1 "Auto-Attach and Version Check" 1 2 "☕ Fuel the Cheats — Tip Katzy (Toggle to open my Ko-fi page)" Auto Assembler Script [ENABLE] [DISABLE] 3 "How to use - Katzy" Auto Assembler Script [ENABLE] [DISABLE] 4 "Clear All" Auto Assembler Script [ENABLE] [DISABLE] 5 "[MAIN] Castlevania: Belmont's Curse" Auto Assembler Script [ENABLE] [DISABLE] 11 "Complete Available Works of Mercy (One-shot)" Auto Assembler Script [ENABLE] [DISABLE] 10 "Invincibility" Auto Assembler Script [ENABLE] [DISABLE] 6 "Infinite Health" Auto Assembler Script [ENABLE] [DISABLE] 8 "Infinite Mana" Auto Assembler Script [ENABLE] [DISABLE] 9 "Infinite Potions" Auto Assembler Script [ENABLE] [DISABLE] 7 "Infinite Jumps" Auto Assembler Script [ENABLE] [DISABLE] 14 "Max Damage" Auto Assembler Script [ENABLE] [DISABLE] --[[ Table identification: Katzy Castlevania: Belmont's Curse | Steam build 25975867 | v1.12 Independently derived from the installed IL2CPP metadata and native code. ]] local previous = rawget(_G, 'BelmontKatzyState') if previous and not previous.shutdown(true) then showMessage('The previous table could not restore its changes. Keep that table available and restart the game before loading another copy.') return end local S = { patches = {}, sync = false, closing = false, stopped = false } _G.BelmontKatzyState = S local list = getAddressList() local form = getMainForm() local oldClose = form.OnClose local expectedExe = "castlevania belmont's curse.exe" local expectedHash = '30059e03b3a240cfbd02ae5f9562fec0' local exeHash = '7e4634fe6b2278c3a1f32ba449f5a0e1' local options = { [6]={'health'}, [7]={'jump1','jump2'}, [8]={'mana','manaRefill'}, [9]={'potions'}, [10]={'fallRecovery','invincibility','harm','traps'}, [11]={'mercy'}, [14]={'maxDamage'} } local hooks = { ['health']={rva=0x519A60,length=6,original='40 53 48 83 EC 20',script=[====[ [ENABLE] aobscanmodule(health_site,GameAssembly.dll,40 53 48 83 EC 20 80 3D 71 1A C5 03 00 48 8B D9 75 37 48 8D 0D 67 BA A0 03 E8 52 8B EF FF 48 8D) assert(health_site,40 53 48 83 EC 20) alloc(health_code,2048,health_site) label(health_return) label(health_done) label(health_original) registersymbol(health_site) registersymbol(health_code) health_code: push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,B0 movups [rsp+40],xmm0 movups [rsp+50],xmm1 movups [rsp+60],xmm2 movups [rsp+70],xmm3 movups [rsp+80],xmm4 movups [rsp+90],xmm5 cmp byte ptr [rcx+6C],0 je health_done mov rdx,[rcx+48] test rdx,rdx jz health_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz health_done mov rcx,[rsp+D8] xor edx,edx call health_original mov [rsp+A0],eax mov rcx,[rsp+D8] xor edx,edx call GameAssembly.dll+519C60 cmp [rsp+A0],eax jge health_done mov edx,eax mov rcx,[rsp+D8] xor r8d,r8d call GameAssembly.dll+519CB0 health_done: movups xmm0,[rsp+40] movups xmm1,[rsp+50] movups xmm2,[rsp+60] movups xmm3,[rsp+70] movups xmm4,[rsp+80] movups xmm5,[rsp+90] lea rsp,[rsp+B0] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax health_original: push rbx sub rsp,20 jmp health_return health_site: jmp health_code nop health_return: [DISABLE] health_site: db 40 53 48 83 EC 20 unregistersymbol(health_site) unregistersymbol(health_code) dealloc(health_code) ]====]}, ['mana']={rva=0x5673C0,length=7,original='48 8B C4 48 89 58 08',script=[====[ [ENABLE] aobscanmodule(mana_site,GameAssembly.dll,48 8B C4 48 89 58 08 48 89 70 10 48 89 78 18 4C 89 70 20 55 48 8D 68 B1 48 81 EC D0 00 00 00 80) assert(mana_site,48 8B C4 48 89 58 08) alloc(mana_code,2048,mana_site) label(mana_return) label(mana_done) registersymbol(mana_site) registersymbol(mana_code) mana_code: push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,80 movups [rsp+20],xmm0 movups [rsp+30],xmm1 movups [rsp+40],xmm2 movups [rsp+50],xmm3 movups [rsp+60],xmm4 movups [rsp+70],xmm5 mov rdx,[rsp+A0] test