[Solved]Sword Art Online: Hollow Realization Deluxe Edition

[qweasdzxc17]

Skill Levels are also two bytes and in the same 140****** <-> 141****** reigon.

Hopefully someone can use this to make a script, my skills in that area are limited.

Katana Skill Level -> 140B15F8E (sao_hr.exe+B15F8E) 2-byte

example:
Note: On UI display, when address is 3872, ui will show 387.2

[KS212]

Requesting probably the single most needed cheat for this game: All skill trees unlocked and fully mastered.

Doing this legit and unlocking all the hidden tree is truly hair pulling... Did it on PS4, never EVER doing it again.

I did it too, but I don't want them unlocked and mastered. Maybe made easier, but definitely not done entirely for me.

Something like a multiplier option?
And yeah, leveling those is a huge pain.

Even a multiplier means you have to actually 'hit' with the weapons... I'd rather just a flat unlock all IF it were possible. Some skills have annoying conditions as well beyond just 'hitting'.

[cdtrico]

Not working at all, the script can be activated, but materials will still be needed and used.

Find any item thats being used for blacksmithing and "Find out what writes to this address" on the quantity.

For example in the Memory viewer ** ** 67 ** 07 2f
Highlight 07 2f and right-click add this address to the list with type 2 bytes then on that address use the find out function.

Is the instruction at the address sao_hr.exe+36B3E0?

EDIT: Should probbaly add that only works for materials in storage.

Oh, that might've been the reason as I had mats in inventory, I'll farm some more and try it out.

EDIT: Tested it with all mats in storage and they didn't get consumed, although I still needed to have the appropriate amount of said mat before I could attempt, thanks!

Just noticed that this also makes it so that when you have quest rewards in your storage and give them they won't be depleted, which is pretty useful to have specific NPC's affection go up repeatedly by resting and redoing the quest.

[qweasdzxc17]

Find any item thats being used for blacksmithing and "Find out what writes to this address" on the quantity.

For example in the Memory viewer ** ** 67 ** 07 2f
Highlight 07 2f and right-click add this address to the list with type 2 bytes then on that address use the find out function.

Is the instruction at the address sao_hr.exe+36B3E0?

EDIT: Should probbaly add that only works for materials in storage.

Oh, that might've been the reason as I had mats in inventory, I'll farm some more and try it out.

EDIT: Tested it with all mats in storage and they didn't get consumed, although I still needed to have the appropriate amount of said mat before I could attempt, thanks!

Just noticed that this also makes it so that when you have quest rewards in your storage and give them they won't be depleted, which is pretty useful to have specific NPC's affection go up repeatedly by resting and redoing the quest.

Its more like storage freeze than no blacksmith material use

[cdtrico]

Oh, that might've been the reason as I had mats in inventory, I'll farm some more and try it out.

EDIT: Tested it with all mats in storage and they didn't get consumed, although I still needed to have the appropriate amount of said mat before I could attempt, thanks!

Just noticed that this also makes it so that when you have quest rewards in your storage and give them they won't be depleted, which is pretty useful to have specific NPC's affection go up repeatedly by resting and redoing the quest.

Its more like storage freeze than no blacksmith material use

Yeah, exactly, which is quite useful in itself to be fair.

[qweasdzxc17]

Code: Select all

{ Game   : sao_hr.exe
  Version: 
  Date   : 2017-10-28
  Author : qweasdzxc17

  This script does blah blah blah
}

[ENABLE]


aobscanmodule(INJECT,sao_hr.exe,66 89 48 02 41 8B EF) // should be unique
alloc(newmem,$1000,"sao_hr.exe"+1B25B5)

label(code)
label(return)

newmem:
  push ax
  mov ax,8
  imul cx,ax
  pop ax

code:
  mov [rax+02],cx
  mov ebp,r15d
  jmp return

INJECT:
  jmp newmem
  nop
  nop
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 66 89 48 02 41 8B EF

