Code Vein

Upload your cheat tables here (No requests)
MarcoJohn
Novice Cheater
Novice Cheater
Posts: 17
Joined: Thu Sep 05, 2019 5:25 am
Reputation: 1

Re: Code Vein

Post by MarcoJohn »

Zanzer wrote:
Fri Sep 27, 2019 3:53 pm
Unlimited Health
Unlimited Stamina
Unlimited Ichor
Unlimited Items
Player Pointer
- Level
- Haze

pox911 scripts
- Current Highlighted Skill
- No Cooldown on Skills
- Accessory Cost Bypass

zachillios scripts
- Highlighted Item Editor
- Highlighted Weapon Editor
- Highlighted Blood Veil Editor
How i can use Weapon editor ???

How to use this cheat table?
  1. Install Cheat Engine
  2. Double-click the .CT file in order to open it.
  3. Click the PC icon in Cheat Engine in order to select the game process.
  4. Keep the list.
  5. Activate the trainer options by checking boxes or setting values from 0 to 1

RaxeIe
Expert Cheater
Expert Cheater
Posts: 97
Joined: Sun Sep 22, 2019 10:19 pm
Reputation: 14

Re: Code Vein

Post by RaxeIe »

MarcoJohn wrote:
Tue Oct 01, 2019 1:51 pm
Zanzer wrote:
Fri Sep 27, 2019 3:53 pm
Unlimited Health
Unlimited Stamina
Unlimited Ichor
Unlimited Items
Player Pointer
- Level
- Haze

pox911 scripts
- Current Highlighted Skill
- No Cooldown on Skills
- Accessory Cost Bypass

zachillios scripts
- Highlighted Item Editor
- Highlighted Weapon Editor
- Highlighted Blood Veil Editor
How i can use Weapon editor ???
go ingame, click your weapon (and hover above it), it will probably show a 0, or whatever rank it currently is at. change it to a 10

Egeslean05
Novice Cheater
Novice Cheater
Posts: 19
Joined: Mon Jun 04, 2018 12:19 am
Reputation: 1

Re: Code Vein

Post by Egeslean05 »

pox911 wrote:
Mon Sep 30, 2019 8:35 pm
edit: Here is the code that will let you change your character that you already have started.

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>1215</ID>
      <Description>"Bypass Customziation Reset"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]

aobscanmodule(CustBypassAOB,CodeVein-Win64-Shipping.exe,41 0F B6 D6 48 89 F1 E8 88) // should be unique
alloc(newmem,$1000,"CodeVein-Win64-Shipping.exe"+5F7FE2C)

label(code)
label(return)

newmem:

code:
  movzx edx,r14l
  mov rcx,rsi
  jmp return

CustBypassAOB:
  jmp newmem
  nop
  nop
CustBypassAOB+c:
return:
registersymbol(CustBypassAOB)

[DISABLE]

CustBypassAOB:
  db 41 0F B6 D6 48 89 F1

unregistersymbol(CustBypassAOB)
dealloc(newmem)
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>
What this code does is it disabled your character being reset after previewing a customization. So basically you start a new game, make the character you want, save the customization, back out, load your main save, enable the code, go to the customization, highlight it, and then back out. You will notice that your character didnt revert back. Then you can just exit the customization screen and your character will be saved via that preset.
I wish I had seen this before the game updated, since I'm guessing that's what broke it cuz all I get is an error with it.

User avatar
SunBeam
Administration
Administration
Posts: 4932
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4630

Re: Code Vein

Post by SunBeam »

When has it updated? o_O For fuck's sake, I freakin' hate devs. I just finished SDK-mapping a ton of it.

jonasbeckman
Expert Cheater
Expert Cheater
Posts: 307
Joined: Sat May 06, 2017 1:26 pm
Reputation: 22

Re: Code Vein

Post by jonasbeckman »

Earlier today, exe and a few additional PAK files so a content addition of some kinda and not just a minor correction considering one of the archives is 500 MB so probably some upcoming addition and for now it's various bug fixes but I couldn't find any patch notes when I saw the update pending in the Steam client.