rdx,rdx jz mana_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz mana_done xorps xmm0,xmm0 comiss xmm0,[rsp+50] jae mana_done mov dword ptr [rsp+50],0 mana_done: movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+80] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax mov rax,rsp mov [rax+8],rbx jmp mana_return mana_site: jmp mana_code nop nop mana_return: [DISABLE] mana_site: db 48 8B C4 48 89 58 08 unregistersymbol(mana_site) unregistersymbol(mana_code) dealloc(mana_code) ]====]}, ['manaRefill']={rva=0x7C5B9C,length=6,original='0F 2F 77 3C 73 6B',script=[====[ [ENABLE] aobscanmodule(manaRefill_site,GameAssembly.dll,0F 2F 77 3C 73 6B F3 0F 10 47 44 0F 2F C6 76 0A F3 41 0F 5C C0 F3 0F 11 47 44 0F 2F 77 44 72 51) assert(manaRefill_site,0F 2F 77 3C 73 6B) alloc(manaRefill_code,2048,manaRefill_site) label(manaRefill_return) label(manaRefill_done) registersymbol(manaRefill_site) registersymbol(manaRefill_code) manaRefill_code: push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,B8 movups [rsp+40],xmm0 movups [rsp+50],xmm1 movups [rsp+60],xmm2 movups [rsp+70],xmm3 movups [rsp+80],xmm4 movups [rsp+90],xmm5 mov rdx,r15 test rdx,rdx jz manaRefill_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz manaRefill_done mov rcx,rdi mov rdx,r15 xor r8d,r8d call GameAssembly.dll+568280 movss [rsp+A0],xmm0 mov rcx,rdi mov rdx,r15 xor r8d,r8d call GameAssembly.dll+5683A0 cvtsi2ss xmm3,eax comiss xmm3,[rsp+A0] jbe manaRefill_done mov rcx,rdi mov rdx,r15 xor r9d,r9d movaps xmm2,xmm3 call GameAssembly.dll+568600 mov rcx,rdi mov rdx,r15 xor r8d,r8d call GameAssembly.dll+568280 movaps xmm3,xmm0 movss [rsp+20],xmm0 mov rcx,r13 mov rdx,r15 mov r8,[rdi+10] mov qword ptr [rsp+28],0 call GameAssembly.dll+567F00 manaRefill_done: movups xmm0,[rsp+40] movups xmm1,[rsp+50] movups xmm2,[rsp+60] movups xmm3,[rsp+70] movups xmm4,[rsp+80] movups xmm5,[rsp+90] lea rsp,[rsp+B8] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax comiss xmm6,[rdi+3C] jae GameAssembly.dll+7C5C0D jmp manaRefill_return manaRefill_site: jmp manaRefill_code nop manaRefill_return: [DISABLE] manaRefill_site: db 0F 2F 77 3C 73 6B unregistersymbol(manaRefill_site) unregistersymbol(manaRefill_code) dealloc(manaRefill_code) ]====]}, ['invincibility']={rva=0x7544E0,length=7,original='48 81 EC C8 01 00 00',script=[====[ [ENABLE] aobscanmodule(invincibility_site,GameAssembly.dll,48 81 EC C8 01 00 00 83 7A 3C 02 41 B9 03 00 00 00 0F 85 8D 00 00 00 48 8B C2 4C 8D 44 24 20 45) assert(invincibility_site,48 81 EC C8 01 00 00) alloc(invincibility_code,2048,invincibility_site) label(invincibility_return) label(invincibility_done) registersymbol(invincibility_site) registersymbol(invincibility_code) invincibility_code: push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,80 movups [rsp+20],xmm0 movups [rsp+30],xmm1 movups [rsp+40],xmm2 movups [rsp+50],xmm3 movups [rsp+60],xmm4 movups [rsp+70],xmm5 mov rdx,[rdx+8] test rdx,rdx jz invincibility_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz invincibility_done movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+80] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax xor eax,eax ret invincibility_done: movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+80] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax sub rsp,1C8 jmp invincibility_return invincibility_site: jmp invincibility_code nop nop invincibility_return: [DISABLE] invincibility_site: db 48 81 EC C8 01 00 00 unregistersymbol(invincibility_site) unregistersymbol(invincibility_code) dealloc(invincibility_code) ]====]}, ['harm']={rva=0x517830,length=6,original='40 55 53 56 41 55',script=[====[ [ENABLE] aobscanmodule(harm_site,GameAssembly.dll,40 55 53 56 41 55 41 56 48 8D AC 24 B0 FA FF FF 48 81 EC 50 06 00 00 80 3D 98 3C C5 03 00 49 8B) assert(harm_site,40 