0
"コンパクトモード切替 / Toggle Compact View"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if not toggleCompactView then
function toggleCompactView(sender, forceEnable)
local isCompactMode = not (compactViewMenuItem.Caption == 'Compact View Mode')
if forceEnable ~= nil then
isCompactMode = not forceEnable
end
synchronize(function()
compactViewMenuItem.Caption = isCompactMode and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = isCompactMode
getMainForm().Panel4.Visible = isCompactMode
getMainForm().Panel5.Visible = isCompactMode
end)
end
end
if not createCompactViewMenu then
function createCompactViewMenu()
if isCompactMenuCreated then return end
synchronize(function()
local mainMenu = getMainForm().Menu.Items
compactViewMenuItem = createMenuItem(mainMenu)
compactViewMenuItem.Caption = 'Compact View Mode'
compactViewMenuItem.OnClick = toggleCompactView
mainMenu.add(compactViewMenuItem)
end)
isCompactMenuCreated = true
end
end
createCompactViewMenu()
toggleCompactView(nil, true)
[DISABLE]
{$lua}
if toggleCompactView then
toggleCompactView(nil, false)
end
1
"スクリプト一括切替 / Toggle scripts"
4080FF
Auto Assembler Script
[ENABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local enableBattleScripts = {
--[[
-- attach process
local processName = "game_exe.exe"
local pid = getProcessIDFromProcessName(processName)
if pid ~= nil and pid > 0 then
local currentPid = getOpenedProcessID() or 0
if currentPid ~= pid then
openProcess(processName)
print("Attached to: " .. processName)
Sleep(333)
else
print("Already attached to: " .. processName)
end
end
synchronize(function()
getLuaEngine().Close()
end)
--]]
0, -- "Toggle Compact View"
2, -- "啟用 / Enable"
3, -- "取得Mira和耀晶石 / Get Mira"
15, -- "瀏覽道具後設定個數 / Browse & set item amount"
26, -- "戰鬥：傷害控制 / Battle: damage control"
50, -- "道具無限 / inf item use"
51, -- "戰鬥：快速BP / Battle: fast BP"
55, -- "戰鬥結束後恢復BP / Restore break gauge after battle"
56, -- "支援經驗值倍率 / Support XP multiplier"
58, -- "快速超能驅動 / Fast overdrive (OD)"
62, -- "超能驅動值不減 / inf. OD gauge"
63, -- "原野無限戰技攻擊條倍率 / Field charge gauge multiplier"
65, -- "原野無限戰技攻擊條 / Field charge: inf charge use"
157, -- "瀏覽食譜時自動設定食材量 / Auto set ingredient amt. when browsing recipes"
161, -- "單一任務資料檢視 / Quest viewer"
185, -- "ORBMENT - 目前選擇之結晶迴路 / Cur. quartz"
260, -- "變更視角 / Change POV [credit to amorrow28]"
273, -- "戰鬥：命中% 最大 / Battle: max HIT%"
275, -- "戰鬥：設定迴避% / Battle: set evade%"
277, -- "戰鬥：設定魔法迴避% / Battle: set magic evade%"
45, -- "戰鬥：試著HP不變0 / Battle: player HP: try to keep non-zero"
46, -- "戰鬥：EP使用後回滿 / Battle: full EP after use"
47, -- "戰鬥：CP使用後回滿 / Battle: full CP after use"
48, -- "戰鬥：擊暈倍率 / Battle: Stun multiplier"
189, -- "立即生效 / take effect immediately"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(enableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and not memRec.Active then
memRec.Active = true
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
[DISABLE]
{$lua}
if (syntaxcheck) then return end
synchronize(function()
getLuaEngine().menuItem5.doClick()
getLuaEngine().Close()
end)
local disableBattleScripts = {
261, -- "隱藏HUD / Hide HUD [F7]"
259, -- "啟用 / Enable change POV [num 0]"
191, -- "Spells+"
189, -- "立即生效 / take effect immediately"
172, -- "產生任務狀態列表 / Generate quests status"
59, -- "改用倍率 / use multiplier"
48, -- "戰鬥：擊暈倍率 / Battle: Stun multiplier"
47, -- "戰鬥：CP使用後回滿 / Battle: full CP after use"
46, -- "戰鬥：EP使用後回滿 / Battle: full EP after use"
45, -- "戰鬥：試著HP不變0 / Battle: player HP: try to keep non-zero"
34, -- "敵方HP選項 / Enemy HP option"
32, -- "被擊中後回CP?"
30, -- "被擊中後回EP?"
27, -- "一般設定 / Global setting"
22, -- "if item amount >="
20, -- "如果數量 >="
18, -- "設定數量為："
16, -- "道具目前數量必須 >="
277, -- "戰鬥：設定魔法迴避% / Battle: set magic evade%"
275, -- "戰鬥：設定迴避% / Battle: set evade%"
273, -- "戰鬥：命中% 最大 / Battle: max HIT%"
272, -- "戰鬥：設定爆擊% / Battle: set crit%"
260, -- "變更視角 / Change POV [credit to amorrow28]"
185, -- "ORBMENT - 目前選擇之結晶迴路 / Cur. quartz"
168, -- "取得全部任務進度資料 / Get all quests progress"
161, -- "單一任務資料檢視 / Quest viewer"
157, -- "瀏覽食譜時自動設定食材量 / Auto set ingredient amt. when browsing recipes"
106, -- "取得進行中Rewards / Get on-going reward data / max 50"
73, -- "角色數值檢視器 / Char. stats viewer"
66, -- "取得擊殺數 / Get kill count"
65, -- "原野無限戰技攻擊條 / Field charge: inf charge use"
63, -- "原野無限戰技攻擊條倍率 / Field charge gauge multiplier"
62, -- "超能驅動值不減 / inf. OD gauge"
58, -- "快速超能驅動 / Fast overdrive (OD)"
56, -- "支援經驗值倍率 / Support XP multiplier"
55, -- "戰鬥結束後恢復BP / Restore break gauge after battle"
51, -- "戰鬥：快速BP / Battle: fast BP"
50, -- "道具無限 / inf item use"
26, -- "戰鬥：傷害控制 / Battle: damage control"
15, -- "瀏覽道具後設定個數 / Browse & set item amount"
3, -- "取得Mira和耀晶石 / Get Mira"
175, -- "空之軌跡 the 2nd / https://opencheattables.com"
2, -- "啟用 / Enable"
0, -- "Toggle Compact View"
}
local addressList = getAddressList()
synchronize(function()
for _, id in ipairs(disableBattleScripts) do
local memRec = addressList.getMemoryRecordByID(id)
if memRec and memRec.Active then
memRec.Active = false
sleep(30)
end
addressList.refresh()
end
end)
synchronize(function() getLuaEngine().Close() end)
-- Comments:
-- ID: 0, Description: "Toggle Compact View", Depth: 0
-- ID: 2, Description: "啟用 / Enable", Depth: 0
-- ID: 3, Description: "取得Mira和耀晶石 / Get Mira", Depth: 1
-- ID: 15, Description: "瀏覽道具後設定個數 / Browse & set item amount", Depth: 1
-- ID: 16, Description: "道具目前數量必須 >=", Depth: 2
-- ID: 18, Description: "設定數量為：", Depth: 2
-- ID: 20, Description: "如果數量 >=", Depth: 2
-- ID: 22, Description: "if item amount >=", Depth: 2
-- ID: 26, Description: "戰鬥：傷害控制 / Battle: damage control", Depth: 1
-- ID: 27, Description: "一般設定 / Global setting", Depth: 2
-- ID: 30, Description: "被擊中後回EP?", Depth: 2
-- ID: 32, Description: "被擊中後回CP?", Depth: 2
-- ID: 34, Description: "敵方HP選項 / Enemy HP option", Depth: 2
-- ID: 45, Description: "戰鬥：試著HP不變0 / Battle: player HP: try to keep non-zero", Depth: 2
-- ID: 46, Description: "戰鬥：EP使用後回滿 / Battle: full EP after use", Depth: 2
-- ID: 47, Description: "戰鬥：CP使用後回滿 / Battle: full CP after use", Depth: 2
-- ID: 48, Description: "戰鬥：擊暈倍率 / Battle: Stun multiplier", Depth: 2
-- ID: 50, Description: "道具無限 / inf item use", Depth: 1
-- ID: 272, Description: "戰鬥：設定爆擊% / Battle: set crit%", Depth: 1
-- ID: 273, Description: "戰鬥：命中% 最大 / Battle: max HIT%", Depth: 1
-- ID: 275, Description: "戰鬥：設定迴避% / Battle: set evade%", Depth: 1
-- ID: 277, Description: "戰鬥：設定魔法迴避% / Battle: set magic evade%", Depth: 1
-- ID: 51, Description: "戰鬥：快速BP / Battle: fast BP", Depth: 1
-- ID: 55, Description: "戰鬥結束後恢復BP / Restore break gauge after battle", Depth: 1
-- ID: 56, Description: "支援經驗值倍率 / Support XP multiplier", Depth: 1
-- ID: 58, Description: "快速超能驅動 / Fast overdrive (OD)", Depth: 1
-- ID: 59, Description: "改用倍率 / use multiplier", Depth: 2
-- ID: 62, Description: "超能驅動值不減 / inf. OD gauge", Depth: 1
-- ID: 63, Description: "原野無限戰技攻擊條倍率 / Field charge gauge multiplier", Depth: 1
-- ID: 65, Description: "原野無限戰技攻擊條 / Field charge: inf charge use", Depth: 1
-- ID: 66, Description: "取得擊殺數 / Get kill count", Depth: 1
-- ID: 185, Description: "ORBMENT - 目前選擇之結晶迴路 / Cur. quartz", Depth: 1
-- ID: 73, Description: "角色數值檢視器 / Char. stats viewer", Depth: 1
-- ID: 191, Description: "Spells+", Depth: 2
-- ID: 106, Description: "取得進行中Rewards / Get on-going reward data / max 50", Depth: 1
-- ID: 157, Description: "瀏覽食譜時自動設定食材量 / Auto set ingredient amt. when browsing recipes", Depth: 1
-- ID: 189, Description: "立即生效 / take effect immediately", Depth: 2
-- ID: 161, Description: "單一任務資料檢視 / Quest viewer", Depth: 1
-- ID: 168, Description: "取得全部任務進度資料 / Get all quests progress", Depth: 1
-- ID: 172, Description: "產生任務狀態列表 / Generate quests status", Depth: 2
-- ID: 260, Description: "變更視角 / Change POV [credit to amorrow28]", Depth: 1
-- ID: 259, Description: "啟用 / Enable change POV [num 0]", Depth: 2
-- ID: 261, Description: "隱藏HUD / Hide HUD [F7]", Depth: 2
-- ID: 175, Description: "空之軌跡 the 2nd / https://opencheattables.com", Depth: 0
2
"有効化 / Enable"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if memrec then print(memrec.Description) end
-- Clear lua engine log & close lua engine
if not closeLuaEngine2 then
function closeLuaEngine2()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine2')
if not closeLuaEngine then
function closeLuaEngine()
synchronize(function()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine')
synchronize(function()
getLuaEngine().MenuItem5.doClick()
AddressList.Header.OnSectionClick = nil
end)
closeLuaEngine2()
if _kuro_2_customInt == nil then
local p_proc = process
registerCustomTypeAutoAssembler([[
alloc(TypeName,256)
alloc(ByteSize,8)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(UsesFloat,1)
TypeName:
db 'Kueo2 integer',0
ByteSize:
dd 4
UsesFloat:
db 0
ConvertRoutine:
//at this point ecx contains the address where the bytes are stored
//return with rax/eax
xor rax,rax
mov eax, dword ptr [rcx]
and eax, 3FFFFFFF
ret
ConvertBackRoutine:
//at this point edx contains the address to write the value to
//and ecx contains the value
push rax
xor rax, rax
mov eax, ecx
or eax, 40000000
mov dword ptr [rdx], eax
pop rax
ret
]])
_kuro_2_customInt = true
process = p_proc
autoAssemble(string.format([[
unregistersymbol($process)
define($process, "%s")
registersymbol($process)
]], process))
closeLuaEngine2()
end
local processName = "sora_2nd.exe"
local pid = getProcessIDFromProcessName(processName)
if pid ~= nil and pid > 0 then
-- 取得目前已經附加的 PID
local currentPid = getOpenedProcessID() or 0
if currentPid ~= pid then
-- 目前沒附加，或附加到別的 process → 執行 attach
openProcess(processName)
print("Attached to: " .. processName)
else
-- 已經附加在正確的 process → 不重複 attach
print("Already attached to: " .. processName)
end
end
closeLuaEngine()
[DISABLE]
{$lua}
if syntaxcheck then return end
closeLuaEngine2()
3
"ミラとセピス / Get Mira"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_GET_MIRA,$process,8B ?? 48 B6 20 00 E8)
// raw AOB: 48 3B DE 74 ?? 66 0F 1F 84 00 00 00 00 00 48 8B 0B 48 8D 15 ?? ?? ?? ?? 41 B1 01 41 B8 FE FF FF 7F E8 ?? ?? ?? ?? 48 85 C0 75 ?? 48 83 C3 08 48 3B DE 75 ?? 49 8B C4 48 8B 15 ?? ?? ?? ?? 48 8B C8 8B 92 48 B6 20 00 E8 ?? ?? ?? ?? 44 88 A7 B8 01 00 00 48 8B 05 ?? ?? ?? ?? F6 80 01 01 00 00 40 0F 85 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 44 38 A0 30 2D 00 00 0F 85 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8B 90 68 47 62 00 48 63 82 D4 00 00 00 48 8D 0C 40 83 BC 8A A0 00 00 00 11 0F 85 ?? ?? ?? ?? F3 0F 58 B7 10 01 00 00 0F 2F 35
// injection point AOB: 8B ?? 48 B6 20 00 E8 ?? ?? ?? ?? ?? 88 ?? B8 01 00 00 ?? 8B ?? ?? ?? ?? ?? F6 ?? 01 01 00 00 40 0F 85 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 38 ?? 30 2D 00 00 0F 85 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? 68 47 62 00 ?? 63 ?? D4 00 00 00 ?? 8D ?? 40 83 ?? ?? A0 00 00 00 11 0F 85 ?? ?? ?? ?? F3 0F 58 ?? 10 01 00 00 0F 2F
alloc(newmem,$1000,INJECT_GET_MIRA)
alloc(INJECT_GET_MIRAo, $6)
label(code)
label(return)
INJECT_GET_MIRAo:
readmem(INJECT_GET_MIRA, $6)
label(i_base_mira_addr i_base_mira_offset)
newmem:
push r15
xor r15, r15
db 41 bf //00 39 1f 00
readmem(INJECT_GET_MIRA+2, 4)
mov [i_base_mira_addr], rdx
mov [i_base_mira_offset], r15
pop r15
code:
// mov edx,[rdx+0020B648]
reassemble(INJECT_GET_MIRA)
//mov edx,[rdx+001F3900]
jmp return
align 10 cc
i_base_mira_addr:
dq 0
i_base_mira_offset:
dq 0
INJECT_GET_MIRA:
jmp newmem
nop 1
return:
registersymbol(INJECT_GET_MIRA INJECT_GET_MIRAo)
registersymbol(i_base_mira_addr i_base_mira_offset)
[DISABLE]
INJECT_GET_MIRA:
readmem(INJECT_GET_MIRAo, $6)
unregistersymbol(INJECT_GET_MIRA INJECT_GET_MIRAo)
dealloc(newmem)
dealloc(INJECT_GET_MIRAo)
//db 8B 92 00 39 1F 00
unregistersymbol(i_base_mira_addr i_base_mira_offset)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+202693
sora_2nd.exe+202652: 48 3B DE - cmp rbx,rsi
sora_2nd.exe+202655: 74 2F - je sora_2nd.exe+202686
sora_2nd.exe+202657: 66 0F 1F 84 00 00 00 00 00 - nop word ptr [rax+rax+00000000]
sora_2nd.exe+202660: 48 8B 0B - mov rcx,[rbx]
sora_2nd.exe+202663: 48 8D 15 CA 52 8E 00 - lea rdx,[sora_2nd.exe+AE7934]
sora_2nd.exe+20266A: 41 B1 01 - mov r9b,01
sora_2nd.exe+20266D: 41 B8 FE FF FF 7F - mov r8d,7FFFFFFE
sora_2nd.exe+202673: E8 08 D1 37 00 - call sora_2nd.exe+57F780
sora_2nd.exe+202678: 48 85 C0 - test rax,rax
sora_2nd.exe+20267B: 75 0C - jne sora_2nd.exe+202689
sora_2nd.exe+20267D: 48 83 C3 08 - add rbx,08
sora_2nd.exe+202681: 48 3B DE - cmp rbx,rsi
sora_2nd.exe+202684: 75 DA - jne sora_2nd.exe+202660
sora_2nd.exe+202686: 49 8B C4 - mov rax,r12
sora_2nd.exe+202689: 48 8B 15 D8 CA A5 00 - mov rdx,[sora_2nd.exe+C5F168]
sora_2nd.exe+202690: 48 8B C8 - mov rcx,rax
// ---------- INJECTING HERE ----------
sora_2nd.exe+202693: 8B 92 48 B6 20 00 - mov edx,[rdx+0020B648]
// ---------- DONE INJECTING ----------
sora_2nd.exe+202699: E8 02 6B 3E 00 - call sora_2nd.exe+5E91A0
sora_2nd.exe+20269E: 44 88 A7 B8 01 00 00 - mov [rdi+000001B8],r12b
sora_2nd.exe+2026A5: 48 8B 05 C4 CA A5 00 - mov rax,[sora_2nd.exe+C5F170]
sora_2nd.exe+2026AC: F6 80 01 01 00 00 40 - test byte ptr [rax+00000101],40
sora_2nd.exe+2026B3: 0F 85 05 01 00 00 - jne sora_2nd.exe+2027BE
sora_2nd.exe+2026B9: 48 8B 05 B8 93 A5 00 - mov rax,[sora_2nd.exe+C5BA78]
sora_2nd.exe+2026C0: 44 38 A0 30 2D 00 00 - cmp [rax+00002D30],r12b
sora_2nd.exe+2026C7: 0F 85 F1 00 00 00 - jne sora_2nd.exe+2027BE
sora_2nd.exe+2026CD: 48 8B 05 94 CA A5 00 - mov rax,[sora_2nd.exe+C5F168]
sora_2nd.exe+2026D4: 48 8B 90 68 47 62 00 - mov rdx,[rax+00624768]
sora_2nd.exe+2026DB: 48 63 82 D4 00 00 00 - movsxd rax,dword ptr [rdx+000000D4]
sora_2nd.exe+2026E2: 48 8D 0C 40 - lea rcx,[rax+rax*2]
sora_2nd.exe+2026E6: 83 BC 8A A0 00 00 00 11 - cmp dword ptr [rdx+rcx*4+000000A0],11
sora_2nd.exe+2026EE: 0F 85 CA 00 00 00 - jne sora_2nd.exe+2027BE
sora_2nd.exe+2026F4: F3 0F 58 B7 10 01 00 00 - addss xmm6,[rdi+00000110]
sora_2nd.exe+2026FC: 0F 2F 35 89 8B 92 00 - comiss xmm6,[sora_2nd.exe+B2B28C]
}
4
"地 / Earth"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-20
5
"水 / Water"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-1C
6
"火 / Fire"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-18
7
"風 / Wind"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-14
8
"時 / Time"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-10
9
"空 / Space"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-C
10
"幻 / Mirage"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-8
11
"セピス塊 / Exchange"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]-4
12
"ミラ / Mira"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]
13
"メダル / Medal"
0
FF8080
4 Bytes
i_base_mira_addr
[i_base_mira_offset]+4
14
"プレイ時間 / Play time"
0
FF8080
Double
i_base_mira_addr
[i_base_mira_offset]+8
15
"アイテムを閲覧後に個数を設定 / Browse & set item amount"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_BROWSE_ITEM_N_SET,$process,0F B7 ?? B8 4C 8A 12 00 85 ?? 75 ?? ?? 8B)
// raw AOB: 72 ?? 89 7C 24 20 4C 8D 0D ?? ?? ?? ?? 41 B8 BB 04 00 00 48 8D 15 ?? ?? ?? ?? B9 03 00 00 00 E8 ?? ?? ?? ?? EB ?? 8D 87 CA FE FF FF 83 F8 07 77 ?? 8B C8 48 8B 05 ?? ?? ?? ?? 8B 94 88 28 B6 20 00 EB ?? 48 8B 05 ?? ?? ?? ?? 0F B7 94 B8 4C 8A 12 00 85 D2 75 ?? 48 8B D6 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 85 C9 74 ?? 48 83 C1 08 BA 50 00 00 00 E8 ?? ?? ?? ?? EB ?? B9 50 00 00 00 E8 ?? ?? ?? ?? 48 8B F8
// injection point AOB: 0F B7 ?? B8 4C 8A 12 00 85 ?? 75 ?? ?? 8B ?? E8 ?? ?? ?? ?? 85 ?? 0F 84 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 85 ?? 74 ?? ?? 83 ?? 08 ?? 50 00 00 00 E8 ?? ?? ?? ?? EB ?? ?? 50 00 00 00 E8 ?? ?? ?? ?? ?? 8B
alloc(newmem,$1000,INJECT_BROWSE_ITEM_N_SET)
alloc(INJECT_BROWSE_ITEM_N_SETo, $8)
label(code)
label(return)
INJECT_BROWSE_ITEM_N_SETo:
readmem(INJECT_BROWSE_ITEM_N_SET, $8)
label(iw_min_threshold iw_set_item_cnt_to i_item_addr_offset is_get_all_quartz is_get_all_accessory iw_min_threshold_100 iw_set_item_cnt_to_100)
newmem:
// AOBMaker migration - what AOBMaker changed below
// old injection: movzx edx,word ptr [rax+rbx*4+00116724]
// new injection: movzx edx,word ptr [rax+rdi*4+00128A4C]
// register RBX -> RDI
// 5 changed line(s) carry a '// AOBMaker was: ...' note above them holding the code before the change.
// To get this script without them, untick 'Note the old code' and migrate again.
// To remove them from this copy in Notepad++: open Replace (Ctrl+H), Search Mode to
// 'Regular expression', leave '. matches newline' UNCHECKED, leave 'Replace with'
// empty, then press Replace All. Copy the pattern from the next line, after the slashes:
// ^[ \t]*// AOBMaker was:[^\r\n]*\R?
// Replace All covers the whole file, so with a .CT open it runs over every script
// in the table. Press Ctrl+Z if the line count drops by more than the note count.
// Read the diff before you enable this. AOBMaker proposes, it does not verify.
// AOBMaker migration end
cmp qword ptr [i_item_addr_offset], 0
jne next1
push r15
xor r15, r15
db 41 bf
readmem(INJECT_BROWSE_ITEM_N_SET+4, 4)
mov [i_item_addr_offset], r15
pop r15
next1:
push r15
push r14
mov r14, [i_item_addr_offset]
// AOBMaker was: lea r15, [rax+rbx*4]
lea r15, [rax+rdi*4]
lea r15, [r15+r14]
{
// rbx check
mov r14, 21445A283C8
cmp r15, r14
jne @F
nop
}
@@:
// check fill quartz
cmp dword ptr [is_get_all_quartz], 1 // is force all quartz?
jne next_accessory
mov r14, E74 // quartz start #
// AOBMaker was: cmp rbx, r14
cmp rdi, r14
jb next_accessory
mov r14, 1108 // 128 address (中間有跳數字)
// AOBMaker was: cmp rbx, r14
cmp rdi, r14
ja next_normal_100 // accessory high watermark = 6A5, so ignore all
mov r14w, [iw_set_item_cnt_to]
mov [r15], r14w
jmp endp
next_accessory:
// check fill quartz
cmp dword ptr [is_get_all_accessory], 1 // is force all accessory?
jne next_normal_100
mov r14, 5DC
// AOBMaker was: cmp rbx, r14
cmp rdi, r14
jb next_normal_100
mov r14, 6A5 // 109 address (中間有跳數字)
// AOBMaker was: cmp rbx, r14
cmp rdi, r14
ja next_normal_100
mov r14w, [iw_set_item_cnt_to]
mov [r15], r14w
jmp endp
next_normal_100:
mov r14w, [r15]
cmp r14w, [iw_min_threshold_100]
jb next_normal
cmp r14w, [iw_set_item_cnt_to_100]
jae endp
mov r14w, [iw_set_item_cnt_to_100]
mov [r15], r14w
jmp endp
next_normal:
mov r14w, [r15]
cmp r14w, [iw_min_threshold]
jb endp
cmp r14w, [iw_set_item_cnt_to]
jae endp
mov r14w, [iw_set_item_cnt_to]
mov [r15], r14w
endp:
pop r14
pop r15
code:
// movzx edx,word ptr [rax+rdi*4+00128A4C]
reassemble(INJECT_BROWSE_ITEM_N_SET)
jmp return
align 10 cc
iw_min_threshold:
dw 2
iw_set_item_cnt_to:
dw 46
iw_min_threshold_100:
dw 64
iw_set_item_cnt_to_100:
dw #700
i_item_addr_offset:
dq 0
is_get_all_quartz:
dd 0
is_get_all_accessory:
dd 0
INJECT_BROWSE_ITEM_N_SET:
jmp newmem
nop 3
return:
registersymbol(INJECT_BROWSE_ITEM_N_SET INJECT_BROWSE_ITEM_N_SETo)
registersymbol(iw_min_threshold iw_set_item_cnt_to i_item_addr_offset is_get_all_quartz is_get_all_accessory iw_min_threshold_100 iw_set_item_cnt_to_100)
[DISABLE]
INJECT_BROWSE_ITEM_N_SET:
readmem(INJECT_BROWSE_ITEM_N_SETo, $8)
unregistersymbol(INJECT_BROWSE_ITEM_N_SET INJECT_BROWSE_ITEM_N_SETo)
dealloc(newmem)
dealloc(INJECT_BROWSE_ITEM_N_SETo)
//db 0F B7 94 98 24 67 11 00
unregistersymbol(iw_min_threshold iw_set_item_cnt_to i_item_addr_offset is_get_all_quartz is_get_all_accessory iw_min_threshold_100 iw_set_item_cnt_to_100)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+155000
sora_2nd.exe+154FB6: 72 24 - jb sora_2nd.exe+154FDC
sora_2nd.exe+154FB8: 89 7C 24 20 - mov [rsp+20],edi
sora_2nd.exe+154FBC: 4C 8D 0D 0D 99 9B 00 - lea r9,[sora_2nd.exe+B0E8D0]
sora_2nd.exe+154FC3: 41 B8 BB 04 00 00 - mov r8d,000004BB
sora_2nd.exe+154FC9: 48 8D 15 18 98 9B 00 - lea rdx,[sora_2nd.exe+B0E7E8]
sora_2nd.exe+154FD0: B9 03 00 00 00 - mov ecx,00000003
sora_2nd.exe+154FD5: E8 C6 54 42 00 - call sora_2nd.exe+57A4A0
sora_2nd.exe+154FDA: EB 30 - jmp sora_2nd.exe+15500C
sora_2nd.exe+154FDC: 8D 87 CA FE FF FF - lea eax,[rdi-00000136]
sora_2nd.exe+154FE2: 83 F8 07 - cmp eax,07
sora_2nd.exe+154FE5: 77 12 - ja sora_2nd.exe+154FF9
sora_2nd.exe+154FE7: 8B C8 - mov ecx,eax
sora_2nd.exe+154FE9: 48 8B 05 78 A1 B0 00 - mov rax,[sora_2nd.exe+C5F168]
sora_2nd.exe+154FF0: 8B 94 88 28 B6 20 00 - mov edx,[rax+rcx*4+0020B628]
sora_2nd.exe+154FF7: EB 0F - jmp sora_2nd.exe+155008
sora_2nd.exe+154FF9: 48 8B 05 68 A1 B0 00 - mov rax,[sora_2nd.exe+C5F168]
// ---------- INJECTING HERE ----------
sora_2nd.exe+155000: 0F B7 94 B8 4C 8A 12 00 - movzx edx,word ptr [rax+rdi*4+00128A4C]
// ---------- DONE INJECTING ----------
sora_2nd.exe+155008: 85 D2 - test edx,edx
sora_2nd.exe+15500A: 75 10 - jne sora_2nd.exe+15501C
sora_2nd.exe+15500C: 48 8B D6 - mov rdx,rsi
sora_2nd.exe+15500F: E8 0C F3 1E 00 - call sora_2nd.exe+344320
sora_2nd.exe+155014: 85 C0 - test eax,eax
sora_2nd.exe+155016: 0F 84 39 01 00 00 - je sora_2nd.exe+155155
sora_2nd.exe+15501C: 48 8B 0D 6D A1 B0 00 - mov rcx,[sora_2nd.exe+C5F190]
sora_2nd.exe+155023: 48 85 C9 - test rcx,rcx
sora_2nd.exe+155026: 74 10 - je sora_2nd.exe+155038
sora_2nd.exe+155028: 48 83 C1 08 - add rcx,08
sora_2nd.exe+15502C: BA 50 00 00 00 - mov edx,00000050
sora_2nd.exe+155031: E8 9A 32 47 00 - call sora_2nd.exe+5C82D0
sora_2nd.exe+155036: EB 0A - jmp sora_2nd.exe+155042
sora_2nd.exe+155038: B9 50 00 00 00 - mov ecx,00000050
sora_2nd.exe+15503D: E8 12 B2 72 00 - call sora_2nd.exe+880254
sora_2nd.exe+155042: 48 8B F8 - mov rdi,rax
}
16
"所持アイテム数が ≧"
0
C08000
2 Bytes
iw_min_threshold
17
"Avail. item amount must >="
0
C08000
2 Bytes
iw_min_threshold
18
"設定個数："
0
C08000
2 Bytes
iw_set_item_cnt_to
19
"Set amount to"
0
C08000
2 Bytes
iw_set_item_cnt_to
20
"条件：数量 ≧"
0
C08000
2 Bytes
iw_min_threshold_100
21
"設定数："
0
C08000
2 Bytes
iw_set_item_cnt_to_100
22
"if item amount >="
0
C08000
2 Bytes
iw_min_threshold_100
23
"then set to:"
0
C08000
2 Bytes
iw_set_item_cnt_to_100
24
"クオーツ個数強制設定? / Force quartz?"
0:No
1:Yes
0
C08000
4 Bytes
is_get_all_quartz
25
"アクセサリ個数強制設定? / force all accessories?"
