1337187103
"━━━━━━━━ Estranged: The Departure ━━━━━━━━"
1
3746
"━━━━━━━━ 🖥️ COMPACT VIEW ━━━━━━━━"
Auto Assembler Script
[ENABLE]
// Script Created By mgr.inz.Player On CE Forums
LuaCall(function cycleFullCompact(sender,force) local state = not(compactmenuitem.Caption == 'Compact View Mode'); if force~=nil then state = not force end; compactmenuitem.Caption = state and 'Compact View Mode' or 'Full View Mode'; getMainForm().Splitter1.Visible = state; getMainForm().Panel4.Visible = state; getMainForm().Panel5.Visible = state; end; function addCompactMenu() if compactmenualreadyexists then return end; local parent = getMainForm().Menu.Items; compactmenuitem = createMenuItem(parent); parent.add(compactmenuitem); compactmenuitem.Caption = 'Compact View Mode'; compactmenuitem.OnClick = cycleFullCompact; compactmenualreadyexists = 'yes'; end; addCompactMenu(); cycleFullCompact(nil,true))
[DISABLE]
LuaCall(cycleFullCompact(nil,false))
1337187109
""
1
1337187053
"━━━━━━━━ 🧍 PLAYER ━━━━━━━━"
Auto Assembler Script
{
==============================================
Table by SeryogaSK
----------------------------------------------
Process : Insulam-Win64-Shipping.exe
Game Title : Estranged: The Departure
Game Version : Steam
Author : SeryogaSK
----------------------------------------------
Warning: Online use may trigger anti-cheat!
==============================================
}
[ENABLE]
{$lua}
if syntaxcheck then return end
function gps_aob_register(sym, ...)
local patterns = {...}
local function showErrorMsg(msg)
local f = createForm(false)
f.Caption = 'GenPointerScript - Error'
f.Width = 400
f.Height = 200
f.Position = poScreenCenter
f.BorderStyle = bsDialog
local lbl = createLabel(f)
lbl.Caption = msg
lbl.Left = 20
lbl.Top = 20
lbl.Width = 360
lbl.Height = 100
lbl.WordWrap = true
local btn = createButton(f)
btn.Caption = 'OK'
btn.Left = 150
btn.Top = 130
btn.Width = 80
btn.Height = 30
btn.OnClick = function() f.close() end
f.show()
end
-- Iterate through all supplied patterns in order
for i, pat in ipairs(patterns) do
local instr = AOBScan(pat, '+X')
if instr and instr.Count > 0 then
if instr.Count == 1 then
local addy = instr[0]
instr.destroy()
unregisterSymbol(sym)
registerSymbol(sym, tonumber(addy, 16))
return
else
local cnt = instr.Count
instr.destroy()
end
else
if instr then instr.destroy() end
end
end
-- All patterns exhausted without a unique match
showErrorMsg('AOB patterns not found!\n\nAll ' .. #patterns .. ' pattern(s) failed to locate the injection point.\nThe game may have been updated.')
error('All ' .. #patterns .. ' AOB pattern(s) failed')
end
gps_aob_register("ply_base",
"48 8B 01 48 89 5C 24 20 FF 90 58 02 00 00 48 89 44 24 68 48 8B C8",
"48 ?? ?? 48 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F ?? ?? ?? ?? ?? 49 ?? ?? 44 ?? ?? ?? 44 ?? ?? ??")
function gps_calculateInstructionDetails(address)
local totalSize = 0
local currentAddr = tonumber(address)
while totalSize < 5 do
local size = getInstructionSize(currentAddr)
if not size or size == 0 then
error('Could not determine instruction size at address: ' .. string.format('0x%X', currentAddr))
end
totalSize = totalSize + size
currentAddr = currentAddr + size
end
local nopCount = totalSize - 5
return totalSize, nopCount
end
local ply_baseAddr = getAddressSafe('ply_base')
if not ply_baseAddr then error('ply_base address not found!') end
local gps_ply_baseTotalBytes, gps_ply_baseNopCount = gps_calculateInstructionDetails(ply_baseAddr)
_G.gps_ply_baseTotalBytes = gps_ply_baseTotalBytes
_G.gps_ply_baseNopCount = gps_ply_baseNopCount
_G.gps_ply_baseReadmemInstr = string.format('readmem(ply_base,%d)', gps_ply_baseTotalBytes)
_G.gps_ply_baseNopInstructions = ''
if gps_ply_baseNopCount > 0 then
for i = 1, gps_ply_baseNopCount do
_G.gps_ply_baseNopInstructions = _G.gps_ply_baseNopInstructions .. 'nop\n'
end
_G.gps_ply_baseNopInstructions = _G.gps_ply_baseNopInstructions:sub(1, -2)
end
{$asm}
alloc(newmem,$1000,ply_base)
alloc(ply_baseCopy,30)
registersymbol(ply_baseCopy)
ply_baseCopy:
readmem(ply_base,30)
label(code)
label(return)
alloc(seeply_base,168)
registersymbol(seeply_base)
alloc(seeply_baseStatus,8)
registersymbol(seeply_baseStatus)
newmem:
mov [seeply_base],rcx
code:
{$lua}
return _G.gps_ply_baseReadmemInstr
{$asm}
jmp return
seeply_base:
dq 0
seeply_baseStatus:
dq 0
ply_base:
jmp newmem
{$lua}
return _G.gps_ply_baseNopInstructions
{$asm}
return:
{$lua}
local gps_ply_baseRegs = { "rbx","rsi","rdi","rcx","rdx","rax","r8","r9","r10","r11","r12","r13","r14","r15","rbp","rsp" }
local gps_ply_baseRegOffsets = { rbx=8, rsi=24, rdi=40, rcx=56, rdx=72, rax=88, r8=104, r9=120, r10=136, r11=152, r12=264, r13=280, r14=296, r15=312, rbp=328, rsp=344 }
_G.gps_ply_baseAddressEntry = nil
_G.gps_ply_baseOriginalStaticAddr = nil
_G.gps_ply_baseBasePointer = nil
_G.gps_ply_baseCurrentRegister = nil
local function gps_forceRefreshply_baseEntry(symbolName, newAddress)
local addrList = getAddressList()
for i = 0, addrList.Count-1 do
local entry = addrList[i]
if entry.Address == symbolName then
entry.Address = string.format("0x%X", newAddress)
sleep(1)
entry.Address = symbolName
return true
end
end
return false
end
local function gps_findOrCreateply_baseEntry()
local addrList = getAddressList()
for i = 0, addrList.Count-1 do
local entry = addrList[i]
if entry.Address == "seeply_baseStatus" then
_G.gps_ply_baseAddressEntry = entry
return entry
end
end
local entry = addrList.createMemoryRecord()
entry.Description = "ply_base (See Pointer)"
entry.Type = vtQword
entry.Address = "seeply_baseStatus"
_G.gps_ply_baseAddressEntry = entry
return entry
end
local function gps_scanForply_basePattern(baseAddr, searchLimit)
local currentAddress = tonumber(baseAddr)
for i = 1, (searchLimit or 8) do
local disasmStr = disassemble(currentAddress)
if disasmStr then
for _, reg in ipairs(gps_ply_baseRegs) do
local hexOffset = disasmStr:match("%["..reg.."%+([0-9A-Fa-f]+)%]")
if hexOffset then return reg, tonumber(hexOffset, 16), nil end
for _, reg2 in ipairs(gps_ply_baseRegs) do
if reg2 ~= reg then
local hexOffset2 = disasmStr:match("%["..reg.."%+"..reg2.."%+([0-9A-Fa-f]+)%]")
if hexOffset2 then return reg, tonumber(hexOffset2, 16), reg2 end
end
end
end
end
currentAddress = currentAddress + (getInstructionSize(currentAddress) or 1)
end
return nil, 0, nil
end
local function gps_ply_baseTimerCallback()
local injectionAddr = getAddressSafe("ply_baseCopy")
if not injectionAddr then return end
local reg, immediate, reg2 = gps_scanForply_basePattern(injectionAddr, 8)
if not reg then return end
local debugBufferAddr = getAddressSafe("seeply_base")
if not debugBufferAddr then return end
local bufferOffset = gps_ply_baseRegOffsets[reg]
if not bufferOffset then return end
local pointerBase = readQword(debugBufferAddr + bufferOffset)
if not pointerBase or pointerBase == 0 then return end
_G.gps_ply_baseBasePointer = pointerBase
_G.gps_ply_baseCurrentRegister = reg
-- Support two-register addressing: [reg1+reg2+offset]
local reg2Value = 0
if reg2 and gps_ply_baseRegOffsets[reg2] then
local r2v = readQword(debugBufferAddr + gps_ply_baseRegOffsets[reg2])
if r2v then reg2Value = r2v end
end
local targetAddr = pointerBase + reg2Value + immediate
if not _G.gps_ply_baseOriginalStaticAddr then
_G.gps_ply_baseOriginalStaticAddr = getAddressSafe("seeply_baseStatus")
end
unregisterSymbol("seeply_baseStatus")
registerSymbol("seeply_baseStatus", targetAddr)
gps_forceRefreshply_baseEntry("seeply_baseStatus", targetAddr)
if not _G.gps_ply_baseEntryCreated then
gps_findOrCreateply_baseEntry()
_G.gps_ply_baseEntryCreated = true
end
end
if _G.gps_ply_baseTimer and _G.gps_ply_baseTimer.destroy then
_G.gps_ply_baseTimer.destroy()
_G.gps_ply_baseTimer = nil
end
_G.gps_ply_baseEntryCreated = false
_G.gps_ply_baseAddressEntry = nil
_G.gps_ply_baseOriginalStaticAddr = nil
_G.gps_ply_baseBasePointer = nil
_G.gps_ply_baseCurrentRegister = nil
if not syntaxcheck then
local startupTimer = createTimer(nil, false)
startupTimer.Interval = 50
startupTimer.OnTimer = function(timer)
if timer and timer.destroy then timer.destroy() end
_G.gps_ply_baseTimer = createTimer(nil, false)
_G.gps_ply_baseTimer.Interval = 555
_G.gps_ply_baseTimer.OnTimer = gps_ply_baseTimerCallback
_G.gps_ply_baseTimer.Enabled = true
end
startupTimer.Enabled = true
end
{$asm}
[DISABLE]
{$lua}
if _G.gps_ply_baseTimer and _G.gps_ply_baseTimer.destroy then
_G.gps_ply_baseTimer.destroy()
_G.gps_ply_baseTimer = nil
end
if _G.gps_ply_baseOriginalStaticAddr then
unregisterSymbol("seeply_baseStatus")
registerSymbol("seeply_baseStatus", _G.gps_ply_baseOriginalStaticAddr)
local addrList = getAddressList()
for i = 0, addrList.Count-1 do
local entry = addrList[i]
if entry.Address == "seeply_baseStatus" then
entry.Address = string.format("0x%X", _G.gps_ply_baseOriginalStaticAddr)
sleep(1)
entry.Address = "seeply_baseStatus"
break
end
end
else
local allocatedAddr = getAddressSafe("seeply_baseStatus")
if allocatedAddr then
unregisterSymbol("seeply_baseStatus")
registerSymbol("seeply_baseStatus", allocatedAddr)
if _G.gps_ply_baseAddressEntry then
_G.gps_ply_baseAddressEntry.Address = string.format("0x%X", allocatedAddr)
sleep(1)
_G.gps_ply_baseAddressEntry.Address = "seeply_baseStatus"
end
end
end
_G.gps_ply_baseEntryCreated = false
_G.gps_ply_baseAddressEntry = nil
_G.gps_ply_baseOriginalStaticAddr = nil
_G.gps_ply_baseBasePointer = nil
