346
"GodMode and One-Hit-Kill (you have to enter combat first and hit something)"
Auto Assembler Script
[ENABLE]
aobscan(combat,44 2B FF 44 89 BE C4 00 00 00)
alloc(newmem,$1000,combat)
label(code)
label(return)
label(godmode_on)
label(onehit_on)
label(onehit)
newmem:
cmp dword ptr [rsi+000000e5],01 // check IsMember
jne onehit
// if it's us, reduce the amount of damage received to zero, then continue
cmp byte ptr [godmode_on],1
jne code
mov edi,0
jmp code
onehit:
cmp byte ptr [onehit_on],1
jne code
mov edi, r15d // just make the damage equal to the health left, then continue
code:
sub r15d,edi // originalcoce
mov [rsi+000000C4],r15d
jmp return
godmode_on:
db 0
onehit_on:
db 0
combat:
jmp newmem
nop 5
return:
registersymbol(combat)
registersymbol(godmode_on)
registersymbol(onehit_on)
[DISABLE]
combat:
db 44 2B FF 44 89 BE C4 00 00 00
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 7FFF22ABAC4E
7FFF22ABAC36: 74 7B - je 7FFF22ABACB3
7FFF22ABAC38: EB 4B - jmp 7FFF22ABAC85
7FFF22ABAC3A: 39 01 - cmp [rcx],eax
7FFF22ABAC3C: 7E 42 - jle 7FFF22ABAC80
7FFF22ABAC3E: 89 01 - mov [rcx],eax
7FFF22ABAC40: EB 3E - jmp 7FFF22ABAC80
7FFF22ABAC42: 45 8B EF - mov r13d,r15d
7FFF22ABAC45: 48 8B 4E 10 - mov rcx,[rsi+10]
7FFF22ABAC49: 8B 49 60 - mov ecx,[rcx+60]
7FFF22ABAC4C: 8B C1 - mov eax,ecx
// ---------- INJECTING HERE ----------
7FFF22ABAC4E: 44 2B FF - sub r15d,edi
// ---------- DONE INJECTING ----------
7FFF22ABAC51: 44 89 BE C4 00 00 00 - mov [rsi+000000C4],r15d
7FFF22ABAC58: 48 8D 96 C4 00 00 00 - lea rdx,[rsi+000000C4]
7FFF22ABAC5F: 83 3A 00 - cmp dword ptr [rdx],00
7FFF22ABAC62: 7D 13 - jnl 7FFF22ABAC77
7FFF22ABAC64: 33 C9 - xor ecx,ecx
7FFF22ABAC66: 89 0A - mov [rdx],ecx
7FFF22ABAC68: 45 85 E4 - test r12d,r12d
7FFF22ABAC6B: 74 05 - je 7FFF22ABAC72
7FFF22ABAC6D: 44 8B F8 - mov r15d,eax
7FFF22ABAC70: EB 13 - jmp 7FFF22ABAC85
}
351
"GodMode"
Auto Assembler Script
[ENABLE]
godmode_on:
db 1
[DISABLE]
godmode_on:
db 0
352
"OneHit"
Auto Assembler Script
[ENABLE]
onehit_on:
db 1
[DISABLE]
onehit_on:
db 0
348
"Get Gold (activate and press ESC to update)"
Auto Assembler Script
[ENABLE]
aobscan(getgold,8B 52 08 44 8B C7 45 33) // should be unique
alloc(newmem,$1000,getgold)
label(code)
label(return)
label(goldaddy)
newmem:
mov [goldaddy],rdx
code:
mov edx,[rdx+08]
mov r8d,edi
jmp return
goldaddy:
dq 0
getgold:
jmp newmem
nop
return:
registersymbol(getgold goldaddy)
[DISABLE]
getgold:
db 8B 52 08 44 8B C7