0:No
1:Yes
0
C08000
4 Bytes
is_get_all_accessory
26
"戦闘：ダメージ制御 / Battle: damage control"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_DAMAGE_CTRL,$process,89 ?? 0C ?? 8B ?? 24 ?? 48 83 C4 20 ?? ?? C3 8B ?? 0C)
// raw AOB: 41 5E C3 8B 46 10 89 46 0C 8B 46 18 89 46 14 48 8B 74 24 38 48 83 C4 20 41 5E C3 8B 46 10 44 3B F0 41 0F 4C C6 33 C9 85 C0 0F 48 C1 89 46 0C 48 8B 74 24 38 48 83 C4 20 41 5E C3 8B 4E 0C 8B 56 10 41 03 CE 3B CA 0F 4C D1 33 C9 85 D2 0F 48 D1 89 56 0C 48 8B 74 24 38 48 83 C4 20 41 5E C3
// injection point AOB: 89 ?? 0C ?? 8B ?? 24 ?? 48 83 C4 20 ?? ?? C3 8B ?? 0C 8B ?? 10 ?? 03 ?? 3B ?? 0F 4C ?? 33 ?? 85 ?? 0F 48 ?? 89 ?? 0C ?? 8B ?? 24 ?? 48 83 C4 20 ?? ?? C3
alloc(newmem,$1000,INJECT_BATTLE_DAMAGE_CTRL)
alloc(INJECT_BATTLE_DAMAGE_CTRLo, $8)
label(code)
label(return)
INJECT_BATTLE_DAMAGE_CTRLo:
readmem(INJECT_BATTLE_DAMAGE_CTRL, $8)
label(i_play_char_id vf_min_player_hp_ratio is_enemy_HP_option is_full_EP is_full_CP i_enemy_HP_limit vf_damage_multi vf_enemy_hp_ratio)
newmem:
//push r15
//mov r15d, [i_play_char_id]
//cmp [rsi], r15d
//pop r15
//ja to_enemy
cmp dword ptr [rsi+44], 0 // RNG
je to_enemy
cmp dword ptr [rsi+78], 0 // STUN
jne to_enemy
to_player:
push r15
cmp dword ptr [is_full_EP], 1
jne @F
mov r15d, [rsi+18]
mov [rsi+14], r15d
@@:
cmp dword ptr [is_full_CP], 1
jne @F
mov r15d, [rsi+20]
mov [rsi+1C], r15d
@@:
// HP calc
mov r15d, [rsi+10]
vcvtsi2ss xmm15, xmm15, r15d
vmovss xmm14, [vf_min_player_hp_ratio]
vmulss xmm13, xmm14, xmm15
vcvtss2si r15d, xmm13
cmp eax, r15d
cmovb eax, r15d
pop r15
jmp code
to_enemy:
cmp dword ptr [is_enemy_HP_option], 0
je code
cmp dword ptr [is_enemy_HP_option], 1
je to_1HP
cmp dword ptr [is_enemy_HP_option], 2
je to_1HK
cmp dword ptr [is_enemy_HP_option], 3
je to_set_limit
cmp dword ptr [is_enemy_HP_option], 4
je to_damage_multi
cmp dword ptr [is_enemy_HP_option], 5
je to_1000_hp
cmp dword ptr [is_enemy_HP_option], 6
je to_ratio_hp
jmp code
to_1HK:
mov eax, 0
jmp code
to_1HP:
cmp eax, 1
jbe code
mov eax, 1
jmp code
to_set_limit:
cmp eax, [i_enemy_HP_limit]
jbe code
mov eax, [i_enemy_HP_limit]
jmp code
to_damage_multi:
cmp r14d, 0
jge code
cmp [rsi+0C], eax
jle code
push rcx
push rdx
mov ecx, [rsi+0C]
vcvtsi2ss xmm15, xmm15, ecx
vcvtsi2ss xmm14, xmm14, eax
vsubss xmm15, xmm14, xmm15
vcvtss2si r14d, xmm15
vcvtsi2ss xmm15, xmm15, r14d
vmovss xmm14, [vf_damage_multi]
vmulss xmm15, xmm14, xmm15
vcvtss2si r14d, xmm15
mov ecx,[rsi+0C]
mov edx,[rsi+10]
add ecx,r14d
cmp ecx,edx
cmovl edx,ecx
test edx,edx
cmovs edx,ecx
mov eax,edx
pop rdx
pop rcx
jmp code
to_1000_hp:
cmp eax, #800
jbe code
mov eax, #800
jmp code
to_ratio_hp:
mov r14d, [rsi+10]
vmovss xmm14, [vf_enemy_hp_ratio]
vcvtsi2ss xmm15, xmm15, r14d
vmulss xmm14, xmm14, xmm15
vcvtsi2ss xmm15, xmm15, eax
vucomiss xmm14, xmm15
jae code
vcvtss2si eax, xmm14
code:
// mov [rsi+0C],eax
reassemble(INJECT_BATTLE_DAMAGE_CTRL)
// mov rsi,[rsp+38]
reassemble(INJECT_BATTLE_DAMAGE_CTRL+3)
jmp return
align 10 cc
i_play_char_id:
dd 7 0
vf_min_player_hp_ratio:
dd (float)0.25 0
is_enemy_HP_option:
dd 6 0
i_enemy_HP_limit:
dd #40000 0
is_full_EP:
dd 1 0
is_full_CP:
dd 1 0
vf_damage_multi:
dd (float)3.3333333 0
vf_enemy_hp_ratio:
dd (float)0.75 0
INJECT_BATTLE_DAMAGE_CTRL:
jmp newmem
nop 3
return:
registersymbol(i_play_char_id vf_min_player_hp_ratio is_enemy_HP_option is_full_EP is_full_CP i_enemy_HP_limit vf_damage_multi vf_enemy_hp_ratio)
registersymbol(INJECT_BATTLE_DAMAGE_CTRL INJECT_BATTLE_DAMAGE_CTRLo)
[DISABLE]
INJECT_BATTLE_DAMAGE_CTRL:
readmem(INJECT_BATTLE_DAMAGE_CTRLo, $8)
unregistersymbol(i_play_char_id vf_min_player_hp_ratio is_enemy_HP_option is_full_EP is_full_CP i_enemy_HP_limit vf_damage_multi vf_enemy_hp_ratio)
unregistersymbol(INJECT_BATTLE_DAMAGE_CTRL INJECT_BATTLE_DAMAGE_CTRLo)
dealloc(newmem)
dealloc(INJECT_BATTLE_DAMAGE_CTRLo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+F8A64
sora_2nd.exe+F8A38: 41 5E - pop r14
sora_2nd.exe+F8A3A: C3 - ret
sora_2nd.exe+F8A3B: 8B 46 10 - mov eax,[rsi+10]
sora_2nd.exe+F8A3E: 89 46 0C - mov [rsi+0C],eax
sora_2nd.exe+F8A41: 8B 46 18 - mov eax,[rsi+18]
sora_2nd.exe+F8A44: 89 46 14 - mov [rsi+14],eax
sora_2nd.exe+F8A47: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_2nd.exe+F8A4C: 48 83 C4 20 - add rsp,20
sora_2nd.exe+F8A50: 41 5E - pop r14
sora_2nd.exe+F8A52: C3 - ret
sora_2nd.exe+F8A53: 8B 46 10 - mov eax,[rsi+10]
sora_2nd.exe+F8A56: 44 3B F0 - cmp r14d,eax
sora_2nd.exe+F8A59: 41 0F 4C C6 - cmovl eax,r14d
sora_2nd.exe+F8A5D: 33 C9 - xor ecx,ecx
sora_2nd.exe+F8A5F: 85 C0 - test eax,eax
sora_2nd.exe+F8A61: 0F 48 C1 - cmovs eax,ecx
// ---------- INJECTING HERE ----------
sora_2nd.exe+F8A64: 89 46 0C - mov [rsi+0C],eax
// ---------- DONE INJECTING ----------
sora_2nd.exe+F8A67: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_2nd.exe+F8A6C: 48 83 C4 20 - add rsp,20
sora_2nd.exe+F8A70: 41 5E - pop r14
sora_2nd.exe+F8A72: C3 - ret
sora_2nd.exe+F8A73: 8B 4E 0C - mov ecx,[rsi+0C]
sora_2nd.exe+F8A76: 8B 56 10 - mov edx,[rsi+10]
sora_2nd.exe+F8A79: 41 03 CE - add ecx,r14d
sora_2nd.exe+F8A7C: 3B CA - cmp ecx,edx
sora_2nd.exe+F8A7E: 0F 4C D1 - cmovl edx,ecx
sora_2nd.exe+F8A81: 33 C9 - xor ecx,ecx
sora_2nd.exe+F8A83: 85 D2 - test edx,edx
sora_2nd.exe+F8A85: 0F 48 D1 - cmovs edx,ecx
sora_2nd.exe+F8A88: 89 56 0C - mov [rsi+0C],edx
sora_2nd.exe+F8A8B: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_2nd.exe+F8A90: 48 83 C4 20 - add rsp,20
sora_2nd.exe+F8A94: 41 5E - pop r14
}
{
sora_1st:
// ORIGINAL CODE - INJECTION POINT: sora_1st.exe+DBB80
sora_1st.exe+DBB68: 41 5E - pop r14
sora_1st.exe+DBB6A: C3 - ret
sora_1st.exe+DBB6B: 8B 4E 0C - mov ecx,[rsi+0C]
sora_1st.exe+DBB6E: 8B 56 10 - mov edx,[rsi+10]
sora_1st.exe+DBB71: 41 03 CE - add ecx,r14d
sora_1st.exe+DBB74: 3B CA - cmp ecx,edx
sora_1st.exe+DBB76: 0F 4C D1 - cmovl edx,ecx
sora_1st.exe+DBB79: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB7B: 85 D2 - test edx,edx
sora_1st.exe+DBB7D: 0F 48 D1 - cmovs edx,ecx
// ---------- INJECTING HERE ----------
sora_1st.exe+DBB80: 89 56 0C - mov [rsi+0C],edx
// ---------- DONE INJECTING ----------
sora_1st.exe+DBB83: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_1st.exe+DBB88: 48 83 C4 20 - add rsp,20
sora_1st.exe+DBB8C: 41 5E - pop r14
sora_1st.exe+DBB8E: C3 - ret
sora_1st.exe+DBB8F: 8B 46 18 - mov eax,[rsi+18]
sora_1st.exe+DBB92: 44 3B F0 - cmp r14d,eax
sora_1st.exe+DBB95: 41 0F 4C C6 - cmovl eax,r14d
sora_1st.exe+DBB99: 33 C9 - xor ecx,ecx
sora_1st.exe+DBB9B: 85 C0 - test eax,eax
sora_1st.exe+DBB9D: 0F 48 C1 - cmovs eax,ecx
}
27
"基本設定 / Global setting"
1
28
"味方最小HP維持率（%）"
0
C08000
Float
vf_min_player_hp_ratio
29
"Min player HP ratio after hit"
0
C08000
Float
vf_min_player_hp_ratio
30
"被ダメージ時EP回復?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_EP
31
"Full EP after get hit?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_EP
32
"被ダメージ時CP回復?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_CP
33
"Full CP after get hit?"
0:No
1:Yes
0
C08000
4 Bytes
is_full_CP
34
"敵HPオプション / Enemy HP option"
0:なし / None
1:HPを1にする / HP 1
2:一撃必殺 / 1 hit kill
3:最大値を下記に設定 / set limit as below
4:下記のダメージ倍率を適用 / damage multiplier as below
5:被弾後HP 800固定 / hit to HP 800
6:指定HP割合 / HP ratio
0
C08000
4 Bytes
is_enemy_HP_option
35
"※警告：味方NPCに影響を与える可能性があります"
8000FF
1
36
"※味方NPCが一撃で倒される可能性があります"
8000FF
1
37
"Warning: may affect friendly NPCs"
8000FF
1
38
"friendly NPC may be killed when battle start"
8000FF
1
39
"3. 敵HP上限"
0
C08000
4 Bytes
i_enemy_HP_limit
40
"4. 与ダメージ倍率"
0
C08000
Float
vf_damage_multi
41
"6. 一撃後HP割合（%）"
0
C08000
Float
vf_enemy_hp_ratio
42
"3. Enemy HP limit:"
0
C08000
4 Bytes
i_enemy_HP_limit
43
"4. damage multiplier"
0
C08000
Float
vf_damage_multi
44
"6. Max HP ratio after hit"
0
C08000
Float
vf_enemy_hp_ratio
45
"戦闘：プレイヤー致死回避 / Battle: player HP: try to keep non-zero"
Auto Assembler Script
{ Game :
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_HP_NO_0,sora_2nd.exe,03 D0 41 39 50 0C 7F ?? 48 8D 15 ?? ?? ?? ?? 48 8B CB) // should be unique
alloc(newmem,$1000,INJECT_HP_NO_0)
label(code)
label(return)
newmem:
code:
add edx,eax
cmp [r8+0C],edx
jg endp
pushfq
cmp edx, 0
jl next1
mov [r8+0C], edx
inc dword ptr [r8+0C]
jmp end_inner
next1:
push r15
mov r15d, [r8+10]
vcvtsi2ss xmm15, xmm15, r15d
vmovss xmm14, [vf_min_player_hp_ratio]
vmulss xmm14, xmm14, xmm15
vcvtss2si r15d, xmm14
mov [r8+0C], r15d
pop r15
end_inner:
popfq
cmp [r8+0C], edx
endp:
jmp return
align 10 cc
INJECT_HP_NO_0:
jmp newmem
nop
return:
registersymbol(INJECT_HP_NO_0)
[DISABLE]
INJECT_HP_NO_0:
db 03 D0 41 39 50 0C
unregistersymbol(INJECT_HP_NO_0)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+1CF283
sora_2nd.exe+1CF265: 74 44 - je sora_2nd.exe+1CF2AB
sora_2nd.exe+1CF267: 4D 8B 00 - mov r8,[r8]
sora_2nd.exe+1CF26A: 41 8B 40 10 - mov eax,[r8+10]
sora_2nd.exe+1CF26E: 8D 0C 80 - lea ecx,[rax+rax*4]
sora_2nd.exe+1CF271: B8 1F 85 EB 51 - mov eax,51EB851F
sora_2nd.exe+1CF276: C1 E1 02 - shl ecx,02
sora_2nd.exe+1CF279: F7 E9 - imul ecx
sora_2nd.exe+1CF27B: C1 FA 05 - sar edx,05
sora_2nd.exe+1CF27E: 8B C2 - mov eax,edx
sora_2nd.exe+1CF280: C1 E8 1F - shr eax,1F
// ---------- INJECTING HERE ----------
sora_2nd.exe+1CF283: 03 D0 - add edx,eax
// ---------- DONE INJECTING ----------
sora_2nd.exe+1CF285: 41 39 50 0C - cmp [r8+0C],edx
sora_2nd.exe+1CF289: 7F 20 - jg sora_2nd.exe+1CF2AB
sora_2nd.exe+1CF28B: 48 8D 15 26 C8 60 00 - lea rdx,[sora_2nd.exe+7DBAB8]
sora_2nd.exe+1CF292: 48 8B CB - mov rcx,rbx
sora_2nd.exe+1CF295: E8 B6 90 FF FF - call sora_2nd.exe+1C8350
sora_2nd.exe+1CF29A: 84 C0 - test al,al
sora_2nd.exe+1CF29C: 74 0D - je sora_2nd.exe+1CF2AB
sora_2nd.exe+1CF29E: 89 7C 24 28 - mov [rsp+28],edi
sora_2nd.exe+1CF2A2: 4C 8D 05 0F C8 60 00 - lea r8,[sora_2nd.exe+7DBAB8]
sora_2nd.exe+1CF2A9: EB 0D - jmp sora_2nd.exe+1CF2B8
}
46
"戦闘：EP消費後に全回復 / Battle: full EP after use"
Auto Assembler Script
{ Game :
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_EP,sora_2nd.exe,8B 4E 14 8B 56 18) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_EP)
label(code)
label(return)
newmem:
cmp dword ptr [rsi+44], 0 // RNG
je code
cmp dword ptr [rsi+78], 0 // RNG
jne code
mov edx, [rsi+18]
mov [rsi+14], edx
xor r14d, r14d
code:
mov ecx,[rsi+14]
mov edx,[rsi+18]
jmp return
INJECT_BATTLE_INF_EP:
jmp newmem
nop
return:
registersymbol(INJECT_BATTLE_INF_EP)
[DISABLE]
INJECT_BATTLE_INF_EP:
db 8B 4E 14 8B 56 18
unregistersymbol(INJECT_BATTLE_INF_EP)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+DBBAF
sora_2nd.exe+DBB92: 44 3B F0 - cmp r14d,eax
sora_2nd.exe+DBB95: 41 0F 4C C6 - cmovl eax,r14d
sora_2nd.exe+DBB99: 33 C9 - xor ecx,ecx
sora_2nd.exe+DBB9B: 85 C0 - test eax,eax
sora_2nd.exe+DBB9D: 0F 48 C1 - cmovs eax,ecx
sora_2nd.exe+DBBA0: 89 46 14 - mov [rsi+14],eax
sora_2nd.exe+DBBA3: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_2nd.exe+DBBA8: 48 83 C4 20 - add rsp,20
sora_2nd.exe+DBBAC: 41 5E - pop r14
sora_2nd.exe+DBBAE: C3 - ret
// ---------- INJECTING HERE ----------
sora_2nd.exe+DBBAF: 8B 4E 14 - mov ecx,[rsi+14]
// ---------- DONE INJECTING ----------
sora_2nd.exe+DBBB2: 8B 56 18 - mov edx,[rsi+18]
sora_2nd.exe+DBBB5: 41 03 CE - add ecx,r14d
sora_2nd.exe+DBBB8: 3B CA - cmp ecx,edx
sora_2nd.exe+DBBBA: 0F 4C D1 - cmovl edx,ecx
sora_2nd.exe+DBBBD: 33 C9 - xor ecx,ecx
sora_2nd.exe+DBBBF: 85 D2 - test edx,edx
sora_2nd.exe+DBBC1: 0F 48 D1 - cmovs edx,ecx
sora_2nd.exe+DBBC4: 89 56 14 - mov [rsi+14],edx
sora_2nd.exe+DBBC7: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_2nd.exe+DBBCC: 48 83 C4 20 - add rsp,20
}
47
"戦闘：CP消費後に全回復 / Battle: full CP after use"
Auto Assembler Script
{ Game :
Version:
Date : 2025-09-19
Author : bbfox@https://openchetatables.com
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_CP,sora_2nd.exe,8B 4E 1C 8B 56 20) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_CP)
label(code)
label(return)
newmem:
cmp dword ptr [rsi+44], 0 // RNG
je code
cmp dword ptr [rsi+78], 0
jne code
mov edx, [rsi+20]
mov [rsi+1C], edx
xor r14d, r14d
code:
mov ecx,[rsi+1C]
mov edx,[rsi+20]
jmp return
INJECT_BATTLE_INF_CP:
jmp newmem
nop
return:
registersymbol(INJECT_BATTLE_INF_CP)
[DISABLE]
INJECT_BATTLE_INF_CP:
db 8B 4E 1C 8B 56 20
unregistersymbol(INJECT_BATTLE_INF_CP)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+DBBF3
sora_2nd.exe+DBBD6: 44 3B F0 - cmp r14d,eax
sora_2nd.exe+DBBD9: 41 0F 4C C6 - cmovl eax,r14d
sora_2nd.exe+DBBDD: 33 C9 - xor ecx,ecx
sora_2nd.exe+DBBDF: 85 C0 - test eax,eax
sora_2nd.exe+DBBE1: 0F 48 C1 - cmovs eax,ecx
sora_2nd.exe+DBBE4: 89 46 1C - mov [rsi+1C],eax
sora_2nd.exe+DBBE7: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_2nd.exe+DBBEC: 48 83 C4 20 - add rsp,20
sora_2nd.exe+DBBF0: 41 5E - pop r14
sora_2nd.exe+DBBF2: C3 - ret
// ---------- INJECTING HERE ----------
sora_2nd.exe+DBBF3: 8B 4E 1C - mov ecx,[rsi+1C]
// ---------- DONE INJECTING ----------
sora_2nd.exe+DBBF6: 8B 56 20 - mov edx,[rsi+20]
sora_2nd.exe+DBBF9: 41 03 CE - add ecx,r14d
sora_2nd.exe+DBBFC: 3B CA - cmp ecx,edx
sora_2nd.exe+DBBFE: 0F 4C D1 - cmovl edx,ecx
sora_2nd.exe+DBC01: 33 C9 - xor ecx,ecx
sora_2nd.exe+DBC03: 85 D2 - test edx,edx
sora_2nd.exe+DBC05: 0F 48 D1 - cmovs edx,ecx
sora_2nd.exe+DBC08: 89 56 1C - mov [rsi+1C],edx
sora_2nd.exe+DBC0B: 48 8B 74 24 38 - mov rsi,[rsp+38]
sora_2nd.exe+DBC10: 48 83 C4 20 - add rsp,20
}
48
"戦闘：気絶付与倍率 / Battle: Stun multiplier"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_STUN_MULTI,$process,F3 0F 58 ?? F3 0F 5D ?? F3 0F 5F ?? ?? 84)
// raw AOB: 48 8B 07 F3 0F 10 40 78 F3 0F 5C 40 74 F3 0F 5C C4 F3 0F 5D F8 48 8B 07 48 8D 4C 24 20 45 84 F6 F3 44 0F 11 44 24 20 49 0F 44 CF F3 0F 10 58 78 44 0F 2F C3 73 ?? F3 0F 10 50 74 0F 57 C9 0F 28 C2 F3 0F 58 C7 F3 0F 5D C3 F3 0F 5F C8 40 84 F6 74 ?? 0F 2F CB 72 ?? 0F 28 CB F3 0F 5C CC 48 85 C9 74 ?? F3 0F 5C CA F3 0F 11 09 F3 44 0F 10 44 24 20 EB ?? 44 0F 2F C7 F3 0F 11 48 74 0F 28 D1
// injection point AOB: F3 0F 58 ?? F3 0F 5D ?? F3 0F 5F ?? ?? 84 ?? 74 ?? 0F 2F ?? 72 ?? 0F 28 ?? F3 0F 5C ?? ?? 85 ?? 74 ?? F3 0F 5C ?? F3 0F 11 ?? F3 ?? 0F 10 ?? ?? ?? EB ?? ?? 0F 2F ?? F3 0F 11 ?? 74 0F 28
alloc(newmem,$1000,INJECT_STUN_MULTI)
alloc(INJECT_STUN_MULTIo, $8)
label(code)
label(return)
INJECT_STUN_MULTIo:
readmem(INJECT_STUN_MULTI, $8)
label(vf_stun_multi i_base_stn_addr)
newmem:
// check if enemy
cmp dword ptr [rax+44], 0 // RNG
jne code
cmp dword ptr [rax+78], 0 // max stun value
je code
mov [i_base_stn_addr], rax
mulss xmm7, dword ptr [vf_stun_multi]
code:
// addss xmm0,xmm7
reassemble(INJECT_STUN_MULTI)
// minss xmm0,xmm3
reassemble(INJECT_STUN_MULTI+4)
jmp return
align 10 cc
i_base_stn_addr:
dq 0
vf_stun_multi:
dd (float)6.66666
INJECT_STUN_MULTI:
jmp newmem
nop 3
return:
registersymbol(INJECT_STUN_MULTI INJECT_STUN_MULTIo)
registersymbol(vf_stun_multi i_base_stn_addr)
[DISABLE]
INJECT_STUN_MULTI:
readmem(INJECT_STUN_MULTIo, $8)
unregistersymbol(INJECT_STUN_MULTI INJECT_STUN_MULTIo)
unregistersymbol(vf_stun_multi i_base_stn_addr)
dealloc(newmem)
dealloc(INJECT_STUN_MULTIo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+E1EAB
sora_2nd.exe+E1E6A: 48 8B 07 - mov rax,[rdi]
sora_2nd.exe+E1E6D: F3 0F 10 40 78 - movss xmm0,[rax+78]
sora_2nd.exe+E1E72: F3 0F 5C 40 74 - subss xmm0,[rax+74]
sora_2nd.exe+E1E77: F3 0F 5C C4 - subss xmm0,xmm4
sora_2nd.exe+E1E7B: F3 0F 5D F8 - minss xmm7,xmm0
sora_2nd.exe+E1E7F: 48 8B 07 - mov rax,[rdi]
sora_2nd.exe+E1E82: 48 8D 4C 24 20 - lea rcx,[rsp+20]
sora_2nd.exe+E1E87: 45 84 F6 - test r14b,r14b
sora_2nd.exe+E1E8A: F3 44 0F 11 44 24 20 - movss [rsp+20],xmm8
sora_2nd.exe+E1E91: 49 0F 44 CF - cmove rcx,r15
sora_2nd.exe+E1E95: F3 0F 10 58 78 - movss xmm3,[rax+78]
sora_2nd.exe+E1E9A: 44 0F 2F C3 - comiss xmm8,xmm3
sora_2nd.exe+E1E9E: 73 79 - jae sora_2nd.exe+E1F19
sora_2nd.exe+E1EA0: F3 0F 10 50 74 - movss xmm2,[rax+74]
sora_2nd.exe+E1EA5: 0F 57 C9 - xorps xmm1,xmm1
sora_2nd.exe+E1EA8: 0F 28 C2 - movaps xmm0,xmm2
// ---------- INJECTING HERE ----------
sora_2nd.exe+E1EAB: F3 0F 58 C7 - addss xmm0,xmm7
// ---------- DONE INJECTING ----------
sora_2nd.exe+E1EAF: F3 0F 5D C3 - minss xmm0,xmm3
sora_2nd.exe+E1EB3: F3 0F 5F C8 - maxss xmm1,xmm0
sora_2nd.exe+E1EB7: 40 84 F6 - test sil,sil
sora_2nd.exe+E1EBA: 74 0C - je sora_2nd.exe+E1EC8
sora_2nd.exe+E1EBC: 0F 2F CB - comiss xmm1,xmm3
sora_2nd.exe+E1EBF: 72 07 - jb sora_2nd.exe+E1EC8
sora_2nd.exe+E1EC1: 0F 28 CB - movaps xmm1,xmm3
sora_2nd.exe+E1EC4: F3 0F 5C CC - subss xmm1,xmm4
sora_2nd.exe+E1EC8: 48 85 C9 - test rcx,rcx
sora_2nd.exe+E1ECB: 74 11 - je sora_2nd.exe+E1EDE
sora_2nd.exe+E1ECD: F3 0F 5C CA - subss xmm1,xmm2
sora_2nd.exe+E1ED1: F3 0F 11 09 - movss [rcx],xmm1
sora_2nd.exe+E1ED5: F3 44 0F 10 44 24 20 - movss xmm8,[rsp+20]
sora_2nd.exe+E1EDC: EB 1F - jmp sora_2nd.exe+E1EFD
sora_2nd.exe+E1EDE: 44 0F 2F C7 - comiss xmm8,xmm7
sora_2nd.exe+E1EE2: F3 0F 11 48 74 - movss [rax+74],xmm1
}
{
sora_1st:
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+C8B27
sora_2nd.exe+C8AFE: 40 84 F6 - test sil,sil
sora_2nd.exe+C8B01: F3 44 0F 11 4C 24 20 - movss [rsp+20],xmm9
sora_2nd.exe+C8B08: 49 0F 44 C7 - cmove rax,r15
sora_2nd.exe+C8B0C: 4C 8B 7C 24 70 - mov r15,[rsp+70]
sora_2nd.exe+C8B11: F3 0F 10 51 78 - movss xmm2,[rcx+78]
sora_2nd.exe+C8B16: 44 0F 2F CA - comiss xmm9,xmm2
sora_2nd.exe+C8B1A: 73 5A - jae sora_2nd.exe+C8B76
sora_2nd.exe+C8B1C: F3 0F 10 59 74 - movss xmm3,[rcx+74]
sora_2nd.exe+C8B21: 0F 28 CA - movaps xmm1,xmm2
sora_2nd.exe+C8B24: 0F 28 C3 - movaps xmm0,xmm3
// ---------- INJECTING HERE ----------
sora_2nd.exe+C8B27: F3 41 0F 58 C0 - addss xmm0,xmm8
// ---------- DONE INJECTING ----------
sora_2nd.exe+C8B2C: F3 0F 5D C8 - minss xmm1,xmm0
sora_2nd.exe+C8B30: 40 84 ED - test bpl,bpl
sora_2nd.exe+C8B33: 74 0C - je sora_2nd.exe+C8B41
sora_2nd.exe+C8B35: 0F 2F CA - comiss xmm1,xmm2
sora_2nd.exe+C8B38: 72 07 - jb sora_2nd.exe+C8B41
sora_2nd.exe+C8B3A: 0F 28 CA - movaps xmm1,xmm2
sora_2nd.exe+C8B3D: F3 0F 5C CC - subss xmm1,xmm4
sora_2nd.exe+C8B41: 48 85 C0 - test rax,rax
sora_2nd.exe+C8B44: 74 11 - je sora_2nd.exe+C8B57
sora_2nd.exe+C8B46: F3 0F 5C CB - subss xmm1,xmm3
}
49
"multiplier"
0
C08000
Float
vf_stun_multi
268
"stun"
0
FF8080
Float
i_base_stn_addr
74
269
"Stun target"
0
FF8080
Float
i_base_stn_addr
78
50
"アイテム無限 / inf item use"
Auto Assembler Script
{ Game : sora_2nd.exe
Version:
Date : 2026/08/20
