EMMA Oxygen(NPC)
Code: Select all
{ Game : mgs2_sse.exe
Version:
Date : 2020-10-05
Author : bilibili
This script does blah blah blah
}
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
aobscanmodule(EMMAOxygen,mgs2_sse.exe,D9 9E 40 0E 00 00 66) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// fstp dword ptr [esi+00000E40]
mov [esi+00000E40],(float)1400
jmp return
EMMAOxygen:
jmp newmem
nop
return:
registersymbol(EMMAOxygen)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
EMMAOxygen:
db D9 9E 40 0E 00 00
unregistersymbol(EMMAOxygen)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "mgs2_sse.exe"+B7DA7
"mgs2_sse.exe"+B7D87: D9 5C 24 10 - fstp dword ptr [esp+10]
"mgs2_sse.exe"+B7D8B: D8 54 24 10 - fcom dword ptr [esp+10]
"mgs2_sse.exe"+B7D8F: DF E0 - fnstsw ax
"mgs2_sse.exe"+B7D91: F6 C4 05 - test ah,05
"mgs2_sse.exe"+B7D94: 7A 06 - jp mgs2_sse.exe+B7D9C
"mgs2_sse.exe"+B7D96: DD D8 - fstp st(0)
"mgs2_sse.exe"+B7D98: D9 44 24 10 - fld dword ptr [esp+10]
"mgs2_sse.exe"+B7D9C: D9 C0 - fld st(0)
"mgs2_sse.exe"+B7D9E: E8 C1 D1 46 00 - call mgs2_sse.exe+524F64
"mgs2_sse.exe"+B7DA3: 66 89 47 18 - mov [edi+18],ax
// ---------- INJECTING HERE ----------
"mgs2_sse.exe"+B7DA7: D9 9E 40 0E 00 00 - fstp dword ptr [esi+00000E40]
// ---------- DONE INJECTING ----------
"mgs2_sse.exe"+B7DAD: 66 8B 4F 18 - mov cx,[edi+18]
"mgs2_sse.exe"+B7DB1: 66 3B 4F 1C - cmp cx,[edi+1C]
"mgs2_sse.exe"+B7DB5: 75 3B - jne mgs2_sse.exe+B7DF2
"mgs2_sse.exe"+B7DB7: 8B 0D AC AD 18 01 - mov ecx,[mgs2_sse.exe+D8ADAC]
"mgs2_sse.exe"+B7DBD: 8B C1 - mov eax,ecx
"mgs2_sse.exe"+B7DBF: 99 - cdq
"mgs2_sse.exe"+B7DC0: BE 0F 00 00 00 - mov esi,0000000F
"mgs2_sse.exe"+B7DC5: F7 FE - idiv esi
"mgs2_sse.exe"+B7DC7: 85 D2 - test edx,edx
"mgs2_sse.exe"+B7DC9: 75 06 - jne mgs2_sse.exe+B7DD1
}
EMMA HEALTH(npc)
Code: Select all
{ Game : mgs2_sse.exe
Version:
Date : 2020-10-05
Author : bilibili
This script does blah blah blah
}
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
aobscanmodule(EmmaHealth1,mgs2_sse.exe,66 89 86 C8 08 00 00 A1) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// mov [esi+000008C8],ax
mov word ptr [esi+000008C8],#100
jmp return
EmmaHealth1:
jmp newmem
nop 2
return:
registersymbol(EmmaHealth1)
aobscanmodule(EmmaHealth2,mgs2_sse.exe,66 89 86 C8 08 00 00 2B) // should be unique
alloc(newmem2,$1000)
label(code2)
label(return2)
newmem2:
code2:
// mov [esi+000008C8],ax
mov word ptr [esi+000008C8],#100
jmp return2
EmmaHealth2:
jmp newmem2
nop 2
return2:
registersymbol(EmmaHealth2)
