28
"Elf Girl Pinball"
800080
1
27
"Ball Options (Only Select 1 At A Time)"
8000FF
1
14
"Set Amount Of Balls"
FF0080
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT_Ball,GameAssembly.dll,83 B9 AC 00 00 00 FF) // should be unique
alloc(newmem,$1000,INJECT_Ball)
registersymbol(INJECT_Ball BallAmount)
label(return BallAmount)
newmem:
push r15
mov r15,[BallAmount]
mov dword ptr [rcx+000000AC],r15
pop r15
cmp dword ptr [rcx+000000AC],-01
jmp return
BallAmount:
db 5
INJECT_Ball:
jmp newmem
nop 2
return:
[DISABLE]
INJECT_Ball:
db 83 B9 AC 00 00 00 FF
unregistersymbol(INJECT_Ball)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+3EE7B6
GameAssembly.dll+3EE793: 5B - pop rbx
GameAssembly.dll+3EE794: E9 A7 7D 00 00 - jmp SaveLoad.Sound_Save
GameAssembly.dll+3EE799: E8 02 7F D4 FF - call GameAssembly.dll+1366A0
GameAssembly.dll+3EE79E: CC - int 3
GameAssembly.dll+3EE79F: CC - int 3
Game.Update: 40 53 - push rbx
GameAssembly.dll+3EE7A2: 48 83 EC 20 - sub rsp,20
GameAssembly.dll+3EE7A6: 80 B9 A0 00 00 00 00 - cmp byte ptr [rcx+000000A0],00
GameAssembly.dll+3EE7AD: 48 8B D9 - mov rbx,rcx
GameAssembly.dll+3EE7B0: 0F 84 90 00 00 00 - je GameAssembly.dll+3EE846
// ---------- INJECTING HERE ----------
GameAssembly.dll+3EE7B6: 83 B9 AC 00 00 00 FF - cmp dword ptr [rcx+000000AC],-01
// ---------- DONE INJECTING ----------
GameAssembly.dll+3EE7BD: 0F 8F 83 00 00 00 - jg GameAssembly.dll+3EE846
GameAssembly.dll+3EE7C3: 80 3D 52 60 65 00 00 - cmp byte ptr [GameAssembly.dll+A4481C],00
GameAssembly.dll+3EE7CA: 75 12 - jne GameAssembly.dll+3EE7DE
GameAssembly.dll+3EE7CC: 8B 0D B2 41 3F 00 - mov ecx,[GameAssembly.dll+7E2984]
GameAssembly.dll+3EE7D2: E8 59 7D D4 FF - call GameAssembly.dll+136530
GameAssembly.dll+3EE7D7: C6 05 3E 60 65 00 01 - mov byte ptr [GameAssembly.dll+A4481C],01
GameAssembly.dll+3EE7DE: C6 83 A0 00 00 00 00 - mov byte ptr [rbx+000000A0],00
GameAssembly.dll+3EE7E5: 48 8B 05 EC 03 66 00 - mov rax,[GameAssembly.dll+A4EBD8]
GameAssembly.dll+3EE7EC: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
GameAssembly.dll+3EE7F3: 48 8B 01 - mov rax,[rcx]
}
15
"Set Ball Amount"
0
4 Bytes
BallAmount
24
"INF Balls"
FF0080
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT_InfBalls,GameAssembly.dll,FF 88 AC 00 00 00) // should be unique
INJECT_InfBalls:
db 90 90 90 90 90 90
[DISABLE]
INJECT_InfBalls:
db FF 88 AC 00 00 00
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+3E6CD7
GameAssembly.dll+3E6CA8: 45 33 C0 - xor r8d,r8d
GameAssembly.dll+3E6CAB: 48 8B CE - mov rcx,rsi
GameAssembly.dll+3E6CAE: F2 0F 11 44 24 20 - movsd [rsp+20],xmm0
GameAssembly.dll+3E6CB4: 89 44 24 28 - mov [rsp+28],eax
GameAssembly.dll+3E6CB8: E8 33 49 07 00 - call GameAssembly.dll+45B5F0
GameAssembly.dll+3E6CBD: 48 8B 05 24 80 66 00 - mov rax,[GameAssembly.dll+A4ECE8]
GameAssembly.dll+3E6CC4: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
