1337163400
"<=== Attach to process and activate mono (Game version: 0.1.443)"
0000FF
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
if(getCEVersion() < 7.4) then
ShowMessage('Warning! CE version should be 7.4 or above')
end
OpenProcess("dverghold.exe")
if(process == nil) then
ShowMessage('The process is NOT found!')
end
LaunchMonoDataCollector()
{$asm}
[DISABLE]
1337163823
"-------------- Camp --------------"
008000
1
1337163788
"No Costs for Training"
Auto Assembler Script
define(address,Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+cd )
define(bytes,41 2B CD)
[ENABLE]
assert(address,bytes)
address:
nop 3
[DISABLE]
address:
db bytes
// sub ecx,r13d
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+cd
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+9d: 48 8B C8 - mov rcx,rax
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+a0: 83 39 00 - cmp dword ptr [rcx],00
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+a3: 48 63 80 D0 00 00 00 - movsxd rax,dword ptr [rax+000000D0]
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+aa: 41 3B C5 - cmp eax,r13d
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+ad: 0F 8C 31 01 00 00 - jl Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+1e4
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+b3: 48 B8 E0 31 7A A3 F8 01 00 00 - mov rax,000001F8A37A31E0
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+bd: 48 8B 08 - mov rcx,[rax]
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+c0: 48 8B C1 - mov rax,rcx
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+c3: 83 39 00 - cmp dword ptr [rcx],00
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+c6: 48 63 89 D0 00 00 00 - movsxd rcx,dword ptr [rcx+000000D0]
// ---------- INJECTING HERE ----------
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+cd: 41 2B CD - sub ecx,r13d
// ---------- DONE INJECTING ----------
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+d0: 83 38 00 - cmp dword ptr [rax],00
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+d3: 89 88 D0 00 00 00 - mov [rax+000000D0],ecx
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+d9: 49 8B CF - mov rcx,r15
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+dc: 48 63 55 D8 - movsxd rdx,dword ptr [rbp-28]
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+e0: 41 83 3F 00 - cmp dword ptr [r15],00
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+e4: 66 90 - nop 2
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+e6: 49 BB E0 55 D2 A8 F8 01 00 00 - mov r11,Systems.HubUI.CharacterSkill:Upgrade
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+f0: 41 FF D3 - call r11
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+f3: 49 8B 86 90 00 00 00 - mov rax,[r14+00000090]
Systems.HubUI.CharacterSkillsElement:HandleSkillClicked+fa: 48 8B C8 - mov rcx,rax
}
1337163777
"No Costs when buying Equipment at the Supplier"
Auto Assembler Script
[ENABLE]
aobscanfunction(buying,Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision,2B CA 83 38 00 89 88) // should be unique in this function
alloc(newmem,$100,buying)
label(code)
label(return)
newmem:
add ecx,edx
code:
// sub ecx,edx
cmp dword ptr [rax],00
jmp return
buying:
jmp newmem
return:
registersymbol(buying)
[DISABLE]
buying:
db 2B CA 83 38 00
unregistersymbol(buying)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+548
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+513: 48 8B C8 - mov rcx,rax
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+516: 49 BB 23 99 2D 20 A3 01 00 00 - mov r11,000001A3202D9923
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+520: 41 FF D3 - call r11
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+523: 48 B8 E0 41 EF 21 A3 01 00 00 - mov rax,000001A321EF41E0
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+52d: 48 8B 08 - mov rcx,[rax]
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+530: 48 8B C1 - mov rax,rcx
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+533: 83 39 00 - cmp dword ptr [rcx],00
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+536: 48 63 89 D0 00 00 00 - movsxd rcx,dword ptr [rcx+000000D0]
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+53d: 48 63 97 C0 00 00 00 - movsxd rdx,dword ptr [rdi+000000C0]
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+544: 41 0F AF D5 - imul edx,r13d
// ---------- INJECTING HERE ----------
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+548: 2B CA - sub ecx,edx
// ---------- DONE INJECTING ----------
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+54a: 83 38 00 - cmp dword ptr [rax],00
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+54d: 89 88 D0 00 00 00 - mov [rax+000000D0],ecx
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+553: 49 8B 47 10 - mov rax,[r15+10]
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+557: 48 8B 80 B8 00 00 00 - mov rax,[rax+000000B8]
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+55e: 48 8B 40 40 - mov rax,[rax+40]
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+562: 48 8B C8 - mov rcx,rax
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+565: 48 8B 00 - mov rax,[rax]
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+568: FF 50 68 - call qword ptr [rax+68]
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+56b: 48 B8 E0 41 EF 21 A3 01 00 00 - mov rax,000001A321EF41E0
Systems.HubUI.HubWorldLogic+StateInterface:BuyProvision+575: 48 8B 00 - mov rax,[rax]
}
1337163785
"No Costs for Upgrading the People in the Camp"
Auto Assembler Script
define(address,Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2bd )
define(bytes,41 2B CF)
[ENABLE]
assert(address,bytes)
address:
nop 3
[DISABLE]
address:
db bytes
// sub ecx,r15d
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2bd
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+28b: F2 0F 10 D0 - movsd xmm2,xmm0
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+28f: F2 0F 5A D2 - cvtsd2ss xmm2,xmm2
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+293: 83 38 00 - cmp dword ptr [rax],00
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+296: 49 BB 60 C2 07 29 A3 01 00 00 - mov r11,SoundManager:PlaySound
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2a0: 41 FF D3 - call r11
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2a3: 48 B8 E0 41 EF 21 A3 01 00 00 - mov rax,000001A321EF41E0
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2ad: 48 8B 00 - mov rax,[rax]
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2b0: 48 8B D0 - mov rdx,rax
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2b3: 83 38 00 - cmp dword ptr [rax],00
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2b6: 48 63 88 D0 00 00 00 - movsxd rcx,dword ptr [rax+000000D0]
// ---------- INJECTING HERE ----------
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2bd: 41 2B CF - sub ecx,r15d
// ---------- DONE INJECTING ----------
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2c0: 83 3A 00 - cmp dword ptr [rdx],00
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2c3: 89 88 D0 00 00 00 - mov [rax+000000D0],ecx
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2c9: 48 B8 E0 41 EF 21 A3 01 00 00 - mov rax,000001A321EF41E0
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2d3: 48 8B 00 - mov rax,[rax]
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2d6: 48 8B C8 - mov rcx,rax
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2d9: 48 8B D6 - mov rdx,rsi
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2dc: 83 38 00 - cmp dword ptr [rax],00
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2df: 48 8D AD 00 00 00 00 - lea rbp,[rbp+00000000]
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2e6: 49 BB D0 DE 01 23 A3 01 00 00 - mov r11,GameStateStore:UpgradeBuilding
Systems.HubUI.HubWorldLogic+StateInterface:UpgradeBuilding+2f0: 41 FF D3 - call r11
}
1337163817
"No Costs when buying at the Blacksmith"
Auto Assembler Script
{ Game : Dverghold.exe
Version:
Date : 2026-08-08
Author : Ich
Description :
<Optional info>
}
[ENABLE]
aobscanfunction(buyequip,Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment,2B CA 83 38 00 89 88) // should be unique in this function
alloc(newmem,$1000,buyequip)
label(code)
label(return)
newmem:
add ecx,edx
code:
// sub ecx,edx
cmp dword ptr [rax],00
jmp return
buyequip:
jmp newmem
return:
registersymbol(buyequip)
[DISABLE]
buyequip:
db 2B CA 83 38 00
unregistersymbol(buyequip)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+251
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+21b: 48 8B C8 - mov rcx,rax
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+21e: 49 BB 93 5C EE 08 01 02 00 00 - mov r11,0000020108EE5C93
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+228: 41 FF D3 - call r11
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+22b: E9 76 00 00 00 - jmp Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+2a6
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+230: 48 B8 F0 CF 1F 0E 01 02 00 00 - mov rax,000002010E1FCFF0
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+23a: 48 8B 08 - mov rcx,[rax]
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+23d: 48 8B C1 - mov rax,rcx
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+240: 83 39 00 - cmp dword ptr [rcx],00
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+243: 48 63 89 D0 00 00 00 - movsxd rcx,dword ptr [rcx+000000D0]
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+24a: 48 63 96 C0 00 00 00 - movsxd rdx,dword ptr [rsi+000000C0]
// ---------- INJECTING HERE ----------
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+251: 2B CA - sub ecx,edx
// ---------- DONE INJECTING ----------
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+253: 83 38 00 - cmp dword ptr [rax],00
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+256: 89 88 D0 00 00 00 - mov [rax+000000D0],ecx
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+25c: 48 8B 47 10 - mov rax,[rdi+10]
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+260: 48 8B 80 B8 00 00 00 - mov rax,[rax+000000B8]
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+267: 48 8B 40 40 - mov rax,[rax+40]