aobscanmodule(EmmaHealth3,mgs2_sse.exe,66 29 B2 CE 02 00 00) // should be unique
alloc(newmem5,$1000)
label(code5)
label(return5)
newmem5:
code5:
// sub [edx+000002CE],si
mov word ptr [edx+000002CE],#100
jmp return5
EmmaHealth3:
jmp newmem5
nop 2
return5:
registersymbol(EmmaHealth3)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
EmmaHealth1:
db 66 89 86 C8 08 00 00
unregistersymbol(EmmaHealth1)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "mgs2_sse.exe"+B7B70
"mgs2_sse.exe"+B7B43: E8 08 01 3C 00 - call mgs2_sse.exe+477C50
"mgs2_sse.exe"+B7B48: 85 C0 - test eax,eax
"mgs2_sse.exe"+B7B4A: 0F 85 DE 00 00 00 - jne mgs2_sse.exe+B7C2E
"mgs2_sse.exe"+B7B50: 66 8B 86 C8 08 00 00 - mov ax,[esi+000008C8]
"mgs2_sse.exe"+B7B57: 8B 15 A8 0A F6 00 - mov edx,[mgs2_sse.exe+B60AA8]
"mgs2_sse.exe"+B7B5D: 0F BF C8 - movsx ecx,ax
"mgs2_sse.exe"+B7B60: 57 - push edi
"mgs2_sse.exe"+B7B61: 2B C2 - sub eax,edx
"mgs2_sse.exe"+B7B63: 66 89 86 C8 08 00 00 - mov [esi+000008C8],ax
"mgs2_sse.exe"+B7B6A: 2B 05 FC 82 A1 00 - sub eax,[mgs2_sse.exe+6182FC]
// ---------- INJECTING HERE ----------
"mgs2_sse.exe"+B7B70: 66 89 86 C8 08 00 00 - mov [esi+000008C8],ax
// ---------- DONE INJECTING ----------
"mgs2_sse.exe"+B7B77: A1 BC 0A F6 00 - mov eax,[mgs2_sse.exe+B60ABC]
"mgs2_sse.exe"+B7B7C: 85 C0 - test eax,eax
"mgs2_sse.exe"+B7B7E: 7E 07 - jle mgs2_sse.exe+B7B87
"mgs2_sse.exe"+B7B80: 66 29 86 30 09 00 00 - sub [esi+00000930],ax
"mgs2_sse.exe"+B7B87: 66 8B BE CC 08 00 00 - mov di,[esi+000008CC]
"mgs2_sse.exe"+B7B8E: 66 39 BE C8 08 00 00 - cmp [esi+000008C8],di
"mgs2_sse.exe"+B7B95: 7D 07 - jnl mgs2_sse.exe+B7B9E
"mgs2_sse.exe"+B7B97: 66 89 BE C8 08 00 00 - mov [esi+000008C8],di
"mgs2_sse.exe"+B7B9E: 66 8B 86 34 09 00 00 - mov ax,[esi+00000934]
"mgs2_sse.exe"+B7BA5: 66 39 86 30 09 00 00 - cmp [esi+00000930],ax
}
EmmaHealth2:
db 66 89 86 C8 08 00 00
unregistersymbol(EmmaHealth2)
dealloc(newmem2)
{
// ORIGINAL CODE - INJECTION POINT: "mgs2_sse.exe"+B7B63
"mgs2_sse.exe"+B7B3B: 85 C0 - test eax,eax
"mgs2_sse.exe"+B7B3D: 0F 84 09 01 00 00 - je mgs2_sse.exe+B7C4C
"mgs2_sse.exe"+B7B43: E8 08 01 3C 00 - call mgs2_sse.exe+477C50
"mgs2_sse.exe"+B7B48: 85 C0 - test eax,eax
"mgs2_sse.exe"+B7B4A: 0F 85 DE 00 00 00 - jne mgs2_sse.exe+B7C2E
"mgs2_sse.exe"+B7B50: 66 8B 86 C8 08 00 00 - mov ax,[esi+000008C8]
"mgs2_sse.exe"+B7B57: 8B 15 A8 0A F6 00 - mov edx,[mgs2_sse.exe+B60AA8]
"mgs2_sse.exe"+B7B5D: 0F BF C8 - movsx ecx,ax
"mgs2_sse.exe"+B7B60: 57 - push edi
"mgs2_sse.exe"+B7B61: 2B C2 - sub eax,edx
