1337163399
"Disable All Scripts - (Always Run Before Closing CE)"
8000FF
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
local mainHook = ('Defend The Rook')
local al = getAddressList()
for i = 0, al.Count - 1 do
if al[i].Active == true and al[i].Description ~= mainHook then al[i].Active = false
end
end
for i = 0, al.Count - 1 do
if al[i].Active == true then al[i].Active = false
end
end
if not syntaxcheck then
synchronize(function()
local t = createTimer()
t.Interval,t.OnTimer = 500,function(tm)
tm.Destroy()
memrec.Active = false
end
end)
end
[DISABLE]
5082
"Compact Mode"
8000FF
Auto Assembler Script
{$lua}
if syntaxcheck then return end
[ENABLE]
function cycleFullCompact(sender,force)
local state = not(compactmenuitem.Caption == 'Compact View Mode')
if force~=nil then state = not force end
compactmenuitem.Caption = state and 'Compact View Mode' or 'Full View Mode'
getMainForm().Splitter1.Visible = state
getMainForm().Panel4.Visible = state
getMainForm().Panel5.Visible = state
end
function addCompactMenu()
if compactmenualreadyexists then return
end
local parent = getMainForm().Menu.Items
compactmenuitem = createMenuItem(parent)
parent.add(compactmenuitem)
compactmenuitem.Caption = 'Compact View Mode'
compactmenuitem.OnClick = cycleFullCompact
compactmenualreadyexists = 'yes'
end
addCompactMenu()
cycleFullCompact(nil,true)
[DISABLE]
cycleFullCompact(nil,false)
105
"Defend The Rook"
FF0000
Auto Assembler Script
[ENABLE]
{$lua}
OpenProcess("Defend The Rook.exe")
if (LaunchMonoDataCollector())==0
then error ('Failure To Launch')
end
if getCEVersion() < 7.2 then showMessage("Please update to Cheat Engine 7.2 or Higher")
return end
[DISABLE]
1337191883
"Battle Scripts"
FF0000
1
5
"Battle Menu"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_BattleMenu,ERROR: Could not find unique AOB, tried code "48 8B 06 FF 50 70") // should be unique
define(INJECT_BattleMenu,BattleMenu:Update+f)
alloc(newmem,$1000,INJECT_BattleMenu)
registersymbol(INJECT_BattleMenu Battle)
label(return Battle)
newmem:
mov [Battle],rsi
mov rax,[rsi]
call qword ptr [rax+70]
jmp return
Battle:
dq 0
INJECT_BattleMenu:
jmp newmem
nop
return:
[DISABLE]
INJECT_BattleMenu:
db 48 8B 06 FF 50 70
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: BattleMenu:Update+f
1F42103D507: 00 00 - add [rax],al
1F42103D509: 00 00 - add [rax],al
1F42103D50B: 00 00 - add [rax],al
1F42103D50D: 00 00 - add [rax],al
1F42103D50F: 00 55 48 - add [rbp+48],dl
BattleMenu:Update+2: 8B EC - mov ebp,esp
BattleMenu:Update+4: 48 83 EC 30 - sub rsp,30
BattleMenu:Update+8: 48 89 75 F8 - mov [rbp-08],rsi
BattleMenu:Update+c: 48 8B F1 - mov rsi,rcx
BattleMenu:Update+f: 48 8B 06 - mov rax,[rsi]
// ---------- INJECTING HERE ----------
BattleMenu:Update+12: FF 50 70 - call qword ptr [rax+70]
// ---------- DONE INJECTING ----------
BattleMenu:Update+15: 48 8B 75 F8 - mov rsi,[rbp-08]
BattleMenu:Update+19: 48 8D 65 00 - lea rsp,[rbp+00]
BattleMenu:Update+1d: 5D - pop rbp
BattleMenu:Update+1e: C3 - ret
1F42103D52F: 00 01 - add [rcx],al
1F42103D531: 04 02 - add al,02
1F42103D533: 05 04 03 01 50 - add eax,50010304
1F42103D538: 00 00 - add [rax],al
1F42103D53A: 00 00 - add [rax],al
1F42103D53C: 00 00 - add [rax],al
}
2
"BASE"
0
4 Bytes
Battle
0
23