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 7FFF22A982C7
7FFF22A9828A: C4 E1 7A 10 44 24 58 - vmovss xmm0,[rsp+58]
7FFF22A98291: C4 E1 7A 58 05 C6 02 00 00 - vaddss xmm0,xmm0,[7FFF22A98560]
7FFF22A9829A: C4 E1 7A 10 4C 24 5C - vmovss xmm1,[rsp+5C]
7FFF22A982A1: 48 8D 4C 24 48 - lea rcx,[rsp+48]
7FFF22A982A6: C4 E1 7A 11 01 - vmovss [rcx],xmm0
7FFF22A982AB: C4 E1 7A 11 49 04 - vmovss [rcx+04],xmm1
7FFF22A982B1: 48 8B 4C 24 48 - mov rcx,[rsp+48]
7FFF22A982B6: 48 BA 18 5B 87 19 6A 02 00 00 - mov rdx,0000026A19875B18
7FFF22A982C0: 48 8B 12 - mov rdx,[rdx]
7FFF22A982C3: 48 8B 52 30 - mov rdx,[rdx+30]
// ---------- INJECTING HERE ----------
7FFF22A982C7: 8B 52 08 - mov edx,[rdx+08]
// ---------- DONE INJECTING ----------
7FFF22A982CA: 44 8B C7 - mov r8d,edi
7FFF22A982CD: 45 33 C9 - xor r9d,r9d
7FFF22A982D0: E8 EB 53 E4 FF - call Sang.Window.WindowHelper::DrawCurrency
7FFF22A982D5: 48 89 44 24 50 - mov [rsp+50],rax
7FFF22A982DA: 48 8D 44 24 5C - lea rax,[rsp+5C]
7FFF22A982DF: C4 E1 7A 10 00 - vmovss xmm0,[rax]
7FFF22A982E4: C4 E1 7A 58 05 77 02 00 00 - vaddss xmm0,xmm0,[7FFF22A98564]
7FFF22A982ED: C4 E1 7A 11 00 - vmovss [rax],xmm0
7FFF22A982F2: 48 B8 38 60 87 19 6A 02 00 00 - mov rax,0000026A19876038
7FFF22A982FC: 48 8B 00 - mov rax,[rax]
}
349
"Gold (to be more precise: Copper-Value)"
0
8 Bytes
goldaddy
8
31
"Character-Editor (use when on world map)"
Auto Assembler Script
[ENABLE]
aobscan(chardata,83 B9 C4 00 00 00 00 7E 0D) // should be unique
alloc(newmem,$400,chardata)
label(code)
label(return)
label(char1)
label(char2)
label(char3)
label(char4)
label(char_add1)
label(char_add2)
label(char_add3)
label(char_add4)
newmem:
// save the addresses of all chars into the according memory places
cmp dword ptr [rcx+000000C0],0
je char_add1
cmp dword ptr [rcx+000000C0],1
je char_add2
cmp dword ptr [rcx+000000C0],2
je char_add3
cmp dword ptr [rcx+000000C0],3
je char_add4
jmp code
char_add1:
mov [char1],rcx
jmp code
char_add2:
mov [char2],rcx
jmp code
char_add3:
mov [char3],rcx
jmp code
char_add4:
mov [char4],rcx
jmp code
code:
cmp dword ptr [rcx+000000C4],00
jmp return
char1:
dq 0
char2:
dq 0
char3:
dq 0
char4:
dq 0
chardata:
jmp newmem
nop 2
return:
registersymbol(chardata)
registersymbol(char1)
registersymbol(char2)
registersymbol(char3)
registersymbol(char4)
[DISABLE]
chardata:
db 83 B9 C4 00 00 00 00
unregistersymbol(chardata)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Sang.Field.Player::RefreshVisibleMember+6B