RaxeIe
Expert Cheater
Expert Cheater
Posts: 97
Joined: Sun Sep 22, 2019 10:19 pm
Reputation: 14

Re: Code Vein

Post by RaxeIe »

SunBeam wrote:
Tue Oct 01, 2019 2:52 pm
When has it updated? o_O For fuck's sake, I freakin' hate devs. I just finished SDK-mapping a ton of it.
Sunbeam can you figure out how to make a cheat table that unlocked all codes? is that even doable since the item ID keeps changing? at least thats what happened when i used zachillios scripts item editor

User avatar
dec1337
Fearless Donors
Fearless Donors
Posts: 87
Joined: Thu Mar 30, 2017 7:48 pm
Reputation: 105

Re: Code Vein

Post by dec1337 »

pox911 wrote:
Mon Sep 30, 2019 8:35 pm

edit: Here is the code that will let you change your character that you already have started.

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>1215</ID>
      <Description>"Bypass Customziation Reset"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]

aobscanmodule(CustBypassAOB,CodeVein-Win64-Shipping.exe,41 0F B6 D6 48 89 F1 E8 88) // should be unique
alloc(newmem,$1000,"CodeVein-Win64-Shipping.exe"+5F7FE2C)

label(code)
label(return)

newmem:

code:
  movzx edx,r14l
  mov rcx,rsi
  jmp return

CustBypassAOB:
  jmp newmem
  nop
  nop
CustBypassAOB+c:
return:
registersymbol(CustBypassAOB)

[DISABLE]

CustBypassAOB:
  db 41 0F B6 D6 48 89 F1

unregistersymbol(CustBypassAOB)
dealloc(newmem)
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>
How did you find these instructions to bypass in the first place? It seems the newest update has changed the AOB - I've tried finding the new AOB manually going through around 100 results with no luck and tried unknown changed value/unchanged while selecting different character presets to find what you did in the first place and had no luck :o I need to get my waifu back :lol:

User avatar
pox911
Slob
Slob
Posts: 128
Joined: Mon Mar 20, 2017 1:41 am
Reputation: 182

Re: Code Vein

Post by pox911 »

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>1215</ID>
      <Description>"Bypass Customziation Reset"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]

aobscanmodule(CustBypassAOB,CodeVein-Win64-Shipping.exe,41 0F B6 D6 48 89 F1 E8 * * * * 48 8b 07) // should be unique
alloc(newmem,$1000,"CodeVein-Win64-Shipping.exe"+5F7FE2C)

label(code)
label(return)

newmem:

code:
  movzx edx,r14l
  mov rcx,rsi
  jmp return

CustBypassAOB:
  jmp newmem
  nop
  nop
CustBypassAOB+c:
return:
registersymbol(CustBypassAOB)

[DISABLE]

CustBypassAOB:
  db 41 0F B6 D6 48 89 F1

unregistersymbol(CustBypassAOB)
dealloc(newmem)
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>
updated the customization bypass. Didnt realize i had a slight error in the aob that didnt make it update friendly. As to how i found it; I started by finding an easy to change customization option. In this case it was the hair shine. I then did an write check on it for when i was in the load preset menu. Turns out there are two separate writes. I just followed the code till i got to the call that does the writing on cancellation and jumped over it.