"Unit 1"
1
6
"Name"
String
128
1
0
1
+58
14
18
20
10
20
7
"unitType"
4 Bytes
+58
F8
20
10
20
8
"initialHitPoints"
4 Bytes
+58
FC
20
10
20
9
"initialArmor"
4 Bytes
+58
100
20
10
20
10
"initialMoves"
4 Bytes
+58
104
20
10
20
11
"initialAttacks"
4 Bytes
+58
108
20
10
20
12
"goldValue"
4 Bytes
+58
10C
20
10
20
13
"xpValue"
4 Bytes
+58
110
20
10
20
14
"isDestroyed"
Byte
+58
114
20
10
20
15
"missingHitPoints"
4 Bytes
+58
118
20
10
20
16
"beforeDestroyedVFXDelay"
Float
+58
11C
20
10
20
17
"hardModeExtraPower"
4 Bytes
+58
120
20
10
20
18
"hardModeExtraMove"
4 Bytes
+58
124
20
10
20
19
"hardModeExtraRange"
4 Bytes
+58
128
20
10
20
20
"hardModeExtraArmor"
4 Bytes
+58
12C
20
10
20
21
"hardModeExtraHitPoints"
4 Bytes
+58
130
20
10
20
24
"Unit 2"
1
27
"Name"
String
128
1
0
1
+58
14
18
28
10
20
28
"unitType"
4 Bytes
+58
F8
28
10
20
29
"initialHitPoints"
4 Bytes
+58
FC
28
10
20
30
"initialArmor"
4 Bytes
+58
100
28
10
20
31
"initialMoves"
4 Bytes
+58
104
28
10
20
32
"initialAttacks"
4 Bytes
+58
108
28
10
20
33
"goldValue"
4 Bytes
+58
10C
28
10
20
34
"xpValue"
4 Bytes
+58
110
28
10
20
35
"isDestroyed"
Byte
+58
114
28
10
20
36
"missingHitPoints"
4 Bytes
+58
118
28
10
20
37
"beforeDestroyedVFXDelay"
Float
+58
11C
28
10
20
38
"hardModeExtraPower"
4 Bytes
+58
120
28
10
20
39
"hardModeExtraMove"
4 Bytes
+58
124
28
10
20
40
"hardModeExtraRange"
4 Bytes
+58
128
28
10
20
41
"hardModeExtraArmor"
4 Bytes
+58
12C
28
10
20
42
"hardModeExtraHitPoints"
4 Bytes
+58
130
28
10
20
26
"Unit 3"
1
43
"Name"
String
128
1
0
1
+58
14
18
30
10
20
44
"unitType"
4 Bytes
+58
F8
30
10
20
45
"initialHitPoints"
4 Bytes
+58
FC
30
10
20
46
"initialArmor"
4 Bytes
+58
100
30
10
20
47
"initialMoves"
4 Bytes
+58
104
30
10
20
48
"initialAttacks"
4 Bytes
+58
108
30
10
20
49
"goldValue"
4 Bytes
+58
10C
30
10
20
50
"xpValue"
4 Bytes
+58
110
30
10
20
51
"isDestroyed"
Byte
+58
114
30
10
20
52
"missingHitPoints"
4 Bytes
+58
118
30
10
20
53
"beforeDestroyedVFXDelay"
Float
+58
11C
30
10
20
54
"hardModeExtraPower"
4 Bytes
+58
120
30
10
20
55
"hardModeExtraMove"
4 Bytes
+58
124
30
10
20
56
"hardModeExtraRange"
4 Bytes
+58
128
30
10
20
57
"hardModeExtraArmor"
4 Bytes
+58
12C
30
10
20
58
"hardModeExtraHitPoints"
4 Bytes
+58
130
30
10
20
25
"Unit 4"
1
59
"Name"
String
128
1
0
1
+58
14
18
38
10
20
60
"unitType"
4 Bytes
+58
F8
38
10
20
61
"initialHitPoints"
4 Bytes
+58
FC
38
10
20
62
"initialArmor"
4 Bytes
+58
100
38
10
20
63
"initialMoves"
4 Bytes
+58
104
38
10
20
64
"initialAttacks"
4 Bytes
+58
108
38
10
20
65
"goldValue"
4 Bytes
+58
10C
38
10
20
66
"xpValue"
4 Bytes
+58
110
38
10
20
67
"isDestroyed"
Byte
+58
114
38
10
20
68
"missingHitPoints"
4 Bytes
+58
118
38
10
20
69
"beforeDestroyedVFXDelay"
Float
+58
11C
38
10
20
70
"hardModeExtraPower"
4 Bytes
+58
120
38
10
20
71
"hardModeExtraMove"
4 Bytes
+58
124
38
10
20
72
"hardModeExtraRange"
4 Bytes
+58
128
38
10
20
73
"hardModeExtraArmor"
4 Bytes
+58
12C
38
10
20
74
"hardModeExtraHitPoints"
4 Bytes
+58
130
38
10
20
22
" "
1
75
"currentRound"
4 Bytes
+C8
76
"lastWaveSpawnedRound"
4 Bytes
+CC
77
"currentWaveSet"
4 Bytes
+D0
78
"currentWaveVariation"
4 Bytes
+D4
79
"currentSubWave"
4 Bytes
+D8
80
"battleMode"
4 Bytes
+DC
82
