68
"--------------------------------------------- KLONA: DOOR TO PHANTOMILE ----------------------------------------------"
1
57
"Player"
Auto Assembler Script
{
==============================================
Header Changer by SeryogaSK
----------------------------------------------
Process : Klonoa.exe
Game Title : Klonoa
Game Version : 1.0 // maybe wrong since can' find right Game Version
Author : SeryogaSK
----------------------------------------------
Warning: Online use may trigger anti-cheat!
==============================================
}
[ENABLE]
aobscanfunction(ply_health,nsPFW.CField:ProgressCockpit,8B 49 58 89 48 2C 48 8B 86 B8 00 00 00) // should be unique in this function
alloc(newmem,$1000,ply_health)
alloc(ply_base,8)
label(code)
label(return)
newmem:
mov [ply_base],rdx
code:
mov ecx,[rcx+58]
mov [rax+2C],ecx
mov rax,[rsi+000000B8]
mov [rbp-38],rax
jmp return
ply_health:
jmp far newmem
nop 3
return:
registersymbol(ply_health ply_base)
[DISABLE]
ply_health:
db 8B 49 58 89 48 2C 48 8B 86 B8 00 00 00 48 89 45 C8
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: nsPFW.CField:ProgressCockpit+58
nsPFW.CField:ProgressCockpit+2a: 48 8B D1 - mov rdx,rcx
nsPFW.CField:ProgressCockpit+2d: 83 3A 00 - cmp dword ptr [rdx],00
nsPFW.CField:ProgressCockpit+30: 48 8B 89 C0 02 00 00 - mov rcx,[rcx+000002C0]
nsPFW.CField:ProgressCockpit+37: 8B 49 5C - mov ecx,[rcx+5C]
nsPFW.CField:ProgressCockpit+3a: 89 48 28 - mov [rax+28],ecx
nsPFW.CField:ProgressCockpit+3d: 48 8B 86 B8 00 00 00 - mov rax,[rsi+000000B8]
nsPFW.CField:ProgressCockpit+44: 48 8B 8E A0 01 00 00 - mov rcx,[rsi+000001A0]
nsPFW.CField:ProgressCockpit+4b: 48 8B D1 - mov rdx,rcx
nsPFW.CField:ProgressCockpit+4e: 83 3A 00 - cmp dword ptr [rdx],00
nsPFW.CField:ProgressCockpit+51: 48 8B 89 C0 02 00 00 - mov rcx,[rcx+000002C0]
// ---------- INJECTING HERE ----------
nsPFW.CField:ProgressCockpit+58: 8B 49 58 - mov ecx,[rcx+58]
// ---------- DONE INJECTING ----------
nsPFW.CField:ProgressCockpit+5b: 89 48 2C - mov [rax+2C],ecx
nsPFW.CField:ProgressCockpit+5e: 48 8B 86 B8 00 00 00 - mov rax,[rsi+000000B8]
nsPFW.CField:ProgressCockpit+65: 48 89 45 C8 - mov [rbp-38],rax
nsPFW.CField:ProgressCockpit+69: 48 8D 64 24 00 - lea rsp,[rsp+00]
nsPFW.CField:ProgressCockpit+6e: 49 BB 50 29 0E B1 37 01 00 00 - mov r11,nsPFW.CCockpit:MaxHitPoint
nsPFW.CField:ProgressCockpit+78: 41 FF D3 - call r11
nsPFW.CField:ProgressCockpit+7b: 48 8B C8 - mov rcx,rax
nsPFW.CField:ProgressCockpit+7e: 48 8B 45 C8 - mov rax,[rbp-38]
nsPFW.CField:ProgressCockpit+82: 89 48 30 - mov [rax+30],ecx
nsPFW.CField:ProgressCockpit+85: 48 8B 86 B8 00 00 00 - mov rax,[rsi+000000B8]
}
3
"player"
Auto Assembler Script
{
==============================================
Header Changer by SeryogaSK
----------------------------------------------
Process : Klonoa.exe
Game Title : Klonoa
Game Version : 1.0 // maybe wrong since can' find right Game Version
Author : SeryogaSK
----------------------------------------------
Warning: Online use may trigger anti-cheat!
