1
"Failed Adventurer"
Auto Assembler Script
[ENABLE]
{$lua}
LaunchMonoDataCollector()
{$asm}
//aobscan(INJECT_Playerbase,ERROR: Could not find unique AOB, tried code "48 8B C8 48 8B 00") // should be unique
define(INJECT_Playerbase,PlayerHealthBar:Update+2e)
alloc(newmem,$1000,INJECT_Playerbase)
registersymbol(playerbase)
label(playerbase)
label(code)
label(return)
newmem:
code:
mov rcx,rax
mov [playerbase],rax
mov rax,[rax]
jmp return
playerbase:
dq 0
INJECT_Playerbase:
jmp newmem
nop
return:
registersymbol(INJECT_Playerbase)
[DISABLE]
INJECT_Playerbase:
db 48 8B C8 48 8B 00
unregistersymbol(playerbase)
unregistersymbol(INJECT_Playerbase)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: PlayerHealthBar:Update+2e
PlayerHealthBar:Update: 55 - push rbp
PlayerHealthBar:Update+1: 48 8B EC - mov rbp,rsp
PlayerHealthBar:Update+4: 48 81 EC 20 01 00 00 - sub rsp,00000120
PlayerHealthBar:Update+b: 48 89 75 F0 - mov [rbp-10],rsi
PlayerHealthBar:Update+f: 48 89 7D F8 - mov [rbp-08],rdi
PlayerHealthBar:Update+13: 48 8B F1 - mov rsi,rcx
PlayerHealthBar:Update+16: F3 0F 10 86 AC 00 00 00 - movss xmm0,[rsi+000000AC]
PlayerHealthBar:Update+1e: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
PlayerHealthBar:Update+22: F2 0F 11 85 60 FF FF FF - movsd [rbp-000000A0],xmm0
PlayerHealthBar:Update+2a: 48 8B 46 60 - mov rax,[rsi+60]
// ---------- INJECTING HERE ----------
PlayerHealthBar:Update+2e: 48 8B C8 - mov rcx,rax
// ---------- DONE INJECTING ----------
PlayerHealthBar:Update+31: 48 8B 00 - mov rax,[rax]
PlayerHealthBar:Update+34: 49 BA 40 4A 4D C4 A0 01 00 00 - mov r10,000001A0C44D4A40
PlayerHealthBar:Update+3e: FF 50 F0 - call qword ptr [rax-10]
PlayerHealthBar:Update+41: F3 0F 5A C8 - cvtss2sd xmm1,xmm0
PlayerHealthBar:Update+45: F2 0F 10 85 60 FF FF FF - movsd xmm0,[rbp-000000A0]
PlayerHealthBar:Update+4d: 66 0F 2F C8 - comisd xmm1,xmm0
PlayerHealthBar:Update+51: 0F 86 D1 00 00 00 - jbe PlayerHealthBar:Update+128
PlayerHealthBar:Update+57: 48 8B 46 60 - mov rax,[rsi+60]
PlayerHealthBar:Update+5b: 48 8B C8 - mov rcx,rax
PlayerHealthBar:Update+5e: 48 8B 00 - mov rax,[rax]
}
2
"BASE"
0
4 Bytes
playerbase
0
3
"Hp"
0
Float
playerbase
034
4
"Max Hp"
0
Float
playerbase
38
10
"1 Hit Kill"
Auto Assembler Script
[ENABLE]
{$lua}
LaunchMonoDataCollector()
{$asm}
//aobscan(INJECT_1Hit,F3 0F 10 40 10 F3 0F 5A C0 F3 0F 10 0D 85) // should be unique
define(INJECT_1Hit,AdEffectManager:Ad+1da)
alloc(newmem,$1000,INJECT_1Hit)
label(code)
label(return)
newmem:
code:
mov [rax+10],(float)999999999
movss xmm0,[rax+10]
jmp return
INJECT_1Hit:
jmp newmem
return:
registersymbol(INJECT_1Hit)
[DISABLE]
INJECT_1Hit:
db F3 0F 10 40 10
unregistersymbol(INJECT_1Hit)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: AdEffectManager:Ad+1da
AdEffectManager:Ad+1a0: 41 FF D3 - call r11
AdEffectManager:Ad+1a3: 48 B9 00 BB 4F C4 A0 01 00 00 - mov rcx,000001A0C44FBB00
AdEffectManager:Ad+1ad: 90 - nop
AdEffectManager:Ad+1ae: 49 BB A0 0F 8F 16 A0 01 00 00 - mov r11,System:Object:__icall_wrapper_ves_icall_object_new_specific
AdEffectManager:Ad+1b8: 41 FF D3 - call r11
AdEffectManager:Ad+1bb: 48 8B C8 - mov rcx,rax
AdEffectManager:Ad+1be: 48 8B 85 30 FE FF FF - mov rax,[rbp-000001D0]
AdEffectManager:Ad+1c5: 48 89 8D 68 FE FF FF - mov [rbp-00000198],rcx
AdEffectManager:Ad+1cc: C7 41 10 00 00 00 00 - mov [rcx+10],00000000
AdEffectManager:Ad+1d3: 48 89 8D 40 FE FF FF - mov [rbp-000001C0],rcx
// ---------- INJECTING HERE ----------
AdEffectManager:Ad+1da: F3 0F 10 40 10 - movss xmm0,[rax+10]
// ---------- DONE INJECTING ----------
AdEffectManager:Ad+1df: F3 0F 5A C0 - cvtss2sd xmm0,xmm0