Sang.Field.Player::RefreshVisibleMember+45: 83 7F 08 00 - cmp dword ptr [rdi+08],00
Sang.Field.Player::RefreshVisibleMember+49: 7E 3D - jle Sang.Field.Player::RefreshVisibleMember+88
Sang.Field.Player::RefreshVisibleMember+4B: 48 8B CF - mov rcx,rdi
Sang.Field.Player::RefreshVisibleMember+4E: 3B 51 08 - cmp edx,[rcx+08]
Sang.Field.Player::RefreshVisibleMember+51: 0F 83 94 00 00 00 - jae Sang.Field.Player::RefreshVisibleMember+EB
Sang.Field.Player::RefreshVisibleMember+57: 48 63 C2 - movsxd rax,edx
Sang.Field.Player::RefreshVisibleMember+5A: 48 8B 44 C1 10 - mov rax,[rcx+rax*8+10]
Sang.Field.Player::RefreshVisibleMember+5F: 80 B8 E4 00 00 00 00 - cmp byte ptr [rax+000000E4],00
Sang.Field.Player::RefreshVisibleMember+66: 74 19 - je Sang.Field.Player::RefreshVisibleMember+81
Sang.Field.Player::RefreshVisibleMember+68: 48 8B C8 - mov rcx,rax
// ---------- INJECTING HERE ----------
Sang.Field.Player::RefreshVisibleMember+6B: 83 B9 C4 00 00 00 00 - cmp dword ptr [rcx+000000C4],00
// ---------- DONE INJECTING ----------
Sang.Field.Player::RefreshVisibleMember+72: 7E 0D - jle Sang.Field.Player::RefreshVisibleMember+81
Sang.Field.Player::RefreshVisibleMember+74: 48 8B 48 10 - mov rcx,[rax+10]
Sang.Field.Player::RefreshVisibleMember+78: 83 B9 70 02 00 00 00 - cmp dword ptr [rcx+00000270],00
Sang.Field.Player::RefreshVisibleMember+7F: 7F 55 - jg Sang.Field.Player::RefreshVisibleMember+D6
Sang.Field.Player::RefreshVisibleMember+81: FF C2 - inc edx
Sang.Field.Player::RefreshVisibleMember+83: 39 57 08 - cmp [rdi+08],edx
Sang.Field.Player::RefreshVisibleMember+86: 7F C3 - jg Sang.Field.Player::RefreshVisibleMember+4B
Sang.Field.Player::RefreshVisibleMember+88: 33 DB - xor ebx,ebx
Sang.Field.Player::RefreshVisibleMember+8A: 83 7F 08 00 - cmp dword ptr [rdi+08],00
Sang.Field.Player::RefreshVisibleMember+8E: 7E 2C - jle Sang.Field.Player::RefreshVisibleMember+BC
}
76
"Char1"
0
1
char1
0
32
"Character Name"
String
256
1
0
1
+8
C
70
"HPCurrent"
0000FF
4 Bytes
+C4
71
"MPCurrent"
FF0000
4 Bytes
+C8
72
"APCurrent"
008080
4 Bytes
+CC
212
"Stats"
1
33
"Hitpoints"
4 Bytes
+10
60
34
"Manapoints"
4 Bytes
+10
64
35
"ActionPoints"
4 Bytes
+10
68
36
"TurnTime"
4 Bytes
+10
6C
37
"Strength"
4 Bytes
+10
80
38
"Vitality"
4 Bytes
+10
84
39
"Dexterity"
4 Bytes
+10
88
40
"Agility"
4 Bytes
+10
8C
41
"Mind"
4 Bytes
+10
90
42
"Spirit"
4 Bytes
+10
94
43
"Speed"
4 Bytes
+10
98
44
"Luck"
4 Bytes
+10
9C
45
"Attack"
4 Bytes
+10
C0
46
"Defense"
4 Bytes
+10