==============================================
}
define(address,nsPFW.CField:ProgressCockpit+5c)
define(bytes,8B 49 58 89 48 2C)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,nsPFW.CField:ProgressCockpit+5c)
alloc(ply_base,8)
registersymbol(ply_base)
label(code)
label(return)
newmem:
mov [ply_base],rdx
code:
mov ecx,[rcx+58]
mov [rax+2C],ecx
jmp return
address:
jmp newmem
nop
return:
[DISABLE]
address:
db bytes
// mov ecx,[rcx+58]
// mov [rax+2C],ecx
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: nsPFW.CField:ProgressCockpit+5c
nsPFW.CField:ProgressCockpit+2e: 48 8B D1 - mov rdx,rcx
nsPFW.CField:ProgressCockpit+31: 83 3A 00 - cmp dword ptr [rdx],00
nsPFW.CField:ProgressCockpit+34: 48 8B 89 C0 02 00 00 - mov rcx,[rcx+000002C0]
nsPFW.CField:ProgressCockpit+3b: 8B 49 5C - mov ecx,[rcx+5C]
nsPFW.CField:ProgressCockpit+3e: 89 48 28 - mov [rax+28],ecx
nsPFW.CField:ProgressCockpit+41: 48 8B 86 B8 00 00 00 - mov rax,[rsi+000000B8]
nsPFW.CField:ProgressCockpit+48: 48 8B 8E A0 01 00 00 - mov rcx,[rsi+000001A0]
nsPFW.CField:ProgressCockpit+4f: 48 8B D1 - mov rdx,rcx
nsPFW.CField:ProgressCockpit+52: 83 3A 00 - cmp dword ptr [rdx],00
nsPFW.CField:ProgressCockpit+55: 48 8B 89 C0 02 00 00 - mov rcx,[rcx+000002C0]
// ---------- INJECTING HERE ----------
nsPFW.CField:ProgressCockpit+5c: 8B 49 58 - mov ecx,[rcx+58]
// ---------- DONE INJECTING ----------
nsPFW.CField:ProgressCockpit+5f: 89 48 2C - mov [rax+2C],ecx
nsPFW.CField:ProgressCockpit+62: 48 8B 86 B8 00 00 00 - mov rax,[rsi+000000B8]
nsPFW.CField:ProgressCockpit+69: 48 89 45 C0 - mov [rbp-40],rax
nsPFW.CField:ProgressCockpit+6d: 90 - nop
nsPFW.CField:ProgressCockpit+6e: 49 BB 00 2C 81 32 C9 01 00 00 - mov r11,nsPFW.CCockpit:MaxHitPoint
nsPFW.CField:ProgressCockpit+78: 41 FF D3 - call r11
nsPFW.CField:ProgressCockpit+7b: 48 8B C8 - mov rcx,rax
nsPFW.CField:ProgressCockpit+7e: 48 8B 45 C0 - mov rax,[rbp-40]
nsPFW.CField:ProgressCockpit+82: 89 48 30 - mov [rax+30],ecx
nsPFW.CField:ProgressCockpit+85: 48 8B 86 B8 00 00 00 - mov rax,[rsi+000000B8]
}
4
"Base"
1
0
8 Bytes
ply_base
59
"m_ElapsedTime"
Float
[ply_base]+110
5
"Hearth"
4 Bytes
[ply_base]+2C0
58
54
"Invincibility Time"
Float
[ply_base]+2B8
50
52
"Gravity"
Float
[ply_base]+2B8
F8
Set Value
17
2
0
Activate
17
1
42
"Support Jump"
Byte
[ply_base]+2B8
102
Set Value
16
1
0
67
"Puzzle"
1
8 Bytes
[ply_base]+2C0
38
66
"Puzzle 2"
Byte
[ply_base]+2C0
20
38
65
"Puzzle 2"
Byte
[ply_base]+2C0
21
38
64
"Puzzle 3"
Byte
[ply_base]+2C0
22
38
63
"Puzzle 4"
Byte
[ply_base]+2C0
23
38
62
"Puzzle 5"
Byte
[ply_base]+2C0
24
38
61
"Puzzle 6"
Byte
[ply_base]+2C0
25
38
1158
"Timer"
Auto Assembler Script
{
==============================================
Header Changer by SeryogaSK
----------------------------------------------
Process : Klonoa.exe
Game Title : Klonoa
Game Version : 1.0 // maybe wrong since can' find right Game Version
Author : SeryogaSK
----------------------------------------------
Warning: Online use may trigger anti-cheat!