// ---------- INJECTING HERE ----------
"mgs2_sse.exe"+B7B63: 66 89 86 C8 08 00 00 - mov [esi+000008C8],ax
// ---------- DONE INJECTING ----------
"mgs2_sse.exe"+B7B6A: 2B 05 FC 82 A1 00 - sub eax,[mgs2_sse.exe+6182FC]
"mgs2_sse.exe"+B7B70: 66 89 86 C8 08 00 00 - mov [esi+000008C8],ax
"mgs2_sse.exe"+B7B77: A1 BC 0A F6 00 - mov eax,[mgs2_sse.exe+B60ABC]
"mgs2_sse.exe"+B7B7C: 85 C0 - test eax,eax
"mgs2_sse.exe"+B7B7E: 7E 07 - jle mgs2_sse.exe+B7B87
"mgs2_sse.exe"+B7B80: 66 29 86 30 09 00 00 - sub [esi+00000930],ax
"mgs2_sse.exe"+B7B87: 66 8B BE CC 08 00 00 - mov di,[esi+000008CC]
"mgs2_sse.exe"+B7B8E: 66 39 BE C8 08 00 00 - cmp [esi+000008C8],di
"mgs2_sse.exe"+B7B95: 7D 07 - jnl mgs2_sse.exe+B7B9E
"mgs2_sse.exe"+B7B97: 66 89 BE C8 08 00 00 - mov [esi+000008C8],di
}
EmmaHealth3:
db 66 29 B2 CE 02 00 00
unregistersymbol(EmmaHealth3)
dealloc(newmem5)
{
// ORIGINAL CODE - INJECTION POINT: "mgs2_sse.exe"+2EB6F1
"mgs2_sse.exe"+2EB6CE: 74 0E - je mgs2_sse.exe+2EB6DE
"mgs2_sse.exe"+2EB6D0: A9 00 00 00 08 - test eax,08000000
"mgs2_sse.exe"+2EB6D5: 75 05 - jne mgs2_sse.exe+2EB6DC
"mgs2_sse.exe"+2EB6D7: 8D 34 B6 - lea esi,[esi+esi*4]
"mgs2_sse.exe"+2EB6DA: EB 02 - jmp mgs2_sse.exe+2EB6DE
"mgs2_sse.exe"+2EB6DC: 03 F6 - add esi,esi
"mgs2_sse.exe"+2EB6DE: 52 - push edx
"mgs2_sse.exe"+2EB6DF: E8 6C FF FF FF - call mgs2_sse.exe+2EB650
"mgs2_sse.exe"+2EB6E4: 83 C4 04 - add esp,04
"mgs2_sse.exe"+2EB6E7: C7 82 3C 10 00 00 A4 01 00 00 - mov [edx+0000103C],000001A4
// ---------- INJECTING HERE ----------
"mgs2_sse.exe"+2EB6F1: 66 29 B2 CE 02 00 00 - sub [edx+000002CE],si
// ---------- DONE INJECTING ----------
"mgs2_sse.exe"+2EB6F8: 57 - push edi
"mgs2_sse.exe"+2EB6F9: 52 - push edx
"mgs2_sse.exe"+2EB6FA: E8 61 FD FF FF - call mgs2_sse.exe+2EB460
"mgs2_sse.exe"+2EB6FF: 83 C4 08 - add esp,08
"mgs2_sse.exe"+2EB702: 5F - pop edi
"mgs2_sse.exe"+2EB703: 5E - pop esi
"mgs2_sse.exe"+2EB704: C3 - ret
"mgs2_sse.exe"+2EB705: B8 01 00 00 00 - mov eax,00000001
"mgs2_sse.exe"+2EB70A: C3 - ret
"mgs2_sse.exe"+2EB70B: 90 - nop
}
Snake health(npc)
Code: Select all
{ Game : mgs2_sse.exe
Version:
Date : 2020-10-05
Author : bilibili
This script does blah blah blah
}
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
aobscanmodule(SnakeHealth,mgs2_sse.exe,66 83 41 1E D8) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// add word ptr [ecx+1E],-28
jmp return
SnakeHealth:
jmp newmem
return:
registersymbol(SnakeHealth)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
SnakeHealth:
db 66 83 41 1E D8
unregistersymbol(SnakeHealth)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "mgs2_sse.exe"+384C74
"mgs2_sse.exe"+384C5F: 89 46 04 - mov [esi+04],eax
"mgs2_sse.exe"+384C62: 89 46 08 - mov [esi+08],eax
"mgs2_sse.exe"+384C65: 89 46 0C - mov [esi+0C],eax
"mgs2_sse.exe"+384C68: 5F - pop edi
"mgs2_sse.exe"+384C69: 33 C0 - xor eax,eax
"mgs2_sse.exe"+384C6B: 5E - pop esi
"mgs2_sse.exe"+384C6C: 8B E5 - mov esp,ebp
"mgs2_sse.exe"+384C6E: 5D - pop ebp
"mgs2_sse.exe"+384C6F: C3 - ret
"mgs2_sse.exe"+384C70: 8B 4C 24 08 - mov ecx,[esp+08]
// ---------- INJECTING HERE ----------
"mgs2_sse.exe"+384C74: 66 83 41 1E D8 - add word ptr [ecx+1E],-28
// ---------- DONE INJECTING ----------
"mgs2_sse.exe"+384C79: 8B 54 24 04 - mov edx,[esp+04]
"mgs2_sse.exe"+384C7D: 8B 82 6C 01 00 00 - mov eax,[edx+0000016C]
"mgs2_sse.exe"+384C83: 05 70 17 00 00 - add eax,00001770
"mgs2_sse.exe"+384C88: C7 00 00 00 00 00 - mov [eax],00000000
"mgs2_sse.exe"+384C8E: C7 40 04 00 00 00 00 - mov [eax+04],00000000
"mgs2_sse.exe"+384C95: C7 40 08 00 00 00 00 - mov [eax+08],00000000
"mgs2_sse.exe"+384C9C: C7 40 0C 00 00 00 00 - mov [eax+0C],00000000
"mgs2_sse.exe"+384CA3: 66 83 79 1E 00 - cmp word ptr [ecx+1E],00
"mgs2_sse.exe"+384CA8: 52 - push edx
"mgs2_sse.exe"+384CA9: 7F 17 - jg mgs2_sse.exe+384CC2
}
Kasarka Health(NPC)
Code: Select all
{ Game : mgs2_sse.exe
Version:
Date : 2020-09-30
Author : fangshun
This script does blah blah blah
}
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
aobscanmodule(Flight,mgs2_sse.exe,D0 00 00 00 66 8B D0 66 29 56 5C 66 39 4E 5C 89 8E 3C010000 C7 86 40 01 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// sub [esi+5C],dx
cmp [esi+5C],cx
jmp return
Flight+07:
jmp newmem
nop 3
return:
registersymbol(Flight)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
Flight+07:
db 66 29 56 5C 66 39 4E 5C
unregistersymbol(Flight)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "mgs2_sse.exe"+1F83C8
"mgs2_sse.exe"+1F83A6: 56 - push esi
"mgs2_sse.exe"+1F83A7: E8 94 1F 00 00 - call mgs2_sse.exe+1FA340
"mgs2_sse.exe"+1F83AC: 56 - push esi
"mgs2_sse.exe"+1F83AD: E8 4E 14 00 00 - call mgs2_sse.exe+1F9800
"mgs2_sse.exe"+1F83B2: 8B 86 3C 01 00 00 - mov eax,[esi+0000013C]
"mgs2_sse.exe"+1F83B8: 33 C9 - xor ecx,ecx
"mgs2_sse.exe"+1F83BA: 83 C4 08 - add esp,08
"mgs2_sse.exe"+1F83BD: 3B C1 - cmp eax,ecx
"mgs2_sse.exe"+1F83BF: 0F 84 D0 00 00 00 - je mgs2_sse.exe+1F8495
"mgs2_sse.exe"+1F83C5: 66 8B D0 - mov dx,ax
// ---------- INJECTING HERE ----------