Author : bbfox@https://opencheattables.scom
}
[ENABLE]
aobscanmodule(INJECT_BATTLE_INF_ITEM,sora_2nd.exe,2B CD C7 44 24 20 FF FF 00 00) // should be unique
alloc(newmem,$1000,INJECT_BATTLE_INF_ITEM)
label(code)
label(return)
newmem:
cmp ebp, 0
jl code
xor ebp, ebp
code:
sub ecx,ebp
mov [rsp+20],0000FFFF
jmp return
INJECT_BATTLE_INF_ITEM:
jmp newmem
nop 5
return:
registersymbol(INJECT_BATTLE_INF_ITEM)
[DISABLE]
INJECT_BATTLE_INF_ITEM:
db 2B CD C7 44 24 20 FF FF 00 00
unregistersymbol(INJECT_BATTLE_INF_ITEM)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+43BEAF
sora_2nd.exe+43BE6C: 8B C7 - mov eax,edi
sora_2nd.exe+43BE6E: 8B 8E 40 B6 20 00 - mov ecx,[rsi+0020B640]
sora_2nd.exe+43BE74: 2B CD - sub ecx,ebp
sora_2nd.exe+43BE76: 85 C9 - test ecx,ecx
sora_2nd.exe+43BE78: 0F 4F C1 - cmovg eax,ecx
sora_2nd.exe+43BE7B: 89 86 40 B6 20 00 - mov [rsi+0020B640],eax
sora_2nd.exe+43BE81: 8B 86 44 B6 20 00 - mov eax,[rsi+0020B644]
sora_2nd.exe+43BE87: 2B C5 - sub eax,ebp
sora_2nd.exe+43BE89: 85 C0 - test eax,eax
sora_2nd.exe+43BE8B: 0F 4F F8 - cmovg edi,eax
sora_2nd.exe+43BE8E: 89 BE 44 B6 20 00 - mov [rsi+0020B644],edi
sora_2nd.exe+43BE94: E9 02 01 00 00 - jmp sora_2nd.exe+43BF9B
sora_2nd.exe+43BE99: 48 8D 14 9E - lea rdx,[rsi+rbx*4]
sora_2nd.exe+43BE9D: 89 7C 24 48 - mov [rsp+48],edi
sora_2nd.exe+43BEA1: 0F B7 8A 4C 8A 12 00 - movzx ecx,word ptr [rdx+00128A4C]
sora_2nd.exe+43BEA8: 48 8D 35 81 2A 6D 00 - lea rsi,[sora_2nd.exe+B0E930]
// ---------- INJECTING HERE ----------
sora_2nd.exe+43BEAF: 2B CD - sub ecx,ebp
// ---------- DONE INJECTING ----------
sora_2nd.exe+43BEB1: C7 44 24 20 FF FF 00 00 - mov [rsp+20],0000FFFF
sora_2nd.exe+43BEB9: 85 C9 - test ecx,ecx
sora_2nd.exe+43BEBB: 4C 8D 4C 24 48 - lea r9,[rsp+48]
sora_2nd.exe+43BEC0: 66 0F 4F C1 - cmovg ax,cx
sora_2nd.exe+43BEC4: 48 8B 0D A5 32 82 00 - mov rcx,[sora_2nd.exe+C5F170]
sora_2nd.exe+43BECB: 66 89 82 4C 8A 12 00 - mov [rdx+00128A4C],ax
sora_2nd.exe+43BED2: 81 E3 FF FF FF 3F - and ebx,3FFFFFFF
sora_2nd.exe+43BED8: 0F BA EB 1E - bts ebx,1E
sora_2nd.exe+43BEDC: 45 33 C0 - xor r8d,r8d
sora_2nd.exe+43BEDF: 48 8B D6 - mov rdx,rsi
sora_2nd.exe+43BEE2: 89 5C 24 40 - mov [rsp+40],ebx
sora_2nd.exe+43BEE6: E8 95 EC 08 00 - call sora_2nd.exe+4CAB80
sora_2nd.exe+43BEEB: 48 8B D8 - mov rbx,rax
sora_2nd.exe+43BEEE: 48 85 C0 - test rax,rax
sora_2nd.exe+43BEF1: 0F 84 81 00 00 00 - je sora_2nd.exe+43BF78
sora_2nd.exe+43BEF7: 8B 44 24 48 - mov eax,[rsp+48]
}
272
"戦闘：クリティカル率（%）設定 / Battle: set crit%"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/21
}
[ENABLE]
aobscanmodule(INJECT_CRIT_MAX,$process,8B ?? 6C 85 ?? 0F 48 ?? ?? F6)
// raw AOB: 45 84 DB 0F 84 ?? ?? ?? ?? 49 8D 8D D0 00 00 00 E8 ?? ?? ?? ?? 44 8B E0 B8 1F 85 EB 51 41 F7 E4 C1 EA 05 6B CA 64 44 2B E1 41 0F B6 4F 10 FE C9 4C 8B 7C 24 60 80 F9 02 77 ?? 49 8B 07 8B 78 6C 85 FF 0F 48 FE 41 F6 C6 01 74 ?? 49 8B 87 98 05 00 00 48 8B 90 08 09 00 00 8B 80 10 09 00 00 48 8D 0C C0 48 8D 04 CA 48 3B D0 74 ?? 83 3A 33 74 ?? 48 83 C2 48 48 3B D0 75 ?? EB
// injection point AOB: 8B ?? 6C 85 ?? 0F 48 ?? ?? F6 ?? 01 74 ?? ?? 8B ?? 98 05 00 00 ?? 8B ?? 08 09 00 00 8B ?? 10 09 00 00 ?? 8D ?? C0 ?? 8D ?? CA ?? 3B ?? 74 ?? 83 ?? 33 74 ?? ?? 83 ?? 48 ?? 3B ?? 75 ?? EB
alloc(newmem,$1000,INJECT_CRIT_MAX)
alloc(INJECT_CRIT_MAXo, $5)
label(code)
label(return)
INJECT_CRIT_MAXo:
readmem(INJECT_CRIT_MAX, $5)
label(i_hitp_target)
newmem:
code:
// mov edi,[rax+6C]
reassemble(INJECT_CRIT_MAX)
cmp dword ptr [rax+44], 0 // RNG
je short @F
cmp dword ptr [rax+78], 0 // max stun value
jne short @F
mov eax, [i_hitp_target]
@@:
// test edi,edi
reassemble(INJECT_CRIT_MAX+3)
jmp return
align 10 cc
i_hitp_target:
dd C8
INJECT_CRIT_MAX:
jmp newmem
return:
registersymbol(INJECT_CRIT_MAX INJECT_CRIT_MAXo)
registersymbol(i_hitp_target)
[DISABLE]
INJECT_CRIT_MAX:
readmem(INJECT_CRIT_MAXo, $5)
unregistersymbol(INJECT_CRIT_MAX INJECT_CRIT_MAXo)
unregistersymbol(i_hitp_target)
dealloc(newmem)
dealloc(INJECT_CRIT_MAXo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+E5C44
sora_2nd.exe+E5C07: 45 84 DB - test r11b,r11b
sora_2nd.exe+E5C0A: 0F 84 89 03 00 00 - je sora_2nd.exe+E5F99
sora_2nd.exe+E5C10: 49 8D 8D D0 00 00 00 - lea rcx,[r13+000000D0]
sora_2nd.exe+E5C17: E8 E4 AF 4A 00 - call sora_2nd.exe+590C00
sora_2nd.exe+E5C1C: 44 8B E0 - mov r12d,eax
sora_2nd.exe+E5C1F: B8 1F 85 EB 51 - mov eax,51EB851F
sora_2nd.exe+E5C24: 41 F7 E4 - mul r12d
sora_2nd.exe+E5C27: C1 EA 05 - shr edx,05
sora_2nd.exe+E5C2A: 6B CA 64 - imul ecx,edx,64
sora_2nd.exe+E5C2D: 44 2B E1 - sub r12d,ecx
sora_2nd.exe+E5C30: 41 0F B6 4F 10 - movzx ecx,byte ptr [r15+10]
sora_2nd.exe+E5C35: FE C9 - dec cl
sora_2nd.exe+E5C37: 4C 8B 7C 24 60 - mov r15,[rsp+60]
sora_2nd.exe+E5C3C: 80 F9 02 - cmp cl,02
sora_2nd.exe+E5C3F: 77 0B - ja sora_2nd.exe+E5C4C
sora_2nd.exe+E5C41: 49 8B 07 - mov rax,[r15]
// ---------- INJECTING HERE ----------
sora_2nd.exe+E5C44: 8B 78 6C - mov edi,[rax+6C]
// ---------- DONE INJECTING ----------
sora_2nd.exe+E5C47: 85 FF - test edi,edi
sora_2nd.exe+E5C49: 0F 48 FE - cmovs edi,esi
sora_2nd.exe+E5C4C: 41 F6 C6 01 - test r14b,01
sora_2nd.exe+E5C50: 74 39 - je sora_2nd.exe+E5C8B
sora_2nd.exe+E5C52: 49 8B 87 98 05 00 00 - mov rax,[r15+00000598]
sora_2nd.exe+E5C59: 48 8B 90 08 09 00 00 - mov rdx,[rax+00000908]
sora_2nd.exe+E5C60: 8B 80 10 09 00 00 - mov eax,[rax+00000910]
sora_2nd.exe+E5C66: 48 8D 0C C0 - lea rcx,[rax+rax*8]
sora_2nd.exe+E5C6A: 48 8D 04 CA - lea rax,[rdx+rcx*8]
sora_2nd.exe+E5C6E: 48 3B D0 - cmp rdx,rax
sora_2nd.exe+E5C71: 74 18 - je sora_2nd.exe+E5C8B
sora_2nd.exe+E5C73: 83 3A 33 - cmp dword ptr [rdx],33
sora_2nd.exe+E5C76: 74 0B - je sora_2nd.exe+E5C83
sora_2nd.exe+E5C78: 48 83 C2 48 - add rdx,48
sora_2nd.exe+E5C7C: 48 3B D0 - cmp rdx,rax
sora_2nd.exe+E5C7F: 75 F2 - jne sora_2nd.exe+E5C73
}
274
"target"
0
C08000
4 Bytes
i_hitp_target
273
"戦闘：命中率（%）最大 / Battle: max HIT%"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/21
}
[ENABLE]
aobscanmodule(INJECT_BATT_HIT_MAX,$process,?? 8B ?? 60 ?? 03 ?? ?? 0F 48)
// raw AOB: 48 3B D0 74 ?? 83 3A 35 74 ?? 48 83 C2 48 48 3B D0 75 ?? EB ?? 48 8B 05 ?? ?? ?? ?? 48 8B 88 C0 00 00 00 48 8B 41 08 48 8B 40 30 48 8B 88 F8 00 00 00 48 85 C9 74 ?? 44 8B 41 04 45 8B 69 60 45 03 E8 44 0F 48 EE 44 89 6C 24 48 48 8B 5C 24 70 48 8B 03 44 8B 60 64 45 85 E4 44 0F 48 E6 44 89 64 24 4C 41 F6 C6 02 75 ?? 41 80 7F 10 04 0F 85 ?? ?? ?? ?? 44 8B 60 68 45 85 E4 44 0F 48 E6 44 89 64 24 4C
// injection point AOB: ?? 8B ?? 60 ?? 03 ?? ?? 0F 48 ?? ?? 89 ?? 24 ?? ?? 8B ?? 24 ?? ?? 8B ?? ?? 8B ?? 64 ?? 85 ?? ?? 0F 48 ?? ?? 89 ?? 24 ?? ?? F6 ?? 02 75 ?? ?? 80 ?? 10 04 0F 85 ?? ?? ?? ?? ?? 8B ?? 68 ?? 85 ?? ?? 0F 48 ?? ?? 89 ?? 24
alloc(newmem,$1000,INJECT_BATT_HIT_MAX)
alloc(INJECT_BATT_HIT_MAXo, $7)
label(code)
label(return)
INJECT_BATT_HIT_MAXo:
readmem(INJECT_BATT_HIT_MAX, $7)
newmem:
code:
// mov r13d,[r9+60]
reassemble(INJECT_BATT_HIT_MAX)
// add r13d,r8d
reassemble(INJECT_BATT_HIT_MAX+4)
cmp dword ptr [r9+44], 0 // RNG
je short @F
cmp dword ptr [r9+78], 0 // max stun value
jne short @F
mov r13d, C8
//
@@:
jmp return
align 10 cc
INJECT_BATT_HIT_MAX:
jmp newmem
nop 2
return:
registersymbol(INJECT_BATT_HIT_MAX INJECT_BATT_HIT_MAXo)
[DISABLE]
INJECT_BATT_HIT_MAX:
readmem(INJECT_BATT_HIT_MAXo, $7)
unregistersymbol(INJECT_BATT_HIT_MAX INJECT_BATT_HIT_MAXo)
dealloc(newmem)
dealloc(INJECT_BATT_HIT_MAXo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+E521A
sora_2nd.exe+E51DF: 48 3B D0 - cmp rdx,rax
sora_2nd.exe+E51E2: 74 36 - je sora_2nd.exe+E521A
sora_2nd.exe+E51E4: 83 3A 35 - cmp dword ptr [rdx],35
sora_2nd.exe+E51E7: 74 0B - je sora_2nd.exe+E51F4
sora_2nd.exe+E51E9: 48 83 C2 48 - add rdx,48
sora_2nd.exe+E51ED: 48 3B D0 - cmp rdx,rax
sora_2nd.exe+E51F0: 75 F2 - jne sora_2nd.exe+E51E4
sora_2nd.exe+E51F2: EB 26 - jmp sora_2nd.exe+E521A
sora_2nd.exe+E51F4: 48 8B 05 8D 68 B7 00 - mov rax,[sora_2nd.exe+C5BA88]
sora_2nd.exe+E51FB: 48 8B 88 C0 00 00 00 - mov rcx,[rax+000000C0]
sora_2nd.exe+E5202: 48 8B 41 08 - mov rax,[rcx+08]
sora_2nd.exe+E5206: 48 8B 40 30 - mov rax,[rax+30]
sora_2nd.exe+E520A: 48 8B 88 F8 00 00 00 - mov rcx,[rax+000000F8]
sora_2nd.exe+E5211: 48 85 C9 - test rcx,rcx
sora_2nd.exe+E5214: 74 04 - je sora_2nd.exe+E521A
sora_2nd.exe+E5216: 44 8B 41 04 - mov r8d,[rcx+04]
// ---------- INJECTING HERE ----------
sora_2nd.exe+E521A: 45 8B 69 60 - mov r13d,[r9+60]
// ---------- DONE INJECTING ----------
sora_2nd.exe+E521E: 45 03 E8 - add r13d,r8d
sora_2nd.exe+E5221: 44 0F 48 EE - cmovs r13d,esi
sora_2nd.exe+E5225: 44 89 6C 24 48 - mov [rsp+48],r13d
sora_2nd.exe+E522A: 48 8B 5C 24 70 - mov rbx,[rsp+70]
sora_2nd.exe+E522F: 48 8B 03 - mov rax,[rbx]
sora_2nd.exe+E5232: 44 8B 60 64 - mov r12d,[rax+64]
sora_2nd.exe+E5236: 45 85 E4 - test r12d,r12d
sora_2nd.exe+E5239: 44 0F 48 E6 - cmovs r12d,esi
sora_2nd.exe+E523D: 44 89 64 24 4C - mov [rsp+4C],r12d
sora_2nd.exe+E5242: 41 F6 C6 02 - test r14b,02
sora_2nd.exe+E5246: 75 0B - jne sora_2nd.exe+E5253
sora_2nd.exe+E5248: 41 80 7F 10 04 - cmp byte ptr [r15+10],04
sora_2nd.exe+E524D: 0F 85 A4 02 00 00 - jne sora_2nd.exe+E54F7
sora_2nd.exe+E5253: 44 8B 60 68 - mov r12d,[rax+68]
sora_2nd.exe+E5257: 45 85 E4 - test r12d,r12d
sora_2nd.exe+E525A: 44 0F 48 E6 - cmovs r12d,esi
}
275
"戦闘：回避率（%）設定 / Battle: set evade%"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/21
}
[ENABLE]
aobscanmodule(INJECT_SET_EVADEP,$process,?? 8B ?? 64 ?? 85 ?? ?? 0F 48)
// raw AOB: 75 ?? EB ?? 48 8B 05 ?? ?? ?? ?? 48 8B 88 C0 00 00 00 48 8B 41 08 48 8B 40 30 48 8B 88 F8 00 00 00 48 85 C9 74 ?? 44 8B 41 04 E9 ?? ?? ?? ?? 66 90 44 0F 48 EE 44 89 6C 24 48 48 8B 5C 24 70 48 8B 03 44 8B 60 64 45 85 E4 44 0F 48 E6 44 89 64 24 4C 41 F6 C6 02 75 ?? 41 80 7F 10 04 0F 85 ?? ?? ?? ?? 44 8B 60 68 45 85 E4 44 0F 48 E6 44 89 64 24 4C 41 80 7F 10 04 0F 85 ?? ?? ?? ?? 4C 8B B3 A8 05 00 00 8B FE 49 8B 1E BA 01 00 00 00
// injection point AOB: ?? 8B ?? 64 ?? 85 ?? ?? 0F 48 ?? ?? 89 ?? 24 ?? ?? F6 ?? 02 75 ?? ?? 80 ?? 10 04 0F 85 ?? ?? ?? ?? ?? 8B ?? 68 ?? 85 ?? ?? 0F 48 ?? ?? 89 ?? 24 ?? ?? 80 ?? 10 04 0F 85 ?? ?? ?? ?? ?? 8B ?? A8 05 00 00 8B ?? ?? 8B ?? ?? 01 00 00 00
alloc(newmem,$1000,INJECT_SET_EVADEP)
alloc(INJECT_SET_EVADEPo, $7)
label(code)
label(return)
INJECT_SET_EVADEPo:
readmem(INJECT_SET_EVADEP, $7)
label(i_evade_target)
newmem:
code:
// mov r12d,[rax+64]
reassemble(INJECT_SET_EVADEP)
cmp dword ptr [rax+44], 0 // RNG
je short @F
cmp dword ptr [rax+78], 0 // max stun value
jne short @F
cmp r12d, [i_evade_target]
jae short @F
mov r12d, [i_evade_target]
@@:
// test r12d,r12d
reassemble(INJECT_SET_EVADEP+4)
jmp return
align 10 cc
i_evade_target:
dd #51
INJECT_SET_EVADEP:
jmp newmem
nop 2
return:
registersymbol(INJECT_SET_EVADEP INJECT_SET_EVADEPo)
registersymbol(i_evade_target)
[DISABLE]
INJECT_SET_EVADEP:
readmem(INJECT_SET_EVADEPo, $7)
unregistersymbol(INJECT_SET_EVADEP INJECT_SET_EVADEPo)
unregistersymbol(i_evade_target)
dealloc(newmem)
dealloc(INJECT_SET_EVADEPo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+E5232
sora_2nd.exe+E51F0: 75 F2 - jne sora_2nd.exe+E51E4
sora_2nd.exe+E51F2: EB 26 - jmp 7FF7FE75521A
sora_2nd.exe+E51F4: 48 8B 05 8D 68 B7 00 - mov rax,[sora_2nd.exe+C5BA88]
sora_2nd.exe+E51FB: 48 8B 88 C0 00 00 00 - mov rcx,[rax+000000C0]
sora_2nd.exe+E5202: 48 8B 41 08 - mov rax,[rcx+08]
sora_2nd.exe+E5206: 48 8B 40 30 - mov rax,[rax+30]
sora_2nd.exe+E520A: 48 8B 88 F8 00 00 00 - mov rcx,[rax+000000F8]
sora_2nd.exe+E5211: 48 85 C9 - test rcx,rcx
sora_2nd.exe+E5214: 74 04 - je 7FF7FE75521A
sora_2nd.exe+E5216: 44 8B 41 04 - mov r8d,[rcx+04]
INJECT_BATT_HIT_MAX: E9 E1 AD E3 FF - jmp 7FF7FE590000
sora_2nd.exe+E521F: 66 90 - nop 2
sora_2nd.exe+E5221: 44 0F 48 EE - cmovs r13d,esi
sora_2nd.exe+E5225: 44 89 6C 24 48 - mov [rsp+48],r13d
sora_2nd.exe+E522A: 48 8B 5C 24 70 - mov rbx,[rsp+70]
sora_2nd.exe+E522F: 48 8B 03 - mov rax,[rbx]
// ---------- INJECTING HERE ----------
sora_2nd.exe+E5232: 44 8B 60 64 - mov r12d,[rax+64]
// ---------- DONE INJECTING ----------
sora_2nd.exe+E5236: 45 85 E4 - test r12d,r12d
sora_2nd.exe+E5239: 44 0F 48 E6 - cmovs r12d,esi
sora_2nd.exe+E523D: 44 89 64 24 4C - mov [rsp+4C],r12d
sora_2nd.exe+E5242: 41 F6 C6 02 - test r14b,02
sora_2nd.exe+E5246: 75 0B - jne sora_2nd.exe+E5253
sora_2nd.exe+E5248: 41 80 7F 10 04 - cmp byte ptr [r15+10],04
sora_2nd.exe+E524D: 0F 85 A4 02 00 00 - jne sora_2nd.exe+E54F7
sora_2nd.exe+E5253: 44 8B 60 68 - mov r12d,[rax+68]
sora_2nd.exe+E5257: 45 85 E4 - test r12d,r12d
sora_2nd.exe+E525A: 44 0F 48 E6 - cmovs r12d,esi
sora_2nd.exe+E525E: 44 89 64 24 4C - mov [rsp+4C],r12d
sora_2nd.exe+E5263: 41 80 7F 10 04 - cmp byte ptr [r15+10],04
sora_2nd.exe+E5268: 0F 85 89 02 00 00 - jne sora_2nd.exe+E54F7
sora_2nd.exe+E526E: 4C 8B B3 A8 05 00 00 - mov r14,[rbx+000005A8]
sora_2nd.exe+E5275: 8B FE - mov edi,esi
sora_2nd.exe+E5277: 49 8B 1E - mov rbx,[r14]
}
276
"target"
0
C08000
4 Bytes
i_evade_target
277
"戦闘：魔法回避率（%）設定 / Battle: set magic evade%"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/21
}
[ENABLE]
aobscanmodule(INJECT_SET_M_EVADEP,$process,?? 8B ?? 68 ?? 85 ?? ?? 0F 48 ?? ?? 89)
// raw AOB: 74 ?? 44 8B 41 04 E9 ?? ?? ?? ?? 66 90 44 0F 48 EE 44 89 6C 24 48 48 8B 5C 24 70 48 8B 03 E9 ?? ?? ?? ?? 66 90 44 0F 48 E6 44 89 64 24 4C 41 F6 C6 02 75 ?? 41 80 7F 10 04 0F 85 ?? ?? ?? ?? 44 8B 60 68 45 85 E4 44 0F 48 E6 44 89 64 24 4C 41 80 7F 10 04 0F 85 ?? ?? ?? ?? 4C 8B B3 A8 05 00 00 8B FE 49 8B 1E BA 01 00 00 00 48 8B CB E8 ?? ?? ?? ?? BA 02 00 00 00 48 8B CB E8 ?? ?? ?? ?? 49 8B 1E 48 8B 8B 90 05 00 00 48 85 C9
// injection point AOB: ?? 8B ?? 68 ?? 85 ?? ?? 0F 48 ?? ?? 89 ?? 24 ?? ?? 80 ?? 10 04 0F 85 ?? ?? ?? ?? ?? 8B ?? A8 05 00 00 8B ?? ?? 8B ?? ?? 01 00 00 00 ?? 8B ?? E8 ?? ?? ?? ?? ?? 02 00 00 00 ?? 8B ?? E8 ?? ?? ?? ?? ?? 8B ?? ?? 8B ?? 90 05 00 00 ?? 85
alloc(newmem,$1000,INJECT_SET_M_EVADEP)
alloc(INJECT_SET_M_EVADEPo, $7)
label(code)
label(return)
INJECT_SET_M_EVADEPo:
readmem(INJECT_SET_M_EVADEP, $7)
label(i_m_evade_target)
newmem:
code:
// mov r12d,[rax+68]
reassemble(INJECT_SET_M_EVADEP)
cmp dword ptr [rax+44], 0 // RNG
je short @F
// AOBMaker was: cmp dword ptr [rsi+78], 0
cmp dword ptr [rax+78], 0 // max stun value
jne short @F
cmp r12d, [i_m_evade_target]
jae short @F
mov r12d, [i_m_evade_target]
@@:
// test r12d,r12d
reassemble(INJECT_SET_M_EVADEP+4)
jmp return
align 10 cc
i_m_evade_target:
dd #43
INJECT_SET_M_EVADEP:
jmp newmem
nop 2
return:
registersymbol(INJECT_SET_M_EVADEP INJECT_SET_M_EVADEPo)
registersymbol(i_m_evade_target)
[DISABLE]
INJECT_SET_M_EVADEP:
readmem(INJECT_SET_M_EVADEPo, $7)
unregistersymbol(INJECT_SET_M_EVADEP INJECT_SET_M_EVADEPo)
unregistersymbol(i_m_evade_target)
dealloc(newmem)
dealloc(INJECT_SET_M_EVADEPo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+E5253
sora_2nd.exe+E5214: 74 04 - je 7FF7FE75521A
sora_2nd.exe+E5216: 44 8B 41 04 - mov r8d,[rcx+04]
INJECT_BATT_HIT_MAX: E9 E1 AD E3 FF - jmp 7FF7FE590000
sora_2nd.exe+E521F: 66 90 - nop 2
sora_2nd.exe+E5221: 44 0F 48 EE - cmovs r13d,esi
sora_2nd.exe+E5225: 44 89 6C 24 48 - mov [rsp+48],r13d
sora_2nd.exe+E522A: 48 8B 5C 24 70 - mov rbx,[rsp+70]
sora_2nd.exe+E522F: 48 8B 03 - mov rax,[rbx]
INJECT_SET_EVADEP: E9 C9 AD E2 FF - jmp 7FF7FE580000
sora_2nd.exe+E5237: 66 90 - nop 2
sora_2nd.exe+E5239: 44 0F 48 E6 - cmovs r12d,esi
sora_2nd.exe+E523D: 44 89 64 24 4C - mov [rsp+4C],r12d
sora_2nd.exe+E5242: 41 F6 C6 02 - test r14b,02
sora_2nd.exe+E5246: 75 0B - jne sora_2nd.exe+E5253
sora_2nd.exe+E5248: 41 80 7F 10 04 - cmp byte ptr [r15+10],04
sora_2nd.exe+E524D: 0F 85 A4 02 00 00 - jne sora_2nd.exe+E54F7
// ---------- INJECTING HERE ----------
sora_2nd.exe+E5253: 44 8B 60 68 - mov r12d,[rax+68]
// ---------- DONE INJECTING ----------
sora_2nd.exe+E5257: 45 85 E4 - test r12d,r12d
sora_2nd.exe+E525A: 44 0F 48 E6 - cmovs r12d,esi
sora_2nd.exe+E525E: 44 89 64 24 4C - mov [rsp+4C],r12d
sora_2nd.exe+E5263: 41 80 7F 10 04 - cmp byte ptr [r15+10],04
sora_2nd.exe+E5268: 0F 85 89 02 00 00 - jne sora_2nd.exe+E54F7
sora_2nd.exe+E526E: 4C 8B B3 A8 05 00 00 - mov r14,[rbx+000005A8]
sora_2nd.exe+E5275: 8B FE - mov edi,esi
sora_2nd.exe+E5277: 49 8B 1E - mov rbx,[r14]
sora_2nd.exe+E527A: BA 01 00 00 00 - mov edx,00000001
sora_2nd.exe+E527F: 48 8B CB - mov rcx,rbx
sora_2nd.exe+E5282: E8 D9 53 FF FF - call sora_2nd.exe+DA660
sora_2nd.exe+E5287: BA 02 00 00 00 - mov edx,00000002
sora_2nd.exe+E528C: 48 8B CB - mov rcx,rbx
sora_2nd.exe+E528F: E8 CC 53 FF FF - call sora_2nd.exe+DA660
sora_2nd.exe+E5294: 49 8B 1E - mov rbx,[r14]
sora_2nd.exe+E5297: 48 8B 8B 90 05 00 00 - mov rcx,[rbx+00000590]
}
278
"target"
0
C08000
4 Bytes
i_m_evade_target
51
"戦闘：BP 常に最大 / Battle: fast BP"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_FAST_BREAK_GUAGE,$process,?? 0F 48 ?? 89 ?? 48 ?? 3B ?? 74 ?? C6 ?? 50 01 ?? 8B ?? 24)
// raw AOB: 48 8B 05 ?? ?? ?? ?? 48 8B 91 60 02 00 00 44 0F B6 80 0D 01 00 00 44 8B 4A 48 41 8D 0C 19 41 F6 C0 04 74 ?? B8 BC 02 00 00 EB ?? B8 58 02 00 00 41 F6 C0 02 75 ?? B8 F4 01 00 00 3B C8 0F 4C C1 85 C0 41 0F 48 C5 89 42 48 41 3B C1 74 ?? C6 42 50 01 48 8B 5C 24 60 48 83 C4 20 41 5D 41 5C 5F 5E 5D C3 CC CC CC CC CC
// injection point AOB: ?? 0F 48 ?? 89 ?? 48 ?? 3B ?? 74 ?? C6 ?? 50 01 ?? 8B ?? 24 ?? 48 83 C4 20 ?? ?? ?? ?? ?? ?? 5D C3 CC CC CC CC CC
alloc(newmem,$1000,INJECT_FAST_BREAK_GUAGE)
alloc(INJECT_FAST_BREAK_GUAGEo, $7)
label(code)
label(return)
INJECT_FAST_BREAK_GUAGEo:
readmem(INJECT_FAST_BREAK_GUAGE, $7)
label(i_base_bbp_addr)
newmem:
// AOBMaker migration - what AOBMaker changed below
// old injection: cmovs ecx,r13d
// new injection: cmovs eax,r13d
// register RCX -> RAX
// 2 changed line(s) carry a '// AOBMaker was: ...' note above them holding the code before the change.
// To get this script without them, untick 'Note the old code' and migrate again.
// To remove them from this copy in Notepad++: open Replace (Ctrl+H), Search Mode to
// 'Regular expression', leave '. matches newline' UNCHECKED, leave 'Replace with'
// empty, then press Replace All. Copy the pattern from the next line, after the slashes:
// ^[ \t]*// AOBMaker was:[^\r\n]*\R?
// Replace All covers the whole file, so with a .CT open it runs over every script
// in the table. Press Ctrl+Z if the line count drops by more than the note count.
// Read the diff before you enable this. AOBMaker proposes, it does not verify.
