C7 92 - mov r8d,92C7D98E
PRAGMATA.exe+59F898C: E8 2F 49 50 FF - call PRAGMATA.exe+4EFD2C0
PRAGMATA.exe+59F8991: 48 8B 47 50 - mov rax,[rdi+50]
PRAGMATA.exe+59F8995: 48 8B 40 18 - mov rax,[rax+18]
PRAGMATA.exe+59F8999: C5 FA 2C D0 - vcvttss2si edx,xmm0
PRAGMATA.exe+59F899D: FF C2 - inc edx
PRAGMATA.exe+59F899F: 48 85 C0 - test rax,rax
PRAGMATA.exe+59F89A2: B9 01 00 00 00 - mov ecx,00000001
PRAGMATA.exe+59F89A7: 0F 44 CA - cmove ecx,edx
}
42
"_RequestedRefreshManagedPerkUnit"
0
FF8080
Byte
+7C
43
"<IsEquippedPe13700>k__BackingField"
0
FF8080
Byte
+7D
8006
"=== ADVANCED ==="
505050
1
44
"Enemy Param Tuning [EXPAND - advanced, huge tree]"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not AOBScanModule then
function AOBScanModule(moduleName, signature)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then return nil end
local ms = createMemScan()
synchronize(function()
ms.firstScan(soExactValue, vtByteArray, nil, signature,
nil, baseAddr, maxAddr, '+X-C-W', fsmNotAligned, '1', true, true, false, false)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
results.destroy()
ms.destroy()
return addr
end
end
local AOBs = {
{name='EnemyBattleSystem', aob='?? 8B ?? ?? ?? ?? ?? ?? 83 ?? 10 00 74 ?? ?? 89 ?? E8 ?? ?? ?? ?? ?? 8B ?? 50 ?? 83 ?? 18 00 75 ?? ?? 8B ?? ?? ?? ?? ?? C5 ?? 10 ?? 68 03 00 00 C5 ?? 57 ?? C5 ?? 2E ?? 75 ?? 7B ?? ?? 85', pos=3, aoblen=7, symbol='EnemyBattleSystem_addr'},
}
local module_name = process
for _, entry in ipairs(AOBs) do
local aob_addr_str = AOBScanModule(module_name, entry.aob)
if aob_addr_str then
local aob_addr_val = tonumber(aob_addr_str, 16)
local offset_addr = aob_addr_val + entry.pos
local relative_offset = readInteger(offset_addr, true)
local final_addr = relative_offset + aob_addr_val + entry.aoblen
synchronize(function()
unregisterSymbol(entry.symbol)
registerSymbol(entry.symbol, final_addr)
end)
print(string.format('[SymbolScanner] %s registered at: %X', entry.name, final_addr))
else
print(string.format('[SymbolScanner] WARNING: AOB scan failed for %s', entry.name))
end
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
unregisterSymbol('EnemyBattleSystem_addr')
{$asm}
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+2BF911
PRAGMATA.exe+2BF8F2: 53 - push rbx
PRAGMATA.exe+2BF8F3: 48 83 EC 20 - sub rsp,20
PRAGMATA.exe+2BF8F7: 48 89 D3 - mov rbx,rdx
PRAGMATA.exe+2BF8FA: 48 89 CE - mov rsi,rcx
PRAGMATA.exe+2BF8FD: 48 8B 02 - mov rax,[rdx]
PRAGMATA.exe+2BF900: 48 89 D1 - mov rcx,rdx
PRAGMATA.exe+2BF903: FF 50 78 - call qword ptr [rax+78]
PRAGMATA.exe+2BF906: 48 8B 46 50 - mov rax,[rsi+50]
PRAGMATA.exe+2BF90A: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+2BF90F: 75 57 - jne PRAGMATA.exe+2BF968
// ---------- INJECTING HERE ----------
PRAGMATA.exe+2BF911: 48 8B 3D 20 B3 6F 0B - mov rdi,[PRAGMATA.exe+B9BAC38]
// ---------- DONE INJECTING ----------
PRAGMATA.exe+2BF918: 48 83 7B 10 00 - cmp qword ptr [rbx+10],00
PRAGMATA.exe+2BF91D: 74 52 - je PRAGMATA.exe+2BF971
PRAGMATA.exe+2BF91F: 48 89 D9 - mov rcx,rbx
PRAGMATA.exe+2BF922: E8 D9 28 A6 04 - call PRAGMATA.exe+4D22200
PRAGMATA.exe+2BF927: 48 8B 46 50 - mov rax,[rsi+50]
PRAGMATA.exe+2BF92B: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+2BF930: 75 36 - jne PRAGMATA.exe+2BF968
PRAGMATA.exe+2BF932: 48 8B 05 1F 35 6D 0B - mov rax,[PRAGMATA.exe+B992E58]
PRAGMATA.exe+2BF939: C5 FA 10 88 68 03 00 00 - vmovss xmm1,[rax+System.Reflection.Emit.OpCodes.Conv_U8]
PRAGMATA.exe+2BF941: C5 E8 57 D2 - vxorps xmm2,xmm2,xmm2
}
45
"base"
1
0
8 Bytes
EnemyBattleSystem_addr
0
46
"app.EnemyBaseParamUserData"
1
0
1
