35
"Fast Level Ups"
Auto Assembler Script
[ENABLE]
aobscan(xp1,8B 41 10 8B 49 20 3B C1 7C) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
push rbx
mov ebx,[ecx+20]
dec ebx
cmp [ecx+10],ebx
jge code
mov [ecx+10],ebx
code:
pop rbx
mov eax,[ecx+10]
mov ecx,[ecx+20]
jmp return
xp1:
jmp newmem
nop
return:
registersymbol(xp1)
[DISABLE]
xp1:
db 8B 41 10 8B 49 20
unregistersymbol(xp1)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 0620D51E
""+620D500: 85 C0 - test eax,eax
""+620D502: 0F 84 2E 00 00 00 - je 0620D536
""+620D508: 8B 05 C8 AC CD 0F - mov eax,[0FCDACC8]
""+620D50E: D9 40 30 - fld dword ptr [eax+30]
""+620D511: D9 EE - fldz
""+620D513: DF F1 - fcomip st(0),st(1)
""+620D515: DD D8 - fstp st(0)
""+620D517: 72 02 - jb 0620D51B
""+620D519: EB 1B - jmp 0620D536
""+620D51B: 8B 4D 08 - mov ecx,[ebp+08]
// ---------- INJECTING HERE ----------
""+620D51E: 8B 41 10 - mov eax,[ecx+10]
""+620D521: 8B 49 20 - mov ecx,[ecx+20]
// ---------- DONE INJECTING ----------
""+620D524: 3B C1 - cmp eax,ecx
""+620D526: 7C 0E - jl 0620D536
""+620D528: 83 EC 0C - sub esp,0C
""+620D52B: FF 75 08 - push [ebp+08]
""+620D52E: E8 ED A5 B7 6E - call 74D87B20
""+620D533: 83 C4 10 - add esp,10
""+620D536: C9 - leave
""+620D537: C3 - ret
""+620D538: 68 60 54 BD 0C - push 0CBD5460
""+620D53D: E9 E6 2A FB FE - jmp 051C0028
}
31
"Inf Candle Light (Must Have Candle lit before turning on)"
Auto Assembler Script
[ENABLE]
aobscan(candle_light1,EB 24 D9 47 28 DD 5D C8 E8 ??) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(candle_base)
registersymbol(candle_base)
newmem:
code:
mov [candle_base],edi
mov [edi+28],(float)100
fld dword ptr [edi+28]
fstp qword ptr [ebp-38]
jmp return
candle_base:
dd 0
candle_light1+02:
jmp newmem
nop
return:
registersymbol(candle_light1)
[DISABLE]
candle_light1+02:
db D9 47 28 DD 5D C8
unregistersymbol(candle_light1)
unregistersymbol(candle_base)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 74D80442
""+74D80428: D9 40 40 - fld dword ptr [eax+40]
""+74D8042B: D9 05 F8 A4 04 73 - fld dword ptr [7304A4F8]
""+74D80431: DE C9 - fmulp st(1),st(0)
""+74D80433: D9 CA - fxch st(2)
""+74D80435: D9 C9 - fxch st(1)
""+74D80437: D9 CA - fxch st(2)
""+74D80439: DE C9 - fmulp st(1),st(0)
""+74D8043B: DE E9 - fsubp st(1),st(0)
""+74D8043D: D9 5F 28 - fstp dword ptr [edi+28]
""+74D80440: EB 24 - jmp CandlestickBehavior:Update+e6
// ---------- INJECTING HERE ----------
""+74D80442: D9 47 28 - fld dword ptr [edi+28]
""+74D80445: DD 5D C8 - fstp qword ptr [ebp-38]
// ---------- DONE INJECTING ----------
""+74D80448: E8 D3 D8 CE 90 - call UnityEngine:Time:get_deltaTime
""+74D8044D: DD 45 C8 - fld qword ptr [ebp-38]
""+74D80450: 8B 05 E0 F5 8C 5E - mov eax,[5E8CF5E0]