// AOBMaker migration end
code:
// cmovs eax,r13d
reassemble(INJECT_FAST_BREAK_GUAGE)
//
// AOBMaker was: cmp ecx, #500
cmp eax, #700
jae @F
// AOBMaker was: mov ecx, 500
mov eax, #700
@@:
// mov [rdx+48],eax
reassemble(INJECT_FAST_BREAK_GUAGE+4)
mov [i_base_bbp_addr], rdx
jmp return
align 10 cc
i_base_bbp_addr:
dq 0
INJECT_FAST_BREAK_GUAGE:
jmp newmem
nop 2
return:
registersymbol(INJECT_FAST_BREAK_GUAGE INJECT_FAST_BREAK_GUAGEo)
registersymbol(i_base_bbp_addr)
[DISABLE]
INJECT_FAST_BREAK_GUAGE:
readmem(INJECT_FAST_BREAK_GUAGEo, $7)
unregistersymbol(INJECT_FAST_BREAK_GUAGE INJECT_FAST_BREAK_GUAGEo)
dealloc(newmem)
dealloc(INJECT_FAST_BREAK_GUAGEo)
unregistersymbol(i_base_bbp_addr)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+DB34A
sora_2nd.exe+DB308: 48 8B 05 61 3E B8 00 - mov rax,[sora_2nd.exe+C5F170]
sora_2nd.exe+DB30F: 48 8B 91 60 02 00 00 - mov rdx,[rcx+00000260]
sora_2nd.exe+DB316: 44 0F B6 80 0D 01 00 00 - movzx r8d,byte ptr [rax+0000010D]
sora_2nd.exe+DB31E: 44 8B 4A 48 - mov r9d,[rdx+48]
sora_2nd.exe+DB322: 41 8D 0C 19 - lea ecx,[r9+rbx]
sora_2nd.exe+DB326: 41 F6 C0 04 - test r8b,04
sora_2nd.exe+DB32A: 74 07 - je sora_2nd.exe+DB333
sora_2nd.exe+DB32C: B8 BC 02 00 00 - mov eax,000002BC
sora_2nd.exe+DB331: EB 10 - jmp sora_2nd.exe+DB343
sora_2nd.exe+DB333: B8 58 02 00 00 - mov eax,00000258
sora_2nd.exe+DB338: 41 F6 C0 02 - test r8b,02
sora_2nd.exe+DB33C: 75 05 - jne sora_2nd.exe+DB343
sora_2nd.exe+DB33E: B8 F4 01 00 00 - mov eax,000001F4
sora_2nd.exe+DB343: 3B C8 - cmp ecx,eax
sora_2nd.exe+DB345: 0F 4C C1 - cmovl eax,ecx
sora_2nd.exe+DB348: 85 C0 - test eax,eax
// ---------- INJECTING HERE ----------
sora_2nd.exe+DB34A: 41 0F 48 C5 - cmovs eax,r13d
// ---------- DONE INJECTING ----------
sora_2nd.exe+DB34E: 89 42 48 - mov [rdx+48],eax
sora_2nd.exe+DB351: 41 3B C1 - cmp eax,r9d
sora_2nd.exe+DB354: 74 04 - je sora_2nd.exe+DB35A
sora_2nd.exe+DB356: C6 42 50 01 - mov byte ptr [rdx+50],01
sora_2nd.exe+DB35A: 48 8B 5C 24 60 - mov rbx,[rsp+60]
sora_2nd.exe+DB35F: 48 83 C4 20 - add rsp,20
sora_2nd.exe+DB363: 41 5D - pop r13
sora_2nd.exe+DB365: 41 5C - pop r12
sora_2nd.exe+DB367: 5F - pop rdi
sora_2nd.exe+DB368: 5E - pop rsi
sora_2nd.exe+DB369: 5D - pop rbp
sora_2nd.exe+DB36A: C3 - ret
sora_2nd.exe+DB36B: CC - int 3
sora_2nd.exe+DB36C: CC - int 3
sora_2nd.exe+DB36D: CC - int 3
sora_2nd.exe+DB36E: CC - int 3
}
52
"real BP value"
0
FF8080
4 Bytes
i_base_bbp_addr
48
53
"can use #"
0
FF8080
4 Bytes
i_base_bbp_addr
4C
54
"??"
0
FF8080
4 Bytes
i_base_bbp_addr
50
55
"戦闘終了時にBP全回復 / Restore break gauge after battle"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_RESTORE_BP_AFTER_BATTLE,$process,?? 8B ?? 60 02 00 00 8B ?? 48 89)
// raw AOB: 66 89 8C D7 70 42 11 00 49 8B 83 48 24 00 00 48 8B 0C D0 8B 81 68 03 00 00 89 84 D7 74 42 11 00 41 FF C0 45 3B 83 50 24 00 00 72 ?? 4C 8B 2D ?? ?? ?? ?? 49 83 BD 60 06 00 00 00 74 ?? 49 8B 83 50 2C 00 00 48 8B 88 68 02 00 00 8B 41 70 89 87 70 49 12 00 49 8B 83 50 2C 00 00 48 8B 88 60 02 00 00 8B 41 48 89 87 74 49 12 00 49 8B 83 B8 2C 00 00 8B 88 B0 00 00 00 89 8F 78 49 12 00 49 8B 83 B8 2C 00 00 8B 88 B4 00 00 00 89 8F 7C 49 12 00 48 8B 15 ?? ?? ?? ?? 48 83 C2 08 48 8D 8F 50 F9 1F 00 41 B8 00 50 00 00 E8 ?? ?? ?? ?? 48 8B 35 ?? ?? ?? ?? 44 89 B7 90 B6 20 00 8B 86 24 02 00 00
// injection point AOB: ?? 8B ?? 60 02 00 00 8B ?? 48 89 ?? 74 49 12 00 ?? 8B ?? B8 2C 00 00 8B ?? B0 00 00 00 89 ?? 78 49 12 00 ?? 8B ?? B8 2C 00 00 8B ?? B4 00 00 00 89 ?? 7C 49 12 00 ?? 8B ?? ?? ?? ?? ?? ?? 83 ?? 08 ?? 8D ?? 50 F9 1F 00 ?? ?? 00 50 00 00 E8 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? 90 B6 20 00 8B ?? 24 02 00 00
alloc(newmem,$1000,INJECT_RESTORE_BP_AFTER_BATTLE)
alloc(INJECT_RESTORE_BP_AFTER_BATTLEo, $7)
label(code)
label(return)
INJECT_RESTORE_BP_AFTER_BATTLEo:
readmem(INJECT_RESTORE_BP_AFTER_BATTLE, $7)
newmem:
code:
// mov rcx,[rax+00000260]
reassemble(INJECT_RESTORE_BP_AFTER_BATTLE)
//
cmp dword ptr [rcx+48], #700
//
jmp return
align 10 cc
INJECT_RESTORE_BP_AFTER_BATTLE:
jmp newmem
nop 2
return:
registersymbol(INJECT_RESTORE_BP_AFTER_BATTLE INJECT_RESTORE_BP_AFTER_BATTLEo)
[DISABLE]
INJECT_RESTORE_BP_AFTER_BATTLE:
readmem(INJECT_RESTORE_BP_AFTER_BATTLEo, $7)
unregistersymbol(INJECT_RESTORE_BP_AFTER_BATTLE INJECT_RESTORE_BP_AFTER_BATTLEo)
dealloc(newmem)
dealloc(INJECT_RESTORE_BP_AFTER_BATTLEo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+43AD7D
sora_2nd.exe+43AD22: 66 89 8C D7 70 42 11 00 - mov [rdi+rdx*8+00114270],cx
sora_2nd.exe+43AD2A: 49 8B 83 48 24 00 00 - mov rax,[r11+00002448]
sora_2nd.exe+43AD31: 48 8B 0C D0 - mov rcx,[rax+rdx*8]
sora_2nd.exe+43AD35: 8B 81 68 03 00 00 - mov eax,[rcx+00000368]
sora_2nd.exe+43AD3B: 89 84 D7 74 42 11 00 - mov [rdi+rdx*8+00114274],eax
sora_2nd.exe+43AD42: 41 FF C0 - inc r8d
sora_2nd.exe+43AD45: 45 3B 83 50 24 00 00 - cmp r8d,[r11+00002450]
sora_2nd.exe+43AD4C: 72 B2 - jb sora_2nd.exe+43AD00
sora_2nd.exe+43AD4E: 4C 8B 2D C3 43 82 00 - mov r13,[sora_2nd.exe+C5F118]
sora_2nd.exe+43AD55: 49 83 BD 60 06 00 00 00 - cmp qword ptr [r13+00000660],00
sora_2nd.exe+43AD5D: 74 2E - je sora_2nd.exe+43AD8D
sora_2nd.exe+43AD5F: 49 8B 83 50 2C 00 00 - mov rax,[r11+00002C50]
sora_2nd.exe+43AD66: 48 8B 88 68 02 00 00 - mov rcx,[rax+00000268]
sora_2nd.exe+43AD6D: 8B 41 70 - mov eax,[rcx+70]
sora_2nd.exe+43AD70: 89 87 70 49 12 00 - mov [rdi+00124970],eax
sora_2nd.exe+43AD76: 49 8B 83 50 2C 00 00 - mov rax,[r11+00002C50]
// ---------- INJECTING HERE ----------
sora_2nd.exe+43AD7D: 48 8B 88 60 02 00 00 - mov rcx,[rax+00000260]
// ---------- DONE INJECTING ----------
sora_2nd.exe+43AD84: 8B 41 48 - mov eax,[rcx+48]
sora_2nd.exe+43AD87: 89 87 74 49 12 00 - mov [rdi+00124974],eax
sora_2nd.exe+43AD8D: 49 8B 83 B8 2C 00 00 - mov rax,[r11+00002CB8]
sora_2nd.exe+43AD94: 8B 88 B0 00 00 00 - mov ecx,[rax+000000B0]
sora_2nd.exe+43AD9A: 89 8F 78 49 12 00 - mov [rdi+00124978],ecx
sora_2nd.exe+43ADA0: 49 8B 83 B8 2C 00 00 - mov rax,[r11+00002CB8]
sora_2nd.exe+43ADA7: 8B 88 B4 00 00 00 - mov ecx,[rax+000000B4]
sora_2nd.exe+43ADAD: 89 8F 7C 49 12 00 - mov [rdi+0012497C],ecx
sora_2nd.exe+43ADB3: 48 8B 15 9E 43 82 00 - mov rdx,[sora_2nd.exe+C5F158]
sora_2nd.exe+43ADBA: 48 83 C2 08 - add rdx,08
sora_2nd.exe+43ADBE: 48 8D 8F 50 F9 1F 00 - lea rcx,[rdi+001FF950]
sora_2nd.exe+43ADC5: 41 B8 00 50 00 00 - mov r8d,00005000
sora_2nd.exe+43ADCB: E8 60 82 46 00 - call sora_2nd.exe+8A3030
sora_2nd.exe+43ADD0: 48 8B 35 89 0C 82 00 - mov rsi,[sora_2nd.exe+C5BA60]
sora_2nd.exe+43ADD7: 44 89 B7 90 B6 20 00 - mov [rdi+0020B690],r14d
sora_2nd.exe+43ADDE: 8B 86 24 02 00 00 - mov eax,[rsi+00000224]
}
56
"(X) サポート経験値倍率設定 / Support XP multiplier"
Auto Assembler Script
{ Game :
Version:
Date : 2025-09-20
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_SUPPORT_EXP_MULTI,sora_2nd.exe,03 D6 3B D7 0F 4C FA 85) // should be unique
alloc(newmem,$1000,INJECT_SUPPORT_EXP_MULTI)
label(code)
label(return vf_support_exp_multi)
newmem:
vmovss xmm14, [vf_support_exp_multi]
vcvtsi2ss xmm15, xmm15, esi
vmulss xmm15, xmm14, xmm15
vcvtss2si esi, xmm15
code:
add edx,esi
cmp edx,edi
cmovl edi,edx
jmp return
align 10 cc
vf_support_exp_multi:
dd (float)6.666666
INJECT_SUPPORT_EXP_MULTI:
jmp newmem
nop 2
return:
registersymbol(INJECT_SUPPORT_EXP_MULTI vf_support_exp_multi)
[DISABLE]
INJECT_SUPPORT_EXP_MULTI:
db 03 D6 3B D7 0F 4C FA
unregistersymbol(INJECT_SUPPORT_EXP_MULTI vf_support_exp_multi)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+EFE6C
sora_2nd.exe+EFE2E: 8B C6 - mov eax,esi
sora_2nd.exe+EFE30: C1 E8 1F - shr eax,1F
sora_2nd.exe+EFE33: 03 F0 - add esi,eax
sora_2nd.exe+EFE35: 83 FE 01 - cmp esi,01
sora_2nd.exe+EFE38: B8 01 00 00 00 - mov eax,00000001
sora_2nd.exe+EFE3D: 0F 4C F0 - cmovl esi,eax
sora_2nd.exe+EFE40: 49 8B 40 38 - mov rax,[r8+38]
sora_2nd.exe+EFE44: 41 8B 55 00 - mov edx,[r13+00]
sora_2nd.exe+EFE48: 48 8B 48 08 - mov rcx,[rax+08]
sora_2nd.exe+EFE4C: E8 EF 86 00 00 - call sora_2nd.exe+F8540
sora_2nd.exe+EFE51: 8B F8 - mov edi,eax
sora_2nd.exe+EFE53: 41 8B 95 94 02 00 00 - mov edx,[r13+00000294]
sora_2nd.exe+EFE5A: 41 8B 4D 00 - mov ecx,[r13+00]
sora_2nd.exe+EFE5E: E8 3D C5 00 00 - call sora_2nd.exe+FC3A0
sora_2nd.exe+EFE63: 8B D8 - mov ebx,eax
sora_2nd.exe+EFE65: 41 8B 95 94 02 00 00 - mov edx,[r13+00000294]
// ---------- INJECTING HERE ----------
sora_2nd.exe+EFE6C: 03 D6 - add edx,esi
// ---------- DONE INJECTING ----------
sora_2nd.exe+EFE6E: 3B D7 - cmp edx,edi
sora_2nd.exe+EFE70: 0F 4C FA - cmovl edi,edx
sora_2nd.exe+EFE73: 85 FF - test edi,edi
sora_2nd.exe+EFE75: B8 00 00 00 00 - mov eax,00000000
sora_2nd.exe+EFE7A: 0F 48 F8 - cmovs edi,eax
sora_2nd.exe+EFE7D: 41 89 BD 94 02 00 00 - mov [r13+00000294],edi
sora_2nd.exe+EFE84: 45 8B 45 00 - mov r8d,[r13+00]
sora_2nd.exe+EFE88: BA 3A 00 00 00 - mov edx,0000003A
sora_2nd.exe+EFE8D: 48 8B 0D C4 BB B6 00 - mov rcx,[sora_2nd.exe+C5BA58]
sora_2nd.exe+EFE94: E8 77 3B F3 FF - call sora_2nd.exe+23A10
sora_2nd.exe+EFE99: 41 8B 95 94 02 00 00 - mov edx,[r13+00000294]
sora_2nd.exe+EFEA0: 41 8B 4D 00 - mov ecx,[r13+00]
sora_2nd.exe+EFEA4: E8 F7 C4 00 00 - call sora_2nd.exe+FC3A0
sora_2nd.exe+EFEA9: 3B C3 - cmp eax,ebx
sora_2nd.exe+EFEAB: 76 45 - jna sora_2nd.exe+EFEF2
sora_2nd.exe+EFEAD: 45 84 FF - test r15b,r15b
}
57
"multiplier"
0
C08000
Float
vf_support_exp_multi
58
"高速オーバードライブ / Fast overdrive (OD)"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_FAST_OVERDRIVE,$process,03 ?? 3B ?? 0F 4C ?? ?? 33 ?? 85 ?? 0F)
// raw AOB: 48 8B 8A 98 05 00 00 48 8B 81 08 09 00 00 8B 89 10 09 00 00 4C 8D 04 C9 4A 8D 0C C0 48 3B C1 74 ?? 0F 1F 40 00 83 38 35 74 ?? 48 83 C0 48 48 3B C1 75 ?? 48 8B 12 B9 64 00 00 00 0F B6 82 93 02 00 00 03 C7 3B C1 0F 4C C8 45 33 C0 85 C9 0F B6 C1 41 0F 48 C0 88 82 93 02 00 00 48 8B 5C 24 30 48 83 C4 20 5F C3 CC CC CC CC CC CC CC
// injection point AOB: 03 ?? 3B ?? 0F 4C ?? ?? 33 ?? 85 ?? 0F B6 ?? ?? 0F 48 ?? 88 ?? 93 02 00 00 ?? 8B ?? 24 ?? 48 83 C4 20 ?? C3 CC CC CC CC CC CC CC
alloc(newmem,$1000,INJECT_FAST_OVERDRIVE)
alloc(INJECT_FAST_OVERDRIVEo, $7)
label(code)
label(return)
INJECT_FAST_OVERDRIVEo:
readmem(INJECT_FAST_OVERDRIVE, $7)
label(vf_od_multi is_od_multi i_base_od_addr)
newmem:
// AOBMaker migration - what AOBMaker changed below
// old injection: add ecx,edi
// new injection: add eax,edi
// register RCX -> RAX
// Read the diff before you enable this. AOBMaker proposes, it does not verify.
// AOBMaker migration end
cmp dword ptr [is_od_multi], 1
jne short @F
vmovss xmm14, [vf_od_multi]
vcvtsi2ss xmm15, xmm15, edi
vmulss xmm15, xmm14, xmm15
vcvtss2si edi, xmm15
jmp short endp
@@:
mov edi, 64
endp:
mov [i_base_od_addr], rdx
code:
// add eax,edi
reassemble(INJECT_FAST_OVERDRIVE)
// cmp eax,ecx
reassemble(INJECT_FAST_OVERDRIVE+2)
// cmovl ecx,eax
reassemble(INJECT_FAST_OVERDRIVE+4)
jmp return
align 10 cc
i_base_od_addr:
dq 0
vf_od_multi:
dd (float)3.3333333
is_od_multi:
dd 0
INJECT_FAST_OVERDRIVE:
jmp newmem
nop 2
return:
registersymbol(INJECT_FAST_OVERDRIVE INJECT_FAST_OVERDRIVEo)
registersymbol(vf_od_multi is_od_multi i_base_od_addr)
[DISABLE]
INJECT_FAST_OVERDRIVE:
readmem(INJECT_FAST_OVERDRIVEo, $7)
unregistersymbol(INJECT_FAST_OVERDRIVE INJECT_FAST_OVERDRIVEo)
dealloc(newmem)
dealloc(INJECT_FAST_OVERDRIVEo)
unregistersymbol(vf_od_multi is_od_multi i_base_od_addr)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+E94BD
sora_2nd.exe+E947B: 48 8B 8A 98 05 00 00 - mov rcx,[rdx+00000598]
sora_2nd.exe+E9482: 48 8B 81 08 09 00 00 - mov rax,[rcx+00000908]
sora_2nd.exe+E9489: 8B 89 10 09 00 00 - mov ecx,[rcx+00000910]
sora_2nd.exe+E948F: 4C 8D 04 C9 - lea r8,[rcx+rcx*8]
sora_2nd.exe+E9493: 4A 8D 0C C0 - lea rcx,[rax+r8*8]
sora_2nd.exe+E9497: 48 3B C1 - cmp rax,rcx
sora_2nd.exe+E949A: 74 12 - je sora_2nd.exe+E94AE
sora_2nd.exe+E949C: 0F 1F 40 00 - nop dword ptr [rax+00]
sora_2nd.exe+E94A0: 83 38 35 - cmp dword ptr [rax],35
sora_2nd.exe+E94A3: 74 31 - je sora_2nd.exe+E94D6
sora_2nd.exe+E94A5: 48 83 C0 48 - add rax,48
sora_2nd.exe+E94A9: 48 3B C1 - cmp rax,rcx
sora_2nd.exe+E94AC: 75 F2 - jne sora_2nd.exe+E94A0
sora_2nd.exe+E94AE: 48 8B 12 - mov rdx,[rdx]
sora_2nd.exe+E94B1: B9 64 00 00 00 - mov ecx,00000064
sora_2nd.exe+E94B6: 0F B6 82 93 02 00 00 - movzx eax,byte ptr [rdx+00000293]
// ---------- INJECTING HERE ----------
sora_2nd.exe+E94BD: 03 C7 - add eax,edi
// ---------- DONE INJECTING ----------
sora_2nd.exe+E94BF: 3B C1 - cmp eax,ecx
sora_2nd.exe+E94C1: 0F 4C C8 - cmovl ecx,eax
sora_2nd.exe+E94C4: 45 33 C0 - xor r8d,r8d
sora_2nd.exe+E94C7: 85 C9 - test ecx,ecx
sora_2nd.exe+E94C9: 0F B6 C1 - movzx eax,cl
sora_2nd.exe+E94CC: 41 0F 48 C0 - cmovs eax,r8d
sora_2nd.exe+E94D0: 88 82 93 02 00 00 - mov [rdx+00000293],al
sora_2nd.exe+E94D6: 48 8B 5C 24 30 - mov rbx,[rsp+30]
sora_2nd.exe+E94DB: 48 83 C4 20 - add rsp,20
sora_2nd.exe+E94DF: 5F - pop rdi
sora_2nd.exe+E94E0: C3 - ret
sora_2nd.exe+E94E1: CC - int 3
sora_2nd.exe+E94E2: CC - int 3
sora_2nd.exe+E94E3: CC - int 3
sora_2nd.exe+E94E4: CC - int 3
sora_2nd.exe+E94E5: CC - int 3
}
59
"倍率切替 / use multiplier"
Auto Assembler Script
[ENABLE]
is_od_multi:
dd 1
[DISABLE]
is_od_multi:
dd 0
60
"multiplier"
0
C08000
Float
vf_od_multi
61
"Last OD"
0
FF8080
Byte
i_base_od_addr
293
62
"オーバードライブゲージ減らない / inf. OD gauge"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_OVERDRIVE_NO_DEC,$process,C6 ?? 93 02 00 00 00)
// raw AOB: 48 8B 8B 90 05 00 00 48 85 C9 74 ?? 48 8B 01 FF 50 10 3D 3A 1E B5 B6 75 ?? 48 8B AB 90 05 00 00 48 8B 95 88 1D 00 00 48 85 D2 74 ?? 48 8B 0D ?? ?? ?? ?? 45 33 C0 E8 ?? ?? ?? ?? 49 8B 06 48 8B 08 C6 81 93 02 00 00 00 49 8B 1E 48 8B 8B 90 05 00 00 48 85 C9 74 ?? 48 8B 01 FF 50 10 3D 3A 1E B5 B6 75 ?? 48 8B 93 90 05 00 00 48 85 D2 74 ?? 48 8B 8A 88 1D 00 00 48 85 C9 74 ?? 8B 81 7C 0E 00 00 C1 E8 07
// injection point AOB: C6 ?? 93 02 00 00 00 ?? 8B ?? ?? 8B ?? 90 05 00 00 ?? 85 ?? 74 ?? ?? 8B ?? FF ?? 10 3D 3A 1E B5 B6 75 ?? ?? 8B ?? 90 05 00 00 ?? 85 ?? 74 ?? ?? 8B ?? 88 1D 00 00 ?? 85 ?? 74 ?? 8B ?? 7C 0E 00 00 C1 ?? 07
INJECT_OVERDRIVE_NO_DEC+6:
db 64
registersymbol(INJECT_OVERDRIVE_NO_DEC)
[DISABLE]
INJECT_OVERDRIVE_NO_DEC+6:
db 00
unregistersymbol(INJECT_OVERDRIVE_NO_DEC)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+E8BD5
sora_2nd.exe+E8B94: 48 8B 8B 90 05 00 00 - mov rcx,[rbx+00000590]
sora_2nd.exe+E8B9B: 48 85 C9 - test rcx,rcx
sora_2nd.exe+E8B9E: 74 14 - je sora_2nd.exe+E8BB4
sora_2nd.exe+E8BA0: 48 8B 01 - mov rax,[rcx]
sora_2nd.exe+E8BA3: FF 50 10 - call qword ptr [rax+10]
sora_2nd.exe+E8BA6: 3D 3A 1E B5 B6 - cmp eax,B6B51E3A
sora_2nd.exe+E8BAB: 75 07 - jne sora_2nd.exe+E8BB4
sora_2nd.exe+E8BAD: 48 8B AB 90 05 00 00 - mov rbp,[rbx+00000590]
sora_2nd.exe+E8BB4: 48 8B 95 88 1D 00 00 - mov rdx,[rbp+00001D88]
sora_2nd.exe+E8BBB: 48 85 D2 - test rdx,rdx
sora_2nd.exe+E8BBE: 74 0F - je sora_2nd.exe+E8BCF
sora_2nd.exe+E8BC0: 48 8B 0D B1 2E B7 00 - mov rcx,[sora_2nd.exe+C5BA78]
sora_2nd.exe+E8BC7: 45 33 C0 - xor r8d,r8d
sora_2nd.exe+E8BCA: E8 F1 7E FE FF - call sora_2nd.exe+D0AC0
sora_2nd.exe+E8BCF: 49 8B 06 - mov rax,[r14]
sora_2nd.exe+E8BD2: 48 8B 08 - mov rcx,[rax]
// ---------- INJECTING HERE ----------
sora_2nd.exe+E8BD5: C6 81 93 02 00 00 00 - mov byte ptr [rcx+00000293],00
// ---------- DONE INJECTING ----------
sora_2nd.exe+E8BDC: 49 8B 1E - mov rbx,[r14]
sora_2nd.exe+E8BDF: 48 8B 8B 90 05 00 00 - mov rcx,[rbx+00000590]
sora_2nd.exe+E8BE6: 48 85 C9 - test rcx,rcx
sora_2nd.exe+E8BE9: 74 75 - je sora_2nd.exe+E8C60
sora_2nd.exe+E8BEB: 48 8B 01 - mov rax,[rcx]
sora_2nd.exe+E8BEE: FF 50 10 - call qword ptr [rax+10]
sora_2nd.exe+E8BF1: 3D 3A 1E B5 B6 - cmp eax,B6B51E3A
sora_2nd.exe+E8BF6: 75 68 - jne sora_2nd.exe+E8C60
sora_2nd.exe+E8BF8: 48 8B 93 90 05 00 00 - mov rdx,[rbx+00000590]
sora_2nd.exe+E8BFF: 48 85 D2 - test rdx,rdx
sora_2nd.exe+E8C02: 74 5C - je sora_2nd.exe+E8C60
sora_2nd.exe+E8C04: 48 8B 8A 88 1D 00 00 - mov rcx,[rdx+00001D88]
sora_2nd.exe+E8C0B: 48 85 C9 - test rcx,rcx
sora_2nd.exe+E8C0E: 74 22 - je sora_2nd.exe+E8C32
sora_2nd.exe+E8C10: 8B 81 7C 0E 00 00 - mov eax,[rcx+00000E7C]
sora_2nd.exe+E8C16: C1 E8 07 - shr eax,07
}
63
"フィールドチャージゲージ倍率 / Field charge gauge multiplier"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_FAST_FIELD_CHARGE,$process,?? 8D ?? 10 ?? C8 00 00 00 3B)
// raw AOB: 89 44 9E 28 F3 44 0F 58 5E 68 F3 44 0F 11 5E 68 48 8B 4D 80 48 33 CC E8 ?? ?? ?? ?? 44 0F 28 9C 24 C0 00 00 00 48 81 C4 20 01 00 00 5E 5B 5D C3 40 53 48 83 EC 20 44 8B 41 70 48 8B D9 41 8D 04 10 BA C8 00 00 00 3B C2 0F 4C D0 33 C9 85 D2 0F 48 D1 89 53 70 8B 43 7C 89 43 74 89 53 78 48 C7 83 80 00 00 00 CD CC 4C 3E C7 83 88 00 00 00 02 00 00 00 44 39 43 70 74 ?? 4C 8B 4B 60 48 89 7C 24 30 4D 85 C9
// injection point AOB: ?? 8D ?? 10 ?? C8 00 00 00 3B ?? 0F 4C ?? 33 ?? 85 ?? 0F 48 ?? 89 ?? 70 8B ?? 7C 89 ?? 74 89 ?? 78 ?? C7 ?? 80 00 00 00 CD CC 4C 3E C7 ?? 88 00 00 00 02 00 00 00 ?? 39 ?? 70 74 ?? ?? 8B ?? 60 ?? 89 ?? 24 ?? ?? 85
alloc(newmem,$1000,INJECT_FAST_FIELD_CHARGE)
alloc(INJECT_FAST_FIELD_CHARGEo, $9)
label(code)
label(return)
label(vf_field_charge_multi)
INJECT_FAST_FIELD_CHARGEo:
readmem(INJECT_FAST_FIELD_CHARGE, $9)
newmem:
cmp edx, 0
jle short code
vcvtsi2ss xmm15, xmm15, edx
vmovss xmm14, [vf_field_charge_multi]
vmulss xmm14, xmm14, xmm15
vcvtss2si edx, xmm14
code:
// lea eax,[r8+rdx]
reassemble(INJECT_FAST_FIELD_CHARGE)
// mov edx,000000C8
reassemble(INJECT_FAST_FIELD_CHARGE+4)
jmp return
align 10 cc
vf_field_charge_multi:
dd (float)3
INJECT_FAST_FIELD_CHARGE:
jmp newmem
nop 4
return:
registersymbol(INJECT_FAST_FIELD_CHARGE INJECT_FAST_FIELD_CHARGEo)
registersymbol(vf_field_charge_multi)
[DISABLE]
INJECT_FAST_FIELD_CHARGE:
readmem(INJECT_FAST_FIELD_CHARGEo, $9)
unregistersymbol(INJECT_FAST_FIELD_CHARGE INJECT_FAST_FIELD_CHARGEo)
unregistersymbol(vf_field_charge_multi)
dealloc(newmem)
dealloc(INJECT_FAST_FIELD_CHARGEo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+7DCED
sora_2nd.exe+7DCB0: 89 44 9E 28 - mov [rsi+rbx*4+28],eax
sora_2nd.exe+7DCB4: F3 44 0F 58 5E 68 - addss xmm11,[rsi+68]
sora_2nd.exe+7DCBA: F3 44 0F 11 5E 68 - movss [rsi+68],xmm11
sora_2nd.exe+7DCC0: 48 8B 4D 80 - mov rcx,[rbp-80]
sora_2nd.exe+7DCC4: 48 33 CC - xor rcx,rsp
sora_2nd.exe+7DCC7: E8 C4 7D 74 00 - call sora_2nd.exe+7C5A90
sora_2nd.exe+7DCCC: 44 0F 28 9C 24 C0 00 00 00 - movaps xmm11,[rsp+000000C0]
sora_2nd.exe+7DCD5: 48 81 C4 20 01 00 00 - add rsp,00000120
sora_2nd.exe+7DCDC: 5E - pop rsi
sora_2nd.exe+7DCDD: 5B - pop rbx
sora_2nd.exe+7DCDE: 5D - pop rbp
sora_2nd.exe+7DCDF: C3 - ret
sora_2nd.exe+7DCE0: 40 53 - push rbx
sora_2nd.exe+7DCE2: 48 83 EC 20 - sub rsp,20
sora_2nd.exe+7DCE6: 44 8B 41 70 - mov r8d,[rcx+70]
sora_2nd.exe+7DCEA: 48 8B D9 - mov rbx,rcx
// ---------- INJECTING HERE ----------
sora_2nd.exe+7DCED: 41 8D 04 10 - lea eax,[r8+rdx]
// ---------- DONE INJECTING ----------
sora_2nd.exe+7DCF1: BA C8 00 00 00 - mov edx,000000C8
sora_2nd.exe+7DCF6: 3B C2 - cmp eax,edx
sora_2nd.exe+7DCF8: 0F 4C D0 - cmovl edx,eax
sora_2nd.exe+7DCFB: 33 C9 - xor ecx,ecx
sora_2nd.exe+7DCFD: 85 D2 - test edx,edx
sora_2nd.exe+7DCFF: 0F 48 D1 - cmovs edx,ecx
sora_2nd.exe+7DD02: 89 53 70 - mov [rbx+70],edx
sora_2nd.exe+7DD05: 8B 43 7C - mov eax,[rbx+7C]
sora_2nd.exe+7DD08: 89 43 74 - mov [rbx+74],eax
sora_2nd.exe+7DD0B: 89 53 78 - mov [rbx+78],edx
sora_2nd.exe+7DD0E: 48 C7 83 80 00 00 00 CD CC 4C 3E - mov qword ptr [rbx+00000080],3E4CCCCD