"Hero (In Battle)"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_Hero,ERROR: Could not find unique AOB, tried code "83 38 00 48 8D 6D 00") // should be unique
define(INJECT_Hero,BattleOverlayMenu:Update+36f)
alloc(newmem,$1000,INJECT_Hero)
registersymbol(INJECT_Hero Hero)
label(return Hero)
newmem:
mov [Hero],rax
cmp dword ptr [rax],00
lea rbp,[rbp+00]
jmp return
Hero:
dq 0
INJECT_Hero:
jmp newmem
nop 2
return:
[DISABLE]
INJECT_Hero:
db 83 38 00 48 8D 6D 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: BattleOverlayMenu:Update+36f
BattleOverlayMenu:Update+33e: 83 38 00 - cmp dword ptr [rax],00
BattleOverlayMenu:Update+341: 48 8D 64 24 00 - lea rsp,[rsp+00]
BattleOverlayMenu:Update+346: 49 BB 60 81 A4 62 F3 01 00 00 - mov r11,UnityEngine.GameObject:get_activeInHierarchy
BattleOverlayMenu:Update+350: 41 FF D3 - call r11
BattleOverlayMenu:Update+353: 85 C0 - test eax,eax
BattleOverlayMenu:Update+355: 0F 85 DC 00 00 00 - jne BattleOverlayMenu:Update+437
BattleOverlayMenu:Update+35b: 48 B8 F0 35 83 72 F2 01 00 00 - mov rax,000001F2728335F0
BattleOverlayMenu:Update+365: 48 8B 00 - mov rax,[rax]
BattleOverlayMenu:Update+368: 48 8B 40 68 - mov rax,[rax+68]
BattleOverlayMenu:Update+36c: 48 8B C8 - mov rcx,rax
// ---------- INJECTING HERE ----------
BattleOverlayMenu:Update+36f: 83 38 00 - cmp dword ptr [rax],00
// ---------- DONE INJECTING ----------
BattleOverlayMenu:Update+372: 48 8D 6D 00 - lea rbp,[rbp+00]
BattleOverlayMenu:Update+376: 49 BB D0 72 A4 62 F3 01 00 00 - mov r11,UnityEngine.Component:get_gameObject
BattleOverlayMenu:Update+380: 41 FF D3 - call r11
BattleOverlayMenu:Update+383: 48 8B C8 - mov rcx,rax
BattleOverlayMenu:Update+386: 83 38 00 - cmp dword ptr [rax],00
BattleOverlayMenu:Update+389: 48 8D 64 24 00 - lea rsp,[rsp+00]
BattleOverlayMenu:Update+38e: 49 BB 60 81 A4 62 F3 01 00 00 - mov r11,UnityEngine.GameObject:get_activeInHierarchy
BattleOverlayMenu:Update+398: 41 FF D3 - call r11
BattleOverlayMenu:Update+39b: 85 C0 - test eax,eax
BattleOverlayMenu:Update+39d: 0F 85 94 00 00 00 - jne BattleOverlayMenu:Update+437
}
83
"BASE"
0
4 Bytes
Hero
0
84
"goldEarned"
4 Bytes
+F8
85
"xpEarned"
4 Bytes
+FC
86
"battlesCompleted"
4 Bytes
+100
87
"runsStarted"
4 Bytes
+104
88
"smallHealPercentage"
Float
+108
89
"largeHealPercentage"
Float
+10C
90
"runStartDateTime"
4 Bytes
+110
91
"minRarity"
4 Bytes
+118
92
"isAlive"
Byte
+11C
93
"hasConfirmed"
Byte
+11D
94
"ascensionReached"
4 Bytes
+120
95
"currentAscensionLevelForRun"
4 Bytes
+124
98
"Max Health/Armor Heros - 1 Hit Kill Enemy"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_Health,48 63 88 FC 00 00 00 48 B8) // should be unique
define(INJECT_Health,Unit:GetInitialHP+6e)
alloc(newmem,$1000,INJECT_Health)
label(return code enemy)
newmem:
cmp [rax+78],#0
je enemy
mov [rax+000000FC],#9999
mov [rax+00000100],#9999
jmp code
enemy:
mov [rax+000000FC],#1
mov [rax+00000100],#0
mov [rax+00000120],#0
mov [rax+00000124],#0
mov [rax+00000128],#0
mov [rax+0000012C],#0
mov [rax+00000130],#0
jmp code
code:
movsxd rcx,dword ptr [rax+000000FC]
jmp return
INJECT_Health:
jmp newmem
nop 2
return:
registersymbol(INJECT_Health)
[DISABLE]
INJECT_Health:
db 48 63 88 FC 00 00 00
unregistersymbol(INJECT_Health)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Unit:GetInitialHP+6e
