16
"Launch Mono and show Cheats"
Auto Assembler Script
[ENABLE]
{$LUA}
LaunchMonoDataCollector()
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
25
"F1: No Damage for group"
Auto Assembler Script
[ENABLE]
GamePlayerLogic:ReceiveDamage:
ret
[DISABLE]
GamePlayerLogic:ReceiveDamage:
push rbp
Toggle Activation
112
No Dmg on/off
0
Activated
Deactivated
158
"F2: Walk through closed doors"
Auto Assembler Script
[ENABLE]
GamePlayerLogic:MovementControl+51a:
nop
nop
nop
nop
nop
nop
[DISABLE]
GamePlayerLogic:MovementControl+51a:
db 0F 84 65 02 00 00
Toggle Activation
113
1
On
Off
165
"F3: Fly over the most holes in the ground"
Auto Assembler Script
[ENABLE]
GlobalManager:DetectFallingDown+1c7:
mov r12d,00000000
GlobalManager:DetectFallingDown+1e6:
mov r12d,00000000
GlobalManager:DetectFallingDown+2d5:
mov r12d,00000000
GlobalManager:DetectFallingDown+324:
mov r12d,00000000
[DISABLE]
GlobalManager:DetectFallingDown+1c7:
mov r12d,00000001
GlobalManager:DetectFallingDown+1e6:
mov r12d,00000001
GlobalManager:DetectFallingDown+2d5:
mov r12d,00000001
GlobalManager:DetectFallingDown+324:
mov r12d,00000001
Toggle Activation
114
0
fly
no fly
159
"F4: no mana costs"
Auto Assembler Script
[ENABLE]
GameGenerationFactory:GetSpellCost+17:
// general idea: put 0 into EDI and then jump to the end of the code
mov edi,0
db e9 5d 01 00 00 90 90 90 90 90
[DISABLE]
GameGenerationFactory:GetSpellCost+17:
mov rsi, rcx
xor edi, edi
mov r15, rsi
sub r15d,0000035D
Toggle Activation
115
0
Activate
Deactivate
8
"Spend no gold"
Auto Assembler Script
[ENABLE]
GamePlayerSaveLoadManager:ReduceMoney+1e:
nop
nop
nop
nop
[DISABLE]
GamePlayerSaveLoadManager:ReduceMoney+1e:
sub ecx,[rsp+08]
{
// ORIGINAL CODE - INJECTION POINT: 1EC64372EFE
GamePlayerSaveLoadManager:ReduceMoney - 48 83 EC 18 - sub rsp,18
GamePlayerSaveLoadManager:ReduceMoney+4- 48 89 0C 24 - mov [rsp],rcx
GamePlayerSaveLoadManager:ReduceMoney+8- 48 89 54 24 08 - mov [rsp+08],rdx
GamePlayerSaveLoadManager:ReduceMoney+d- 48 8B C1 - mov rax,rcx
GamePlayerSaveLoadManager:ReduceMoney+10- 48 8B 48 18 - mov rcx,[rax+18]
GamePlayerSaveLoadManager:ReduceMoney+14- 48 8B C1 - mov rax,rcx
GamePlayerSaveLoadManager:ReduceMoney+17- 83 39 00 - cmp dword ptr [rcx],00
GamePlayerSaveLoadManager:ReduceMoney+1a- 48 63 49 70 - movsxd rcx,dword ptr [rcx+70]
GamePlayerSaveLoadManager:ReduceMoney+1e- 2B 4C 24 08 - sub ecx,[rsp+08]
GamePlayerSaveLoadManager:ReduceMoney+22- 83 38 00 - cmp dword ptr [rax],00
GamePlayerSaveLoadManager:ReduceMoney+25- 89 48 70 - mov [rax+70],ecx
GamePlayerSaveLoadManager:ReduceMoney+28- 48 83 C4 18 - add rsp,18
GamePlayerSaveLoadManager:ReduceMoney+2c- C3 - ret
}
15
"don't get hungry"
Auto Assembler Script
[ENABLE]
CharacterBase:UpdateHungry+192:
nop
nop
[DISABLE]
CharacterBase:UpdateHungry+192:
sub eax,edi
{
// ORIGINAL CODE - INJECTION POINT: 211153C52D2
