114982 "<=== Attach to process" 0000FF Auto Assembler Script {$lua} [ENABLE] if syntaxcheck then return end if(getCEVersion() < 7.4) then ShowMessage('Warning! CE version should be 7.4 or above') end OpenProcess("witcher3.exe") if(process == nil) then ShowMessage('The process is NOT found!') end {$asm} [DISABLE] 115001 "Full Health and Stamina, Zero Poison" Auto Assembler Script [ENABLE] aobscanmodule(stats,witcher3.exe,8B 0C 90 89 0E B1 01 48 8B 45 60 C5 FA 10 74 90 04) // should be unique alloc(newmem,$1000,stats) label(code) label(return) newmem: mov ecx,0 // let's take zero as default cmp rdx,6 // check if we are currently having the poisoned-value je code // if it is, just write our zero mov ecx,[rax+rdx*4+4] // else load the max value instead of current code: mov [rax+rdx*4],ecx // save into the current value //mov ecx,[rax+rdx*4] mov [rsi],ecx jmp return stats: jmp newmem return: registersymbol(stats) [DISABLE] stats: db 8B 0C 90 89 0E unregistersymbol(stats) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: witcher3.exe+1D73F7F witcher3.exe+1D73F5C: 48 8B CD - mov rcx,rbp witcher3.exe+1D73F5F: 48 0F 45 FA - cmovne rdi,rdx witcher3.exe+1D73F63: 8B 54 24 78 - mov edx,[rsp+78] witcher3.exe+1D73F67: 48 FF 43 30 - inc qword ptr [rbx+30] witcher3.exe+1D73F6B: E8 90 1C 00 00 - call witcher3.exe+1D75C00 witcher3.exe+1D73F70: 83 F8 FF - cmp eax,-01 witcher3.exe+1D73F73: 74 1D - je witcher3.exe+1D73F92 witcher3.exe+1D73F75: 48 98 - cdqe witcher3.exe+1D73F77: 48 8D 14 40 - lea rdx,[rax+rax*2] witcher3.exe+1D73F7B: 48 8B 45 60 - mov rax,[rbp+60] // ---------- INJECTING HERE ---------- witcher3.exe+1D73F7F: 8B 0C 90 - mov ecx,[rax+rdx*4] // ---------- DONE INJECTING ---------- witcher3.exe+1D73F82: 89 0E - mov [rsi],ecx witcher3.exe+1D73F84: B1 01 - mov cl,01 witcher3.exe+1D73F86: 48 8B 45 60 - mov rax,[rbp+60] witcher3.exe+1D73F8A: C5 FA 10 74 90 04 - vmovss xmm6,[rax+rdx*4+04] witcher3.exe+1D73F90: EB 08 - jmp witcher3.exe+1D73F9A witcher3.exe+1D73F92: C7 06 00 00 80 BF - mov [rsi],BF800000 witcher3.exe+1D73F98: 32 C9 - xor cl,cl witcher3.exe+1D73F9A: C5 FA 11 37 - vmovss [rdi],xmm6 witcher3.exe+1D73F9E: 4D 85 F6 - test r14,r14 witcher3.exe+1D73FA1: 74 03 - je witcher3.exe+1D73FA6 } 115007 "Fill money up to 99.999 when buying something" Auto Assembler Script [ENABLE] aobscanmodule(money,witcher3.exe,39 5F 58 75 ** 4D 85 F6 74 ** 41 8B 46 08 85 C0 74 ** 4D 8B 06 4D 8D 0C 80 4D 3B C1 74 ** 4C 8B 57 24 8B 47 2C 49 8D 14 82 49 8B C2 4C 3B D2 74 ** 41 8B 08 39 08 74 ** 48 83 C0 04 48 3B C2 75 ** 49 83 C0 04 4D 3B C1 75 ** 03 77 54 41 FF C3 44 3B DD 72 ** 4C 8B 7C 24 30 80 7C 24 78 00 48 8B 6C 24 60 74 ** 49 8B CD E8 ** ** ** ** 48 85 C0 74 ** 4D 8B CE 89 9C 24 88 00 00 00 45 33 C0 48 8D 94 24 88 00 00 00 48 8B C8 E8 ** ** ** ** 03 F0 4C 8B 74 24 38 4C 8B 6C 24 40 48 8B 7C 24 50 48 8B 5C 24 70 4D 85 E4 74 ** 41 89 34 24 48 8B 4C 24 20 4C 8B 64 24 48 48 8B 74 24 58 48 85 C9 74 ** E8 ** ** ** ** 48 83 C4 68) // should be unique alloc(newmem,$1000,money) label(code) label(return) newmem: cmp dword ptr [rdi+58], #51313 // Hex 0xC871 in Dezimal jne code // Wenn KEIN Gold -> direkt zum Originalcode springen // Nur