14 "GodMode" Auto Assembler Script { ============================================================================ Game : Expeditions: Rome Executable : ExpeditionsRome-Win64-Shipping.exe Game Version : 1.6 Steam Build : 16180202 (current public branch) Table Version : 1.0.0 Script : GodMode Created : 2026-08-31 Last Updated : 2026-09-09 Author : Mortlock What it does: - Prevents FRIENDLY units from losing HP during tactical combat. - Friendly faction is identified by [R9+0x100] == 2. - HP is written at [R9+0xA8]. - If proposed HP (ECX) is lower than current HP (R10D), the write is skipped. - HP increases/healing are still allowed; enemy HP writes are unchanged. Notes: - Uses an AOB scan of the game's HP write, making it less dependent on a fixed executable address. - Do NOT enable at the same time as EnemyGodMode; both hook the same HP write. ============================================================================ } [ENABLE] aobscanmodule(GodModeFriendlies,ExpeditionsRome-Win64-Shipping.exe,41 89 89 A8 00 00 00) alloc(newmemGod,$1000,GodModeFriendlies) label(codeGod) label(returnGod) newmemGod: // Is this a friendly unit? cmp dword ptr [r9+00000100],2 jne codeGod // Friendly: // ECX = new HP // R10D = old HP // If HP is decreasing, block it. cmp ecx,r10d jl returnGod codeGod: mov [r9+000000A8],ecx jmp returnGod GodModeFriendlies: jmp newmemGod nop 2 returnGod: registersymbol(GodModeFriendlies) [DISABLE] GodModeFriendlies: db 41 89 89 A8 00 00 00 unregistersymbol(GodModeFriendlies) dealloc(newmemGod) { // ORIGINAL CODE - INJECTION POINT: "ExpeditionsRome-Win64-Shipping.exe"+6F76F3 "ExpeditionsRome-Win64-Shipping.exe"+6F76D6: EB 06 - jmp "ExpeditionsRome-Win64-Shipping.exe"+6F76DE "ExpeditionsRome-Win64-Shipping.exe"+6F76D8: 8B 89 D4 00 00 00 - mov ecx,[rcx+000000D4] "ExpeditionsRome-Win64-Shipping.exe"+6F76DE: 45 85 C0 - test r8d,r8d "ExpeditionsRome-Win64-Shipping.exe"+6F76E1: 79 04 - jns "ExpeditionsRome-Win64-Shipping.exe"+6F76E7 "ExpeditionsRome-Win64-Shipping.exe"+6F76E3: 33 C9 - xor ecx,ecx "ExpeditionsRome-Win64-Shipping.exe"+6F76E5: EB 07 - jmp "ExpeditionsRome-Win64-Shipping.exe"+6F76EE "ExpeditionsRome-Win64-Shipping.exe"+6F76E7: 44 3B C1 - cmp r8d,ecx "ExpeditionsRome-Win64-Shipping.exe"+6F76EA: 41 0F 4C C8 - cmovl ecx,r8d "ExpeditionsRome-Win64-Shipping.exe"+6F76EE: 41 3B CA - cmp ecx,r10d "ExpeditionsRome-Win64-Shipping.exe"+6F76F1: 74 14 - je "ExpeditionsRome-Win64-Shipping.exe"+6F7707 // ---------- INJECTING HERE ---------- "ExpeditionsRome-Win64-Shipping.exe"+6F76F3: 41 89 89 A8 00 00 00 - mov [r9+000000A8],ecx // ---------- DONE INJECTING ---------- "ExpeditionsRome-Win64-Shipping.exe"+6F76FA: 45 33 C0 - xor r8d,r8d "ExpeditionsRome-Win64-Shipping.exe"+6F76FD: 49 8B C9 - mov rcx,r9 "ExpeditionsRome-Win64-Shipping.exe"+6F7700: 33 D2 - xor edx,edx "ExpeditionsRome-Win64-Shipping.exe"+6F7702: E9 99 D2 FF FF - jmp "ExpeditionsRome-Win64-Shipping.exe"+6F49A0 "ExpeditionsRome-Win64-Shipping.exe"+6F7707: C3 - ret "ExpeditionsRome-Win64-Shipping.exe"+6F7708: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F7709: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F770A: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F770B: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F770C: CC - int 3 } 17 "UnlimitedMovement" Auto Assembler Script { ============================================================================ Game : Expeditions: Rome Executable : ExpeditionsRome-Win64-Shipping.exe Game Version : 1.6 Steam Build : 16180202 (current public