16
"only at Charakter Generation"
1
15
"Charakter Stat Points to be spent"
Byte
arx.exe+453E58
18
"Skill Points to be spent"
Byte
arx.exe+453E59
23
"The usual values"
1
20
"Hitpoints Current"
0000FF
Float
arx.exe+453E24
25
"Mana Current"
0
FF0000
Float
arx.exe+453E2c
31
"Gold"
2 Bytes
arx.exe+453E92
48
"XP"
0
4 Bytes
arx.exe+453E5E
50
"Food"
0
Float
arx.exe+453E86
33
"Skill Points (Base Values, don't worry - just push them)"
1
32
"Stealth"
0
Float
00853DF8
34
"Dexterity"
0
Float
00853DFC
35
"Senses"
0
Float
00853E00
36
"Astral"
0
Float
00853E04
37
"Knowledge"
0
Float
00853E08
39
"Magic"
0
Float
00853E0C
40
"Distance Weapons"
0
Float
00853E10
41
"Brawl"
0
Float
00853E14
42
"Defense"
0
Float
00853E18
60
"Durability Scripts"
1
62
"Armor"
Auto Assembler Script
define(address,"arx.exe"+38F03)
define(bytes,F3 0F 11 8F 84 0A 00 00)
[ENABLE]
assert(address,bytes)
address:
nop
nop
nop
nop
nop
nop
nop
nop
[DISABLE]
address:
db bytes
// movss [edi+00000A84],xmm1
{
// ORIGINAL CODE - INJECTION POINT: arx.exe+38F03
arx.exe+38ED4: F3 0F 10 8F 84 0A 00 00 - movss xmm1,[edi+00000A84]
arx.exe+38EDC: 66 0F 6E C0 - movd xmm0,eax
arx.exe+38EE0: 0F 5B C0 - cvtdq2ps xmm0,xmm0
arx.exe+38EE3: F3 0F 59 05 20 C6 5F 00 - mulss xmm0,[arx.exe+1FC620]
arx.exe+38EEB: F3 0F 59 05 14 C6 5F 00 - mulss xmm0,[arx.exe+1FC614]
arx.exe+38EF3: 0F 2F C1 - comiss xmm0,xmm1
arx.exe+38EF6: 76 27 - jna arx.exe+38F1F
arx.exe+38EF8: F3 0F 5C 4D 08 - subss xmm1,[ebp+08]
arx.exe+38EFD: 0F 57 C0 - xorps xmm0,xmm0
arx.exe+38F00: 0F 2F C1 - comiss xmm0,xmm1
// ---------- INJECTING HERE ----------
arx.exe+38F03: F3 0F 11 8F 84 0A 00 00 - movss [edi+00000A84],xmm1
// ---------- DONE INJECTING ----------
arx.exe+38F0B: 72 12 - jb arx.exe+38F1F
arx.exe+38F0D: 6A 00 - push 00
arx.exe+38F0F: 68 20 C7 5F 00 - push arx.exe+1FC720
arx.exe+38F14: 6A 46 - push 46
arx.exe+38F16: 57 - push edi
arx.exe+38F17: E8 84 DD 08 00 - call arx.exe+C6CA0
arx.exe+38F1C: 83 C4 10 - add esp,10
arx.exe+38F1F: 83 C6 02 - add esi,02
arx.exe+38F22: 81 FE 30 3D 85 00 - cmp esi,arx.exe+453D30
arx.exe+38F28: 7C 8E - jl arx.exe+38EB8
}
63
"Weapon"
Auto Assembler Script
define(address,"arx.exe"+3937F)
define(bytes,F3 0F 11 8E 84 0A 00 00)
[ENABLE]
assert(address,bytes)
address:
nop
nop
nop
nop
nop
nop
nop
nop
[DISABLE]
address:
db bytes
// movss [esi+00000A84],xmm1
{
// ORIGINAL CODE - INJECTION POINT: arx.exe+3937F
arx.exe+39350: F3 0F 10 8E 84 0A 00 00 - movss xmm1,[esi+00000A84]
arx.exe+39358: 66 0F 6E C0 - movd xmm0,eax
arx.exe+3935C: 0F 5B C0 - cvtdq2ps xmm0,xmm0