C4
47
"Resistance"
4 Bytes
+10
C8
48
"CritChance"
4 Bytes
+10
CC
49
"CritDmg"
4 Bytes
+10
D0
50
"Accuracy"
4 Bytes
+10
D4
51
"Evasion"
4 Bytes
+10
D8
52
"Defence Pierce %"
4 Bytes
+10
DC
53
"Resist Pierce %"
4 Bytes
+10
E0
213
"Multipliers"
1
54
"PDmgGivenMult"
4 Bytes
+10
10C
55
"PDmgTakenMult"
4 Bytes
+10
110
56
"MDmgGivenMult"
4 Bytes
+10
114
57
"MDmgTakenMult"
4 Bytes
+10
118
58
"PCritChanceGivenMult"
4 Bytes
+10
11C
59
"PCritChanceTakenMult"
4 Bytes
+10
120
60
"PCritDmgGivenMult"
4 Bytes
+10
124
61
"PCritDmgTakenMult"
4 Bytes
+10
128
63
"HealingGivenMult"
4 Bytes
+10
15C
64
"HealingTakenMult"
4 Bytes
+10
160
66
"RepeatActionDmgMult"
4 Bytes
+10
168
67
"RepeatActionDmgMultCap"
4 Bytes
+10
16C
62
"CritResist"
4 Bytes
+10
150
65
"MPCostsMult"
4 Bytes
+10
164
68
"APBonusOnTurn"
4 Bytes
+10
1A0
69
"APBonusOnBattleStart"
4 Bytes
+10
19C
214
"Char2"
0
1
char2
0
215
"Character Name"
String
256
1
0
1
+8
C
216
"HPCurrent"
0000FF
4 Bytes
+C4
217
"MPCurrent"
FF0000
4 Bytes
+C8
218
"APCurrent"
008080
4 Bytes
+CC
219
"Stats"
1
220
"Hitpoints"
4 Bytes
+10
60
221
"Manapoints"
4 Bytes
+10
64
222
"ActionPoints"
4 Bytes
+10
68
223
"TurnTime"
4 Bytes
+10
6C
224
"Strength"
4 Bytes
+10
80
225
"Vitality"
4 Bytes
+10
84
226
"Dexterity"
4 Bytes
+10
88
227
"Agility"
4 Bytes
+10
8C
228
"Mind"
4 Bytes
+10
90
229
"Spirit"
4 Bytes
+10
94
230
"Speed"
4 Bytes
+10
98
231
"Luck"
4 Bytes
+10
9C
232
"Attack"
4 Bytes
+10
C0
233
"Defense"
4 Bytes
+10
C4
234
"Resistance"
4 Bytes
+10
C8
235
"CritChance"
4 Bytes
+10
CC
236
"CritDmg"
4 Bytes
+10
D0
237
"Accuracy"
4 Bytes
+10
D4
238
"Evasion"
4 Bytes
+10
D8
239
"Defence Pierce %"
4 Bytes
+10
DC
240
"Resist Pierce %"
4 Bytes
+10
E0
241
"Multipliers"
1
242
"PDmgGivenMult"
4 Bytes
+10
10C
243
"PDmgTakenMult"
4 Bytes
+10
110
244
"MDmgGivenMult"
4 Bytes
+10
114
245
"MDmgTakenMult"
4 Bytes
+10
118
246
"PCritChanceGivenMult"
4 Bytes
+10
11C
247
"PCritChanceTakenMult"
4 Bytes
+10
120
248
"PCritDmgGivenMult"
4 Bytes
+10
124
249
"PCritDmgTakenMult"
4 Bytes
+10
128
250
"HealingGivenMult"
4 Bytes
+10
15C
251
"HealingTakenMult"
4 Bytes
+10
160
252
"RepeatActionDmgMult"
4 Bytes
+10
168
253
"RepeatActionDmgMultCap"
4 Bytes
+10
16C
254
"CritResist"
4 Bytes
+10
150
255
"MPCostsMult"
4 Bytes
+10
164
256
"APBonusOnTurn"
4 Bytes
+10
1A0
257
"APBonusOnBattleStart"
4 Bytes
+10
19C
258
"Char3"
0
1
char3
0
259
"Character Name"
String
256
1
0
1
+8
C
260
"HPCurrent"
0000FF
4 Bytes
+C4
261
"MPCurrent"
FF0000
4 Bytes
+C8