+48
0
47
"_Abnormal"
1
0
1
+20
0
48
"_DefenceDownTimeForNum [System.Single x3]"
1
0
1
+10
0
49
"[0]"
0
Float
+20
50
"[1]"
0
Float
+24
51
"[2]"
0
Float
+28
52
"_DefenseDownRateForNum [System.Single x3]"
1
0
1
+18
0
53
"[0]"
0
Float
+20
54
"[1]"
0
Float
+24
55
"[2]"
0
Float
+28
56
"_DefenseDownFinishBlowRateForNum [System.Single x3]"
1
0
1
+20
0
57
"[0]"
0
Float
+20
58
"[1]"
0
Float
+24
59
"[2]"
0
Float
+28
60
"_DefenceDownDownRateForRank [System.Single x3]"
1
0
1
+28
0
61
"[0]"
0
Float
+20
62
"[1]"
0
Float
+24
63
"[2]"
0
Float
+28
64
"_DefenceDownFinishBlowDamageRateForRank [System.Single x3]"
1
0
1
+30
0
65
"[0]"
0
Float
+20
66
"[1]"
0
Float
+24
67
"[2]"
0
Float
+28
68
"_DefenceDownResistanceTimeRate [System.Single x5]"
1
0
1
+38
0
69
"[0]"
0
Float
+20
70
"[1]"
0
Float
+24
71
"[2]"
0
Float
+28
72
"[3]"
0
Float
+2C
73
"[4]"
0
Float
+30
74
"_DefenceDownResistanceStackRate [System.Single x5]"
1
0
1
+40
0
75
"[0]"
0
Float
+20
76
"[1]"
0
Float
+24
77
"[2]"
0
Float
+28
78
"[3]"
0
Float
+2C
79
"[4]"
0
Float
+30
80
"_StunTimeFromCh18000"
0
Float
+13C
81
"_StunTimeForNum [System.Single x3]"
1
0
1
+48
0
82
"[0]"
0
Float
+20
83
"[1]"
0
Float
+24
84
"[2]"
0
Float
+28
85
"_StunAddTimeForRank [System.Single x3]"
1
0
1
+50
0
86
"[0]"
0
Float
+20
87
"[1]"
0
Float
+24
88
"[2]"
0
Float
+28
89
"_StunResistanceTimeRate [System.Single x5]"
1
0
1
+58
0
90
"[0]"
0
Float
+20
91
"[1]"
0
Float
+24
92
"[2]"
0
Float
+28
93
"[3]"
0
Float
+2C
94
"[4]"
0
Float
+30
95
"_StunResistanceStackRate [System.Single x5]"
1
0
1
+60
0
96
"[0]"
0
Float
+20
97
"[1]"
0
Float
+24
98
"[2]"
0
Float
+28
99
"[3]"
0
Float
+2C
100
"[4]"
0
Float
+30
101
"_ConfuseTimeForNum [System.Single x3]"
1
0
1
+68
0
102
"[0]"
0
Float
+20
103
"[1]"
0
Float
+24
104
"[2]"
0
Float
+28
105
"_ConfuseAttackRateForNum [System.Single x3]"
1
0
1
+70
0
106
"[0]"
0
Float
+20
107
"[1]"
0
Float
+24
108
"[2]"
0
Float
+28
109
"_ConfuseAttackRateForRank [System.Single x3]"
1
0
1
+78
0
110
"[0]"
0
Float
+20
111
"[1]"
0
Float
+24
112
"[2]"
0
Float
+28
113
"_ConfuseDoReactionCoolTimeForRank [System.Single x3]"
1
0
1
+80
0
114
"[0]"
0
Float
+20
115
"[1]"
0
Float
+24
116
"[2]"
0
Float
+28
117
"_ConfuseResistanceTimeRate [System.Single x5]"
1
0
1
+88
0
118
"[0]"
0
Float
+20
119
"[1]"
0
Float
+24
120
"[2]"
0
Float
+28
121
"[3]"
0
Float
+2C
122
"[4]"
0
Float
+30
123
"_ConfuseResistanceStackRate [System.Single x5]"
1
0
1
+90
0
124
"[0]"
0
Float
+20
125
"[1]"
0
Float
+24
126
"[2]"
0
Float
+28
127
"[3]"
0
Float
+2C
128
"[4]"
0
Float
+30
129
"_HealBaseValue"
0
Float
+120
130
"_HealConvertRateForRank [via.AnimationCurve x3]"
1
0
1
+98
0
131
"[0]"
1
0
8 Bytes
+FFFFFFFFFFFFEDA0
132
"[1]"
1
0
8 Bytes
+FFFFFFFFFFFFEE00
133
"[2]"
1
0
8 Bytes
+FFFFFFFFFFFFEE60
134
"_HealConvertRateMax"
0
Float
+150
135
"_HealRateForNum [System.Single x3]"
1
0
1
+A0
0
136
"[0]"
0
Float
+20
137
"[1]"
0
Float
+24
138
"[2]"
0
Float
+28
139
"_MultiOpenHackingTimeRateForNum [System.Single x3]"
1
0
1
+A8
0
140
"[0]"
0
Float
+20
141
"[1]"
0
Float
+24
142
"[2]"
0
Float
+28
143
"_MultiTargetNumForRank [System.Int32 x3]"
1
0
1
+B0
0
144
"[0]"
1
4 Bytes
+20
145
"[1]"
1
4 Bytes
+24
146
"[2]"
1
4 Bytes
+28
147
"_MultiRadiusForRank [System.Single x3]"
1
0
1
+B8
0
148
"[0]"
0
Float
+20
149
"[1]"
0
Float
+24
150
"[2]"
0
Float
+28
151
"_MultiStartExplodeTime"
0
Float
+124
152
"_MultiTargetExplodeTime"
0
Float
+128
153
"_ReceiveMultiHackingDamageRate"
0
Float
+12C
154
"_ReceiveMultiHackingFatalDamageRate"
0
Float
+130
155
"_ReceiveMultiHeatFatalDamageRate"
0
Float
+134
156
"_HeatDamageInterval"
0
Float
+138
157