sora_2nd.exe+7DD19: C7 83 88 00 00 00 02 00 00 00 - mov [rbx+00000088],00000002
sora_2nd.exe+7DD23: 44 39 43 70 - cmp [rbx+70],r8d
sora_2nd.exe+7DD27: 74 3E - je sora_2nd.exe+7DD67
sora_2nd.exe+7DD29: 4C 8B 4B 60 - mov r9,[rbx+60]
sora_2nd.exe+7DD2D: 48 89 7C 24 30 - mov [rsp+30],rdi
}
64
"multiplier"
0
C08000
Float
vf_field_charge_multi
65
"フィールドチャージゲージ無限 / Field charge: inf charge use"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_CHARGE_NO_DEC,$process,83 ?? 70 64 7C ?? E8 ?? ?? ?? ?? 84 ?? 75)
// raw AOB: 89 41 04 8B 41 28 89 41 08 C7 41 10 00 00 80 3F C7 41 14 00 00 80 3F C7 41 18 00 00 80 3F 48 C7 41 30 CD CC CC 3D 89 51 38 48 8B 0D ?? ?? ?? ?? 80 B9 30 2D 00 00 00 75 ?? 48 8B 05 ?? ?? ?? ?? F6 80 05 01 00 00 04 75 ?? 48 8B 81 50 2C 00 00 48 8B 88 68 02 00 00 83 79 70 64 7C ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 4C 8B 8B 20 06 00 00 4D 85 C9 74 ?? 48 63 83 14 06 00 00 41 B8 01 00 00 00 48 8B 8B C8 05 00 00 48 83 C0 02 48 8D 14 40 8B 94 93 C8 05 00 00 41 FF D1 48 63 83 14 06 00 00 48 8D 0C 40 C7 84 8B E4 05 00 00 01 00 00 00
// injection point AOB: 83 ?? 70 64 7C ?? E8 ?? ?? ?? ?? 84 ?? 75 ?? ?? 8B ?? 20 06 00 00 ?? 85 ?? 74 ?? ?? 63 ?? 14 06 00 00 ?? ?? 01 00 00 00 ?? 8B ?? C8 05 00 00 ?? 83 ?? 02 ?? 8D ?? 40 8B ?? 93 C8 05 00 00 ?? FF ?? ?? 63 ?? 14 06 00 00 ?? 8D ?? 40 C7 ?? ?? E4 05 00 00 01 00 00 00
alloc(newmem,$1000,INJECT_CHARGE_NO_DEC)
alloc(INJECT_CHARGE_NO_DECo, $6)
label(code)
label(return)
INJECT_CHARGE_NO_DECo:
readmem(INJECT_CHARGE_NO_DEC, $6)
newmem:
cmp dword ptr [rcx+70],C8
jae short code
mov dword ptr [rcx+70],C8
code:
// cmp dword ptr [rcx+70],64
reassemble(INJECT_CHARGE_NO_DEC)
// jl sora_2nd.exe+91B39
reassemble(INJECT_CHARGE_NO_DEC+4)
jmp return
align 10 cc
INJECT_CHARGE_NO_DEC:
jmp newmem
nop 1
return:
registersymbol(INJECT_CHARGE_NO_DEC INJECT_CHARGE_NO_DECo)
[DISABLE]
INJECT_CHARGE_NO_DEC:
readmem(INJECT_CHARGE_NO_DECo, $6)
unregistersymbol(INJECT_CHARGE_NO_DEC INJECT_CHARGE_NO_DECo)
dealloc(newmem)
dealloc(INJECT_CHARGE_NO_DECo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+91B2A
sora_2nd.exe+91AD3: 89 41 04 - mov [rcx+04],eax
sora_2nd.exe+91AD6: 8B 41 28 - mov eax,[rcx+28]
sora_2nd.exe+91AD9: 89 41 08 - mov [rcx+08],eax
sora_2nd.exe+91ADC: C7 41 10 00 00 80 3F - mov [rcx+10],3F800000
sora_2nd.exe+91AE3: C7 41 14 00 00 80 3F - mov [rcx+14],3F800000
sora_2nd.exe+91AEA: C7 41 18 00 00 80 3F - mov [rcx+18],3F800000
sora_2nd.exe+91AF1: 48 C7 41 30 CD CC CC 3D - mov qword ptr [rcx+30],3DCCCCCD
sora_2nd.exe+91AF9: 89 51 38 - mov [rcx+38],edx
sora_2nd.exe+91AFC: 48 8B 0D 75 9F BC 00 - mov rcx,[sora_2nd.exe+C5BA78]
sora_2nd.exe+91B03: 80 B9 30 2D 00 00 00 - cmp byte ptr [rcx+00002D30],00
sora_2nd.exe+91B0A: 75 75 - jne sora_2nd.exe+91B81
sora_2nd.exe+91B0C: 48 8B 05 5D D6 BC 00 - mov rax,[sora_2nd.exe+C5F170]
sora_2nd.exe+91B13: F6 80 05 01 00 00 04 - test byte ptr [rax+00000105],04
sora_2nd.exe+91B1A: 75 1D - jne sora_2nd.exe+91B39
sora_2nd.exe+91B1C: 48 8B 81 50 2C 00 00 - mov rax,[rcx+00002C50]
sora_2nd.exe+91B23: 48 8B 88 68 02 00 00 - mov rcx,[rax+00000268]
// ---------- INJECTING HERE ----------
sora_2nd.exe+91B2A: 83 79 70 64 - cmp dword ptr [rcx+70],64
// ---------- DONE INJECTING ----------
sora_2nd.exe+91B2E: 7C 09 - jl sora_2nd.exe+91B39
sora_2nd.exe+91B30: E8 BB 01 00 00 - call sora_2nd.exe+91CF0
sora_2nd.exe+91B35: 84 C0 - test al,al
sora_2nd.exe+91B37: 75 48 - jne sora_2nd.exe+91B81
sora_2nd.exe+91B39: 4C 8B 8B 20 06 00 00 - mov r9,[rbx+00000620]
sora_2nd.exe+91B40: 4D 85 C9 - test r9,r9
sora_2nd.exe+91B43: 74 26 - je sora_2nd.exe+91B6B
sora_2nd.exe+91B45: 48 63 83 14 06 00 00 - movsxd rax,dword ptr [rbx+00000614]
sora_2nd.exe+91B4C: 41 B8 01 00 00 00 - mov r8d,00000001
sora_2nd.exe+91B52: 48 8B 8B C8 05 00 00 - mov rcx,[rbx+000005C8]
sora_2nd.exe+91B59: 48 83 C0 02 - add rax,02
sora_2nd.exe+91B5D: 48 8D 14 40 - lea rdx,[rax+rax*2]
sora_2nd.exe+91B61: 8B 94 93 C8 05 00 00 - mov edx,[rbx+rdx*4+000005C8]
sora_2nd.exe+91B68: 41 FF D1 - call r9
sora_2nd.exe+91B6B: 48 63 83 14 06 00 00 - movsxd rax,dword ptr [rbx+00000614]
sora_2nd.exe+91B72: 48 8D 0C 40 - lea rcx,[rax+rax*2]
}
66
"(X) 撃破数を取得 / Get kill count"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_GET_KILL_CNT,$process,8B ?? 88 12 01 00 8B ?? C1 ?? 1E 83 ?? 01 75 ?? 8D ?? 8D 00 00 00 00 C1 ?? 02 EB ?? 83 ?? 02 75 ?? 8D ?? 8D 00 00 00 00 66 0F 6E ?? F3 0F 2C ?? EB)
// raw AOB: C1 E8 1E 83 F8 01 75 ?? 8D 14 8D 00 00 00 00 C1 FA 02 EB ?? 83 F8 02 75 ?? 8D 04 8D 00 00 00 00 66 0F 6E C0 F3 0F 2C D0 EB ?? 8B D5 49 8B CD E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 8B 88 88 12 01 00 8B C1 C1 E8 1E 83 F8 01 75 ?? 8D 14 8D 00 00 00 00 C1 FA 02 EB ?? 83 F8 02 75 ?? 8D 04 8D 00 00 00 00 66 0F 6E C0 F3 0F 2C D0 EB ?? 8B D5 B8 9F 86 01 00 3B D0
// injection point AOB: 8B ?? 88 12 01 00 8B ?? C1 ?? 1E 83 ?? 01 75 ?? 8D ?? 8D 00 00 00 00 C1 ?? 02 EB ?? 83 ?? 02 75 ?? 8D ?? 8D 00 00 00 00 66 0F 6E ?? F3 0F 2C ?? EB ?? 8B ?? ?? 9F 86 01 00 3B
alloc(newmem,$1000,INJECT_GET_KILL_CNT)
alloc(INJECT_GET_KILL_CNTo, $6)
label(code)
label(return)
INJECT_GET_KILL_CNTo:
readmem(INJECT_GET_KILL_CNT, $6)
label(i_base_kill_cnt_addr)
newmem:
push r15
lea r15, [rax+00011288]
mov [i_base_kill_cnt_addr], r15
pop r15
code:
// mov ecx,[rax+00011288]
reassemble(INJECT_GET_KILL_CNT)
jmp return
align 10 cc
i_base_kill_cnt_addr:
dq 0
INJECT_GET_KILL_CNT:
jmp newmem
nop 1
return:
registersymbol(INJECT_GET_KILL_CNT INJECT_GET_KILL_CNTo)
registersymbol(i_base_kill_cnt_addr)
[DISABLE]
INJECT_GET_KILL_CNT:
readmem(INJECT_GET_KILL_CNTo, $6)
unregistersymbol(INJECT_GET_KILL_CNT INJECT_GET_KILL_CNTo)
dealloc(newmem)
dealloc(INJECT_GET_KILL_CNTo)
unregistersymbol(i_base_kill_cnt_addr)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+3F8210
sora_2nd.exe+3F81D5: C1 E8 1E - shr eax,1E
sora_2nd.exe+3F81D8: 83 F8 01 - cmp eax,01
sora_2nd.exe+3F81DB: 75 0C - jne sora_2nd.exe+3F81E9
sora_2nd.exe+3F81DD: 8D 14 8D 00 00 00 00 - lea edx,[rcx*4+00000000]
sora_2nd.exe+3F81E4: C1 FA 02 - sar edx,02
sora_2nd.exe+3F81E7: EB 18 - jmp sora_2nd.exe+3F8201
sora_2nd.exe+3F81E9: 83 F8 02 - cmp eax,02
sora_2nd.exe+3F81EC: 75 11 - jne sora_2nd.exe+3F81FF
sora_2nd.exe+3F81EE: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
sora_2nd.exe+3F81F5: 66 0F 6E C0 - movd xmm0,eax
sora_2nd.exe+3F81F9: F3 0F 2C D0 - cvttss2si edx,xmm0
sora_2nd.exe+3F81FD: EB 02 - jmp sora_2nd.exe+3F8201
sora_2nd.exe+3F81FF: 8B D5 - mov edx,ebp
sora_2nd.exe+3F8201: 49 8B CD - mov rcx,r13
sora_2nd.exe+3F8204: E8 97 0F 1F 00 - call sora_2nd.exe+5E91A0
sora_2nd.exe+3F8209: 48 8B 05 60 6F 86 00 - mov rax,[sora_2nd.exe+C5F170]
// ---------- INJECTING HERE ----------
sora_2nd.exe+3F8210: 8B 88 88 12 01 00 - mov ecx,[rax+00011288]
// ---------- DONE INJECTING ----------
sora_2nd.exe+3F8216: 8B C1 - mov eax,ecx
sora_2nd.exe+3F8218: C1 E8 1E - shr eax,1E
sora_2nd.exe+3F821B: 83 F8 01 - cmp eax,01
sora_2nd.exe+3F821E: 75 0C - jne sora_2nd.exe+3F822C
sora_2nd.exe+3F8220: 8D 14 8D 00 00 00 00 - lea edx,[rcx*4+00000000]
sora_2nd.exe+3F8227: C1 FA 02 - sar edx,02
sora_2nd.exe+3F822A: EB 18 - jmp sora_2nd.exe+3F8244
sora_2nd.exe+3F822C: 83 F8 02 - cmp eax,02
sora_2nd.exe+3F822F: 75 11 - jne sora_2nd.exe+3F8242
sora_2nd.exe+3F8231: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
sora_2nd.exe+3F8238: 66 0F 6E C0 - movd xmm0,eax
sora_2nd.exe+3F823C: F3 0F 2C D0 - cvttss2si edx,xmm0
sora_2nd.exe+3F8240: EB 02 - jmp sora_2nd.exe+3F8244
sora_2nd.exe+3F8242: 8B D5 - mov edx,ebp
sora_2nd.exe+3F8244: B8 9F 86 01 00 - mov eax,0001869F
sora_2nd.exe+3F8249: 3B D0 - cmp edx,eax
}
67
"※使用：開啟記錄"
8000FF
1
68
"Usage: Open memo menu"
8000FF
1
69
"Kill count"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
0
70
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
4
71
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
8
72
"??"
0
FF8080
Custom
Kueo2 integer
i_base_kill_cnt_addr
C
185
"オーブメント - 選択中のクオーツ / Cur. quartz"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_GET_CURRENT_QUARTZ,$process,39 ?? ?? 2C 02 00 00 74 ?? 8B ?? B8 2C 02 00 00 ?? 8B ?? 48 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? 8B)
// raw AOB: 75 ?? 41 8B D4 EB ?? 8B 52 10 48 8B 8B 70 02 00 00 45 33 C9 E8 ?? ?? ?? ?? 48 8B 93 00 02 00 00 8B BA B8 00 00 00 83 FF FF 74 ?? 8B 92 C8 00 00 00 48 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 C0 74 ?? 39 AC B8 2C 02 00 00 74 ?? 8B 94 B8 2C 02 00 00 48 8B 4B 48 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 83 00 02 00 00 8B 88 B8 00 00 00 83 F9 FF 0F 84 ?? ?? ?? ?? 89 8B 0C 02 00 00 40 88 A8 CC 00 00 00 48 8B 80 88 00 00 00 48 8B 88 B0 02 00 00
// injection point AOB: 39 ?? ?? 2C 02 00 00 74 ?? 8B ?? B8 2C 02 00 00 ?? 8B ?? 48 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? 8B ?? 00 02 00 00 8B ?? B8 00 00 00 83 ?? FF 0F 84 ?? ?? ?? ?? 89 ?? 0C 02 00 00 ?? 88 ?? CC 00 00 00 ?? 8B ?? 88 00 00 00 ?? 8B ?? B0 02 00 00
alloc(newmem,$1000,INJECT_GET_CURRENT_QUARTZ)
alloc(INJECT_GET_CURRENT_QUARTZo, $7)
label(code)
label(return)
INJECT_GET_CURRENT_QUARTZo:
readmem(INJECT_GET_CURRENT_QUARTZ, $7)
label(i_bse_cqtz_addr)
newmem:
// AOBMaker migration - what AOBMaker changed below
// old injection: cmp [rax+rsi*4+0000022C],ebx
// new injection: cmp [rax+rdi*4+0000022C],ebp
// register RBX -> RBP
// register RSI -> RDI
// 1 changed line(s) carry a '// AOBMaker was: ...' note above them holding the code before the change.
// To get this script without them, untick 'Note the old code' and migrate again.
// To remove them from this copy in Notepad++: open Replace (Ctrl+H), Search Mode to
// 'Regular expression', leave '. matches newline' UNCHECKED, leave 'Replace with'
// empty, then press Replace All. Copy the pattern from the next line, after the slashes:
// ^[ \t]*// AOBMaker was:[^\r\n]*\R?
// Replace All covers the whole file, so with a .CT open it runs over every script
// in the table. Press Ctrl+Z if the line count drops by more than the note count.
// Read the diff before you enable this. AOBMaker proposes, it does not verify.
// AOBMaker migration end
//push r15
// AOBMaker was: lea rcx, [rax+rsi*4+0000022C]
lea rcx, [rax+rdi*4+0000022C]
mov [i_bse_cqtz_addr], rcx
//pop r15
code:
// cmp [rax+rdi*4+0000022C],ebp
reassemble(INJECT_GET_CURRENT_QUARTZ)
jmp return
align 10 cc
i_bse_cqtz_addr:
dq 0
INJECT_GET_CURRENT_QUARTZ:
jmp newmem
nop 2
return:
registersymbol(INJECT_GET_CURRENT_QUARTZ INJECT_GET_CURRENT_QUARTZo)
registersymbol(i_bse_cqtz_addr)
[DISABLE]
INJECT_GET_CURRENT_QUARTZ:
readmem(INJECT_GET_CURRENT_QUARTZo, $7)
unregistersymbol(INJECT_GET_CURRENT_QUARTZ INJECT_GET_CURRENT_QUARTZo)
dealloc(newmem)
dealloc(INJECT_GET_CURRENT_QUARTZo)
unregistersymbol(i_bse_cqtz_addr)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+1CA660
sora_2nd.exe+1CA61E: 75 05 - jne sora_2nd.exe+1CA625
sora_2nd.exe+1CA620: 41 8B D4 - mov edx,r12d
sora_2nd.exe+1CA623: EB 03 - jmp sora_2nd.exe+1CA628
sora_2nd.exe+1CA625: 8B 52 10 - mov edx,[rdx+10]
sora_2nd.exe+1CA628: 48 8B 8B 70 02 00 00 - mov rcx,[rbx+00000270]
sora_2nd.exe+1CA62F: 45 33 C9 - xor r9d,r9d
sora_2nd.exe+1CA632: E8 79 35 FE FF - call sora_2nd.exe+1ADBB0
sora_2nd.exe+1CA637: 48 8B 93 00 02 00 00 - mov rdx,[rbx+00000200]
sora_2nd.exe+1CA63E: 8B BA B8 00 00 00 - mov edi,[rdx+000000B8]
sora_2nd.exe+1CA644: 83 FF FF - cmp edi,-01
sora_2nd.exe+1CA647: 74 35 - je sora_2nd.exe+1CA67E
sora_2nd.exe+1CA649: 8B 92 C8 00 00 00 - mov edx,[rdx+000000C8]
sora_2nd.exe+1CA64F: 48 8B 0D 12 4B A9 00 - mov rcx,[sora_2nd.exe+C5F168]
sora_2nd.exe+1CA656: E8 C5 0F 27 00 - call sora_2nd.exe+43B620
sora_2nd.exe+1CA65B: 48 85 C0 - test rax,rax
sora_2nd.exe+1CA65E: 74 1E - je sora_2nd.exe+1CA67E
// ---------- INJECTING HERE ----------
sora_2nd.exe+1CA660: 39 AC B8 2C 02 00 00 - cmp [rax+rdi*4+0000022C],ebp
// ---------- DONE INJECTING ----------
sora_2nd.exe+1CA667: 74 15 - je sora_2nd.exe+1CA67E
sora_2nd.exe+1CA669: 8B 94 B8 2C 02 00 00 - mov edx,[rax+rdi*4+0000022C]
sora_2nd.exe+1CA670: 48 8B 4B 48 - mov rcx,[rbx+48]
sora_2nd.exe+1CA674: E8 47 D2 F6 FF - call sora_2nd.exe+1378C0
sora_2nd.exe+1CA679: E9 A8 FD FF FF - jmp sora_2nd.exe+1CA426
sora_2nd.exe+1CA67E: 48 8B CB - mov rcx,rbx
sora_2nd.exe+1CA681: E8 5A BB 00 00 - call sora_2nd.exe+1D61E0
sora_2nd.exe+1CA686: E9 9B FD FF FF - jmp sora_2nd.exe+1CA426
sora_2nd.exe+1CA68B: 48 8B 83 00 02 00 00 - mov rax,[rbx+00000200]
sora_2nd.exe+1CA692: 8B 88 B8 00 00 00 - mov ecx,[rax+000000B8]
sora_2nd.exe+1CA698: 83 F9 FF - cmp ecx,-01
sora_2nd.exe+1CA69B: 0F 84 19 FE FF FF - je sora_2nd.exe+1CA4BA
sora_2nd.exe+1CA6A1: 89 8B 0C 02 00 00 - mov [rbx+0000020C],ecx
sora_2nd.exe+1CA6A7: 40 88 A8 CC 00 00 00 - mov [rax+000000CC],bpl
sora_2nd.exe+1CA6AE: 48 8B 80 88 00 00 00 - mov rax,[rax+00000088]
sora_2nd.exe+1CA6B5: 48 8B 88 B0 02 00 00 - mov rcx,[rax+000002B0]
}
186
"現在のクオーツ / Cur. quartz"
Quartz.ID
0
FF8080
4 Bytes
i_bse_cqtz_addr
0
73
"ステータスビューアー / Char. stats viewer"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_GET_CHAR_STAT,$process,8B ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 0F 28 ?? 0F 28 ?? 39 ?? ?? 75 ?? F3 0F 10 ?? ?? ?? ?? ?? F3 0F 10 ?? ?? ?? ?? ?? F3 0F 11 ?? A8 01 00 00 F3 0F 11 ?? AC 01 00 00 C7 ?? A4 01 00 00 00 00 80 3F C7 ?? 84 01 00 00 00 00 80 3F 8B ?? A8 01 00 00 89 ?? 88 01 00 00 8B ?? AC 01 00 00 F3 0F 11 ?? 98 01 00 00 F3 0F 11 ?? 9C 01 00 00 89 ?? 8C 01 00 00 C7 ?? 94 01 00 00 00 00 80 3F ?? 89 ?? B4 01 00 00 89 ?? BC 01 00 00 66 0F 6E ?? ?? ?? 8B ?? 28)
// raw AOB: 49 8B 87 30 02 00 00 4C 8D 24 C6 49 3B F4 74 ?? 48 8B 0E 48 8D 15 ?? ?? ?? ?? 41 B1 01 41 B8 FE FF FF 7F E8 ?? ?? ?? ?? 4C 8B F8 48 85 C0 75 ?? 48 83 C6 08 49 3B F4 75 ?? 4C 8B FF 8B 55 14 48 8B CB E8 ?? ?? ?? ?? 8B 55 18 49 8B CD E8 ?? ?? ?? ?? 8B 45 18 0F 28 C6 0F 28 CE 39 45 14 75 ?? F3 0F 10 05 ?? ?? ?? ?? F3 0F 10 0D ?? ?? ?? ?? F3 0F 11 83 A8 01 00 00 F3 0F 11 8B AC 01 00 00 C7 83 A4 01 00 00 00 00 80 3F C7 83 84 01 00 00 00 00 80 3F 8B 83 A8 01 00 00
// injection point AOB: 8B ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 0F 28 ?? 0F 28 ?? 39 ?? ?? 75 ?? F3 0F 10 ?? ?? ?? ?? ?? F3 0F 10 ?? ?? ?? ?? ?? F3 0F 11 ?? A8 01 00 00 F3 0F 11 ?? AC 01 00 00 C7 ?? A4 01 00 00 00 00 80 3F C7 ?? 84 01 00 00 00 00 80 3F 8B ?? A8 01 00 00
alloc(newmem,$1000,INJECT_GET_CHAR_STAT)
alloc(INJECT_GET_CHAR_STATo, $6)
label(code)
label(return)
INJECT_GET_CHAR_STATo:
readmem(INJECT_GET_CHAR_STAT, $6)
label(i_base_char_stat_addr)
newmem:
// AOBMaker migration - what AOBMaker changed below
// old injection: mov edx,[rsi+14]
// new injection: mov edx,[rbp+14]
// register RSI -> RBP
// 1 changed line(s) carry a '// AOBMaker was: ...' note above them holding the code before the change.
// To get this script without them, untick 'Note the old code' and migrate again.
// To remove them from this copy in Notepad++: open Replace (Ctrl+H), Search Mode to
// 'Regular expression', leave '. matches newline' UNCHECKED, leave 'Replace with'
// empty, then press Replace All. Copy the pattern from the next line, after the slashes:
// ^[ \t]*// AOBMaker was:[^\r\n]*\R?
// Replace All covers the whole file, so with a .CT open it runs over every script
// in the table. Press Ctrl+Z if the line count drops by more than the note count.
// Read the diff before you enable this. AOBMaker proposes, it does not verify.
// AOBMaker migration end
// AOBMaker was: mov [i_base_char_stat_addr], rsi
mov [i_base_char_stat_addr], rbp
code:
// mov edx,[rbp+14]
reassemble(INJECT_GET_CHAR_STAT)
// mov rcx,rbx
reassemble(INJECT_GET_CHAR_STAT+3)
jmp return
align 10 cc
i_base_char_stat_addr:
dq 0
INJECT_GET_CHAR_STAT:
jmp newmem
nop 1
return:
registersymbol(INJECT_GET_CHAR_STAT INJECT_GET_CHAR_STATo)
registersymbol(i_base_char_stat_addr)
[DISABLE]
INJECT_GET_CHAR_STAT:
readmem(INJECT_GET_CHAR_STATo, $6)
unregistersymbol(INJECT_GET_CHAR_STAT INJECT_GET_CHAR_STATo)
dealloc(newmem)
dealloc(INJECT_GET_CHAR_STATo)
unregistersymbol(i_base_char_stat_addr)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+54074F
sora_2nd.exe+540713: 49 8B 87 30 02 00 00 - mov rax,[r15+00000230]
sora_2nd.exe+54071A: 4C 8D 24 C6 - lea r12,[rsi+rax*8]
sora_2nd.exe+54071E: 49 3B F4 - cmp rsi,r12
sora_2nd.exe+540721: 74 29 - je sora_2nd.exe+54074C
sora_2nd.exe+540723: 48 8B 0E - mov rcx,[rsi]
sora_2nd.exe+540726: 48 8D 15 CB BA 5A 00 - lea rdx,[sora_2nd.exe+AEC1F8]
sora_2nd.exe+54072D: 41 B1 01 - mov r9b,01
sora_2nd.exe+540730: 41 B8 FE FF FF 7F - mov r8d,7FFFFFFE
sora_2nd.exe+540736: E8 45 F0 03 00 - call sora_2nd.exe+57F780
sora_2nd.exe+54073B: 4C 8B F8 - mov r15,rax
sora_2nd.exe+54073E: 48 85 C0 - test rax,rax
sora_2nd.exe+540741: 75 0C - jne sora_2nd.exe+54074F
sora_2nd.exe+540743: 48 83 C6 08 - add rsi,08
sora_2nd.exe+540747: 49 3B F4 - cmp rsi,r12
sora_2nd.exe+54074A: 75 D7 - jne sora_2nd.exe+540723
sora_2nd.exe+54074C: 4C 8B FF - mov r15,rdi
// ---------- INJECTING HERE ----------
sora_2nd.exe+54074F: 8B 55 14 - mov edx,[rbp+14]
// ---------- DONE INJECTING ----------
sora_2nd.exe+540752: 48 8B CB - mov rcx,rbx
sora_2nd.exe+540755: E8 46 8A 0A 00 - call sora_2nd.exe+5E91A0
sora_2nd.exe+54075A: 8B 55 18 - mov edx,[rbp+18]
sora_2nd.exe+54075D: 49 8B CD - mov rcx,r13
sora_2nd.exe+540760: E8 3B 8A 0A 00 - call sora_2nd.exe+5E91A0
sora_2nd.exe+540765: 8B 45 18 - mov eax,[rbp+18]
sora_2nd.exe+540768: 0F 28 C6 - movaps xmm0,xmm6
sora_2nd.exe+54076B: 0F 28 CE - movaps xmm1,xmm6
sora_2nd.exe+54076E: 39 45 14 - cmp [rbp+14],eax
sora_2nd.exe+540771: 75 10 - jne sora_2nd.exe+540783
sora_2nd.exe+540773: F3 0F 10 05 0D AE 5E 00 - movss xmm0,[sora_2nd.exe+B2B588]
sora_2nd.exe+54077B: F3 0F 10 0D 95 AB 5E 00 - movss xmm1,[sora_2nd.exe+B2B318]
sora_2nd.exe+540783: F3 0F 11 83 A8 01 00 00 - movss [rbx+000001A8],xmm0
sora_2nd.exe+54078B: F3 0F 11 8B AC 01 00 00 - movss [rbx+000001AC],xmm1
sora_2nd.exe+540793: C7 83 A4 01 00 00 00 00 80 3F - mov [rbx+000001A4],3F800000
sora_2nd.exe+54079D: C7 83 84 01 00 00 00 00 80 3F - mov [rbx+00000184],3F800000
}
74
"ID? (勿更改 / do not edit)"
Char.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
0
75
"Lv"
0
FF8080
4 Bytes
i_base_char_stat_addr
4
76
"XP"
0
FF8080
4 Bytes
i_base_char_stat_addr
8
77
"HP"
0
FF8080
4 Bytes
i_base_char_stat_addr
C
78
"Max HP"
0
FF8080
4 Bytes
i_base_char_stat_addr
10
79
"EP"
0
FF8080
4 Bytes
i_base_char_stat_addr
14
80
"Max EP"
0
FF8080
4 Bytes
i_base_char_stat_addr
18
81
"CP"
0
FF8080
4 Bytes
i_base_char_stat_addr
1C
82
"Max CP"
0
FF8080
4 Bytes
i_base_char_stat_addr
20
83
"STR"
0
FF8080
4 Bytes
i_base_char_stat_addr
24
84
"DEF"
0
FF8080
4 Bytes
i_base_char_stat_addr
28
85
"ATS"
0
FF8080
4 Bytes
i_base_char_stat_addr
2C
86
"ADF"
0
FF8080
4 Bytes
i_base_char_stat_addr
30
87
"SPD"
0
FF8080
4 Bytes
i_base_char_stat_addr
34
88
"AGL"
0
FF8080
4 Bytes
i_base_char_stat_addr
38
89
"DEX"
0
FF8080
4 Bytes
i_base_char_stat_addr
3C
90
"MOV"
0
FF8080
4 Bytes
i_base_char_stat_addr
40
91
"RNG"
0
FF8080
4 Bytes
i_base_char_stat_addr
44
92
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
48
93
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
4C
94
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
50
95
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
54
96
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
58
97
"??"
