FearLess Cheat Engine

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>4109</ID>
      <Description>"selected mission reward"</Description>
      <Options moHideChildren="1"/>
      <LastState/>
      <Color>8000FF</Color>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : MonsterHunterWorld.exe
  Version:
  Date   : 2018-08-15
  Author : SeiKur0

}
{$lua}
local function listToString(list)
  local str = ""

  for indx = 1, #list do
    local name = list[indx]
    str = str..string.format("%d", indx-1)..":"..name.."\n"
  end
  return str
end

local function getItemList()
   local base = getAddress("p_gamedb")
   local itemcount = readInteger(base+0xd0) / 2
   local database = readPointer(base+0xf0)
   local indx = 0
   local list = {}
   local itemname = nil
   while indx &lt; itemcount do
       itemname = readString(readPointer(database))
       table.insert(list, itemname)
       database = database + 0x10
       indx = indx + 1
   end
   return list
end

local function addDD(entry,str)
    entry.DropDownList.Text = str
    entry.DropDownReadOnly = true
    entry.DropDownDescriptionOnly = true
    entry.DisplayAsDropDownListItem = true
end

local function remDD(entry)
    entry.DropDownList.Text = ""
    entry.DisplayAsDropDownListItem = false
end

local function changeentries_rewarditem(str)
    local parent = getAddressList().getMemoryRecordByDescription('selected mission reward')
    addDD(parent.Child[0],str)
end
local function delentries_rewarditem()
    local parent = getAddressList().getMemoryRecordByDescription('selected mission reward')
    remDD(parent.Child[0])
end

local function registerDB()
      local aobs = AOBScan("53 52 00 00 63 6F 6D 6D 6F 6E 5C 74 65 78 74 5C 73 74 65 61 6D 5C 69 74 65 6D", "-X-C+W", 1, 4)
      if aobs ~= nil then
         local base = getAddress(aobs[0])-8
        unregisterSymbol("p_gamedb")
        registerSymbol("p_gamedb",base)
      end
end

local function cleanup()
     unregisterSymbol("p_gamedb")
     delentries_rewarditem()
end

local function main()
      changeentries_rewarditem(listToString(getItemList()))
end

[ENABLE]
registerDB()
main()

{$asm}
aobscanmodule(inj_rewards,MonsterHunterWorld.exe,48 8D 0C 80 8B 7C CA 10 85 FF)
{aobscanmodule(inj_infreward,MonsterHunterWorld.exe,3B F7 74 2C 85 F6 7E 28)}
alloc(newmem,$1000,"MonsterHunterWorld.exe"+1A75063)

label(p_reward)
registersymbol(p_reward)

label(return_reward)
{label(return_infreward)}

label(code_reward)
{label(code_infreward)}

newmem:
code_reward:

  lea rcx,[rax+rax*4]
  lea rcx,[rdx+rcx*8]
  mov edi,[rcx+10]
  test edi,edi
  je return_reward
  mov [p_reward],rcx
  jmp return_reward

{code_infreward:
  mov rdi,rsi

jmp return_infreward}

p_reward:
dq 0

inj_rewards:
  jmp code_reward
  nop
  nop
  nop
return_reward:
registersymbol(inj_rewards)

{inj_infreward:
jmp code_infreward
nop
return_infreward:
db eb
registersymbol(inj_infreward)}

{$lua}
[DISABLE]
cleanup()
{$asm}
inj_rewards:
  db 48 8D 0C 80 8B 7C CA 10

{inj_infreward:
db 3B F7 74 2C 85 F6 7E}

unregistersymbol(p_reward)
unregistersymbol(inj_rewards)
{unregistersymbol(inj_infreward)}
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "MonsterHunterWorld.exe"+1A75063