Unit:GetInitialHP+29: 48 89 85 40 FF FF FF - mov [rbp-000000C0],rax
Unit:GetInitialHP+30: 48 89 85 48 FF FF FF - mov [rbp-000000B8],rax
Unit:GetInitialHP+37: 48 89 85 28 FF FF FF - mov [rbp-000000D8],rax
Unit:GetInitialHP+3e: 89 85 20 FF FF FF - mov [rbp-000000E0],eax
Unit:GetInitialHP+44: 48 89 85 18 FF FF FF - mov [rbp-000000E8],rax
Unit:GetInitialHP+4b: 48 89 85 50 FF FF FF - mov [rbp-000000B0],rax
Unit:GetInitialHP+52: 48 89 85 58 FF FF FF - mov [rbp-000000A8],rax
Unit:GetInitialHP+59: 48 89 85 60 FF FF FF - mov [rbp-000000A0],rax
Unit:GetInitialHP+60: 48 89 85 10 FF FF FF - mov [rbp-000000F0],rax
Unit:GetInitialHP+67: 48 8B 85 78 FE FF FF - mov rax,[rbp-00000188]
// ---------- INJECTING HERE ----------
Unit:GetInitialHP+6e: 48 63 88 FC 00 00 00 - movsxd rcx,dword ptr [rax+000000FC]
// ---------- DONE INJECTING ----------
Unit:GetInitialHP+75: 48 B8 F0 35 83 72 F2 01 00 00 - mov rax,000001F2728335F0
Unit:GetInitialHP+7f: 48 8B 00 - mov rax,[rax]
Unit:GetInitialHP+82: 48 8B 80 E0 00 00 00 - mov rax,[rax+000000E0]
Unit:GetInitialHP+89: 48 8B 40 58 - mov rax,[rax+58]
Unit:GetInitialHP+8d: 48 8B 40 48 - mov rax,[rax+48]
Unit:GetInitialHP+91: 48 8B D0 - mov rdx,rax
Unit:GetInitialHP+94: 83 3A 00 - cmp dword ptr [rdx],00
Unit:GetInitialHP+97: 0F B6 80 04 01 00 00 - movzx eax,byte ptr [rax+00000104]
Unit:GetInitialHP+9e: 89 8D 08 FF FF FF - mov [rbp-000000F8],ecx
Unit:GetInitialHP+a4: 85 C0 - test eax,eax
}
100
"Proximity Mines Always Armed"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_ProxMinesArmed,0F B6 86 A9 00 00 00 85 C0 74) // should be unique
define(INJECT_ProxMinesArmed,Trap:CanTrigger+27)
alloc(newmem,$1000,INJECT_ProxMinesArmed)
label(return)
newmem:
mov byte ptr [rsi+000000A9],#1
movzx eax,byte ptr [rsi+000000A9]
jmp return
INJECT_ProxMinesArmed:
jmp newmem
nop 2
return:
registersymbol(INJECT_ProxMinesArmed)
[DISABLE]
INJECT_ProxMinesArmed:
db 0F B6 86 A9 00 00 00
unregistersymbol(INJECT_ProxMinesArmed)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Trap:CanTrigger+27
Trap:CanTrigger+1: 48 8B EC - mov rbp,rsp
Trap:CanTrigger+4: 48 83 EC 60 - sub rsp,60
Trap:CanTrigger+8: 48 89 5D C8 - mov [rbp-38],rbx
Trap:CanTrigger+c: 48 89 75 D0 - mov [rbp-30],rsi
Trap:CanTrigger+10: 48 89 7D D8 - mov [rbp-28],rdi
Trap:CanTrigger+14: 4C 89 65 E0 - mov [rbp-20],r12
Trap:CanTrigger+18: 4C 89 6D E8 - mov [rbp-18],r13
Trap:CanTrigger+1c: 4C 89 75 F0 - mov [rbp-10],r14
Trap:CanTrigger+20: 4C 89 7D F8 - mov [rbp-08],r15
Trap:CanTrigger+24: 48 8B F1 - mov rsi,rcx
// ---------- INJECTING HERE ----------
Trap:CanTrigger+27: 0F B6 86 A9 00 00 00 - movzx eax,byte ptr [rsi+000000A9]
// ---------- DONE INJECTING ----------
Trap:CanTrigger+2e: 85 C0 - test eax,eax
Trap:CanTrigger+30: 74 0A - je Trap:CanTrigger+3c
Trap:CanTrigger+32: B8 01 00 00 00 - mov eax,00000001
Trap:CanTrigger+37: E9 76 02 00 00 - jmp Trap:CanTrigger+2b2
Trap:CanTrigger+3c: 48 B8 F0 35 83 72 F2 01 00 00 - mov rax,000001F2728335F0
Trap:CanTrigger+46: 48 8B 00 - mov rax,[rax]
Trap:CanTrigger+49: 48 8B 40 38 - mov rax,[rax+38]
Trap:CanTrigger+4d: 48 8B 40 78 - mov rax,[rax+78]
Trap:CanTrigger+51: 48 8B C8 - mov rcx,rax
Trap:CanTrigger+54: 83 39 00 - cmp dword ptr [rcx],00
}
101