0
FF8080
4 Bytes
i_base_char_stat_addr
5C
98
"Hit %"
0
FF8080
4 Bytes
i_base_char_stat_addr
60
99
"Evade %"
0
FF8080
4 Bytes
i_base_char_stat_addr
64
100
"Mgi Evade %"
0
FF8080
4 Bytes
i_base_char_stat_addr
68
101
"Crit %"
0
FF8080
4 Bytes
i_base_char_stat_addr
6C
191
"Spells+"
1
190
"Spell 01"
0
FF8080
2 Bytes
i_base_char_stat_addr
18C
192
"Spell 02"
0
FF8080
2 Bytes
i_base_char_stat_addr
18E
193
"Spell 03"
0
FF8080
2 Bytes
i_base_char_stat_addr
190
194
"Spell 04"
0
FF8080
2 Bytes
i_base_char_stat_addr
192
195
"Spell 05"
0
FF8080
2 Bytes
i_base_char_stat_addr
194
196
"Spell 06"
0
FF8080
2 Bytes
i_base_char_stat_addr
196
197
"Spell 07"
0
FF8080
2 Bytes
i_base_char_stat_addr
198
198
"Spell 08"
0
FF8080
2 Bytes
i_base_char_stat_addr
19A
199
"Spell 09"
0
FF8080
2 Bytes
i_base_char_stat_addr
19C
200
"Spell 10"
0
FF8080
2 Bytes
i_base_char_stat_addr
19E
201
"Spell 11"
0
FF8080
2 Bytes
i_base_char_stat_addr
1A0
202
"Spell 12"
0
FF8080
2 Bytes
i_base_char_stat_addr
1A2
203
"Spell 13"
0
FF8080
2 Bytes
i_base_char_stat_addr
1A4
204
"Spell 14"
0
FF8080
2 Bytes
i_base_char_stat_addr
1A6
205
"Spell 15"
0
FF8080
2 Bytes
i_base_char_stat_addr
1A8
206
"Spell 16"
0
FF8080
2 Bytes
i_base_char_stat_addr
1AA
207
"Spell 17"
0
FF8080
2 Bytes
i_base_char_stat_addr
1AC
208
"Spell 18"
0
FF8080
2 Bytes
i_base_char_stat_addr
1AE
209
"Spell 19"
0
FF8080
2 Bytes
i_base_char_stat_addr
1B0
210
"Spell 20"
0
FF8080
2 Bytes
i_base_char_stat_addr
1B2
211
"Spell 21"
0
FF8080
2 Bytes
i_base_char_stat_addr
1B4
212
"Spell 22"
0
FF8080
2 Bytes
i_base_char_stat_addr
1B6
213
"Spell 23"
0
FF8080
2 Bytes
i_base_char_stat_addr
1B8
214
"Spell 24"
0
FF8080
2 Bytes
i_base_char_stat_addr
1BA
215
"Spell 25"
0
FF8080
2 Bytes
i_base_char_stat_addr
1BC
216
"Spell 26"
0
FF8080
2 Bytes
i_base_char_stat_addr
1BE
217
"Spell 27"
0
FF8080
2 Bytes
i_base_char_stat_addr
1C0
218
"Spell 28"
0
FF8080
2 Bytes
i_base_char_stat_addr
1C2
219
"Spell29"
0
FF8080
2 Bytes
i_base_char_stat_addr
1C4
220
"Spell 30"
0
FF8080
2 Bytes
i_base_char_stat_addr
1C6
221
"Spell 31"
0
FF8080
2 Bytes
i_base_char_stat_addr
1C8
222
"Spell 32"
0
FF8080
2 Bytes
i_base_char_stat_addr
1CA
223
"Spell 33"
0
FF8080
2 Bytes
i_base_char_stat_addr
1CC
224
"Spell 34"
0
FF8080
2 Bytes
i_base_char_stat_addr
1CE
225
"Spell 35"
0
FF8080
2 Bytes
i_base_char_stat_addr
1D0
226
"Spell 36"
0
FF8080
2 Bytes
i_base_char_stat_addr
1D2
227
"Spell 37"
0
FF8080
2 Bytes
i_base_char_stat_addr
1D4
228
"Spell 38"
0
FF8080
2 Bytes
i_base_char_stat_addr
1D6
229
"Spell 39"
0
FF8080
2 Bytes
i_base_char_stat_addr
1D8
230
"Spell 40"
0
FF8080
2 Bytes
i_base_char_stat_addr
1DA
102
"Quartz #1"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
22C
179
"Quartz #2"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
230
180
"Quartz #3"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
234
181
"Quartz #4"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
238
182
"Quartz #5"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
23C
183
"Quartz #6"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
240
231
"Weapon"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
25C
232
"Armour"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
260
233
"Shoe"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
264
234
"Accessory #1"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
268
235
"Accessory #2"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
26C
236
"Costume #1"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
270
237
"Costume #2"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
274
238
"Costume #3"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
278
239
"Costume #4"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
27C
240
"Costume #5"
Quartz.ID
0
FF8080
4 Bytes
i_base_char_stat_addr
280
103
"??"
0
FF8080
Byte
i_base_char_stat_addr
28A
104
"Overdrive"
0
FF8080
Byte
i_base_char_stat_addr
28B
105
"Support EXP"
0
FF8080
4 Bytes
i_base_char_stat_addr
28C
106
"進行中のリワードを取得 / Get on-going reward data / max 50"
Auto Assembler Script
{ Game : ed9.exe
Version:
Date : 2025-09-19
Author : bbfox@https://opencheattables.com
}
[ENABLE]
aobscanmodule(INJECT_GET_ACHIEVEMENT,sora_2nd.exe,8B 8B ?? ?? ?? 00 8B C1 C1 E8 1E 83 F8 01) // should be unique
alloc(newmem,$1000,INJECT_GET_ACHIEVEMENT)
alloc(INJECT_GET_ACHIEVEMENTo, 6)
label(code)
label(return i_base_achi_addr)
INJECT_GET_ACHIEVEMENTo:
readmem(INJECT_GET_ACHIEVEMENT, 6)
newmem:
push r15
push r14
push rcx
xor ecx, ecx
mov dword ptr [i_idx], 0
mov ecx, [INJECT_GET_ACHIEVEMENTo+2]
lea r15, [rbx+rcx]
loop1:
mov ecx, [i_idx]
mov r14, i_base_achi_addr
lea r14, [r14+rcx*8]
cmp qword ptr [r14], r15
je endp
cmp qword ptr [r14], 0
je write_it
jmp chk_next
write_it:
mov [r14], r15
jmp endp
db EB 3B 54
db 68 69 73 20 74
db 61 62 6C 65 20 63 6F 6D 65 73 20 66 72 6F 6D 20 68 74
db 74 70 73 3A 2F
db 2F 6F 70 65 6E 63 68 65
db 61 74 74 61 62 6C 65 73
db 2E 63 6F 6D
db 20 2F 20 43 45 20 37 2E 34 2B
chk_next:
inc dword ptr [i_idx]
cmp dword ptr [i_idx], 33
jb loop1
endp:
pop rcx
pop r14
pop r15
code:
// mov ecx,[rbx+00011100]
reassemble(INJECT_GET_ACHIEVEMENT)
jmp return
align 10 cc
i_idx:
dd 0 0
i_base_achi_addr:
dq 0
align 100 0
db 0
align 100 0
db 0
align 100 0
db 0
INJECT_GET_ACHIEVEMENT:
jmp newmem
nop
return:
registersymbol(INJECT_GET_ACHIEVEMENT i_base_achi_addr)
registersymbol(INJECT_GET_ACHIEVEMENTo)
[DISABLE]
INJECT_GET_ACHIEVEMENT:
//db 8B 8B 00 11 01 00
readmem(INJECT_GET_ACHIEVEMENTo, 6)
unregistersymbol(INJECT_GET_ACHIEVEMENT i_base_achi_addr)
dealloc(newmem)
unregistersymbol(INJECT_GET_ACHIEVEMENTo)
dealloc(INJECT_GET_ACHIEVEMENTo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+239E4
sora_2nd.exe+239B4: 3D 00 01 00 00 - cmp eax,00000100
sora_2nd.exe+239B9: 72 25 - jb sora_2nd.exe+239E0
sora_2nd.exe+239BB: 4C 8D 0D 86 89 7D 00 - lea r9,[sora_2nd.exe+7FC348]
sora_2nd.exe+239C2: 41 B8 5F 02 00 00 - mov r8d,0000025F
sora_2nd.exe+239C8: 48 8D 15 81 88 7D 00 - lea rdx,[sora_2nd.exe+7FC250]
sora_2nd.exe+239CF: B9 03 00 00 00 - mov ecx,00000003
sora_2nd.exe+239D4: E8 97 DD 42 00 - call sora_2nd.exe+451770
sora_2nd.exe+239D9: 44 8B 54 24 78 - mov r10d,[rsp+78]
sora_2nd.exe+239DE: EB 04 - jmp sora_2nd.exe+239E4
sora_2nd.exe+239E0: 48 8D 1C 83 - lea rbx,[rbx+rax*4]
// ---------- INJECTING HERE ----------
sora_2nd.exe+239E4: 8B 8B 00 11 01 00 - mov ecx,[rbx+00011100]
// ---------- DONE INJECTING ----------
sora_2nd.exe+239EA: 8B C1 - mov eax,ecx
sora_2nd.exe+239EC: C1 E8 1E - shr eax,1E
sora_2nd.exe+239EF: 83 F8 01 - cmp eax,01
sora_2nd.exe+239F2: 75 0C - jne sora_2nd.exe+23A00
sora_2nd.exe+239F4: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
sora_2nd.exe+239FB: C1 F8 02 - sar eax,02
sora_2nd.exe+239FE: EB 18 - jmp sora_2nd.exe+23A18
sora_2nd.exe+23A00: 83 F8 02 - cmp eax,02
sora_2nd.exe+23A03: 75 11 - jne sora_2nd.exe+23A16
sora_2nd.exe+23A05: 8D 04 8D 00 00 00 00 - lea eax,[rcx*4+00000000]
}
107
"#1"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr
0
108
"#2"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+8
0
109
"#3"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+10
0
110
"#4"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+18
0
111
"#5"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+20
0
112
"#6"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+28
0
113
"#7"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+30
0
114
"#8"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+38
0
115
"#9"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+40
0
116
"#10"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+48
0
117
"#11"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+50
0
118
"#12"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+58
0
119
"#13"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+60
0
120
"#14"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+68
0
121
"#15"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+70
0
122
"#16"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+78
0
123
"#17"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+80
0
124
"#18"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+88
0
125
"#19"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+90
0
126
"#20"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+98
0
127
"#21"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+A0
0
128
"#22"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+A8
0
129
"#23"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+B0
0
130
"#24"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+B8
0
131
"#25"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+C0
0
132
"#26"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+C8
0
133
"#27"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+D0
0
134
"#28"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+D8
0
135
"#29"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+E0
0
136
"#30"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+E8
0
137
"#31"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+F0
0
138
"#32"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+F8
0
139
"#33"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+100
0
140
"#34"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+108
0
141
"#35"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+110
0
142
"#36"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+118
0
143
"#37"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+120
0
144
"#38"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+128
0
145
"#39"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+130
0
146
"#40"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+138
0
147
"#41"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+140
0
148
"#42"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+148
0
149
"#43"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+150
0
150
"#44"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+158
0
151
"#45"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+160
0
152
"#46"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+168
0
153
"#47"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+170
0
154
"#48"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+178
0
155
"#49"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+180
0
156
"#50"
0
FF8080
Custom
Kueo2 integer
i_base_achi_addr+188
0
157
"レシピ選択時：必要素材を自動補充 / Auto set ingredient amt. when browsing recipes"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_AUTO_COOKING_INGREDIENTS,$process,?? 0F B7 ?? 88 4C 8A 12 00 ?? 8B ?? 28)
// raw AOB: 72 ?? 4C 8D 0D ?? ?? ?? ?? 89 44 24 20 41 B8 BB 04 00 00 48 8D 15 ?? ?? ?? ?? B9 03 00 00 00 E8 ?? ?? ?? ?? EB ?? 8D 88 CA FE FF FF 83 F9 07 77 ?? 48 8B 05 ?? ?? ?? ?? 44 8B A4 88 28 B6 20 00 EB ?? 48 8B C8 48 8B 05 ?? ?? ?? ?? 44 0F B7 A4 88 4C 8A 12 00 49 8B 9E 28 02 00 00 49 8B 86 30 02 00 00 48 8D 3C C3 48 3B DF 74 ?? 0F 1F 80 00 00 00 00 48 8B 0B 48 8D 15 ?? ?? ?? ?? 41 B1 01 45 33 C0 E8 ?? ?? ?? ?? 48 8B E8 48 85 C0 75 ?? 48 83 C3 08 48 3B DF
// injection point AOB: ?? 0F B7 ?? 88 4C 8A 12 00 ?? 8B ?? 28 02 00 00 ?? 8B ?? 30 02 00 00 ?? 8D ?? C3 ?? 3B ?? 74 ?? 0F 1F ?? 00 00 00 00 ?? 8B ?? ?? 8D ?? ?? ?? ?? ?? ?? ?? 01 ?? 33 ?? E8 ?? ?? ?? ?? ?? 8B ?? ?? 85 ?? 75 ?? ?? 83 ?? 08 ?? 3B
alloc(newmem,$1000,INJECT_AUTO_COOKING_INGREDIENTS)
alloc(INJECT_AUTO_COOKING_INGREDIENTSo, $9)
label(code)
label(return)
INJECT_AUTO_COOKING_INGREDIENTSo:
readmem(INJECT_AUTO_COOKING_INGREDIENTS, $9)
label(iw_ingredient_set_to)
newmem:
mov bx, [iw_ingredient_set_to]
cmp word ptr [rax+rcx*4+00128A4C], bx
jae short code
mov [rax+rcx*4+00128A4C], bx
code:
// movzx r12d,word ptr [rax+rcx*4+00128A4C]
reassemble(INJECT_AUTO_COOKING_INGREDIENTS)
jmp return
align 10 cc
iw_ingredient_set_to:
dw #70
INJECT_AUTO_COOKING_INGREDIENTS:
jmp newmem
nop 4
return:
registersymbol(INJECT_AUTO_COOKING_INGREDIENTS INJECT_AUTO_COOKING_INGREDIENTSo)
registersymbol(iw_ingredient_set_to)
[DISABLE]
INJECT_AUTO_COOKING_INGREDIENTS:
readmem(INJECT_AUTO_COOKING_INGREDIENTSo, $9)
unregistersymbol(INJECT_AUTO_COOKING_INGREDIENTS INJECT_AUTO_COOKING_INGREDIENTSo)
dealloc(newmem)
dealloc(INJECT_AUTO_COOKING_INGREDIENTSo)
unregistersymbol(iw_ingredient_set_to)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+4103B9
sora_2nd.exe+41036D: 72 24 - jb sora_2nd.exe+410393
sora_2nd.exe+41036F: 4C 8D 0D 5A E5 6F 00 - lea r9,[sora_2nd.exe+B0E8D0]
sora_2nd.exe+410376: 89 44 24 20 - mov [rsp+20],eax
sora_2nd.exe+41037A: 41 B8 BB 04 00 00 - mov r8d,000004BB
sora_2nd.exe+410380: 48 8D 15 61 E4 6F 00 - lea rdx,[sora_2nd.exe+B0E7E8]
sora_2nd.exe+410387: B9 03 00 00 00 - mov ecx,00000003
sora_2nd.exe+41038C: E8 0F A1 16 00 - call sora_2nd.exe+57A4A0
sora_2nd.exe+410391: EB 2F - jmp sora_2nd.exe+4103C2
sora_2nd.exe+410393: 8D 88 CA FE FF FF - lea ecx,[rax-00000136]
sora_2nd.exe+410399: 83 F9 07 - cmp ecx,07
sora_2nd.exe+41039C: 77 11 - ja sora_2nd.exe+4103AF
sora_2nd.exe+41039E: 48 8B 05 C3 ED 84 00 - mov rax,[sora_2nd.exe+C5F168]
sora_2nd.exe+4103A5: 44 8B A4 88 28 B6 20 00 - mov r12d,[rax+rcx*4+0020B628]
sora_2nd.exe+4103AD: EB 13 - jmp sora_2nd.exe+4103C2
sora_2nd.exe+4103AF: 48 8B C8 - mov rcx,rax
sora_2nd.exe+4103B2: 48 8B 05 AF ED 84 00 - mov rax,[sora_2nd.exe+C5F168]
// ---------- INJECTING HERE ----------
sora_2nd.exe+4103B9: 44 0F B7 A4 88 4C 8A 12 00 - movzx r12d,word ptr [rax+rcx*4+00128A4C]
// ---------- DONE INJECTING ----------
sora_2nd.exe+4103C2: 49 8B 9E 28 02 00 00 - mov rbx,[r14+00000228]
sora_2nd.exe+4103C9: 49 8B 86 30 02 00 00 - mov rax,[r14+00000230]
sora_2nd.exe+4103D0: 48 8D 3C C3 - lea rdi,[rbx+rax*8]
sora_2nd.exe+4103D4: 48 3B DF - cmp rbx,rdi
sora_2nd.exe+4103D7: 74 2D - je sora_2nd.exe+410406
sora_2nd.exe+4103D9: 0F 1F 80 00 00 00 00 - nop dword ptr [rax+00000000]
sora_2nd.exe+4103E0: 48 8B 0B - mov rcx,[rbx]
sora_2nd.exe+4103E3: 48 8D 15 FE CD 6F 00 - lea rdx,[sora_2nd.exe+B0D1E8]
sora_2nd.exe+4103EA: 41 B1 01 - mov r9b,01
sora_2nd.exe+4103ED: 45 33 C0 - xor r8d,r8d
sora_2nd.exe+4103F0: E8 8B F3 16 00 - call sora_2nd.exe+57F780
sora_2nd.exe+4103F5: 48 8B E8 - mov rbp,rax
sora_2nd.exe+4103F8: 48 85 C0 - test rax,rax
sora_2nd.exe+4103FB: 75 0B - jne sora_2nd.exe+410408
sora_2nd.exe+4103FD: 48 83 C3 08 - add rbx,08
sora_2nd.exe+410401: 48 3B DF - cmp rbx,rdi
}
158
"使用法：対象のレシピ閲覧後、料理メニューを開き直す"
8000FF
1
159
"Usage: Browse the related recipe, then reopen the cooking menu
"
8000FF
1
189
"即座に反映 / take effect immediately"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_AUTO_COOKING_INGREDIENTS2,$process,0F B7 ?? 8A 4C 8A 12 00 ?? 0F)
// raw AOB: 4C 8D 0D ?? ?? ?? ?? 89 44 24 20 41 B8 BB 04 00 00 48 8D 15 ?? ?? ?? ?? B9 03 00 00 00 E8 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 33 C9 EB ?? 8D 88 CA FE FF FF 83 F9 07 77 ?? 05 CA FE FF FF 8B 8C 82 28 B6 20 00 EB ?? 8B C8 0F B7 8C 8A 4C 8A 12 00 40 0F B6 C5 3B C8 0F 82 ?? ?? ?? ?? FF C6 48 83 C3 08 3B F7 72 ?? 32 C0 E9 ?? ?? ?? ?? CC CC 48 89 5C 24 10 48 89 74 24 18 57 48 83 EC 30 48 8B 05
// injection point AOB: 0F B7 ?? 8A 4C 8A 12 00 ?? 0F B6 ?? 3B ?? 0F 82 ?? ?? ?? ?? FF ?? ?? 83 ?? 08 3B ?? 72 ?? 32 ?? E9 ?? ?? ?? ?? CC CC ?? 89 ?? 24 ?? ?? 89 ?? 24 ?? ?? 48 83 EC 30 ?? 8B
alloc(newmem,$1000,INJECT_AUTO_COOKING_INGREDIENTS2)
alloc(INJECT_AUTO_COOKING_INGREDIENTS2o, $8)
label(code)
label(return)
INJECT_AUTO_COOKING_INGREDIENTS2o:
readmem(INJECT_AUTO_COOKING_INGREDIENTS2, $8)
newmem:
mov ax, [iw_ingredient_set_to]
cmp word ptr [rdx+rcx*4+00128A4C], ax
jae code
mov [rdx+rcx*4+00128A4C], ax
code:
// movzx ecx,word ptr [rdx+rcx*4+00128A4C]
reassemble(INJECT_AUTO_COOKING_INGREDIENTS2)
jmp return
align 10 cc
INJECT_AUTO_COOKING_INGREDIENTS2:
jmp newmem
nop 3
return:
registersymbol(INJECT_AUTO_COOKING_INGREDIENTS2 INJECT_AUTO_COOKING_INGREDIENTS2o)
[DISABLE]
INJECT_AUTO_COOKING_INGREDIENTS2:
readmem(INJECT_AUTO_COOKING_INGREDIENTS2o, $8)
unregistersymbol(INJECT_AUTO_COOKING_INGREDIENTS2 INJECT_AUTO_COOKING_INGREDIENTS2o)
dealloc(newmem)
dealloc(INJECT_AUTO_COOKING_INGREDIENTS2o)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+412479
sora_2nd.exe+412431: 4C 8D 0D 98 C4 6F 00 - lea r9,[sora_2nd.exe+B0E8D0]
sora_2nd.exe+412438: 89 44 24 20 - mov [rsp+20],eax
sora_2nd.exe+41243C: 41 B8 BB 04 00 00 - mov r8d,000004BB
sora_2nd.exe+412442: 48 8D 15 9F C3 6F 00 - lea rdx,[sora_2nd.exe+B0E7E8]
sora_2nd.exe+412449: B9 03 00 00 00 - mov ecx,00000003
sora_2nd.exe+41244E: E8 4D 80 16 00 - call sora_2nd.exe+57A4A0
sora_2nd.exe+412453: 48 8B 15 0E CD 84 00 - mov rdx,[sora_2nd.exe+C5F168]
sora_2nd.exe+41245A: 33 C9 - xor ecx,ecx
sora_2nd.exe+41245C: EB 23 - jmp sora_2nd.exe+412481
sora_2nd.exe+41245E: 8D 88 CA FE FF FF - lea ecx,[rax-00000136]
sora_2nd.exe+412464: 83 F9 07 - cmp ecx,07
sora_2nd.exe+412467: 77 0E - ja sora_2nd.exe+412477
sora_2nd.exe+412469: 05 CA FE FF FF - add eax,FFFFFECA
sora_2nd.exe+41246E: 8B 8C 82 28 B6 20 00 - mov ecx,[rdx+rax*4+0020B628]
sora_2nd.exe+412475: EB 0A - jmp sora_2nd.exe+412481
sora_2nd.exe+412477: 8B C8 - mov ecx,eax
// ---------- INJECTING HERE ----------
sora_2nd.exe+412479: 0F B7 8C 8A 4C 8A 12 00 - movzx ecx,word ptr [rdx+rcx*4+00128A4C]
// ---------- DONE INJECTING ----------
sora_2nd.exe+412481: 40 0F B6 C5 - movzx eax,bpl
sora_2nd.exe+412485: 3B C8 - cmp ecx,eax
sora_2nd.exe+412487: 0F 82 2A FF FF FF - jb sora_2nd.exe+4123B7
sora_2nd.exe+41248D: FF C6 - inc esi
sora_2nd.exe+41248F: 48 83 C3 08 - add rbx,08
sora_2nd.exe+412493: 3B F7 - cmp esi,edi
sora_2nd.exe+412495: 72 89 - jb sora_2nd.exe+412420
sora_2nd.exe+412497: 32 C0 - xor al,al
sora_2nd.exe+412499: E9 1B FF FF FF - jmp sora_2nd.exe+4123B9
sora_2nd.exe+41249E: CC - int 3
sora_2nd.exe+41249F: CC - int 3
sora_2nd.exe+4124A0: 48 89 5C 24 10 - mov [rsp+10],rbx
sora_2nd.exe+4124A5: 48 89 74 24 18 - mov [rsp+18],rsi
sora_2nd.exe+4124AA: 57 - push rdi
sora_2nd.exe+4124AB: 48 83 EC 30 - sub rsp,30
sora_2nd.exe+4124AF: 48 8B 05 D2 95 84 00 - mov rax,[sora_2nd.exe+C5BA88]
}
160
"最小値 / min. value"
0
C08000
2 Bytes
iw_ingredient_set_to
161
"個別クエスト情報閲覧 / Quest viewer"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/21
}
[ENABLE]
aobscanmodule(INJECT_SINGLE_QUEST_VIEWER,$process,?? 0F B6 ?? D6 0A)
// raw AOB: BA 9F 85 FB 41 C7 84 24 A0 00 00 00 08 00 00 00 48 8D 0D ?? ?? ?? ?? C7 84 24 A4 00 00 00 E7 B5 A5 28 C7 84 24 A8 00 00 00 04 00 00 00 C7 84 24 AC 00 00 00 45 D4 D5 86 C7 84 24 B0 00 00 00 02 00 00 00 C7 84 24 B4 00 00 00 29 2C E0 A2 C7 84 24 B8 00 00 00 20 00 00 00 C7 84 24 BC 00 00 00 A0 88 28 D8 E8 ?? ?? ?? ?? 8B CF 4C 8D 84 24 A0 00 00 00 44 8B D0 48 8D 14 89 48 03 D2 45 0F B6 4C D6 0A 49 8B 08 48 8B D1 48 C1 EA 20 41 85 C9 75 ?? 49 83 C0 08 48 8D 84 24 C0 00 00 00 4C 3B C0 75 ?? EB ?? 44 8B D2 48 8B 9C 24 90 00 00 00 48 8B 05 ?? ?? ?? ?? 44 89 93 EC 02 00 00 48 8B 88 B8 06 00 00 48 85 C9
// injection point AOB: ?? 0F B6 ?? D6 0A ?? 8B ?? ?? 8B ?? ?? C1 ?? 20 ?? 85 ?? 75 ?? ?? 83 ?? 08 ?? 8D ?? 24 ?? 00 00 00 ?? 3B ?? 75 ?? EB ?? ?? 8B ?? ?? 8B ?? 24 ?? 00 00 00 ?? 8B ?? ?? ?? ?? ?? ?? 89 ?? EC 02 00 00 ?? 8B ?? B8 06 00 00 ?? 85
alloc(newmem,$1000,INJECT_SINGLE_QUEST_VIEWER)
alloc(INJECT_SINGLE_QUEST_VIEWERo, $6)
label(code)
label(return)
INJECT_SINGLE_QUEST_VIEWERo:
readmem(INJECT_SINGLE_QUEST_VIEWER, $6)
label(i_base_quest_addr)
newmem:
// AOBMaker migration - what AOBMaker changed below
// old injection: movzx eax,byte ptr [rbp+rdx*8+0A]
// new injection: movzx r9d,byte ptr [r14+rdx*8+0A]
// register RAX -> R9
// register RBP -> R14
// 1 changed line(s) carry a '// AOBMaker was: ...' note above them holding the code before the change.
// To get this script without them, untick 'Note the old code' and migrate again.
// To remove them from this copy in Notepad++: open Replace (Ctrl+H), Search Mode to
// 'Regular expression', leave '. matches newline' UNCHECKED, leave 'Replace with'
// empty, then press Replace All. Copy the pattern from the next line, after the slashes:
// ^[ \t]*// AOBMaker was:[^\r\n]*\R?
// Replace All covers the whole file, so with a .CT open it runs over every script
// in the table. Press Ctrl+Z if the line count drops by more than the note count.
// Read the diff before you enable this. AOBMaker proposes, it does not verify.