55 53 56 41 55) alloc(harm_code,2048,harm_site) label(harm_return) label(harm_done) registersymbol(harm_site) registersymbol(harm_code) harm_code: push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,80 movups [rsp+20],xmm0 movups [rsp+30],xmm1 movups [rsp+40],xmm2 movups [rsp+50],xmm3 movups [rsp+60],xmm4 movups [rsp+70],xmm5 mov rdx,[rsp+A0] test rdx,rdx jz harm_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz harm_done movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+80] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax ret harm_done: movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+80] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax push rbp push rbx push rsi push r13 jmp harm_return harm_site: jmp harm_code nop harm_return: [DISABLE] harm_site: db 40 55 53 56 41 55 unregistersymbol(harm_site) unregistersymbol(harm_code) dealloc(harm_code) ]====]}, ['traps']={rva=0x6B1F10,length=5,original='40 55 53 56 57',script=[====[ [ENABLE] aobscanmodule(traps_site,GameAssembly.dll,40 55 53 56 57 48 8D AC 24 68 FF FF FF 48 81 EC 98 01 00 00 80 3D 4C A6 AB 03 00 48 8B F2 48 8B) assert(traps_site,40 55 53 56 57) alloc(traps_code,2048,traps_site) label(traps_return) label(traps_done) label(traps_checkPlayer) registersymbol(traps_site) registersymbol(traps_code) traps_code: push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,80 movups [rsp+20],xmm0 movups [rsp+30],xmm1 movups [rsp+40],xmm2 movups [rsp+50],xmm3 movups [rsp+60],xmm4 movups [rsp+70],xmm5 cmp dword ptr [rcx+24],2 je traps_checkPlayer cmp dword ptr [rcx+24],3 jne traps_done traps_checkPlayer: mov rdx,[rsp+A0] test rdx,rdx jz traps_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz traps_done movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+80] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax ret traps_done: movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+80] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax push rbp push rbx push rsi push rdi jmp traps_return traps_site: jmp traps_code traps_return: [DISABLE] traps_site: db 40 55 53 56 57 unregistersymbol(traps_site) unregistersymbol(traps_code) dealloc(traps_code) ]====]}, ['fallRecovery']={rva=0x6B201E,length=5,original='38 5F 20 75 04',script=[====[ [ENABLE] aobscanmodule(fallRecovery_site,GameAssembly.dll,38 5F 20 75 04 8B C3 EB 12 48 8B 15 DA B8 87 03 48 8B CE E8 BA 8B 75 00 0F B6 C0 44 84 F0 0F 85) assert(fallRecovery_site,38 5F 20 75 04) alloc(fallRecovery_code,2048,fallRecovery_site) label(fallRecovery_return) label(fallRecovery_done) registersymbol(fallRecovery_site) registersymbol(fallRecovery_code) fallRecovery_code: push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,88 movups [rsp+20],xmm0 movups [rsp+30],xmm1 movups [rsp+40],xmm2 movups [rsp+50],xmm3 movups [rsp+60],xmm4 movups [rsp+70],xmm5 cmp dword ptr [rdi+24],1 ja fallRecovery_done mov rdx,rsi test rdx,rdx jz fallRecovery_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz fallRecovery_done movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+88] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax jmp GameAssembly.dll+6B2027 fallRecovery_done: movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+88] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax cmp byte ptr [rdi+20],bl jne GameAssembly.dll+6B2027 jmp fallRecovery_return fallRecovery_site: jmp fallRecovery_code fallRecovery_return: [DISABLE] fallRecovery_site: db 38 5F 20 75 04 unregistersymbol(fallRecovery_site) unregistersymbol(fallRecovery_code) dealloc(fallRecovery_code) ]====]}, ['potions']={rva=0xA0C7A7,length=6,original='45 33 C0 0F 28 CB',script=[====[ [ENABLE] aobscanmodule(potions_site,GameAssembly.dll,45 33 C0 0F 28 CB 49 8B CE E8 EB 24 D5 FF 48 8B 4B 28 48 85 C9 74 49 48 8B 01 4C 8B C7 0F 10 