branch) Table Version : 1.0.0 Script : UnlimitedMovement Created : 2026-08-30 Last Updated : 2026-09-09 Author : Mortlock What it does: - Prevents FRIENDLY units from spending/decreasing movement during combat. - Friendly faction is identified by [R9+0x100] == 2. - Movement is written at [R9+0xC0]. - If proposed movement (ECX) is lower than current movement (R10D), the write is skipped. - Movement increases/resets are still allowed; enemy movement is unchanged. Notes: - Effectively provides unlimited tactical movement for friendly units while preserving normal increases and turn/reset behaviour. - Uses an AOB scan rather than a fixed executable address. ============================================================================ } [ENABLE] aobscanmodule(UnlimitedMovement,ExpeditionsRome-Win64-Shipping.exe,41 89 89 C0 00 00 00) alloc(newmem,$1000,UnlimitedMovement) label(code) label(return) newmem: // +100 appears to identify faction: // 2 = friendly // 1 = enemy cmp dword ptr [r9+00000100],2 jne code // Friendly unit. // ECX = proposed new movement // R10D = previous movement // Only block reductions. cmp ecx,r10d jl return code: mov [r9+000000C0],ecx jmp return UnlimitedMovement: jmp newmem nop 2 return: registersymbol(UnlimitedMovement) [DISABLE] UnlimitedMovement: db 41 89 89 C0 00 00 00 unregistersymbol(UnlimitedMovement) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: "ExpeditionsRome-Win64-Shipping.exe"+6F7A93 "ExpeditionsRome-Win64-Shipping.exe"+6F7A76: EB 06 - jmp "ExpeditionsRome-Win64-Shipping.exe"+6F7A7E "ExpeditionsRome-Win64-Shipping.exe"+6F7A78: 8B 89 F4 01 00 00 - mov ecx,[rcx+000001F4] "ExpeditionsRome-Win64-Shipping.exe"+6F7A7E: 45 85 C0 - test r8d,r8d "ExpeditionsRome-Win64-Shipping.exe"+6F7A81: 79 04 - jns "ExpeditionsRome-Win64-Shipping.exe"+6F7A87 "ExpeditionsRome-Win64-Shipping.exe"+6F7A83: 33 C9 - xor ecx,ecx "ExpeditionsRome-Win64-Shipping.exe"+6F7A85: EB 07 - jmp "ExpeditionsRome-Win64-Shipping.exe"+6F7A8E "ExpeditionsRome-Win64-Shipping.exe"+6F7A87: 44 3B C1 - cmp r8d,ecx "ExpeditionsRome-Win64-Shipping.exe"+6F7A8A: 41 0F 4C C8 - cmovl ecx,r8d "ExpeditionsRome-Win64-Shipping.exe"+6F7A8E: 41 3B CA - cmp ecx,r10d "ExpeditionsRome-Win64-Shipping.exe"+6F7A91: 74 14 - je "ExpeditionsRome-Win64-Shipping.exe"+6F7AA7 // ---------- INJECTING HERE ---------- "ExpeditionsRome-Win64-Shipping.exe"+6F7A93: 41 89 89 C0 00 00 00 - mov [r9+000000C0],ecx // ---------- DONE INJECTING ---------- "ExpeditionsRome-Win64-Shipping.exe"+6F7A9A: 45 33 C0 - xor r8d,r8d "ExpeditionsRome-Win64-Shipping.exe"+6F7A9D: 49 8B C9 - mov rcx,r9 "ExpeditionsRome-Win64-Shipping.exe"+6F7AA0: B2 02 - mov dl,02 "ExpeditionsRome-Win64-Shipping.exe"+6F7AA2: E9 F9 CE FF FF - jmp "ExpeditionsRome-Win64-Shipping.exe"+6F49A0 "ExpeditionsRome-Win64-Shipping.exe"+6F7AA7: C3 - ret "ExpeditionsRome-Win64-Shipping.exe"+6F7AA8: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F7AA9: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F7AAA: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F7AAB: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F7AAC: CC - int 3 } 16 "UnlimitedActionPoints" Auto Assembler Script { ============================================================================ Game : Expeditions: Rome Executable : ExpeditionsRome-Win64-Shipping.exe Game Version : 1.6 Steam Build : 16180202 (current public branch) Table Version : 1.0.0 Script : UnlimitedActionPoints Created : 2026-08-31 Last Updated : 2026-09-09 Author : Mortlock What it does: - Prevents FRIENDLY