_G.gps_ply_baseCurrentRegister = nil
{$asm}
ply_base:
{$lua}
local totalBytes = _G.gps_ply_baseTotalBytes or 8
return string.format("readmem(ply_baseCopy, %d)", totalBytes)
{$asm}
unregistersymbol(*)
dealloc(*)
{$lua}
_G.gps_ply_baseTotalBytes = nil
_G.gps_ply_baseNopCount = nil
_G.gps_ply_baseReadmemInstr = nil
_G.gps_ply_baseNopInstructions = nil
{$asm}
{
0F C1 43 0C 83 F8 01 75 0E 48 8B 03 BA 01 00 00
00 48 8B CB FF 50 08 48 83 C6 10 49 3B F6 75 A5
45 84 FF 74 49 48 8B 05 29 C8 CF 01 48 8B 88 10
0B 00 00 48 85 C9 74 36 48 8B 01 FF 90 00 01 00
00 48 85 C0 74 28 48 8B 05 08 C8 CF 01 48 8B 88
10 0B 00 00 48 8B 01 FF 90 00 01 00 00 49 8B 55
70 48 8B C8 4C 8B 00 41 FF 90 38 01 00 00 41 8B
55 64 4C 8D 85 E8 00 00 00 45 33 C9 89 95 D0 00
00 00 33 C9 E8 AC 87 2D 00 48 8B 75 00 33 FF 48
8B CE 48 89 BD 60 03 00 00 48 89 BD 68 03 00 00
48 89 BD 80 03 00 00 48 89 BD 88 03 00 00 44 89
A5 90 03 00 00 89 BD 94 03 00 00 48 89 BD A0 03
00 00 89 BD A8 03 00 00 E8 48 2E 0B 00 48 8B 0D
81 C7 CF 01 48 8D 55 E0 4C 8B C6 48 89 7D D0 4C
8B E0 48 89 7D D8 44 8B EF E8 27 D8 3E 00 4C 8B
45 E0 8B 55 E8 85 D2 78 0A 41 3B 50 08 7D 04 B0
01 EB 02 32 C0 84 C0 74 13 49 8B 08 48 63 C2 48
39 3C C1 75 07 FF C2 89 55 E8 EB D9 F3 44 0F 10
15 58 6C D8 00 45 0F 57 C9 F3 44 0F 10 1D 4B E3
CF 00 0F 1F 00 85 D2 78 0A 41 3B 50 08 7D 04 B0
01 EB 02 32 C0 84 C0 0F 84 CF 05 00 00 49 8B 00
48 63 CA 4C 8B 34 C8 4C 89 75 F8 4D 85 F6 0F 84
88 05 00 00 48 8B 5D 80 48 8B 0D E6 C6 CF 01 48
8B D3 4D 8B 76 30 E8 EA 3A 3F 00 45 84 FF 74 1A
48 8B 05 CE C6 CF 01 41 0F B6 D7 48 8B 88 00 0B
00 00 48 8B 01 FF 50 20 EB 05 B8 01 00 00 00 89
45 A8 85 C0 0F 8E 39 05 00 00 45 84 FF 74 1D 48
8B 05 9F C6 CF 01 44 8B C7 41 0F B6 D7 48 8B 88
00 0B 00 00 48 8B 01 FF 50 28 EB 02 33 C0 48 8B
4D F8 4C 8D 8D C0 02 00 00 8B D0 4C 8D 85 50 01
00 00 89 54 24 30 33 D2 48 89 54 24 28 48 8D 95
C0 00 00 00
// ORIGINAL CODE - INJECTION POINT: "Insulam-Win64-Shipping.exe"+16A6BAF
"Insulam-Win64-Shipping.exe"+16A6B91: 7FF62F236B91 - 02 00 - add al,[rax]
"Insulam-Win64-Shipping.exe"+16A6B93: 7FF62F236B93 - 00 8B D04C8D85 - add [rbx-7A72B330],cl
"Insulam-Win64-Shipping.exe"+16A6B99: 7FF62F236B99 - 50 - push rax
"Insulam-Win64-Shipping.exe"+16A6B9A: 7FF62F236B9A - 01 00 - add [rax],eax
"Insulam-Win64-Shipping.exe"+16A6B9C: 7FF62F236B9C - 00 89 54243033 - add [rcx+33302454],cl
"Insulam-Win64-Shipping.exe"+16A6BA2: 7FF62F236BA2 - D2 48 89 - ror byte ptr [rax-77],cl
"Insulam-Win64-Shipping.exe"+16A6BA5: 7FF62F236BA5 - 54 - push rsp
"Insulam-Win64-Shipping.exe"+16A6BA6: 7FF62F236BA6 - 24 28 - and al,28
// ---------- INJECTING HERE ----------
"Insulam-Win64-Shipping.exe"+16A6BA8: 7FF62F236BA8 - 48 8D 95 C0000000 - lea rdx,[rbp+000000C0]
"Insulam-Win64-Shipping.exe"+16A6BAF: 7FF62F236BAF - 48 8B 01 - mov rax,[rcx] - 48 8B 01
// ---------- DONE INJECTING ----------
"Insulam-Win64-Shipping.exe"+16A6BB2: 7FF62F236BB2 - 48 89 5C 24 20 - mov [rsp+20],rbx
"Insulam-Win64-Shipping.exe"+16A6BB7: 7FF62F236BB7 - FF 90 58020000 - call qword ptr [rax+00000258]
"Insulam-Win64-Shipping.exe"+16A6BBD: 7FF62F236BBD - 48 89 44 24 68 - mov [rsp+68],rax
"Insulam-Win64-Shipping.exe"+16A6BC2: 7FF62F236BC2 - 48 8B C8 - mov rcx,rax
"Insulam-Win64-Shipping.exe"+16A6BC5: 7FF62F236BC5 - 48 85 C0 - test rax,rax
"Insulam-Win64-Shipping.exe"+16A6BC8: 7FF62F236BC8 - 0F84 C3040000 - je 7FF62F237091
"Insulam-Win64-Shipping.exe"+16A6BCE: 7FF62F236BCE - 49 63 DD - movsxd rbx,r13d
"Insulam-Win64-Shipping.exe"+16A6BD1: 7FF62F236BD1 - 44 8D 6B 01 - lea r13d,[rbx+01]
"Insulam-Win64-Shipping.exe"+16A6BD5: 7FF62F236BD5 - 44 89 6D D8 - mov [rbp-28],r13d
"Insulam-Win64-Shipping.exe"+16A6BD9: 7FF62F236BD9 - 44 3B 6D DC - cmp r13d,[rbp-24]
"Insulam-Win64-Shipping.exe"+16A6BDD: 7FF62F236BDD - 7E 14 - jle 7FF62F236BF3
"Insulam-Win64-Shipping.exe"+16A6BDF: 7FF62F236BDF - 8B D3 - mov edx,ebx
"Insulam-Win64-Shipping.exe"+16A6BE1: 7FF62F236BE1 - 48 8D 4D D0 - lea rcx,[rbp-30]
"Insulam-Win64-Shipping.exe"+16A6BE5: 7FF62F236BE5 - E8 66FEBEFE - call 7FF62DE26A50
"Insulam-Win64-Shipping.exe"+16A6BEA: 7FF62F236BEA - 48 8B 4C 24 68 - mov rcx,[rsp+68]
"Insulam-Win64-Shipping.exe"+16A6BEF: 7FF62F236BEF - 44 8B 6D D8 - mov r13d,[rbp-28]
"Insulam-Win64-Shipping.exe"+16A6BF3: 7FF62F236BF3 - 48 8B 55 D0 - mov rdx,[rbp-30]
"Insulam-Win64-Shipping.exe"+16A6BF7: 7FF62F236BF7 - 48 89 0C DA - mov [rdx+rbx*8],rcx
"Insulam-Win64-Shipping.exe"+16A6BFB: 7FF62F236BFB - 48 8B 4C 24 68 - mov rcx,[rsp+68]
"Insulam-Win64-Shipping.exe"+16A6C00: 7FF62F236C00 - 48 8B 01 - mov rax,[rcx]
"Insulam-Win64-Shipping.exe"+16A6C03: 7FF62F236C03 - F7 40 28 00001000 - test [rax+28],00100000
"Insulam-Win64-Shipping.exe"+16A6C0A: 7FF62F236C0A - 75 0F - jne 7FF62F236C1B
"Insulam-Win64-Shipping.exe"+16A6C0C: 7FF62F236C0C - 0F57 C0 - xorps xmm0,xmm0
"Insulam-Win64-Shipping.exe"+16A6C0F: 7FF62F236C0F - 0F11 81 100B0000 - movups [rcx+00000B10],xmm0
48 8B 01 48 89 5C 24 20 FF 90 58 02 00 00 48 89
44 24 68 48 8B C8 48 85 C0 0F 84 C3 04 00 00 49
63 DD 44 8D 6B 01 44 89 6D D8 44 3B 6D DC 7E 14
8B D3 48 8D 4D D0 E8 66 FE BE FE 48 8B 4C 24 68
44 8B 6D D8 48 8B 55 D0 48 89 0C DA 48 8B 4C 24
68 48 8B 01 F7 40 28 00 00 10 00 75 0F 0F 57 C0
0F 11 81 10 0B 00 00 48 8B 4C 24 68 4C 8B 7D 88
49 8B 87 B0 00 00 00 48 89 81 EC 0A 00 00 48 8B
4C 24 68 8B 81 58 02 00 00 89 81 90 0D 00 00 8B
81 5C 02 00 00 89 81 94 0D 00 00 8B 81 60 02 00
00 89 81 98 0D 00 00 8B 81 64 02 00 00 89 81 9C
0D 00 00 85 FF 0F 85 3E 03 00 00 48 8B 4D F8 4C
8D 85 98 01 00 00 F2 0F 10 85 50 01 00 00 48 8D
55 F4 45 33 C9 F2 0F 11 81 88 00 00 00 8B 85 58
01 00 00 89 81 90 00 00 00 48 8D 45 F8 48 89 85
98 01 00 00 48 8D 8D 60 03 00 00 48 8D 44 24 68
48 89 85 A0 01 00 00 E8 65 DA E5 FF 4D 85 E4 0F
84 CC 02 00 00 4D 85 F6 0F 84 C3 02 00 00 48 8B
0D 3C C5 CF 01 B3 01 48 85 C9 74 36 E8 20 D2 3E
00 48 8B C8 E8 D8 7A E6 FF 3A C3 76 25 48 8B 0D
1D C5 CF 01 E8 F8 D1 3E 00 41 39 44 24 28 75 12
41 38 BF BC 02 00 00 B8 00 00 00 00 0F B6 DB 0F
44 D8 84 DB 0F 84 77 02 00 00 49 8B 06 4C 8D 8D
B8 01 00 00 4C 8D 85 C8 01 00 00 49 8B CE 48 8D
55 98 FF 90 30 0C 00 00 4C 8D 85 B8 01 00 00 48
8D 95 C8 01 00 00 48 8D 8D 10 03 00 00 E8 CF 84
EC FE 48 8B D0 48 8D 8D B0 03 00 00 E8 B0 74 D2
FE 48 8B 0D A9 C4 CF 01 48 83 B9 10 0B 00 00 00
0F 84 F0 00 00 00 48 8B 89 00 0B 00 00 48 85 C9
0F 84 E0 00 00 00 48 8B 01 FF 50 08 84 C0 0F 84
D2 00 00 00 48 8B 05 76 C4 CF 01 48 8D 55 38 45
33 C0 48 8B
aobscanmodule(ply_base, Insulam-Win64-Shipping.exe, 48 ?? ?? 48 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? 48 ?? ?? 0F ?? ?? ?? ?? ?? 49 ?? ?? 44 ?? ?? ?? 44 ?? ?? ??)
}
1337187085
"Can Be Damaged"
0:ON
1:OFF
0
Binary
0
1
0
seeply_base
5A
258
30
1337187091
"Jump Current Count"
0
4 Bytes
seeply_base
338
258
30
1337187090
"Jump Max Count"
0
4 Bytes
seeply_base
334
258
30
1337187056
"Health"
0
Float
seeply_base
CC
640
258
30
1337187057
"Max. Health"
0
Float
seeply_base
D0
640
258
30
1337187070
"Battery"
0
Float
seeply_base
CC
6C0
258
30
1337187071
"Max. Battery"
0
Float
seeply_base
D0
6C0
258
30
1337187080
"Battery Consumption Per Second"
0
Float
seeply_base
6F4
258
30
1337187072
"Stamina"
0
Float
seeply_base
CC
6C8
258
30
1337187073
"Max. Stamina"
0
Float
seeply_base
D0
6C8
258
30
1337187076
"Stamina Gain Per Second"
0
Float
seeply_base
6D8
258
30
1337187077
"Stamina Consumption Per Second"
0
Float
seeply_base
6DC
258
30
1337187074
"Oxygen"
0
Float
seeply_base
CC
6D0
258
30
1337187075
"Max. Oxygen"
0
Float
seeply_base
D0
6D0
258
30
1337187058
"Flashlight Mobility"
0
Byte
seeply_base
14F
6B8
258
30
1337187059
"Flashlight Detail Mode"
0
Byte
seeply_base
150
6B8
258
30
1337187064
"Flashlight Brightness"
0
Float
seeply_base
200
6B8
258
30
1337187065
"Flashlight Intensity"
0
Float
seeply_base
204
6B8
258
30
1337187066
"Flashlight Temperature"
0
Float
seeply_base
220
6B8
258
30
1337187067
"Flashlight Max Draw Distance"
0
Float
seeply_base
224
6B8
258
30
1337187068
"Flashlight Max Distance Fade Range"
0
Float
seeply_base
228
6B8
258
30
1337187063
"Flashlight Bloom Scale"
0
Float
seeply_base
294
6B8
258
30
1337187062
"Flashlight Bloom Threshold"
0
Float
seeply_base
298
6B8
258
30
1337187061
"Flashlight Bloom Max Brightness"
0
Float
seeply_base
29C
6B8
258
30
1337187060
"Flashlight Radius"
0
Float
seeply_base
33C
6B8
258
30
1337187069
"Flashlight Attenuation Radius"
0
Float
seeply_base
340
6B8
258
30
1337187078
"Flashlight Intensity"
0
Float
seeply_base
6E8
258
30
1337187079
"Flashlight Outer Cone Angle"
0
Float
seeply_base
6EC
258
30
1337187081
"Flashlight Attenuation Radius"
0
Float
seeply_base
6F0
258
30
1337187082
"Flashlight Power Burst"
0
Float
seeply_base
700
258
30
1337187083
"Zoom Field Of View"
0
Float
seeply_base
704
258
30
1337187084
"Aiming Field Of View"
0
Float
seeply_base
708
258
30
1337187088
"Player Interaction Distance"
0
Float
seeply_base
730
258
30
1337187089
"Focal Distance"
0
Float
seeply_base
9C0
258
30
1337187086
"Player Maximum Carry Mass"
0
Float
seeply_base
748
258
30
1337187087
"Player Maximum Carry Radius"
0
Float
seeply_base
74C
258
30
1337187102
"Rapid fire"
Auto Assembler Script
{
==============================================
Table by SeryogaSK
----------------------------------------------
Process : Insulam-Win64-Shipping.exe
Game Title : Estranged: The Departure
Game Version : Steam
Author : SeryogaSK
----------------------------------------------
Warning: Online use may trigger anti-cheat!