63) assert(potions_site,45 33 C0 0F 28 CB) alloc(potions_code,2048,potions_site) label(potions_return) label(potions_done) registersymbol(potions_site) registersymbol(potions_code) potions_code: push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,88 movups [rsp+20],xmm0 movups [rsp+30],xmm1 movups [rsp+40],xmm2 movups [rsp+50],xmm3 movups [rsp+60],xmm4 movups [rsp+70],xmm5 mov rax,[rbx] test rax,rax jz potions_done mov rax,[rax] mov rax,[rax+10] test rax,rax jz potions_done mov r11,6F5068746C616548 cmp [rax],r11 jne potions_done mov r11,727275436E6F6974 cmp [rax+8],r11 jne potions_done cmp dword ptr [rax+10],00746E65 jne potions_done mov rdx,rsi test rdx,rdx jz potions_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz potions_done movss xmm3,[rsp+50] maxss xmm3,[r14+18] movss [rsp+50],xmm3 potions_done: movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+88] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax xor r8d,r8d movaps xmm1,xmm3 jmp potions_return potions_site: jmp potions_code nop potions_return: [DISABLE] potions_site: db 45 33 C0 0F 28 CB unregistersymbol(potions_site) unregistersymbol(potions_code) dealloc(potions_code) ]====]}, ['jump1']={rva=0xA27AE9,length=7,original='84 C0 74 14 8B 4F 28',script=[====[ [ENABLE] aobscanmodule(jump1_site,GameAssembly.dll,84 C0 74 14 8B 4F 28 85 C9 74 3A 83 E9 01 74 18 83 F9 01 75 5E 0F B6 C1 48 8B 74 24 30 48 8B 5C) assert(jump1_site,84 C0 74 14 8B 4F 28) alloc(jump1_code,2048,jump1_site) label(jump1_return) label(jump1_done) registersymbol(jump1_site) registersymbol(jump1_code) jump1_code: test al,al jz GameAssembly.dll+A27B01 push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,88 movups [rsp+20],xmm0 movups [rsp+30],xmm1 movups [rsp+40],xmm2 movups [rsp+50],xmm3 movups [rsp+60],xmm4 movups [rsp+70],xmm5 mov rdx,rbx test rdx,rdx jz jump1_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz jump1_done movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+88] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax mov al,1 jmp GameAssembly.dll+A27B01 jump1_done: movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+88] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax test al,al jz GameAssembly.dll+A27B01 mov ecx,[rdi+28] jmp jump1_return jump1_site: jmp jump1_code nop nop jump1_return: [DISABLE] jump1_site: db 84 C0 74 14 8B 4F 28 unregistersymbol(jump1_site) unregistersymbol(jump1_code) dealloc(jump1_code) ]====]}, ['jump2']={rva=0xA18EF9,length=7,original='84 C0 74 14 8B 4F 20',script=[====[ [ENABLE] aobscanmodule(jump2_site,GameAssembly.dll,84 C0 74 14 8B 4F 20 85 C9 74 3A 83 E9 01 74 18 83 F9 01 75 5E 0F B6 C1 48 8B 74 24 30 48 8B 5C) assert(jump2_site,84 C0 74 14 8B 4F 20) alloc(jump2_code,2048,jump2_site) label(jump2_return) label(jump2_done) registersymbol(jump2_site) registersymbol(jump2_code) jump2_code: test al,al jz GameAssembly.dll+A18F11 push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,88 movups [rsp+20],xmm0 movups [rsp+30],xmm1 movups [rsp+40],xmm2 movups [rsp+50],xmm3 movups [rsp+60],xmm4 movups [rsp+70],xmm5 mov rdx,rbx test rdx,rdx jz jump2_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz jump2_done movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+88] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax mov al,1 jmp GameAssembly.dll+A18F11 jump2_done: movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+88] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax test al,al jz GameAssembly.dll+A18F11 mov ecx,[rdi+20] jmp jump2_return jump2_site: jmp jump2_code nop nop jump2_return: [DISABLE] jump2_site: db 84 C0 74 14 8B 4F 20 unregistersymbol(jump2_site) unregistersymbol(jump2_code) dealloc(jump2_code) ]====]}, ['mercy']={rva=0x5594F0,length=5,original='48 89 5C 24 08',script=[====[ [ENABLE] aobscanmodule(mercy_site,GameAssembly.dll,48 