CharacterBase:UpdateHungry+160 - EB 29 - jmp CharacterBase:UpdateHungry+18b
CharacterBase:UpdateHungry+162 - 48 B8 805AADB610020000 - mov rax,00000210B6AD5A80
CharacterBase:UpdateHungry+16c - 48 8B 00 - mov rax,[rax]
CharacterBase:UpdateHungry+16f - 48 8B C8 - mov rcx,rax
CharacterBase:UpdateHungry+172 - 83 39 00 - cmp dword ptr [rcx],00
CharacterBase:UpdateHungry+175 - 48 63 80 F4150000 - movsxd rax,dword ptr [rax+000015F4]
CharacterBase:UpdateHungry+17c - 83 F8 01 - cmp eax,01
CharacterBase:UpdateHungry+17f - 7F 0A - jg CharacterBase:UpdateHungry+18b
CharacterBase:UpdateHungry+181 - 83 FF 02 - cmp edi,02
CharacterBase:UpdateHungry+184 - 7C 05 - jl CharacterBase:UpdateHungry+18b
CharacterBase:UpdateHungry+186 - BF 02000000 - mov edi,00000002
CharacterBase:UpdateHungry+18b - 48 63 86 E4000000 - movsxd rax,dword ptr [rsi+000000E4]
CharacterBase:UpdateHungry+192 - 2B C7 - sub eax,edi
CharacterBase:UpdateHungry+194 - 89 86 E4000000 - mov [rsi+000000E4],eax
CharacterBase:UpdateHungry+19a - 85 C0 - test eax,eax
CharacterBase:UpdateHungry+19c - 7D 0A - jnl CharacterBase:UpdateHungry+1a8
CharacterBase:UpdateHungry+19e - C7 86 E4000000 00000000 - mov [rsi+000000E4],00000000
CharacterBase:UpdateHungry+1a8 - 48 8B CE - mov rcx,rsi
CharacterBase:UpdateHungry+1ab - 49 BB 30533C1511020000 - mov r11,CharacterBase:GetHungryStatus
CharacterBase:UpdateHungry+1b5 - 41 FF D3 - call r11
CharacterBase:UpdateHungry+1b8 - 48 8B 75 F0 - mov rsi,[rbp-10]
}
20
"Torch does not burn down / magic light does not expire"
Auto Assembler Script
[ENABLE]
ItemInfo:UpdateTorchTime+3c:
nop
nop
nop
nop
GamePlayerLogic:LoopingTorchLightSpell+4e:
nop
nop
[DISABLE]
ItemInfo:UpdateTorchTime+3c:
subsd xmm0,xmm1
GamePlayerLogic:LoopingTorchLightSpell+4e:
dec eax
163
"Much higher Mana Refresh"
Auto Assembler Script
[ENABLE]
MPInfo:AddMP+19:
add eax,#100
nop
[DISABLE]
// MPInfo:MinusMP+21:
// sub eax,esi
MPInfo:AddMP+19:
add eax,[rsp+08]
100
"Always Levelup with each kill"
Auto Assembler Script
[ENABLE]
CharacterBase:AddExperience+40:
nop
nop
[DISABLE]
CharacterBase:AddExperience+40:
db 7e 16
161
"Make 65.5535 dmg"
Auto Assembler Script
[ENABLE]
aobscan(dmgboost,48 89 95 60 FF FF FF 4D) // should be unique
alloc(newmem,$1000,1FECD663106)
label(code)
label(return)
newmem:
mov rdx,ffff
code:
mov [rbp-000000A0],rdx
jmp return
dmgboost:
jmp newmem
nop 2
return:
registersymbol(dmgboost)
[DISABLE]
dmgboost:
db 48 89 95 60 FF FF FF
unregistersymbol(dmgboost)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 1FECD663106
1FECD6630E0: 55 - push rbp
1FECD6630E1: 48 8B EC - mov rbp,rsp
1FECD6630E4: 48 81 EC D0 00 00 00 - sub rsp,000000D0
1FECD6630EB: 48 89 5D D0 - mov [rbp-30],rbx
1FECD6630EF: 48 89 75 D8 - mov [rbp-28],rsi
1FECD6630F3: 4C 89 65 E0 - mov [rbp-20],r12
1FECD6630F7: 4C 89 6D E8 - mov [rbp-18],r13