User avatar
dec1337
Fearless Donors
Fearless Donors
Posts: 87
Joined: Thu Mar 30, 2017 7:48 pm
Reputation: 105

Re: Code Vein

Post by dec1337 »

pox911 wrote:
Tue Oct 01, 2019 5:22 pm

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>1215</ID>
      <Description>"Bypass Customziation Reset"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]

aobscanmodule(CustBypassAOB,CodeVein-Win64-Shipping.exe,41 0F B6 D6 48 89 F1 E8 * * * * 48 8b 07) // should be unique
alloc(newmem,$1000,"CodeVein-Win64-Shipping.exe"+5F7FE2C)

label(code)
label(return)

newmem:

code:
  movzx edx,r14l
  mov rcx,rsi
  jmp return

CustBypassAOB:
  jmp newmem
  nop
  nop
CustBypassAOB+c:
return:
registersymbol(CustBypassAOB)

[DISABLE]

CustBypassAOB:
  db 41 0F B6 D6 48 89 F1

unregistersymbol(CustBypassAOB)
dealloc(newmem)
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>
updated the customization bypass. Didnt realize i had a slight error in the aob that didnt make it update friendly. As to how i found it; I started by finding an easy to change customization option. In this case it was the hair shine. I then did an write check on it for when i was in the load preset menu. Turns out there are two separate writes. I just followed the code till i got to the call that does the writing on cancellation and jumped over it.
Ohhhh that is genius. Thankyou for explaining how you did it! And thankyou for the updated AOB

User avatar
gunbalde60
Expert Cheater
Expert Cheater
Posts: 393
Joined: Tue Jan 09, 2018 3:53 am
Reputation: 32

Re: Code Vein

Post by gunbalde60 »

pox911 wrote:
Tue Oct 01, 2019 5:22 pm

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>1215</ID>
      <Description>"Bypass Customziation Reset"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]

aobscanmodule(CustBypassAOB,CodeVein-Win64-Shipping.exe,41 0F B6 D6 48 89 F1 E8 * * * * 48 8b 07) // should be unique
alloc(newmem,$1000,"CodeVein-Win64-Shipping.exe"+5F7FE2C)

label(code)
label(return)

newmem:

code:
  movzx edx,r14l
  mov rcx,rsi
  jmp return

CustBypassAOB:
  jmp newmem
  nop
  nop
CustBypassAOB+c:
return:
registersymbol(CustBypassAOB)

[DISABLE]

CustBypassAOB:
  db 41 0F B6 D6 48 89 F1

unregistersymbol(CustBypassAOB)
dealloc(newmem)
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>
updated the customization bypass. Didnt realize i had a slight error in the aob that didnt make it update friendly. As to how i found it; I started by finding an easy to change customization option. In this case it was the hair shine. I then did an write check on it for when i was in the load preset menu. Turns out there are two separate writes. I just followed the code till i got to the call that does the writing on cancellation and jumped over it.
Pox, do you mind updating your table, to include all this debug items, bypass etc? I'm too much of a CE noob to do it myself. :D

User avatar
pox911
Slob
Slob
Posts: 128
Joined: Mon Mar 20, 2017 1:41 am
Reputation: 182

Re: Code Vein

Post by pox911 »

Zanzer made the tabe so he just needs to update it with the current info :P. As for the item thing, i just need to write a basic tutorial on how to us the console dumper and the current selected weapon code together.

User avatar
SunBeam
Administration
Administration
Posts: 4932
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4630

Re: Code Vein

Post by SunBeam »

Anyone made a backup of "CodeVein-Win64-Shipping.exe" before the update?

jonasbeckman
Expert Cheater
Expert Cheater
Posts: 307
Joined: Sat May 06, 2017 1:26 pm
Reputation: 22

Re: Code Vein

Post by jonasbeckman »

Thankfully the same method works here too which for the Steam command it would be this.

download_depot 678960 678961 853352522958954733 755890020008653547

Resulting in this EXE:

CodeVein-Win64-Shipping.rar
[Link]


C:\Program Files (x86)\Steam\SteamApps\content\app_678960\depot_678961

(Reversing the two last manifests would get the new patch data and using only one would be a full 30 GB download of the entire depot in this case.)


It's good that this is a thing as it's really convenient but there's the file with the lengthy explanation done away with and that's the actual exe and not the UE4 launcher exe that sometimes gets confused with the main binary file. :D

EDIT:
Or just Steam://open/console as a web address, OK the Steam client prompt and in the Steam client and the newly available "console" tab well that command consistent of that application id for the game, that main depot id for the game and then the current patch manifest and previous patch manifest to reference against to only grab the diff files instead of the entire thing to give a summary of what it's doing.