==============================================
Script Author : VoidUzumaki & SilverRabbit90
}
[ENABLE]
{$lua}
if syntaxcheck then return end
local function setupPattern(pattern, name, targetIndex, moduleName, many)
local results
if moduleName then
results = AOBScan(pattern, moduleName)
end
if not results or (results and results.Count == 0) then
if results then results.destroy() end
results = AOBScan(pattern)
end
if results and results.Count > 0 then
if results.Count > 1 then
end
local targetAddr = results[targetIndex - 1] or results[0]
if type(targetAddr) == "string" then
targetAddr = tonumber(targetAddr, 16)
end
if targetAddr then
registerSymbol(name, targetAddr)
else
error("Failed to get valid address from AOB scan results")
end
results.destroy()
return true -- Success
else
if results then results.destroy() end
return false -- Failed
end
end
-- Detect if we are in 32-bit or 64-bit mode
local function is64Bit()
return targetIs64Bit()
end
-- Get the appropriate register size prefix
local function getRegisterPrefix(reg)
if not reg then return nil end
-- If already has a size prefix, return as is
if reg:match("^[re]") then
return reg
end
-- For 64-bit, convert to r prefix if needed
if is64Bit() then
local reg64Map = {
ax = "rax", bx = "rbx", cx = "rcx", dx = "rdx",
si = "rsi", di = "rdi", sp = "rsp", bp = "rbp",
r8 = "r8", r9 = "r9", r10 = "r10", r11 = "r11",
r12 = "r12", r13 = "r13", r14 = "r14", r15 = "r15"
}
return reg64Map[reg:lower()] or reg
else
-- For 32-bit, convert to e prefix if needed
local reg32Map = {
ax = "eax", bx = "ebx", cx = "ecx", dx = "edx",
si = "esi", di = "edi", sp = "esp", bp = "ebp"
}
return reg32Map[reg:lower()] or reg
end
end
local function parseInstructionDetails(symbolName)
local address = getAddress(symbolName)
if not address then
error("Symbol not found: " .. symbolName)
end
local info = disassemble(address)
-- Check if we got a valid disassembly (not just ?? or invalid opcodes)
if info:match("^[0-9A-Fa-f]+ %- %- %?%?") then
error("Invalid opcode at address - disassembly failed")
end
-- Split the disassembled string to get the actual opcode part
local parts = {}
for part in string.gmatch(info, "[^-]+") do
table.insert(parts, part:match("^%s*(.-)%s*$"))
end
if #parts < 3 then
error("Invalid disassembly format - expected at least 3 parts separated by '-'")
end
local opcodeSection = parts[3]
if not opcodeSection or opcodeSection == "??" or opcodeSection:match("^%s*$") then
error("Failed to parse opcode section from disassembled instruction")
end
-- Extract the instruction mnemonic
local instruction = opcodeSection:match("(%w+)%s+")
if not instruction then
error("Failed to parse instruction mnemonic from: " .. opcodeSection)
end
local destReg, baseReg, offset = nil, nil, 0
local sourceReg, memoryOperand = nil, nil
local targetRegister = nil -- The register we want to modify
-- Enhanced parsing for different instruction types (including FPU instructions)
if instruction:match("^mov") or instruction:match("^fld") or instruction:match("^fst") or
instruction:match("^fstp") or instruction:match("^fild") or instruction:match("^fist") then
-- Parse destination and source
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
-- Handle single operand instructions (fld, fst, etc.)
if not destPart and not sourcePart then
local operand = opcodeSection:match("%w+%s+(.+)$")
if operand then
operand = operand:match("^%s*(.-)%s*$")
if operand:match("%[") then
memoryOperand = operand
baseReg = operand:match("%[([a-zA-Z0-9]+)")
local offsetStr = operand:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = baseReg
else
targetRegister = operand
end
end
else
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then sourceReg = sourcePart:match("^%s*(.-)%s*$") end
-- Check if destination is memory operand like [reg+offset]
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
-- For mov [memory], register - we want to modify the source register
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
-- For mov register, [memory] - we want to modify the destination register
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
-- For mov reg, reg - we can modify either, let's choose source
targetRegister = sourceReg or destReg
end
end
elseif instruction:match("^add") or instruction:match("^sub") or
instruction:match("^mul") or instruction:match("^div") or
instruction:match("^and") or instruction:match("^or") or
instruction:match("^xor") then
-- Arithmetic and logic operations
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then sourceReg = sourcePart:match("^%s*(.-)%s*$") end
-- Check for memory operands
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
targetRegister = destReg -- For reg-to-reg operations, modify destination
end
elseif instruction:match("^cmp") or instruction:match("^test") then
-- Compare operations - we can modify either operand
local leftPart = opcodeSection:match("%w+%s+([^,]+),")
local rightPart = opcodeSection:match(",(.+)$")
if leftPart then destReg = leftPart:match("^%s*(.-)%s*$") end
if rightPart then sourceReg = rightPart:match("^%s*(.-)%s*$") end
-- Check for memory operands
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
targetRegister = destReg -- Default to first operand
end
elseif instruction:match("^push") or instruction:match("^pop") then
-- Stack operations (single operand)
local operand = opcodeSection:match("%w+%s+(.+)$")
if operand then
destReg = operand:match("^%s*(.-)%s*$")
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = baseReg
else
targetRegister = destReg
end
end
elseif instruction:match("^lea") then
-- Load effective address
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then
sourceReg = sourcePart:match("^%s*(.-)%s*$")
-- LEA always uses memory operand as source
if sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
end
end
targetRegister = destReg -- LEA loads into destination register
else
-- Generic two-operand instruction parsing
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then sourceReg = sourcePart:match("^%s*(.-)%s*$") end
-- Check for memory operands in both
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
targetRegister = destReg or sourceReg -- Default behavior
end
end
-- Ensure we have appropriate register prefixes
if targetRegister then
targetRegister = getRegisterPrefix(targetRegister)
end
if baseReg then
baseReg = getRegisterPrefix(baseReg)
end
if destReg then
destReg = getRegisterPrefix(destReg)
end
if sourceReg then
sourceReg = getRegisterPrefix(sourceReg)
end
return instruction, destReg, baseReg, offset, sourceReg, memoryOperand, targetRegister
end
-- Process type casts and convert them to proper assembly
local function processTypeCasts(codeString)
local processedCode = codeString
-- Pattern to find type casts like (float), (int), (double), (byte), (word), (dword), (qword)
local typePatterns = {
["%(float%)"] = function(value)
-- For float values, we need to handle them specially
if value:match("^[%d%.]+$") then
return "(float)" .. value
else
return value
end
end,
["%(double%)"] = function(value)
if value:match("^[%d%.]+$") then
return "(double)" .. value
else
return value
end
end,
["%(int%)"] = function(value)
if value:match("^[%d%.]+$") then
return value:match("^[%d]+") or "0"
else
return value
end
end,
["%(byte%)"] = "byte ptr",
["%(word%)"] = "word ptr",
["%(dword%)"] = "dword ptr",
["%(qword%)"] = "qword ptr"
}
-- First pass: handle memory size specifiers
for pattern, replacement in pairs(typePatterns) do
if type(replacement) == "string" then
processedCode = processedCode:gsub(pattern .. "%s*%[", replacement .. " [")
end
end
-- Second pass: handle value type casts
-- Match patterns like mov [reg+offset],(float)2.5
processedCode = processedCode:gsub(",%s*%(float%)%s*([%d%.]+)", function(value)
return ",(float)" .. value
end)
processedCode = processedCode:gsub(",%s*%(double%)%s*([%d%.]+)", function(value)
return ",(double)" .. value
end)
processedCode = processedCode:gsub(",%s*%(int%)%s*([%d%.]+)", function(value)
local intValue = value:match("^(%d+)") or "0"
return "," .. intValue
end)
return processedCode
end
-- Smart replacement function that analyzes context
local function smartReplaceInCode(codeString, targetRegister, baseReg, offset, destReg, sourceReg)
local replacements = {}
local tempCode = codeString
-- Find all %s positions and their contexts
local positions = {}
local pattern = "()(%%s)()"
for startPos, match, endPos in string.gmatch(codeString, pattern) do
table.insert(positions, {start = startPos, match = match, endPos = endPos})
end
-- Analyze each %s in context
for i = #positions, 1, -1 do -- Work backwards to preserve positions
local pos = positions[i]
local before = string.sub(codeString, math.max(1, pos.start - 30), pos.start - 1)
local after = string.sub(codeString, pos.endPos, math.min(string.len(codeString), pos.endPos + 30))
local replacement = ""
-- Pattern: [%s+%s] - memory operation with base and offset
if before:match("%[%s*$") and after:match("^%s*%+") then
-- This is the base register in [reg+offset]
replacement = baseReg or (is64Bit() and "rcx" or "ecx")
elseif before:match("%+%s*$") and after:match("^%s*%]") then
-- This is the offset in [reg+offset]
replacement = string.format("%08X", offset or 0)
-- Pattern: [label],%s - storing register value to memory
elseif before:match("%[%w+%]%s*,%s*$") then
-- When writing to memory in our custom code, use the appropriate register
if baseReg then
replacement = baseReg
else
replacement = targetRegister or (is64Bit() and "rax" or "eax")
end
-- Pattern: mov %s,[label] - loading value from memory
elseif before:match("(%w+)%s+$") and after:match("^%s*,%s*%[%w+%]") then
replacement = targetRegister or (is64Bit() and "rax" or "eax")
-- Pattern: arithmetic/mov with register (add %s, / mov %s, / sub %s,)
elseif before:match("(%w+)%s+$") and after:match("^%s*,") then
local instruction = before:match("(%w+)%s*$")
replacement = targetRegister or (is64Bit() and "rax" or "eax")
-- print(" -> Detected as first operand of " .. (instruction or "unknown"))
-- Pattern: second operand (, %s)
elseif before:match(",%s*$") then
-- Check if it's inside brackets (memory reference)
local fullBefore = string.sub(codeString, 1, pos.start - 1)
local openBrackets = select(2, string.gsub(fullBefore, "%[", ""))
local closeBrackets = select(2, string.gsub(fullBefore, "%]", ""))
if openBrackets > closeBrackets then
-- We're inside brackets
if before:match("%+%s*$") then
replacement = string.format("%08X", offset or 0)
-- print(" -> Detected as offset inside brackets")
else
replacement = baseReg or (is64Bit() and "rcx" or "ecx")
end
else
-- Not in brackets, it's a register
replacement = targetRegister or (is64Bit() and "rax" or "eax")
end
-- Pattern: Simple %s replacement (like mov %s,value)
elseif before:match("mov%s+$") or before:match("add%s+$") or before:match("sub%s+$") then
replacement = targetRegister or (is64Bit() and "rax" or "eax")
-- Default: assume it's the target register
else
replacement = targetRegister or (is64Bit() and "rax" or "eax")
end
-- Replace this specific %s
tempCode = string.sub(tempCode, 1, pos.start - 1) .. replacement .. string.sub(tempCode, pos.endPos)
end
-- Process type casts after replacements
tempCode = processTypeCasts(tempCode)
return tempCode
end
if memrec then
if memrec.Active then
memrec.Active=false
end
end
local moduleName = "Insulam-Win64-Shipping.exe"
local pattern = "F3 0F ?? ?? ?? ?? ?? ?? EB 08 F3 0F ?? ?? ?? ?? ?? ?? 48 8B ?? 48 8B ?? FF 90 ?? ?? ?? ?? 48 8D ?? ?? ?? ?? ?? 33 D2 E8 B0 ?? ?? ?? 48 8B ?? ?? ?? ?? ??"