==============================================
}
define(address,nsPFW.nsTimeAttack.CTimer:Progress+11)
define(bytes,F3 0F 10 46 10)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,nsPFW.nsTimeAttack.CTimer:Progress+11)
label(code)
label(return)
newmem:
mov [rsi+10],(float)2
code:
movss xmm0,[rsi+10]
jmp return
address:
jmp newmem
return:
[DISABLE]
address:
db bytes
// movss xmm0,[rsi+10]
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: nsPFW.nsTimeAttack.CTimer:Progress+11
28827EF34B4: 00 00 - add [rax],al
28827EF34B6: 00 00 - add [rax],al
28827EF34B8: 00 00 - add [rax],al
28827EF34BA: 00 00 - add [rax],al
28827EF34BC: 00 00 - add [rax],al
28827EF34BE: 00 00 - add [rax],al
nsPFW.nsTimeAttack.CTimer:Progress: 48 83 EC 18 - sub rsp,18
nsPFW.nsTimeAttack.CTimer:Progress+4: 48 89 34 24 - mov [rsp],rsi
nsPFW.nsTimeAttack.CTimer:Progress+8: 48 8B F1 - mov rsi,rcx
nsPFW.nsTimeAttack.CTimer:Progress+b: F3 0F 11 4C 24 08 - movss [rsp+08],xmm1
// ---------- INJECTING HERE ----------
nsPFW.nsTimeAttack.CTimer:Progress+11: F3 0F 10 46 10 - movss xmm0,[rsi+10]
// ---------- DONE INJECTING ----------
nsPFW.nsTimeAttack.CTimer:Progress+16: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
nsPFW.nsTimeAttack.CTimer:Progress+1a: F3 0F 10 4C 24 08 - movss xmm1,[rsp+08]
nsPFW.nsTimeAttack.CTimer:Progress+20: F3 0F 5A C9 - cvtss2sd xmm1,xmm1
nsPFW.nsTimeAttack.CTimer:Progress+24: F3 0F 10 15 24 00 00 00 - movss xmm2,[nsPFW.nsTimeAttack.CTimer:Progress+50]
nsPFW.nsTimeAttack.CTimer:Progress+2c: F3 0F 5A D2 - cvtss2sd xmm2,xmm2
nsPFW.nsTimeAttack.CTimer:Progress+30: F2 0F 59 CA - mulsd xmm1,xmm2
nsPFW.nsTimeAttack.CTimer:Progress+34: F2 0F 58 C1 - addsd xmm0,xmm1
nsPFW.nsTimeAttack.CTimer:Progress+38: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0
nsPFW.nsTimeAttack.CTimer:Progress+3c: F3 0F 11 6E 10 - movss [rsi+10],xmm5
nsPFW.nsTimeAttack.CTimer:Progress+41: 48 8B 34 24 - mov rsi,[rsp]
}
1175
""
1
1174
"MISC"
1
28
"m_NumContinue"
4 Bytes
[ply_base]+2C0
5C
29
"m_NumPieces"
4 Bytes
[ply_base]+2C0
60
30
"m_NumPiecesInRecord"
4 Bytes
[ply_base]+2C0
64
31
"m_CountOfPieces"
4 Bytes
[ply_base]+2C0
68
32
"m_CountOfPiecesInRecord"
4 Bytes
[ply_base]+2C0
6C
33
"m_AttachedObjectNumber"
4 Bytes
[ply_base]+2C0
70
34
"m_AttachedObjectNumberInRecord"
4 Bytes
[ply_base]+2C0
74
35
"m_BaseScale"
Float
[ply_base]+2FC
36
"toAngle"
Float
[ply_base]+2F8
37
"transparentValue"