89 5C 24 08 57 48 83 EC 20 45 33 C0 48 8B FA 48 8B D9 E8 98 DF FF FF 80 BB 90 00 00 00 00 74) assert(mercy_site,48 89 5C 24 08) alloc(mercy_code,2048,mercy_site) label(mercy_return) label(mercy_done) label(mercy_request) label(mercy_eligible) label(mercy_groupLoop) label(mercy_taskLoop) label(mercy_nextTask) label(mercy_nextGroup) label(mercy_finished) registersymbol(mercy_site) registersymbol(mercy_code) registersymbol(mercy_request) mercy_code: push rbx push rbp push rsi push rdi push r12 push r13 push r14 push r15 push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,B0 movups [rsp+40],xmm0 movups [rsp+50],xmm1 movups [rsp+60],xmm2 movups [rsp+70],xmm3 movups [rsp+80],xmm4 movups [rsp+90],xmm5 cmp dword ptr [mercy_request],1 jne mercy_done mov rdx,[rsp+D0] test rdx,rdx jz mercy_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz mercy_done mov eax,1 mov edx,2 lock cmpxchg [mercy_request],edx jne mercy_done mov r12,[rsp+D8] mov r13,[rsp+D0] mov rax,[r12+40] test rax,rax jz mercy_finished mov r15d,[rax+18] mov r14,[rax+10] test r14,r14 jz mercy_finished cmp r15d,[r14+18] ja mercy_finished xor ebx,ebx mercy_groupLoop: cmp ebx,r15d jae mercy_finished mov rax,[r14+rbx*8+20] test rax,rax jz mercy_nextGroup mov rsi,[rax+28] test rsi,rsi jz mercy_nextGroup mov ebp,[rsi+18] xor edi,edi mercy_taskLoop: cmp edi,ebp jae mercy_nextGroup mov rdx,[rsi+rdi*8+20] test rdx,rdx jz mercy_nextTask // ArcanaTaskNever is the unavailable secret objective, displayed as ???. mov rax,[rdx] mov rax,[rax+10] mov r11,6154616E61637241 cmp [rax],r11 jne mercy_eligible mov r11,00726576654E6B73 cmp [rax+8],r11 je mercy_nextTask mercy_eligible: mov rcx,r12 xor r8d,r8d call GameAssembly.dll+557210 test al,al jnz mercy_nextTask mov rcx,r12 mov rdx,r13 mov r8,[rsi+rdi*8+20] xor r9d,r9d call GameAssembly.dll+558B50 mercy_nextTask: inc edi jmp mercy_taskLoop mercy_nextGroup: inc ebx jmp mercy_groupLoop mercy_finished: mov dword ptr [mercy_request],0 mercy_done: movups xmm0,[rsp+40] movups xmm1,[rsp+50] movups xmm2,[rsp+60] movups xmm3,[rsp+70] movups xmm4,[rsp+80] movups xmm5,[rsp+90] lea rsp,[rsp+B0] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax pop r15 pop r14 pop r13 pop r12 pop rdi pop rsi pop rbp pop rbx mov [rsp+8],rbx jmp mercy_return align 8 mercy_request: dd 0 mercy_site: jmp mercy_code mercy_return: [DISABLE] mercy_site: db 48 89 5C 24 08 unregistersymbol(mercy_site) unregistersymbol(mercy_code) unregistersymbol(mercy_request) dealloc(mercy_code) ]====]}, ['maxDamage']={rva=0x517971,length=6,original='2B 85 84 03 00 00',script=[====[ [ENABLE] aobscanmodule(maxDamage_site,GameAssembly.dll,2B 85 84 03 00 00 33 C9 85 C0 0F 4E C1 45 33 C0 8B D0 49 8B CE E8 25 23 00 00 48 8B 46 28 48 85) assert(maxDamage_site,2B 85 84 03 00 00) alloc(maxDamage_code,2048,maxDamage_site) label(maxDamage_return) label(maxDamage_done) registersymbol(maxDamage_site) registersymbol(maxDamage_code) maxDamage_code: push rax push rcx push rdx push r8 push r9 push r10 push r11 sub rsp,88 movups [rsp+20],xmm0 movups [rsp+30],xmm1 movups [rsp+40],xmm2 movups [rsp+50],xmm3 movups [rsp+60],xmm4 movups [rsp+70],xmm5 cmp dword ptr [rsp+B8],0 jle maxDamage_done cmp dword ptr [rbp+384],0 jle maxDamage_done test r13,r13 jz maxDamage_done mov rdx,rsi xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jnz maxDamage_done mov rcx,r13 xor edx,edx call GameAssembly.dll+75F610 mov rdx,rax test rdx,rdx jz maxDamage_done xor ecx,ecx xor r8d,r8d call GameAssembly.dll+519490 test al,al jz maxDamage_done mov eax,[rsp+B8] mov [rbp+384],eax maxDamage_done: movups xmm0,[rsp+20] movups xmm1,[rsp+30] movups xmm2,[rsp+40] movups xmm3,[rsp+50] movups xmm4,[rsp+60] movups xmm5,[rsp+70] lea rsp,[rsp+88] pop r11 pop r10 pop r9 pop r8 pop rdx pop rcx pop rax sub eax,[rbp+384] jmp maxDamage_return