""+74D80456: D9 40 40 - fld dword ptr [eax+40]
""+74D80459: D9 CA - fxch st(2)
""+74D8045B: D9 C9 - fxch st(1)
""+74D8045D: D9 CA - fxch st(2)
""+74D8045F: DE C9 - fmulp st(1),st(0)
""+74D80461: DE E9 - fsubp st(1),st(0)
""+74D80463: D9 5F 28 - fstp dword ptr [edi+28]
}
38
"Candle Light Address"
Float
[candle_base]+28
39
"Candle Light When walking/running"
Auto Assembler Script
[ENABLE]
aobscan(run_candle,D9 47 28 DD 5D C8 E8) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
mov [edi+28],(float)100
fld dword ptr [edi+28]
fstp qword ptr [ebp-38]
jmp return
run_candle:
jmp newmem
nop
return:
registersymbol(run_candle)
[DISABLE]
run_candle:
db D9 47 28 DD 5D C8
unregistersymbol(run_candle)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 265B295C
""+265B293A: 8B 05 98 AC 80 0C - mov eax,[0C80AC98]
""+265B2940: D9 40 7C - fld dword ptr [eax+7C]
""+265B2943: 8B 05 98 AC 80 0C - mov eax,[0C80AC98]
""+265B2949: D9 40 28 - fld dword ptr [eax+28]
""+265B294C: D9 05 F8 C4 96 6E - fld dword ptr [6E96C4F8]
""+265B2952: DE C1 - faddp
""+265B2954: DF F1 - fcomip st(0),st(1)
""+265B2956: DD D8 - fstp st(0)
""+265B2958: 7A 30 - jp 265B298A
""+265B295A: 77 2E - ja 265B298A
// ---------- INJECTING HERE ----------
""+265B295C: D9 47 28 - fld dword ptr [edi+28]
""+265B295F: DD 5D C8 - fstp qword ptr [ebp-38]
// ---------- DONE INJECTING ----------
""+265B2962: E8 B9 A1 4F DF - call 05AACB20
""+265B2967: DD 45 C8 - fld qword ptr [ebp-38]
""+265B296A: 8B 05 30 61 A9 10 - mov eax,[10A96130]
""+265B2970: D9 40 40 - fld dword ptr [eax+40]
""+265B2973: D9 05 00 C5 96 6E - fld dword ptr [6E96C500]
""+265B2979: DE C9 - fmulp st(1),st(0)
""+265B297B: D9 CA - fxch st(2)
""+265B297D: D9 C9 - fxch st(1)
""+265B297F: D9 CA - fxch st(2)
""+265B2981: DE C9 - fmulp st(1),st(0)
}
92
"Stealth 2"
Auto Assembler Script
[ENABLE]
aobscan(stealth,D9 40 68 8B 47 30 D9) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
mov [eax+68],(float)0
code:
fld dword ptr [eax+68]
mov eax,[edi+30]
jmp return
stealth:
jmp newmem
nop
return:
registersymbol(stealth)
[DISABLE]
stealth:
db D9 40 68 8B 47 30
unregistersymbol(stealth)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 1CE44895
1CE4487A: 85 C0 - test eax,eax
1CE4487C: 74 14 - je 1CE44892
1CE4487E: 8B 47 18 - mov eax,[edi+18]
1CE44881: 83 EC 0C - sub esp,0C
1CE44884: 50 - push eax
1CE44885: 39 00 - cmp [eax],eax
1CE44887: E8 14 BF 50 E7 - call 043507A0
1CE4488C: 83 C4 10 - add esp,10
1CE4488F: 88 47 4D - mov [edi+4D],al
1CE44892: 8B 47 30 - mov eax,[edi+30]
// ---------- INJECTING HERE ----------
1CE44895: D9 40 68 - fld dword ptr [eax+68]
1CE44898: 8B 47 30 - mov eax,[edi+30]
// ---------- DONE INJECTING ----------