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+26b: 48 8B C8 - mov rcx,rax
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+26e: 48 8B 00 - mov rax,[rax]
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+271: FF 50 68 - call qword ptr [rax+68]
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+274: 48 8B 47 10 - mov rax,[rdi+10]
Systems.HubUI.HubWorldLogic+StateInterface:BuyEquipment+278: 48 8B 80 B8 00 00 00 - mov rax,[rax+000000B8]
}
1337163821
"No Costs at the Healer"
Auto Assembler Script
[ENABLE]
aobscanfunction(healer,Systems.HubUI.HealerActionCosts:GetCost,49 8B C5 48 8B 75 D8 48 8B 7D E0 4C 8B 6D E8) // should be unique in this function
alloc(newmem,$100,healer)
label(code)
label(return)
newmem:
code:
mov rax,0
mov rsi,[rbp-28]
jmp return
healer:
jmp newmem
nop 2
return:
registersymbol(healer)
[DISABLE]
healer:
db 49 8B C5 48 8B 75 D8
unregistersymbol(healer)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.HubUI.HealerActionCosts:GetCost+153
Systems.HubUI.HealerActionCosts:GetCost+12e: 49 8B CF - mov rcx,r15
Systems.HubUI.HealerActionCosts:GetCost+131: 4C 8B C5 - mov r8,rbp
Systems.HubUI.HealerActionCosts:GetCost+134: 49 83 C0 C8 - add r8,-38
Systems.HubUI.HealerActionCosts:GetCost+138: 48 8D 64 24 00 - lea rsp,[rsp+00]
Systems.HubUI.HealerActionCosts:GetCost+13d: 90 - nop
Systems.HubUI.HealerActionCosts:GetCost+13e: 49 BB EE 2F 6B AB 16 02 00 00 - mov r11,00000216AB6B2FEE
Systems.HubUI.HealerActionCosts:GetCost+148: 41 FF D3 - call r11
Systems.HubUI.HealerActionCosts:GetCost+14b: 4C 8B E8 - mov r13,rax
Systems.HubUI.HealerActionCosts:GetCost+14e: EB 03 - jmp Systems.HubUI.HealerActionCosts:GetCost+153
Systems.HubUI.HealerActionCosts:GetCost+150: 45 33 ED - xor r13d,r13d
// ---------- INJECTING HERE ----------
Systems.HubUI.HealerActionCosts:GetCost+153: 49 8B C5 - mov rax,r13
// ---------- DONE INJECTING ----------
Systems.HubUI.HealerActionCosts:GetCost+156: 48 8B 75 D8 - mov rsi,[rbp-28]
Systems.HubUI.HealerActionCosts:GetCost+15a: 48 8B 7D E0 - mov rdi,[rbp-20]
Systems.HubUI.HealerActionCosts:GetCost+15e: 4C 8B 6D E8 - mov r13,[rbp-18]
Systems.HubUI.HealerActionCosts:GetCost+162: 4C 8B 75 F0 - mov r14,[rbp-10]
Systems.HubUI.HealerActionCosts:GetCost+166: 4C 8B 7D F8 - mov r15,[rbp-08]
Systems.HubUI.HealerActionCosts:GetCost+16a: 48 8D 65 00 - lea rsp,[rbp+00]
Systems.HubUI.HealerActionCosts:GetCost+16e: 5D - pop rbp
Systems.HubUI.HealerActionCosts:GetCost+16f: C3 - ret
216AB6B2FD0: 01 04 02 - add [rdx+rax],eax
216AB6B2FD3: 05 04 03 01 50 - add eax,50010304
}
1337163840
"No Costs for fitting items at the Blacksmith"
Auto Assembler Script
define(address,Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b2c)
define(bytes,41 2B CC )
[ENABLE]
assert(address,bytes)
address:
nop 3
return:
[DISABLE]
address:
db bytes
// sub ecx,r12d
{
// ORIGINAL CODE - INJECTION POINT: Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b2c
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+afd: 48 8B 00 - mov rax,[rax]
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b00: 49 BA 78 63 AA 7D 0A 02 00 00 - mov r10,0000020A7DAA6378
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b0a: FF 50 D8 - call qword ptr [rax-28]
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b0d: 48 8B 65 B8 - mov rsp,[rbp-48]
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b11: C3 - ret
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b12: 48 B8 B0 21 6C C9 0A 02 00 00 - mov rax,0000020AC96C21B0
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b1c: 48 8B 08 - mov rcx,[rax]
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b1f: 48 8B C1 - mov rax,rcx
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b22: 83 39 00 - cmp dword ptr [rcx],00
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b25: 48 63 89 E8 00 00 00 - movsxd rcx,dword ptr [rcx+000000E8]
// ---------- INJECTING HERE ----------
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b2c: 41 2B CC - sub ecx,r12d
// ---------- DONE INJECTING ----------
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b2f: 83 38 00 - cmp dword ptr [rax],00
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b32: 89 88 E8 00 00 00 - mov [rax+000000E8],ecx
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b38: 49 8B 4E 10 - mov rcx,[r14+10]
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b3c: 33 D2 - xor edx,edx
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b3e: 49 BB E0 27 7F C3 0A 02 00 00 - mov r11,UnityEngine.Object:op_Inequality
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b48: 41 FF D3 - call r11
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b4b: 85 C0 - test eax,eax
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b4d: 74 14 - je Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b63
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b4f: 49 8B CE - mov rcx,r14
Systems.HubUI.HubWorldLogic+StateInterface:TryApplyFittings+b52: 48 8D 6D 00 - lea rbp,[rbp+00]
}
1337163869
"No Costs at the Priest for Blessings"
Auto Assembler Script
define(address,GameStateStore:RemovePiety+17 )
define(bytes,2B 44 24 08)
[ENABLE]
assert(address,bytes)
address:
nop 4
[DISABLE]
address:
db bytes
// sub eax,[rsp+08]
{
// ORIGINAL CODE - INJECTION POINT: GameStateStore:RemovePiety+17
20ACD9C8087: 00 00 - add [rax],al
20ACD9C8089: 00 00 - add [rax],al
20ACD9C808B: 00 00 - add [rax],al
20ACD9C808D: 00 00 - add [rax],al
20ACD9C808F: 00 48 83 - add [rax-7D],cl
GameStateStore:RemovePiety+2: EC - in al,dx
GameStateStore:RemovePiety+3: 18 48 89 - sbb [rax-77],cl
GameStateStore:RemovePiety+6: 3C 24 - cmp al,24
GameStateStore:RemovePiety+8: 48 8B F9 - mov rdi,rcx
GameStateStore:RemovePiety+b: 48 89 54 24 08 - mov [rsp+08],rdx
GameStateStore:RemovePiety+10: 48 63 87 D8 00 00 00 - movsxd rax,dword ptr [rdi+000000D8]
// ---------- INJECTING HERE ----------
GameStateStore:RemovePiety+17: 2B 44 24 08 - sub eax,[rsp+08]
// ---------- DONE INJECTING ----------
GameStateStore:RemovePiety+1b: 33 D2 - xor edx,edx
GameStateStore:RemovePiety+1d: 33 C9 - xor ecx,ecx
GameStateStore:RemovePiety+1f: 3B D0 - cmp edx,eax
GameStateStore:RemovePiety+21: 48 0F 4F C1 - cmovg rax,rcx
GameStateStore:RemovePiety+25: 89 87 D8 00 00 00 - mov [rdi+000000D8],eax
GameStateStore:RemovePiety+2b: 48 8B 3C 24 - mov rdi,[rsp]
GameStateStore:RemovePiety+2f: 48 83 C4 18 - add rsp,18
GameStateStore:RemovePiety+33: C3 - ret
20ACD9C80C4: 00 00 - add [rax],al
}
1337163841
"Get GameStateStore (e.g. Gold)"
Auto Assembler Script
[ENABLE]
aobscanfunction(partygold,Systems.HubUI.HubWorldLogic:Update,48 63 80 E8 00 00 00 89 85 28 FF FF FF) // should be unique in this function
alloc(newmem,$1000,partygold)
label(code)
label(return)
label(goldamount)
newmem:
mov [goldamount],rax
code:
movsxd rax,dword ptr [rax+000000E8]
jmp return
goldamount:
dq 0
partygold:
jmp newmem
nop 2
return:
registersymbol(partygold goldamount)
[DISABLE]
partygold:
db 48 63 80 E8 00 00 00
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.HubUI.HubWorldLogic:Update+ccb
Systems.HubUI.HubWorldLogic:Update+c96: 49 BB 70 88 F5 6A 0B 02 00 00 - mov r11,Systems.HubUI.HubWorldLogic:GetCurrentResourceDisplayMode
Systems.HubUI.HubWorldLogic:Update+ca0: 41 FF D3 - call r11
Systems.HubUI.HubWorldLogic:Update+ca3: 48 8B F8 - mov rdi,rax
Systems.HubUI.HubWorldLogic:Update+ca6: 85 C0 - test eax,eax
Systems.HubUI.HubWorldLogic:Update+ca8: 0F 85 5A 01 00 00 - jne Systems.HubUI.HubWorldLogic:Update+e08
Systems.HubUI.HubWorldLogic:Update+cae: C7 85 28 FF FF FF 00 00 00 00 - mov [rbp-000000D8],00000000
Systems.HubUI.HubWorldLogic:Update+cb8: 48 B8 B0 21 6C C9 0A 02 00 00 - mov rax,0000020AC96C21B0
Systems.HubUI.HubWorldLogic:Update+cc2: 48 8B 00 - mov rax,[rax]
Systems.HubUI.HubWorldLogic:Update+cc5: 48 8B C8 - mov rcx,rax
Systems.HubUI.HubWorldLogic:Update+cc8: 83 39 00 - cmp dword ptr [rcx],00
// ---------- INJECTING HERE ----------
Systems.HubUI.HubWorldLogic:Update+ccb: 48 63 80 E8 00 00 00 - movsxd rax,dword ptr [rax+000000E8]
// ---------- DONE INJECTING ----------
Systems.HubUI.HubWorldLogic:Update+cd2: 89 85 28 FF FF FF - mov [rbp-000000D8],eax
Systems.HubUI.HubWorldLogic:Update+cd8: 89 85 10 FF FF FF - mov [rbp-000000F0],eax
Systems.HubUI.HubWorldLogic:Update+cde: 48 8B 86 B0 00 00 00 - mov rax,[rsi+000000B0]
Systems.HubUI.HubWorldLogic:Update+ce5: 48 8B C8 - mov rcx,rax
Systems.HubUI.HubWorldLogic:Update+ce8: 83 39 00 - cmp dword ptr [rcx],00
Systems.HubUI.HubWorldLogic:Update+ceb: 4C 8B 70 28 - mov r14,[rax+28]
Systems.HubUI.HubWorldLogic:Update+cef: 4D 8B E6 - mov r12,r14
Systems.HubUI.HubWorldLogic:Update+cf2: 49 8B FC - mov rdi,r12
Systems.HubUI.HubWorldLogic:Update+cf5: 4D 85 E4 - test r12,r12
Systems.HubUI.HubWorldLogic:Update+cf8: 74 18 - je Systems.HubUI.HubWorldLogic:Update+d12
}
1337163842
"piety"
0
4 Bytes
goldamount
d8
1337163844
"Oil left in the Lamp"
0
4 Bytes
goldamount
e4
1337163843
"Gold"
0
4 Bytes
goldamount
e8
1337163845
"Moonstonedust"
0
4 Bytes
goldamount
f4
1337163846
"Dragonbone Powder"
0
4 Bytes
goldamount
f8
1337163847
"Heartwood Regin"
0
4 Bytes
goldamount
fc
1337163848
"Characters"
0
1
goldamount
0
10
20
1337163849
"Char 1"
0
1
+20
0
1337163850
"Generated Name"
0
String
20
1
0
1
+10
14
18
1337163851
"Custom Name"
0
String
20
1
0
1
+10
14
20
1337163852
"Level"
0
4 Bytes
+cc
1337163853
"Experience"
0
4 Bytes
+d0
1337163854
"Char 2"
0
1
+28
0
1337163855
"Generated Name"
0
String
20
1
0
1
+10
14
18
1337163856
"Custom Name"
0
String
20
1
0
1
+10
14
20
1337163857
"Level"
0
4 Bytes
+cc
1337163858
"Experience"
0
4 Bytes
+d0
1337163859
"Char 3"
0
1
+30
0
1337163860
"Generated Name"
0
String
20
1
0
1
+10
14
18
1337163861
"Custom Name"
0
String
20
1
0
1
+10
14
20
1337163862
"Level"
0
4 Bytes
+cc
1337163863
"Experience"
0
4 Bytes
+d0
1337163864
"Char 4"
0
1
+38
0
1337163865
"Generated Name"
0
String
20
1
0
1
+10
14
18
1337163866
"Custom Name"
0
String
20
1
0
1
+10
14
20
1337163867
"Level"
0
4 Bytes
+cc
1337163868
"Experience"
0
4 Bytes
+d0
1337163822
"-------------- Dungeon --------------"
008000
1
1337163825
"Boost the Map to show all details (Party Position, Enemies...)"