262
"APCurrent"
008080
4 Bytes
+CC
263
"Stats"
1
264
"Hitpoints"
4 Bytes
+10
60
265
"Manapoints"
4 Bytes
+10
64
266
"ActionPoints"
4 Bytes
+10
68
267
"TurnTime"
4 Bytes
+10
6C
268
"Strength"
4 Bytes
+10
80
269
"Vitality"
4 Bytes
+10
84
270
"Dexterity"
4 Bytes
+10
88
271
"Agility"
4 Bytes
+10
8C
272
"Mind"
4 Bytes
+10
90
273
"Spirit"
4 Bytes
+10
94
274
"Speed"
4 Bytes
+10
98
275
"Luck"
4 Bytes
+10
9C
276
"Attack"
4 Bytes
+10
C0
277
"Defense"
4 Bytes
+10
C4
278
"Resistance"
4 Bytes
+10
C8
279
"CritChance"
4 Bytes
+10
CC
280
"CritDmg"
4 Bytes
+10
D0
281
"Accuracy"
4 Bytes
+10
D4
282
"Evasion"
4 Bytes
+10
D8
283
"Defence Pierce %"
4 Bytes
+10
DC
284
"Resist Pierce %"
4 Bytes
+10
E0
285
"Multipliers"
1
286
"PDmgGivenMult"
4 Bytes
+10
10C
287
"PDmgTakenMult"
4 Bytes
+10
110
288
"MDmgGivenMult"
4 Bytes
+10
114
289
"MDmgTakenMult"
4 Bytes
+10
118
290
"PCritChanceGivenMult"
4 Bytes
+10
11C
291
"PCritChanceTakenMult"
4 Bytes
+10
120
292
"PCritDmgGivenMult"
4 Bytes
+10
124
293
"PCritDmgTakenMult"
4 Bytes
+10
128
294
"HealingGivenMult"
4 Bytes
+10
15C
295
"HealingTakenMult"
4 Bytes
+10
160
296
"RepeatActionDmgMult"
4 Bytes
+10
168
297
"RepeatActionDmgMultCap"
4 Bytes
+10
16C
298
"CritResist"
4 Bytes
+10
150
299
"MPCostsMult"
4 Bytes
+10
164
300
"APBonusOnTurn"
4 Bytes
+10
1A0
301
"APBonusOnBattleStart"
4 Bytes
+10
19C
302
"Char4"
0
1
char4
0
303
"Character Name"
String
256
1
0
1
+8
C
304
"HPCurrent"
0000FF
4 Bytes
+C4
305
"MPCurrent"
FF0000
4 Bytes
+C8
306
"APCurrent"
008080
4 Bytes
+CC
307
"Stats"
1
308
"Hitpoints"
4 Bytes
+10
60
309
"Manapoints"
4 Bytes
+10
64
310
"ActionPoints"
4 Bytes
+10
68
311
"TurnTime"
4 Bytes
+10
6C
312
"Strength"
4 Bytes
+10
80
313
"Vitality"
4 Bytes
+10
84
314
"Dexterity"
4 Bytes
+10
88
315
"Agility"
4 Bytes
+10
8C
316
"Mind"
4 Bytes
+10
90
317
"Spirit"
4 Bytes
+10
94
318
"Speed"
4 Bytes
+10
98
319
"Luck"
4 Bytes
+10
9C
320
"Attack"
4 Bytes
+10
C0
321
"Defense"
4 Bytes
+10
C4
322
"Resistance"
4 Bytes
+10
C8
323
"CritChance"
4 Bytes
+10
CC
324
"CritDmg"
4 Bytes
+10
D0
325
"Accuracy"
4 Bytes
+10
D4
326
"Evasion"
4 Bytes
+10
D8
327
"Defence Pierce %"
4 Bytes
+10
DC
328
"Resist Pierce %"
4 Bytes
+10
E0
329
"Multipliers"
1
330
"PDmgGivenMult"
4 Bytes
+10
10C
331
"PDmgTakenMult"
4 Bytes
+10
110
332
"MDmgGivenMult"
4 Bytes
+10
114
333
"MDmgTakenMult"
4 Bytes
+10
118
334
"PCritChanceGivenMult"
4 Bytes
+10
11C
335
"PCritChanceTakenMult"
4 Bytes
+10
120
336
"PCritDmgGivenMult"
4 Bytes
+10
124
337