1CE4489B: D9 40 64 - fld dword ptr [eax+64]
1CE4489E: DF F1 - fcomip st(0),st(1)
1CE448A0: DD D8 - fstp st(0)
1CE448A2: 0F 8A 67 02 00 00 - jp 1CE44B0F
1CE448A8: 0F 87 61 02 00 00 - ja 1CE44B0F
1CE448AE: 8B 47 30 - mov eax,[edi+30]
1CE448B1: 0F B6 40 75 - movzx eax,byte ptr [eax+75]
1CE448B5: 85 C0 - test eax,eax
1CE448B7: 0F 84 E8 06 00 00 - je 1CE44FA5
1CE448BD: 8B 47 34 - mov eax,[edi+34]
}
88
"Find Health"
Auto Assembler Script
{ Game : GoaT.exe
Version:
Date : 2018-11-03
Author : Ich
This script does blah blah blah
}
[ENABLE]
aobscan(health,20 8B 05 * * * * D9 40 30 D9 9F F4 00 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(health_base)
registersymbol(health_base)
newmem:
mov [health_base],eax
code:
fstp dword ptr [edi+000000F4]
jmp return
health_base:
dd 0
health+0A:
jmp newmem
nop
return:
registersymbol(health)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
health+0A:
db D9 9F F4 00 00 00
unregistersymbol(health)
unregistersymbol(health_base)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 05A44A98
05A44A6D: FF 89 44 24 04 8B - dec [ecx-crypt32.dll+5DBBC]
05A44A73: 85 54 FF FF - test [edi+edi*8-01],edx
05A44A77: FF 89 44 24 08 8B - dec [ecx-crypt32.dll+1DBBC]
05A44A7D: 85 58 FF - test [eax-01],ebx
05A44A80: FF - db -01
05A44A81: FF 89 44 24 0C 57 - dec [ecx+570C2444]
05A44A87: E8 2C 09 00 00 - call 05A453B8
05A44A8C: 83 C4 20 - add esp,20
05A44A8F: 8B 05 60 CD C8 13 - mov eax,[13C8CD60]
05A44A95: D9 40 30 - fld dword ptr [eax+30]
// ---------- INJECTING HERE ----------
05A44A98: D9 9F F4 00 00 00 - fstp dword ptr [edi+000000F4]
// ---------- DONE INJECTING ----------
05A44A9E: D9 87 F4 00 00 00 - fld dword ptr [edi+000000F4]
05A44AA4: D9 05 B0 61 81 38 - fld dword ptr [388161B0]
05A44AAA: DE C9 - fmulp st(1),st(0)
05A44AAC: D9 9F FC 00 00 00 - fstp dword ptr [edi+000000FC]
05A44AB2: 8B 05 64 CD C8 13 - mov eax,[13C8CD64]
05A44AB8: D9 40 38 - fld dword ptr [eax+38]
05A44ABB: D9 9F F8 00 00 00 - fstp dword ptr [edi+000000F8]
05A44AC1: D9 87 F8 00 00 00 - fld dword ptr [edi+000000F8]
05A44AC7: D9 05 B8 61 81 38 - fld dword ptr [388161B8]
05A44ACD: DE C9 - fmulp st(1),st(0)
}
89
"Health-Value"
Float
[health_base]+30
96
"Unlimited Stamina/Endurance"
Auto Assembler Script
[ENABLE]
aobscan(stamina,D9 40 38 D9 9F F8 00 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
push rbx // save rbx
mov ebx,[eax+20] // get maximum
mov [eax+38],ebx // set maximum as current
pop rbx // restore rbx
code:
fld dword ptr [eax+38]
fstp dword ptr [edi+000000F8]
jmp return
stamina:
jmp newmem
nop
nop
nop
nop
return:
registersymbol(stamina)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
stamina:
db D9 40 38 D9 9F F8 00 00 00