Auto Assembler Script
[ENABLE]
aobscanfunction(maphack,Systems.Characters.PlayerParty:ShowAutomap,48 8B FA 4C 89 45 E8 41 89 BF A0 01 00 00) // should be unique in this function
alloc(newmem,$100,maphack)
label(code)
label(return)
newmem:
mov rdx,#63 // all Details
code:
mov rdi,rdx
mov [rbp-18],r8
jmp return
maphack:
jmp newmem
nop 2
return:
registersymbol(maphack)
[DISABLE]
maphack:
db 48 8B FA 4C 89 45 E8
unregistersymbol(maphack)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.Characters.PlayerParty:ShowAutomap+13
216A83698F8: 00 00 - add [rax],al
216A83698FA: 00 00 - add [rax],al
216A83698FC: 00 00 - add [rax],al
216A83698FE: 00 00 - add [rax],al
Systems.Characters.PlayerParty:ShowAutomap: 55 - push rbp
Systems.Characters.PlayerParty:ShowAutomap+1: 48 8B EC - mov rbp,rsp
Systems.Characters.PlayerParty:ShowAutomap+4: 48 83 EC 40 - sub rsp,40
Systems.Characters.PlayerParty:ShowAutomap+8: 48 89 7D F0 - mov [rbp-10],rdi
Systems.Characters.PlayerParty:ShowAutomap+c: 4C 89 7D F8 - mov [rbp-08],r15
Systems.Characters.PlayerParty:ShowAutomap+10: 4C 8B F9 - mov r15,rcx
// ---------- INJECTING HERE ----------
Systems.Characters.PlayerParty:ShowAutomap+13: 48 8B FA - mov rdi,rdx
// ---------- DONE INJECTING ----------
Systems.Characters.PlayerParty:ShowAutomap+16: 4C 89 45 E8 - mov [rbp-18],r8
Systems.Characters.PlayerParty:ShowAutomap+1a: 41 89 BF A0 01 00 00 - mov [r15+000001A0],edi
Systems.Characters.PlayerParty:ShowAutomap+21: 49 8B CF - mov rcx,r15
Systems.Characters.PlayerParty:ShowAutomap+24: 66 90 - nop 2
Systems.Characters.PlayerParty:ShowAutomap+26: 49 BB 5B 3A 09 A9 16 02 00 00 - mov r11,00000216A9093A5B
Systems.Characters.PlayerParty:ShowAutomap+30: 41 FF D3 - call r11
Systems.Characters.PlayerParty:ShowAutomap+33: 49 8B 87 E0 00 00 00 - mov rax,[r15+000000E0]
Systems.Characters.PlayerParty:ShowAutomap+3a: 48 8B C8 - mov rcx,rax
Systems.Characters.PlayerParty:ShowAutomap+3d: 48 8B D7 - mov rdx,rdi
Systems.Characters.PlayerParty:ShowAutomap+40: 83 38 00 - cmp dword ptr [rax],00
}
1337163508
"Party does not use up Odem (Mana) when casting"
Auto Assembler Script
[ENABLE]
aobscanfunction(odem,Systems.Characters.UnitBase:DrainOdem,2B 4D F0 89 08 48 85 FF 0F 84 ** ** ** ** 48 8D 87 A4 00 00 00) // should be unique in this function
alloc(newmem,$1000,odem)
label(code)
label(return)
newmem:
code:
// sub ecx,[rbp-10]
mov [rax],ecx
jmp return
odem:
jmp newmem
return:
registersymbol(odem)
[DISABLE]
odem:
db 2B 4D F0 89 08
unregistersymbol(odem)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.Characters.UnitBase:DrainOdem+2d
Systems.Characters.UnitBase:DrainOdem+4: 48 83 EC 40 - sub rsp,40
Systems.Characters.UnitBase:DrainOdem+8: 48 89 7D F8 - mov [rbp-08],rdi
Systems.Characters.UnitBase:DrainOdem+c: 48 8B F9 - mov rdi,rcx
Systems.Characters.UnitBase:DrainOdem+f: 48 89 55 F0 - mov [rbp-10],rdx
Systems.Characters.UnitBase:DrainOdem+13: 48 85 FF - test rdi,rdi
Systems.Characters.UnitBase:DrainOdem+16: 0F 84 AD 00 00 00 - je Systems.Characters.UnitBase:DrainOdem+c9
Systems.Characters.UnitBase:DrainOdem+1c: 48 8D 87 A4 00 00 00 - lea rax,[rdi+000000A4]
Systems.Characters.UnitBase:DrainOdem+23: 48 83 C0 04 - add rax,04
Systems.Characters.UnitBase:DrainOdem+27: 48 8B D0 - mov rdx,rax
Systems.Characters.UnitBase:DrainOdem+2a: 48 63 08 - movsxd rcx,dword ptr [rax]
// ---------- INJECTING HERE ----------
Systems.Characters.UnitBase:DrainOdem+2d: 2B 4D F0 - sub ecx,[rbp-10]
// ---------- DONE INJECTING ----------
Systems.Characters.UnitBase:DrainOdem+30: 89 08 - mov [rax],ecx
Systems.Characters.UnitBase:DrainOdem+32: 48 85 FF - test rdi,rdi
Systems.Characters.UnitBase:DrainOdem+35: 0F 84 87 00 00 00 - je Systems.Characters.UnitBase:DrainOdem+c2
Systems.Characters.UnitBase:DrainOdem+3b: 48 8D 87 A4 00 00 00 - lea rax,[rdi+000000A4]
Systems.Characters.UnitBase:DrainOdem+42: 48 89 45 E8 - mov [rbp-18],rax
Systems.Characters.UnitBase:DrainOdem+46: 48 85 FF - test rdi,rdi
Systems.Characters.UnitBase:DrainOdem+49: 0F 84 6C 00 00 00 - je Systems.Characters.UnitBase:DrainOdem+bb
Systems.Characters.UnitBase:DrainOdem+4f: 48 8D 87 A4 00 00 00 - lea rax,[rdi+000000A4]
Systems.Characters.UnitBase:DrainOdem+56: 48 63 48 04 - movsxd rcx,dword ptr [rax+04]
Systems.Characters.UnitBase:DrainOdem+5a: 48 85 FF - test rdi,rdi
}
1337163783
"Party is always well fed (=> no hunger games here)"
Auto Assembler Script
[ENABLE]
aobscanfunction(hunger,Systems.Characters.PartyMember:TickHunger,89 86 CC 02 00 00 F3 0F 10 86 C8 02 00 00) // should be unique in this function
alloc(newmem,$1000,hunger)
label(code)
label(return)
newmem:
mov eax,0
code:
mov [rsi+000002CC],eax
jmp return
hunger:
jmp newmem
nop
return:
registersymbol(hunger)
[DISABLE]
hunger:
db 89 86 CC 02 00 00
unregistersymbol(hunger)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.Characters.PartyMember:TickHunger+1b4
Systems.Characters.PartyMember:TickHunger+189: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
Systems.Characters.PartyMember:TickHunger+18d: F2 0F 10 C0 - movsd xmm0,xmm0
Systems.Characters.PartyMember:TickHunger+191: 66 0F 3A 09 C0 01 - roundpd xmm0,xmm0,01
Systems.Characters.PartyMember:TickHunger+197: F2 0F 10 C0 - movsd xmm0,xmm0
Systems.Characters.PartyMember:TickHunger+19b: F2 0F 2C C0 - cvttsd2si eax,xmm0
Systems.Characters.PartyMember:TickHunger+19f: 4C 8B F8 - mov r15,rax
Systems.Characters.PartyMember:TickHunger+1a2: 85 C0 - test eax,eax
Systems.Characters.PartyMember:TickHunger+1a4: 0F 8E 35 00 00 00 - jng Systems.Characters.PartyMember:TickHunger+1df
Systems.Characters.PartyMember:TickHunger+1aa: 48 63 86 CC 02 00 00 - movsxd rax,dword ptr [rsi+000002CC]
Systems.Characters.PartyMember:TickHunger+1b1: 41 03 C7 - add eax,r15d
// ---------- INJECTING HERE ----------
Systems.Characters.PartyMember:TickHunger+1b4: 89 86 CC 02 00 00 - mov [rsi+000002CC],eax
// ---------- DONE INJECTING ----------
Systems.Characters.PartyMember:TickHunger+1ba: F3 0F 10 86 C8 02 00 00 - movss xmm0,[rsi+000002C8]