// AOBMaker migration end
push r15
// AOBMaker was: lea r15, [rbp+rdx*8]
lea r15, [r14+rdx*8]
mov [i_base_quest_addr], r15
pop r15
code:
// movzx r9d,byte ptr [r14+rdx*8+0A]
reassemble(INJECT_SINGLE_QUEST_VIEWER)
jmp return
align 10 cc
i_base_quest_addr:
dq 0
INJECT_SINGLE_QUEST_VIEWER:
jmp newmem
nop 1
return:
registersymbol(INJECT_SINGLE_QUEST_VIEWER INJECT_SINGLE_QUEST_VIEWERo)
registersymbol(i_base_quest_addr)
[DISABLE]
INJECT_SINGLE_QUEST_VIEWER:
readmem(INJECT_SINGLE_QUEST_VIEWERo, $6)
unregistersymbol(INJECT_SINGLE_QUEST_VIEWER INJECT_SINGLE_QUEST_VIEWERo)
dealloc(newmem)
dealloc(INJECT_SINGLE_QUEST_VIEWERo)
unregistersymbol(i_base_quest_addr)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+42559B
sora_2nd.exe+42551E: BA 9F 85 FB 41 - mov edx,41FB859F
sora_2nd.exe+425523: C7 84 24 A0 00 00 00 08 00 00 00 - mov [rsp+000000A0],00000008
sora_2nd.exe+42552E: 48 8D 0D FC 71 6E 00 - lea rcx,[sora_2nd.exe+B0C731]
sora_2nd.exe+425535: C7 84 24 A4 00 00 00 E7 B5 A5 28 - mov [rsp+000000A4],28A5B5E7
sora_2nd.exe+425540: C7 84 24 A8 00 00 00 04 00 00 00 - mov [rsp+000000A8],00000004
sora_2nd.exe+42554B: C7 84 24 AC 00 00 00 45 D4 D5 86 - mov [rsp+000000AC],86D5D445
sora_2nd.exe+425556: C7 84 24 B0 00 00 00 02 00 00 00 - mov [rsp+000000B0],00000002
sora_2nd.exe+425561: C7 84 24 B4 00 00 00 29 2C E0 A2 - mov [rsp+000000B4],A2E02C29
sora_2nd.exe+42556C: C7 84 24 B8 00 00 00 20 00 00 00 - mov [rsp+000000B8],00000020
sora_2nd.exe+425577: C7 84 24 BC 00 00 00 A0 88 28 D8 - mov [rsp+000000BC],D82888A0
sora_2nd.exe+425582: E8 D9 5C C3 FF - call sora_2nd.exe+5B260
sora_2nd.exe+425587: 8B CF - mov ecx,edi
sora_2nd.exe+425589: 4C 8D 84 24 A0 00 00 00 - lea r8,[rsp+000000A0]
sora_2nd.exe+425591: 44 8B D0 - mov r10d,eax
sora_2nd.exe+425594: 48 8D 14 89 - lea rdx,[rcx+rcx*4]
sora_2nd.exe+425598: 48 03 D2 - add rdx,rdx
// ---------- INJECTING HERE ----------
sora_2nd.exe+42559B: 45 0F B6 4C D6 0A - movzx r9d,byte ptr [r14+rdx*8+0A]
// ---------- DONE INJECTING ----------
sora_2nd.exe+4255A1: 49 8B 08 - mov rcx,[r8]
sora_2nd.exe+4255A4: 48 8B D1 - mov rdx,rcx
sora_2nd.exe+4255A7: 48 C1 EA 20 - shr rdx,20
sora_2nd.exe+4255AB: 41 85 C9 - test r9d,ecx
sora_2nd.exe+4255AE: 75 13 - jne sora_2nd.exe+4255C3
sora_2nd.exe+4255B0: 49 83 C0 08 - add r8,08
sora_2nd.exe+4255B4: 48 8D 84 24 C0 00 00 00 - lea rax,[rsp+000000C0]
sora_2nd.exe+4255BC: 4C 3B C0 - cmp r8,rax
sora_2nd.exe+4255BF: 75 E0 - jne sora_2nd.exe+4255A1
sora_2nd.exe+4255C1: EB 03 - jmp sora_2nd.exe+4255C6
sora_2nd.exe+4255C3: 44 8B D2 - mov r10d,edx
sora_2nd.exe+4255C6: 48 8B 9C 24 90 00 00 00 - mov rbx,[rsp+00000090]
sora_2nd.exe+4255CE: 48 8B 05 CB 9B 83 00 - mov rax,[sora_2nd.exe+C5F1A0]
sora_2nd.exe+4255D5: 44 89 93 EC 02 00 00 - mov [rbx+000002EC],r10d
sora_2nd.exe+4255DC: 48 8B 88 B8 06 00 00 - mov rcx,[rax+000006B8]
sora_2nd.exe+4255E3: 48 85 C9 - test rcx,rcx
}
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+346618
sora_2nd.exe+3465D2: C7 84 24 A8 00 00 00 02 00 00 00 - mov [rsp+000000A8],00000002
sora_2nd.exe+3465DD: C7 84 24 AC 00 00 00 29 2C E0 A2 - mov [rsp+000000AC],A2E02C29
sora_2nd.exe+3465E8: C7 84 24 B0 00 00 00 20 00 00 00 - mov [rsp+000000B0],00000020
sora_2nd.exe+3465F3: C7 84 24 B4 00 00 00 A0 88 28 D8 - mov [rsp+000000B4],D82888A0
sora_2nd.exe+3465FE: E8 5D C1 D2 FF - call sora_2nd.exe+72760
sora_2nd.exe+346603: 41 8B CF - mov ecx,r15d
sora_2nd.exe+346606: 4C 8D 84 24 98 00 00 00 - lea r8,[rsp+00000098]
sora_2nd.exe+34660E: 44 8B C8 - mov r9d,eax
sora_2nd.exe+346611: 48 8D 14 89 - lea rdx,[rcx+rcx*4]
sora_2nd.exe+346615: 48 03 D2 - add rdx,rdx
// ---------- INJECTING HERE ----------
sora_2nd.exe+346618: 0F B6 44 D5 0A - movzx eax,byte ptr [rbp+rdx*8+0A]
// ---------- DONE INJECTING ----------
sora_2nd.exe+34661D: 0F 1F 00 - nop dword ptr [rax]
sora_2nd.exe+346620: 49 8B 08 - mov rcx,[r8]
sora_2nd.exe+346623: 85 C1 - test ecx,eax
sora_2nd.exe+346625: 75 13 - jne sora_2nd.exe+34663A
sora_2nd.exe+346627: 49 83 C0 08 - add r8,08
sora_2nd.exe+34662B: 48 8D 8C 24 B8 00 00 00 - lea rcx,[rsp+000000B8]
sora_2nd.exe+346633: 4C 3B C1 - cmp r8,rcx
sora_2nd.exe+346636: 75 E8 - jne sora_2nd.exe+346620
sora_2nd.exe+346638: EB 07 - jmp sora_2nd.exe+346641
sora_2nd.exe+34663A: 4C 8B C9 - mov r9,rcx
}
162
"使用：查看委託"
8000FF
1
163
"Usage: View quests"
8000FF
1
164
"base"
1
0
808080
8 Bytes
i_base_quest_addr
165
"進捗ステータス / Status"
Quest.StatusID
0
FF8080
Byte
i_base_quest_addr
A
166
"報告フラグ / Reported"
Quest.Completed
0
FF8080
Byte
i_base_quest_addr
B
167
"BPボーナス / Bonus BP"
0
FF8080
Byte
i_base_quest_addr
4C
168
"クエスト全進捗データ取得 / Get all quests progress"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/21
}
[ENABLE]
aobscanmodule(INJECT_GET_QUEST_PROGRESS,$process,?? F6 ?? ?? 0A 04 74 ?? 0F B6)
// raw AOB: 48 63 C1 4C 89 74 24 08 4C 89 3C 24 48 8D 0C 80 48 03 C9 44 8B 74 CB 48 44 8B 7C CB 44 48 8B 1D ?? ?? ?? ?? 41 8B CE 0F AF CA 49 03 CF 0F B7 04 29 66 41 3B C4 73 ?? 4C 8D 04 80 4D 03 C0 42 F6 44 C3 0A 04 74 ?? 0F B6 4C 29 28 42 0F B7 44 C3 4C 03 C8 41 01 0B FF C2 3B D7 72 ?? 4C 8B 3C 24 4C 8B 74 24 08 4C 8B 64 24 38 48 8B 6C 24 28 48 8B 15 ?? ?? ?? ?? 48 8B 7C 24 30 48 8B 5C 24 20 8B 8A 48 11 01 00
// injection point AOB: ?? F6 ?? ?? 0A 04 74 ?? 0F B6 ?? 29 28 ?? 0F B7 ?? C3 4C 03 ?? ?? 01 ?? FF ?? 3B ?? 72 ?? ?? 8B ?? 24 ?? 8B ?? 24 ?? ?? 8B ?? 24 ?? ?? 8B ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? ?? 8B ?? 24 ?? ?? 8B ?? 24 ?? 8B ?? 48 11 01 00
alloc(newmem,$1000,INJECT_GET_QUEST_PROGRESS)
alloc(INJECT_GET_QUEST_PROGRESSo, $6)
label(code)
label(return)
INJECT_GET_QUEST_PROGRESSo:
readmem(INJECT_GET_QUEST_PROGRESS, $6)
label(i_base_quest_data_addrs)
newmem:
// AOBMaker migration - what AOBMaker changed below
// old injection: test byte ptr [rdi+rcx*8+0A],04
// new injection: test byte ptr [rbx+r8*8+0A],04
// register RDI -> RBX
// register RCX -> R8
// 1 changed line(s) carry a '// AOBMaker was: ...' note above them holding the code before the change.
// To get this script without them, untick 'Note the old code' and migrate again.
// To remove them from this copy in Notepad++: open Replace (Ctrl+H), Search Mode to
// 'Regular expression', leave '. matches newline' UNCHECKED, leave 'Replace with'
// empty, then press Replace All. Copy the pattern from the next line, after the slashes:
// ^[ \t]*// AOBMaker was:[^\r\n]*\R?
// Replace All covers the whole file, so with a .CT open it runs over every script
// in the table. Press Ctrl+Z if the line count drops by more than the note count.
// Read the diff before you enable this. AOBMaker proposes, it does not verify.
// AOBMaker migration end
push r15
push r14
push r13
xor r13, r13
// AOBMaker was: lea r15, [rdi+rcx*8]
lea r15, [rbx+r8*8]
loop1:
mov r14, i_base_quest_data_addrs
lea r14, [r14+r13*8]
cmp [r14], r15
je endp
cmp qword ptr [r14], 0
jne @F
//write data
mov [r14], r15
jmp endp
@@:
inc r13
cmp r13, #99
jae endp
jmp loop1
endp:
pop r13
pop r14
pop r15
code:
// test byte ptr [rbx+r8*8+0A],04
reassemble(INJECT_GET_QUEST_PROGRESS)
jmp return
align 10 cc
i_base_quest_data_addrs:
dq 0
align 400 0 0
db 0
INJECT_GET_QUEST_PROGRESS:
jmp newmem
nop 1
return:
registersymbol(INJECT_GET_QUEST_PROGRESS INJECT_GET_QUEST_PROGRESSo)
registersymbol(i_base_quest_data_addrs)
[DISABLE]
INJECT_GET_QUEST_PROGRESS:
readmem(INJECT_GET_QUEST_PROGRESSo, $6)
unregistersymbol(INJECT_GET_QUEST_PROGRESS INJECT_GET_QUEST_PROGRESSo)
dealloc(newmem)
dealloc(INJECT_GET_QUEST_PROGRESSo)
unregistersymbol(i_base_quest_data_addrs)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+4322AB
sora_2nd.exe+43226D: 48 63 C1 - movsxd rax,ecx
sora_2nd.exe+432270: 4C 89 74 24 08 - mov [rsp+08],r14
sora_2nd.exe+432275: 4C 89 3C 24 - mov [rsp],r15
sora_2nd.exe+432279: 48 8D 0C 80 - lea rcx,[rax+rax*4]
sora_2nd.exe+43227D: 48 03 C9 - add rcx,rcx
sora_2nd.exe+432280: 44 8B 74 CB 48 - mov r14d,[rbx+rcx*8+48]
sora_2nd.exe+432285: 44 8B 7C CB 44 - mov r15d,[rbx+rcx*8+44]
sora_2nd.exe+43228A: 48 8B 1D C7 CE 82 00 - mov rbx,[sora_2nd.exe+C5F158]
sora_2nd.exe+432291: 41 8B CE - mov ecx,r14d
sora_2nd.exe+432294: 0F AF CA - imul ecx,edx
sora_2nd.exe+432297: 49 03 CF - add rcx,r15
sora_2nd.exe+43229A: 0F B7 04 29 - movzx eax,word ptr [rcx+rbp]
sora_2nd.exe+43229E: 66 41 3B C4 - cmp ax,r12w
sora_2nd.exe+4322A2: 73 1F - jae sora_2nd.exe+4322C3
sora_2nd.exe+4322A4: 4C 8D 04 80 - lea r8,[rax+rax*4]
sora_2nd.exe+4322A8: 4D 03 C0 - add r8,r8
// ---------- INJECTING HERE ----------
sora_2nd.exe+4322AB: 42 F6 44 C3 0A 04 - test byte ptr [rbx+r8*8+0A],04
// ---------- DONE INJECTING ----------
sora_2nd.exe+4322B1: 74 10 - je sora_2nd.exe+4322C3
sora_2nd.exe+4322B3: 0F B6 4C 29 28 - movzx ecx,byte ptr [rcx+rbp+28]
sora_2nd.exe+4322B8: 42 0F B7 44 C3 4C - movzx eax,word ptr [rbx+r8*8+4C]
sora_2nd.exe+4322BE: 03 C8 - add ecx,eax
sora_2nd.exe+4322C0: 41 01 0B - add [r11],ecx
sora_2nd.exe+4322C3: FF C2 - inc edx
sora_2nd.exe+4322C5: 3B D7 - cmp edx,edi
sora_2nd.exe+4322C7: 72 C8 - jb sora_2nd.exe+432291
sora_2nd.exe+4322C9: 4C 8B 3C 24 - mov r15,[rsp]
sora_2nd.exe+4322CD: 4C 8B 74 24 08 - mov r14,[rsp+08]
sora_2nd.exe+4322D2: 4C 8B 64 24 38 - mov r12,[rsp+38]
sora_2nd.exe+4322D7: 48 8B 6C 24 28 - mov rbp,[rsp+28]
sora_2nd.exe+4322DC: 48 8B 15 8D CE 82 00 - mov rdx,[sora_2nd.exe+C5F170]
sora_2nd.exe+4322E3: 48 8B 7C 24 30 - mov rdi,[rsp+30]
sora_2nd.exe+4322E8: 48 8B 5C 24 20 - mov rbx,[rsp+20]
sora_2nd.exe+4322ED: 8B 8A 48 11 01 00 - mov ecx,[rdx+00011148]
}
{
sora_1st:
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+352ACC
sora_2nd.exe+352AA4: 44 8B 7C CF 44 - mov r15d,[rdi+rcx*8+44]
sora_2nd.exe+352AA9: 48 8B 3D 70 C2 5A 00 - mov rdi,[sora_2nd.exe+8FED20]
sora_2nd.exe+352AB0: 44 8B C5 - mov r8d,ebp
sora_2nd.exe+352AB3: 44 0F AF C2 - imul r8d,edx
sora_2nd.exe+352AB7: 4D 03 C7 - add r8,r15
sora_2nd.exe+352ABA: 41 0F B7 04 18 - movzx eax,word ptr [r8+rbx]
sora_2nd.exe+352ABF: 66 41 3B C4 - cmp ax,r12w
sora_2nd.exe+352AC3: 73 1E - jae sora_2nd.exe+352AE3
sora_2nd.exe+352AC5: 48 8D 0C 80 - lea rcx,[rax+rax*4]
sora_2nd.exe+352AC9: 48 03 C9 - add rcx,rcx
// ---------- INJECTING HERE ----------
sora_2nd.exe+352ACC: F6 44 CF 0A 04 - test byte ptr [rdi+rcx*8+0A],04
// ---------- DONE INJECTING ----------
sora_2nd.exe+352AD1: 74 10 - je sora_2nd.exe+352AE3
sora_2nd.exe+352AD3: 0F B7 4C CF 4C - movzx ecx,word ptr [rdi+rcx*8+4C]
sora_2nd.exe+352AD8: 41 0F B6 44 18 28 - movzx eax,byte ptr [r8+rbx+28]
sora_2nd.exe+352ADE: 03 C8 - add ecx,eax
sora_2nd.exe+352AE0: 41 01 0B - add [r11],ecx
sora_2nd.exe+352AE3: FF C2 - inc edx
sora_2nd.exe+352AE5: 3B D6 - cmp edx,esi
sora_2nd.exe+352AE7: 72 C7 - jb sora_2nd.exe+352AB0
sora_2nd.exe+352AE9: 4C 8B 3C 24 - mov r15,[rsp]
sora_2nd.exe+352AED: 4C 8B 64 24 08 - mov r12,[rsp+08]
}
169
"使用：向公會任務NPC回報"
8000FF
1
170
"Usage: report to guild quests NPC"
8000FF
1
171
"base"
1
0
808080
8 Bytes
i_base_quest_data_addrs
172
"クエスト進行状況リストを生成 / Generate quests status"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
closeLuaEngine2()
-- ====== 可調參數 ======
local PARENT_NAME = "+Quest List (削除不可 / do not delete this)"
local BASE_SYM = "i_base_quest_data_addrs" -- 這裡存放的是 指標陣列 的起始位址
local PTR_COUNT = 99 -- 一共 99 組
local PTR_STRIDE = 0x8 -- 每個指標 8 bytes（64-bit）
-- 顏色（交錯上色，方便閱讀）
local evenColor = 0xFF8000
local oddColor = 0xAA8044
-- ====== 欄位位移定義 ======
local OFF_QUEST_STATUS = 0x0A -- 1 byte
local OFF_COMPLETED = 0x0B -- 1 byte
local OFF_BONUS_BP = 0x4C -- 2 bytes
local OFF_UNKNOWN_04 = 0x04 -- 1 byte
local OFF_QUEST_TYPE = 0x05 -- 1 byte
-- Quest log 子區間：0x0C ~ 0x4A，步長 2
local LOG_BEGIN = 0x0C
local LOG_END = 0x4A
local LOG_STEP = 0x02
local addressList = getAddressList()
-- 讀出指標陣列起點位址（這裡 BASE_SYM 本身是個位址，裡面每 8 bytes 存一個指標）
local baseAddr = getAddress(BASE_SYM)
if not baseAddr or baseAddr == 0 then
print("Read error: cannot resolve symbol '" .. BASE_SYM .. "'")
return
end
-- 小工具：建立單一記錄
local function addRec(desc, addr, vt, parent, opts)
local r = addressList.createMemoryRecord()
r.Description = desc
r.Address = string.format("%X", addr or 0)
r.Vartype = vt
r.Parent = parent
if opts then
if opts.hex ~= nil then r.ShowAsHex = opts.hex end
if opts.color then r.Color = opts.color end
if opts.ddLinked then r.DropDownLinked = opts.ddLinked end
if opts.ddMemrec then r.DropDownLinkedMemrec = opts.ddMemrec end
end
return r
end
synchronize(function()
-- 取得/建立父節點
local parent = addressList.getMemoryRecordByDescription(PARENT_NAME)
if not parent then
parent = addressList.createMemoryRecord()
parent.Description = PARENT_NAME
parent.IsGroupHeader = true
parent.Options = "[moHideChildren]"
end
-- 清掉舊子節點
for i = addressList.Count - 1, 0, -1 do
local mr = addressList[i]
if mr.Parent == parent then mr.delete() end
end
-- 逐筆讀取指標並建立節點
for n = 0, PTR_COUNT - 1 do
-- 讀出第 n 筆任務資料指標
local ptrSlotAddr = baseAddr + (PTR_STRIDE * n)
local questPtr = readPointer(ptrSlotAddr) or 0
-- 外層 Row
local row = addressList.createMemoryRecord()
row.Description = string.format("Row[%03d]", n + 1)
row.IsGroupHeader = true
row.Parent = parent
row.Color = (n % 2 == 0) and evenColor or oddColor
-- === 基本欄位 ===
-- Quest status (1 byte)
addRec("進捗ステータス / Status", questPtr + OFF_QUEST_STATUS, vtByte, row, {ddLinked = true, ddMemrec = "Quest.StatusID"})
-- 讀任務狀態 (byte)
row.Options = "[moHideChildren,moDeactivateChildrenAsWell]"
local statusVal = readBytes(questPtr + OFF_QUEST_STATUS, 1, false) or 0
if statusVal == 0 then
row.Collapsed = true -- 預設收合
row.Active = false
else
row.Collapsed = false -- 預設展開
row.Active = true
end
-- Completed or not (1 byte)
addRec("報告フラグ / Reported", questPtr + OFF_COMPLETED, vtByte, row, {ddLinked = true, ddMemrec = "Quest.Completed"})
-- Bonus BP (2 bytes)
addRec("BPボーナス / Bonus BP", questPtr + OFF_BONUS_BP, vtWord, row, {color = row.Color})
-- Unknown @0x04 (1 byte)
--addRec("Unknown (0x04)", questPtr + OFF_UNKNOWN_04, vtByte, row)
-- Quest type? @0x05 (1 byte)
addRec("クエストタイプ? / Quest type?", questPtr + OFF_QUEST_TYPE, vtByte, row)
-- === Quest log 子節點（預設收合） ===
local logGroup = addressList.createMemoryRecord()
logGroup.Description = "依頼履歴 / Quest log"
logGroup.IsGroupHeader = true
logGroup.Parent = row
logGroup.Options = "[moHideChildren]" -- 允許收合
logGroup.Active = false -- 預設收合
logGroup.Color = (n % 2 == 0) and evenColor or oddColor
-- 0x0C ~ 0x4A，每 2 bytes 一筆（vtWord）
local idx = 1
for off = LOG_BEGIN, LOG_END, LOG_STEP do
addRec(string.format("log ID %d", idx), questPtr + off, vtWord, logGroup, {ddLinked = true, ddMemrec = "Quest.LogID"})
idx = idx + 1
end
end
parent.IsExpanded = true
end)
print(string.format("%d quest rows built to '%s'.", PTR_COUNT, PARENT_NAME))
closeLuaEngine()
[DISABLE]
{$lua}
if syntaxcheck then return end
local PARENT_NAME = "+Quest List (削除不可 / do not delete this)"
local addressList = getAddressList()
synchronize(function()
local parent = addressList.getMemoryRecordByDescription(PARENT_NAME)
if not parent then
print("Cannot find parent node: " .. PARENT_NAME)
return
end
for i = addressList.Count - 1, 0, -1 do
local mr = addressList[i]
if mr.Parent == parent then mr.delete() end
end
parent.Active = false
end)
print("Quest nodes cleared.")
closeLuaEngine()
173
""base" 不得為0 / "base" cannot be 0"
8000FF
1
174
"+Quest List (削除不可 / do not delete this)"
1
260
"視点切替 / カメラ切替 / Change POV [orig. credit to amorrow28, Sora_1st code]"
1
259
"有効化 / Enable change POV [num 0]"
Auto Assembler Script
[ENABLE]
// ========== Configuration Variables ==========
globalalloc(speedModifier,8)
speedModifier:
dd (float)3.0
globalalloc(useMouse,8)
useMouse:
dd (float)1.0
globalalloc(mouseSensitivity,8)
mouseSensitivity:
dd (float)8.0
// ========== AOB Scans ==========
aobscanmodule(cameracoordinates_aob,$process,?? 8B ?? 90 06 00 00 ?? 8B ?? 3E C8)
// raw AOB: F3 44 0F 58 C0 F3 0F 58 F9 F3 0F 58 F2 F3 44 0F 58 54 24 7C F3 44 0F 58 E8 F3 44 0F 58 E1 41 B7 01 F3 44 0F 58 DA 48 83 C3 40 48 3B DE 75 ?? 8B 87 34 07 00 00 D1 E8 4C 8B 15 ?? ?? ?? ?? A8 01 0F 85 ?? ?? ?? ?? 48 8B 8F 90 06 00 00 41 8B 84 3E C8 01 00 00 89 41 08 41 8B 84 3E CC 01 00 00 89 41 0C 41 8B 84 3E D0 01 00 00 89 41 10 48 8B 8F 90 06 00 00 41 8B 84 3E 04 02 00 00 89 41 18 41 8B 84 3E 08 02 00 00 89 41 1C 41 8B 84 3E 0C 02 00 00 89 41 20 48 8B 8F 90 06 00 00 41 8B 84 3E 40 02 00 00 89 41 28
// injection point AOB: ?? 8B ?? 90 06 00 00 ?? 8B ?? 3E C8 01 00 00 89 ?? 08 ?? 8B ?? 3E CC 01 00 00 89 ?? 0C ?? 8B ?? 3E D0 01 00 00 89 ?? 10 ?? 8B ?? 90 06 00 00 ?? 8B ?? 3E 04 02 00 00 89 ?? 18 ?? 8B ?? 3E 08 02 00 00 89 ?? 1C ?? 8B ?? 3E 0C 02 00 00 89 ?? 20 ?? 8B ?? 90 06 00 00 ?? 8B ?? 3E 40 02 00 00 89 ?? 28
aobscanmodule(moveplayer_aob,$process,E8 ?? ?? ?? ?? ?? 8B ?? ?? 0F 28 ?? F3 0F 58 ?? B8)
// raw AOB: 48 8B 86 90 16 01 00 48 89 B8 D8 02 00 00 48 8B 8E 90 16 01 00 48 8B 01 FF 50 10 EB ?? 4C 8D 0D ?? ?? ?? ?? 4C 89 74 24 20 41 B8 C0 01 00 00 48 8D 15 ?? ?? ?? ?? B9 03 00 00 00 E8 ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 48 8D 8B 10 01 00 00 41 0F 28 CA E8 ?? ?? ?? ?? 48 8B 03 41 0F 28 C2 F3 0F 58 83 B8 02 00 00 48 8B CB F3 0F 11 83 B8 02 00 00 FF 50 18 44 0F 28 AC 24 80 01 00 00 0F 28 B4 24 F0 01 00 00 4C 8B BC 24 00 02 00 00 4C 8B B4 24 08 02 00 00 4C 8B A4 24 18 02 00 00 48 8B B4 24 50 02 00 00 84 C0 75 ?? 83 BB 98 00 00 00 03 74
// injection point AOB: E8 ?? ?? ?? ?? ?? 8B ?? ?? 0F 28 ?? F3 0F 58 ?? B8 02 00 00 ?? 8B ?? F3 0F 11 ?? B8 02 00 00 FF ?? 18 ?? 0F 28 ?? ?? ?? ?? 00 00 0F 28 ?? ?? ?? ?? 00 00 ?? 8B ?? 24 ?? ?? 00 00 ?? 8B ?? 24 ?? ?? 00 00 ?? 8B ?? 24 ?? ?? 00 00 ?? 8B ?? 24 ?? ?? 00 00 84 ?? 75 ?? 83 ?? 98 00 00 00 03 74
alloc(moveplayer_aobo, $5)
moveplayer_aobo:
readmem(moveplayer_aob, $5)
// ========== Memory Allocations ==========
alloc(newmem,$100,cameracoordinates_aob)
alloc(cameracoordinates,$100)
alloc(tempBuffer,$80)
registersymbol(cameracoordinates_aob)
registersymbol(moveplayer_aob)
registersymbol(moveplayer_aobo)
registersymbol(cameracoordinates)
registersymbol(tempBuffer)
label(code)
label(return)
// ========== Camera Hook ==========
newmem:
code:
mov rcx,[rdi+00000690]
mov [cameracoordinates],rcx
jmp return
cameracoordinates_aob:
jmp newmem
nop 2
return:
// ========== NOP the camera update instructions ==========
// inject pt: sora_2nd.exe+1278EA - 48 8B 8F 90060000 - mov rcx,[rdi+00000690]
// nop sora_2nd.exe+1278F9 - 89 41 08 - mov [rcx+08],eax
cameracoordinates_aob+F:
nop 3
// sora_2nd.exe+127904 - 89 41 0C - mov [rcx+0C],eax
cameracoordinates_aob+1A:
nop 3
// sora_2nd.exe+12790F - 89 41 10 - mov [rcx+10],eax
cameracoordinates_aob+25:
nop 3
// sora_2nd.exe+127921 - 89 41 18 - mov [rcx+18],eax
cameracoordinates_aob+37:
nop 3
// sora_2nd.exe+12792C - 89 41 1C - mov [rcx+1C],eax
cameracoordinates_aob+42:
nop 3
// sora_2nd.exe+127937 - 89 41 20 - mov [rcx+20],eax
cameracoordinates_aob+4D:
nop 3
// sora_2nd.exe+127949 - 89 41 28 - mov [rcx+28],eax
cameracoordinates_aob+5F:
nop 3
// sora_2nd.exe+127954 - 89 41 2C - mov [rcx+2C],eax
cameracoordinates_aob+6A:
nop 3
// sora_2nd.exe+12795F - 89 41 30 - mov [rcx+30],eax
cameracoordinates_aob+75:
nop 3
// ========== Disable Player Movement ==========
moveplayer_aob:
db 90 90 90 90 90
// ========== Lua Camera Control ==========
{$lua}
if syntaxcheck then return end
function checkKeys()
if not (getForegroundProcess() == getOpenedProcessID()) then return end
if (getAddressSafe("[cameracoordinates]")) then
-- Read configuration
local speed = readFloat("speedModifier")
local use_mouse = readFloat("useMouse")
local mouse_speed = readFloat("mouseSensitivity")
-- Camera Coordinates
local camx = readFloat("[cameracoordinates]+08")
local camy = readFloat("[cameracoordinates]+10")
local camz = readFloat("[cameracoordinates]+0C")
-- Target Coordinates
local targetx = readFloat("[cameracoordinates]+18")
local targety = readFloat("[cameracoordinates]+20")
local targetz = readFloat("[cameracoordinates]+1C")
-- Validate coordinates
if (targetz == nil) or (targetz == camz and targetx == camx and targety == camy) then
return
end
-- Mouse initialization
local new_mouse_x, new_mouse_y = getMousePos()
local mouse_loaded = readInteger("cameracoordinates+38")
if not (mouse_loaded == 1) and (use_mouse == 1) then
new_mouse_x = getScreenWidth() / 2
new_mouse_y = getScreenHeight() / 2
setMousePos(getScreenWidth() / 2, getScreenHeight() / 2)
writeInteger("cameracoordinates+38", 1)
end
-- Mouse movement delta
local mouse_move_x = new_mouse_x - getScreenWidth() / 2
local mouse_move_y = new_mouse_y - getScreenHeight() / 2
-- Calculate camera angles
local camdist = ((targetx - camx)^2 + (targety - camy)^2 + (targetz - camz)^2)^0.5
local tilt = math.atan2(camz - targetz, ((targetx - camx)^2 + (targety - camy)^2)^0.5)
local pan = math.atan2(targetx - camx, targety - camy) + math.rad(180)
-- Trigonometry
local siny = math.sin(pan)
local cosy = math.cos(pan)
local sinp = math.sin(tilt)
local cosp = math.cos(tilt)
-- Movement speed
local movespeed = speed * 0.03
-- Forward
if isKeyPressed(VK_W) then
camx = camx - (siny * movespeed)
camy = camy - (cosy * movespeed)
camz = camz - (sinp * movespeed)
end
-- Left
if isKeyPressed(VK_A) then
camx = camx + (math.sin(pan - math.rad(90)) * movespeed)
camy = camy + (math.cos(pan - math.rad(90)) * movespeed)
end
-- Back
if isKeyPressed(VK_S) then
camx = camx + (siny * movespeed)
camy = camy + (cosy * movespeed)
camz = camz + (sinp * movespeed)
end
-- Right
if isKeyPressed(VK_D) then
camx = camx - (math.sin(pan - math.rad(90)) * movespeed)
camy = camy - (math.cos(pan - math.rad(90)) * movespeed)
end