GameAssembly.dll+3E6CCB: 48 8B 01 - mov rax,[rcx]
GameAssembly.dll+3E6CCE: 48 85 C0 - test rax,rax
GameAssembly.dll+3E6CD1: 0F 84 C2 02 00 00 - je GameAssembly.dll+3E6F99
// ---------- INJECTING HERE ----------
GameAssembly.dll+3E6CD7: FF 88 AC 00 00 00 - dec [rax+000000AC]
// ---------- DONE INJECTING ----------
GameAssembly.dll+3E6CDD: 48 8B 05 D4 7F 66 00 - mov rax,[GameAssembly.dll+A4ECB8]
GameAssembly.dll+3E6CE4: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
GameAssembly.dll+3E6CEB: 48 8B 09 - mov rcx,[rcx]
GameAssembly.dll+3E6CEE: 48 85 C9 - test rcx,rcx
GameAssembly.dll+3E6CF1: 0F 84 A2 02 00 00 - je GameAssembly.dll+3E6F99
GameAssembly.dll+3E6CF7: 33 D2 - xor edx,edx
GameAssembly.dll+3E6CF9: E8 22 03 EA FF - call GameAssembly.dll+287020
GameAssembly.dll+3E6CFE: 33 D2 - xor edx,edx
GameAssembly.dll+3E6D00: 48 8B CF - mov rcx,rdi
GameAssembly.dll+3E6D03: E8 A8 8C 01 00 - call GameAssembly.dll+3FF9B0
}
25
"Add Balls On Fail"
FF0080
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT_InfBalls,GameAssembly.dll,FF 88 AC 00 00 00) // should be unique
INJECT_InfBalls:
db FF 80 AC 00 00 00
[DISABLE]
INJECT_InfBalls:
db FF 88 AC 00 00 00
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+3E6CD7
GameAssembly.dll+3E6CA8: 45 33 C0 - xor r8d,r8d
GameAssembly.dll+3E6CAB: 48 8B CE - mov rcx,rsi
GameAssembly.dll+3E6CAE: F2 0F 11 44 24 20 - movsd [rsp+20],xmm0
GameAssembly.dll+3E6CB4: 89 44 24 28 - mov [rsp+28],eax
GameAssembly.dll+3E6CB8: E8 33 49 07 00 - call GameAssembly.dll+45B5F0
GameAssembly.dll+3E6CBD: 48 8B 05 24 80 66 00 - mov rax,[GameAssembly.dll+A4ECE8]
GameAssembly.dll+3E6CC4: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
GameAssembly.dll+3E6CCB: 48 8B 01 - mov rax,[rcx]
GameAssembly.dll+3E6CCE: 48 85 C0 - test rax,rax
GameAssembly.dll+3E6CD1: 0F 84 C2 02 00 00 - je GameAssembly.dll+3E6F99
// ---------- INJECTING HERE ----------
GameAssembly.dll+3E6CD7: FF 88 AC 00 00 00 - dec [rax+000000AC]
// ---------- DONE INJECTING ----------
GameAssembly.dll+3E6CDD: 48 8B 05 D4 7F 66 00 - mov rax,[GameAssembly.dll+A4ECB8]
GameAssembly.dll+3E6CE4: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
GameAssembly.dll+3E6CEB: 48 8B 09 - mov rcx,[rcx]
GameAssembly.dll+3E6CEE: 48 85 C9 - test rcx,rcx
GameAssembly.dll+3E6CF1: 0F 84 A2 02 00 00 - je GameAssembly.dll+3E6F99
GameAssembly.dll+3E6CF7: 33 D2 - xor edx,edx
GameAssembly.dll+3E6CF9: E8 22 03 EA FF - call GameAssembly.dll+287020
GameAssembly.dll+3E6CFE: 33 D2 - xor edx,edx
GameAssembly.dll+3E6D00: 48 8B CF - mov rcx,rdi
GameAssembly.dll+3E6D03: E8 A8 8C 01 00 - call GameAssembly.dll+3FF9B0
}
26
"End Game On Next Fail"
FF0080
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECTNoBalls,GameAssembly.dll,FF 88 AC 00 00 00) // should be unique
alloc(newmem,$1000,INJECTNoBalls)
registersymbol(INJECTNoBalls)