local name = "wpn_rapidfi"
local targetIndex = 1
local many = false
-- Run setup
local scanSuccess = setupPattern(pattern, name, targetIndex, moduleName, many)
if not scanSuccess then
end
-- Try to parse instruction details
local success, instruction, destReg, baseReg, offset, sourceReg, memoryOperand, targetRegister = pcall(parseInstructionDetails, name)
if not success then
unregisterSymbol(name)
end
if not targetRegister then
unregisterSymbol(name)
end
local offsetHex = string.format("%08X", offset)
-- USER CUSTOM CODE
local customCode = [==[
]==]
-- DYNAMIC ASSEMBLY TEMPLATE WITH CUSTOM CODE SUPPORT
local assemblyTemplate = [==[
alloc(newmem1,0x1000,wpn_rapidfi)
registersymbol(newmem1)
label(code1)
label(return1)
label(wpn_rapidfiBkp)
registersymbol(wpn_rapidfiBkp)
newmem1:
mov [rbx+0000038C],(float)0 //Player //0.4000000060 Normal
mov [rbx+00000394],(float)0 //Player //
code1:
readmem(wpn_rapidfi,8)
jmp return1
wpn_rapidfiBkp:
readmem(wpn_rapidfi,8)
wpn_rapidfi:
jmp newmem1
nop 3
return1:
]==]
assemblyTemplate = string.format(assemblyTemplate, customCode)
local assemblyCode = smartReplaceInCode(assemblyTemplate, targetRegister, baseReg, offset, destReg, sourceReg)
local assembleSuccess = autoAssemble(assemblyCode)
if not assembleSuccess then
unregisterSymbol(name)
error("Assembly failed")
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
-- Restore original instruction
local origin = getAddress("wpn_rapidfi")
local originBkp = getAddress("wpn_rapidfiBkp")
if origin and originBkp then
local bytes = readBytes(originBkp, 8, true)
writeBytes(origin, bytes)
-- print("Successfully restored original instruction")
else
print("Warning: Could not restore original instruction - addresses not found")
end
-- Clean up memory
if getAddress("wpn_rapidfi") then unregisterSymbol("wpn_rapidfi") end
if getAddress("wpn_rapidfiBkp") then unregisterSymbol("wpn_rapidfiBkp") end
if getAddress("newmem1") then
deAlloc(getAddress("newmem1"))
unregisterSymbol("newmem1")
end
{$asm}
{lua}
{
8B D9 F3 0F 10 B1 A8 03 00 00 0F 29 78 D8 48 8B
01 FF 90 50 01 00 00 0F 57 FF F3 0F 10 80 08 05
00 00 F3 0F 5C C6 0F 2F C7 0F 82 22 02 00 00 48
89 BC 24 C8 00 00 00 48 8B BB E8 03 00 00 83 BF
C0 00 00 00 00 7F 34 48 8B CF E8 51 98 FF FF 84
C0 75 17 83 BF B8 00 00 00 00 7E 1F 8B 87 C4 00
00 00 39 87 C0 00 00 00 7D 11 48 8B 03 48 8B CB
FF 90 90 06 00 00 E9 CE 01 00 00 80 BB 10 04 00
00 00 0F 85 C1 01 00 00 48 8B 83 E8 03 00 00 83
B8 C0 00 00 00 00 0F 8E AD 01 00 00 48 8B 03 48
8B CB FF 90 50 01 00 00 8B 88 08 05 00 00 48 8B
03 89 8B 08 04 00 00 48 8B CB FF 90 80 06 00 00
84 C0 0F 85 58 01 00 00 48 83 BB E8 02 00 00 00
F3 0F 10 35 00 DD 03 02 74 3D 48 8B 8B 78 02 00
00 E8 5A 58 26 01 48 85 C0 74 2C 48 8B 8B 78 02
00 00 E8 49 58 26 01 48 8B 93 E8 02 00 00 48 8B
C8 45 33 C9 C6 44 24 28 01 0F 28 D6 F3 0F 11 7C
24 20 E8 69 A0 13 01 48 8B 8B C0 02 00 00 48 85
C9 0F 84 88 00 00 00 8B 05 73 F5 F0 02 4C 8D 4C
24 70 F2 0F 10 05 5E F5 F0 02 48 8B 93 78 02 00
00 C6 44 24 60 01 89 84 24 88 00 00 00 33 C0 48
89 44 24 58 48 89 44 24 50 F3 0F 11 7C 24 48 F3
0F 11 74 24 40 F3 0F 11 74 24 38 88 44 24 30 89
44 24 28 48 89 84 24 C0 00 00 00 48 8D 84 24 80
00 00 00 4C 8B 84 24 C0 00 00 00 48 89 44 24 20
F2 0F 11 84 24 80 00 00 00 48 C7 44 24 70 00 00
00 00 C7 44 24 78 00 00 00 00 E8 D1 AE 35 01 48
83 BB 00 03 00 00 00 74 27 48 8B 8B A0 03 00 00
48 8B 01 FF 90 A0 06 00 00 84 C0 74 13 48 8B 93
78 02 00 00 48 8B 8B 00 03 00 00 E8 C0 6E 00 00
48 8B 8B A0 03 00 00 48 8B 01 FF 90 A0 06 00 00
84 C0 74 0A
// ORIGINAL CODE - INJECTION POINT: "Insulam-Win64-Shipping.exe"+367254
"Insulam-Win64-Shipping.exe"+36721C: 7FF62DEF721C - A0 030000488B01FF90 - mov al,[90FF018B48000003]
"Insulam-Win64-Shipping.exe"+367225: 7FF62DEF7225 - A0 06000084C0741348 - mov al,[481374C084000006]
"Insulam-Win64-Shipping.exe"+36722E: 7FF62DEF722E - 8B 93 78020000 - mov edx,[rbx+00000278]
"Insulam-Win64-Shipping.exe"+367234: 7FF62DEF7234 - 48 8B 8B 00030000 - mov rcx,[rbx+00000300]
"Insulam-Win64-Shipping.exe"+36723B: 7FF62DEF723B - E8 C06E0000 - call 7FF62DEFE100
"Insulam-Win64-Shipping.exe"+367240: 7FF62DEF7240 - 48 8B 8B A0030000 - mov rcx,[rbx+000003A0]
"Insulam-Win64-Shipping.exe"+367247: 7FF62DEF7247 - 48 8B 01 - mov rax,[rcx]
"Insulam-Win64-Shipping.exe"+36724A: 7FF62DEF724A - FF 90 A0060000 - call qword ptr [rax+000006A0]
"Insulam-Win64-Shipping.exe"+367250: 7FF62DEF7250 - 84 C0 - test al,al
"Insulam-Win64-Shipping.exe"+367252: 7FF62DEF7252 - 74 0A - je 7FF62DEF725E
// ---------- INJECTING HERE ----------
"Insulam-Win64-Shipping.exe"+367254: 7FF62DEF7254 - F3 0F10 8B 8C030000 - movss xmm1,[rbx+0000038C] - F3 0F 10 8B 8C 03 00 00
// ---------- DONE INJECTING ----------
"Insulam-Win64-Shipping.exe"+36725C: 7FF62DEF725C - EB 08 - jmp 7FF62DEF7266
"Insulam-Win64-Shipping.exe"+36725E: 7FF62DEF725E - F3 0F10 8B 90030000 - movss xmm1,[rbx+00000390]
"Insulam-Win64-Shipping.exe"+367266: 7FF62DEF7266 - 48 8B 03 - mov rax,[rbx]
"Insulam-Win64-Shipping.exe"+367269: 7FF62DEF7269 - 48 8B CB - mov rcx,rbx
"Insulam-Win64-Shipping.exe"+36726C: 7FF62DEF726C - FF 90 88060000 - call qword ptr [rax+00000688]
"Insulam-Win64-Shipping.exe"+367272: 7FF62DEF7272 - 48 8D 8B 50020000 - lea rcx,[rbx+00000250]
"Insulam-Win64-Shipping.exe"+367279: 7FF62DEF7279 - 33 D2 - xor edx,edx
"Insulam-Win64-Shipping.exe"+36727B: 7FF62DEF727B - E8 B08DF9FF - call 7FF62DE90030
"Insulam-Win64-Shipping.exe"+367280: 7FF62DEF7280 - 48 8B 83 E8030000 - mov rax,[rbx+000003E8]
"Insulam-Win64-Shipping.exe"+367287: 7FF62DEF7287 - 48 8B CB - mov rcx,rbx
"Insulam-Win64-Shipping.exe"+36728A: 7FF62DEF728A - FF 88 C0000000 - dec [rax+000000C0]
"Insulam-Win64-Shipping.exe"+367290: 7FF62DEF7290 - 48 8B 03 - mov rax,[rbx]
"Insulam-Win64-Shipping.exe"+367293: 7FF62DEF7293 - FF 90 A0060000 - call qword ptr [rax+000006A0]
F3 0F 10 8B 8C 03 00 00 EB 08 F3 0F 10 8B 90 03
00 00 48 8B 03 48 8B CB FF 90 88 06 00 00 48 8D
8B 50 02 00 00 33 D2 E8 B0 8D F9 FF 48 8B 83 E8
03 00 00 48 8B CB FF 88 C0 00 00 00 48 8B 03 FF
90 A0 06 00 00 80 BB 04 04 00 00 00 74 07 C6 83
10 04 00 00 01 48 8B BC 24 C8 00 00 00 0F 28 B4
24 A0 00 00 00 0F 28 BC 24 90 00 00 00 48 81 C4
B0 00 00 00 5B C3 CC CC CC CC CC CC C6 81 9C 03
00 00 00 C3 CC CC CC CC CC CC CC CC C6 81 9C 03
00 00 00 C6 81 10 04 00 00 00 C3 CC 40 57 48 83
EC 60 48 8B 01 48 8B F9 FF 90 70 09 00 00 48 8B
17 48 8B CF 84 C0 74 0C 48 83 C4 60 5F 48 FF A2
68 09 00 00 FF 92 48 09 00 00 84 C0 0F 84 39 01
00 00 48 8B 07 48 8B CF 48 89 74 24 78 FF 90 D8
08 00 00 84 C0 74 4D 48 89 5C 24 70 E8 DB AD 00
00 48 8D 8F 98 08 00 00 48 8B D8 E8 0C B7 42 00
48 8B D3 48 8B 48 10 E8 A0 DB 2E 00 48 8B 5C 24
70 84 C0 74 1F 48 8D 8F 98 08 00 00 E8 EB B6 42
00 48 8B D7 48 8B C8 E8 40 C3 00 00 84 C0 0F 85
D2 00 00 00 48 8B 07 48 8B CF FF 90 E0 08 00 00
84 C0 0F 85 BE 00 00 00 48 8B 07 48 8B CF FF 90
D8 08 00 00 84 C0 0F 84 82 00 00 00 F2 0F 10 87
3C 07 00 00 48 8D 54 24 40 8B 87 44 07 00 00 48
8B 8F A8 06 00 00 0F 29 74 24 50 F3 0F 10 B7 38
07 00 00 F2 0F 11 44 24 30 89 44 24 38 E8 CA F0
23 01 0F 28 C6 4C 8D 44 24 30 0F 28 CE 48 8D 54
24 20 48 8B CF F3 0F 59 00 F3 0F 59 48 04 F3 0F
59 70 08 48 8B 07 F3 0F 11 44 24 20 F3 0F 11 4C
24 24 F3 0F 11 74 24 28 FF 90 D0 08 00 00 0F 28
74 24 50 48 8B 74 24 78 48 83 C4 60 5F C3 48 8B
07 48 8B CF FF 90 78 08 00 00 84 C0 74 18 48 8D
8F 48 06 00
aobscanmodule(wpn_rapidfi, Insulam-Win64-Shipping.exe, F3 0F ?? ?? ?? ?? ?? ?? EB 08 F3 0F ?? ?? ?? ?? ?? ?? 48 8B ?? 48 8B ?? FF 90 ?? ?? ?? ?? 48 8D ?? ?? ?? ?? ?? 33 D2 E8 B0 ?? ?? ?? 48 8B ?? ?? ?? ?? ??)