"PCritDmgTakenMult"
4 Bytes
+10
128
338
"HealingGivenMult"
4 Bytes
+10
15C
339
"HealingTakenMult"
4 Bytes
+10
160
340
"RepeatActionDmgMult"
4 Bytes
+10
168
341
"RepeatActionDmgMultCap"
4 Bytes
+10
16C
342
"CritResist"
4 Bytes
+10
150
343
"MPCostsMult"
4 Bytes
+10
164
344
"APBonusOnTurn"
4 Bytes
+10
1A0
345
"APBonusOnBattleStart"
4 Bytes
+10
19C
355
"Get 10x the XP than normal"
Auto Assembler Script
[ENABLE]
aobscan(experience,44 8B 41 18 41 3B C0) // should be unique
alloc(newmem,$1000,experience)
label(code)
label(return)
newmem:
imul edx,10
code:
mov r8d,[rcx+18]
cmp eax,r8d
jmp return
experience:
jmp newmem
nop 2
return:
registersymbol(experience)
[DISABLE]
experience:
db 44 8B 41 18 41 3B C0
unregistersymbol(experience)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Sang.PartyData.LevelsCollection::CollectExp+16
Sang.PartyData.LevelsCollection::CollectExp+2: 41 56 - push r14
Sang.PartyData.LevelsCollection::CollectExp+4: 41 54 - push r12
Sang.PartyData.LevelsCollection::CollectExp+6: 57 - push rdi
Sang.PartyData.LevelsCollection::CollectExp+7: 56 - push rsi
Sang.PartyData.LevelsCollection::CollectExp+8: 55 - push rbp
Sang.PartyData.LevelsCollection::CollectExp+9: 53 - push rbx
Sang.PartyData.LevelsCollection::CollectExp+A: 48 83 EC 40 - sub rsp,40
Sang.PartyData.LevelsCollection::CollectExp+E: 49 8B F0 - mov rsi,r8
Sang.PartyData.LevelsCollection::CollectExp+11: 33 FF - xor edi,edi
Sang.PartyData.LevelsCollection::CollectExp+13: 8B 41 1C - mov eax,[rcx+1C]
// ---------- INJECTING HERE ----------
Sang.PartyData.LevelsCollection::CollectExp+16: 44 8B 41 18 - mov r8d,[rcx+18]
// ---------- DONE INJECTING ----------
Sang.PartyData.LevelsCollection::CollectExp+1A: 41 3B C0 - cmp eax,r8d
Sang.PartyData.LevelsCollection::CollectExp+1D: 0F 8D B7 00 00 00 - jnl Sang.PartyData.LevelsCollection::CollectExp+DA
Sang.PartyData.LevelsCollection::CollectExp+23: 01 51 20 - add [rcx+20],edx
Sang.PartyData.LevelsCollection::CollectExp+26: EB 7C - jmp Sang.PartyData.LevelsCollection::CollectExp+A4
Sang.PartyData.LevelsCollection::CollectExp+28: BF 01 00 00 00 - mov edi,00000001
Sang.PartyData.LevelsCollection::CollectExp+2D: 29 41 20 - sub [rcx+20],eax
Sang.PartyData.LevelsCollection::CollectExp+30: 48 8B 41 08 - mov rax,[rcx+08]
Sang.PartyData.LevelsCollection::CollectExp+34: 4C 8B 96 80 01 00 00 - mov r10,[rsi+00000180]
Sang.PartyData.LevelsCollection::CollectExp+3B: 45 8B 52 60 - mov r10d,[r10+60]