Systems.Characters.PartyMember:TickHunger+1c2: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
Systems.Characters.PartyMember:TickHunger+1c6: F3 41 0F 2A CF - cvtsi2ss xmm1,r15d
Systems.Characters.PartyMember:TickHunger+1cb: F3 0F 5A C9 - cvtss2sd xmm1,xmm1
Systems.Characters.PartyMember:TickHunger+1cf: F2 0F 5C C1 - subsd xmm0,xmm1
Systems.Characters.PartyMember:TickHunger+1d3: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0
Systems.Characters.PartyMember:TickHunger+1d7: F3 0F 11 AE C8 02 00 00 - movss [rsi+000002C8],xmm5
Systems.Characters.PartyMember:TickHunger+1df: 48 8B CE - mov rcx,rsi
Systems.Characters.PartyMember:TickHunger+1e2: 48 8D 6D 00 - lea rbp,[rbp+00]
Systems.Characters.PartyMember:TickHunger+1e6: 49 BB 10 39 66 28 A3 01 00 00 - mov r11,Systems.Characters.PartyMember:get_CurrentHungerState
}
1337163819
"One-Hit-Kills"
Auto Assembler Script
[ENABLE]
aobscanfunction(damageboost,Systems.Characters.EnemyUnit:TakeDamage,48 8B F9 48 89 55 E8 49 8B F0 4C 89 4D E0) // should be unique in this function
alloc(newmem,$1000,damageboost)
label(code)
label(return)
newmem:
mov rdx,#9999
code:
mov rdi,rcx
mov [rbp-18],rdx
jmp return
damageboost:
jmp newmem
nop 2
return:
registersymbol(damageboost)
[DISABLE]
damageboost:
db 48 8B F9 48 89 55 E8
unregistersymbol(damageboost)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.Characters.EnemyUnit:TakeDamage+10
1A79F18AE33: 05 04 03 01 50 - add eax,50010304
1A79F18AE38: 00 00 - add [rax],al
1A79F18AE3A: 00 00 - add [rax],al
1A79F18AE3C: 00 00 - add [rax],al
1A79F18AE3E: 00 00 - add [rax],al
Systems.Characters.EnemyUnit:TakeDamage: 55 - push rbp
Systems.Characters.EnemyUnit:TakeDamage+1: 48 8B EC - mov rbp,rsp
Systems.Characters.EnemyUnit:TakeDamage+4: 48 83 EC 50 - sub rsp,50
Systems.Characters.EnemyUnit:TakeDamage+8: 48 89 75 F0 - mov [rbp-10],rsi
Systems.Characters.EnemyUnit:TakeDamage+c: 48 89 7D F8 - mov [rbp-08],rdi
// ---------- INJECTING HERE ----------
Systems.Characters.EnemyUnit:TakeDamage+10: 48 8B F9 - mov rdi,rcx
// ---------- DONE INJECTING ----------
Systems.Characters.EnemyUnit:TakeDamage+13: 48 89 55 E8 - mov [rbp-18],rdx
Systems.Characters.EnemyUnit:TakeDamage+17: 49 8B F0 - mov rsi,r8
Systems.Characters.EnemyUnit:TakeDamage+1a: 4C 89 4D E0 - mov [rbp-20],r9
Systems.Characters.EnemyUnit:TakeDamage+1e: 48 B9 98 BD 44 B0 A8 01 00 00 - mov rcx,000001A8B044BD98
Systems.Characters.EnemyUnit:TakeDamage+28: 48 8D 64 24 00 - lea rsp,[rsp+00]
Systems.Characters.EnemyUnit:TakeDamage+2d: 90 - nop
Systems.Characters.EnemyUnit:TakeDamage+2e: 49 BB 80 10 02 6B A6 01 00 00 - mov r11,System.Object:__icall_wrapper_ves_icall_object_new_specific
Systems.Characters.EnemyUnit:TakeDamage+38: 41 FF D3 - call r11
Systems.Characters.EnemyUnit:TakeDamage+3b: 48 8B C8 - mov rcx,rax
Systems.Characters.EnemyUnit:TakeDamage+3e: C7 41 28 00 00 00 00 - mov [rcx+28],00000000
}
1337163830
"Oil of Lamp does not decrease"
Auto Assembler Script
[ENABLE]
aobscanfunction(oillevel,PartyOilLamp:OnTurnStart,41 2B C7 89 86 AC 00 00 00) // should be unique in this function
alloc(newmem,$1000,oillevel)
label(code)
label(return)
newmem:
code:
// sub eax,r15d
mov [rsi+000000AC],eax
jmp return
oillevel:
jmp newmem
nop 4
return:
registersymbol(oillevel)
[DISABLE]
oillevel:
db 41 2B C7 89 86 AC 00 00 00
unregistersymbol(oillevel)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: PartyOilLamp:OnTurnStart+3fe
PartyOilLamp:OnTurnStart+3ca: 85 C0 - test eax,eax
PartyOilLamp:OnTurnStart+3cc: 0F 8E 35 00 00 00 - jng PartyOilLamp:OnTurnStart+407
PartyOilLamp:OnTurnStart+3d2: F3 0F 10 86 B4 00 00 00 - movss xmm0,[rsi+000000B4]
PartyOilLamp:OnTurnStart+3da: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
PartyOilLamp:OnTurnStart+3de: F3 41 0F 2A CF - cvtsi2ss xmm1,r15d
PartyOilLamp:OnTurnStart+3e3: F3 0F 5A C9 - cvtss2sd xmm1,xmm1
PartyOilLamp:OnTurnStart+3e7: F2 0F 5C C1 - subsd xmm0,xmm1
PartyOilLamp:OnTurnStart+3eb: F2 0F 5A E8 - cvtsd2ss xmm5,xmm0
PartyOilLamp:OnTurnStart+3ef: F3 0F 11 AE B4 00 00 00 - movss [rsi+000000B4],xmm5
PartyOilLamp:OnTurnStart+3f7: 48 63 86 AC 00 00 00 - movsxd rax,dword ptr [rsi+000000AC]
// ---------- INJECTING HERE ----------
PartyOilLamp:OnTurnStart+3fe: 41 2B C7 - sub eax,r15d
// ---------- DONE INJECTING ----------
PartyOilLamp:OnTurnStart+401: 89 86 AC 00 00 00 - mov [rsi+000000AC],eax
PartyOilLamp:OnTurnStart+407: 48 63 86 B0 00 00 00 - movsxd rax,dword ptr [rsi+000000B0]
PartyOilLamp:OnTurnStart+40e: 83 F8 01 - cmp eax,01
PartyOilLamp:OnTurnStart+411: 75 28 - jne PartyOilLamp:OnTurnStart+43b
PartyOilLamp:OnTurnStart+413: 0F B6 86 BC 00 00 00 - movzx eax,byte ptr [rsi+000000BC]
PartyOilLamp:OnTurnStart+41a: 85 C0 - test eax,eax
PartyOilLamp:OnTurnStart+41c: 74 1D - je PartyOilLamp:OnTurnStart+43b
PartyOilLamp:OnTurnStart+41e: F3 0F 10 05 6A 00 00 00 - movss xmm0,[PartyOilLamp:OnTurnStart+490]
PartyOilLamp:OnTurnStart+426: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
PartyOilLamp:OnTurnStart+42a: F2 0F 5A C0 - cvtsd2ss xmm0,xmm0
}
1
"Get Adresses of the Party (activate, go back in game)"
Auto Assembler Script
[ENABLE]
aobscanfunction(getparty,Systems.DungeonUI.StatsScreenUI:Update,83 39 00 48 8B 40 78 48 8B C8 83 39 00) // should be unique in this function
alloc(newmem,$100,getparty)
label(code)
label(return)
label(party)
newmem:
mov [party],rcx
code:
cmp dword ptr [rcx],00
mov rax,[rax+78]
jmp return
party:
dq 0
getparty:
jmp newmem
nop 2
return:
registersymbol(getparty party)
[DISABLE]
getparty:
db 83 39 00 48 8B 40 78
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.DungeonUI.StatsScreenUI:Update+b6b
Systems.DungeonUI.StatsScreenUI:Update+b3d: 48 63 55 C8 - movsxd rdx,dword ptr [rbp-38]
Systems.DungeonUI.StatsScreenUI:Update+b41: 89 55 E8 - mov [rbp-18],edx
Systems.DungeonUI.StatsScreenUI:Update+b44: 48 8D 10 - lea rdx,[rax]
Systems.DungeonUI.StatsScreenUI:Update+b47: 83 3F 00 - cmp dword ptr [rdi],00
Systems.DungeonUI.StatsScreenUI:Update+b4a: 48 8D 6D 00 - lea rbp,[rbp+00]