AdEffectManager:Ad+1e3: F3 0F 10 0D 85 06 00 00 - movss xmm1,[AdEffectManager:Ad+870]
AdEffectManager:Ad+1eb: F3 0F 5A C9 - cvtss2sd xmm1,xmm1
AdEffectManager:Ad+1ef: 48 8B 86 98 00 00 00 - mov rax,[rsi+00000098]
AdEffectManager:Ad+1f6: 48 63 8E C4 01 00 00 - movsxd rcx,dword ptr [rsi+000001C4]
AdEffectManager:Ad+1fd: 48 63 C9 - movsxd rcx,ecx
AdEffectManager:Ad+200: 39 48 18 - cmp [rax+18],ecx
AdEffectManager:Ad+203: 0F 86 FF 05 00 00 - jbe AdEffectManager:Ad+808
AdEffectManager:Ad+209: 48 8D 44 88 20 - lea rax,[rax+rcx*4+20]
AdEffectManager:Ad+20e: F3 0F 10 10 - movss xmm2,[rax]
}
Change of jl GalleryPage:UpdateGalleryContext+a0
1C655E58071
40
18
44
3B
F0
0F
8C
49
00
00
00
48
8B
46
20
48
Change of jae GalleryPage:UpdateGalleryContext+3b3
1C655E5808B
47
18
44
3B
E8
0F
83
42
03
00
00
48
8B
47
10
49
Change of jae GalleryPage:UpdateGalleryContext+3c8
1C655E580F6
45
18
44
3B
E0
0F
83
EC
02
00
00
49
8B
45
10
49
Change of jae GalleryPage:UpdateGalleryContext+3e0
1C655E58125
40
18
39
45
B8
0F
83
D5
02
00
00
48
8B
45
C0
48
Change of jae GalleryPage:UpdateGalleryContext+3f8
1C655E58175
40
18
39
45
A8
0F
83
9D
02
00
00
48
8B
45
B0
48
Change of je GalleryPage:UpdateGalleryContext+4a3
1C655E582E6
FF
FF
48
85
FF
0F
84
D7
01
00
00
48
B9
78
05
EF
Change of jne GalleryPage:UpdateGalleryContext+470
1C655E5838D
00
00
48
3B
C1
0F
85
FD
00
00
00
48
8B
8D
48
FF
Change of jl GalleryPage:UpdateGalleryContext+40
1C655E583AB
FF
C6
45
3B
F7
0F
8C
AF
FC
FF
FF
48
8B
5D
C8
48
Change of jmp GalleryPage:UpdateGalleryContext+294
1C655E5848B
00
00
41
FF
D3
E9
24
FE
FF
FF
BA
1E
01
00
00
Change of je GalleryControlPanel:add_OnClickLeftBtn+6d
1C5CD417741
8B
E0
4D
85
E4
74
1A
49
8B
04
24
48
Change of jne GalleryControlPanel:add_OnClickLeftBtn+c3
1C5CD417757
00
00
48
3B
C1
0F
85
56
00
00
00
4D
8B
F4
48
85
Change of jne GalleryControlPanel:add_OnClickLeftBtn+30
1C5CD41777B
8B
E8
49
3B
C7
75
A3
48
8B
75
D0
48
Change of je GalleryGroup:Start+434
1C655E57756
45
B0
48
85
F6
0F
84
D8
03
00
00
48
B9
78
05
EF
Change of je GalleryGroup:Start+f8
1C655E577D9
8B
F8
4D
85
FF
0F
84
19
00
00
00
49
8B
07
48
8B
Change of jne GalleryGroup:Start+426
1C655E577F2
00
00
48
3B
C1
0F
85
2E
03
00
00
49
8B
C7
48
89
Change of je GalleryGroup:Start+1b1
1C655E57891
8B
E8
4D
85
ED
0F
84
1A
00
00
00
49
8B
45
00
48
Change of jne GalleryGroup:Start+347
1C655E579B6
4D
B8
48
85
C0
0F
85
8B
00
00
00
48
B8
E0
FA
E6
Change of je GalleryGroup:Start+3d3
1C655E579CD
45
B0
48
85
C0
0F
84
00
01
00
00
48
B9
50
C0
3A
Change of jae GalleryGroup:InitGalleryContext+83
1C655E5B19C
46
18
44
3B
E8
73
35
49
8B
46
10
49
Change of jl GalleryGroup:InitGalleryContext+38
1C655E5B1B7
FF
C7
44
3B
FF
7C
CF
48
8B
75
D8
48
Change of jl GalleryGroup:InstanceToken+68
1C655E5A8E9
FF
C7
44
3B
FF
7C
8D
48
8B
75
E8
48
Change of jp GalleryGroup:Update+e5
1C655F3976C
C9
66
0F
2F
C8
7A
27
90
90
90
90
0F
Change of ja GalleryGroup:Update+e5
1C655F39772
27
90
90
90
90
0F
87
1D
00
00
00
C6
86
A0
00
00
Change of je GalleryViewer00:LoadFrom+1f
1A0E3B22F38
48
8B
F2
85
F6
74
05
83
FE
01
74
26
Change of jne <>c__DisplayClass4_0:<UpdateGalleryContext>b__0+28
1A05B001264
8B
F9
48
85
C0
75
02
EB
0A
48
63
56
Change of jl GalleryPage:UpdateGalleryContext+a0
1A0E3A468A1
40
18
44
3B
F0
0F
8C
49
00
00
00
48
8B
46
20
48
Change of jae GalleryPage:UpdateGalleryContext+3b3
1A0E3A468BB
47
18
44
3B
E8
0F
83
42
03
00
00
48
8B
47
10
49
Change of jae GalleryPage:UpdateGalleryContext+3c8
1A0E3A46926
45
18
44
3B
E0
0F
83
EC
02
00
00
49
8B
45
10
49
Change of jae GalleryPage:UpdateGalleryContext+3e0
1A0E3A46955
40
18
39
45
B8
0F
83
D5
02
00
00
48
8B
45
C0
48