1FECD6630FB: 4C 89 75 F0 - mov [rbp-10],r14
1FECD6630FF: 4C 89 7D F8 - mov [rbp-08],r15
1FECD663103: 4C 8B E1 - mov r12,rcx
// ---------- INJECTING HERE ----------
1FECD663106: 48 89 95 60 FF FF FF - mov [rbp-000000A0],rdx
// ---------- DONE INJECTING ----------
1FECD66310D: 4D 8B F0 - mov r14,r8
1FECD663110: 4D 8B F9 - mov r15,r9
1FECD663113: 48 8B 75 38 - mov rsi,[rbp+38]
1FECD663117: 48 C7 45 C0 00 00 00 00 - mov qword ptr [rbp-40],00000000
1FECD66311F: 81 BD 60 FF FF FF 80 96 98 00 - cmp [rbp-000000A0],00989680
1FECD663129: 75 22 - jne 1FECD66314D
1FECD66312B: 49 8B CC - mov rcx,r12
1FECD66312E: 48 63 95 60 FF FF FF - movsxd rdx,dword ptr [rbp-000000A0]
1FECD663135: 45 33 C0 - xor r8d,r8d
1FECD663138: 45 33 C9 - xor r9d,r9d
}
37
"Party Gold"
4 Bytes
"THREADSTACK1"-00000350
70
58
8
258
10
98
41
"Backup Pointer"
4 Bytes
"mono-2.0-bdwgc.dll"+0043DC80
70
58
8
258
10
98
39
"Backup Pointer"
4 Bytes
"THREADSTACK1"-00000300
70
58
8
258
10
98
40
"Backup Pointer"
4 Bytes
"THREADSTACK1"-000002F0
70
58
8
258
10
98
114
"Character Stats via Pointer"
1
54
"GamePlayerLogic[]"
1
4 Bytes
"mono-2.0-bdwgc.dll"+0044EBB8
0
68
7A0
210
55
"Players"
1
4 Bytes
+670
0
56
"Character 1"
1
4 Bytes
+20
0
36
"Name"
String
10
1
0
1
+10
14
57
"Hitpoints Max"
4 Bytes
+18
10
58
"Hitpoints Current"
4 Bytes
+18
14
59
"Mana Max"
4 Bytes
+20
10
60
"Mana Current"
4 Bytes
+20
14
67
"Experience"
4 Bytes
+12c
69
"Ability Points Left"
4 Bytes
+140
70
"Skill Points Left"
4 Bytes
+144
61
"Character 2"
1
4 Bytes
+28
0
62
"Name"
String
10
1
0
1
+10
14
63
"Hitpoints Max"
4 Bytes
+18
10
64
"Hitpoints Current"
4 Bytes
+18
14
65
"Mana Max"
4 Bytes
+20
10
66
"Mana Current"
4 Bytes
+20
14
68
"Experience"
4 Bytes
+12c
71
"Ability Points Left"
4 Bytes
+140
72
"Skill Points Left"
4 Bytes
+144
73
"Character 3"
1
4 Bytes
+30
0
74
"Name"
String
10
1
0
1
+10
14
75
"Hitpoints Max"
4 Bytes
+18
10
76
"Hitpoints Current"
4 Bytes
+18
14
77
"Mana Max"
4 Bytes
+20
10
78
"Mana Current"
4 Bytes
+20
14
79
"Experience"
4 Bytes
+12c
80
"Ability Points Left"
4 Bytes
+140
81
"Skill Points Left"
4 Bytes
+144
82
"Character 4"
1
4 Bytes
+38
0
83
"Name"
String
10
1
0
1
+10
14
84
"Hitpoints Max"
4 Bytes
+18
10
85
"Hitpoints Current"
4 Bytes
+18
14
86
"Mana Max"
4 Bytes
+20
10
87
"Mana Current"
4 Bytes
+20
14
102
"Experience"
4 Bytes
+12c
89
"Ability Points Left"
4 Bytes
+140
90
"Skill Points Left"
4 Bytes
+144
99
"Backup Pointers for GamePlayerLogic if the used path fails"
1
91
"pointerscan result"
4 Bytes
"mono-2.0-bdwgc.dll"+0043A108
0
68
7A0
30
92
"pointerscan result"
4 Bytes
"mono-2.0-bdwgc.dll"+0044EA90
0
68
7A0
230
93
"pointerscan result"
4 Bytes
"mono-2.0-bdwgc.dll"+0044EBB8
0
B8
7A8
210
94
"pointerscan result"
4 Bytes
"mono-2.0-bdwgc.dll"+0043A108
0
B8
7A8
30
95
"pointerscan result"
4 Bytes
"mono-2.0-bdwgc.dll"+0044EA90
0
B8
7A8
230
97