"_HeatTriggerFatalValueForRank [System.Int32 x3]"
1
0
1
+C0
0
158
"[0]"
1
4 Bytes
+20
159
"[1]"
1
4 Bytes
+24
160
"[2]"
1
4 Bytes
+28
161
"_HeatBaseValue"
1
4 Bytes
+140
162
"_HeatTimeForNum [System.Single x3]"
1
0
1
+C8
0
163
"[0]"
0
Float
+20
164
"[1]"
0
Float
+24
165
"[2]"
0
Float
+28
166
"_HeatDamageRateForRank [System.Single x3]"
1
0
1
+D0
0
167
"[0]"
0
Float
+20
168
"[1]"
0
Float
+24
169
"[2]"
0
Float
+28
170
"_HeatFatalDamageRateForRank [System.Single x3]"
1
0
1
+D8
0
171
"[0]"
0
Float
+20
172
"[1]"
0
Float
+24
173
"[2]"
0
Float
+28
174
"_HeatHitFatalDamageRateForRank [System.Single x3]"
1
0
1
+E0
0
175
"[0]"
0
Float
+20
176
"[1]"
0
Float
+24
177
"[2]"
0
Float
+28
178
"_HeatResistanceTimeRate [System.Single x5]"
1
0
1
+E8
0
179
"[0]"
0
Float
+20
180
"[1]"
0
Float
+24
181
"[2]"
0
Float
+28
182
"[3]"
0
Float
+2C
183
"[4]"
0
Float
+30
184
"_HeatResistanceStackRate [System.Single x5]"
1
0
1
+F0
0
185
"[0]"
0
Float
+20
186
"[1]"
0
Float
+24
187
"[2]"
0
Float
+28
188
"[3]"
0
Float
+2C
189
"[4]"
0
Float
+30
190
"_ShockPuzzleDamageRateForNum [System.Single x3]"
1
0
1
+F8
0
191
"[0]"
0
Float
+20
192
"[1]"
0
Float
+24
193
"[2]"
0
Float
+28
194
"_ShockPuzzleDamageRate [System.Single x3]"
1
0
1
+100
0
195
"[0]"
0
Float
+20
196
"[1]"
0
Float
+24
197
"[2]"
0
Float
+28
198
"_ShockResistanceStackRate [System.Single x5]"
1
0
1
+110
0
199
"[0]"
0
Float
+20
200
"[1]"
0
Float
+24
201
"[2]"
0
Float
+28
202
"[3]"
0
Float
+2C
203
"[4]"
0
Float
+30
204
"_PowerUpTime"
0
Float
+144
205
"_PowerUpAttackRate"
0
Float
+148
206
"_PowerUpDamageRate"
0
Float
+14C
207
"_ActiveModeRate [System.Single x9]"
1
0
1
+118
0
208
"[0]"
0
Float
+20
209
"[1]"
0
Float
+24
210
"[2]"
0
Float
+28
211
"[3]"
0
Float
+2C
212
"[4]"
0
Float
+30
213
"[5]"
0
Float
+34
214
"[6]"
0
Float
+38
215
"[7]"
0
Float
+3C
216
"[8]"
0
Float
+40
217
"_FinishBlow"
1
0
1
+28
0
218
"_WaitTime"
0
FF8080
Float
+24
219
"_WaitEndDamage"
1
FF8080
4 Bytes
+18
220
"_AroundReactionRange"
0
FF8080
Float
+1C
221
"_DropRateInFinishBlowDead"
0
FF8080
Float
+20
222
"_FatalBreak"
1
0
1
+30
0
223
"_DecreaseValueInNormal"
0
FF8080
Float
+24
224
"_FatalBreakTime"
0
FF8080
Float
+18
225
"_DelayTimeOnFatalDamage"
0
FF8080
Float
+1C
226
"_AddDelayOnEnterOpen"
0
FF8080
Float
+20
227
"_HackingFatalDamageScaleInOpen"
0
FF8080
Float
+28
228
"_DropRateInFatalBreakDead"
0
FF8080
Float
+2C
229
"_AddHackingFataDamageArray"
1
0
1
+10
0
230
"[0]"
0
FF8080
Float
+20
231
"[1]"
0
FF8080
Float
+24
232
"[2]"
0
FF8080
Float
+28
233
"[3]"
0
FF8080
Float
+2C
234
"[4]"
0
FF8080
Float
+30
235
"_DeathBlow"
1
0
1
+38
0
236
"_DeathBlowTime"
0
FF8080
Float
+10
237
"_DeathBlow2Time"
0
FF8080
Float
+14
238
"_FriendHit"
1
0
1
+40
0
239
"_BaseDamageRate"
0
FF8080
Float
+10
240
"_BaseWinceRate"
0
FF8080
Float
+14
241
"_Hacking"
1
0
1
+48
0
242
"_FlashRemainTime"
0
FF8080
Float
+18
243
"_Weapon"
1
0
1
+60
0
244
"_OverrideReaction02LoopTimeUnits [app.EnemyBaseWeapon.OverrideReaction02LoopTimeUnit x1]"
1
0
1
+10
0
245
"[0]"
1
0
1
+20
0
246
"_WeaponID"
0
FF8080
4 Bytes
+18
247
"_OverrideReaction02LoopTime [System.Single x8]"
1
0
1
+10
0
248
"[0]"
0
FF8080
Float
+20
249
"[1]"
0
FF8080
Float
+24
250
"[2]"
0
FF8080
Float
+28
251
"[3]"
0
FF8080
Float
+2C
252
"[4]"
0
FF8080
Float
+30
253
"[5]"
0
FF8080
Float
+34
254
"[6]"
0
FF8080
Float
+38
255
"[7]"
0
FF8080
Float
+3C
256
"_EraseCodeGridUnit [app.EnemyBaseWeapon.EraseCodeGridUnit]"
1
0
1
+18
0
257
"_DefaultUnit [app.EnemyBaseWeapon.EraseCodeGridUnit.Unit]"
1
0
1
+10
0
258
"_EraseCodeGridNum [System.Int32 x7]"
1
0
1
+10
0
259
"[0]"
1
FF8080
4 Bytes
+20
260
"[1]"
1
FF8080
4 Bytes
+24