Sang.PartyData.LevelsCollection::CollectExp+3F: 45 8B DA - mov r11d,r10d
}
379
"Get Coordinates"
Auto Assembler Script
[ENABLE]
aobscan(getcoords,02 00 00 48 8B 4E 08 C4 E1 7A 10 B1 28 01 00 00) // should be unique
alloc(newmem,$1000,getcoords)
label(code)
label(return)
label(coords)
newmem:
mov [coords],rcx
code:
vmovss xmm6,[rcx+00000128]
jmp return
coords:
dq 0
getcoords+07:
jmp newmem
nop 4
return:
registersymbol(getcoords coords)
[DISABLE]
getcoords+07:
db C4 E1 7A 10 B1 28 01 00 00
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Sang.Field.PhysicsEngine::UpdateTick+D34
Sang.Field.PhysicsEngine::UpdateTick+CF1: 0F 83 C6 1E 00 00 - jae Sang.Field.PhysicsEngine::UpdateTick+2BBD
Sang.Field.PhysicsEngine::UpdateTick+CF7: 48 63 D5 - movsxd rdx,ebp
Sang.Field.PhysicsEngine::UpdateTick+CFA: 48 8B 4C D1 10 - mov rcx,[rcx+rdx*8+10]
Sang.Field.PhysicsEngine::UpdateTick+CFF: C4 E1 7A 10 84 24 84 00 00 00 - vmovss xmm0,[rsp+00000084]
Sang.Field.PhysicsEngine::UpdateTick+D09: C4 E1 7A 5C 81 04 01 00 00 - vsubss xmm0,xmm0,[rcx+00000104]
Sang.Field.PhysicsEngine::UpdateTick+D12: C4 E1 7A 10 8C 24 30 01 00 00 - vmovss xmm1,[rsp+00000130]
Sang.Field.PhysicsEngine::UpdateTick+D1C: C4 E1 72 58 0D A3 1E 00 00 - vaddss xmm1,xmm1,[7FFF227D0E58]
Sang.Field.PhysicsEngine::UpdateTick+D25: C4 E1 78 2E C8 - vucomiss xmm1,xmm0
Sang.Field.PhysicsEngine::UpdateTick+D2A: 0F 86 74 02 00 00 - jbe Sang.Field.PhysicsEngine::UpdateTick+FA4
Sang.Field.PhysicsEngine::UpdateTick+D30: 48 8B 4E 08 - mov rcx,[rsi+08]
// ---------- INJECTING HERE ----------
Sang.Field.PhysicsEngine::UpdateTick+D34: C4 E1 7A 10 B1 28 01 00 00 - vmovss xmm6,[rcx+00000128]
// ---------- DONE INJECTING ----------
Sang.Field.PhysicsEngine::UpdateTick+D3D: 4C 8B 76 10 - mov r14,[rsi+10]
Sang.Field.PhysicsEngine::UpdateTick+D41: 41 3B 6E 18 - cmp ebp,[r14+18]
Sang.Field.PhysicsEngine::UpdateTick+D45: 72 0F - jb Sang.Field.PhysicsEngine::UpdateTick+D56
Sang.Field.PhysicsEngine::UpdateTick+D47: B9 0D 00 00 00 - mov ecx,0000000D
Sang.Field.PhysicsEngine::UpdateTick+D4C: BA 16 00 00 00 - mov edx,00000016
Sang.Field.PhysicsEngine::UpdateTick+D51: E8 0A 05 75 5E - call System.ThrowHelper::ThrowArgumentOutOfRangeException
Sang.Field.PhysicsEngine::UpdateTick+D56: 49 8B 4E 08 - mov rcx,[r14+08]
Sang.Field.PhysicsEngine::UpdateTick+D5A: 3B 69 08 - cmp ebp,[rcx+08]
Sang.Field.PhysicsEngine::UpdateTick+D5D: 0F 83 5A 1E 00 00 - jae Sang.Field.PhysicsEngine::UpdateTick+2BBD