arx.exe+3935F: F3 0F 59 05 20 C6 5F 00 - mulss xmm0,[arx.exe+1FC620]
arx.exe+39367: F3 0F 59 05 14 C6 5F 00 - mulss xmm0,[arx.exe+1FC614]
arx.exe+3936F: 0F 2F C1 - comiss xmm0,xmm1
arx.exe+39372: 76 27 - jna arx.exe+3939B
arx.exe+39374: F3 0F 5C 4D 0C - subss xmm1,[ebp+0C]
arx.exe+39379: 0F 57 C0 - xorps xmm0,xmm0
arx.exe+3937C: 0F 2F C1 - comiss xmm0,xmm1
// ---------- INJECTING HERE ----------
arx.exe+3937F: F3 0F 11 8E 84 0A 00 00 - movss [esi+00000A84],xmm1
// ---------- DONE INJECTING ----------
arx.exe+39387: 72 12 - jb arx.exe+3939B
arx.exe+39389: 6A 00 - push 00
arx.exe+3938B: 68 20 C7 5F 00 - push arx.exe+1FC720
arx.exe+39390: 6A 46 - push 46
arx.exe+39392: 56 - push esi
arx.exe+39393: E8 08 D9 08 00 - call arx.exe+C6CA0
arx.exe+39398: 83 C4 10 - add esp,10
arx.exe+3939B: 5E - pop esi
arx.exe+3939C: 5D - pop ebp
arx.exe+3939D: C3 - ret
}
64
"Torch in Hand"
Auto Assembler Script
define(address,"arx.exe"+ABD83)
define(bytes,F3 0F 11 88 84 0A 00 00)
[ENABLE]
assert(address,bytes)
address:
nop
nop
nop
nop
nop
nop
nop
nop
[DISABLE]
address:
db bytes
// movss [eax+00000A84],xmm1
{
// ORIGINAL CODE - INJECTION POINT: arx.exe+ABD83
arx.exe+ABD4A: 85 C0 - test eax,eax
arx.exe+ABD4C: 0F 84 E2 00 00 00 - je arx.exe+ABE34
arx.exe+ABD52: C7 80 8C 0A 00 00 00 00 00 00 - mov [eax+00000A8C],00000000
arx.exe+ABD5C: F3 0F 10 05 D0 0A 9A 00 - movss xmm0,[arx.exe+5A0AD0]
arx.exe+ABD64: A1 98 3F 85 00 - mov eax,[arx.exe+453F98]
arx.exe+ABD69: F3 0F 59 05 24 C6 5F 00 - mulss xmm0,[arx.exe+1FC624]
arx.exe+ABD71: F3 0F 10 88 84 0A 00 00 - movss xmm1,[eax+00000A84]
arx.exe+ABD79: F3 0F 5C C8 - subss xmm1,xmm0
arx.exe+ABD7D: 0F 57 C0 - xorps xmm0,xmm0
arx.exe+ABD80: 0F 2F C1 - comiss xmm0,xmm1
// ---------- INJECTING HERE ----------
arx.exe+ABD83: F3 0F 11 88 84 0A 00 00 - movss [eax+00000A84],xmm1
// ---------- DONE INJECTING ----------
arx.exe+ABD8B: 0F 82 A3 00 00 00 - jb arx.exe+ABE34
arx.exe+ABD91: FF 35 98 3F 85 00 - push [arx.exe+453F98]
arx.exe+ABD97: E8 F4 15 03 00 - call arx.exe+DD390
arx.exe+ABD9C: FF 35 98 3F 85 00 - push [arx.exe+453F98]
arx.exe+ABDA2: E8 79 50 01 00 - call arx.exe+C0E20
arx.exe+ABDA7: A1 98 3F 85 00 - mov eax,[arx.exe+453F98]
arx.exe+ABDAC: B9 07 00 00 00 - mov ecx,00000007
arx.exe+ABDB1: 66 89 88 B0 04 00 00 - mov [eax+000004B0],cx
arx.exe+ABDB8: B9 FD FF 00 00 - mov ecx,0000FFFD
arx.exe+ABDBD: A1 98 3F 85 00 - mov eax,[arx.exe+453F98]
}
Change of movss [arx.exe+453E24],xmm1
arx.exe+AB933
04
F3
0F
58
CD
F3
0F
11
0D
24
3E
85
00
F3
0F
10
05
A4