261
"[2]"
1
FF8080
4 Bytes
+28
262
"[3]"
1
FF8080
4 Bytes
+2C
263
"[4]"
1
FF8080
4 Bytes
+30
264
"[5]"
1
FF8080
4 Bytes
+34
265
"[6]"
1
FF8080
4 Bytes
+38
266
"_EraseCodeTimeRate"
0
FF8080
Float
+38
267
"_EraseCodeDamage [app.EnemyBaseWeapon.EraseCodeDamageUnit]"
1
0
1
+20
0
268
"_Damage"
1
FF8080
4 Bytes
+10
269
"_OpenTime"
0
FF8080
Float
+14
270
"_FatalDamage"
0
FF8080
Float
+18
271
"_Wp7800HeatRate [System.Single x9]"
1
0
1
+30
0
272
"[0]"
0
FF8080
Float
+20
273
"[1]"
0
FF8080
Float
+24
274
"[2]"
0
FF8080
Float
+28
275
"[3]"
0
FF8080
Float
+2C
276
"[4]"
0
FF8080
Float
+30
277
"[5]"
0
FF8080
Float
+34
278
"[6]"
0
FF8080
Float
+38
279
"[7]"
0
FF8080
Float
+3C
280
"[8]"
0
FF8080
Float
+40
281
"_Wp8300TimeRate"
0
FF8080
Float
+3C
282
"_PowerHacking"
1
0
1
+58
0
283
"_ReactionRange"
0
FF8080
Float
+10
284
"_ClearReactionValue"
1
FF8080
4 Bytes
+18
285
"_HalfClearReactionValue"
1
FF8080
4 Bytes
+1C
286
"_OneOrMoreReactionValue"
1
FF8080
4 Bytes
+20
287
"_AroundClearReactionValue"
1
FF8080
4 Bytes
+28
288
"_AroundHalfClearReactionValue"
1
FF8080
4 Bytes
+2C
289
"_AroundOneOrMoreReactionValue"
1
FF8080
4 Bytes
+30
290
"_AttackPermitData"
1
0
1
+60
0
291
"_AttackPermitRangeMin"
0
FF8080
Float
+20
292
"_AttackPermitRangeMax"
0
FF8080
Float
+24
293
"_AttackPermitAngleL"
0
FF8080
Float
+28
294
"_AttackPermitAngleR"
0
FF8080
Float
+2C
295
"GrappleIntervalTime"
0
FF8080
Float
+30
27
"Training Timer"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/04/19
}
[ENABLE]
aobscanmodule(INJECT_LOCK_CHALLENGE_TIMER,$process,C5 ?? 58 ?? B8 00 00 00 C5 ?? 11 ?? B8 00 00 00 ?? 8B ?? 50)
// raw AOB: CC CC CC 41 57 41 56 41 55 41 54 56 57 55 53 48 83 EC 48 48 8B 05 ?? ?? ?? ?? 48 31 E0 48 89 44 24 40 48 C7 44 24 30 00 00 00 00 C5 E2 58 82 B8 00 00 00 C5 FA 11 82 B8 00 00 00 48 8B 41 50 48 83 78 18 00 74 ?? 48 8B 4C 24 40 48 31 E1 E8 ?? ?? ?? ?? 90 48 83 C4 48 5B 5D 5F 5E 41 5C 41 5D 41 5E
// injection point AOB: C5 ?? 58 ?? B8 00 00 00 C5 ?? 11 ?? B8 00 00 00 ?? 8B ?? 50 ?? 83 ?? 18 00 74 ?? ?? 8B ?? 24 ?? ?? 31 ?? E8 ?? ?? ?? ?? 90 48 83 C4 48 ?? 5D
alloc(newmem,$1000,INJECT_LOCK_CHALLENGE_TIMER)
alloc(INJECT_LOCK_CHALLENGE_TIMERo, $8)
label(code)
label(return)
label(vf_target_ctime i_training_mode)
INJECT_LOCK_CHALLENGE_TIMERo:
readmem(INJECT_LOCK_CHALLENGE_TIMER, $8)
newmem:
vmovss xmm15, [vf_target_ctime]
vmovss xmm0, [rdx+000000B8]
cmp dword ptr [i_training_mode], 0
jne short chk_min
chk_max:
vucomiss xmm0, xmm15
jbe short code
vmovss [rdx+000000B8], xmm15
jmp short code
chk_min:
vucomiss xmm0, xmm15
jae short code
vmovss [rdx+000000B8], xmm15
code:
// vaddss xmm0,xmm3,[rdx+000000B8]
reassemble(INJECT_LOCK_CHALLENGE_TIMER)
jmp return
align 10 cc
vf_target_ctime:
dd (float)24
i_training_mode: // 0: max clamp, 1: min clamp
dd 0
INJECT_LOCK_CHALLENGE_TIMER:
jmp newmem
nop 3
return:
registersymbol(INJECT_LOCK_CHALLENGE_TIMER INJECT_LOCK_CHALLENGE_TIMERo)
registersymbol(vf_target_ctime i_training_mode)
[DISABLE]
INJECT_LOCK_CHALLENGE_TIMER:
readmem(INJECT_LOCK_CHALLENGE_TIMERo, $8)
unregistersymbol(INJECT_LOCK_CHALLENGE_TIMER INJECT_LOCK_CHALLENGE_TIMERo)
unregistersymbol(vf_target_ctime i_training_mode)
dealloc(newmem)
dealloc(INJECT_LOCK_CHALLENGE_TIMERo)
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+776DEF8
PRAGMATA.exe+776DECD: CC - int 3
PRAGMATA.exe+776DECE: CC - int 3
PRAGMATA.exe+776DECF: CC - int 3
PRAGMATA.exe+776DED0: 41 57 - push r15
PRAGMATA.exe+776DED2: 41 56 - push r14
PRAGMATA.exe+776DED4: 41 55 - push r13
PRAGMATA.exe+776DED6: 41 54 - push r12
PRAGMATA.exe+776DED8: 56 - push rsi