"mgs2_sse.exe"+1F83C8: 66 29 56 5C - sub [esi+5C],dx
"mgs2_sse.exe"+1F83CC: 66 39 4E 5C - cmp [esi+5C],cx
// ---------- DONE INJECTING ----------
"mgs2_sse.exe"+1F83D0: 89 8E 3C 01 00 00 - mov [esi+0000013C],ecx
"mgs2_sse.exe"+1F83D6: C7 86 40 01 00 00 EE 02 00 00 - mov [esi+00000140],000002EE
"mgs2_sse.exe"+1F83E0: 0F 8D AF 00 00 00 - jnl mgs2_sse.exe+1F8495
"mgs2_sse.exe"+1F83E6: 8B 86 F8 00 00 00 - mov eax,[esi+000000F8]
"mgs2_sse.exe"+1F83EC: 3B C1 - cmp eax,ecx
"mgs2_sse.exe"+1F83EE: 66 89 4E 5C - mov [esi+5C],cx
"mgs2_sse.exe"+1F83F2: 74 2A - je mgs2_sse.exe+1F841E
"mgs2_sse.exe"+1F83F4: 8D 4C 24 18 - lea ecx,[esp+18]
"mgs2_sse.exe"+1F83F8: 66 89 7C 24 18 - mov [esp+18],di
"mgs2_sse.exe"+1F83FD: 51 - push ecx
}
PLAYER Oxygen
Code: Select all
{ Game : mgs2_sse.exe
Version:
Date : 2020-10-05
Author : bilibili
This script does blah blah blah
}
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
aobscanmodule(InfOxygen,mgs2_sse.exe,66 89 81 FE 00 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// mov [ecx+000000FE],ax
mov word ptr [ecx+000000FE],#4000
jmp return
InfOxygen:
jmp newmem
nop 2
return:
registersymbol(InfOxygen)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
InfOxygen:
db 66 89 81 FE 00 00 00
unregistersymbol(InfOxygen)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "mgs2_sse.exe"+BF6FE
"mgs2_sse.exe"+BF6D6: E8 05 BE 3B 00 - call mgs2_sse.exe+47B4E0
"mgs2_sse.exe"+BF6DB: 83 C4 0C - add esp,0C
"mgs2_sse.exe"+BF6DE: 80 4E 66 10 - or byte ptr [esi+66],10
"mgs2_sse.exe"+BF6E2: E8 B9 F4 02 00 - call mgs2_sse.exe+EEBA0
"mgs2_sse.exe"+BF6E7: 83 F8 25 - cmp eax,25
"mgs2_sse.exe"+BF6EA: 75 08 - jne mgs2_sse.exe+BF6F4
"mgs2_sse.exe"+BF6EC: 66 8B 57 1A - mov dx,[edi+1A]
"mgs2_sse.exe"+BF6F0: 66 89 57 18 - mov [edi+18],dx
"mgs2_sse.exe"+BF6F4: 66 8B 47 18 - mov ax,[edi+18]
"mgs2_sse.exe"+BF6F8: 8B 0D 34 1F A0 00 - mov ecx,[mgs2_sse.exe+601F34]
// ---------- INJECTING HERE ----------
"mgs2_sse.exe"+BF6FE: 66 89 81 FE 00 00 00 - mov [ecx+000000FE],ax
// ---------- DONE INJECTING ----------
"mgs2_sse.exe"+BF705: F6 86 B4 00 00 00 02 - test byte ptr [esi+000000B4],02
"mgs2_sse.exe"+BF70C: 74 23 - je mgs2_sse.exe+BF731
"mgs2_sse.exe"+BF70E: 57 - push edi
"mgs2_sse.exe"+BF70F: E8 EC 27 03 00 - call mgs2_sse.exe+F1F00
"mgs2_sse.exe"+BF714: 83 C4 04 - add esp,04
"mgs2_sse.exe"+BF717: 5F - pop edi
"mgs2_sse.exe"+BF718: 5E - pop esi
"mgs2_sse.exe"+BF719: 5D - pop ebp
"mgs2_sse.exe"+BF71A: 83 C4 0C - add esp,0C
"mgs2_sse.exe"+BF71D: C3 - ret
}