}
1337187095
"No Reload"
Auto Assembler Script
{
==============================================
Table by SeryogaSK
----------------------------------------------
Process : Insulam-Win64-Shipping.exe
Game Title : Estranged: The Departure
Game Version : Steam
Author : SeryogaSK
----------------------------------------------
Warning: Online use may trigger anti-cheat!
==============================================
Script Author : VoidUzumaki & SilverRabbit90
}
[ENABLE]
{$lua}
if syntaxcheck then return end
local function setupPattern(pattern, name, targetIndex, moduleName, many)
local results
if moduleName then
results = AOBScan(pattern, moduleName)
end
if not results or (results and results.Count == 0) then
if results then results.destroy() end
results = AOBScan(pattern)
end
if results and results.Count > 0 then
if results.Count > 1 then
end
local targetAddr = results[targetIndex - 1] or results[0]
if type(targetAddr) == "string" then
targetAddr = tonumber(targetAddr, 16)
end
if targetAddr then
registerSymbol(name, targetAddr)
else
error("Failed to get valid address from AOB scan results")
end
results.destroy()
return true -- Success
else
if results then results.destroy() end
return false -- Failed
end
end
-- Detect if we are in 32-bit or 64-bit mode
local function is64Bit()
return targetIs64Bit()
end
-- Get the appropriate register size prefix
local function getRegisterPrefix(reg)
if not reg then return nil end
-- If already has a size prefix, return as is
if reg:match("^[re]") then
return reg
end
-- For 64-bit, convert to r prefix if needed
if is64Bit() then
local reg64Map = {
ax = "rax", bx = "rbx", cx = "rcx", dx = "rdx",
si = "rsi", di = "rdi", sp = "rsp", bp = "rbp",
r8 = "r8", r9 = "r9", r10 = "r10", r11 = "r11",
r12 = "r12", r13 = "r13", r14 = "r14", r15 = "r15"
}
return reg64Map[reg:lower()] or reg
else
-- For 32-bit, convert to e prefix if needed
local reg32Map = {
ax = "eax", bx = "ebx", cx = "ecx", dx = "edx",
si = "esi", di = "edi", sp = "esp", bp = "ebp"
}
return reg32Map[reg:lower()] or reg
end
end
local function parseInstructionDetails(symbolName)
local address = getAddress(symbolName)
if not address then
error("Symbol not found: " .. symbolName)
end
local info = disassemble(address)
-- Check if we got a valid disassembly (not just ?? or invalid opcodes)
if info:match("^[0-9A-Fa-f]+ %- %- %?%?") then
error("Invalid opcode at address - disassembly failed")
end
-- Split the disassembled string to get the actual opcode part
local parts = {}
for part in string.gmatch(info, "[^-]+") do
table.insert(parts, part:match("^%s*(.-)%s*$"))
end
if #parts < 3 then
error("Invalid disassembly format - expected at least 3 parts separated by '-'")
end
local opcodeSection = parts[3]
if not opcodeSection or opcodeSection == "??" or opcodeSection:match("^%s*$") then
error("Failed to parse opcode section from disassembled instruction")
end
-- Extract the instruction mnemonic
local instruction = opcodeSection:match("(%w+)%s+")
if not instruction then
error("Failed to parse instruction mnemonic from: " .. opcodeSection)
end
local destReg, baseReg, offset = nil, nil, 0
local sourceReg, memoryOperand = nil, nil
local targetRegister = nil -- The register we want to modify
-- Enhanced parsing for different instruction types (including FPU instructions)
if instruction:match("^mov") or instruction:match("^fld") or instruction:match("^fst") or
instruction:match("^fstp") or instruction:match("^fild") or instruction:match("^fist") then
-- Parse destination and source
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
-- Handle single operand instructions (fld, fst, etc.)
if not destPart and not sourcePart then
local operand = opcodeSection:match("%w+%s+(.+)$")
if operand then
operand = operand:match("^%s*(.-)%s*$")
if operand:match("%[") then
memoryOperand = operand
baseReg = operand:match("%[([a-zA-Z0-9]+)")
local offsetStr = operand:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = baseReg
else
targetRegister = operand
end
end
else
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then sourceReg = sourcePart:match("^%s*(.-)%s*$") end
-- Check if destination is memory operand like [reg+offset]
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
-- For mov [memory], register - we want to modify the source register
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
-- For mov register, [memory] - we want to modify the destination register
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
-- For mov reg, reg - we can modify either, let's choose source
targetRegister = sourceReg or destReg
end
end
elseif instruction:match("^add") or instruction:match("^sub") or
instruction:match("^mul") or instruction:match("^div") or
instruction:match("^and") or instruction:match("^or") or
instruction:match("^xor") then
-- Arithmetic and logic operations
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then sourceReg = sourcePart:match("^%s*(.-)%s*$") end
-- Check for memory operands
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
targetRegister = destReg -- For reg-to-reg operations, modify destination
end
elseif instruction:match("^cmp") or instruction:match("^test") then
-- Compare operations - we can modify either operand
local leftPart = opcodeSection:match("%w+%s+([^,]+),")
local rightPart = opcodeSection:match(",(.+)$")
if leftPart then destReg = leftPart:match("^%s*(.-)%s*$") end
if rightPart then sourceReg = rightPart:match("^%s*(.-)%s*$") end
-- Check for memory operands
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
targetRegister = destReg -- Default to first operand
end
elseif instruction:match("^push") or instruction:match("^pop") then
-- Stack operations (single operand)
local operand = opcodeSection:match("%w+%s+(.+)$")
if operand then
destReg = operand:match("^%s*(.-)%s*$")
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = baseReg
else
targetRegister = destReg
end
end
elseif instruction:match("^lea") then
-- Load effective address
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then
sourceReg = sourcePart:match("^%s*(.-)%s*$")
-- LEA always uses memory operand as source
if sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
end
end
targetRegister = destReg -- LEA loads into destination register
else
-- Generic two-operand instruction parsing
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then sourceReg = sourcePart:match("^%s*(.-)%s*$") end
-- Check for memory operands in both
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
targetRegister = destReg or sourceReg -- Default behavior
end
end
-- Ensure we have appropriate register prefixes
if targetRegister then
targetRegister = getRegisterPrefix(targetRegister)
end
if baseReg then
baseReg = getRegisterPrefix(baseReg)
end
if destReg then
destReg = getRegisterPrefix(destReg)
end
if sourceReg then
sourceReg = getRegisterPrefix(sourceReg)
end
return instruction, destReg, baseReg, offset, sourceReg, memoryOperand, targetRegister
end
-- Process type casts and convert them to proper assembly
local function processTypeCasts(codeString)
local processedCode = codeString
-- Pattern to find type casts like (float), (int), (double), (byte), (word), (dword), (qword)
local typePatterns = {
["%(float%)"] = function(value)
-- For float values, we need to handle them specially
if value:match("^[%d%.]+$") then
return "(float)" .. value
else
return value
end
end,
["%(double%)"] = function(value)
if value:match("^[%d%.]+$") then
return "(double)" .. value
else
return value
end
end,
["%(int%)"] = function(value)
if value:match("^[%d%.]+$") then
return value:match("^[%d]+") or "0"
else
return value
end
end,
["%(byte%)"] = "byte ptr",
["%(word%)"] = "word ptr",
["%(dword%)"] = "dword ptr",
["%(qword%)"] = "qword ptr"
}
-- First pass: handle memory size specifiers
for pattern, replacement in pairs(typePatterns) do
if type(replacement) == "string" then
processedCode = processedCode:gsub(pattern .. "%s*%[", replacement .. " [")
end
end
-- Second pass: handle value type casts
-- Match patterns like mov [reg+offset],(float)2.5
processedCode = processedCode:gsub(",%s*%(float%)%s*([%d%.]+)", function(value)
return ",(float)" .. value
end)
processedCode = processedCode:gsub(",%s*%(double%)%s*([%d%.]+)", function(value)
return ",(double)" .. value
end)
processedCode = processedCode:gsub(",%s*%(int%)%s*([%d%.]+)", function(value)
local intValue = value:match("^(%d+)") or "0"
return "," .. intValue
end)
return processedCode
end
-- Smart replacement function that analyzes context
local function smartReplaceInCode(codeString, targetRegister, baseReg, offset, destReg, sourceReg)
local replacements = {}
local tempCode = codeString
-- Find all %s positions and their contexts
local positions = {}
local pattern = "()(%%s)()"
for startPos, match, endPos in string.gmatch(codeString, pattern) do
table.insert(positions, {start = startPos, match = match, endPos = endPos})
end
-- Analyze each %s in context
for i = #positions, 1, -1 do -- Work backwards to preserve positions
local pos = positions[i]
local before = string.sub(codeString, math.max(1, pos.start - 30), pos.start - 1)
local after = string.sub(codeString, pos.endPos, math.min(string.len(codeString), pos.endPos + 30))
local replacement = ""
-- Pattern: [%s+%s] - memory operation with base and offset
if before:match("%[%s*$") and after:match("^%s*%+") then
-- This is the base register in [reg+offset]
replacement = baseReg or (is64Bit() and "rcx" or "ecx")
elseif before:match("%+%s*$") and after:match("^%s*%]") then
-- This is the offset in [reg+offset]
replacement = string.format("%08X", offset or 0)
-- Pattern: [label],%s - storing register value to memory
elseif before:match("%[%w+%]%s*,%s*$") then
-- When writing to memory in our custom code, use the appropriate register
if baseReg then
replacement = baseReg
else
replacement = targetRegister or (is64Bit() and "rax" or "eax")
end
-- Pattern: mov %s,[label] - loading value from memory
elseif before:match("(%w+)%s+$") and after:match("^%s*,%s*%[%w+%]") then
replacement = targetRegister or (is64Bit() and "rax" or "eax")
-- Pattern: arithmetic/mov with register (add %s, / mov %s, / sub %s,)
elseif before:match("(%w+)%s+$") and after:match("^%s*,") then
local instruction = before:match("(%w+)%s*$")
replacement = targetRegister or (is64Bit() and "rax" or "eax")
-- print(" -> Detected as first operand of " .. (instruction or "unknown"))
-- Pattern: second operand (, %s)
elseif before:match(",%s*$") then
-- Check if it's inside brackets (memory reference)
local fullBefore = string.sub(codeString, 1, pos.start - 1)
local openBrackets = select(2, string.gsub(fullBefore, "%[", ""))
local closeBrackets = select(2, string.gsub(fullBefore, "%]", ""))
if openBrackets > closeBrackets then
-- We're inside brackets
if before:match("%+%s*$") then
replacement = string.format("%08X", offset or 0)
-- print(" -> Detected as offset inside brackets")
else
replacement = baseReg or (is64Bit() and "rcx" or "ecx")
end
else
-- Not in brackets, it's a register
replacement = targetRegister or (is64Bit() and "rax" or "eax")
end
-- Pattern: Simple %s replacement (like mov %s,value)
elseif before:match("mov%s+$") or before:match("add%s+$") or before:match("sub%s+$") then
replacement = targetRegister or (is64Bit() and "rax" or "eax")
-- Default: assume it's the target register
else
replacement = targetRegister or (is64Bit() and "rax" or "eax")
end
-- Replace this specific %s
tempCode = string.sub(tempCode, 1, pos.start - 1) .. replacement .. string.sub(tempCode, pos.endPos)
end
-- Process type casts after replacements
tempCode = processTypeCasts(tempCode)
return tempCode
end
if memrec then
if memrec.Active then
memrec.Active=false
end
end
local moduleName = "Insulam-Win64-Shipping.exe"
local pattern = "8B 91 ?? ?? ?? ?? 48 8B ?? 48 89 ?? 48 89 ?? ?? E8 A1 ?? ?? ??"