PRAGMATA.exe+776DED9: 57 - push rdi
PRAGMATA.exe+776DEDA: 55 - push rbp
PRAGMATA.exe+776DEDB: 53 - push rbx
PRAGMATA.exe+776DEDC: 48 83 EC 48 - sub rsp,48
PRAGMATA.exe+776DEE0: 48 8B 05 59 79 19 04 - mov rax,[PRAGMATA.exe+B905840]
PRAGMATA.exe+776DEE7: 48 31 E0 - xor rax,rsp
PRAGMATA.exe+776DEEA: 48 89 44 24 40 - mov [rsp+40],rax
PRAGMATA.exe+776DEEF: 48 C7 44 24 30 00 00 00 00 - mov qword ptr [rsp+30],00000000
// ---------- INJECTING HERE ----------
PRAGMATA.exe+776DEF8: C5 E2 58 82 B8 00 00 00 - vaddss xmm0,xmm3,[rdx+000000B8]
// ---------- DONE INJECTING ----------
PRAGMATA.exe+776DF00: C5 FA 11 82 B8 00 00 00 - vmovss [rdx+000000B8],xmm0
PRAGMATA.exe+776DF08: 48 8B 41 50 - mov rax,[rcx+50]
PRAGMATA.exe+776DF0C: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+776DF11: 74 1F - je PRAGMATA.exe+776DF32
PRAGMATA.exe+776DF13: 48 8B 4C 24 40 - mov rcx,[rsp+40]
PRAGMATA.exe+776DF18: 48 31 E1 - xor rcx,rsp
PRAGMATA.exe+776DF1B: E8 D0 74 8B FD - call PRAGMATA.AK::SoundEngine::Term+7F0
PRAGMATA.exe+776DF20: 90 - nop
PRAGMATA.exe+776DF21: 48 83 C4 48 - add rsp,48
PRAGMATA.exe+776DF25: 5B - pop rbx
PRAGMATA.exe+776DF26: 5D - pop rbp
PRAGMATA.exe+776DF27: 5F - pop rdi
PRAGMATA.exe+776DF28: 5E - pop rsi
PRAGMATA.exe+776DF29: 41 5C - pop r12
PRAGMATA.exe+776DF2B: 41 5D - pop r13
PRAGMATA.exe+776DF2D: 41 5E - pop r14
}
28
"Training Timer Mode"
0:Keep at or below Target Time
1:Keep at or above Target Time
0
C08000
4 Bytes
i_training_mode
29
"Target Time Value"
0
C08000
Float
vf_target_ctime
8007
"=== SYSTEM ==="
404040
1
8
"Gravity Override"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/04/17
}
[ENABLE]
aobscanmodule(INJECT_GET_GRAVITY_2,$process,C5 ?? 28 ?? C5 ?? 10 ?? 20 C5 ?? 11)
// raw AOB: 56 57 53 48 83 EC 68 C5 F8 29 74 24 50 48 8B 05 ?? ?? ?? ?? 48 31 E0 48 89 44 24 48 48 8B 41 50 48 83 78 18 00 0F 85 ?? ?? ?? ?? 48 89 D7 48 89 CE 48 8B 82 30 03 00 00 48 85 C0 0F 84 ?? ?? ?? ?? C5 F8 28 F2 C5 FA 10 40 20 C5 FA 11 50 20 48 8B 46 50 48 83 78 18 00 0F 85 ?? ?? ?? ?? C5 FA 5C C6 C4 E2 79 18 0D ?? ?? ?? ?? C5 F8 54 C1 C5 FA 10 0D ?? ?? ?? ?? C5 F8 2E C8 0F 82 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? C5 FA 11 B0 30 01 00 00 48 8B 46 50 48 83 78 18 00
// injection point AOB: C5 ?? 28 ?? C5 ?? 10 ?? 20 C5 ?? 11 ?? 20 ?? 8B ?? 50 ?? 83 ?? 18 00 0F 85 ?? ?? ?? ?? C5 ?? 5C ?? C4 ?? ?? 18 ?? ?? ?? ?? ?? C5 ?? 54 ?? C5 ?? 10 ?? ?? ?? ?? ?? C5 ?? 2E ?? 0F 82 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 85 ?? 0F 84 ?? ?? ?? ?? C5 ?? 11 ?? 30 01 00 00 ?? 8B ?? 50 ?? 83 ?? 18 00
alloc(newmem,$1000,INJECT_GET_GRAVITY_2)
alloc(INJECT_GET_GRAVITY_2o, $9)
label(code)
label(return)
label(vf_target_graviry is_set_gravity)
INJECT_GET_GRAVITY_2o:
readmem(INJECT_GET_GRAVITY_2, $9)
newmem:
cmp dword ptr [is_set_gravity], 1
jne short code
vmovss xmm2, [vf_target_graviry]
code:
// vmovaps xmm6,xmm2
reassemble(INJECT_GET_GRAVITY_2)
// vmovss xmm0,[rax+20]
reassemble(INJECT_GET_GRAVITY_2+4)
jmp return
align 10 cc
vf_target_graviry:
dd (float)1
is_set_gravity:
dd 0
INJECT_GET_GRAVITY_2:
jmp newmem
nop 4
return:
registersymbol(INJECT_GET_GRAVITY_2 INJECT_GET_GRAVITY_2o)
registersymbol(vf_target_graviry is_set_gravity)
[DISABLE]
INJECT_GET_GRAVITY_2:
readmem(INJECT_GET_GRAVITY_2o, $9)
unregistersymbol(INJECT_GET_GRAVITY_2 INJECT_GET_GRAVITY_2o)
unregistersymbol(vf_target_graviry is_set_gravity)
dealloc(newmem)
dealloc(INJECT_GET_GRAVITY_2o)
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+299533
PRAGMATA.exe+2994F2: 56 - push rsi
PRAGMATA.exe+2994F3: 57 - push rdi
PRAGMATA.exe+2994F4: 53 - push rbx