ausführen, wenn Gold kleiner als 99.999 ist cmp dword ptr [rdi+54], #99999 jge code mov dword ptr [rdi+54], #99999 code: cmp r11d,ebp jb witcher3.exe+1F849D0 jmp return money+50: jmp newmem return: registersymbol(money) [DISABLE] money+50: db 44 3B DD 72 9E unregistersymbol(money) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: witcher3.exe+1F84A2D witcher3.exe+1F84A11: 39 08 - cmp [rax],ecx witcher3.exe+1F84A13: 74 15 - je witcher3.exe+1F84A2A witcher3.exe+1F84A15: 48 83 C0 04 - add rax,04 witcher3.exe+1F84A19: 48 3B C2 - cmp rax,rdx witcher3.exe+1F84A1C: 75 F3 - jne witcher3.exe+1F84A11 witcher3.exe+1F84A1E: 49 83 C0 04 - add r8,04 witcher3.exe+1F84A22: 4D 3B C1 - cmp r8,r9 witcher3.exe+1F84A25: 75 DF - jne witcher3.exe+1F84A06 witcher3.exe+1F84A27: 03 77 54 - add esi,[rdi+54] witcher3.exe+1F84A2A: 41 FF C3 - inc r11d // ---------- INJECTING HERE ---------- witcher3.exe+1F84A2D: 44 3B DD - cmp r11d,ebp // ---------- DONE INJECTING ---------- witcher3.exe+1F84A30: 72 9E - jb witcher3.exe+1F849D0 witcher3.exe+1F84A32: 4C 8B 7C 24 30 - mov r15,[rsp+30] witcher3.exe+1F84A37: 80 7C 24 78 00 - cmp byte ptr [rsp+78],00 witcher3.exe+1F84A3C: 48 8B 6C 24 60 - mov rbp,[rsp+60] witcher3.exe+1F84A41: 74 2C - je witcher3.exe+1F84A6F witcher3.exe+1F84A43: 49 8B CD - mov rcx,r13 witcher3.exe+1F84A46: E8 35 45 00 00 - call witcher3.exe+1F88F80 witcher3.exe+1F84A4B: 48 85 C0 - test rax,rax witcher3.exe+1F84A4E: 74 1F - je witcher3.exe+1F84A6F witcher3.exe+1F84A50: 4D 8B CE - mov r9,r14 } 114985 "Horse has always full endurance" Auto Assembler Script // endurance is a float, full = 100.0 define(address,"witcher3.exe"+23EF0F1) define(bytes,C5 FA 11 71 08) [ENABLE] assert(address,bytes) address: nop 5 return: [DISABLE] address: db bytes // vmovss [rcx+08],xmm6 dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: witcher3.exe+23EF0F1 witcher3.exe+23EF0CA: 48 85 C9 - test rcx,rcx witcher3.exe+23EF0CD: 75 1B - jne witcher3.exe+23EF0EA witcher3.exe+23EF0CF: 48 8D 54 24 30 - lea rdx,[rsp+30] witcher3.exe+23EF0D4: 48 89 7C 24 30 - mov [rsp+30],rdi witcher3.exe+23EF0D9: 48 8D 4B 14 - lea rcx,[rbx+14] witcher3.exe+23EF0DD: C5 FA 11 74 24 38 - vmovss [rsp+38],xmm6 witcher3.exe+23EF0E3: E8 28 11 15 FE - call witcher3.exe+540210 witcher3.exe+23EF0E8: EB 0C - jmp witcher3.exe+23EF0F6 witcher3.exe+23EF0EA: C5 F8 2E 71 08 - vucomiss xmm6,[rcx+08] witcher3.exe+23EF0EF: 74 2C - je witcher3.exe+23EF11D // ---------- INJECTING HERE ---------- witcher3.exe+23EF0F1: C5 FA 11 71 08 - vmovss [rcx+08],xmm6 // ---------- DONE INJECTING ---------- witcher3.exe+23EF0F6: 4C 8B 43 08 - mov r8,[rbx+08] witcher3.exe+23EF0FA: 8B CF - mov ecx,edi witcher3.exe+23EF0FC: C5 FA 2C C7 - vcvttss2si eax,xmm7 witcher3.exe+23EF100: 44 69 C8 E8 03 00 00 - imul r9d,eax,000003E8 witcher3.exe+23EF107: C6 44 24 28 00 - mov byte ptr [rsp+28],00 witcher3.exe+23EF10C: C5 F8 28 CE - vmovaps xmm1,xmm6 witcher3.exe+23EF110: C7 44 24 20 04 00 00 00 - mov [rsp+20],00000004 witcher3.exe+23EF118: E8 03 66 BB FE - call witcher3.AK::SoundEngine::SetRTPCValue witcher3.exe+23EF11D: 48 8B 5C 24 70 - mov rbx,[rsp+70] witcher3.exe+23EF122: C5 F8 28 74 24 50 - vmovaps