"Unlimted Spells"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_UnlimitedSpells,00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 48 8B EC 48 81 EC B0 00 00 00 48 89 75 D8) // should be unique
define(INJECT_UnlimitedSpells,Spell:GetMaxCasts)
INJECT_UnlimitedSpells:
db C3
[DISABLE]
INJECT_UnlimitedSpells:
db 55
{
// ORIGINAL CODE - INJECTION POINT: Spell:GetMaxCasts
1F41D4D012C: 00 00 - add [rax],al
1F41D4D012E: 00 00 - add [rax],al
1F41D4D0130: 00 00 - add [rax],al
1F41D4D0132: 00 00 - add [rax],al
1F41D4D0134: 00 00 - add [rax],al
1F41D4D0136: 00 00 - add [rax],al
1F41D4D0138: 00 00 - add [rax],al
1F41D4D013A: 00 00 - add [rax],al
1F41D4D013C: 00 00 - add [rax],al
1F41D4D013E: 00 00 - add [rax],al
// ---------- INJECTING HERE ----------
Spell:GetMaxCasts: 55 - push rbp
// ---------- DONE INJECTING ----------
Spell:GetMaxCasts+1: 48 8B EC - mov rbp,rsp
Spell:GetMaxCasts+4: 48 81 EC B0 00 00 00 - sub rsp,000000B0
Spell:GetMaxCasts+b: 48 89 75 D8 - mov [rbp-28],rsi
Spell:GetMaxCasts+f: 48 89 7D E0 - mov [rbp-20],rdi
Spell:GetMaxCasts+13: 4C 89 6D E8 - mov [rbp-18],r13
Spell:GetMaxCasts+17: 4C 89 75 F0 - mov [rbp-10],r14
Spell:GetMaxCasts+1b: 4C 89 7D F8 - mov [rbp-08],r15
Spell:GetMaxCasts+1f: 48 8B F1 - mov rsi,rcx
Spell:GetMaxCasts+22: 33 C0 - xor eax,eax
Spell:GetMaxCasts+24: 48 89 45 98 - mov [rbp-68],rax
}
102
"Unlimited Traps"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_UnlimitedTraps,ERROR: Could not find unique AOB, tried code "55 48 8B EC 48 83 EC 40") // should be unique
define(INJECT_UnlimitedTraps,SpellTrap:CanCast)
INJECT_UnlimitedTraps:
db C3
[DISABLE]
INJECT_UnlimitedTraps:
db 55
{
// ORIGINAL CODE - INJECTION POINT: SpellTrap:CanCast
1F421128B89: 00 00 - add [rax],al
1F421128B8B: 00 00 - add [rax],al
1F421128B8D: 00 00 - add [rax],al
1F421128B8F: 00 01 - add [rcx],al
1F421128B91: 04 02 - add al,02
1F421128B93: 05 04 03 01 50 - add eax,50010304
1F421128B98: 00 00 - add [rax],al
1F421128B9A: 00 00 - add [rax],al
1F421128B9C: 00 00 - add [rax],al
1F421128B9E: 00 00 - add [rax],al
// ---------- INJECTING HERE ----------
SpellTrap:CanCast: 55 - push rbp
// ---------- DONE INJECTING ----------
SpellTrap:CanCast+1: 48 8B EC - mov rbp,rsp
SpellTrap:CanCast+4: 48 83 EC 40 - sub rsp,40
SpellTrap:CanCast+8: 48 89 7D F8 - mov [rbp-08],rdi
SpellTrap:CanCast+c: 48 8B F9 - mov rdi,rcx
SpellTrap:CanCast+f: 48 89 55 F0 - mov [rbp-10],rdx
SpellTrap:CanCast+13: 66 66 90 - nop 3
SpellTrap:CanCast+16: 49 BB A0 94 0A 21 F4 01 00 00 - mov r11,Ability:GetPlayer
SpellTrap:CanCast+20: 41 FF D3 - call r11
SpellTrap:CanCast+23: 48 89 45 E0 - mov [rbp-20],rax
SpellTrap:CanCast+27: 48 8B CF - mov rcx,rdi
}
103
"Unlimited Towers"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_UnlTowers,00 00 00 00 00 00 00 00 00 55 48 8B EC 48 83 EC 40 48 89 7D F8 48 8B F9 48 89 55 F0 66 66 90 49 BB A0) // should be unique
define(INJECT_UnlTowers,SpellTower:CanCast)
INJECT_UnlTowers:
db C3
[DISABLE]
INJECT_UnlTowers:
db 55
{
// ORIGINAL CODE - INJECTION POINT: SpellTower:CanCast
1F42111B5FC: 00 00 - add [rax],al
1F42111B5FE: 00 00 - add [rax],al
1F42111B600: 00 00 - add [rax],al
1F42111B602: 00 00 - add [rax],al
1F42111B604: 00 00 - add [rax],al
1F42111B606: 00 00 - add [rax],al
1F42111B608: 00 00 - add [rax],al
1F42111B60A: 00 00 - add [rax],al
