FearLess Cheat Engine

SnowMN wrote: ↑

Wed Aug 02, 2023 2:48 pm

has anone managed to use xp multiplier cuase its the only one that crashes the game and the only one i wanted to use

[ENABLE]
aobscanmodule(playeR_crfour_player,witcher3.exe,45 33 C9 89 44 24 68 48 8B 01)
alloc(newmem,$200,playeR_crfour_player)

label(code)
label(xp_ptr)
label(cmp_xp)
label(upgradepoints)
label(CCharacterStats_area_ptr)
label(try_the_next)
label(try_next_offset)
label(read_playeR_crfour_player)


registersymbol(xp_ptr)
registersymbol(cmp_xp)
registersymbol(upgradepoints)
registersymbol(CCharacterStats_area_ptr)
registersymbol(read_playeR_crfour_player)

newmem:
  push rdx
  push rdi
  push r8
  mov rdx,rcx
  test rdx,rdx
  jz code
  mov [CCharacterStats_area_ptr],rdx                //cr4Player

  mov rdx,[rdx+1C0]
  test rdx,rdx
  jz code
  mov rdx,[rdx+40]
  test rdx,rdx
  jz code
  mov rdx,[rdx+40]
  test rdx,rdx
  jz code
  mov rdx,[rdx+8]
  test rdx,rdx
  jz code

  cmp dword ptr [rdx+18],0
  jle try_next_offset
  cmp dword ptr [rdx+18],10000000
  jg try_next_offset

  lea rdi,[rdx+18]
  mov [xp_ptr],rdi
  mov r8,rdi
  sub r8,8
  mov [upgradepoints],r8
  jmp code

try_next_offset:
  cmp [rdx+24],0
  jle try_the_next
  cmp dword ptr [rdx+24],10000000
  jg try_the_next

  lea rdi,[rdx+24]
  mov [xp_ptr],rdi
  mov r8,rdi
  sub r8,8
  mov [upgradepoints],r8

try_the_next:
  cmp [rdx+28],0
  jle code
  cmp dword ptr [rdx+28],10000000
  jg code

  lea rdi,[rdx+28]
  mov [xp_ptr],rdi
  mov r8,rdi
  sub r8,8
  mov [upgradepoints],r8

code:
  mov r8,[xp_ptr]
  mov [cmp_xp],r8
  pop r8
  pop rdx
  pop rdi
  mov [rsp+68],eax
  mov rax,[rcx]
  jmp return

read_playeR_crfour_player:
  readmem(playeR_crfour_player,7)

align 10,cc

xp_ptr:
 dq 0

align 10,cc

CCharacterStats_area_ptr:
  dq 0

align 10,cc

upgradepoints:
  dq 0

cmp_xp:
 dq 0

playeR_crfour_player+03:
  jmp newmem
  nop 2
return:
registersymbol(playeR_crfour_player)

[DISABLE]

playeR_crfour_player+03:
  db 89 44 24 68 48 8B 01

unregistersymbol(*)
dealloc(*)

relentlesstech wrote: ↑

Tue Mar 05, 2024 4:05 pm

SnowMN wrote: ↑

Wed Aug 02, 2023 2:48 pm

has anone managed to use xp multiplier cuase its the only one that crashes the game and the only one i wanted to use

This will fix the XP script for v4.04, just copy/paste this over original script

Code: Select all

[ENABLE]
aobscanmodule(playeR_crfour_player,witcher3.exe,45 33 C9 89 44 24 68 48 8B 01)
alloc(newmem,$200,playeR_crfour_player)

label(code)
label(xp_ptr)
label(cmp_xp)
label(upgradepoints)
label(CCharacterStats_area_ptr)
label(try_the_next)
label(try_next_offset)
label(read_playeR_crfour_player)


registersymbol(xp_ptr)
registersymbol(cmp_xp)
registersymbol(upgradepoints)
registersymbol(CCharacterStats_area_ptr)
registersymbol(read_playeR_crfour_player)

newmem:
  push rdx
  push rdi
  push r8
  mov rdx,rcx
  test rdx,rdx
  jz code
  mov [CCharacterStats_area_ptr],rdx                //cr4Player

  mov rdx,[rdx+1C0]
  test rdx,rdx
  jz code
  mov rdx,[rdx+40]
  test rdx,rdx
  jz code
  mov rdx,[rdx+40]
  test rdx,rdx
  jz code
  mov rdx,[rdx+8]
  test rdx,rdx
  jz code

  cmp dword ptr [rdx+18],0
  jle try_next_offset
  cmp dword ptr [rdx+18],10000000
  jg try_next_offset

  lea rdi,[rdx+18]
  mov [xp_ptr],rdi
  mov r8,rdi
  sub r8,8
  mov [upgradepoints],r8
  jmp code

try_next_offset:
  cmp [rdx+24],0
  jle try_the_next
  cmp dword ptr [rdx+24],10000000
  jg try_the_next

  lea rdi,[rdx+24]
  mov [xp_ptr],rdi
  mov r8,rdi
  sub r8,8
  mov [upgradepoints],r8

try_the_next:
  cmp [rdx+28],0
  jle code
  cmp dword ptr [rdx+28],10000000
  jg code

  lea rdi,[rdx+28]
  mov [xp_ptr],rdi
  mov r8,rdi
  sub r8,8
  mov [upgradepoints],r8

code:
  mov r8,[xp_ptr]
  mov [cmp_xp],r8
  pop r8
  pop rdx
  pop rdi
  mov [rsp+68],eax
  mov rax,[rcx]
  jmp return

read_playeR_crfour_player:
  readmem(playeR_crfour_player,7)

align 10,cc

xp_ptr:
 dq 0

align 10,cc

CCharacterStats_area_ptr:
  dq 0

align 10,cc

upgradepoints:
  dq 0

cmp_xp:
 dq 0

playeR_crfour_player+03:
  jmp newmem
  nop 2
return:
registersymbol(playeR_crfour_player)

[DISABLE]

playeR_crfour_player+03:
  db 89 44 24 68 48 8B 01

unregistersymbol(*)
dealloc(*)