Systems.DungeonUI.StatsScreenUI:Update+b4e: 49 BB 40 C6 FC 28 A3 01 00 00 - mov r11,UnityEngine.Transform:set_localPosition
Systems.DungeonUI.StatsScreenUI:Update+b58: 41 FF D3 - call r11
Systems.DungeonUI.StatsScreenUI:Update+b5b: 48 B8 60 3C 02 22 A3 01 00 00 - mov rax,000001A322023C60
Systems.DungeonUI.StatsScreenUI:Update+b65: 48 8B 00 - mov rax,[rax]
Systems.DungeonUI.StatsScreenUI:Update+b68: 48 8B C8 - mov rcx,rax
// ---------- INJECTING HERE ----------
Systems.DungeonUI.StatsScreenUI:Update+b6b: 83 39 00 - cmp dword ptr [rcx],00
// ---------- DONE INJECTING ----------
Systems.DungeonUI.StatsScreenUI:Update+b6e: 48 8B 40 78 - mov rax,[rax+78]
Systems.DungeonUI.StatsScreenUI:Update+b72: 48 8B C8 - mov rcx,rax
Systems.DungeonUI.StatsScreenUI:Update+b75: 83 39 00 - cmp dword ptr [rcx],00
Systems.DungeonUI.StatsScreenUI:Update+b78: 0F B6 40 28 - movzx eax,byte ptr [rax+28]
Systems.DungeonUI.StatsScreenUI:Update+b7c: 85 C0 - test eax,eax
Systems.DungeonUI.StatsScreenUI:Update+b7e: 0F 84 04 01 00 00 - je Systems.DungeonUI.StatsScreenUI:Update+c88
Systems.DungeonUI.StatsScreenUI:Update+b84: F3 0F 10 05 74 01 00 00 - movss xmm0,[Systems.DungeonUI.StatsScreenUI:Update+d00]
Systems.DungeonUI.StatsScreenUI:Update+b8c: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
Systems.DungeonUI.StatsScreenUI:Update+b90: F2 0F 11 85 68 FE FF FF - movsd [rbp-00000198],xmm0
Systems.DungeonUI.StatsScreenUI:Update+b98: 48 8D 64 24 00 - lea rsp,[rsp+00]
}
1337163797
"Freeze all interesting "current" Values below at the Characters Entries"
0000FF
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
function freezeCurrentEntries()
local addressList = getAddressList()
-- Geht sicher alle Haupt-Einträge der Tabelle durch
for i = 0, addressList.Count - 1 do
local record = addressList[i]
-- Sicherstellen, dass der Eintrag existiert und eine Beschreibung hat
if record and record.Description then
-- Prüft, ob die Beschreibung mit "Current" beginnt
if record.Description:sub(1, 7) == "Current" then
record.Active = true
-- 2. Grünen Pfeil aktivieren (Wert darf nur steigen)
record.AllowIncrease = true
record.AllowDecrease = false
end
end
end
end
-- Script direkt ausführen:
freezeCurrentEntries()
{$asm}
[DISABLE]
2
"Party"
0
1
party
0
3
"gridPositionX"
C0C0C0
4 Bytes
+34
4
"gridPositionY"
C0C0C0
4 Bytes
+38
5
"Number of Group Members"
0
C0C0C0
4 Bytes
+88
18
1337163401
"Inventory Stacks (change stackable amounts)"
008000
1
7
"Slot 01"
0
4 Bytes
+60
18
20
78
8
"Slot 02"
0
4 Bytes
+60
18
28
78
9
"Slot 03"
0
4 Bytes
+60
18
30
78
10
"Slot 04"
0
4 Bytes
+60
18
38
78
11
"Slot 05"
0
4 Bytes
+60
18
40
78
12
"Slot 06"
0
4 Bytes
+60
18
48
78
13
"Slot 07"
0
4 Bytes
+60
18
50
78
14
"Slot 08"
0
4 Bytes
+60
18
58
78
15
"Slot 09"
0
4 Bytes
+60
18
60
78
16
"Slot 10"
0
4 Bytes
+60
18
68
78
1337163789
"Slot 11"
0
4 Bytes
+60
18
70
78
1337163790
"Slot 12"
0
4 Bytes
+60
18
78
78
1337163791
"Slot 13"
0
4 Bytes
+60
18
80
78
1337163792
"Slot 14"
0
4 Bytes
+60
18
88
78
1337163793
"Slot 15"
0
4 Bytes
+60
18
90
78
1337163794
"Slot 16"
0
4 Bytes
+60
18
98
78
1337163795
"Slot 17"
0
4 Bytes
+60
18
a0
78
1337163796
"Slot 18"
0
4 Bytes
+60
18
a8
78
1337163808
"Slot 19"
0
4 Bytes
+60
18
b0
78
1337163809
"Slot 20"
0
4 Bytes
+60
18
b8
78
1337163810
"Slot 21"
0
4 Bytes
+60
18
c0
78
1337163811
"Slot 22"
0
4 Bytes
+60
18
c8
78
1337163812
"Slot 23"
0
4 Bytes
+60
18
d0
78
1337163813
"Slot 24"
0
4 Bytes
+60
18
d8
78
6
"Player Character 1"
1
0
1
+88
0
20
17
"Name"
0
String
30
1
0
1
+178
14
c8
1337163451
"Experience and Level"
1
1337163448
"Pending Levelups"
0
C0C0C0
4 Bytes
+288
1337163450
"Experience Points"
0
4 Bytes
+28c
1337163449
"Level (don't change, use the EXP for that)"
0
C0C0C0
4 Bytes
+290
1337163404
"BaseStats"
0
1
+a4
1337163405
"Current Health"
1
0000FF
4 Bytes
+0
1337163431
"Current Odem (Mana)"
0
FF0000
4 Bytes
+4
1337163432
"Current Stamina"
0
008080
4 Bytes
+8
1337163433
"Current Armor"
0
4 Bytes
+c
1337163430
"Full Health"
0
4 Bytes
+10
1337163406
"Full Stamina"
0
4 Bytes
+14
1337163427
"Full Odem"
0
4 Bytes
+18
1337163446
"Character Stats"
1
1337163625
"Accuracy"
0
4 Bytes
+3c
1337163434
"Agility"
0
4 Bytes
+40
1337163435
"Intelligence"
0
4 Bytes
+44
1337163623
"Constitution"
0
4 Bytes
+48
1337163444
"Crit Chance"
0
4 Bytes
+6c
1337163447
"Resists"
1
1337163436
"Poison Resistance"
0
4 Bytes
+4c
1337163437
"Fire Resistance"
0
4 Bytes
+50
1337163438
"Cold Resistance"
0
4 Bytes
+54
1337163439
"Electricity Resistance"
0
4 Bytes
+58
1337163440
"Pierce Resistance"
0
4 Bytes
+5c
1337163441
"Bludge Resistance"
0
4 Bytes
+60
1337163442
"Slash Resistance"
0
4 Bytes
+64
1337163443
"Crush Resistance (not displayed in the game, unused?)"
0
4 Bytes
+68
1337163445
"Immune to Bleed"
0
4 Bytes
+70
1337163624
"Immune to Poison"
0
4 Bytes
+74
1337163407
"Player Character 2"
1
0
1
+88
0
28
1337163626
"Name"
0
String
30
1
0
1
+178
14
c8
1337163627
"Experience and Level"
1
1337163628
"Pending Levelups"
0
C0C0C0
4 Bytes
+288
1337163629
"Experience Points"
0
4 Bytes
+28c
1337163630
"Level (don't change, use the EXP for that)"
0
C0C0C0
4 Bytes
+290
1337163631
"BaseStats"
0
1
+a4
1337163632
"Current Health"
1
0000FF
4 Bytes
+0
1337163633
"Current Odem (Mana)"
0
FF0000
4 Bytes
+4
1337163634
"Current Stamina"
0
008080
4 Bytes
+8
1337163635
"Current Armor"
0
4 Bytes
+c
1337163636
"Full Health"
0
4 Bytes
+10
1337163637
"Full Stamina"
0
4 Bytes
+14
1337163638
"Full Odem"
0
4 Bytes
+18
1337163639
"Character Stats"
1
1337163640
"Accuracy"
0
4 Bytes
+3c
1337163641
"Agility"
0
4 Bytes
+40
1337163642
"Intelligence"
0
4 Bytes
+44
1337163643
"Constitution"
0
4 Bytes
+48
1337163644
"Crit Chance"
0
4 Bytes
+6c
1337163645
"Resists"
1
1337163646
"Poison Resistance"
0
4 Bytes
+4c
1337163647
"Fire Resistance"
0
4 Bytes
+50
1337163648
"Cold Resistance"
0
4 Bytes
+54
1337163649
"Electricity Resistance"
0
4 Bytes
+58
1337163650
"Pierce Resistance"
0
4 Bytes
+5c
1337163651
"Bludge Resistance"
0
4 Bytes
+60
1337163652
"Slash Resistance"
0
4 Bytes
+64
1337163653
"Crush Resistance (not displayed in the game, unused?)"