1F42111B60C: 00 00 - add [rax],al
1F42111B60E: 00 00 - add [rax],al
// ---------- INJECTING HERE ----------
SpellTower:CanCast: 55 - push rbp
// ---------- DONE INJECTING ----------
SpellTower:CanCast+1: 48 8B EC - mov rbp,rsp
SpellTower:CanCast+4: 48 83 EC 40 - sub rsp,40
SpellTower:CanCast+8: 48 89 7D F8 - mov [rbp-08],rdi
SpellTower:CanCast+c: 48 8B F9 - mov rdi,rcx
SpellTower:CanCast+f: 48 89 55 F0 - mov [rbp-10],rdx
SpellTower:CanCast+13: 66 66 90 - nop 3
SpellTower:CanCast+16: 49 BB A0 94 0A 21 F4 01 00 00 - mov r11,Ability:GetPlayer
SpellTower:CanCast+20: 41 FF D3 - call r11
SpellTower:CanCast+23: 48 89 45 E0 - mov [rbp-20],rax
SpellTower:CanCast+27: 48 8B CF - mov rcx,rdi
}
1337191864
"Can Place Tower Anywhere"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_TowerAnywhere,ERROR: Could not find unique AOB, tried code "55 48 8B EC 48 83 EC 30") // should be unique
define(INJECT_TowerAnywhere,SpellTower:CanTarget)
INJECT_TowerAnywhere:
db C3
[DISABLE]
INJECT_TowerAnywhere:
db 55
{
// ORIGINAL CODE - INJECTION POINT: SpellTower:CanTarget
1F42111BB29: 04 02 - add al,02
1F42111BB2B: 05 04 03 01 50 - add eax,50010304
1F42111BB30: 00 00 - add [rax],al
1F42111BB32: 00 00 - add [rax],al
1F42111BB34: 00 00 - add [rax],al
1F42111BB36: 00 00 - add [rax],al
1F42111BB38: 00 00 - add [rax],al
1F42111BB3A: 00 00 - add [rax],al
1F42111BB3C: 00 00 - add [rax],al
1F42111BB3E: 00 00 - add [rax],al
// ---------- INJECTING HERE ----------
SpellTower:CanTarget: 55 - push rbp
// ---------- DONE INJECTING ----------
SpellTower:CanTarget+1: 48 8B EC - mov rbp,rsp
SpellTower:CanTarget+4: 48 83 EC 30 - sub rsp,30
SpellTower:CanTarget+8: 48 89 75 F8 - mov [rbp-08],rsi
SpellTower:CanTarget+c: 48 8B F2 - mov rsi,rdx
SpellTower:CanTarget+f: 48 8B CE - mov rcx,rsi
SpellTower:CanTarget+12: 33 D2 - xor edx,edx
SpellTower:CanTarget+14: 66 90 - nop 2
SpellTower:CanTarget+16: 49 BB 50 08 9F 62 F3 01 00 00 - mov r11,UnityEngine.Object:op_Inequality
SpellTower:CanTarget+20: 41 FF D3 - call r11
SpellTower:CanTarget+23: 85 C0 - test eax,eax
}
1337191884
"Menu Scripts"
FF0000
1
1337191867
"Hero Menu From Main Menu (Open Ascension Panel)"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_MainMenuHero,48 63 80 20 01 00 00 3B) // should be unique
define(INJECT_MainMenuHero,AscensionPanel:CanPressIndex+1a)
alloc(newmem,$1000,INJECT_MainMenuHero)
registersymbol(INJECT_MainMenuHero MainMHero)
label(return MainMHero)
newmem:
mov [MainMHero],rax
movsxd rax,dword ptr [rax+00000120]
jmp return
MainMHero:
dq 0
INJECT_MainMenuHero:
jmp newmem
nop 2
return:
[DISABLE]
INJECT_MainMenuHero:
db 48 63 80 20 01 00 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: AscensionPanel:CanPressIndex+1a
1F42114A4A7: 00 00 - add [rax],al
1F42114A4A9: 00 00 - add [rax],al
1F42114A4AB: 00 00 - add [rax],al
1F42114A4AD: 00 00 - add [rax],al
1F42114A4AF: 00 48 83 - add [rax-7D],cl
AscensionPanel:CanPressIndex+2: EC - in al,dx
AscensionPanel:CanPressIndex+3: 18 48 89 - sbb [rax-77],cl
AscensionPanel:CanPressIndex+6: 54 - push rsp
AscensionPanel:CanPressIndex+7: 24 08 - and al,08
AscensionPanel:CanPressIndex+9: 48 B8 F0 35 83 72 F2 01 00 00 - mov rax,000001F2728335F0
// ---------- INJECTING HERE ----------