maxDamage_site: jmp maxDamage_code nop maxDamage_return: [DISABLE] maxDamage_site: db 2B 85 84 03 00 00 unregistersymbol(maxDamage_site) unregistersymbol(maxDamage_code) dealloc(maxDamage_code) ]====]} } local function rec(id) return list.getMemoryRecordByID(id) end local function say(message) if not S.closing then showMessage(message) end end local function bytes(address, length) local b = readBytes(address, length, true) if not b or #b ~= length then return nil end local t = {} for i,v in ipairs(b) do t[i] = string.format('%02X',v) end return table.concat(t,' ') end local function modules(pid) local ok, items = pcall(enumModules,pid) if not ok or not items then return nil end local exe, game for _,m in pairs(items) do local n = (m.Name or ''):lower() if n == expectedExe then exe=m end if n == 'gameassembly.dll' then game=m end end if not exe or not game then return nil end local a = (exe.PathToFile or ''):match('^(.*)[/\\]') local b = (game.PathToFile or ''):match('^(.*)[/\\]') if not a or not b or a:lower() ~= b:lower() then return nil end return game,exe end local function fingerprint(game,exe) local ok,a,b = pcall(function() return md5file(game.PathToFile),md5file(exe.PathToFile) end) return ok and type(a)=='string' and type(b)=='string' and a:lower()==expectedHash and b:lower()==exeHash end local function ownedProcess() if not S.pid then return false end local game = modules(S.pid) return game and game.Address == S.base and game.PathToFile == S.path end local function untick() S.sync=true for _,id in ipairs({6,7,8,9,10,11,14,5}) do pcall(function() rec(id).Active=false end) end S.sync=false end local function remove(name) local p = S.patches[name] if not p then return true end if name=='mercy' then local address=getAddressSafe('mercy_request') local state=address and readInteger(address) if state==nil or state==2 then S.lastError='Works of Mercy completion is still running or its state could not be read. Resume gameplay briefly, then try Clear All again.' return false end end local h = hooks[name] local current=bytes(S.base+h.rva,h.length) if current~=p.patched and current~=h.original then S.lastError='Another modification changed a cheat location. Restart the game before using this table again.' return false end local ok,result = pcall(autoAssemble,h.script,false,p.info) if not ok or not result or bytes(S.base+h.rva,h.length)~=h.original then S.lastError='A cheat could not restore the original game code. Restart the game before using the table again.' return false end S.patches[name]=nil return true end function S.clear(quiet) if not next(S.patches) then untick(); return true end if not ownedProcess() then local ok,processes=pcall(getProcesslist) if ok and processes and not processes[S.pid] then S.patches={}; untick(); return true end S.lastError='The original game process could not be verified for cleanup. Restart the game before using the table again.' if not quiet then say(S.lastError) end return false end local selected=getOpenedProcessID() if selected~=S.pid then openProcess(S.pid) end if getOpenedProcessID()~=S.pid then S.lastError='The game could not be reopened to turn off its cheats.' if not quiet then say(S.lastError) end return false end local ok=true for _,name in ipairs({'maxDamage','mercy','jump2','jump1','potions','traps','harm','invincibility','fallRecovery','manaRefill','mana','health'}) do if not remove(name) then ok=false end end if selected~=S.pid and selected and selected~=0 then pcall(openProcess,selected) end if ok then untick() elseif not quiet then say(S.lastError) end return ok end local function ready() if not S.pid or getOpenedProcessID()~=S.pid or not ownedProcess() then say(S.attachError or 'The supported game is not attached. Start Castlevania: Belmont\'s Curse and wait for the table to attach.') return