this is an update to the table I made last year.
not all the scripts are updated though. I start updating the table last week, but I got distracted by other games. and now I probably can't finish the updates to all the scripts, so I think I should just share it now.
///
Options:
Undead
- for Player & Pet.
- you and your pet would still took damage, but won't be killed.
One Hit Kill
- activate to have one hit kill.
- Undead script must be activated first.
Full Pet Energy
- activate to lock pet energy at full.
Hero Stats
- including Exp, Level, Sub-Levels (Weapon Levels, Magic Levels, etc.), Level Up Points, Inventory Size, and Moving Speed
- with this script activated you may freely edit your stats without triggering the "anti-cheat system".
- NOTE that the Inventory Size value should stay within 10 (x10=100, default starting size) to 25 (x10=250). or the items you placed at the end of the inventory may disappeared.
- Sub-Levels are using custom type SubLevel, changing the type to others may hurt your eyes. check the end of the post for the custom type.
Sync ALL Sub-Levels with current Level
- when activated, all your Sub-Levels (Weapon Levels, Magic Levels, etc..) would be synced with the player's current level.
Run Faster
- multiply the moving speed with the Speed Multiplier specified
- Speed Multiplier default value: 1.5
Items
- including Coins, first 10 Item's ID, Name, Quantity, Charge (if any), Suffix, Status (if any) and the Slot it's on.
- with this script activated you may freely edit the items' value without triggering the "anti-cheat system".
- the items are all 0xA8 apart from each other. you may examine the pointers' structure and add more slots yourself.
check Table Extra for the Suffix list.
- NOTE that I didn't check if the suffix list is still correct, I've just updated the offsets, you've to check them yourself.
Inf. Item
- Coins won't decrease when shopping.
- all Potions (empty or not) are locked at 2 once you obtain them. you may still drop or sell them normally.
- Arrows, Scrolls won't drop below 1
- Magic Essence and Divine Favor won't drops below 110.
- wands' Charges won't decrease when used.
- NOTE that I didn't test the script thoroughly after the update. let me know if something doesn't work and I'll see what I can do.
Spells
- including the first 10 Spell's ID, Name and the Slot it's on.
- check the Spell List for all the spell ID.
Spell List
- list all the spell's ID and name, both player's spells and enemies' spells.
e.g. if you want to change one of your spell to an alternate phase door spell which has no level restriction and no essence usage, first locate this spell number, which is 131,
then place the spell you want to exchange with in one of the first 10 slots in magic tab, then change ID of the magic slot to "(131)" without quote, this will automatically change the value with the ID of spell 131.
- spell ID has its own custom type SpellID, check the end of this post the info.
///
Notes:
- table has AOB scan, should work on other exe version, as long as the game version is v1.47.1
- table won't work on previous game versions.
- this table is intended to be used in offline / single-player mode ONLY.
- you've to add two custom type in order for the table to work as it should. create the 2 custom types with the 2 following aa scripts.
- SubLevel
Code:
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(TypeName,256)
alloc(ByteSize,4)
alloc(UsesFloat,1)
TypeName:
db 'SubLevel',0
ByteSize:
dd 1
UsesFloat:
db 0 //Change to 1 if this custom type should be treated as a float
//The convert routine should hold a routine that converts the data to an integer (in eax)
//function declared as: stdcall int ConvertRoutine(unsigned char *input);
//Note: Keep in mind that this routine can be called by multiple threads at the same time.
ConvertRoutine:
//jmp dllname.functionname
[64-bit]
//or manual:
//parameters: (64-bit)
//rcx=address of input
mov eax,[rcx] //eax now contains the bytes 'input' pointed to
ret
[/64-bit]
[32-bit]
//jmp dllname.functionname
//or manual:
//parameters: (32-bit)
push ebp
mov ebp,esp
//[ebp+8]=input
//example:
mov eax,[ebp+8] //place the address that contains the bytes into eax
mov eax,[eax] //place the bytes into eax so it's handled as a normal 4 byte value
movzx eax,al
xor al,44
pop ebp
ret 4
[/32-bit]
//The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)
//function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);
ConvertBackRoutine:
//jmp dllname.functionname
//or manual:
[64-bit]
//parameters: (64-bit)
//ecx=input
//rdx=address of output
//example:
mov [rdx],ecx //place the integer the 4 bytes pointed to by rdx
ret
[/64-bit]
[32-bit]
//parameters: (32-bit)
push ebp
mov ebp,esp
//[ebp+8]=input
//[ebp+c]=address of output
//example:
push eax
push ebx
mov eax,[ebp+8] //load the value into eax
mov ebx,[ebp+c] //load the address into ebx
movzx eax,al
xor al,44
mov byte ptr [ebx],al //write the value into the address
pop ebx
pop eax
pop ebp
ret 8
[/32-bit]
- SpellID:
Code:
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(TypeName,256)
alloc(ByteSize,4)
alloc(UsesFloat,1)
TypeName:
db 'SpellID',0
ByteSize:
dd 4
UsesFloat:
db 0 //Change to 1 if this custom type should be treated as a float
//The convert routine should hold a routine that converts the data to an integer (in eax)
//function declared as: stdcall int ConvertRoutine(unsigned char *input);
//Note: Keep in mind that this routine can be called by multiple threads at the same time.
ConvertRoutine:
//jmp dllname.functionname
[64-bit]
//or manual:
//parameters: (64-bit)
//rcx=address of input
mov eax,[rcx] //eax now contains the bytes 'input' pointed to
ret
[/64-bit]
[32-bit]
//jmp dllname.functionname
//or manual:
//parameters: (32-bit)
push ebp
mov ebp,esp
//[ebp+8]=input
//example:
//mov eax,[ebp+8] //place the address that contains the bytes into eax
//mov eax,[eax] //place the bytes into eax so it's handled as a normal 4 byte value
mov eax,[ebp+28]
pop ebp
ret 4
[/32-bit]
//The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)
//function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);
ConvertBackRoutine:
//jmp dllname.functionname
//or manual:
[64-bit]
//parameters: (64-bit)
//ecx=input
//rdx=address of output
//example:
mov [rdx],ecx //place the integer the 4 bytes pointed to by rdx
ret
[/64-bit]
[32-bit]
//parameters: (32-bit)
push ebp
mov ebp,esp
//[ebp+8]=input
//[ebp+c]=address of output
//example:
push eax
push ebx
mov eax,[ebp+8] //load the value into eax
mov ebx,[ebp+c] //load the address into ebx
//mov [ebx],eax //write the value into the address
pop ebx
pop eax
pop ebp
ret 8
[/32-bit]
How to use this cheat table?
- Install Cheat Engine
- Double-click the .CT file in order to open it.
- Click the PC icon in Cheat Engine in order to select the game process.
- Keep the list.
- Activate the trainer options by checking boxes or setting values from 0 to 1