AscensionPanel:CanPressIndex+13: 48 8B 00 - mov rax,[rax]
// ---------- DONE INJECTING ----------
AscensionPanel:CanPressIndex+16: 48 8B 40 68 - mov rax,[rax+68]
AscensionPanel:CanPressIndex+1a: 48 63 80 20 01 00 00 - movsxd rax,dword ptr [rax+00000120]
AscensionPanel:CanPressIndex+21: 3B 44 24 08 - cmp eax,[rsp+08]
AscensionPanel:CanPressIndex+25: 7D 16 - jnl AscensionPanel:CanPressIndex+3d
AscensionPanel:CanPressIndex+27: 48 B8 F0 35 83 72 F2 01 00 00 - mov rax,000001F2728335F0
AscensionPanel:CanPressIndex+31: 48 8B 00 - mov rax,[rax]
AscensionPanel:CanPressIndex+34: 0F B6 80 C8 01 00 00 - movzx eax,byte ptr [rax+000001C8]
AscensionPanel:CanPressIndex+3b: EB 05 - jmp AscensionPanel:CanPressIndex+42
AscensionPanel:CanPressIndex+3d: B8 01 00 00 00 - mov eax,00000001
AscensionPanel:CanPressIndex+42: 48 83 C4 18 - add rsp,18
}
1337191868
"BASE"
0
4 Bytes
MainMHero
0
1337191869
"goldEarned"
4 Bytes
+F8
1337191870
"xpEarned"
4 Bytes
+FC
1337191871
"battlesCompleted"
4 Bytes
+100
1337191872
"runsStarted"
4 Bytes
+104
1337191873
"smallHealPercentage"
Float
+108
1337191874
"largeHealPercentage"
Float
+10C
1337191875
"runStartDateTime"
4 Bytes
+110
1337191876
"minRarity"
4 Bytes
+118
1337191877
"isAlive"
Byte
+11C
1337191878
"hasConfirmed"
Byte
+11D
1337191879
"ascensionReached"
4 Bytes
+120
1337191880
"currentAscensionLevelForRun"
4 Bytes
+124
97
"Get 99 gems on spend"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_Gems,89 87 A8 00 00 00 48 B8) // should be unique
define(INJECT_Gems,MetaMenu:ClickVisibleEffect+2ed)
alloc(newmem,$1000,INJECT_Gems)
label(code)
label(return)
newmem:
code:
mov [rdi+000000A8],#99
jmp return
INJECT_Gems:
jmp newmem
nop
return:
registersymbol(INJECT_Gems)
[DISABLE]
INJECT_Gems:
db 89 87 A8 00 00 00
unregistersymbol(INJECT_Gems)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: MetaMenu:ClickVisibleEffect+2ed
MetaMenu:ClickVisibleEffect+2bf: 83 3F 00 - cmp dword ptr [rdi],00
MetaMenu:ClickVisibleEffect+2c2: 48 8D 6D 00 - lea rbp,[rbp+00]
MetaMenu:ClickVisibleEffect+2c6: 49 BB 70 E2 14 21 F4 01 00 00 - mov r11,MenuControl:ShowRightBlockingNotification
MetaMenu:ClickVisibleEffect+2d0: 41 FF D3 - call r11
MetaMenu:ClickVisibleEffect+2d3: E9 4B 02 00 00 - jmp MetaMenu:ClickVisibleEffect+523
MetaMenu:ClickVisibleEffect+2d8: 48 63 87 A8 00 00 00 - movsxd rax,dword ptr [rdi+000000A8]
MetaMenu:ClickVisibleEffect+2df: 49 8B 4E 18 - mov rcx,[r14+18]
MetaMenu:ClickVisibleEffect+2e3: 48 8B 49 18 - mov rcx,[rcx+18]
MetaMenu:ClickVisibleEffect+2e7: 48 63 49 68 - movsxd rcx,dword ptr [rcx+68]
MetaMenu:ClickVisibleEffect+2eb: 2B C1 - sub eax,ecx
// ---------- INJECTING HERE ----------
MetaMenu:ClickVisibleEffect+2ed: 89 87 A8 00 00 00 - mov [rdi+000000A8],eax
// ---------- DONE INJECTING ----------
MetaMenu:ClickVisibleEffect+2f3: 48 B8 F0 35 83 72 F2 01 00 00 - mov rax,000001F2728335F0
MetaMenu:ClickVisibleEffect+2fd: 48 8B 00 - mov rax,[rax]
MetaMenu:ClickVisibleEffect+300: 66 0F 57 C0 - xorpd xmm0,xmm0
MetaMenu:ClickVisibleEffect+304: 48 8B C8 - mov rcx,rax
MetaMenu:ClickVisibleEffect+307: 48 BA 60 74 52 1C F4 01 00 00 - mov rdx,000001F41C527460
MetaMenu:ClickVisibleEffect+311: 49 B8 80 F2 6C 25 F4 01 00 00 - mov r8,000001F4256CF280
MetaMenu:ClickVisibleEffect+31b: F2 0F 10 D8 - movsd xmm3,xmm0