xmm6,[rsp+50] } 114991 "always 100 air when swimming" Auto Assembler Script [ENABLE] aobscanmodule(breathingair,witcher3.exe,CC FA 11 34 88) // should be unique alloc(newmem,$100,breathingair) label(code) label(return) label(val_100) newmem: vmovss xmm6,[val_100] code: vmovss [rax+rcx*4],xmm6 jmp return val_100: dd (float)100.0 breathingair: jmp newmem return: registersymbol(breathingair) [DISABLE] breathingair: db CC FA 11 34 88 unregistersymbol(breathingair) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: witcher3.exe+1D7826F witcher3.exe+1D78251: 83 FF 0C - cmp edi,0C witcher3.exe+1D78254: 74 3A - je witcher3.exe+1D78290 witcher3.exe+1D78256: 8B D7 - mov edx,edi witcher3.exe+1D78258: 48 8B CE - mov rcx,rsi witcher3.exe+1D7825B: E8 C0 1D 00 00 - call witcher3.exe+1D7A020 witcher3.exe+1D78260: 83 F8 FF - cmp eax,-01 witcher3.exe+1D78263: 74 2B - je witcher3.exe+1D78290 witcher3.exe+1D78265: 48 98 - cdqe witcher3.exe+1D78267: 48 8D 0C 40 - lea rcx,[rax+rax*2] witcher3.exe+1D7826B: 48 8B 46 60 - mov rax,[rsi+60] // ---------- INJECTING HERE ---------- witcher3.exe+1D7826F: C5 FA 11 34 88 - vmovss [rax+rcx*4],xmm6 // ---------- DONE INJECTING ---------- witcher3.exe+1D78274: 83 FF 06 - cmp edi,06 witcher3.exe+1D78277: 75 17 - jne witcher3.exe+1D78290 witcher3.exe+1D78279: 8B 05 AD A5 D3 03 - mov eax,[witcher3.exe+5AB282C] witcher3.exe+1D7827F: 48 8D 54 24 20 - lea rdx,[rsp+20] witcher3.exe+1D78284: 48 8B CE - mov rcx,rsi witcher3.exe+1D78287: 89 44 24 20 - mov [rsp+20],eax witcher3.exe+1D7828B: E8 B0 50 99 00 - call witcher3.exe+270D340 witcher3.exe+1D78290: 48 8B 5C 24 60 - mov rbx,[rsp+60] witcher3.exe+1D78295: C5 F8 28 74 24 30 - vmovaps xmm6,[rsp+30] witcher3.exe+1D7829B: 48 83 C4 40 - add rsp,40 } 114999 "Skill Points don't decrease when used" Auto Assembler Script define(address,"witcher3.exe"+274516E) define(bytes,2B C6 89 07 4D 85 F6) [ENABLE] assert(address,bytes) address: nop 2 [DISABLE] address: db bytes // sub eax,esi // mov [rdi],eax // test r14,r14 dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: witcher3.exe+274516E witcher3.exe+274514D: 4D 8B 0C CF - mov r9,[r15+rcx*8] witcher3.exe+2745151: 4D 85 C9 - test r9,r9 witcher3.exe+2745154: 74 12 - je witcher3.exe+2745168 witcher3.exe+2745156: 48 8B 0B - mov rcx,[rbx] witcher3.exe+2745159: 4C 8D 44 24 50 - lea r8,[rsp+50] witcher3.exe+274515E: 48 8B D3 - mov rdx,rbx witcher3.exe+2745161: 41 FF D1 - call r9 witcher3.exe+2745164: 8B 74 24 50 - mov esi,[rsp+50] witcher3.exe+2745168: 48 FF 43 30 - inc qword ptr [rbx+30] witcher3.exe+274516C: 8B 07 - mov eax,[rdi] // ---------- INJECTING HERE ---------- witcher3.exe+274516E: 2B C6 - sub eax,esi // ---------- DONE INJECTING ---------- witcher3.exe+2745170: 89 07 - mov [rdi],eax witcher3.exe+2745172: 4D 85 F6 - test r14,r14 witcher3.exe+2745175: 74 03 - je witcher3.exe+274517A witcher3.exe+2745177: 41 89 06 - mov [r14],eax witcher3.exe+274517A: 48 8B 5C 24 40 - mov rbx,[rsp+40] witcher3.exe+274517F: 48 8B 74 24 58 - mov rsi,[rsp+58] witcher3.exe+2745184: 48 83 C4 20 - add rsp,20 witcher3.exe+2745188: 41 5F - pop r15 witcher3.exe+274518A: 41 5E - pop r14 witcher3.exe+274518C: 5F - pop rdi }