lollipop-Win64-Shipping.exe+363F1AC mov [rdx+rcx],eax
holds the lollipop amount however RCX is the base address that holds it other than that I do not know how to "get" RCX without the game crashing when I prod into it
nevermind if you are going to use the code activate the script before you enter the stage select screen thats when the code starts to do its magic apparently... weird
Code: Select all
<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
<CheatEntries>
<CheatEntry>
<ID>129</ID>
<Description>"Number of Lolipops"</Description>
<LastState Activated="1"/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>{ Game : lollipop-Win64-Shipping.exe
Version:
Date : 2024-11-28
Author : Algester
This script does blah blah blah
}
[ENABLE]
aobscanmodule(HOOK,lollipop-Win64-Shipping.exe,89 04 0A FF C3 48 83 C2 04 41 3B 58 78 7C DB 33) // should be unique
alloc(newmem,$1000,HOOK)
label(code)
label(return)
label(res)
newmem:
code:
mov [res],rcx
mov [rdx+rcx],eax
inc ebx
jmp return
res:
dq 0
HOOK:
jmp newmem
return:
registersymbol(HOOK res)
[DISABLE]
HOOK:
db 89 04 0A FF C3
unregistersymbol(HOOK res)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: lollipop-Win64-Shipping.exe+363F1AC
lollipop-Win64-Shipping.exe+363F183: 8B 87 E0 00 00 00 - mov eax,[rdi+000000E0]
lollipop-Win64-Shipping.exe+363F189: 41 89 40 6C - mov [r8+6C],eax
lollipop-Win64-Shipping.exe+363F18D: 41 39 58 78 - cmp [r8+78],ebx
lollipop-Win64-Shipping.exe+363F191: 7E 28 - jle lollipop-Win64-Shipping.exe+363F1BB
lollipop-Win64-Shipping.exe+363F193: 48 8B D3 - mov rdx,rbx
lollipop-Win64-Shipping.exe+363F196: 3B 9F D0 00 00 00 - cmp ebx,[rdi+000000D0]
lollipop-Win64-Shipping.exe+363F19C: 7D 11 - jnl lollipop-Win64-Shipping.exe+363F1AF
lollipop-Win64-Shipping.exe+363F19E: 48 8B 87 C8 00 00 00 - mov rax,[rdi+000000C8]
lollipop-Win64-Shipping.exe+363F1A5: 49 8B 48 70 - mov rcx,[r8+70]
lollipop-Win64-Shipping.exe+363F1A9: 8B 04 02 - mov eax,[rdx+rax]
// ---------- INJECTING HERE ----------
lollipop-Win64-Shipping.exe+363F1AC: 89 04 0A - mov [rdx+rcx],eax
// ---------- DONE INJECTING ----------
lollipop-Win64-Shipping.exe+363F1AF: FF C3 - inc ebx
lollipop-Win64-Shipping.exe+363F1B1: 48 83 C2 04 - add rdx,04
lollipop-Win64-Shipping.exe+363F1B5: 41 3B 58 78 - cmp ebx,[r8+78]
lollipop-Win64-Shipping.exe+363F1B9: 7C DB - jl lollipop-Win64-Shipping.exe+363F196
lollipop-Win64-Shipping.exe+363F1BB: 33 D2 - xor edx,edx
lollipop-Win64-Shipping.exe+363F1BD: 48 8B CF - mov rcx,rdi
lollipop-Win64-Shipping.exe+363F1C0: E8 0B 37 82 FF - call lollipop-Win64-Shipping.exe+2E628D0
lollipop-Win64-Shipping.exe+363F1C5: 48 85 C0 - test rax,rax
lollipop-Win64-Shipping.exe+363F1C8: 0F 84 76 00 00 00 - je lollipop-Win64-Shipping.exe+363F244
lollipop-Win64-Shipping.exe+363F1CE: 8B 48 08 - mov ecx,[rax+08]
}
</AssemblerScript>
<CheatEntries>
<CheatEntry>
<ID>123</ID>
<Description>"Lollipop Amount"</Description>
<LastState Value="4" RealAddress="20513B091C0"/>
<ShowAsSigned>0</ShowAsSigned>
<VariableType>4 Bytes</VariableType>
<Address>res</Address>
<Offsets>
<Offset>0</Offset>
</Offsets>
</CheatEntry>
</CheatEntries>
</CheatEntry>
</CheatEntries>
</CheatTable>