local name = "wpn_ammos"
local targetIndex = 1
local many = false
-- Run setup
local scanSuccess = setupPattern(pattern, name, targetIndex, moduleName, many)
if not scanSuccess then
end
-- Try to parse instruction details
local success, instruction, destReg, baseReg, offset, sourceReg, memoryOperand, targetRegister = pcall(parseInstructionDetails, name)
if not success then
unregisterSymbol(name)
end
if not targetRegister then
unregisterSymbol(name)
end
local offsetHex = string.format("%08X", offset)
-- USER CUSTOM CODE
local customCode = [==[
]==]
-- DYNAMIC ASSEMBLY TEMPLATE WITH CUSTOM CODE SUPPORT
local assemblyTemplate = [==[
alloc(newmem1,0x1000,wpn_ammos)
registersymbol(newmem1)
label(code1)
label(return1)
label(wpn_ammosBkp)
registersymbol(wpn_ammosBkp)
newmem1:
mov [rcx+000000C0],#99 // ClipRemaining
mov [rcx+000000C5],#999 // ClipMax
code1:
readmem(wpn_ammos,6)
jmp return1
wpn_ammosBkp:
readmem(wpn_ammos,6)
wpn_ammos:
jmp newmem1
nop 1
return1:
]==]
assemblyTemplate = string.format(assemblyTemplate, customCode)
local assemblyCode = smartReplaceInCode(assemblyTemplate, targetRegister, baseReg, offset, destReg, sourceReg)
local assembleSuccess = autoAssemble(assemblyCode)
if not assembleSuccess then
unregisterSymbol(name)
error("Assembly failed")
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
-- Restore original instruction
local origin = getAddress("wpn_ammos")
local originBkp = getAddress("wpn_ammosBkp")
if origin and originBkp then
local bytes = readBytes(originBkp, 6, true)
writeBytes(origin, bytes)
-- print("Successfully restored original instruction")
else
print("Warning: Could not restore original instruction - addresses not found")
end
-- Clean up memory
if getAddress("wpn_ammos") then unregisterSymbol("wpn_ammos") end
if getAddress("wpn_ammosBkp") then unregisterSymbol("wpn_ammosBkp") end
if getAddress("newmem1") then
deAlloc(getAddress("newmem1"))
unregisterSymbol("newmem1")
end
{$asm}
{lua}
{
CC CC CC CC CC CC CC CC CC CC 48 85 C9 75 04 0F
57 C0 C3 F3 0F 10 81 54 02 00 00 C3 CC CC CC CC
CC CC CC CC CC CC CC CC CC CC 40 53 48 83 EC 20
48 8B D9 48 85 C9 74 6C E8 BD 03 8F 01 48 8B 53
10 4C 8D 40 30 48 63 40 38 3B 42 38 7F 27 48 8B
C8 48 8B 42 30 4C 39 04 C8 75 1A 48 8B 8B 10 04
00 00 48 85 C9 74 0E 48 83 C1 48 48 83 C4 20 5B
E9 A5 15 FF FF E8 40 7F 8D 01 48 8B 53 10 4C 8D
40 30 48 63 40 38 3B 42 38 7F 19 48 8B C8 48 8B
42 30 4C 39 04 C8 75 0C 48 8B 8B 00 04 00 00 48
85 C9 75 C3 33 C0 48 83 C4 20 5B C3 CC CC CC CC
CC CC CC CC CC CC CC CC CC CC 48 85 C9 0F 84 E1
00 00 00 56 48 83 EC 30 48 8B 89 A8 01 00 00 48
8B F2 48 89 5C 24 40 48 89 6C 24 48 48 89 7C 24
50 4C 89 74 24 58 E8 CF EB F1 00 48 63 7E 08 45
33 F6 48 8B 1E 4C 89 74 24 20 89 7C 24 28 85 FF
74 2A 45 33 C0 48 8D 4C 24 20 8B D7 E8 19 9E 00
00 4C 8B 74 24 20 4C 8B C7 49 C1 E0 03 48 8B D3
49 8B CE E8 52 AF FB 01 8B 7C 24 28 48 63 C7 49
8B DE 49 8D 2C C6 4C 3B F5 74 43 48 8B 3B 48 85
FF 74 32 E8 12 44 F8 00 48 8B 4F 10 4C 8D 40 30
48 63 40 38 3B 41 38 7F 1C 48 8B D0 48 8B 41 30
4C 39 04 D0 75 0F 48 8B 8F A8 01 00 00 48 8B D6
E8 45 EB F1 00 48 83 C3 08 48 3B DD 75 BD 48 8B
7C 24 50 48 8B 6C 24 48 48 8B 5C 24 40 4D 85 F6
74 08 49 8B CE E8 00 52 1B 00 4C 8B 74 24 58 48
83 C4 30 5E C3 CC CC CC CC CC 48 89 5C 24 08 57
48 83 EC 20 48 8D B9 44 02 00 00 48 8B DA 48 8B
CF 33 D2 E8 32 04 FF FF 84 C0 74 17 33 C0 48 89
03 48 89 43 08 48 8B C3 48 8B 5C 24 30 48 83 C4
20 5F C3 48 8B CF E8 EF 36 43 00 48 8B 88 E8 03
00 00 33 C0
// ORIGINAL CODE - INJECTION POINT: "Insulam-Win64-Shipping.exe"+35F37A
"Insulam-Win64-Shipping.exe"+35F35B: 7FF62DEEF35B - 48 8B C3 - mov rax,rbx
"Insulam-Win64-Shipping.exe"+35F35E: 7FF62DEEF35E - 48 8B 5C 24 30 - mov rbx,[rsp+30]
"Insulam-Win64-Shipping.exe"+35F363: 7FF62DEEF363 - 48 83 C4 20 - add rsp,20
"Insulam-Win64-Shipping.exe"+35F367: 7FF62DEEF367 - 5F - pop rdi
"Insulam-Win64-Shipping.exe"+35F368: 7FF62DEEF368 - C3 - ret
"Insulam-Win64-Shipping.exe"+35F369: 7FF62DEEF369 - 48 8B CF - mov rcx,rdi
"Insulam-Win64-Shipping.exe"+35F36C: 7FF62DEEF36C - E8 EF364300 - call 7FF62E322A60
"Insulam-Win64-Shipping.exe"+35F371: 7FF62DEEF371 - 48 8B 88 E8030000 - mov rcx,[rax+000003E8]
"Insulam-Win64-Shipping.exe"+35F378: 7FF62DEEF378 - 33 C0 - xor eax,eax
// ---------- INJECTING HERE ----------
"Insulam-Win64-Shipping.exe"+35F37A: 7FF62DEEF37A - 8B 91 C0000000 - mov edx,[rcx+000000C0] - 8B 91 C0 00 00 00
// ---------- DONE INJECTING ----------
"Insulam-Win64-Shipping.exe"+35F380: 7FF62DEEF380 - 48 8B CB - mov rcx,rbx
"Insulam-Win64-Shipping.exe"+35F383: 7FF62DEEF383 - 48 89 03 - mov [rbx],rax
"Insulam-Win64-Shipping.exe"+35F386: 7FF62DEEF386 - 48 89 43 08 - mov [rbx+08],rax
"Insulam-Win64-Shipping.exe"+35F38A: 7FF62DEEF38A - E8 A1431600 - call 7FF62E053730
"Insulam-Win64-Shipping.exe"+35F38F: 7FF62DEEF38F - 48 8B C3 - mov rax,rbx
"Insulam-Win64-Shipping.exe"+35F392: 7FF62DEEF392 - 48 8B 5C 24 30 - mov rbx,[rsp+30]
"Insulam-Win64-Shipping.exe"+35F397: 7FF62DEEF397 - 48 83 C4 20 - add rsp,20
"Insulam-Win64-Shipping.exe"+35F39B: 7FF62DEEF39B - 5F - pop rdi
"Insulam-Win64-Shipping.exe"+35F39C: 7FF62DEEF39C - C3 - ret
"Insulam-Win64-Shipping.exe"+35F39D: 7FF62DEEF39D - CC - int 3
"Insulam-Win64-Shipping.exe"+35F39E: 7FF62DEEF39E - CC - int 3
"Insulam-Win64-Shipping.exe"+35F39F: 7FF62DEEF39F - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3A0: 7FF62DEEF3A0 - 48 8B 89 90000000 - mov rcx,[rcx+00000090]
"Insulam-Win64-Shipping.exe"+35F3A7: 7FF62DEEF3A7 - 48 8B 01 - mov rax,[rcx]
"Insulam-Win64-Shipping.exe"+35F3AA: 7FF62DEEF3AA - 48 FF A0 20010000 - jmp qword ptr [rax+00000120]
"Insulam-Win64-Shipping.exe"+35F3B1: 7FF62DEEF3B1 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3B2: 7FF62DEEF3B2 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3B3: 7FF62DEEF3B3 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3B4: 7FF62DEEF3B4 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3B5: 7FF62DEEF3B5 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3B6: 7FF62DEEF3B6 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3B7: 7FF62DEEF3B7 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3B8: 7FF62DEEF3B8 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3B9: 7FF62DEEF3B9 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3BA: 7FF62DEEF3BA - CC - int 3
"Insulam-Win64-Shipping.exe"+35F3BB: 7FF62DEEF3BB - CC - int 3
8B 91 C0 00 00 00 48 8B CB 48 89 03 48 89 43 08
E8 A1 43 16 00 48 8B C3 48 8B 5C 24 30 48 83 C4
20 5F C3 CC CC CC 48 8B 89 90 00 00 00 48 8B 01
48 FF A0 20 01 00 00 CC CC CC CC CC CC CC CC CC
CC CC CC CC CC CC 48 8B 81 F0 01 00 00 48 85 C0
75 04 0F 57 C0 C3 F3 0F 10 80 F8 00 00 00 C3 CC
CC CC CC CC CC CC 48 85 C9 74 15 48 8B 81 F0 01
00 00 48 85 C0 74 09 F3 0F 10 80 F8 00 00 00 C3
0F 57 C0 C3 CC CC 48 8B 89 90 00 00 00 48 8B 01
48 FF A0 E8 00 00 00 CC CC CC CC CC CC CC CC CC
CC CC CC CC CC CC 40 53 48 83 EC 20 E8 15 DB 34
01 48 8B D8 48 85 C0 74 29 E8 28 20 01 00 48 8B
4B 10 48 83 C0 30 48 63 50 08 3B 51 38 7F 13 48
8B 49 30 48 39 04 D1 75 09 48 8B C3 48 83 C4 20
5B C3 33 C0 48 83 C4 20 5B C3 CC CC CC CC CC CC
CC CC CC CC CC CC 40 53 48 83 EC 20 E8 F5 DA 34
01 48 8B D8 48 85 C0 74 29 E8 38 63 01 00 48 8B
4B 10 48 83 C0 30 48 63 50 08 3B 51 38 7F 13 48
8B 49 30 48 39 04 D1 75 09 48 8B C3 48 83 C4 20
5B C3 33 C0 48 83 C4 20 5B C3 CC CC CC CC CC CC
CC CC CC CC CC CC 40 53 48 83 EC 20 E8 45 E7 34
01 48 8B D8 48 85 C0 74 29 E8 28 37 02 00 48 8B
4B 10 48 83 C0 30 48 63 50 08 3B 51 38 7F 13 48
8B 49 30 48 39 04 D1 75 09 48 8B C3 48 83 C4 20
5B C3 33 C0 48 83 C4 20 5B C3 CC CC CC CC CC CC
CC CC CC CC CC CC 40 53 48 83 EC 20 E8 05 EA 34
01 48 8B D8 48 85 C0 74 29 E8 38 CF 01 00 48 8B
4B 10 48 83 C0 30 48 63 50 08 3B 51 38 7F 13 48
8B 49 30 48 39 04 D1 75 09 48 8B C3 48 83 C4 20
5B C3 33 C0 48 83 C4 20 5B C3 CC CC CC CC CC CC
CC CC CC CC CC CC 48 89 5C 24 08 48 89 74 24 10
48 89 7C 24
aobscanmodule(wpn_ammos, Insulam-Win64-Shipping.exe, 8B 91 ?? ?? ?? ?? 48 8B ?? 48 89 ?? 48 89 ?? ?? E8 A1 ?? ?? ??)
}
1337187096
"Ammo"
Auto Assembler Script
{
==============================================
Table by SeryogaSK
----------------------------------------------
Process : Insulam-Win64-Shipping.exe
Game Title : Estranged: The Departure
Game Version : Steam
Author : SeryogaSK
----------------------------------------------
Warning: Online use may trigger anti-cheat!