units from spending/decreasing Action Points (AP). - Friendly faction is identified by [R9+0x100] == 2. - AP is written at [R9+0xB4]. - If proposed AP (ECX) is lower than current AP (R10D), the write is skipped. - AP increases/resets are still allowed; enemy AP writes are unchanged. Notes: - Effectively keeps friendly AP available for repeated actions, subject to any other game restrictions such as skill cooldowns or charges. - Uses an AOB scan rather than a fixed executable address. ============================================================================ } [ENABLE] aobscanmodule(UnlimitedActionPoints,ExpeditionsRome-Win64-Shipping.exe,41 89 89 B4 00 00 00) alloc(newmemAP,$1000,UnlimitedActionPoints) label(codeAP) label(returnAP) newmemAP: // Friendly unit? cmp dword ptr [r9+00000100],2 jne codeAP // Friendly: // ECX = proposed new AP // R10D = old AP // Block decreases such as 1 -> 0 cmp ecx,r10d jl returnAP codeAP: mov [r9+000000B4],ecx jmp returnAP UnlimitedActionPoints: jmp newmemAP nop 2 returnAP: registersymbol(UnlimitedActionPoints) [DISABLE] UnlimitedActionPoints: db 41 89 89 B4 00 00 00 unregistersymbol(UnlimitedActionPoints) dealloc(newmemAP) { // ORIGINAL CODE - INJECTION POINT: "ExpeditionsRome-Win64-Shipping.exe"+6F75D3 "ExpeditionsRome-Win64-Shipping.exe"+6F75B6: EB 06 - jmp "ExpeditionsRome-Win64-Shipping.exe"+6F75BE "ExpeditionsRome-Win64-Shipping.exe"+6F75B8: 8B 89 3C 02 00 00 - mov ecx,[rcx+0000023C] "ExpeditionsRome-Win64-Shipping.exe"+6F75BE: 45 85 C0 - test r8d,r8d "ExpeditionsRome-Win64-Shipping.exe"+6F75C1: 79 04 - jns "ExpeditionsRome-Win64-Shipping.exe"+6F75C7 "ExpeditionsRome-Win64-Shipping.exe"+6F75C3: 33 C9 - xor ecx,ecx "ExpeditionsRome-Win64-Shipping.exe"+6F75C5: EB 07 - jmp "ExpeditionsRome-Win64-Shipping.exe"+6F75CE "ExpeditionsRome-Win64-Shipping.exe"+6F75C7: 44 3B C1 - cmp r8d,ecx "ExpeditionsRome-Win64-Shipping.exe"+6F75CA: 41 0F 4C C8 - cmovl ecx,r8d "ExpeditionsRome-Win64-Shipping.exe"+6F75CE: 41 3B CA - cmp ecx,r10d "ExpeditionsRome-Win64-Shipping.exe"+6F75D1: 74 14 - je "ExpeditionsRome-Win64-Shipping.exe"+6F75E7 // ---------- INJECTING HERE ---------- "ExpeditionsRome-Win64-Shipping.exe"+6F75D3: 41 89 89 B4 00 00 00 - mov [r9+000000B4],ecx // ---------- DONE INJECTING ---------- "ExpeditionsRome-Win64-Shipping.exe"+6F75DA: 45 33 C0 - xor r8d,r8d "ExpeditionsRome-Win64-Shipping.exe"+6F75DD: 49 8B C9 - mov rcx,r9 "ExpeditionsRome-Win64-Shipping.exe"+6F75E0: B2 03 - mov dl,03 "ExpeditionsRome-Win64-Shipping.exe"+6F75E2: E9 B9 D3 FF FF - jmp "ExpeditionsRome-Win64-Shipping.exe"+6F49A0 "ExpeditionsRome-Win64-Shipping.exe"+6F75E7: C3 - ret "ExpeditionsRome-Win64-Shipping.exe"+6F75E8: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F75E9: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F75EA: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F75EB: CC - int 3 "ExpeditionsRome-Win64-Shipping.exe"+6F75EC: CC - int 3 } 40 "NoSkillCooldowns" Auto Assembler Script { ============================================================================ Game : Expeditions: Rome Executable : ExpeditionsRome-Win64-Shipping.exe Game Version : 1.6 Steam Build : 16180202 (current public branch) Table Version : 1.0.0 Script : NoSkillCooldowns Created : 2026-09-01 Last Updated : 2026-09-09 Author : Mortlock What it does: - Removes the normal post-use skill cooldown and prevents skill charges from decreasing, allowing affected skills to be used repeatedly. - Cooldown field: skill object +0x1A0. When the cooldown becomes 1, the script immediately