PRAGMATA.exe+2994F5: 48 83 EC 68 - sub rsp,68
PRAGMATA.exe+2994F9: C5 F8 29 74 24 50 - vmovaps [rsp+50],xmm6
PRAGMATA.exe+2994FF: 48 8B 05 3A C3 66 0B - mov rax,[PRAGMATA.exe+B905840]
PRAGMATA.exe+299506: 48 31 E0 - xor rax,rsp
PRAGMATA.exe+299509: 48 89 44 24 48 - mov [rsp+48],rax
PRAGMATA.exe+29950E: 48 8B 41 50 - mov rax,[rcx+50]
PRAGMATA.exe+299512: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+299517: 0F 85 28 01 00 00 - jne PRAGMATA.exe+299645
PRAGMATA.exe+29951D: 48 89 D7 - mov rdi,rdx
PRAGMATA.exe+299520: 48 89 CE - mov rsi,rcx
PRAGMATA.exe+299523: 48 8B 82 30 03 00 00 - mov rax,[rdx+00000330]
PRAGMATA.exe+29952A: 48 85 C0 - test rax,rax
PRAGMATA.exe+29952D: 0F 84 46 01 00 00 - je PRAGMATA.exe+299679
// ---------- INJECTING HERE ----------
PRAGMATA.exe+299533: C5 F8 28 F2 - vmovaps xmm6,xmm2
// ---------- DONE INJECTING ----------
PRAGMATA.exe+299537: C5 FA 10 40 20 - vmovss xmm0,[rax+20]
PRAGMATA.exe+29953C: C5 FA 11 50 20 - vmovss [rax+20],xmm2
PRAGMATA.exe+299541: 48 8B 46 50 - mov rax,[rsi+50]
PRAGMATA.exe+299545: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+29954A: 0F 85 F5 00 00 00 - jne PRAGMATA.exe+299645
PRAGMATA.exe+299550: C5 FA 5C C6 - vsubss xmm0,xmm0,xmm6
PRAGMATA.exe+299554: C4 E2 79 18 0D 3F EB D1 08 - vbroadcastss xmm1,[PRAGMATA.exe+8FB809C]
PRAGMATA.exe+29955D: C5 F8 54 C1 - vandps xmm0,xmm0,xmm1
PRAGMATA.exe+299561: C5 FA 10 0D 67 16 D2 08 - vmovss xmm1,[PRAGMATA.exe+8FBABD0]
PRAGMATA.exe+299569: C5 F8 2E C8 - vucomiss xmm1,xmm0
PRAGMATA.exe+29956D: 0F 82 32 01 00 00 - jb PRAGMATA.exe+2996A5
PRAGMATA.exe+299573: 48 8B 05 5E 16 72 0B - mov rax,[PRAGMATA.exe+B9BABD8]
PRAGMATA.exe+29957A: 48 85 C0 - test rax,rax
PRAGMATA.exe+29957D: 0F 84 A4 01 00 00 - je PRAGMATA.exe+299727
PRAGMATA.exe+299583: C5 FA 11 B0 30 01 00 00 - vmovss [rax+00000130],xmm6
PRAGMATA.exe+29958B: 48 8B 46 50 - mov rax,[rsi+50]
}
9
"Gravity Mode"
0:Off
1:Apply Gravity Multiplier
YesNo
0
C08000
4 Bytes
is_set_gravity
10
"Gravity Multiplier (1.0 normal, 0.5 low, 2.0 heavy)"
0
C08000
Float
vf_target_graviry
1
"Compact View (hides clutter)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not toggleCompactView then
function toggleCompactView(sender, forceEnable)
local isCompactMode = not (compactViewMenuItem.Caption == 'Compact View Mode')
if forceEnable ~= nil then
isCompactMode = not forceEnable
end
synchronize(function()
compactViewMenuItem.Caption = isCompactMode and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = isCompactMode
getMainForm().Panel4.Visible = isCompactMode
getMainForm().Panel5.Visible = isCompactMode
end)
end
end
if not createCompactViewMenu then
function createCompactViewMenu()
if isCompactMenuCreated then return end
synchronize(function()
local mainMenu = getMainForm().Menu.Items
compactViewMenuItem = createMenuItem(mainMenu)
compactViewMenuItem.Caption = 'Compact View Mode'
compactViewMenuItem.OnClick = toggleCompactView
mainMenu.add(compactViewMenuItem)
end)
isCompactMenuCreated = true
end
end
createCompactViewMenu()
toggleCompactView(nil, true)
[DISABLE]
{$lua}
if toggleCompactView then
toggleCompactView(nil, false)
end
8008
"[internal] Auto-loaded scanners -- do not toggle manually"
808080
1
6
"[internal] gravity scanner"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://opencheattables.com
Date : 2026/04/17
}
[ENABLE]
aobscanmodule(INJECT_GET_GRAVITY,$process,C5 ?? 11 ?? 30 01 00 00 ?? 8B ?? 50 ?? 83 ?? 18 00 0F 85 ?? ?? ?? ?? ?? 8B ?? 80)