0
4 Bytes
+68
1337163654
"Immune to Bleed"
0
4 Bytes
+70
1337163655
"Immune to Poison"
0
4 Bytes
+74
1337163408
"Player Character 3"
1
0
1
+88
0
30
1337163656
"Name"
0
String
30
1
0
1
+178
14
c8
1337163657
"Experience and Level"
1
1337163658
"Pending Levelups"
0
C0C0C0
4 Bytes
+288
1337163659
"Experience Points"
0
4 Bytes
+28c
1337163660
"Level (don't change, use the EXP for that)"
0
C0C0C0
4 Bytes
+290
1337163661
"BaseStats"
0
1
+a4
1337163662
"Current Health"
1
0000FF
4 Bytes
+0
1337163663
"Current Odem (Mana)"
0
FF0000
4 Bytes
+4
1337163664
"Current Stamina"
0
008080
4 Bytes
+8
1337163665
"Current Armor"
0
4 Bytes
+c
1337163666
"Full Health"
0
4 Bytes
+10
1337163667
"Full Stamina"
0
4 Bytes
+14
1337163668
"Full Odem"
0
4 Bytes
+18
1337163669
"Character Stats"
1
1337163670
"Accuracy"
0
4 Bytes
+3c
1337163671
"Agility"
0
4 Bytes
+40
1337163672
"Intelligence"
0
4 Bytes
+44
1337163673
"Constitution"
0
4 Bytes
+48
1337163674
"Crit Chance"
0
4 Bytes
+6c
1337163675
"Resists"
1
1337163676
"Poison Resistance"
0
4 Bytes
+4c
1337163677
"Fire Resistance"
0
4 Bytes
+50
1337163678
"Cold Resistance"
0
4 Bytes
+54
1337163679
"Electricity Resistance"
0
4 Bytes
+58
1337163680
"Pierce Resistance"
0
4 Bytes
+5c
1337163681
"Bludge Resistance"
0
4 Bytes
+60
1337163682
"Slash Resistance"
0
4 Bytes
+64
1337163683
"Crush Resistance (not displayed in the game, unused?)"
0
4 Bytes
+68
1337163684
"Immune to Bleed"
0
4 Bytes
+70
1337163685
"Immune to Poison"
0
4 Bytes
+74
1337163409
"Player Character 4"
1
0
1
+88
0
38
1337163686
"Name"
0
String
30
1
0
1
+178
14
c8
1337163687
"Experience and Level"
1
1337163688
"Pending Levelups"
0
C0C0C0
4 Bytes
+288
1337163689
"Experience Points"
0
4 Bytes
+28c
1337163690
"Level (don't change, use the EXP for that)"
0
C0C0C0
4 Bytes
+290
1337163691
"BaseStats"
0
1
+a4
1337163692
"Current Health"
1
0000FF
4 Bytes
+0
1337163693
"Current Odem (Mana)"
0
FF0000
4 Bytes
+4
1337163694
"Current Stamina"
0
008080
4 Bytes
+8
1337163695
"Current Armor"
0
4 Bytes
+c
1337163696
"Full Health"
0
4 Bytes
+10
1337163697
"Full Stamina"
0
4 Bytes
+14
1337163698
"Full Odem"
0
4 Bytes
+18
1337163699
"Character Stats"
1
1337163700
"Accuracy"
0
4 Bytes
+3c
1337163701
"Agility"
0
4 Bytes
+40
1337163702
"Intelligence"
0
4 Bytes
+44
1337163703
"Constitution"
0
4 Bytes
+48
1337163704
"Crit Chance"
0
4 Bytes
+6c
1337163705
"Resists"
1
1337163706
"Poison Resistance"
0
4 Bytes
+4c
1337163707
"Fire Resistance"
0
4 Bytes
+50
1337163708
"Cold Resistance"
0
4 Bytes
+54
1337163709
"Electricity Resistance"
0
4 Bytes
+58
1337163710
"Pierce Resistance"
0
4 Bytes
+5c
1337163711
"Bludge Resistance"
0
4 Bytes
+60
1337163712
"Slash Resistance"
0
4 Bytes
+64
1337163713
"Crush Resistance (not displayed in the game, unused?)"
0
4 Bytes
+68
1337163714
"Immune to Bleed"
0
4 Bytes
+70
1337163715
"Immune to Poison"
0
4 Bytes
+74
1337163410
"NPC 1 (hm, never got any...)"
1
0
1
+88
0
40
1337163716
"Name"
0
String
30
1
0
1
+178
14
c8
1337163717
"Experience and Level"
1
1337163718
"Pending Levelups"
0
C0C0C0
4 Bytes
+288
1337163719
"Experience Points"
0
4 Bytes
+28c
1337163720
"Level (don't change, use the EXP for that)"
0
C0C0C0
4 Bytes
+290
1337163721
"BaseStats"
0
1
+a4
1337163722
"Current Health"
0
0000FF
4 Bytes
+0
1337163723
"Current Odem (Mana)"
0
FF0000
4 Bytes
+4
1337163724
"Current Stamina"
0
008080
4 Bytes
+8
1337163725
"Current Armor"
0
4 Bytes
+c
1337163726
"Full Health"
0
4 Bytes
+10
1337163727
"Full Stamina"
0
4 Bytes
+14
1337163728
"Full Odem"
0
4 Bytes
+18
1337163729
"Character Stats"
1
1337163730
"Accuracy"
0
4 Bytes
+3c
1337163731
"Agility"
0
4 Bytes
+40
1337163732
"Intelligence"
0
4 Bytes
+44
1337163733
"Constitution"
0
4 Bytes
+48
1337163734
"Crit Chance"
0
4 Bytes
+6c
1337163735
"Resists"
1
1337163736
"Poison Resistance"
0
4 Bytes
+4c
1337163737
"Fire Resistance"
0
4 Bytes
+50
1337163738
"Cold Resistance"
0
4 Bytes
+54
1337163739
"Electricity Resistance"
0
4 Bytes
+58
1337163740
"Pierce Resistance"
0
4 Bytes
+5c
1337163741
"Bludge Resistance"
0
4 Bytes
+60
1337163742
"Slash Resistance"
0
4 Bytes
+64
1337163743
"Crush Resistance (not displayed in the game, unused?)"
0
4 Bytes
+68
1337163744
"Immune to Bleed"
0
4 Bytes
+70
1337163745
"Immune to Poison"
0
4 Bytes
+74
1337163594
"NPC 2"
1
0
1
+88
0
48
1337163746
"Name"
0
String
30
1
0
1
+178
14
c8
1337163747
"Experience and Level"
1
1337163748
"Pending Levelups"
0
C0C0C0
4 Bytes
+288
1337163749
"Experience Points"
0
4 Bytes
+28c
1337163750
"Level (don't change, use the EXP for that)"
0
C0C0C0
4 Bytes
+290
1337163751
"BaseStats"
0
1
+a4
1337163752
"Current Health"
0
0000FF
4 Bytes
+0
1337163753
"Current Odem (Mana)"
0
FF0000
4 Bytes
+4
1337163754
"Current Stamina"
0
008080
4 Bytes
+8
1337163755
"Current Armor"
0
4 Bytes
+c
1337163756
"Full Health"
0
4 Bytes
+10
1337163757
"Full Stamina"
0
4 Bytes
+14
1337163758
"Full Odem"
0
4 Bytes
+18
1337163759
"Character Stats"
1
1337163760
"Accuracy"
0
4 Bytes
+3c
1337163761
"Agility"
0
4 Bytes
+40
1337163762
"Intelligence"
0
4 Bytes
+44
1337163763
"Constitution"
0
4 Bytes
+48
1337163764
"Crit Chance"
0
4 Bytes
+6c
1337163765
"Resists"
1
1337163766
"Poison Resistance"
0
4 Bytes
+4c
1337163767
"Fire Resistance"
0
4 Bytes
+50
1337163768
"Cold Resistance"
0
4 Bytes
+54
1337163769
"Electricity Resistance"
0
4 Bytes
+58
1337163770
"Pierce Resistance"
0
4 Bytes
+5c
1337163771
"Bludge Resistance"
0
4 Bytes
+60
1337163772
"Slash Resistance"
0
4 Bytes
+64
1337163773
"Crush Resistance (not displayed in the game, unused?)"