I was able to pointer scan HP to make it easier to scan this the array of bytes is basically structured as (Current HP) (Current HP) (Max HP) all in 4 bytes
at the start if you do not have any upgrades HP starts at 100 for every upgrade bought you add +10 for the total max of 200
so at the start its 64 00 00 00 64 00 00 00 64 00 00 00
Code: Select all
<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
<CheatEntries>
<CheatEntry>
<ID>137</ID>
<Description>"HP Attempt"</Description>
<LastState Activated="1"/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>{ Game : lollipop-Win64-Shipping.exe
Version:
Date : 2024-11-29
Author : Algester
This script does blah blah blah
}
[ENABLE]
aobscanmodule(AoBTest,lollipop-Win64-Shipping.exe,20 48 63 D9 48 C1 E3 06 48 03 18 48 8B 4B 18) // should be unique
alloc(newmem,$1000,AoBTest)
label(code)
label(return Base)
newmem:
code:
mov [Base],rax
add rbx,[rax]
mov rcx,[rbx+18]
jmp return
Base:
dq 0
AoBTest+08:
jmp newmem
nop 2
return:
registersymbol(AoBTest Base)
[DISABLE]
AoBTest+08:
db 48 03 18 48 8B 4B 18
unregistersymbol(AoBTest Base)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: lollipop-Win64-Shipping.exe+EDFB8C
lollipop-Win64-Shipping.exe+EDFB62: 48 8D 4C 24 20 - lea rcx,[rsp+20]
lollipop-Win64-Shipping.exe+EDFB67: E8 14 94 C1 FF - call lollipop-Win64-Shipping.exe+AF8F80
lollipop-Win64-Shipping.exe+EDFB6C: 48 8B 44 24 30 - mov rax,[rsp+30]
lollipop-Win64-Shipping.exe+EDFB71: 8B 4C 24 3C - mov ecx,[rsp+3C]
lollipop-Win64-Shipping.exe+EDFB75: 3B 48 18 - cmp ecx,[rax+18]
lollipop-Win64-Shipping.exe+EDFB78: 0F 8D 79 00 00 00 - jnl lollipop-Win64-Shipping.exe+EDFBF7
lollipop-Win64-Shipping.exe+EDFB7E: 66 90 - nop 2
lollipop-Win64-Shipping.exe+EDFB80: 48 8B 44 24 20 - mov rax,[rsp+20]
lollipop-Win64-Shipping.exe+EDFB85: 48 63 D9 - movsxd rbx,ecx
lollipop-Win64-Shipping.exe+EDFB88: 48 C1 E3 06 - shl rbx,06
// ---------- INJECTING HERE ----------
lollipop-Win64-Shipping.exe+EDFB8C: 48 03 18 - add rbx,[rax]
// ---------- DONE INJECTING ----------
lollipop-Win64-Shipping.exe+EDFB8F: 48 8B 4B 18 - mov rcx,[rbx+18]
lollipop-Win64-Shipping.exe+EDFB93: 48 85 C9 - test rcx,rcx
lollipop-Win64-Shipping.exe+EDFB96: 74 1A - je lollipop-Win64-Shipping.exe+EDFBB2
lollipop-Win64-Shipping.exe+EDFB98: B8 FF FF FF FF - mov eax,FFFFFFFF
lollipop-Win64-Shipping.exe+EDFB9D: F0 0F C1 41 0C - lock xadd [rcx+0C],eax
lollipop-Win64-Shipping.exe+EDFBA2: 83 F8 01 - cmp eax,01
lollipop-Win64-Shipping.exe+EDFBA5: 75 0B - jne lollipop-Win64-Shipping.exe+EDFBB2
lollipop-Win64-Shipping.exe+EDFBA7: 48 8B 01 - mov rax,[rcx]
lollipop-Win64-Shipping.exe+EDFBAA: BA 01 00 00 00 - mov edx,00000001
lollipop-Win64-Shipping.exe+EDFBAF: FF 50 08 - call qword ptr [rax+08]
}
</AssemblerScript>
<CheatEntries>
<CheatEntry>
<ID>136</ID>
<Description>"Juliet's HP"</Description>
<LastState Value="200" RealAddress="1F20B6D27C0"/>
<ShowAsSigned>0</ShowAsSigned>
<VariableType>4 Bytes</VariableType>
<Address>Base</Address>
<Offsets>
<Offset>600</Offset>
<Offset>298</Offset>
<Offset>100</Offset>
<Offset>0</Offset>
</Offsets>
</CheatEntry>
</CheatEntries>
</CheatEntry>
</CheatEntries>
</CheatTable>
Ok its jank but I used lollipop-Win64-Shipping.exe+EDFB8C - 48 03 18 - add rbx,[rax] to generate the HP