unregistersymbol(stamina)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 257351D8
257351AC: 83 C4 20 - add esp,20
257351AF: 8B 05 F8 1D 06 15 - mov eax,[15061DF8]
257351B5: D9 40 30 - fld dword ptr [eax+30]
257351B8: E9 43 AE 4F DB - jmp 00C30000
257351BD: 90 - nop
257351BE: D9 87 F4 00 00 00 - fld dword ptr [edi+000000F4]
257351C4: D9 05 58 8F E0 39 - fld dword ptr [39E08F58]
257351CA: DE C9 - fmulp st(1),st(0)
257351CC: D9 9F FC 00 00 00 - fstp dword ptr [edi+000000FC]
257351D2: 8B 05 FC 1D 06 15 - mov eax,[15061DFC]
// ---------- INJECTING HERE ----------
257351D8: D9 40 38 - fld dword ptr [eax+38]
257351DB: D9 9F F8 00 00 00 - fstp dword ptr [edi+000000F8]
// ---------- DONE INJECTING ----------
257351E1: D9 87 F8 00 00 00 - fld dword ptr [edi+000000F8]
257351E7: D9 05 60 8F E0 39 - fld dword ptr [39E08F60]
257351ED: DE C9 - fmulp st(1),st(0)
257351EF: D9 9F 00 01 00 00 - fstp dword ptr [edi+00000100]
257351F5: D9 87 F4 00 00 00 - fld dword ptr [edi+000000F4]
257351FB: D9 87 04 01 00 00 - fld dword ptr [edi+00000104]
25735201: DF F1 - fcomip st(0),st(1)
25735203: DD D8 - fstp st(0)
25735205: 0F 85 82 00 00 00 - jne 2573528D
2573520B: 0F 8A 7C 00 00 00 - jp 2573528D
}
98
"999 Florin (when pressing TAB)"
Auto Assembler Script
[ENABLE]
aobscan(gold,8B 00 83 EC 08 6A 00 50 E8 22)
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// mov eax,[eax]
mov eax, #999
sub esp,08
jmp return
gold:
jmp newmem
return:
registersymbol(gold)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
gold:
db 8B 00 83 EC 08
unregistersymbol(gold)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 04C6B059
04C6B041: FF 75 FC - push [ebp-04]
04C6B044: E8 4F 23 00 00 - call 04C6D398
04C6B049: 83 C4 10 - add esp,10
04C6B04C: C9 - leave
04C6B04D: C3 - ret
04C6B04E: 00 00 - add [eax],al
04C6B050: 55 - push ebp
04C6B051: 8B EC - mov ebp,esp
04C6B053: 83 EC 08 - sub esp,08
04C6B056: 8B 45 08 - mov eax,[ebp+08]
// ---------- INJECTING HERE ----------
04C6B059: 8B 00 - mov eax,[eax]
04C6B05B: 83 EC 08 - sub esp,08
// ---------- DONE INJECTING ----------
04C6B05E: 6A 00 - push 00
04C6B060: 50 - push eax
04C6B061: E8 22 00 00 00 - call 04C6B088
04C6B066: 83 C4 10 - add esp,10
04C6B069: C9 - leave
04C6B06A: C3 - ret
04C6B06B: 00 68 98 - add [eax-68],ch
04C6B06E: 63 0F - arpl [edi],cx
04C6B070: 12 E9 - adc ch,cl
04C6B072: B2 4F - mov dl,4F
}
Health is saved as a float value. At least when starting a fresh game, your maximum health is 30.000.
If you get hit, the remaining health is most likely NOT a rounded number. Eating increases health by 8.
Searching for the health value will get you roundabout 10 addresses. In most cases, the address ending with ...430 is the master-value.