label(return)
newmem:
mov [rax+000000AC],-1
jmp return
INJECTNoBalls:
jmp newmem
nop
return:
[DISABLE]
INJECTNoBalls:
db FF 88 AC 00 00 00
unregistersymbol(INJECTNoBalls)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+3E6CD7
GameAssembly.dll+3E6CA8: 45 33 C0 - xor r8d,r8d
GameAssembly.dll+3E6CAB: 48 8B CE - mov rcx,rsi
GameAssembly.dll+3E6CAE: F2 0F 11 44 24 20 - movsd [rsp+20],xmm0
GameAssembly.dll+3E6CB4: 89 44 24 28 - mov [rsp+28],eax
GameAssembly.dll+3E6CB8: E8 33 49 07 00 - call GameAssembly.dll+45B5F0
GameAssembly.dll+3E6CBD: 48 8B 05 24 80 66 00 - mov rax,[GameAssembly.dll+A4ECE8]
GameAssembly.dll+3E6CC4: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
GameAssembly.dll+3E6CCB: 48 8B 01 - mov rax,[rcx]
GameAssembly.dll+3E6CCE: 48 85 C0 - test rax,rax
GameAssembly.dll+3E6CD1: 0F 84 C2 02 00 00 - je GameAssembly.dll+3E6F99
// ---------- INJECTING HERE ----------
GameAssembly.dll+3E6CD7: FF 88 AC 00 00 00 - dec [rax+000000AC]
// ---------- DONE INJECTING ----------
GameAssembly.dll+3E6CDD: 48 8B 05 D4 7F 66 00 - mov rax,[GameAssembly.dll+A4ECB8]
GameAssembly.dll+3E6CE4: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
GameAssembly.dll+3E6CEB: 48 8B 09 - mov rcx,[rcx]
GameAssembly.dll+3E6CEE: 48 85 C9 - test rcx,rcx
GameAssembly.dll+3E6CF1: 0F 84 A2 02 00 00 - je GameAssembly.dll+3E6F99
GameAssembly.dll+3E6CF7: 33 D2 - xor edx,edx
GameAssembly.dll+3E6CF9: E8 22 03 EA FF - call GameAssembly.dll+287020
GameAssembly.dll+3E6CFE: 33 D2 - xor edx,edx
GameAssembly.dll+3E6D00: 48 8B CF - mov rcx,rdi
GameAssembly.dll+3E6D03: E8 A8 8C 01 00 - call GameAssembly.dll+3FF9B0
}
6
"Pinball (Unlock Blue Girl To Populate)"
8000FF
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT_Girls,GameAssembly.dll,01 42 1C 48 8B 0D 79 C4 66 00) // should be unique
alloc(newmem,$1000,INJECT_Girls)
registersymbol(INJECT_Girls Girls)
label(return Girls)
newmem:
mov [Girls],rdx
add [rdx+1C],eax
mov rcx,[GameAssembly.dll+A527B8]
jmp return
Girls:
dq 0
INJECT_Girls:
jmp newmem
nop 5
return:
[DISABLE]
INJECT_Girls:
db 01 42 1C 48 8B 0D 79 C4 66 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+3E6335
GameAssembly.dll+3E630E: 84 C0 - test al,al
GameAssembly.dll+3E6310: 74 26 - je GameAssembly.dll+3E6338
GameAssembly.dll+3E6312: 83 7D 18 02 - cmp dword ptr [rbp+18],02
GameAssembly.dll+3E6316: 75 20 - jne GameAssembly.dll+3E6338
GameAssembly.dll+3E6318: 48 8B 05 99 89 66 00 - mov rax,[GameAssembly.dll+A4ECB8]
GameAssembly.dll+3E631F: 48 8B 88 B8 00 00 00 - mov rcx,[rax+000000B8]
GameAssembly.dll+3E6326: 48 8B 11 - mov rdx,[rcx]
GameAssembly.dll+3E6329: 48 85 D2 - test rdx,rdx
GameAssembly.dll+3E632C: 0F 84 97 08 00 00 - je GameAssembly.dll+3E6BC9
GameAssembly.dll+3E6332: 8B 45 1C - mov eax,[rbp+1C]
// ---------- INJECTING HERE ----------
GameAssembly.dll+3E6335: 01 42 1C - add [rdx+1C],eax