Float
[ply_base]+2F4
16
"m_HaveGoldenMedal"
1
8 Bytes
[ply_base]+2C0
48
6
"[0]Boolean"
Byte
[ply_base]+2C0
20
48
7
"[1]Boolean"
Byte
[ply_base]+2C0
21
48
8
"[2]Boolean"
Byte
[ply_base]+2C0
22
48
9
"[3]Boolean"
Byte
[ply_base]+2C0
23
48
10
"[4]Boolean"
Byte
[ply_base]+2C0
24
48
11
"[5]Boolean"
Byte
[ply_base]+2C0
25
48
12
"[6]Boolean"
Byte
[ply_base]+2C0
26
48
13
"[7]Boolean"
Byte
[ply_base]+2C0
27
48
14
"[8]Boolean"
Byte
[ply_base]+2C0
28
48
15
"[9]Boolean"
Byte
[ply_base]+2C0
29
48
17
"m_HaveGoldenMedalInRecord"
1
8 Bytes
[ply_base]+2C0
50
27
"[0]Boolean"
Byte
[ply_base]+2C0
20
50
26
"[1]Boolean"
Byte
[ply_base]+2C0
21
50
25
"[2]Boolean"
Byte
[ply_base]+2C0
22
50
24
"[3]Boolean"
Byte
[ply_base]+2C0
23
50
23
"[4]Boolean"
Byte
[ply_base]+2C0
24
50
22
"[5]Boolean"
Byte
[ply_base]+2C0
25
50
21
"[6]Boolean"
Byte
[ply_base]+2C0
26
50
20
"[7]Boolean"
Byte
[ply_base]+2C0
27
50
19
"[8]Boolean"
Byte
[ply_base]+2C0
28
50
18
"[9]Boolean"
Byte
[ply_base]+2C0
29
50
38
"isAllCleared"
Byte
[ply_base]+158
1F8
39
"debugStartVision"
0
Byte
[ply_base]+158
214
40
"isCompleteActivity"
Byte
[ply_base]+158
20D
41
"m_SecondJump"
Byte
[ply_base]+2B8
101
43
"m_SupportJump"
Byte
[ply_base]+2B8
103
44
"m_ActionTimerForJump"
Float
[ply_base]+2B8
104
45
"m_IsJumping"
Byte
[ply_base]+2B8
114
46
"m_IsSpringJump"
Byte
[ply_base]+2B8
115
47
"m_DidHover"
Byte
[ply_base]+2B8
116
48
"m_DidStagger"
Byte
[ply_base]+2B8
117
49
"m_DidMove"
Byte
[ply_base]+2B8
118
50
"m_RunningMeter"
Float
[ply_base]+2B8
11C
51
"m_IsNoDamage"
Byte
[ply_base]+2B8
128
53
"m_IsForbidden"
Byte
[ply_base]+2B0
10
55
"m_DownExternalForce"
Float
[ply_base]+2B8
54
56
"m_Timer"
Float
[ply_base]+2B8
58
58
"m_Radius"
Float
[ply_base]+20
2C
20
10
60
"m_IsLooped"
Byte
[ply_base]+118
69
"--------------------------------------------------------------- ----------------------------------------------------------------"
1
1160
""
1
1159
"----------------------------------------------- KLONOA 2: LUNAREA'S VEIL ------------------------------------------------"
1
1165
"Unl. Health"
Auto Assembler Script
{
==============================================
Header Changer by SeryogaSK
----------------------------------------------
Process : Klonoa.exe
Game Title : Klonoa
Game Version : 1.0 // maybe wrong since can' find right Game Version
Author : SeryogaSK
----------------------------------------------
Warning: Online use may trigger anti-cheat!