false end local game,exe=modules(S.pid) if not fingerprint(game,exe) then say('This table supports Steam build 25975867. The installed game files differ; leave the cheats off until the table is updated.') return false end return true end local function enableOption(id) if not rec(5).Active then say('Enable MAIN first.'); return false end if not ready() then return false end local added={} for _,name in ipairs(options[id]) do local h=hooks[name] if bytes(S.base+h.rva,h.length)~=h.original then for i=#added,1,-1 do remove(added[i]) end say('The game code at this option has changed or is already modified. Turn off other tables for this game, then try again.') return false end local ok,result,info=pcall(autoAssemble,h.script) if not ok or not result or not info then for i=#added,1,-1 do remove(added[i]) end S.lastError=not ok and result or info say('Cheat Engine could not install this option. Its memory allocation or script assembly failed. Leave it off and report the option name.') return false end local actual=bytes(S.base+h.rva,h.length) S.patches[name]={info=info,patched=actual} added[#added+1]=name local target=getAddressSafe(name..'_code') local delta=target and (target-(S.base+h.rva+5)) local expected if delta and delta>=-2147483648 and delta<=2147483647 then local packed=string.pack('<i4',delta) expected='E9' for i=1,4 do expected=expected..string.format(' %02X',packed:byte(i)) end for i=6,h.length do expected=expected..' 90' end end if not actual or actual~=expected then for i=#added,1,-1 do remove(added[i]) end say('The option did not install with the expected jump instruction. Leave it off and restart the game if cleanup failed.') return false end end return true end local function disableOption(id) if not next(S.patches) then return true end if getOpenedProcessID()~=S.pid or not ownedProcess() then return S.clear(false) end local ok=true for i=#options[id],1,-1 do if not remove(options[id][i]) then ok=false end end if not ok then say(S.lastError) end return ok end local closeHandler function S.shutdown(quiet) S.stopped=true if S.timer then S.timer.destroy(); S.timer=nil end local ok=S.clear(quiet) if ok and form.OnClose==closeHandler then form.OnClose=oldClose end return ok end closeHandler=function(sender,action) S.closing=true pcall(S.shutdown,true) if oldClose then local ok,result=pcall(oldClose,sender,action) if ok and result~=nil then return result end end return action end form.OnClose=closeHandler rec(5).OnDestroy=function() pcall(S.shutdown,true) end rec(5).OnActivate=function(_,before) if before and not S.sync then return ready() end return true end rec(5).OnDeactivate=function(_,before) if before and not S.sync then return S.clear(false) end return true end for id in pairs(options) do local optionId=id rec(id).OnActivate=function(_,before) if before and not S.sync then return enableOption(optionId) end return true end rec(id).OnDeactivate=function(_,before) if before and not S.sync then return disableOption(optionId) end return true end end rec(11).OnActivate=function(_,before) if not before or S.sync then return true end if not rec(5).Active then say('Enable MAIN first.'); return false end if not ready() then return false end if not S.patches.mercy and not enableOption(11) then return false end local address=getAddressSafe('mercy_request') local state=address and readInteger(address) if state~=0 then say((state==1 or state==2) and 'The previous completion request is still pending. Resume gameplay briefly.' or 'The completion request could not be read. Use Clear All before trying again.') return false end if not writeInteger(address,1) then remove('mercy') say('The completion request could not be queued. Leave the option off and try again.') end return false end rec(2).OnActivate=function(_,before) if before then