(Well prior patch and then current patch as it's targeting the previous data or the release day data depot manifest and not the patch but eh it's fairly clear what it's doing I hope.)

User avatar
SunBeam
Administration
Administration
Posts: 4932
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4630

Re: Code Vein

Post by SunBeam »

^ Thanks! Stored it locally for the future, along with the x64dbg big ass map of functions/comments:

Here you go, in case you wanna do some analysis on your own.

Image

Image

Download: [Link]
(305 functions, 112 labels)

BR,
Sun

zachillios
Table Makers
Table Makers
Posts: 905
Joined: Fri Mar 03, 2017 9:05 am
Reputation: 760

Re: Code Vein

Post by zachillios »

Here's my stuff updated:

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>566</ID>
      <Description>"Item Editors"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>40</ID>
          <Description>"Highlighted Item Editor"</Description>
          <Options moHideChildren="1"/>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>{ Game   : CodeVein-Win64-Shipping.exe
  Version: 
  Date   : 2019-09-26
  Author : Zach

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(Item_Pointer,CodeVein-Win64-Shipping.exe,0F 10 48 10 0F 11 03 F2 0F 10 40 20 0F) // should be unique
alloc(newmem,$1000,Item_Pointer)
globalalloc(ItemPointer,4)
label(code)
label(return)

newmem:
mov [ItemPointer],rax
code:
  movups xmm1,[rax+10]
  movups [rbx],xmm0
  jmp return

Item_Pointer:
  jmp newmem
  nop 2
return:
registersymbol(Item_Pointer)

[DISABLE]

Item_Pointer:
  db 0F 10 48 10 0F 11 03

unregistersymbol(Item_Pointer)
dealloc(newmem)
dealloc(ItemPointer)
{
// ORIGINAL CODE - INJECTION POINT: "CodeVein-Win64-Shipping.exe"+612A872