"pointerscan result"
4 Bytes
"mono-2.0-bdwgc.dll"+0044EAD8
0
640
658
210
98
"pointerscan result"
4 Bytes
"mono-2.0-bdwgc.dll"+0044ED08
0
68
7A0
210
238
113
"pointerscan result"
4 Bytes
"UnityPlayer.dll"+0144ED80
0
28
40
38
40
115
"Character Stats via Code Injection"
Auto Assembler Script
[ENABLE]
aobscan(GPLptr,48 8D 10 41 83 3F 00 49 BB B0) // should be unique
alloc(newmem,$1000,217D513C624)
label(code)
label(return)
globalalloc(_gameplaylogic,8)
newmem:
lea rdx,[rax]
mov [_gameplaylogic],r15
code:
cmp dword ptr [r15],00
jmp return
GPLptr:
jmp newmem
nop 2
return:
registersymbol(GPLptr)
[DISABLE]
GPLptr:
db 48 8D 10 41 83 3F 00
unregistersymbol(GPLptr)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 217D513C624
217D513C5F5: 49 8B CE - mov rcx,r14
217D513C5F8: 49 BB 50 30 1F DB 17 02 00 00 - mov r11,00000217DB1F3050
217D513C602: 41 FF D3 - call r11
217D513C605: 49 8B CF - mov rcx,r15
217D513C608: 48 8B C5 - mov rax,rbp
217D513C60B: 48 83 C0 B8 - add rax,-48
217D513C60F: 48 8B 95 08 FF FF FF - mov rdx,[rbp-000000F8]
217D513C616: 48 89 55 B8 - mov [rbp-48],rdx
217D513C61A: 48 63 95 10 FF FF FF - movsxd rdx,dword ptr [rbp-000000F0]
217D513C621: 89 55 C0 - mov [rbp-40],edx
// ---------- INJECTING HERE ----------
217D513C624: 48 8D 10 - lea rdx,[rax]
217D513C627: 41 83 3F 00 - cmp dword ptr [r15],00
// ---------- DONE INJECTING ----------
217D513C62B: 49 BB B0 2C 15 D9 17 02 00 00 - mov r11,00000217D9152CB0
217D513C635: 41 FF D3 - call r11
217D513C638: 48 8B C7 - mov rax,rdi
217D513C63B: 48 8B 5D C8 - mov rbx,[rbp-38]
217D513C63F: 48 8B 75 D0 - mov rsi,[rbp-30]
217D513C643: 48 8B 7D D8 - mov rdi,[rbp-28]
217D513C647: 4C 8B 65 E0 - mov r12,[rbp-20]
217D513C64B: 4C 8B 6D E8 - mov r13,[rbp-18]
217D513C64F: 4C 8B 75 F0 - mov r14,[rbp-10]
217D513C653: 4C 8B 7D F8 - mov r15,[rbp-08]
}
154
"GamePlayerLogic-Adress from Script"
1
8 Bytes
_gameplaylogic
117
"Players"
1
4 Bytes
_gameplaylogic
0
670
118
"Character 1"
1
4 Bytes
+20
0
119
"Name"
String
10
1
0
1
+10
14
120
"Hitpoints Max"
4 Bytes
+18
10
121
"Hitpoints Current"
4 Bytes
+18
14
122
"Mana Max"
4 Bytes
+20
10
123
"Mana Current"
4 Bytes
+20
14
124
"Experience"
4 Bytes
+12c
125
"Ability Points Left"
4 Bytes
+140
126
"Skill Points Left"
4 Bytes
+144
127
"Character 2"
1
4 Bytes
+28
0
128
"Name"
String
10
1
0
1
+10
14
129
"Hitpoints Max"
4 Bytes
+18
10
130
"Hitpoints Current"
4 Bytes
+18
14
131
"Mana Max"
4 Bytes
+20
10
132
"Mana Current"
4 Bytes
+20
14
133
"Experience"
4 Bytes
+12c
134
"Ability Points Left"
4 Bytes
+140
135
"Skill Points Left"
4 Bytes
+144
136
"Character 3"
1
4 Bytes
+30
0
137
"Name"
String
10
1
0
1
+10
14
138
"Hitpoints Max"
4 Bytes
+18
10
139
"Hitpoints Current"
4 Bytes
+18
14
140
"Mana Max"
4 Bytes
+20
10
141
"Mana Current"
4 Bytes
+20
14
142
"Experience"
4 Bytes
+12c
143
"Ability Points Left"
4 Bytes
+140
144