// raw AOB: 0F 84 ?? ?? ?? ?? C5 F8 28 F2 C5 FA 10 40 20 C5 FA 11 50 20 48 8B 46 50 48 83 78 18 00 0F 85 ?? ?? ?? ?? C5 FA 5C C6 C4 E2 79 18 0D ?? ?? ?? ?? C5 F8 54 C1 C5 FA 10 0D ?? ?? ?? ?? C5 F8 2E C8 0F 82 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? C5 FA 11 B0 30 01 00 00 48 8B 46 50 48 83 78 18 00 0F 85 ?? ?? ?? ?? 48 8B 87 80 03 00 00 48 85 C0 0F 84 ?? ?? ?? ?? 48 8B 40 50 48 85 C0 0F 84 ?? ?? ?? ?? 48 8B 80 30 03 00 00 48 85 C0 0F 84 ?? ?? ?? ?? C5 FA 10 05 ?? ?? ?? ?? C5 F8 2E 40 20 0F 97 C3 48 8B 46 50
// injection point AOB: C5 ?? 11 ?? 30 01 00 00 ?? 8B ?? 50 ?? 83 ?? 18 00 0F 85 ?? ?? ?? ?? ?? 8B ?? 80 03 00 00 ?? 85 ?? 0F 84 ?? ?? ?? ?? ?? 8B ?? 50 ?? 85 ?? 0F 84 ?? ?? ?? ?? ?? 8B ?? 30 03 00 00 ?? 85 ?? 0F 84 ?? ?? ?? ?? C5 ?? 10 ?? ?? ?? ?? ?? C5 ?? 2E ?? 20 0F 97 ?? ?? 8B ?? 50
alloc(newmem,$1000,INJECT_GET_GRAVITY)
alloc(INJECT_GET_GRAVITYo, $8)
label(code)
label(return)
label(i_base_gravirty_addr)
INJECT_GET_GRAVITYo:
readmem(INJECT_GET_GRAVITY, $8)
newmem:
mov [i_base_gravirty_addr], rax
code:
// vmovss [rax+00000130],xmm6
reassemble(INJECT_GET_GRAVITY)
jmp return
align 10 cc
i_base_gravirty_addr:
dq 0
INJECT_GET_GRAVITY:
jmp newmem
nop 3
return:
registersymbol(INJECT_GET_GRAVITY INJECT_GET_GRAVITYo)
registersymbol(i_base_gravirty_addr)
[DISABLE]
INJECT_GET_GRAVITY:
readmem(INJECT_GET_GRAVITYo, $8)
unregistersymbol(INJECT_GET_GRAVITY INJECT_GET_GRAVITYo)
unregistersymbol(i_base_gravirty_addr)
dealloc(newmem)
dealloc(INJECT_GET_GRAVITYo)
{
// ORIGINAL CODE - INJECTION POINT: PRAGMATA.exe+299583
PRAGMATA.exe+29952D: 0F 84 46 01 00 00 - je PRAGMATA.exe+299679
PRAGMATA.exe+299533: C5 F8 28 F2 - vmovaps xmm6,xmm2
PRAGMATA.exe+299537: C5 FA 10 40 20 - vmovss xmm0,[rax+20]
PRAGMATA.exe+29953C: C5 FA 11 50 20 - vmovss [rax+20],xmm2
PRAGMATA.exe+299541: 48 8B 46 50 - mov rax,[rsi+50]
PRAGMATA.exe+299545: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+29954A: 0F 85 F5 00 00 00 - jne PRAGMATA.exe+299645
PRAGMATA.exe+299550: C5 FA 5C C6 - vsubss xmm0,xmm0,xmm6
PRAGMATA.exe+299554: C4 E2 79 18 0D 3F EB D1 08 - vbroadcastss xmm1,[PRAGMATA.exe+8FB809C]
PRAGMATA.exe+29955D: C5 F8 54 C1 - vandps xmm0,xmm0,xmm1
PRAGMATA.exe+299561: C5 FA 10 0D 67 16 D2 08 - vmovss xmm1,[PRAGMATA.exe+8FBABD0]
PRAGMATA.exe+299569: C5 F8 2E C8 - vucomiss xmm1,xmm0
PRAGMATA.exe+29956D: 0F 82 32 01 00 00 - jb PRAGMATA.exe+2996A5
PRAGMATA.exe+299573: 48 8B 05 5E 16 72 0B - mov rax,[PRAGMATA.exe+B9BABD8]
PRAGMATA.exe+29957A: 48 85 C0 - test rax,rax
PRAGMATA.exe+29957D: 0F 84 A4 01 00 00 - je PRAGMATA.exe+299727
// ---------- INJECTING HERE ----------
PRAGMATA.exe+299583: C5 FA 11 B0 30 01 00 00 - vmovss [rax+00000130],xmm6
// ---------- DONE INJECTING ----------
PRAGMATA.exe+29958B: 48 8B 46 50 - mov rax,[rsi+50]
PRAGMATA.exe+29958F: 48 83 78 18 00 - cmp qword ptr [rax+18],00
PRAGMATA.exe+299594: 0F 85 AB 00 00 00 - jne PRAGMATA.exe+299645
PRAGMATA.exe+29959A: 48 8B 87 80 03 00 00 - mov rax,[rdi+00000380]
PRAGMATA.exe+2995A1: 48 85 C0 - test rax,rax
PRAGMATA.exe+2995A4: 0F 84 7D 01 00 00 - je PRAGMATA.exe+299727
PRAGMATA.exe+2995AA: 48 8B 40 50 - mov rax,[rax+50]
PRAGMATA.exe+2995AE: 48 85 C0 - test rax,rax
PRAGMATA.exe+2995B1: 0F 84 AB 00 00 00 - je PRAGMATA.exe+299662
PRAGMATA.exe+2995B7: 48 8B 80 30 03 00 00 - mov rax,[rax+00000330]
PRAGMATA.exe+2995BE: 48 85 C0 - test rax,rax
PRAGMATA.exe+2995C1: 0F 84 9B 00 00 00 - je PRAGMATA.exe+299662
PRAGMATA.exe+2995C7: C5 FA 10 05 BD EA D1 08 - vmovss xmm0,[PRAGMATA.exe+8FB808C]
PRAGMATA.exe+2995CF: C5 F8 2E 40 20 - vucomiss xmm0,[rax+20]
PRAGMATA.exe+2995D4: 0F 97 C3 - seta bl
PRAGMATA.exe+2995D7: 48 8B 46 50 - mov rax,[rsi+50]
}
7
"Current Gravity Rate (read-only)"
0
FF8080