==============================================
Script Author : VoidUzumaki & SilverRabbit90
}
[ENABLE]
{$lua}
if syntaxcheck then return end
local function setupPattern(pattern, name, targetIndex, moduleName, many)
local results
if moduleName then
results = AOBScan(pattern, moduleName)
end
if not results or (results and results.Count == 0) then
if results then results.destroy() end
results = AOBScan(pattern)
end
if results and results.Count > 0 then
if results.Count > 1 then
end
local targetAddr = results[targetIndex - 1] or results[0]
if type(targetAddr) == "string" then
targetAddr = tonumber(targetAddr, 16)
end
if targetAddr then
registerSymbol(name, targetAddr)
else
error("Failed to get valid address from AOB scan results")
end
results.destroy()
return true -- Success
else
if results then results.destroy() end
return false -- Failed
end
end
-- Detect if we are in 32-bit or 64-bit mode
local function is64Bit()
return targetIs64Bit()
end
-- Get the appropriate register size prefix
local function getRegisterPrefix(reg)
if not reg then return nil end
-- If already has a size prefix, return as is
if reg:match("^[re]") then
return reg
end
-- For 64-bit, convert to r prefix if needed
if is64Bit() then
local reg64Map = {
ax = "rax", bx = "rbx", cx = "rcx", dx = "rdx",
si = "rsi", di = "rdi", sp = "rsp", bp = "rbp",
r8 = "r8", r9 = "r9", r10 = "r10", r11 = "r11",
r12 = "r12", r13 = "r13", r14 = "r14", r15 = "r15"
}
return reg64Map[reg:lower()] or reg
else
-- For 32-bit, convert to e prefix if needed
local reg32Map = {
ax = "eax", bx = "ebx", cx = "ecx", dx = "edx",
si = "esi", di = "edi", sp = "esp", bp = "ebp"
}
return reg32Map[reg:lower()] or reg
end
end
local function parseInstructionDetails(symbolName)
local address = getAddress(symbolName)
if not address then
error("Symbol not found: " .. symbolName)
end
local info = disassemble(address)
-- Check if we got a valid disassembly (not just ?? or invalid opcodes)
if info:match("^[0-9A-Fa-f]+ %- %- %?%?") then
error("Invalid opcode at address - disassembly failed")
end
-- Split the disassembled string to get the actual opcode part
local parts = {}
for part in string.gmatch(info, "[^-]+") do
table.insert(parts, part:match("^%s*(.-)%s*$"))
end
if #parts < 3 then
error("Invalid disassembly format - expected at least 3 parts separated by '-'")
end
local opcodeSection = parts[3]
if not opcodeSection or opcodeSection == "??" or opcodeSection:match("^%s*$") then
error("Failed to parse opcode section from disassembled instruction")
end
-- Extract the instruction mnemonic
local instruction = opcodeSection:match("(%w+)%s+")
if not instruction then
error("Failed to parse instruction mnemonic from: " .. opcodeSection)
end
local destReg, baseReg, offset = nil, nil, 0
local sourceReg, memoryOperand = nil, nil
local targetRegister = nil -- The register we want to modify
-- Enhanced parsing for different instruction types (including FPU instructions)
if instruction:match("^mov") or instruction:match("^fld") or instruction:match("^fst") or
instruction:match("^fstp") or instruction:match("^fild") or instruction:match("^fist") then
-- Parse destination and source
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
-- Handle single operand instructions (fld, fst, etc.)
if not destPart and not sourcePart then
local operand = opcodeSection:match("%w+%s+(.+)$")
if operand then
operand = operand:match("^%s*(.-)%s*$")
if operand:match("%[") then
memoryOperand = operand
baseReg = operand:match("%[([a-zA-Z0-9]+)")
local offsetStr = operand:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = baseReg
else
targetRegister = operand
end
end
else
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then sourceReg = sourcePart:match("^%s*(.-)%s*$") end
-- Check if destination is memory operand like [reg+offset]
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
-- For mov [memory], register - we want to modify the source register
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
-- For mov register, [memory] - we want to modify the destination register
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
-- For mov reg, reg - we can modify either, let's choose source
targetRegister = sourceReg or destReg
end
end
elseif instruction:match("^add") or instruction:match("^sub") or
instruction:match("^mul") or instruction:match("^div") or
instruction:match("^and") or instruction:match("^or") or
instruction:match("^xor") then
-- Arithmetic and logic operations
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then sourceReg = sourcePart:match("^%s*(.-)%s*$") end
-- Check for memory operands
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
targetRegister = destReg -- For reg-to-reg operations, modify destination
end
elseif instruction:match("^cmp") or instruction:match("^test") then
-- Compare operations - we can modify either operand
local leftPart = opcodeSection:match("%w+%s+([^,]+),")
local rightPart = opcodeSection:match(",(.+)$")
if leftPart then destReg = leftPart:match("^%s*(.-)%s*$") end
if rightPart then sourceReg = rightPart:match("^%s*(.-)%s*$") end
-- Check for memory operands
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
targetRegister = destReg -- Default to first operand
end
elseif instruction:match("^push") or instruction:match("^pop") then
-- Stack operations (single operand)
local operand = opcodeSection:match("%w+%s+(.+)$")
if operand then
destReg = operand:match("^%s*(.-)%s*$")
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = baseReg
else
targetRegister = destReg
end
end
elseif instruction:match("^lea") then
-- Load effective address
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then
sourceReg = sourcePart:match("^%s*(.-)%s*$")
-- LEA always uses memory operand as source
if sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
end
end
targetRegister = destReg -- LEA loads into destination register
else
-- Generic two-operand instruction parsing
local destPart = opcodeSection:match("%w+%s+([^,]+),")
local sourcePart = opcodeSection:match(",(.+)$")
if destPart then destReg = destPart:match("^%s*(.-)%s*$") end
if sourcePart then sourceReg = sourcePart:match("^%s*(.-)%s*$") end
-- Check for memory operands in both
if destReg and destReg:match("%[") then
memoryOperand = destReg
baseReg = destReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = destReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = sourceReg or baseReg
elseif sourceReg and sourceReg:match("%[") then
memoryOperand = sourceReg
baseReg = sourceReg:match("%[([a-zA-Z0-9]+)")
local offsetStr = sourceReg:match("%+([0-9A-Fa-f]+)")
if offsetStr then
offset = tonumber(offsetStr, 16)
end
targetRegister = destReg or baseReg
else
targetRegister = destReg or sourceReg -- Default behavior
end
end
-- Ensure we have appropriate register prefixes
if targetRegister then
targetRegister = getRegisterPrefix(targetRegister)
end
if baseReg then
baseReg = getRegisterPrefix(baseReg)
end
if destReg then
destReg = getRegisterPrefix(destReg)
end
if sourceReg then
sourceReg = getRegisterPrefix(sourceReg)
end
return instruction, destReg, baseReg, offset, sourceReg, memoryOperand, targetRegister
end
-- Process type casts and convert them to proper assembly
local function processTypeCasts(codeString)
local processedCode = codeString
-- Pattern to find type casts like (float), (int), (double), (byte), (word), (dword), (qword)
local typePatterns = {
["%(float%)"] = function(value)
-- For float values, we need to handle them specially
if value:match("^[%d%.]+$") then
return "(float)" .. value
else
return value
end
end,
["%(double%)"] = function(value)
if value:match("^[%d%.]+$") then
return "(double)" .. value
else
return value
end
end,
["%(int%)"] = function(value)
if value:match("^[%d%.]+$") then
return value:match("^[%d]+") or "0"
else
return value
end
end,
["%(byte%)"] = "byte ptr",
["%(word%)"] = "word ptr",
["%(dword%)"] = "dword ptr",
["%(qword%)"] = "qword ptr"
}
-- First pass: handle memory size specifiers
for pattern, replacement in pairs(typePatterns) do
if type(replacement) == "string" then
processedCode = processedCode:gsub(pattern .. "%s*%[", replacement .. " [")
end
end
-- Second pass: handle value type casts
-- Match patterns like mov [reg+offset],(float)2.5
processedCode = processedCode:gsub(",%s*%(float%)%s*([%d%.]+)", function(value)
return ",(float)" .. value
end)
processedCode = processedCode:gsub(",%s*%(double%)%s*([%d%.]+)", function(value)
return ",(double)" .. value
end)
processedCode = processedCode:gsub(",%s*%(int%)%s*([%d%.]+)", function(value)
local intValue = value:match("^(%d+)") or "0"
return "," .. intValue
end)
return processedCode
end
-- Smart replacement function that analyzes context
local function smartReplaceInCode(codeString, targetRegister, baseReg, offset, destReg, sourceReg)
local replacements = {}
local tempCode = codeString
-- Find all %s positions and their contexts
local positions = {}
local pattern = "()(%%s)()"
for startPos, match, endPos in string.gmatch(codeString, pattern) do
table.insert(positions, {start = startPos, match = match, endPos = endPos})
end
-- Analyze each %s in context
for i = #positions, 1, -1 do -- Work backwards to preserve positions
local pos = positions[i]
local before = string.sub(codeString, math.max(1, pos.start - 30), pos.start - 1)
local after = string.sub(codeString, pos.endPos, math.min(string.len(codeString), pos.endPos + 30))
local replacement = ""
-- Pattern: [%s+%s] - memory operation with base and offset
if before:match("%[%s*$") and after:match("^%s*%+") then
-- This is the base register in [reg+offset]
replacement = baseReg or (is64Bit() and "rcx" or "ecx")
elseif before:match("%+%s*$") and after:match("^%s*%]") then
-- This is the offset in [reg+offset]
replacement = string.format("%08X", offset or 0)
-- Pattern: [label],%s - storing register value to memory
elseif before:match("%[%w+%]%s*,%s*$") then
-- When writing to memory in our custom code, use the appropriate register
if baseReg then
replacement = baseReg
else
replacement = targetRegister or (is64Bit() and "rax" or "eax")
end
-- Pattern: mov %s,[label] - loading value from memory
elseif before:match("(%w+)%s+$") and after:match("^%s*,%s*%[%w+%]") then
replacement = targetRegister or (is64Bit() and "rax" or "eax")
-- Pattern: arithmetic/mov with register (add %s, / mov %s, / sub %s,)
elseif before:match("(%w+)%s+$") and after:match("^%s*,") then
local instruction = before:match("(%w+)%s*$")
replacement = targetRegister or (is64Bit() and "rax" or "eax")
-- print(" -> Detected as first operand of " .. (instruction or "unknown"))
-- Pattern: second operand (, %s)
elseif before:match(",%s*$") then
-- Check if it's inside brackets (memory reference)
local fullBefore = string.sub(codeString, 1, pos.start - 1)
local openBrackets = select(2, string.gsub(fullBefore, "%[", ""))
local closeBrackets = select(2, string.gsub(fullBefore, "%]", ""))
if openBrackets > closeBrackets then
-- We're inside brackets
if before:match("%+%s*$") then
replacement = string.format("%08X", offset or 0)
-- print(" -> Detected as offset inside brackets")
else
replacement = baseReg or (is64Bit() and "rcx" or "ecx")
end
else
-- Not in brackets, it's a register
replacement = targetRegister or (is64Bit() and "rax" or "eax")
end
-- Pattern: Simple %s replacement (like mov %s,value)
elseif before:match("mov%s+$") or before:match("add%s+$") or before:match("sub%s+$") then
replacement = targetRegister or (is64Bit() and "rax" or "eax")
-- Default: assume it's the target register
else
replacement = targetRegister or (is64Bit() and "rax" or "eax")
end
-- Replace this specific %s
tempCode = string.sub(tempCode, 1, pos.start - 1) .. replacement .. string.sub(tempCode, pos.endPos)
end
-- Process type casts after replacements
tempCode = processTypeCasts(tempCode)
return tempCode
end
if memrec then
if memrec.Active then
memrec.Active=false
end
end
local moduleName = "Insulam-Win64-Shipping.exe"
local pattern = "8B 91 ?? ?? ?? ?? 48 8B ?? 48 89 ?? 48 89 ?? ?? E8 C1 ?? ?? ??"