"CodeVein-Win64-Shipping.exe"+612A847: E8 44 62 91 FA                 -  call CodeVein-Win64-Shipping.exe+A40A90
"CodeVein-Win64-Shipping.exe"+612A84C: 48 89 C2                       -  mov rdx,rax
"CodeVein-Win64-Shipping.exe"+612A84F: 4C 8D 4C 24 30                 -  lea r9,[rsp+30]
"CodeVein-Win64-Shipping.exe"+612A854: 41 B8 2B 00 00 00              -  mov r8d,0000002B
"CodeVein-Win64-Shipping.exe"+612A85A: 48 89 F9                       -  mov rcx,rdi
"CodeVein-Win64-Shipping.exe"+612A85D: E8 2E 11 82 FA                 -  call CodeVein-Win64-Shipping.exe+94B990
"CodeVein-Win64-Shipping.exe"+612A862: 48 8B 84 24 A8 00 00 00        -  mov rax,[rsp+000000A8]
"CodeVein-Win64-Shipping.exe"+612A86A: 48 85 C0                       -  test rax,rax
"CodeVein-Win64-Shipping.exe"+612A86D: 74 1A                          -  je CodeVein-Win64-Shipping.exe+612A889
"CodeVein-Win64-Shipping.exe"+612A86F: 0F 10 00                       -  movups xmm0,[rax]
// ---------- INJECTING HERE ----------
"CodeVein-Win64-Shipping.exe"+612A872: 0F 10 48 10                    -  movups xmm1,[rax+10]
"CodeVein-Win64-Shipping.exe"+612A876: 0F 11 03                       -  movups [rbx],xmm0
// ---------- DONE INJECTING  ----------
"CodeVein-Win64-Shipping.exe"+612A879: F2 0F 10 40 20                 -  movsd xmm0,[rax+20]
"CodeVein-Win64-Shipping.exe"+612A87E: 0F 11 4B 10                    -  movups [rbx+10],xmm1
"CodeVein-Win64-Shipping.exe"+612A882: F2 0F 11 43 20                 -  movsd [rbx+20],xmm0
"CodeVein-Win64-Shipping.exe"+612A887: EB 29                          -  jmp CodeVein-Win64-Shipping.exe+612A8B2
"CodeVein-Win64-Shipping.exe"+612A889: 48 89 43 10                    -  mov [rbx+10],rax
"CodeVein-Win64-Shipping.exe"+612A88D: 48 89 43 18                    -  mov [rbx+18],rax
"CodeVein-Win64-Shipping.exe"+612A891: 48 89 43 20                    -  mov [rbx+20],rax
"CodeVein-Win64-Shipping.exe"+612A895: 48 89 33                       -  mov [rbx],rsi
"CodeVein-Win64-Shipping.exe"+612A898: 48 89 73 08                    -  mov [rbx+08],rsi
"CodeVein-Win64-Shipping.exe"+612A89C: 66 C7 43 10 08 10              -  mov word ptr [rbx+10],1008
}
</AssemblerScript>
          <CheatEntries>
            <CheatEntry>
              <ID>41</ID>
              <Description>"Quantity"</Description>
              <LastState Value="2" RealAddress="C23F34DC"/>
              <VariableType>4 Bytes</VariableType>
              <Address>ItemPointer</Address>
              <Offsets>
                <Offset>14</Offset>
              </Offsets>
            </CheatEntry>
            <CheatEntry>
              <ID>550</ID>
              <Description>"Max Quantity"</Description>
              <LastState Value="5" RealAddress="C23F34E0"/>
              <VariableType>4 Bytes</VariableType>
              <Address>ItemPointer</Address>
              <Offsets>
                <Offset>18</Offset>
              </Offsets>
            </CheatEntry>
            <CheatEntry>
              <ID>551</ID>
              <Description>"ID"</Description>
              <LastState Value="B2 7B 43" RealAddress="C23F34C9"/>
              <ShowAsHex>1</ShowAsHex>
              <VariableType>Array of byte</VariableType>
              <ByteLength>3</ByteLength>
              <Address>ItemPointer</Address>
              <Offsets>
                <Offset>1</Offset>
              </Offsets>
            </CheatEntry>
          </CheatEntries>
        </CheatEntry>
        <CheatEntry>
          <ID>591</ID>
          <Description>"Highlighted Weapon Editor"</Description>
          <Options moHideChildren="1"/>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>{ Game   : CodeVein-Win64-Shipping.exe
  Version: 
  Date   : 2019-10-01
  Author : Zach

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(Weapon_Scan,CodeVein-Win64-Shipping.exe,0F 10 48 10 0F 11 4B 10 48 8B 9C 24 90 00 00 00 48 81 C4 80 00 00 00 5F C3 CC 48 29 C0 41 50 48 F7 D0) // should be unique
alloc(newmem,$1000,Weapon_Scan)
globalalloc(WeaponScan,8)
label(code)
label(return)

newmem:
mov [WeaponScan],rax
code:
  movups xmm1,[rax+10]
  movups [rbx+10],xmm1
  jmp return

Weapon_Scan:
  jmp newmem
  nop 3
return:
registersymbol(Weapon_Scan)

[DISABLE]

Weapon_Scan:
  db 0F 10 48 10 0F 11 4B 10 48 8B 9C 24 90 00 00 00 48 81 C4 80 00 00 00 5F C3 CC 48 29 C0 41 50 48 F7 D0

unregistersymbol(Weapon_Scan)
dealloc(newmem)
dealloc(WeaponScan)
{
// ORIGINAL CODE - INJECTION POINT: "CodeVein-Win64-Shipping.exe"+7BEA357