shellExecute('https://ko-fi.com/katzy'); return false end return true end rec(3).OnActivate=function(_,before) if before then showMessage([[How to use - Katzy Table identification: Katzy. Start Castlevania: Belmont's Curse (Steam build 25975867), open this table in 64-bit Cheat Engine, and allow its Lua script. The table attaches automatically to one matching game process. Enable MAIN, then choose options individually. Complete Available Works of Mercy (One-shot): completes unfinished, available works for currently unlocked Arcana, including unequipped Arcana, on the next gameplay update. Unavailable secret objectives shown as ??? are excluded. The checkbox unticks immediately. Newly unlocked Arcana require another activation. Talent points become available normally; talents are not purchased. Completed works remain completed and are saved by the game. Clear All cancels a request that has not run yet. Infinite Health: refills the player's health bar while enabled. Hits can still cause reactions; use Invincibility to ignore hits. Does not resurrect a dead character or bypass scripted death sequences. Infinite Jumps: allows repeated jump presses in the air using the normal jump actions. Traversal restrictions still apply; release and press Jump again for each jump. Infinite Mana: refills the player's mana bars on the next gameplay update, including empty bars, and prevents mana costs while enabled. Infinite Potions: prevents normal health-potion count reductions through the potion stat action. Start with at least one potion. Refills still work; overdrive potions are unaffected. Invincibility: blocks player hit reactions and damage, including spike and saw traps. Pitfalls and water falls still trigger the game's safe-position recovery; lethal fall zones also use this recovery path while enabled. Does not refill health. Can be combined with Infinite Health. Max Damage: makes accepted player hits remove the target's remaining health without an oversized damage value. Scripted invulnerability and boss phases still apply. Does not change earned stats. These options affect the player only. Turning an option off restores its original code; it does not rewind health, mana, or potion gains. MAIN off and Clear All disable all options. Close Cheat Engine normally to clean up. A forced termination cannot run cleanup. The tipping entry opens Katzy's Ko-fi page only when deliberately toggled.]]) return false end return true end rec(4).OnActivate=function(_,before) if before then S.clear(false); return false end return true end local function attach() if S.stopped then return end if next(S.patches) then if not ownedProcess() or getOpenedProcessID()~=S.pid then S.clear(false) end return end local candidates={} for pid,name in pairs(getProcesslist()) do if type(name)=='string' and name:lower()==expectedExe then candidates[#candidates+1]=pid end end if #candidates~=1 then S.pid=nil S.attachError=#candidates>1 and 'More than one game process is running. Keep one instance open so the table can attach safely.' or nil return end local pid=candidates[1] local game,exe=modules(pid) if not game then return end if S.pid==pid and S.base==game.Address and getOpenedProcessID()==pid then return end local key=tostring(pid)..':'..tostring(game.Address) if S.rejected==key then return end if not fingerprint(game,exe) then S.rejected=key S.attachError='This table supports Steam build 25975867. The installed game files differ; the cheats have been left off.' return end openProcess(pid) if getOpenedProcessID()~=pid then return end S.pid=pid; S.base=game.Address; S.path=game.PathToFile; S.attachError=nil end S.timer=createTimer(nil,false) S.timer.Interval=1500 S.timer.OnTimer=function() local ok,err=pcall(attach) if not ok then S.lastError=err end end S.timer.Enabled=true pcall(attach)