==============================================
}
define(address,App.Klonoa2.Game:DrawGameScrHeart2D+7e)
define(bytes,48 63 40 20 48 89 45 F0)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,App.Klonoa2.Game:DrawGameScrHeart2D+7e)
label(code)
label(return)
newmem:
mov dword ptr [rax+20],#999
code:
movsxd rax,dword ptr [rax+20]
mov [rbp-10],rax
jmp return
address:
jmp newmem
nop 3
return:
[DISABLE]
address:
db bytes
// movsxd rax,dword ptr [rax+20]
// mov [rbp-10],rax
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: App.Klonoa2.Game:DrawGameScrHeart2D+7e
App.Klonoa2.Game:DrawGameScrHeart2D+47: BA 01 00 00 00 - mov edx,00000001
App.Klonoa2.Game:DrawGameScrHeart2D+4c: 83 38 00 - cmp dword ptr [rax],00
App.Klonoa2.Game:DrawGameScrHeart2D+4f: 48 8D AD 00 00 00 00 - lea rbp,[rbp+00000000]
App.Klonoa2.Game:DrawGameScrHeart2D+56: 49 BB 30 40 75 37 1A 02 00 00 - mov r11,App.Klonoa2.HudHeart:SetHeartActive
App.Klonoa2.Game:DrawGameScrHeart2D+60: 41 FF D3 - call r11
App.Klonoa2.Game:DrawGameScrHeart2D+63: 48 B8 E0 BF 44 69 1A 02 00 00 - mov rax,0000021A6944BFE0
App.Klonoa2.Game:DrawGameScrHeart2D+6d: 48 8B 00 - mov rax,[rax]
App.Klonoa2.Game:DrawGameScrHeart2D+70: 48 8B 40 38 - mov rax,[rax+38]
App.Klonoa2.Game:DrawGameScrHeart2D+74: 83 78 18 00 - cmp dword ptr [rax+18],00
App.Klonoa2.Game:DrawGameScrHeart2D+78: 0F 86 43 00 00 00 - jbe App.Klonoa2.Game:DrawGameScrHeart2D+c1
// ---------- INJECTING HERE ----------
App.Klonoa2.Game:DrawGameScrHeart2D+7e: 48 63 40 20 - movsxd rax,dword ptr [rax+20]
// ---------- DONE INJECTING ----------
App.Klonoa2.Game:DrawGameScrHeart2D+82: 48 89 45 F0 - mov [rbp-10],rax
App.Klonoa2.Game:DrawGameScrHeart2D+86: 49 BB 60 4D A4 69 1A 02 00 00 - mov r11,App.Klonoa2.OBJKLO:get_KLO_LIFE_MAX
App.Klonoa2.Game:DrawGameScrHeart2D+90: 41 FF D3 - call r11
App.Klonoa2.Game:DrawGameScrHeart2D+93: 4C 8B C0 - mov r8,rax
App.Klonoa2.Game:DrawGameScrHeart2D+96: 48 8B 45 F8 - mov rax,[rbp-08]
App.Klonoa2.Game:DrawGameScrHeart2D+9a: 48 8B 55 F0 - mov rdx,[rbp-10]
App.Klonoa2.Game:DrawGameScrHeart2D+9e: 48 8B C8 - mov rcx,rax
App.Klonoa2.Game:DrawGameScrHeart2D+a1: 45 33 C9 - xor r9d,r9d
App.Klonoa2.Game:DrawGameScrHeart2D+a4: 83 38 00 - cmp dword ptr [rax],00
App.Klonoa2.Game:DrawGameScrHeart2D+a7: 48 8D AD 00 00 00 00 - lea rbp,[rbp+00000000]
}
1169
"Player [Die one time]"
Auto Assembler Script
{
==============================================
Header Changer by SeryogaSK
----------------------------------------------
Process : Klonoa.exe
Game Title : Klonoa
Game Version : 1.0 // maybe wrong since can' find right Game Version
Author : SeryogaSK
----------------------------------------------
Warning: Online use may trigger anti-cheat!