0
4 Bytes
+68
1337163774
"Immune to Bleed"
0
4 Bytes
+70
1337163775
"Immune to Poison"
0
4 Bytes
+74
1337163828
"other scripts which shall not auto-activate"
1
1337163827
"Active 'dogmode' (500x dmg)"
Auto Assembler Script
[ENABLE]
aobscanfunction(dogmode,Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext,0F B6 10 B9 F4 01 00 00 B8 01 00 00 00) // should be unique in this function
alloc(newmem,$1000,dogmode)
label(code)
label(return)
newmem:
mov byte ptr [rax],1
code:
movzx edx,byte ptr [rax]
mov ecx,000001F4
jmp return
dogmode:
jmp newmem
nop 3
return:
registersymbol(dogmode)
[DISABLE]
dogmode:
db 0F B6 10 B9 F4 01 00 00
unregistersymbol(dogmode)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+ff
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+c2: 49 8D 95 A4 00 00 00 - lea rdx,[r13+000000A4]
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+c9: 48 8B CD - mov rcx,rbp
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+cc: 48 81 C1 C8 FD FF FF - add rcx,FFFFFFFFFFFFFDC8
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+d3: 41 B8 74 00 00 00 - mov r8d,00000074
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+d9: 48 8D 64 24 00 - lea rsp,[rsp+00]
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+de: 49 BB E0 85 27 29 58 02 00 00 - mov r11,System.String:memcpy
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+e8: 41 FF D3 - call r11
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+eb: 48 63 85 C8 FD FF FF - movsxd rax,dword ptr [rbp-00000238]
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+f2: 89 46 48 - mov [rsi+48],eax
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+f5: 48 B8 D8 69 1B CB 59 02 00 00 - mov rax,00000259CB1B69D8
// ---------- INJECTING HERE ----------
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+ff: 0F B6 10 - movzx edx,byte ptr [rax]
// ---------- DONE INJECTING ----------
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+102: B9 F4 01 00 00 - mov ecx,000001F4
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+107: B8 01 00 00 00 - mov eax,00000001
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+10c: 85 D2 - test edx,edx
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+10e: 48 8B F8 - mov rdi,rax
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+111: 48 0F 45 F9 - cmovne rdi,rcx
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+115: 48 63 46 2C - movsxd rax,dword ptr [rsi+2C]
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+119: 85 C0 - test eax,eax
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+11b: 7F 07 - jg Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+124
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+11d: C7 46 2C 01 00 00 00 - mov [rsi+2C],00000001
Systems.Characters.EnemyUnit+<TakeDamage>d__27:MoveNext+124: 48 63 56 2C - movsxd rdx,dword ptr [rsi+2C]
}
1337163509
"Get 250XP plus 5x the XP than normal when killing something"
Auto Assembler Script
[ENABLE]
aobscanfunction(experience,Systems.Characters.PartyMember:AddExperience,03 C6 89 87 8C 02 00 00 48 63 8F 8C 02 00 00) // should be unique in this function
alloc(newmem,$1000,experience)
label(code)
label(return)
newmem:
add eax,#250
add eax,esi
add eax,esi
add eax,esi
add eax,esi
code:
add eax,esi
mov [rdi+0000028C],eax
jmp return
experience:
jmp newmem
nop 3
return:
registersymbol(experience)
[DISABLE]
experience:
db 03 C6 89 87 8C 02 00 00
unregistersymbol(experience)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Systems.Characters.PartyMember:AddExperience+9d
Systems.Characters.PartyMember:AddExperience+7a: FF 00 - inc [rax]
Systems.Characters.PartyMember:AddExperience+7c: 00 00 - add [rax],al
Systems.Characters.PartyMember:AddExperience+7e: 00 48 63 - add [rax+63],cl
Systems.Characters.PartyMember:AddExperience+81: 8F - db 8f
Systems.Characters.PartyMember:AddExperience+82: 8C 02 - mov [rdx],es
Systems.Characters.PartyMember:AddExperience+84: 00 00 - add [rax],al
Systems.Characters.PartyMember:AddExperience+86: 49 BB E0 AC E1 22 A3 01 00 00 - mov r11,000001A322E1ACE0
Systems.Characters.PartyMember:AddExperience+90: 41 FF D3 - call r11
Systems.Characters.PartyMember:AddExperience+93: 4C 8B F0 - mov r14,rax
Systems.Characters.PartyMember:AddExperience+96: 48 63 87 8C 02 00 00 - movsxd rax,dword ptr [rdi+0000028C]
// ---------- INJECTING HERE ----------
Systems.Characters.PartyMember:AddExperience+9d: 03 C6 - add eax,esi
// ---------- DONE INJECTING ----------
Systems.Characters.PartyMember:AddExperience+9f: 89 87 8C 02 00 00 - mov [rdi+0000028C],eax
Systems.Characters.PartyMember:AddExperience+a5: 48 63 8F 8C 02 00 00 - movsxd rcx,dword ptr [rdi+0000028C]
Systems.Characters.PartyMember:AddExperience+ac: 66 90 - nop 2
Systems.Characters.PartyMember:AddExperience+ae: 49 BB E0 AC E1 22 A3 01 00 00 - mov r11,000001A322E1ACE0
Systems.Characters.PartyMember:AddExperience+b8: 41 FF D3 - call r11
Systems.Characters.PartyMember:AddExperience+bb: 4C 8B E8 - mov r13,rax
Systems.Characters.PartyMember:AddExperience+be: 41 3B C6 - cmp eax,r14d
Systems.Characters.PartyMember:AddExperience+c1: 0F 8E 21 04 00 00 - jng Systems.Characters.PartyMember:AddExperience+4e8
Systems.Characters.PartyMember:AddExperience+c7: 4D 8B FD - mov r15,r13
Systems.Characters.PartyMember:AddExperience+ca: 45 2B FE - sub r15d,r14d
}
1337163824
"stop this feature at level 15 or so - otherwise your savegame will fuck up"
0000FF
1
1337163831
"Walk through walls"
Auto Assembler Script
[ENABLE]
aobscanfunction(walls,Environment.Level:IsGridCellBlocked,55 48 8B EC 48 81 EC C0 00 00 00 48 89 5D C8) // should be unique in this function
alloc(newmem,$1000,walls)
label(return)
walls:
xor eax, eax // way is free
ret
return:
registersymbol(walls)
[DISABLE]
walls:
db 55 48 8B EC 48 81 EC C0 00 00 00
unregistersymbol(walls)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Environment.Level:IsGridCellBlocked
26BA6BBBF0D: D3 08 - ror [rax],cl
26BA6BBBF0F: B0 87 - mov al,-79
26BA6BBBF11: 34 42 - xor al,42
26BA6BBBF13: 6C - insb
26BA6BBBF14: 02 00 - add al,[rax]
26BA6BBBF16: 00 00 - add [rax],al
26BA6BBBF18: 00 00 - add [rax],al
26BA6BBBF1A: 00 00 - add [rax],al
26BA6BBBF1C: 00 00 - add [rax],al
26BA6BBBF1E: 00 00 - add [rax],al
// ---------- INJECTING HERE ----------
Environment.Level:IsGridCellBlocked: 55 - push rbp
// ---------- DONE INJECTING ----------
Environment.Level:IsGridCellBlocked+1: 48 8B EC - mov rbp,rsp
Environment.Level:IsGridCellBlocked+4: 48 81 EC C0 00 00 00 - sub rsp,000000C0
Environment.Level:IsGridCellBlocked+b: 48 89 5D C8 - mov [rbp-38],rbx
Environment.Level:IsGridCellBlocked+f: 48 89 75 D0 - mov [rbp-30],rsi
Environment.Level:IsGridCellBlocked+13: 48 89 7D D8 - mov [rbp-28],rdi
Environment.Level:IsGridCellBlocked+17: 4C 89 65 E0 - mov [rbp-20],r12
Environment.Level:IsGridCellBlocked+1b: 4C 89 6D E8 - mov [rbp-18],r13
Environment.Level:IsGridCellBlocked+1f: 4C 89 75 F0 - mov [rbp-10],r14
Environment.Level:IsGridCellBlocked+23: 4C 89 7D F8 - mov [rbp-08],r15
Environment.Level:IsGridCellBlocked+27: 48 89 4D B8 - mov [rbp-48],rcx
}
1337163805
"Get Coordinates"
Auto Assembler Script
[ENABLE]
aobscanmodule(coords,UnityPlayer.dll,0F 10 02 0F C2 C4 04 44 0F 50 C0 0F 11 22) // should be unique
alloc(newmem,$1000,coords)
label(code)
label(return)
newmem:
mov [coordinates],rdx
code:
movups xmm0,[rdx]
cmpneqps xmm0,xmm4
jmp return
coordinates:
dq 0
coords:
jmp newmem
nop 2
return:
registersymbol(coords coordinates)
[DISABLE]
coords:
db 0F 10 02 0F C2 C4 04
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: UnityPlayer.dll+677E6A
UnityPlayer.dll+677E3E: E8 5D 20 9E FF - call UnityPlayer.dll+59EA0
UnityPlayer.dll+677E43: 0F 28 64 24 30 - movaps xmm4,[rsp+30]
UnityPlayer.dll+677E48: 48 8B 07 - mov rax,[rdi]
UnityPlayer.dll+677E4B: 66 0F 6F 15 1D F5 84 01 - movdqa xmm2,[UnityPlayer.dll+1EC7370]
UnityPlayer.dll+677E53: 0F 10 08 - movups xmm1,[rax]
UnityPlayer.dll+677E56: 8B 40 08 - mov eax,[rax+08]
UnityPlayer.dll+677E59: 48 8D 14 40 - lea rdx,[rax+rax*2]
UnityPlayer.dll+677E5D: 66 48 0F 7E C8 - movq rax,xmm1
UnityPlayer.dll+677E62: 48 C1 E2 04 - shl rdx,04
UnityPlayer.dll+677E66: 48 03 50 18 - add rdx,[rax+18]
// ---------- INJECTING HERE ----------
UnityPlayer.dll+677E6A: 0F 10 02 - movups xmm0,[rdx]
// ---------- DONE INJECTING ----------
UnityPlayer.dll+677E6D: 0F C2 C4 04 - cmpneqps xmm0,xmm4
UnityPlayer.dll+677E71: 44 0F 50 C0 - movmskps r8d,xmm0
UnityPlayer.dll+677E75: 0F 11 22 - movups [rdx],xmm4
UnityPlayer.dll+677E78: 0F 28 5C 24 40 - movaps xmm3,[rsp+40]
UnityPlayer.dll+677E7D: 0F 28 C3 - movaps xmm0,xmm3
UnityPlayer.dll+677E80: 0F 59 C3 - mulps xmm0,xmm3
UnityPlayer.dll+677E83: 66 0F 70 C8 39 - pshufd xmm1,xmm039
UnityPlayer.dll+677E88: 0F 58 C8 - addps xmm1,xmm0
UnityPlayer.dll+677E8B: 66 0F 70 C1 4E - pshufd xmm0,xmm14E
UnityPlayer.dll+677E90: 0F 58 C8 - addps xmm1,xmm0
}
1337163806
"X"
0
Float
coordinates
0
1337163807
"Y"
0
Float
coordinates
8
1337163836
"get the REAL addresses (but be careful. the grid place where you port from stays blocked!)"