"MonsterHunterWorld.exe"+1A75044: 48 83 C4 30           -  add rsp,30
"MonsterHunterWorld.exe"+1A75048: 5B                    -  pop rbx
"MonsterHunterWorld.exe"+1A75049: C3                    -  ret 
"MonsterHunterWorld.exe"+1A7504A: 41 B8 6C 02 00 00     -  mov r8d,0000026C
"MonsterHunterWorld.exe"+1A75050: E8 BB 30 C3 FF        -  call MonsterHunterWorld.exe+16A8110
"MonsterHunterWorld.exe"+1A75055: 48 83 C4 30           -  add rsp,30
"MonsterHunterWorld.exe"+1A75059: 5B                    -  pop rbx
"MonsterHunterWorld.exe"+1A7505A: C3                    -  ret 
"MonsterHunterWorld.exe"+1A7505B: 41 8B C1              -  mov eax,r9d
"MonsterHunterWorld.exe"+1A7505E: 48 89 7C 24 40        -  mov [rsp+40],rdi
// ---------- INJECTING HERE ----------
"MonsterHunterWorld.exe"+1A75063: 48 8D 0C 80           -  lea rcx,[rax+rax*4]
"MonsterHunterWorld.exe"+1A75067: 8B 7C CA 10           -  mov edi,[rdx+rcx*8+10]
// ---------- DONE INJECTING  ----------
"MonsterHunterWorld.exe"+1A7506B: 85 FF                 -  test edi,edi
"MonsterHunterWorld.exe"+1A7506D: 74 6D                 -  je MonsterHunterWorld.exe+1A750DC
"MonsterHunterWorld.exe"+1A7506F: 8B CF                 -  mov ecx,edi
"MonsterHunterWorld.exe"+1A75071: E8 DA 2C 9D FF        -  call MonsterHunterWorld.exe+1447D50
"MonsterHunterWorld.exe"+1A75076: 84 C0                 -  test al,al
"MonsterHunterWorld.exe"+1A75078: 74 08                 -  je MonsterHunterWorld.exe+1A75082
"MonsterHunterWorld.exe"+1A7507A: 41 B8 6E 02 00 00     -  mov r8d,0000026E
"MonsterHunterWorld.exe"+1A75080: EB 60                 -  jmp MonsterHunterWorld.exe+1A750E2
"MonsterHunterWorld.exe"+1A75082: BA 01 00 00 00        -  mov edx,00000001
"MonsterHunterWorld.exe"+1A75087: 8B CF                 -  mov ecx,edi
}

{
// ORIGINAL CODE - INJECTION POINT: "MonsterHunterWorld.exe"+14490F3

"MonsterHunterWorld.exe"+14490C5: C6 81 AB 54 01 00 01  -  mov byte ptr [rcx+000154AB],01
"MonsterHunterWorld.exe"+14490CC: 48 8B 0D 9D 16 3D 03  -  mov rcx,[MonsterHunterWorld.exe+481A770]
"MonsterHunterWorld.exe"+14490D3: 80 B9 29 A4 00 00 01  -  cmp byte ptr [rcx+0000A429],01
"MonsterHunterWorld.exe"+14490DA: 75 15                 -  jne MonsterHunterWorld.exe+14490F1
"MonsterHunterWorld.exe"+14490DC: 48 8B 0D 7D 0B 3D 03  -  mov rcx,[MonsterHunterWorld.exe+4819C60]
"MonsterHunterWorld.exe"+14490E3: E8 88 24 26 00        -  call MonsterHunterWorld.exe+16AB570
"MonsterHunterWorld.exe"+14490E8: EB 07                 -  jmp MonsterHunterWorld.exe+14490F1
"MonsterHunterWorld.exe"+14490EA: E8 C1 21 00 00        -  call MonsterHunterWorld.exe+144B2B0
"MonsterHunterWorld.exe"+14490EF: 8B F8                 -  mov edi,eax
"MonsterHunterWorld.exe"+14490F1: 3B F7                 -  cmp esi,edi
// ---------- INJECTING HERE ----------
"MonsterHunterWorld.exe"+14490F3: 74 2C                 -  je MonsterHunterWorld.exe+1449121
"MonsterHunterWorld.exe"+14490F5: 85 F6                 -  test esi,esi
"MonsterHunterWorld.exe"+14490F7: 7E 28                 -  jle MonsterHunterWorld.exe+1449121
// ---------- DONE INJECTING  ----------
"MonsterHunterWorld.exe"+14490F9: 48 8B 0D B8 E7 6D 02  -  mov rcx,[MonsterHunterWorld.exe+3B278B8]
"MonsterHunterWorld.exe"+1449100: E8 1B C1 30 00        -  call MonsterHunterWorld.exe+1755220
"MonsterHunterWorld.exe"+1449105: 48 05 94 62 06 00     -  add rax,00066294
"MonsterHunterWorld.exe"+144910B: 48 8B CB              -  mov rcx,rbx
"MonsterHunterWorld.exe"+144910E: 48 C1 E9 05           -  shr rcx,05
"MonsterHunterWorld.exe"+1449112: 83 E3 1F              -  and ebx,1F
"MonsterHunterWorld.exe"+1449115: 48 8D 14 88           -  lea rdx,[rax+rcx*4]
"MonsterHunterWorld.exe"+1449119: 8B 04 88              -  mov eax,[rax+rcx*4]
"MonsterHunterWorld.exe"+144911C: 0F AB D8              -  bts eax,ebx
"MonsterHunterWorld.exe"+144911F: 89 02                 -  mov [rdx],eax
}
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>4111</ID>
          <Description>"type"</Description>
          <Color>C08000</Color>
          <VariableType>4 Bytes</VariableType>
          <Address>p_reward</Address>
          <Offsets>
            <Offset>10</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>4112</ID>
          <Description>"amount"</Description>
          <Color>C08000</Color>
          <VariableType>4 Bytes</VariableType>
          <Address>p_reward</Address>
          <Offsets>
            <Offset>14</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
  </CheatEntries>
</CheatTable>