"CodeVein-Win64-Shipping.exe"+7BEA32E: 48 89 C2                 -  mov rdx,rax
"CodeVein-Win64-Shipping.exe"+7BEA331: 4C 8D 4C 24 30           -  lea r9,[rsp+30]
"CodeVein-Win64-Shipping.exe"+7BEA336: 41 B8 3D 00 00 00        -  mov r8d,0000003D
"CodeVein-Win64-Shipping.exe"+7BEA33C: 48 89 F9                 -  mov rcx,rdi
"CodeVein-Win64-Shipping.exe"+7BEA33F: E8 7C 1C D6 F8           -  call CodeVein-Win64-Shipping.exe+94BFC0
"CodeVein-Win64-Shipping.exe"+7BEA344: 48 8B 84 24 A8 00 00 00  -  mov rax,[rsp+000000A8]
"CodeVein-Win64-Shipping.exe"+7BEA34C: 48 85 C0                 -  test rax,rax
"CodeVein-Win64-Shipping.exe"+7BEA34F: 74 0E                    -  je CodeVein-Win64-Shipping.exe+7BEA35F
"CodeVein-Win64-Shipping.exe"+7BEA351: 0F 10 00                 -  movups xmm0,[rax]
"CodeVein-Win64-Shipping.exe"+7BEA354: 0F 11 03                 -  movups [rbx],xmm0
// ---------- INJECTING HERE ----------
"CodeVein-Win64-Shipping.exe"+7BEA357: 0F 10 48 10              -  movups xmm1,[rax+10]
"CodeVein-Win64-Shipping.exe"+7BEA35B: 0F 11 4B 10              -  movups [rbx+10],xmm1
// ---------- DONE INJECTING  ----------
"CodeVein-Win64-Shipping.exe"+7BEA35F: 48 8B 9C 24 90 00 00 00  -  mov rbx,[rsp+00000090]
"CodeVein-Win64-Shipping.exe"+7BEA367: 48 81 C4 80 00 00 00     -  add rsp,00000080
"CodeVein-Win64-Shipping.exe"+7BEA36E: 5F                       -  pop rdi
"CodeVein-Win64-Shipping.exe"+7BEA36F: C3                       -  ret 
"CodeVein-Win64-Shipping.exe"+7BEA370: CC                       -  int 3 
"CodeVein-Win64-Shipping.exe"+7BEA371: 48 29 C0                 -  sub rax,rax
"CodeVein-Win64-Shipping.exe"+7BEA374: 41 50                    -  push r8
"CodeVein-Win64-Shipping.exe"+7BEA376: 48 F7 D0                 -  not rax
"CodeVein-Win64-Shipping.exe"+7BEA379: 48 F7 14 24              -  not [rsp]
"CodeVein-Win64-Shipping.exe"+7BEA37D: 48 23 04 24              -  and rax,[rsp]
}
</AssemblerScript>
          <CheatEntries>
            <CheatEntry>
              <ID>587</ID>
              <Description>"Forge"</Description>
              <LastState Value="3" RealAddress="5FD49614"/>
              <VariableType>4 Bytes</VariableType>
              <Address>WeaponScan</Address>
              <Offsets>
                <Offset>14</Offset>
              </Offsets>
            </CheatEntry>
          </CheatEntries>
        </CheatEntry>
        <CheatEntry>
          <ID>593</ID>
          <Description>"Highlighted Blood Veil Editor"</Description>
          <Options moHideChildren="1"/>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>{ Game   : CodeVein-Win64-Shipping.exe
  Version: 
  Date   : 2019-10-01
  Author : Zach

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(bCode_Scan,CodeVein-Win64-Shipping.exe,0F 10 48 10 0F 11 4B 10 48 8B 9C 24 90 00 00 00 48 81 C4 80 00 00 00 5F C3 CC 00) // should be unique
alloc(newmem,$1000,bCode_Scan)
globalalloc(bCodeScan,4)
label(code)
label(return)

newmem:
mov [bCodeScan],rax
code:
  movups xmm1,[rax+10]
  movups [rbx+10],xmm1
  jmp return

bCode_Scan:
  jmp newmem
  nop 3
return:
registersymbol(bCode_Scan)

