12
"Always full Health and Mana"
Auto Assembler Script
{ Game : TheBardsTaleTrilogy.exe
Version:
Date : 2019-11-03
Author : Ich
This script does blah blah blah
}
[ENABLE]
aobscanmodule(checker,GameAssembly.dll,83 B9 84 00 00 00 00 0F 94) // should be unique
alloc(newmem,$1000,"GameAssembly.dll"+1F20D0)
label(code)
label(return)
newmem:
push eax
mov eax,[rcx+80] // load full health
mov [rcx+84], eax // write it to current health
mov eax,[rcx+88] // load full mana
mov [rcx+8c], eax // write it to current mana
pop eax
code:
cmp dword ptr [rcx+00000084],00
jmp return
checker:
jmp newmem
nop 2
return:
registersymbol(checker)
[DISABLE]
checker:
db 83 B9 84 00 00 00 00
unregistersymbol(checker)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "GameAssembly.dll"+1F20D0
"GameAssembly.dll"+1F20C6: CC - int 3
"GameAssembly.dll"+1F20C7: CC - int 3
"GameAssembly.dll"+1F20C8: CC - int 3
"GameAssembly.dll"+1F20C9: CC - int 3
"GameAssembly.dll"+1F20CA: CC - int 3
"GameAssembly.dll"+1F20CB: CC - int 3
"GameAssembly.dll"+1F20CC: CC - int 3
"GameAssembly.dll"+1F20CD: CC - int 3
"GameAssembly.dll"+1F20CE: CC - int 3
"GameAssembly.dll"+1F20CF: CC - int 3
// ---------- INJECTING HERE ----------
"GameAssembly.dll"+1F20D0: 83 B9 84 00 00 00 00 - cmp dword ptr [rcx+00000084],00
// ---------- DONE INJECTING ----------
"GameAssembly.dll"+1F20D7: 0F 94 C0 - sete al
"GameAssembly.dll"+1F20DA: C3 - ret
"GameAssembly.dll"+1F20DB: CC - int 3
"GameAssembly.dll"+1F20DC: CC - int 3
"GameAssembly.dll"+1F20DD: CC - int 3
"GameAssembly.dll"+1F20DE: CC - int 3
"GameAssembly.dll"+1F20DF: CC - int 3
"GameAssembly.dll"+1F20E0: 0F B6 41 22 - movzx eax,byte ptr [rcx+22]
"GameAssembly.dll"+1F20E4: C3 - ret
"GameAssembly.dll"+1F20E5: CC - int 3
}
15
"Always get 10.000 gold when looting"
Auto Assembler Script
{ Game : TheBardsTaleTrilogy.exe
Version:
Date : 2019-11-03
Author : Ich
This script does blah blah blah
}
[ENABLE]
aobscanmodule(getmoregold,GameAssembly.dll,48 8B 57 68 48 03 D6) // should be unique
alloc(newmem,$1000,"GameAssembly.dll"+201AA7)
label(code)
label(return)
newmem:
mov rsi,#10000
code:
mov rdx,[rdi+68]
add rdx,rsi
jmp return
getmoregold:
jmp newmem
nop 2
return:
registersymbol(getmoregold)
[DISABLE]
getmoregold:
db 48 8B 57 68 48 03 D6
unregistersymbol(getmoregold)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "GameAssembly.dll"+201AA7
"GameAssembly.dll"+201A81: 74 0E - je GameAssembly.dll+201A91
"GameAssembly.dll"+201A83: 83 B9 D8 00 00 00 00 - cmp dword ptr [rcx+000000D8],00
"GameAssembly.dll"+201A8A: 75 05 - jne GameAssembly.dll+201A91
"GameAssembly.dll"+201A8C: E8 3F EC E5 FF - call GameAssembly.dll+606D0
"GameAssembly.dll"+201A91: 33 C9 - xor ecx,ecx
"GameAssembly.dll"+201A93: E8 88 4A 04 00 - call GameAssembly.dll+246520
"GameAssembly.dll"+201A98: 48 85 C0 - test rax,rax
"GameAssembly.dll"+201A9B: 0F 84 E5 00 00 00 - je GameAssembly.dll+201B86
"GameAssembly.dll"+201AA1: 80 78 18 00 - cmp byte ptr [rax+18],00
"GameAssembly.dll"+201AA5: 75 6E - jne GameAssembly.dll+201B15
// ---------- INJECTING HERE ----------
"GameAssembly.dll"+201AA7: 48 8B 57 68 - mov rdx,[rdi+68]
"GameAssembly.dll"+201AAB: 48 03 D6 - add rdx,rsi
// ---------- DONE INJECTING ----------
"GameAssembly.dll"+201AAE: 48 89 57 68 - mov [rdi+68],rdx
"GameAssembly.dll"+201AB2: 48 8B 05 6F FA C3 00 - mov rax,[GameAssembly.dll+E41528]
"GameAssembly.dll"+201AB9: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
"GameAssembly.dll"+201AC0: 48 8B 09 - mov rcx,[rcx]
"GameAssembly.dll"+201AC3: 48 85 C9 - test rcx,rcx
"GameAssembly.dll"+201AC6: 0F 84 BA 00 00 00 - je GameAssembly.dll+201B86
"GameAssembly.dll"+201ACC: 45 33 C0 - xor r8d,r8d
"GameAssembly.dll"+201ACF: E8 DC 4E FD FF - call GameAssembly.dll+1D69B0
"GameAssembly.dll"+201AD4: 48 8B 05 CD F3 C3 00 - mov rax,[GameAssembly.dll+E40EA8]
"GameAssembly.dll"+201ADB: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
}
54
"Editor for currently "opened" Character"
Binary
0
1
0
"GameAssembly.dll"+00E464E0
0
18
0
B8
22
"Experience"
4 Bytes
+50
23
"Strength"
4 Bytes
+58
24
"Intelligence"
4 Bytes
+5c
25
"Dexterity"
4 Bytes
+60
26
"Constitution"
4 Bytes
+64
27
"Luck"
4 Bytes
+68
28
"Level"
4 Bytes
+7c
29
"Hitpoints (max)"
4 Bytes
+80
30
"Hitpoints (current)"
4 Bytes
+84
31
"Mana (max)"
4 Bytes
+88
32
"Mana (current)"
4 Bytes
+8c
55
"Backup Pointer 1"
Binary
0
1
0
"GameAssembly.dll"+00E45CA8
0
18
20
B8
56
"Backup Pointer 2"
Binary
0
1
0
"GameAssembly.dll"+00E46048
0
18
10
B8
57
"Backup Pointer 3"
Binary
0
1
0
"GameAssembly.dll"+00E2ABF8
0
18
0
B8
340