Looking at the code decreasing health, there are at least two identical code blocks in the game which can not be separated by simple AOB scan, because they are identical. So I narrowed down the memory region where the code is searched :)
Stealth:
29F21E3A - 0FB6 87 C4000000 - movzx eax,byte ptr [edi+000000C4]
29F21E41 - 85 C0 - test eax,eax
29F21E43 - 75 2F - jne 29F21E74
29F21E45 - D9 47 68 - fld dword ptr [edi+68]
29F21E48 - DD 5D F0 - fstp qword ptr [ebp-10]
29F21E4B - 8B 05 103A1A15 - mov eax,[151A3A10] { [143F67D0] }
29F21E51 - D9 40 74 - fld dword ptr [eax+74]
29F21E54 - D9 47 70 - fld dword ptr [edi+70]
29F21E57 - DEC9 - fmulp st(1),st(0)
29F21E59 - DD 5D E8 - fstp qword ptr [ebp-18]
29F21E5C - E8 EFEC32DB - call 05250B50
29F21E61 - DD 45 F0 - fld qword ptr [ebp-10]
29F21E64 - DD 45 E8 - fld qword ptr [ebp-18]
29F21E67 - D9C9 - fxch st(1)
29F21E69 - D9CA - fxch st(2)
29F21E6B - DEC9 - fmulp st(1),st(0)
29F21E6D - DEC1 - faddp
----------------------------------------------------------
29F21E6F - D9 5F 68 - fstp dword ptr [edi+68]
----------------------------------------------------------
29F21E72 - EB 2D - jmp 29F21EA1
29F21E74 - D9 47 68 - fld dword ptr [edi+68]
29F21E77 - DD 5D F0 - fstp qword ptr [ebp-10]
29F21E7A - 8B 05 103A1A15 - mov eax,[151A3A10] { [143F67D0] }
29F21E80 - D9 40 70 - fld dword ptr [eax+70]
29F21E83 - D9 47 70 - fld dword ptr [edi+70]
29F21E86 - DEC9 - fmulp st(1),st(0)
29F21E88 - DD 5D E8 - fstp qword ptr [ebp-18]
29F21E8B - E8 C0EC32DB - call 05250B50
29F21E90 - DD 45 F0 - fld qword ptr [ebp-10]
29F21E93 - DD 45 E8 - fld qword ptr [ebp-18]
29F21E96 - D9C9 - fxch st(1)
29F21E98 - D9CA - fxch st(2)
29F21E9A - DEC9 - fmulp st(1),st(0)
29F21E9C - DEC1 - faddp
29F21E9E - D9 5F 68 - fstp dword ptr [edi+68]
29F21EA1 - D9 47 68 - fld dword ptr [edi+68]
29F21EA4 - D9EE - fldz
29F21EA6 - D9 47 64 - fld dword ptr [edi+64]
29F21EA9 - 83 EC 04 - sub esp,04 { 4 }
29F21EAC - 83 EC 04 - sub esp,04 { 4 }
29F21EAF - D9 1C 24 - fstp dword ptr [esp]
29F21EB2 - 83 EC 04 - sub esp,04 { 4 }
29F21EB5 - D9 1C 24 - fstp dword ptr [esp]
29F21EB8 - 83 EC 04 - sub esp,04 { 4 }
29F21EBB - D9 1C 24 - fstp dword ptr [esp]
29F21EBE - E8 FDE32DDB - call 052002C0
29F21EC3 - 83 C4 10 - add esp,10 { 16 }
----------------------------------------------------------
29F21EC6 - D9 5F 68 - fstp dword ptr [edi+68]
----------------------------------------------------------
29F21EC9 - 8B 47 28 - mov eax,[edi+28]
1 2 3 4 5 6 7 8 9 a
D9 5F 68 EB 2D D9 47 68 DD 5D
F0 8B 05 ?? ?? ?? ?? D9 40 70
D9 47 70 DE C9 DD 5D E8 E8 ??
?? ?? ?? DD 45 F0 DD 45 E8 D9
C9 D9 CA DE C9 DE C1 D9 5F 68
D9 47 68 D9 EE D9 47 64 83 EC
04 83 EC 04 D9 1C 24 83 EC 04
D9 1C 24 83 EC 04 D9 1C 24 E8
?? ?? ?? ?? 83 C4 10 D9 5F 68
= +87d
= +57h