==============================================
}
define(address,App.Klonoa2.Game+GAME_WORK:DecKloZanki+8e)
define(bytes,89 08 48 8B 75 F0)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,App.Klonoa2.Game+GAME_WORK:DecKloZanki+8e)
alloc(ply_basesec,8)
registersymbol(ply_basesec)
label(code)
label(return)
newmem:
mov [ply_basesec],rdi
code:
mov [rax],ecx
mov rsi,[rbp-10]
jmp return
address:
jmp newmem
nop
return:
[DISABLE]
address:
db bytes
// mov [rax],ecx
// mov rsi,[rbp-10]
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: App.Klonoa2.Game+GAME_WORK:DecKloZanki+8e
App.Klonoa2.Game+GAME_WORK:DecKloZanki+6d: 48 63 09 - movsxd rcx,dword ptr [rcx]
App.Klonoa2.Game+GAME_WORK:DecKloZanki+70: 3B C1 - cmp eax,ecx
App.Klonoa2.Game+GAME_WORK:DecKloZanki+72: 7C 1C - jl App.Klonoa2.Game+GAME_WORK:DecKloZanki+90
App.Klonoa2.Game+GAME_WORK:DecKloZanki+74: 48 8B 47 40 - mov rax,[rdi+40]
App.Klonoa2.Game+GAME_WORK:DecKloZanki+78: 48 63 CE - movsxd rcx,esi
App.Klonoa2.Game+GAME_WORK:DecKloZanki+7b: 39 48 18 - cmp [rax+18],ecx
App.Klonoa2.Game+GAME_WORK:DecKloZanki+7e: 0F 86 1A 00 00 00 - jbe App.Klonoa2.Game+GAME_WORK:DecKloZanki+9e
App.Klonoa2.Game+GAME_WORK:DecKloZanki+84: 48 8D 44 88 20 - lea rax,[rax+rcx*4+20]
App.Klonoa2.Game+GAME_WORK:DecKloZanki+89: 48 63 08 - movsxd rcx,dword ptr [rax]
App.Klonoa2.Game+GAME_WORK:DecKloZanki+8c: FF C9 - dec ecx
// ---------- INJECTING HERE ----------
App.Klonoa2.Game+GAME_WORK:DecKloZanki+8e: 89 08 - mov [rax],ecx
// ---------- DONE INJECTING ----------
App.Klonoa2.Game+GAME_WORK:DecKloZanki+90: 48 8B 75 F0 - mov rsi,[rbp-10]
App.Klonoa2.Game+GAME_WORK:DecKloZanki+94: 48 8B 7D F8 - mov rdi,[rbp-08]
App.Klonoa2.Game+GAME_WORK:DecKloZanki+98: 48 8D 65 00 - lea rsp,[rbp+00]
App.Klonoa2.Game+GAME_WORK:DecKloZanki+9c: 5D - pop rbp
App.Klonoa2.Game+GAME_WORK:DecKloZanki+9d: C3 - ret
App.Klonoa2.Game+GAME_WORK:DecKloZanki+9e: BA 3D 00 00 00 - mov edx,0000003D
App.Klonoa2.Game+GAME_WORK:DecKloZanki+a3: B9 8C 01 00 00 - mov ecx,0000018C
App.Klonoa2.Game+GAME_WORK:DecKloZanki+a8: 48 8D 64 24 00 - lea rsp,[rsp+00]
App.Klonoa2.Game+GAME_WORK:DecKloZanki+ad: 90 - nop
App.Klonoa2.Game+GAME_WORK:DecKloZanki+ae: 49 BB D0 20 7F 3A CE 02 00 00 - mov r11,000002CE3A7F20D0
}
1170
"Base"
1
0
8 Bytes
ply_basesec
1171
"Hearth"
4 Bytes
[ply_basesec]+38
20
1172
"Life"
4 Bytes
[ply_basesec]+40
20
1173
"--------------------------------------------------------------- ----------------------------------------------------------------"
1