Float
i_base_gravirty_addr
130
571
"Table Helpers (internal)"
006600
1
572
"YesNo"
0:No
1:Yes
1
573
"Overdrive Pointer Scanner (internal)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not AOBScanModule then
function AOBScanModule(moduleName, signature)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then return nil end
local ms = createMemScan()
synchronize(function()
ms.firstScan(soExactValue, vtByteArray, nil, signature,
nil, baseAddr, maxAddr, '+X-C-W', fsmNotAligned, '1', true, true, false, false)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
results.destroy()
ms.destroy()
return addr
end
end
local AOBs = {
{name='FAST_OVERDRIVE_PLUS_30', aob='?? 8B ?? ?? ?? ?? ?? ?? 8B ?? 50 ?? 85 ?? 0F 84 ?? ?? ?? ?? ?? 8D ?? 24 ?? ?? 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? C4 ?? ?? 7E ?? ?? 8B ?? 50 ?? 8B ?? 18 ?? 85 ?? 0F 94 ?? 74 ?? C5 ?? 57 ?? EB ?? C5 ?? 10 ?? ?? ?? C5 ?? 6E ?? C5 ?? 70 ?? 50 C5 ?? 72 ?? 1F C5 ?? 72 ?? 1F C5 ?? DB ?? C5 ?? D6 ?? ?? ?? C5 ?? 11 ?? ?? ?? ?? 85 ?? 75', pos=3, aoblen=7, symbol='FAST_OVERDRIVE_PLUS_30_addr'},
}
local module_name = process
for _, entry in ipairs(AOBs) do
local aob_addr_str = AOBScanModule(module_name, entry.aob)
if aob_addr_str then
local aob_addr_val = tonumber(aob_addr_str, 16)
local offset_addr = aob_addr_val + entry.pos
local relative_offset = readInteger(offset_addr, true)
local final_addr = relative_offset + aob_addr_val + entry.aoblen
synchronize(function()
unregisterSymbol(entry.symbol)
registerSymbol(entry.symbol, final_addr)
end)
print(string.format('[SymbolScanner] %s registered at: %X', entry.name, final_addr))
else
print(string.format('[SymbolScanner] WARNING: AOB scan failed for %s', entry.name))
end
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
unregisterSymbol('FAST_OVERDRIVE_PLUS_30_addr')
{$asm}
{
PRAGMATA.exe+2D5BC0 - 48 8B 90 80000000 - mov rdx,[rax+System.Text.Unicode.UnicodeRanges._u0750]
PRAGMATA.exe+2D5BC7 - 48 85 D2 - test rdx,rdx
PRAGMATA.exe+2D5BCA - 0F84 F5010000 - je PRAGMATA.exe+2D5DC5
===> here: PRAGMATA.exe+2D5BD0 - C5FA1071 10 - vmovss xmm6,[rcx+10]
PRAGMATA.exe+2D5BD5 - 48 89 F1 - mov rcx,rsi
PRAGMATA.exe+2D5BD8 - E8 D3D8EFFF - call PRAGMATA.exe+1D34B0
PRAGMATA.exe+2D5BDD - 48 8B 4E 50 - mov rcx,[rsi+50]
PRAGMATA.exe+2D5BE1 - 48 83 79 18 00 - cmp qword ptr [rcx+18],00
PRAGMATA.exe+2D5BE6 - 0F85 C2000000 - jne PRAGMATA.exe+2D5CAE
PRAGMATA.exe+2D5BEC - 48 85 C0 - test rax,rax
PRAGMATA.exe+2D5BEF - 0F84 D0010000 - je PRAGMATA.exe+2D5DC5
PRAGMATA.exe+2D5BF5 - C5F82E70 1C - vucomiss xmm6,[rax+1C]
PRAGMATA.exe+2D5BFA - 0F83 CB000000 - jae PRAGMATA.exe+2D5CCB
this RIP symbol here==> PRAGMATA.exe+2D5C00 - 48 8B 1D 01AE6C0B - mov rbx,[PRAGMATA.exe+B9A0A08]
PRAGMATA.exe+2D5C07 - 4C 8B 47 50 - mov r8,[rdi+50]
PRAGMATA.exe+2D5C0B - 4D 85 C0 - test r8,r8
PRAGMATA.exe+2D5C0E - 0F84 6D010000 - je PRAGMATA.exe+2D5D81
PRAGMATA.exe+2D5C14 - 4C 8D 74 24 40 - lea r14,[rsp+40]
PRAGMATA.exe+2D5C19 - 4C 89 F1 - mov rcx,r14
PRAGMATA.exe+2D5C1C - 48 89 F2 - mov rdx,rsi
PRAGMATA.exe+2D5C1F - E8 DCF5BD04 - call PRAGMATA.exe+4EB5200
PRAGMATA.exe+2D5C24 - C4C17A7E0E - vmovq xmm1,[r14]
PRAGMATA.exe+2D5C29 - 48 8B 46 50 - mov rax,[rsi+50]
PRAGMATA.exe+2D5C2D - 48 8B 40 18 - mov rax,[rax+18]
PRAGMATA.exe+2D5C7B - C5FA101D AD 27CE08 - vmovss xmm3,[PRAGMATA.exe+8FB8430] <(999.00)>
name='FAST_OVERDRIVE_PLUS_XX_Offsets', aob='C5 ?? 10 ?? ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? E8 ?? ?? ?? ?? ?? 8B ?? 50 31 ?? ?? 83 ?? 18 00 ?? 0F 44 ?? 75', pos=4, aoblen=8, symbol='FAST_OVERDRIVE_PLUS_XX_Offsets_addr'
}