-- Diagonal movement combinations
if isKeyPressed(VK_W) and isKeyPressed(VK_D) then
camx = camx - (math.sin(pan - math.rad(45)) * movespeed)
camy = camy - (math.cos(pan - math.rad(45)) * movespeed)
camz = camz - (sinp * movespeed)
end
if isKeyPressed(VK_W) and isKeyPressed(VK_A) then
camx = camx - (math.sin(pan + math.rad(45)) * movespeed)
camy = camy - (math.cos(pan + math.rad(45)) * movespeed)
camz = camz - (sinp * movespeed)
end
if isKeyPressed(VK_S) and isKeyPressed(VK_A) then
camx = camx + (math.sin(pan - math.rad(45)) * movespeed)
camy = camy + (math.cos(pan - math.rad(45)) * movespeed)
camz = camz + (sinp * movespeed)
end
if isKeyPressed(VK_S) and isKeyPressed(VK_D) then
camx = camx + (math.sin(pan + math.rad(45)) * movespeed)
camy = camy + (math.cos(pan + math.rad(45)) * movespeed)
camz = camz + (sinp * movespeed)
end
-- Vertical movement
if isKeyPressed(VK_R) then
camz = camz + (speed * 0.02)
end
if isKeyPressed(VK_F) then
camz = camz - (speed * 0.02)
end
-- Camera rotation
if isKeyPressed(VK_L) then
pan = pan - speed * 0.01
end
if isKeyPressed(VK_J) then
pan = pan + speed * 0.01
end
if isKeyPressed(VK_I) then
tilt = math.max(tilt - speed * 0.01, math.rad(-89.5))
end
if isKeyPressed(VK_K) then
tilt = math.min(tilt + speed * 0.01, math.rad(89.5))
end
-- Mouse rotation
if (use_mouse == 1) then
if not(mouse_move_y == 0) then
tilt = math.min(math.max(tilt + mouse_move_y * mouse_speed * 0.0003, math.rad(-89.5)), math.rad(89.5))
end
if not(mouse_move_x == 0) then
pan = pan - mouse_move_x * mouse_speed * 0.0003
end
setMousePos(getScreenWidth() / 2, getScreenHeight() / 2)
end
-- Copy original memory to temp buffer
copyMemory("[cameracoordinates]+08", 48, "tempBuffer")
-- Write new values to temp buffer
writeFloat("tempBuffer+00", camx)
writeFloat("tempBuffer+08", camy)
writeFloat("tempBuffer+04", camz)
writeFloat("tempBuffer+10", camx - (camdist * math.cos(tilt) * math.sin(pan)))
writeFloat("tempBuffer+18", camy - (camdist * math.cos(tilt) * math.cos(pan)))
writeFloat("tempBuffer+14", camz - (camdist * math.sin(tilt)))
-- Anti-vomit settings
writeFloat("tempBuffer+20", 0)
writeFloat("tempBuffer+24", 1)
writeFloat("tempBuffer+28", 0)
-- Copy buffer back to game memory
copyMemory("tempBuffer", 48, "[cameracoordinates]+08")
-- Speed modifiers
if isKeyPressed(VK_F3) then
writeFloat("speedModifier", 12)
elseif isKeyPressed(VK_F2) then
writeFloat("speedModifier", 6)
elseif isKeyPressed(VK_F1) then
writeFloat("speedModifier", 0.5)
else
writeFloat("speedModifier", 3)
end
-- Mouse toggle
if isKeyPressed(VK_PRIOR) then
writeFloat("useMouse", 1)
elseif isKeyPressed(VK_NEXT) then
writeFloat("useMouse", 0)
writeInteger("cameracoordinates+38", 0)
end
end
end
-- Timer setup
t = createTimer(nil)
timer_setInterval(t, 10)
timer_onTimer(t, checkKeys)
timer_setEnabled(t, true)
{$asm}
[DISABLE]
{$lua}
if syntaxcheck then return end
timer_setEnabled(t, false)
{$asm}
// Restore original code
cameracoordinates_aob:
db 48 8B 8F 90 06 00 00 41 8B 84 3E C8 01 00 00 89 41 08 41 8B 84 3E CC 01
db 00 00 89 41 0C 41 8B 84 3E D0 01 00 00 89 41 10 48 8B 8F 90 06 00 00 41
db 8B 84 3E 04 02 00 00 89 41 18 41 8B 84 3E 08 02 00 00 89 41 1C 41 8B 84
db 3E 0C 02 00 00 89 41 20 48 8B 8F 90 06 00 00 41 8B 84 3E 40 02 00 00 89
db 41 28 41 8B 84 3E 44 02 00 00 89 41 2C 41 8B 84 3E 48 02 00 00 89 41 30
moveplayer_aob:
readmem(moveplayer_aobo, $5)
// Clean up
unregistersymbol(cameracoordinates_aob)
unregistersymbol(moveplayer_aob)
unregistersymbol(moveplayer_aobo)
unregistersymbol(cameracoordinates)
unregistersymbol(tempBuffer)
dealloc(cameracoordinates)
dealloc(newmem)
dealloc(tempBuffer)
dealloc(moveplayer_aobo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+1278EA
sora_2nd.exe+1278A4: F3 44 0F 58 C0 - addss xmm8,xmm0
sora_2nd.exe+1278A9: F3 0F 58 F9 - addss xmm7,xmm1
sora_2nd.exe+1278AD: F3 0F 58 F2 - addss xmm6,xmm2
sora_2nd.exe+1278B1: F3 44 0F 58 54 24 7C - addss xmm10,[rsp+7C]
sora_2nd.exe+1278B8: F3 44 0F 58 E8 - addss xmm13,xmm0
sora_2nd.exe+1278BD: F3 44 0F 58 E1 - addss xmm12,xmm1
sora_2nd.exe+1278C2: 41 B7 01 - mov r15b,01
sora_2nd.exe+1278C5: F3 44 0F 58 DA - addss xmm11,xmm2
sora_2nd.exe+1278CA: 48 83 C3 40 - add rbx,40
sora_2nd.exe+1278CE: 48 3B DE - cmp rbx,rsi
sora_2nd.exe+1278D1: 75 9E - jne sora_2nd.exe+127871
sora_2nd.exe+1278D3: 8B 87 34 07 00 00 - mov eax,[rdi+00000734]
sora_2nd.exe+1278D9: D1 E8 - shr eax,1
sora_2nd.exe+1278DB: 4C 8B 15 36 78 B3 00 - mov r10,[sora_2nd.exe+C5F118]
sora_2nd.exe+1278E2: A8 01 - test al,01
sora_2nd.exe+1278E4: 0F 85 84 01 00 00 - jne sora_2nd.exe+127A6E
// ---------- INJECTING HERE ----------
sora_2nd.exe+1278EA: 48 8B 8F 90 06 00 00 - mov rcx,[rdi+00000690]
// ---------- DONE INJECTING ----------
sora_2nd.exe+1278F1: 41 8B 84 3E C8 01 00 00 - mov eax,[r14+rdi+000001C8]
sora_2nd.exe+1278F9: 89 41 08 - mov [rcx+08],eax
sora_2nd.exe+1278FC: 41 8B 84 3E CC 01 00 00 - mov eax,[r14+rdi+000001CC]
sora_2nd.exe+127904: 89 41 0C - mov [rcx+0C],eax
sora_2nd.exe+127907: 41 8B 84 3E D0 01 00 00 - mov eax,[r14+rdi+000001D0]
sora_2nd.exe+12790F: 89 41 10 - mov [rcx+10],eax
sora_2nd.exe+127912: 48 8B 8F 90 06 00 00 - mov rcx,[rdi+00000690]
sora_2nd.exe+127919: 41 8B 84 3E 04 02 00 00 - mov eax,[r14+rdi+00000204]
sora_2nd.exe+127921: 89 41 18 - mov [rcx+18],eax
sora_2nd.exe+127924: 41 8B 84 3E 08 02 00 00 - mov eax,[r14+rdi+00000208]
sora_2nd.exe+12792C: 89 41 1C - mov [rcx+1C],eax
sora_2nd.exe+12792F: 41 8B 84 3E 0C 02 00 00 - mov eax,[r14+rdi+0000020C]
sora_2nd.exe+127937: 89 41 20 - mov [rcx+20],eax
sora_2nd.exe+12793A: 48 8B 8F 90 06 00 00 - mov rcx,[rdi+00000690]
sora_2nd.exe+127941: 41 8B 84 3E 40 02 00 00 - mov eax,[r14+rdi+00000240]
sora_2nd.exe+127949: 89 41 28 - mov [rcx+28],eax
sora_2nd.exe+12794C - 41 8B 84 3E 44020000 - mov eax,[r14+rdi+00000244]
sora_2nd.exe+127954 - 89 41 2C - mov [rcx+2C],eax
sora_2nd.exe+127957 - 41 8B 84 3E 48020000 - mov eax,[r14+rdi+00000248]
sora_2nd.exe+12795F - 89 41 30 - mov [rcx+30],eax
sora_2nd.exe+127962 - 41 0F10 84 3E 28030000 - movups xmm0,[r14+rdi+00000328]
sora_2nd.exe+12796B - 0F11 45 A0 - movups [rbp-60],xmm0
sora_2nd.exe+12796F - F2 41 0F10 8C 3E 38030000 - movsd xmm1,[r14+rdi+00000338]
sora_2nd.exe+127979 - F2 0F11 4D B0 - movsd [rbp-50],xmm1
sora_2nd.exe+12797E - 83 BF 30070000 00 - cmp dword ptr [rdi+00000730],00
sora_2nd.exe+127985 - 0F85 86000000 - jne sora_2nd.exe+127A11
sora_2nd.exe+12798B - 49 8B 82 60070000 - mov rax,[r10+00000760]
sora_2nd.exe+127992 - 83 B8 88C22000 03 - cmp dword ptr [rax+0020C288],03
sora_2nd.exe+127999 - 74 76 - je sora_2nd.exe+127A11
sora_2nd.exe+12799B - 48 8B 05 C677B300 - mov rax,[sora_2nd.exe+C5F168]
sora_2nd.exe+1279A2 - 0FB6 80 413A6200 - movzx eax,byte ptr [rax+00623A41]
sora_2nd.exe+1279A9 - F3 0F10 0D 4742A000 - movss xmm1,[sora_2nd.exe+B2BBF8]
sora_2nd.exe+1279B1 - 83 F8 05 - cmp eax,05
}
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+26BDD9
sora_2nd.exe+26BDA3: 4C 8D 0D AE 10 59 00 - lea r9,[sora_2nd.exe+7FCE58]
sora_2nd.exe+26BDAA: 48 89 74 24 20 - mov [rsp+20],rsi
sora_2nd.exe+26BDAF: 41 B8 A6 01 00 00 - mov r8d,000001A6
sora_2nd.exe+26BDB5: 48 8D 15 64 15 59 00 - lea rdx,[sora_2nd.exe+7FD320]
sora_2nd.exe+26BDBC: B9 03 00 00 00 - mov ecx,00000003
sora_2nd.exe+26BDC1: E8 DA 59 1E 00 - call sora_2nd.exe+4517A0
sora_2nd.exe+26BDC6: 48 8B CB - mov rcx,rbx
sora_2nd.exe+26BDC9: E8 92 31 00 00 - call sora_2nd.exe+26EF60
sora_2nd.exe+26BDCE: 48 8D 8B F0 00 00 00 - lea rcx,[rbx+000000F0]
sora_2nd.exe+26BDD5: 41 0F 28 C9 - movaps xmm1,xmm9
// ---------- INJECTING HERE ----------
sora_2nd.exe+26BDD9: E8 22 D6 00 00 - call sora_2nd.exe+279400
// ---------- DONE INJECTING ----------
sora_2nd.exe+26BDDE: 48 8B 03 - mov rax,[rbx]
sora_2nd.exe+26BDE1: 41 0F 28 C1 - movaps xmm0,xmm9
sora_2nd.exe+26BDE5: F3 0F 58 83 88 02 00 00 - addss xmm0,[rbx+00000288]
sora_2nd.exe+26BDED: 48 8B CB - mov rcx,rbx
sora_2nd.exe+26BDF0: F3 0F 11 83 88 02 00 00 - movss [rbx+00000288],xmm0
sora_2nd.exe+26BDF8: FF 50 18 - call qword ptr [rax+18]
sora_2nd.exe+26BDFB: 44 0F 28 74 24 70 - movaps xmm14,[rsp+70]
sora_2nd.exe+26BE01: 0F 28 B4 24 F0 00 00 00 - movaps xmm6,[rsp+000000F0]
sora_2nd.exe+26BE09: 4C 8B BC 24 00 01 00 00 - mov r15,[rsp+00000100]
sora_2nd.exe+26BE11: 4C 8B B4 24 08 01 00 00 - mov r14,[rsp+00000108]
sora_2nd.exe+26BE19 - 48 8B BC 24 48010000 - mov rdi,[rsp+00000148]
sora_2nd.exe+26BE21 - 48 8B B4 24 40010000 - mov rsi,[rsp+00000140]
sora_2nd.exe+26BE29 - 84 C0 - test al,al
sora_2nd.exe+26BE2B - 75 0A - jne sora_2nd.exe+26BE37
sora_2nd.exe+26BE2D - 83 7B 78 03 - cmp dword ptr [rbx+78],03
sora_2nd.exe+26BE31 - 74 04 - je sora_2nd.exe+26BE37
sora_2nd.exe+26BE33 - 4C 89 63 70 - mov [rbx+70],r12
sora_2nd.exe+26BE37 - 45 33 C0 - xor r8d,r8d
sora_2nd.exe+26BE3A - 41 0F28 C9 - movaps xmm1,xmm9
sora_2nd.exe+26BE3E - 48 8B CB - mov rcx,rbx
sora_2nd.exe+26BE41 - E8 2A820000 - call sora_2nd.exe+274070
sora_2nd.exe+26BE46 - 48 8B 43 40 - mov rax,[rbx+40]
sora_2nd.exe+26BE4A - 48 8B 88 381D0000 - mov rcx,[rax+00001D38]
sora_2nd.exe+26BE51 - 48 8B 89 78050000 - mov rcx,[rcx+00000578]
sora_2nd.exe+26BE58 - E8 831DE3FF - call sora_2nd.exe+9DBE0
}
Toggle Activation
96
0
Activate
Deactivate
262
"使用：【W / A / S / D】移動、【R / F】上昇・下降、【マウス移動】視点回転（カメラ操作）"
8000FF
1
264
"使用：【I / J / K / L】カメラ操作、【Page Up】マウス操作ON、【Page Down】マウス操作OFF"
8000FF
1
265
"使用：【F1】超低速モード、【F2】高速モード、【F3】超高速モード、【入力なし】通常速度"
8000FF
1
263
"Usage: W, A, S, D: move; R, F:up/down; Mouse: change view"
8000FF
1
266
"Usage: I, J, K, L: view angle; PgUp: enable mouse. PgDn: Disable mouse"
8000FF
1
267
"Usage: F1: Slow speed, F2: fast speed, F3: Ultra fast speed"
8000FF
1
279
"ccords.base"
1
0
808080
8 Bytes
cameracoordinates
280
"camx"
0
FF8080
Float
+0
8
281
"camy"
0
FF8080
Float
+0
10
282
"camz"
0
FF8080
Float
+0
C
283
"targetx"
0
FF8080
Float
+0
18
284
"targety"
0
FF8080
Float
+0
20
285
"targetz"
0
FF8080
Float
+0
1C
261
"HUD非表示 / Hide HUD [F7]"
Auto Assembler Script
{
Generated by AOBMaker, bbfox@https://github.com/bbfox0703/AOBMaker-Release
Date : 2026/08/20
}
[ENABLE]
aobscanmodule(INJECT_HIDE_HUD,$process,F3 0F 11 ?? 78 ?? 85)
// raw AOB: 89 47 48 8B 87 A8 01 00 00 89 47 4C 8B 87 AC 01 00 00 89 47 50 8B 87 E0 01 00 00 89 47 58 8B 87 E4 01 00 00 89 47 5C 8B 87 E8 01 00 00 89 47 60 F3 0F 10 86 DC 00 00 00 F3 0F 59 87 04 02 00 00 48 8B 8F 80 00 00 00 8B 87 C0 00 00 00 89 87 C4 00 00 00 F3 0F 11 47 78 48 85 C9 0F 84 ?? ?? ?? ?? 8B 87 A0 00 00 00 83 E0 0E 3C 0E 0F 85 ?? ?? ?? ?? F3 0F 10 41 08 F3 0F 11 85 E0 00 00 00 F3 0F 10 49 0C F3 0F 11 8D E4 00 00 00 F3 0F 10 41 10 F3 0F 11 85 E8 00 00 00 F3 0F 10 49 14 F3 0F 11 8D EC 00 00 00 F3 0F 10 41 18 F3 0F 11 85 F0 00 00 00
// injection point AOB: F3 0F 11 ?? 78 ?? 85 ?? 0F 84 ?? ?? ?? ?? 8B ?? A0 00 00 00 83 ?? 0E 3C 0E 0F 85 ?? ?? ?? ?? F3 0F 10 ?? 08 F3 0F 11 ?? ?? 00 00 00 F3 0F 10 ?? 0C F3 0F 11 ?? ?? 00 00 00 F3 0F 10 ?? 10 F3 0F 11 ?? ?? 00 00 00 F3 0F 10 ?? 14 F3 0F 11 ?? ?? 00 00 00 F3 0F 10 ?? 18 F3 0F 11 ?? ?? 00 00 00
alloc(newmem,$1000,INJECT_HIDE_HUD)
alloc(INJECT_HIDE_HUDo, $5)
label(code)
label(return)
INJECT_HIDE_HUDo:
readmem(INJECT_HIDE_HUD, $5)
newmem:
pxor xmm0, xmm0
code:
// movss [rdi+78],xmm0
reassemble(INJECT_HIDE_HUD)
jmp return
align 10 cc
INJECT_HIDE_HUD:
jmp newmem
return:
registersymbol(INJECT_HIDE_HUD INJECT_HIDE_HUDo)
[DISABLE]
INJECT_HIDE_HUD:
readmem(INJECT_HIDE_HUDo, $5)
unregistersymbol(INJECT_HIDE_HUD INJECT_HIDE_HUDo)
dealloc(newmem)
dealloc(INJECT_HIDE_HUDo)
{
// ORIGINAL CODE - INJECTION POINT: sora_2nd.exe+57E81A
sora_2nd.exe+57E7C7: 89 47 48 - mov [rdi+48],eax
sora_2nd.exe+57E7CA: 8B 87 A8 01 00 00 - mov eax,[rdi+000001A8]
sora_2nd.exe+57E7D0: 89 47 4C - mov [rdi+4C],eax
sora_2nd.exe+57E7D3: 8B 87 AC 01 00 00 - mov eax,[rdi+000001AC]
sora_2nd.exe+57E7D9: 89 47 50 - mov [rdi+50],eax
sora_2nd.exe+57E7DC: 8B 87 E0 01 00 00 - mov eax,[rdi+000001E0]
sora_2nd.exe+57E7E2: 89 47 58 - mov [rdi+58],eax
sora_2nd.exe+57E7E5: 8B 87 E4 01 00 00 - mov eax,[rdi+000001E4]
sora_2nd.exe+57E7EB: 89 47 5C - mov [rdi+5C],eax
sora_2nd.exe+57E7EE: 8B 87 E8 01 00 00 - mov eax,[rdi+000001E8]
sora_2nd.exe+57E7F4: 89 47 60 - mov [rdi+60],eax
sora_2nd.exe+57E7F7: F3 0F 10 86 DC 00 00 00 - movss xmm0,[rsi+000000DC]
sora_2nd.exe+57E7FF: F3 0F 59 87 04 02 00 00 - mulss xmm0,[rdi+00000204]
sora_2nd.exe+57E807: 48 8B 8F 80 00 00 00 - mov rcx,[rdi+00000080]
sora_2nd.exe+57E80E: 8B 87 C0 00 00 00 - mov eax,[rdi+000000C0]
sora_2nd.exe+57E814: 89 87 C4 00 00 00 - mov [rdi+000000C4],eax
// ---------- INJECTING HERE ----------
sora_2nd.exe+57E81A: F3 0F 11 47 78 - movss [rdi+78],xmm0
// ---------- DONE INJECTING ----------
sora_2nd.exe+57E81F: 48 85 C9 - test rcx,rcx
sora_2nd.exe+57E822: 0F 84 08 03 00 00 - je sora_2nd.exe+57EB30
sora_2nd.exe+57E828: 8B 87 A0 00 00 00 - mov eax,[rdi+000000A0]
sora_2nd.exe+57E82E: 83 E0 0E - and eax,0E
sora_2nd.exe+57E831: 3C 0E - cmp al,0E
sora_2nd.exe+57E833: 0F 85 D2 00 00 00 - jne sora_2nd.exe+57E90B
sora_2nd.exe+57E839: F3 0F 10 41 08 - movss xmm0,[rcx+08]
sora_2nd.exe+57E83E: F3 0F 11 85 E0 00 00 00 - movss [rbp+000000E0],xmm0
sora_2nd.exe+57E846: F3 0F 10 49 0C - movss xmm1,[rcx+0C]
sora_2nd.exe+57E84B: F3 0F 11 8D E4 00 00 00 - movss [rbp+000000E4],xmm1
sora_2nd.exe+57E853: F3 0F 10 41 10 - movss xmm0,[rcx+10]
sora_2nd.exe+57E858: F3 0F 11 85 E8 00 00 00 - movss [rbp+000000E8],xmm0
sora_2nd.exe+57E860: F3 0F 10 49 14 - movss xmm1,[rcx+14]
sora_2nd.exe+57E865: F3 0F 11 8D EC 00 00 00 - movss [rbp+000000EC],xmm1
sora_2nd.exe+57E86D: F3 0F 10 41 18 - movss xmm0,[rcx+18]
sora_2nd.exe+57E872: F3 0F 11 85 F0 00 00 00 - movss [rbp+000000F0],xmm0
}
Toggle Activation
118
0
175
"空の軌跡 the 2nd DEMO / bbfox@opencheattables.com"
00B300
1
176
"Quest.Completed"
0:いいえ / No
1:はい / Yes
1
270
"Char.ID"
0:艾絲芾爾 / エステル / Estelle
1:約書亞 / ヨシュア / Joshua
2:シェラザード / Scherazard
3:オリビエ / Olivier
4:克蘿賽 / クローゼ / Kloe
5:阿加特 / アガット / Agate
6:ティータ / Tita
7:陣 / ジン / Zin
101:アネラス
1
187
"Quartz.ID"
1
177
"Quest.StatusID"
0:未開始 / not started
4:(未確認) 失敗? / Failed?
16:依頼前 / 未受注 / before accept
18:達成済み / completed
22:報告済み / reported
48:進行中 / 受注中 / in progress
50:達成済み / completed
52:報告済み / reported
54:報告済み / reported
1
178
"Quest.LogID"
255:無効値 / Empty
1
The movement algorithm is based on Cyber's CS4 script, adapted for Kuro's engine by me. Credit also goes to DhaosCollider for AOB (from Kuro CLE) for FOV, to lock player movement, and for the fantastic idea of using the latter to allow WASD control. My eternal gratitude to both!
--[[
[ENABLE]
{$lua}
if syntaxcheck then return end
]]--
-- **デバッグモードの設定 (デフォルト: 無効)**
local debugMode = false
-- AOBScanModule関数
if not AOBScanModule then
function AOBScanModule(moduleName, signature, scanOptions)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then
if debugMode then print("❗ Error: Module " .. moduleName .. " not found!") end
return nil
end
if debugMode then
print(string.format("✔️ %s Base Address: 0x%X", moduleName, baseAddr))
print(string.format("🔬 Scanning Range: 0x%X - 0x%X", baseAddr, maxAddr))
end
local ms = createMemScan()
synchronize(function()
ms.firstScan(
soExactValue,
vtByteArray,
nil,
signature,
nil,
baseAddr,
maxAddr,
scanOptions or "+X+R",
fsmNotAligned,
"1",
true,
true,
false,
false
)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addr
synchronize(function()
if results.getCount() > 0 then
addr = results[0]
end
end)
if addr then
if debugMode then print("🔦 AOB found at: 0x" .. addr) end
else
if debugMode then print("💔 AOB not found in " .. moduleName) end
end
results.destroy()
ms.destroy()
return addr
end
end
registerLuaFunctionHighlight('AOBScanModule')
--[[
test AOBScanModule()
local aob_addr_str = AOBScanModule("???.exe", "48 8B 05 ?? ?? ?? ?? 33 ED 48 8B 88", "+X+R")
if aob_addr_str then
print("🔦 Final AOB Address: 0x" .. aob_addr_str)
else
print("💔 AOB not found in ???.exe")
end
]]--
-- AOBScanModuleN関数
if not AOBScanModuleN then
function AOBScanModuleN(moduleName, signature, maxResults, scanOptions)
local baseAddr = nil
local maxAddr = 0
local modList
synchronize(function()
modList = enumModules()
end)
for _, mod in ipairs(modList) do
if string.lower(mod.Name) == string.lower(moduleName) then
baseAddr = mod.Address
maxAddr = baseAddr + mod.Size
break
end
end
if not baseAddr then
if debugMode then print("❗ Error: Module " .. moduleName .. " not found!") end
return nil
end
if debugMode then
print(string.format("✔️ %s Base Address: 0x%X", moduleName, baseAddr))
print(string.format("🔬 Scanning Range: 0x%X - 0x%X", baseAddr, maxAddr))
end
local ms = createMemScan()
synchronize(function()
ms.firstScan(
soExactValue,
vtByteArray,
nil,
signature,
nil,
baseAddr,
maxAddr,
scanOptions or "+X+R",
fsmNotAligned,
"1",
true,
true,
false,
false
)
end)
ms.waitTillDone()
local results = createFoundList(ms)
results.initialize()
local addrs = {}
synchronize(function()
local count = results.getCount()
for i = 0, math.min(maxResults - 1, count - 1) do
table.insert(addrs, results[i])
if debugMode then
print(string.format("🔦 AOB[%d] found at: 0x%s", i + 1, results[i]))
end
end
end)
if #addrs == 0 and debugMode then
print("💔 AOB not found in " .. moduleName)
end
results.destroy()
ms.destroy()
return addrs
end
end
registerLuaFunctionHighlight('AOBScanModuleN')
-- 搜尋並取出最多5筆結果
--[[
local list = AOBScanModuleN("GameModule.exe", "12 34 56 ?? 78", 5)
if list then
for i, addr in ipairs(list) do
print(string.format("地址 %d: 0x%s", i, addr))
end
end
]]--
-- Lua scripts that table checkbox will not be checked with "NO_ACTIVATE" in comment/script body
if not onMemRecPostExecute then
function onMemRecPostExecute(memoryrecord, newState, succeeded)
if memoryrecord.Type == vtAutoAssembler and memoryrecord.Script:find("NO_ACTIVATE") and newState and succeeded then
synchronize(function()
memoryrecord.disableWithoutExecute()
end)
end
end
end
-- Memory record IDs now allowed to be 'locked'
IDs = {999999, 9999999}
-- Determine event trigger sequence
if not contains then
function contains(table, val)
for i = 1, #table do
if table[i] == val then
return true
end
end
return false
end
end
if not onMemRecPreExecute then
function onMemRecPreExecute(memoryrecord, newstate)
if contains(IDs, memoryrecord.ID) and newstate then
synchronize(function()
if not memoryrecord.OnActivate then
memoryrecord.OnActivate = function(memoryrecord, before, currentstate)
return false
end
end
end)
end
end
end
-- Utility Functions
-- Clear lua engine log
if not clearLuaLog then
function clearLuaLog()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
end)
end
end
registerLuaFunctionHighlight('clearLuaLog')
-- Close lua engine log
if not closeLuaEngine then
function closeLuaEngine()
synchronize(function()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine')
-- Clear lua engine log & close lua engine
if not closeLuaEngine2 then
function closeLuaEngine2()
synchronize(function()
getLuaEngine().MenuItem5.doClick()
getLuaEngine().Close()
end)
end
end
registerLuaFunctionHighlight('closeLuaEngine2')
if not getProcessNameFromPID then
function getProcessNameFromPID(pid)
local sl = createStringList()
getProcessList(sl)
local hexPid = string.format("%X", pid):upper()
for i = 0, sl.Count - 1 do
local entry = sl[i]
local hexid, name = entry:match("^(%x+)%-(.+)$")
if hexid and name then
if tonumber(hexid, 16) == pid then
return name
end
end
end
return "(unknown)"
end
end
registerLuaFunctionHighlight('getProcessNameFromPID')
if not printProcessInfo then
function printProcessInfo()
local pid = getOpenedProcessID()
local name = getProcessNameFromPID(pid)
print(string.format("📎 Attached to process: %s (PID: %d / 0x%X)", name, pid, pid))
end
end
registerLuaFunctionHighlight('printProcessInfo')
if not dumpProcessListAndFindPID then
function dumpProcessListAndFindPID()
local pid = getOpenedProcessID()
print(string.format("💭 Current PID: %d / 0x%X", pid, pid))
local sl = createStringList()
getProcessList(sl)
print("🧾 Dumping process list:")
for i = 0, sl.Count - 1 do
local entry = sl[i]
print(string.format("[%d] %s", i, entry))
-- 嘗試解析並比對 PID
local name, hexid = entry:match("(.+)%-(%x+)$")
if name and hexid then
local parsed = tonumber(hexid, 16)
if parsed == pid then
print("🔦 Match found in process list:")
print(string.format("Name: %s | PID: %s (0x%s)", name, parsed, hexid))
end
end
end
end
end
registerLuaFunctionHighlight('dumpProcessListAndFindPID')
if not toHex32 then
function toHex32(num)
local hexstr = "0123456789ABCDEF"
local result = ""
if num < 0 then
num = (num + (1 << 32)) % (1 << 32) -- 轉成32-bit補數
end
for i = 1, 8 do -- 32-bit 一共8個hex位
local n = num & 0xF -- 取最低4 bit
result = hexstr:sub(n + 1, n + 1) .. result
num = num >> 4 -- 右移4 bit
end
return result
end
end
registerLuaFunctionHighlight('toHex32')
if not toHex then
function toHex(num)
local hexstr = "0123456789ABCDEF"
local result = ""
if num < 0 then
num = (num + (1 << 64)) % (1 << 64) -- 轉成64-bit補數
end
for i = 1, 16 do -- 每4 bit 一個 hex字，64-bit總共16個hex位
local n = num & 0xF -- 取最低4bit
result = hexstr:sub(n + 1, n + 1) .. result
num = num >> 4 -- 右移4bit
end
return result
end
end
registerLuaFunctionHighlight('toHex')
synchronize(function() AddressList.Header.OnSectionClick = nil end)
--[[
[DISABLE]
{$lua}
if AOBScanModule then
AOBScanModule = nil
end
if onMemRecPostExecute then
onMemRecPostExecute = nil
end
if onMemRecPreExecute then
onMemRecPreExecute = nil
end
if clearLuaLog then
clearLuaLog = nil
end
if closeLuaEngine then
closeLuaEngine = nil
end
if closeLuaEngine2 then
closeLuaEngine2 = nil
end
]]--