"Skill Points Left"
4 Bytes
+144
145
"Character 4"
1
4 Bytes
+38
0
146
"Name"
String
10
1
0
1
+10
14
147
"Hitpoints Max"
4 Bytes
+18
10
148
"Hitpoints Current"
4 Bytes
+18
14
149
"Mana Max"
4 Bytes
+20
10
150
"Mana Current"
4 Bytes
+20
14
151
"Experience"
4 Bytes
+12c
152
"Ability Points Left"
4 Bytes
+140
153
"Skill Points Left"
4 Bytes
+144
162
"Auto Assemble script"
Auto Assembler Script
[ENABLE]
aobscan(falling,00 49 8B C4 48 8B 75 D0) // should be unique
alloc(newmem,$1000,1FF12D6DF9A)
label(code)
label(return)
newmem:
mov r12d,0
code:
mov rax,r12
mov rsi,[rbp-30]
jmp return
falling+01:
jmp newmem
nop 2
return:
registersymbol(falling)
[DISABLE]
falling+01:
db 49 8B C4 48 8B 75 D0
unregistersymbol(falling)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 1FF12D6DF9A
1FF12D6DF72: 49 8B CD - mov rcx,r13
1FF12D6DF75: 33 D2 - xor edx,edx
1FF12D6DF77: 49 BB E0 25 4B D0 FE 01 00 00 - mov r11,000001FED04B25E0
1FF12D6DF81: 41 FF D3 - call r11
1FF12D6DF84: 85 C0 - test eax,eax
1FF12D6DF86: 74 12 - je 1FF12D6DF9A
1FF12D6DF88: 41 0F B6 85 67 01 00 00 - movzx eax,byte ptr [r13+00000167]
1FF12D6DF90: 85 C0 - test eax,eax
1FF12D6DF92: 74 06 - je 1FF12D6DF9A
1FF12D6DF94: 41 BC 01 00 00 00 - mov r12d,00000001
// ---------- INJECTING HERE ----------
1FF12D6DF9A: 49 8B C4 - mov rax,r12
1FF12D6DF9D: 48 8B 75 D0 - mov rsi,[rbp-30]
// ---------- DONE INJECTING ----------
1FF12D6DFA1: 48 8B 7D D8 - mov rdi,[rbp-28]
1FF12D6DFA5: 4C 8B 65 E0 - mov r12,[rbp-20]
1FF12D6DFA9: 4C 8B 6D E8 - mov r13,[rbp-18]
1FF12D6DFAD: 4C 8B 75 F0 - mov r14,[rbp-10]
1FF12D6DFB1: 4C 8B 7D F8 - mov r15,[rbp-08]
1FF12D6DFB5: 48 8D 65 00 - lea rsp,[rbp+00]
1FF12D6DFB9: 5D - pop rbp
1FF12D6DFBA: C3 - ret
1FF12D6DFBB: 00 00 - add [rax],al
1FF12D6DFBD: 00 00 - add [rax],al
}
164
"Magic Light"
4 Bytes
1FF15194798
Change of je GamePlayerLogic:MovementControl+785
217D808D80A
41
FF
D3
85
C0
0F
84
65
02
00
00
83
FE
03
74
12
_gameplaylogic
217D9170000
MonsterAI:ReceiveDamage
private void ReceiveDamage(int iNumber, bool bMissed, bool bCritical)
------------------------------------------------------------------------------
Detect if entering the next tile is possible:
GlobalManager:DetectMoveAble
------------------------------------------------------------------------------
Coordinates: X increases when walking East, Y increased when walking south.
Values are 4-byte.
Changing the found coordinates does not teleport the party, sadly...
------------------------------------------------------------------------------
set r12 to zero here and we do not fall down - except on deadly holes :(
GlobalManager:DetectFallingDown+32a - 49 8B C4 - mov rax,r12
------------------------------------------------------------------------------
maybe of interest:
GamePlayerLogic:FallingDown
00FF570C
1
00FF5752
1
0154CA76
0
13569124
1
1360A5B6
1