Sang.Field.PhysicsEngine::UpdateTick+D63: 48 63 D5 - movsxd rdx,ebp
}
380
"X"
0
Float
coords
128
381
"Z"
0
Float
coords
12c
382
"Y"
0
Float
coords
130
383
"Force chargeJump (I think)"
Auto Assembler Script
[ENABLE]
aobscan(jumpcharge,83 7E 44 04 75 06) // should be unique
alloc(newmem,$1000,jumpcharge)
label(code)
label(return)
newmem:
code:
cmp dword ptr [rsi+44],04
// jne Sang.Field.Player::UpdateJump+7C
jmp return
jumpcharge:
jmp newmem
nop
return:
registersymbol(jumpcharge)
[DISABLE]
jumpcharge:
db 83 7E 44 04 75 06
unregistersymbol(jumpcharge)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Sang.Field.Player::UpdateJump+70
Sang.Field.Player::UpdateJump+4D: 7F 1C - jg Sang.Field.Player::UpdateJump+6B
Sang.Field.Player::UpdateJump+4F: 80 7E 4C 00 - cmp byte ptr [rsi+4C],00
Sang.Field.Player::UpdateJump+53: 74 16 - je Sang.Field.Player::UpdateJump+6B
Sang.Field.Player::UpdateJump+55: 48 8B 46 08 - mov rax,[rsi+08]
Sang.Field.Player::UpdateJump+59: 80 B8 EE 00 00 00 00 - cmp byte ptr [rax+000000EE],00
Sang.Field.Player::UpdateJump+60: 75 09 - jne Sang.Field.Player::UpdateJump+6B
Sang.Field.Player::UpdateJump+62: 80 B8 F6 00 00 00 00 - cmp byte ptr [rax+000000F6],00
Sang.Field.Player::UpdateJump+69: 74 05 - je Sang.Field.Player::UpdateJump+70
Sang.Field.Player::UpdateJump+6B: FF C9 - dec ecx
Sang.Field.Player::UpdateJump+6D: 89 4E 28 - mov [rsi+28],ecx
// ---------- INJECTING HERE ----------
Sang.Field.Player::UpdateJump+70: 83 7E 44 04 - cmp dword ptr [rsi+44],04
// ---------- DONE INJECTING ----------
Sang.Field.Player::UpdateJump+74: 75 06 - jne Sang.Field.Player::UpdateJump+7C
Sang.Field.Player::UpdateJump+76: C6 46 4E 01 - mov byte ptr [rsi+4E],01
Sang.Field.Player::UpdateJump+7A: EB 14 - jmp Sang.Field.Player::UpdateJump+90
Sang.Field.Player::UpdateJump+7C: C6 46 4E 00 - mov byte ptr [rsi+4E],00
Sang.Field.Player::UpdateJump+80: C4 E1 78 57 C0 - vxorps xmm0,xmm0,xmm0
Sang.Field.Player::UpdateJump+85: C4 E1 7A 11 46 30 - vmovss [rsi+30],xmm0
Sang.Field.Player::UpdateJump+8B: 33 C9 - xor ecx,ecx
Sang.Field.Player::UpdateJump+8D: 89 4E 34 - mov [rsi+34],ecx
Sang.Field.Player::UpdateJump+90: 80 7E 4E 00 - cmp byte ptr [rsi+4E],00
Sang.Field.Player::UpdateJump+94: 74 0A - je Sang.Field.Player::UpdateJump+A0
}
Change of jne Sang.Field.Player::UpdateJump+7C
7FFF227EDBD4
28
83
7E
44
04
75
06
C6
46
4E
01
EB
Sang.Field.Player::UpdateJump+74 - 75 06 - jne Sang.Field.Player::UpdateJump+7C
=> NOPing that out seems to force chargeJump