Auto Assembler Script
[ENABLE]
aobscanmodule(realcoord,UnityPlayer.dll,CC 44 0F 58 4E 10) // should be unique
alloc(newmem,$1000,realcoord)
label(code)
label(return)
label(effectivecoord)
newmem:
mov [effectivecoord],rsi
code:
addss xmm9,[rsi+10]
jmp return
effectivecoord:
dq 0
realcoord:
jmp newmem
nop
return:
registersymbol(realcoord effectivecoord)
[DISABLE]
realcoord:
db CC 44 0F 58 4E 10
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: UnityPlayer.dll+185F3EF
UnityPlayer.dll+185F3C4: F3 44 0F 58 C8 - addss xmm9,xmm0
UnityPlayer.dll+185F3C9: 41 0F 28 C4 - movaps xmm0,xmm12
UnityPlayer.dll+185F3CD: F3 0F 59 C2 - mulss xmm0,xmm2
UnityPlayer.dll+185F3D1: F3 0F 5C E0 - subss xmm4,xmm0
UnityPlayer.dll+185F3D5: 41 0F 28 C0 - movaps xmm0,xmm8
UnityPlayer.dll+185F3D9: F3 41 0F 59 C3 - mulss xmm0,xmm11
UnityPlayer.dll+185F3DE: F3 44 0F 58 C9 - addss xmm9,xmm1
UnityPlayer.dll+185F3E3: F3 44 0F 59 DA - mulss xmm11,xmm2
UnityPlayer.dll+185F3E8: 0F 28 CE - movaps xmm1,xmm6
UnityPlayer.dll+185F3EB: F3 0F 59 E7 - mulss xmm4,xmm7
// ---------- INJECTING HERE ----------
UnityPlayer.dll+185F3EF: F3 44 0F 58 4E 10 - addss xmm9,[rsi+10]
// ---------- DONE INJECTING ----------
UnityPlayer.dll+185F3F5: F3 45 0F 5C DA - subss xmm11,xmm10
UnityPlayer.dll+185F3FA: F3 45 0F 59 C4 - mulss xmm8,xmm12
UnityPlayer.dll+185F3FF: F3 0F 58 E0 - addss xmm4,xmm0
UnityPlayer.dll+185F403: F3 0F 59 F5 - mulss xmm6,xmm5
UnityPlayer.dll+185F407: F3 0F 59 CB - mulss xmm1,xmm3
UnityPlayer.dll+185F40B: F3 44 0F 59 DF - mulss xmm11,xmm7
UnityPlayer.dll+185F410: 41 0F 28 7B E0 - movaps xmm7,[r11-20]
UnityPlayer.dll+185F415: F3 0F 58 E1 - addss xmm4,xmm1
UnityPlayer.dll+185F419: F3 45 0F 58 D8 - addss xmm11,xmm8
UnityPlayer.dll+185F41E: 45 0F 28 43 D0 - movaps xmm8,[r11-30]
}
1337163837
"X"
0
Float
effectivecoord
10
1337163838
"Y"
0
Float
effectivecoord
18
1337163872
"debug"
C0C0C0
1
1337163870
"Teleport Script which crashes the game (1)"
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
-- 2. Eingabeaufforderung für X-Koordinate
local inputX = inputQuery("Teleport", "Ziel X-Koordinate (Raster/Grid):", "0")
if inputX == nil then return end
-- 3. Eingabeaufforderung für Y-Koordinate
local inputY = inputQuery("Teleport", "Ziel Y-Koordinate (Raster/Grid):", "0")
if inputY == nil then return end
local newX = tonumber(inputX)
local newY = tonumber(inputY)
if newX == nil or newY == nil then
print("Fehler: Ungültige Zahl eingegeben.")
return
end
-- 4. Instanz von PlayerParty im Speicher suchen
local instances = mono_findInstances("", "PlayerParty")
if instances == nil or #instances == 0 then
-- Falls PlayerParty eine Unterklasse ist, nach GridMover/Player suchen
instances = mono_findInstances("", "PlayerParty")
end
if instances == nil or #instances == 0 then
print("Fehler: PlayerParty.Instance konnte im Speicher nicht gefunden werden.")
return
end
local playerAddress = instances[1]
-- 5. Method-Address von InstantMoveToGridCell ermitteln
-- Parametertypen: int, int, bool (bool hat Standardwert True)
local method = mono_findMethod("", "PlayerParty", "InstantMoveToGridCell")
if method == nil then
-- Falls die Methode in der Basisklasse (z.B. GridMoverBase) definiert ist:
method = mono_findMethod("", "GridMoverBase", "InstantMoveToGridCell")
end
if method == nil then
print("Fehler: Methode InstantMoveToGridCell nicht gefunden.")
return
end
-- 6. Methode auf der Instanz ausführen
-- Argumente: [Instanz-Adresse], [newPositionX], [newPositionY], [layoutUnits]
local args = { playerAddress, newX, newY, 1 }
mono_invoke_method(nil, method, playerAddress, args)
print(string.format("Teleportiert zu X: %d, Y: %d", newX, newY))
[DISABLE]
// [DISABLE] bleibt leer, da es sich um eine einmalige Funktionsausführung handelt.
1337163871
"Teleport Script which crashes the game (2)"
Auto Assembler Script
[ENABLE]
{$LUA}
if syntaxcheck then return end
-- 1. Koordinaten abfragen
local inputX = inputQuery("Teleport", "Ziel X-Koordinate (Integer):", "0")
if not inputX then return end
local inputY = inputQuery("Teleport", "Ziel Y-Koordinate (Integer):", "0")
if not inputY then return end
local newX = tonumber(inputX)
local newY = tonumber(inputY)
if not newX or not newY then
print("[Teleport] Ungültige Zahl!")
return
end
-- 2. PlayerParty.Instance suchen
local klass = mono_findClass("", "PlayerParty")
if not klass or klass == 0 then
print("[Teleport] Klasse 'PlayerParty' nicht gefunden.")
return
end
local instances = mono_findInstances("", "PlayerParty")
local playerAddr = 0
if instances and #instances > 0 then
playerAddr = instances[1]
end
if not playerAddr or playerAddr == 0 then
print("[Teleport] Keine PlayerParty-Instanz gefunden! Steht der Charakter auf der Map?")
return
end
-- 3. Methode finden
local method = mono_findMethod("", "PlayerParty", "InstantMoveToGridCell")
if not method or method == 0 then
method = mono_findMethod("", "GridMoverBase", "InstantMoveToGridCell")
end
if not method or method == 0 then
print("[Teleport] Methode 'InstantMoveToGridCell' nicht gefunden.")
return
end
-- 4. JIT-Kompilierung der Methode erzwingen & NATIVE Adresse abgreifen
local nativeMethodAddr = mono_compile_method(method)
if not nativeMethodAddr or nativeMethodAddr == 0 then
print("[Teleport] Konnte JIT-Adresse der Methode nicht kompilieren.")
return
end
print(string.format("[Teleport] Instanz: %X | Native Methode: %X", playerAddr, nativeMethodAddr))
-- 5. Werte für CE-Memory vorbereiten
writeInteger("mem_Teleport_X", newX)
writeInteger("mem_Teleport_Y", newY)
writeQword("mem_Player_Addr", playerAddr)
writeQword("mem_Method_Addr", nativeMethodAddr)
-- Executer-Thread im Spiel anstoßen
local script = [[
createThread(TeleportThread)
]]
autoAssemble(script)
{$ASM}
alloc(mem_Teleport_X, 4)
alloc(mem_Teleport_Y, 4)
alloc(mem_Player_Addr, 8)
alloc(mem_Method_Addr, 8)
registersymbol(mem_Teleport_X)
registersymbol(mem_Teleport_Y)
registersymbol(mem_Player_Addr)
registersymbol(mem_Method_Addr)
alloc(TeleportThread, 128)
TeleportThread:
// x64 Calling Convention (fastcall):
// RCX = Instance (this)
// RDX = newPositionX
// R8 = newPositionY
// R9 = layoutUnits (1 = True)
sub rsp, 28 // Shadow Space reservieren
mov rcx, [mem_Player_Addr] // Player Party Instanz
mov edx, [mem_Teleport_X] // X-Koordinate
mov r8d, [mem_Teleport_Y] // Y-Koordinate
mov r9d, 1 // layoutUnits = true
mov rax, [mem_Method_Addr] // Native Adresse der C#-Funktion
call rax // Aufruf
add rsp, 28 // Shadow Space aufräumen
ret
[DISABLE]
unregistersymbol(mem_Teleport_X)
unregistersymbol(mem_Teleport_Y)
unregistersymbol(mem_Player_Addr)
unregistersymbol(mem_Method_Addr)
dealloc(mem_Teleport_X)
dealloc(mem_Teleport_Y)
dealloc(mem_Player_Addr)
dealloc(mem_Method_Addr)
dealloc(TeleportThread)