MetaMenu:ClickVisibleEffect+31f: F2 0F 5A DB - cvtsd2ss xmm3,xmm3
MetaMenu:ClickVisibleEffect+323: 83 38 00 - cmp dword ptr [rax],00
MetaMenu:ClickVisibleEffect+326: 49 BB 00 41 01 21 F4 01 00 00 - mov r11,MenuControl:PlaySound
}
1337191882
"Max Ascension (Open And Close Ascension Panel)"
Auto Assembler Script
[ENABLE]
//aobscan(INJECT_MaxAscension,48 63 89 20 01 00 00 89) // should be unique
define(INJECT_MaxAscension,DataControl:SaveData+59a)
alloc(newmem,$1000,INJECT_MaxAscension)
registersymbol(INJECT_MaxAscension)
label(return)
newmem:
mov dword ptr [rcx+00000120],#10
mov dword ptr [rcx+00000124],#10
movsxd rcx,dword ptr [rcx+00000120]
jmp return
INJECT_MaxAscension:
jmp newmem
nop 2
return:
[DISABLE]
INJECT_MaxAscension:
db 48 63 89 20 01 00 00
unregistersymbol(INJECT_MaxAscension)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: DataControl:SaveData+59a
DataControl:SaveData+568: 48 8B 49 70 - mov rcx,[rcx+70]
DataControl:SaveData+56c: 48 89 48 60 - mov [rax+60],rcx
DataControl:SaveData+570: 48 B9 F0 35 83 72 F2 01 00 00 - mov rcx,000001F2728335F0
DataControl:SaveData+57a: 48 8B 09 - mov rcx,[rcx]
DataControl:SaveData+57d: 48 8B 49 68 - mov rcx,[rcx+68]
DataControl:SaveData+581: 48 8B 49 78 - mov rcx,[rcx+78]
DataControl:SaveData+585: 48 89 48 58 - mov [rax+58],rcx
DataControl:SaveData+589: 48 B9 F0 35 83 72 F2 01 00 00 - mov rcx,000001F2728335F0
DataControl:SaveData+593: 48 8B 09 - mov rcx,[rcx]
DataControl:SaveData+596: 48 8B 49 68 - mov rcx,[rcx+68]
// ---------- INJECTING HERE ----------
DataControl:SaveData+59a: 48 63 89 20 01 00 00 - movsxd rcx,dword ptr [rcx+00000120]
// ---------- DONE INJECTING ----------
DataControl:SaveData+5a1: 89 88 B8 00 00 00 - mov [rax+000000B8],ecx
DataControl:SaveData+5a7: 48 B9 F0 35 83 72 F2 01 00 00 - mov rcx,000001F2728335F0
DataControl:SaveData+5b1: 48 8B 09 - mov rcx,[rcx]
DataControl:SaveData+5b4: 48 8B 49 68 - mov rcx,[rcx+68]
DataControl:SaveData+5b8: 48 63 89 24 01 00 00 - movsxd rcx,dword ptr [rcx+00000124]
DataControl:SaveData+5bf: 89 88 BC 00 00 00 - mov [rax+000000BC],ecx
DataControl:SaveData+5c5: 48 B9 F0 35 83 72 F2 01 00 00 - mov rcx,000001F2728335F0
DataControl:SaveData+5cf: 48 8B 09 - mov rcx,[rcx]
DataControl:SaveData+5d2: 48 8B 89 E0 00 00 00 - mov rcx,[rcx+000000E0]
DataControl:SaveData+5d9: 48 8B 49 58 - mov rcx,[rcx+58]
}
Change of je Spell:<GetMaxCasts>b__4_0+43
1F42111B111
8B
F6
48
85
F6
74
20
48
8B
06
48
8B
Change of je Spell:<GetMaxCasts>b__4_0+43
1F42111B12E
00
00
48
3B
C1
74
03
45
33
F6
4D
8B
Change of je Spell:<GetMaxCasts>b__4_0+65
1F42111B13C
8B
C7
48
85
C0
74
17
49
8B
4F
48
48
Change of jmp Spell:<GetMaxCasts>b__4_0+67
1F42111B153
00
00
41
FF
D3
EB
02
33
C0
48
8B
75
Change of mov r11,Tile:GetUnit
1F4216C0D1E
C8
83
38
00
90
49
BB
30
1A
06
21
F4
01
00
00
41
FF
D3
48
8B
Change of je TriggerHerosBanner:GameEventOccurred+57
1F4216C0C25
8B
F6
48
85
F6
74
20
48
8B
06
48
8B
Change of mov r11,Trigger:PerformTrigger
1F4216C0CA6
48
8B
D7
66
90
49
BB
70
D0
0E
21
F4
01
00
00
41
FF
D3
48
8B
Change of jng AscensionPanel:PressedAscension+78
1F4216DA9BD
01
00
00
3B
F0
0F
8E
45
00
00
00
48
B8
F0
35
83
Change of jnl AscensionPanel:PressedAscension+e0
1F4216DAA22
01
00
00
3B
F0
0F
8D
48
00
00
00
48
B8
F0
35
83