[DISABLE]

bCode_Scan:
  db 0F 10 48 10 0F 11 4B 10

unregistersymbol(bCode_Scan)
dealloc(newmem)
dealloc(bCodeScan)
{
// ORIGINAL CODE - INJECTION POINT: "CodeVein-Win64-Shipping.exe"+7BC65B7

"CodeVein-Win64-Shipping.exe"+7BC658E: 48 89 C2                 -  mov rdx,rax
"CodeVein-Win64-Shipping.exe"+7BC6591: 4C 8D 4C 24 30           -  lea r9,[rsp+30]
"CodeVein-Win64-Shipping.exe"+7BC6596: 41 B8 2D 00 00 00        -  mov r8d,0000002D
"CodeVein-Win64-Shipping.exe"+7BC659C: 48 89 F9                 -  mov rcx,rdi
"CodeVein-Win64-Shipping.exe"+7BC659F: E8 1C 5A D8 F8           -  call CodeVein-Win64-Shipping.exe+94BFC0
"CodeVein-Win64-Shipping.exe"+7BC65A4: 48 8B 84 24 A8 00 00 00  -  mov rax,[rsp+000000A8]
"CodeVein-Win64-Shipping.exe"+7BC65AC: 48 85 C0                 -  test rax,rax
"CodeVein-Win64-Shipping.exe"+7BC65AF: 74 0E                    -  je CodeVein-Win64-Shipping.exe+7BC65BF
"CodeVein-Win64-Shipping.exe"+7BC65B1: 0F 10 00                 -  movups xmm0,[rax]
"CodeVein-Win64-Shipping.exe"+7BC65B4: 0F 11 03                 -  movups [rbx],xmm0
// ---------- INJECTING HERE ----------
"CodeVein-Win64-Shipping.exe"+7BC65B7: 0F 10 48 10              -  movups xmm1,[rax+10]
"CodeVein-Win64-Shipping.exe"+7BC65BB: 0F 11 4B 10              -  movups [rbx+10],xmm1
// ---------- DONE INJECTING  ----------
"CodeVein-Win64-Shipping.exe"+7BC65BF: 48 8B 9C 24 90 00 00 00  -  mov rbx,[rsp+00000090]
"CodeVein-Win64-Shipping.exe"+7BC65C7: 48 81 C4 80 00 00 00     -  add rsp,00000080
"CodeVein-Win64-Shipping.exe"+7BC65CE: 5F                       -  pop rdi
"CodeVein-Win64-Shipping.exe"+7BC65CF: C3                       -  ret 
"CodeVein-Win64-Shipping.exe"+7BC65D0: CC                       -  int 3 
"CodeVein-Win64-Shipping.exe"+7BC65D1: 00 00                    -  add [rax],al
"CodeVein-Win64-Shipping.exe"+7BC65D3: 00 00                    -  add [rax],al
"CodeVein-Win64-Shipping.exe"+7BC65D5: 41 54                    -  push r12
"CodeVein-Win64-Shipping.exe"+7BC65D7: 49 F7 D4                 -  not r12
"CodeVein-Win64-Shipping.exe"+7BC65DA: 4C 21 24 24              -  and [rsp],r12
}
</AssemblerScript>
          <CheatEntries>
            <CheatEntry>
              <ID>594</ID>
              <Description>"Forge"</Description>
              <LastState Value="7" RealAddress="9B8BCB34"/>
              <VariableType>4 Bytes</VariableType>
              <Address>bCodeScan</Address>
              <Offsets>
                <Offset>14</Offset>
              </Offsets>
            </CheatEntry>
          </CheatEntries>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

Post Reply

Who is online

Users browsing this forum: Bing [Bot], cosmocapsoon, creditor, EphenSteve, Google [Bot], Google Adsense [Bot], M_310, sinnedomoyap