local name = "wpn_smothamos"
local targetIndex = 1
local many = false
-- Run setup
local scanSuccess = setupPattern(pattern, name, targetIndex, moduleName, many)
if not scanSuccess then
end
-- Try to parse instruction details
local success, instruction, destReg, baseReg, offset, sourceReg, memoryOperand, targetRegister = pcall(parseInstructionDetails, name)
if not success then
unregisterSymbol(name)
end
if not targetRegister then
unregisterSymbol(name)
end
local offsetHex = string.format("%08X", offset)
-- USER CUSTOM CODE
local customCode = [==[
]==]
-- DYNAMIC ASSEMBLY TEMPLATE WITH CUSTOM CODE SUPPORT
local assemblyTemplate = [==[
alloc(newmem1,0x1000,wpn_smothamos)
registersymbol(newmem1)
label(code1)
label(return1)
label(wpn_smothamosBkp)
registersymbol(wpn_smothamosBkp)
newmem1:
mov [rcx+000000B8],#999 //AmmoRemaining
mov [rcx+000000BC],#999 //AmmoMax
code1:
readmem(wpn_smothamos,6)
jmp return1
wpn_smothamosBkp:
readmem(wpn_smothamos,6)
wpn_smothamos:
jmp newmem1
nop 1
return1:
]==]
assemblyTemplate = string.format(assemblyTemplate, customCode)
local assemblyCode = smartReplaceInCode(assemblyTemplate, targetRegister, baseReg, offset, destReg, sourceReg)
local assembleSuccess = autoAssemble(assemblyCode)
if not assembleSuccess then
unregisterSymbol(name)
error("Assembly failed")
end
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
-- Restore original instruction
local origin = getAddress("wpn_smothamos")
local originBkp = getAddress("wpn_smothamosBkp")
if origin and originBkp then
local bytes = readBytes(originBkp, 6, true)
writeBytes(origin, bytes)
-- print("Successfully restored original instruction")
else
print("Warning: Could not restore original instruction - addresses not found")
end
-- Clean up memory
if getAddress("wpn_smothamos") then unregisterSymbol("wpn_smothamos") end
if getAddress("wpn_smothamosBkp") then unregisterSymbol("wpn_smothamosBkp") end
if getAddress("newmem1") then
deAlloc(getAddress("newmem1"))
unregisterSymbol("newmem1")
end
{$asm}
{lua}
{
1E 53 EC 02 F2 0F 10 0D 26 53 EC 02 48 8B 74 24
40 48 8B C3 0F 11 03 F2 0F 11 4B 10 48 8B 5C 24
38 48 83 C4 20 5F C3 CC CC CC 48 8B 89 90 00 00
00 48 8B 01 48 FF A0 D8 00 00 00 CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC 48 8B 89 90 00 00
00 48 8B 01 48 FF A0 C8 00 00 00 CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC 40 53 48 83 EC 20
48 83 B9 38 02 00 00 00 48 8B D9 74 1D 48 8B 01
FF 90 70 02 00 00 48 8B 8B 38 02 00 00 48 8B D0
48 83 C4 20 5B E9 30 BB F5 00 48 83 C4 20 5B C3
CC CC CC CC CC CC CC CC CC CC 48 8B 89 90 00 00
00 48 8B 01 48 FF 60 40 CC CC 48 83 EC 28 4C 8D
0D B5 1C 07 02 BA 21 00 00 00 4C 8D 05 59 8F 05
02 48 8D 0D 22 1C 07 02 E8 3D EF 22 00 E8 88 13
23 00 32 C0 48 83 C4 28 C3 CC 48 83 EC 28 48 8B
05 15 34 EC 02 48 85 C0 75 72 E8 5B E7 28 00 48
85 C0 74 3C 41 B8 01 00 00 00 48 89 5C 24 20 48
8B D0 48 8D 4C 24 30 E8 4E 0A 28 00 48 8B 18 E8
26 FE 26 00 48 8B C8 48 8B D3 E8 5B 2A 27 00 48
8B 5C 24 20 48 89 05 CF 33 EC 02 48 83 C4 28 C3
B9 08 00 00 00 E8 80 0F 15 00 48 85 C0 74 16 48
8D 0D E4 71 04 02 48 89 08 48 89 05 AA 33 EC 02
48 83 C4 28 C3 48 89 05 9E 33 EC 02 48 83 C4 28
C3 CC CC CC CC CC CC CC CC CC 48 8D 41 08 C3 CC
CC CC CC CC CC CC CC CC CC CC F3 0F 10 81 CC 00
00 00 F3 0F 5E 81 D0 00 00 00 C3 CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC 48 89 5C 24 08 57
48 83 EC 20 48 8D B9 44 02 00 00 48 8B DA 48 8B
CF 33 D2 E8 52 07 FF FF 84 C0 74 17 33 C0 48 89
03 48 89 43 08 48 8B C3 48 8B 5C 24 30 48 83 C4
20 5F C3 48 8B CF E8 0F 3A 43 00 48 8B 88 E8 03
00 00 33 C0
// ORIGINAL CODE - INJECTION POINT: "Insulam-Win64-Shipping.exe"+35F05A
"Insulam-Win64-Shipping.exe"+35F03B: 7FF62DEEF03B - 48 8B C3 - mov rax,rbx
"Insulam-Win64-Shipping.exe"+35F03E: 7FF62DEEF03E - 48 8B 5C 24 30 - mov rbx,[rsp+30]
"Insulam-Win64-Shipping.exe"+35F043: 7FF62DEEF043 - 48 83 C4 20 - add rsp,20
"Insulam-Win64-Shipping.exe"+35F047: 7FF62DEEF047 - 5F - pop rdi
"Insulam-Win64-Shipping.exe"+35F048: 7FF62DEEF048 - C3 - ret
"Insulam-Win64-Shipping.exe"+35F049: 7FF62DEEF049 - 48 8B CF - mov rcx,rdi
"Insulam-Win64-Shipping.exe"+35F04C: 7FF62DEEF04C - E8 0F3A4300 - call 7FF62E322A60
"Insulam-Win64-Shipping.exe"+35F051: 7FF62DEEF051 - 48 8B 88 E8030000 - mov rcx,[rax+000003E8]
"Insulam-Win64-Shipping.exe"+35F058: 7FF62DEEF058 - 33 C0 - xor eax,eax
// ---------- INJECTING HERE ----------
"Insulam-Win64-Shipping.exe"+35F05A: 7FF62DEEF05A - 8B 91 B8000000 - mov edx,[rcx+000000B8] - 8B 91 B8 00 00 00
// ---------- DONE INJECTING ----------
"Insulam-Win64-Shipping.exe"+35F060: 7FF62DEEF060 - 48 8B CB - mov rcx,rbx
"Insulam-Win64-Shipping.exe"+35F063: 7FF62DEEF063 - 48 89 03 - mov [rbx],rax
"Insulam-Win64-Shipping.exe"+35F066: 7FF62DEEF066 - 48 89 43 08 - mov [rbx+08],rax
"Insulam-Win64-Shipping.exe"+35F06A: 7FF62DEEF06A - E8 C1461600 - call 7FF62E053730
"Insulam-Win64-Shipping.exe"+35F06F: 7FF62DEEF06F - 48 8B C3 - mov rax,rbx
"Insulam-Win64-Shipping.exe"+35F072: 7FF62DEEF072 - 48 8B 5C 24 30 - mov rbx,[rsp+30]
"Insulam-Win64-Shipping.exe"+35F077: 7FF62DEEF077 - 48 83 C4 20 - add rsp,20
"Insulam-Win64-Shipping.exe"+35F07B: 7FF62DEEF07B - 5F - pop rdi
"Insulam-Win64-Shipping.exe"+35F07C: 7FF62DEEF07C - C3 - ret
"Insulam-Win64-Shipping.exe"+35F07D: 7FF62DEEF07D - CC - int 3
"Insulam-Win64-Shipping.exe"+35F07E: 7FF62DEEF07E - CC - int 3
"Insulam-Win64-Shipping.exe"+35F07F: 7FF62DEEF07F - CC - int 3
"Insulam-Win64-Shipping.exe"+35F080: 7FF62DEEF080 - 48 8B 89 90000000 - mov rcx,[rcx+00000090]
"Insulam-Win64-Shipping.exe"+35F087: 7FF62DEEF087 - 48 8B 01 - mov rax,[rcx]
"Insulam-Win64-Shipping.exe"+35F08A: 7FF62DEEF08A - 48 FF A0 08010000 - jmp qword ptr [rax+00000108]
"Insulam-Win64-Shipping.exe"+35F091: 7FF62DEEF091 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F092: 7FF62DEEF092 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F093: 7FF62DEEF093 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F094: 7FF62DEEF094 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F095: 7FF62DEEF095 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F096: 7FF62DEEF096 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F097: 7FF62DEEF097 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F098: 7FF62DEEF098 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F099: 7FF62DEEF099 - CC - int 3
"Insulam-Win64-Shipping.exe"+35F09A: 7FF62DEEF09A - CC - int 3
"Insulam-Win64-Shipping.exe"+35F09B: 7FF62DEEF09B - CC - int 3
8B 91 B8 00 00 00 48 8B CB 48 89 03 48 89 43 08
E8 C1 46 16 00 48 8B C3 48 8B 5C 24 30 48 83 C4
20 5F C3 CC CC CC 48 8B 89 90 00 00 00 48 8B 01
48 FF A0 08 01 00 00 CC CC CC CC CC CC CC CC CC
CC CC CC CC CC CC 40 53 48 83 EC 20 48 8B DA 48
C7 42 08 0E 00 00 00 33 C0 48 8B CB 48 89 02 33
D2 E8 60 80 F2 FF 48 8B 0B 48 8D 15 3E 13 07 02
41 B8 1C 00 00 00 E8 6B 3A 18 00 48 8B C3 48 83
C4 20 5B C3 CC CC 0F 10 81 00 03 00 00 48 8B C2
0F 29 02 C3 CC CC 40 53 48 83 EC 20 48 8B 99 F0
02 00 00 48 85 DB 74 57 41 B8 01 00 00 00 48 8D
15 71 41 07 02 48 8D 4C 24 30 E8 C7 07 28 00 48
8D 54 24 30 48 8B CB E8 AA 28 A0 01 48 8B D8 48
85 C0 74 2B E8 9D C3 79 01 48 8B 4B 10 48 83 C0
30 48 63 50 08 3B 51 38 7F 0A 48 8B 49 30 48 39
04 D1 74 02 33 DB 48 8B C3 48 83 C4 20 5B C3 33
C0 48 83 C4 20 5B C3 CC CC CC CC CC CC CC CC CC
CC CC CC CC CC CC 48 8B 89 90 00 00 00 48 8B 01
48 FF A0 18 01 00 00 CC CC CC CC CC CC CC CC CC
CC CC CC CC CC CC 48 85 C9 75 04 0F 57 C0 C3 F3
0F 10 81 54 02 00 00 C3 CC CC CC CC CC CC CC CC
CC CC CC CC CC CC 40 53 48 83 EC 20 48 8B D9 48
85 C9 74 6C E8 BD 03 8F 01 48 8B 53 10 4C 8D 40
30 48 63 40 38 3B 42 38 7F 27 48 8B C8 48 8B 42
30 4C 39 04 C8 75 1A 48 8B 8B 10 04 00 00 48 85
C9 74 0E 48 83 C1 48 48 83 C4 20 5B E9 A5 15 FF
FF E8 40 7F 8D 01 48 8B 53 10 4C 8D 40 30 48 63
40 38 3B 42 38 7F 19 48 8B C8 48 8B 42 30 4C 39
04 C8 75 0C 48 8B 8B 00 04 00 00 48 85 C9 75 C3
33 C0 48 83 C4 20 5B C3 CC CC CC CC CC CC CC CC
CC CC CC CC CC CC 48 85 C9 0F 84 E1 00 00 00 56
48 83 EC 30
aobscanmodule(wpn_smothamos, Insulam-Win64-Shipping.exe, 8B 91 ?? ?? ?? ?? 48 8B ?? 48 89 ?? 48 89 ?? ?? E8 C1 ?? ?? ??)
}
1337187110
""
1
1337187104
"━━━━━━━━ 🔧 DEBUG ━━━━━━━━━"
1
1337187055
"Player Base"
1
0
8 Bytes
seeply_base
1337187108
""
1
1337187105
"━━━━━━━━ 📡 Links ━━━━━━━━"
1
1337187106
"├─ YouTube"
Auto Assembler Script
{$lua}
[ENABLE]
shellExecute("https://www.youtube.com/@SeryogaSK");
createThread(function();sleep(100);memrec.Active=false;end);
[DISABLE]
1337187111
"├─ bbfox UEDumper"
Auto Assembler Script
{$lua}
[ENABLE]
shellExecute("https://opencheattables.com/viewtopic.php?p=5251");
createThread(function();sleep(100);memrec.Active=false;end);
[DISABLE]
1337187107
"└─ OCT PROFILE"
Auto Assembler Script
{$lua}
if syntaxcheck then return end
--if not monopipe then if LaunchMonoDataCollector() == 0 then error(MessageDialog('Failed to Launch Mono Data Collector', mtError, mbClose)) end end
{$asm}
[ENABLE]
{$lua}
shellExecute("https://opencheattables.com/memberlist.php?mode=viewprofile&u=6096");
createThread(function();sleep(100);memrec.Active=false;end);
{$asm}
[DISABLE]
3755
"━━━━━━━━ 📜 Last Update ━━━━━━━━"
1
3756
"└─ 18.06.2026"
1
-- Cheat Table Decorator
function decorateSSKTable()
local mainForm = getMainForm()
-- Main Form Styling
mainForm.Caption = 'Estranged: The Departure (Steam) - Enhanced Table [by SeryogaSK] {Habibrahimov.com}'
getAutoAttachList().add("Insulam-Win64-Shipping.exe")
end
-- Execute when table loads
decorateSSKTable()