// ---------- DONE INJECTING ----------
GameAssembly.dll+3E6338: 48 8B 0D 79 C4 66 00 - mov rcx,[GameAssembly.dll+A527B8]
GameAssembly.dll+3E633F: F6 81 2F 01 00 00 02 - test byte ptr [rcx+0000012F],02
GameAssembly.dll+3E6346: 74 0E - je GameAssembly.dll+3E6356
GameAssembly.dll+3E6348: 44 39 B1 E0 00 00 00 - cmp [rcx+000000E0],r14d
GameAssembly.dll+3E634F: 75 05 - jne GameAssembly.dll+3E6356
GameAssembly.dll+3E6351: E8 4A 27 C2 FF - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+3E6356: 45 33 C0 - xor r8d,r8d
GameAssembly.dll+3E6359: 33 D2 - xor edx,edx
GameAssembly.dll+3E635B: 48 8B CD - mov rcx,rbp
GameAssembly.dll+3E635E: E8 8D 10 06 00 - call UnityEngine.Object.op_Inequality
}
7
"BASE"
0
C0C0C0
1
Girls
0
8
"Score Female 1"
FF0080
4 Bytes
+18
9
"Score Female 2"
FF0080
4 Bytes
+1C
10
"Heart Female 1"
FF0080
4 Bytes
+DC
11
"Heart Female 2"
FF0080
4 Bytes
+E0
17
"Game (Start Pinball Game)"
8000FF
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT_Game,GameAssembly.dll,00 89 8F A8 00 00 00) // should be unique
alloc(newmem,$1000,INJECT_Game)
registersymbol(INJECT_Game Game)
label(return Game)
newmem:
mov [Game],rdi
mov [rdi+000000A8],ecx
jmp return
Game:
dq 0
INJECT_Game+01:
jmp newmem
nop
return:
[DISABLE]
INJECT_Game+01:
db 89 8F A8 00 00 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+3EC312
GameAssembly.dll+3EC2E4: 4C 89 74 24 48 - mov [rsp+48],r14
GameAssembly.dll+3EC2E9: 48 8B 82 B8 00 00 00 - mov rax,[rdx+000000B8]
GameAssembly.dll+3EC2F0: 4C 89 7C 24 40 - mov [rsp+40],r15
GameAssembly.dll+3EC2F5: 4C 8B 00 - mov r8,[rax]
GameAssembly.dll+3EC2F8: 4D 85 C0 - test r8,r8
GameAssembly.dll+3EC2FB: 0F 84 A0 0C 00 00 - je GameAssembly.dll+3ECFA1
GameAssembly.dll+3EC301: 41 83 78 38 01 - cmp dword ptr [r8+38],01
GameAssembly.dll+3EC306: B9 02 00 00 00 - mov ecx,00000002
GameAssembly.dll+3EC30B: 75 12 - jne GameAssembly.dll+3EC31F
GameAssembly.dll+3EC30D: B9 03 00 00 00 - mov ecx,00000003
// ---------- INJECTING HERE ----------
GameAssembly.dll+3EC312: 89 8F A8 00 00 00 - mov [rdi+000000A8],ecx
// ---------- DONE INJECTING ----------
GameAssembly.dll+3EC318: 48 8B 15 31 29 66 00 - mov rdx,[GameAssembly.dll+A4EC50]
GameAssembly.dll+3EC31F: 48 8B 82 B8 00 00 00 - mov rax,[rdx+000000B8]
GameAssembly.dll+3EC326: 4C 8B 00 - mov r8,[rax]
GameAssembly.dll+3EC329: 4D 85 C0 - test r8,r8
GameAssembly.dll+3EC32C: 0F 84 6F 0C 00 00 - je GameAssembly.dll+3ECFA1
GameAssembly.dll+3EC332: 41 83 78 3C 01 - cmp dword ptr [r8+3C],01
GameAssembly.dll+3EC337: 75 0F - jne GameAssembly.dll+3EC348
GameAssembly.dll+3EC339: FF C1 - inc ecx
GameAssembly.dll+3EC33B: 89 8F A8 00 00 00 - mov [rdi+000000A8],ecx
GameAssembly.dll+3EC341: 48 8B 15 08 29 66 00 - mov rdx,[GameAssembly.dll+A4EC50]
}
18
"BASE"
0
C0C0C0
1
Game
0
20
"Money"
FF0080
4 Bytes
+A4
21
"Ball Lift Init"
FF0080
4 Bytes
+A8
22
"Ball Lift"
FF0080
4 Bytes
+AC