restores it to 0. - Charge field: skill object +0x198. Writes that would reduce the current charge count are blocked; equal or increased charge values are allowed. Technical notes: - The cooldown section uses an AOB hook inside the game executable. - The charge section hooks VCRUNTIME140._NLG_Return2+102A and validates the destination against skill object +0x198 before blocking a decrease. - There is NO friendly/enemy faction check in this script. If enemy skill objects use the same code paths, they may also receive the effect. - The VCRUNTIME hook is more version/runtime-sensitive than the AOB scripts and should be rechecked if the game or VC runtime files change. ============================================================================ } [ENABLE] // ============================================================ // SKILL COOLDOWNS // ============================================================ aobscanmodule(NoSkillCooldowns,ExpeditionsRome-Win64-Shipping.exe,FF 54 C5 00 48 8B 4B 20 0F B6 11 80 FA 04) alloc(newmemCooldown,$1000,NoSkillCooldowns) label(returnCooldown) label(cleanupCooldown) newmemCooldown: // RCX = skill object base // R11 = cooldown address = RCX+1A0 sub rsp,30 mov [rsp+20],rcx mov [rsp+28],r11 // Original call call qword ptr [rbp+rax*8+00] // Is destination skill object +1A0? mov rdx,[rsp+20] add rdx,000001A0 cmp [rsp+28],rdx jne cleanupCooldown // Cooldown becoming 1 -> restore to 0 mov rdx,[rsp+28] cmp dword ptr [rdx],1 jne cleanupCooldown mov dword ptr [rdx],0 cleanupCooldown: add rsp,30 // Original instruction mov rcx,[rbx+20] jmp returnCooldown NoSkillCooldowns: jmp newmemCooldown nop 3 returnCooldown: registersymbol(NoSkillCooldowns) // ============================================================ // SKILL CHARGES // ============================================================ define(NoSkillCharges,VCRUNTIME140._NLG_Return2+102A) alloc(newmemCharges,$1000,NoSkillCharges) label(normalChargeWrite) newmemCharges: // Original instruction mov ecx,[rdx] // At the actual charge write: // R12 = skill object base // RAX = charge address // charge field = skill object +198 lea r10,[r12+00000198] // Is this really the charge field? cmp rax,r10 jne normalChargeWrite // Block only decreases. cmp ecx,[rax] jae normalChargeWrite // Do not write the reduced charge count. ret normalChargeWrite: mov [rax],ecx ret NoSkillCharges: jmp newmemCharges registersymbol(NoSkillCharges) [DISABLE] // Restore cooldown hook NoSkillCooldowns: db FF 54 C5 00 48 8B 4B 20 // Restore original VCRUNTIME helper NoSkillCharges: db 8B 0A 89 08 C3 unregistersymbol(NoSkillCooldowns) unregistersymbol(NoSkillCharges) dealloc(newmemCooldown) dealloc(newmemCharges) { // ORIGINAL CODE - INJECTION POINT: VCRUNTIME140._NLG_Return2+102C VCRUNTIME140._NLG_Return2+1016: 89 08 - mov [rax],ecx VCRUNTIME140._NLG_Return2+1018: 44 88 40 04 - mov [rax+04],r8b VCRUNTIME140._NLG_Return2+101C: C3 - ret VCRUNTIME140._NLG_Return2+101D: 48 8B 0A - mov rcx,[rdx] VCRUNTIME140._NLG_Return2+1020: 48 89 08 - mov [rax],rcx VCRUNTIME140._NLG_Return2+1023: C3 - ret VCRUNTIME140._NLG_Return2+1024: 0F B6 0A - movzx ecx,byte ptr [rdx] VCRUNTIME140._NLG_Return2+1027: 88 08 - mov [rax],cl VCRUNTIME140._NLG_Return2+1029: C3 - ret VCRUNTIME140._NLG_Return2+102A: 8B 0A - mov ecx,[rdx] // ---------- INJECTING HERE ---------- VCRUNTIME140._NLG_Return2+102C: 89 08 - mov [rax],ecx // ---------- DONE INJECTING ---------- VCRUNTIME140._NLG_Return2+102E: C3 - ret VCRUNTIME140._NLG_Return2+102F: 90 - nop VCRUNTIME140._NLG_Return2+1030: 49 83 F8 20 - cmp r8,20 VCRUNTIME140._NLG_Return2+1034: 77 17 - ja VCRUNTIME140._NLG_Return2+104D VCRUNTIME140._NLG_Return2+1036: F3 0F 6F 0A - movdqu xmm1,[rdx] VCRUNTIME140._NLG_Return2+103A: F3 42 0F 6F 54 02 F0 - movdqu xmm2,[rdx+r8-10] VCRUNTIME140._NLG_Return2+1041: F3 0F 7F 09 - movdqu [rcx],xmm1 VCRUNTIME140._NLG_Return2+1045: F3 42 0F 7F 54 01 F0 - movdqu [rcx+r8-10],xmm2 VCRUNTIME140._NLG_Return2+104C: C3 - ret VCRUNTIME140._NLG_Return2+104D: 4E 8D 0C 02 - lea r9,[rdx+r8] } 39 "Testing" 1 38 "EnemyGodMode - Turn off Friendly GodMode" Auto Assembler Script { ============================================================================ Game : Expeditions: Rome Executable : ExpeditionsRome-Win64-Shipping.exe Game Version : 1.6 Steam Build : 16180202 (current public branch) Table Version : 1.0.0 Script : EnemyGodMode Created : 2026-09-01 Last Updated : 2026-09-09 Author : Mortlock What it does: - Prevents ENEMY units from losing HP. Primarily useful as a testing/debug script when checking faction filtering and HP behaviour. - Enemy faction is identified by [R9+0x100] == 1. - HP is written at [R9+0xA8]. - If proposed HP (ECX) is lower than current HP (R10D), the write is skipped. - HP increases/healing are still allowed; friendly HP writes are unchanged. Notes: - Uses the same HP write/signature as the friendly GodMode script. - Do NOT enable at the same time as GodMode. Disable friendly GodMode first. ============================================================================ } [ENABLE] aobscanmodule(EnemyGodModeTest,ExpeditionsRome-Win64-Shipping.exe,41 89 89 A8 00 00 00) alloc(newmemEnemyGod,$1000,EnemyGodModeTest) label(codeEnemyGod) label(returnEnemyGod) newmemEnemyGod: // Enemy faction = 1 // Friendly faction = 2 cmp dword ptr [r9+00000100],1 jne codeEnemyGod // ECX = proposed new HP // R10D = existing HP // If enemy HP is decreasing, block the write. cmp ecx,r10d jl returnEnemyGod codeEnemyGod: mov [r9+000000A8],ecx jmp returnEnemyGod EnemyGodModeTest: jmp newmemEnemyGod nop 2 returnEnemyGod: registersymbol(EnemyGodModeTest) [DISABLE] EnemyGodModeTest: db 41 89 89 A8 00 00 00 unregistersymbol(EnemyGodModeTest) dealloc(newmemEnemyGod) { // ORIGINAL CODE - INJECTION POINT: VCRUNTIME140._NLG_Return2+102C VCRUNTIME140._NLG_Return2+1016: 89 08 - mov [rax],ecx VCRUNTIME140._NLG_Return2+1018: 44 88 40 04 - mov [rax+04],r8b VCRUNTIME140._NLG_Return2+101C: C3 - ret VCRUNTIME140._NLG_Return2+101D: 48 8B 0A - mov rcx,[rdx] VCRUNTIME140._NLG_Return2+1020: 48 89 08 - mov [rax],rcx VCRUNTIME140._NLG_Return2+1023: C3 - ret VCRUNTIME140._NLG_Return2+1024: 0F B6 0A - movzx ecx,byte ptr [rdx] VCRUNTIME140._NLG_Return2+1027: 88 08 - mov [rax],cl VCRUNTIME140._NLG_Return2+1029: C3 - ret VCRUNTIME140._NLG_Return2+102A: 8B 0A - mov ecx,[rdx] // ---------- INJECTING HERE ---------- VCRUNTIME140._NLG_Return2+102C: 89 08 - mov [rax],ecx // ---------- DONE INJECTING ---------- VCRUNTIME140._NLG_Return2+102E: C3 - ret VCRUNTIME140._NLG_Return2+102F: 90 - nop VCRUNTIME140._NLG_Return2+1030: 49 83 F8 20 - cmp r8,20 VCRUNTIME140._NLG_Return2+1034: 77 17 - ja VCRUNTIME140._NLG_Return2+104D VCRUNTIME140._NLG_Return2+1036: F3 0F 6F 0A - movdqu xmm1,[rdx] VCRUNTIME140._NLG_Return2+103A: F3 42 0F 6F 54 02 F0 - movdqu xmm2,[rdx+r8-10] VCRUNTIME140._NLG_Return2+1041: F3 0F 7F 09 - movdqu [rcx],xmm1 VCRUNTIME140._NLG_Return2+1045: F3 42 0F 7F 54 01 F0 - movdqu [rcx+r8-10],xmm2 VCRUNTIME140._NLG_Return2+104C: C3 - ret VCRUNTIME140._NLG_Return2+104D: 4E 8D 0C 02 - lea r9,[rdx+r8] }