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "sao_hr.exe"+1B25B5

"sao_hr.exe"+1B2593: 48 89 6C 24 40           -  mov [rsp+40],rbp
"sao_hr.exe"+1B2598: 4C 89 7C 24 20           -  mov [rsp+20],r15
"sao_hr.exe"+1B259D: 03 D7                    -  add edx,edi
"sao_hr.exe"+1B259F: 45 33 FF                 -  xor r15d,r15d
"sao_hr.exe"+1B25A2: 3B D1                    -  cmp edx,ecx
"sao_hr.exe"+1B25A4: 7F 08                    -  jg sao_hr.exe+1B25AE
"sao_hr.exe"+1B25A6: 8B CA                    -  mov ecx,edx
"sao_hr.exe"+1B25A8: 85 D2                    -  test edx,edx
"sao_hr.exe"+1B25AA: 41 0F 48 CF              -  cmovs ecx,r15d
"sao_hr.exe"+1B25AE: 44 39 3D 7B 03 92 00     -  cmp [sao_hr.exe+AD2930],r15d
// ---------- INJECTING HERE ----------
"sao_hr.exe"+1B25B5: 66 89 48 02              -  mov [rax+02],cx
"sao_hr.exe"+1B25B9: 41 8B EF                 -  mov ebp,r15d
// ---------- DONE INJECTING  ----------
"sao_hr.exe"+1B25BC: 41 8B FF                 -  mov edi,r15d
"sao_hr.exe"+1B25BF: 7E 68                    -  jle sao_hr.exe+1B2629
"sao_hr.exe"+1B25C1: 48 89 74 24 48           -  mov [rsp+48],rsi
"sao_hr.exe"+1B25C6: 4C 89 74 24 50           -  mov [rsp+50],r14
"sao_hr.exe"+1B25CB: 49 8B F7                 -  mov rsi,r15
"sao_hr.exe"+1B25CE: 66 90                    -  nop 
"sao_hr.exe"+1B25D0: 48 8B 05 51 03 92 00     -  mov rax,[sao_hr.exe+AD2928]
"sao_hr.exe"+1B25D7: 45 8B F7                 -  mov r14d,r15d
"sao_hr.exe"+1B25DA: 0F BF 1C 06              -  movsx ebx,word ptr [rsi+rax]
"sao_hr.exe"+1B25DE: E8 BD 1D 1B 00           -  call sao_hr.exe+3643A0
}

This should work for ex skills, but

• It boosts your skill level to somthing impossible like 6228.0

Maybe someone who is more knowledgeable can take a look?

EDIT: Just checked, will also work for weapon skill levels

[qweasdzxc17]

Code: Select all

{ Game   : sao_hr.exe
  Version: 
  Date   : 2017-10-28
  Author : qweasdzxc17

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(INJECT,sao_hr.exe,66 89 48 08 48 8B 0D CA 01 92 00) // should be unique
alloc(newmem,$1000,"sao_hr.exe"+1B273B)

label(code)
label(return)

newmem:
  inc cx
  inc cx
  inc cx
  
code:
  mov [rax+08],cx
  mov rcx,[sao_hr.exe+AD2910]
  jmp return

INJECT:
  jmp newmem
  nop
  nop
  nop
  nop
  nop
  nop
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 66 89 48 08 48 8B 0D CA 01 92 00

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "sao_hr.exe"+1B273B

"sao_hr.exe"+1B2716: 44 0F B7 40 08           -  movzx r8d,word ptr [rax+08]
"sao_hr.exe"+1B271B: 33 D2                    -  xor edx,edx
"sao_hr.exe"+1B271D: B9 50 C3 00 00           -  mov ecx,0000C350
"sao_hr.exe"+1B2722: 44 03 C6                 -  add r8d,esi
"sao_hr.exe"+1B2725: 45 85 C0                 -  test r8d,r8d
"sao_hr.exe"+1B2728: 41 0F 4F D0              -  cmovg edx,r8d
"sao_hr.exe"+1B272C: 44 8B 05 E5 01 92 00     -  mov r8d,[sao_hr.exe+AD2918]
"sao_hr.exe"+1B2733: 3B D1                    -  cmp edx,ecx
"sao_hr.exe"+1B2735: 66 0F 4C CA              -  cmovl cx,dx
"sao_hr.exe"+1B2739: 8B D7                    -  mov edx,edi
// ---------- INJECTING HERE ----------
"sao_hr.exe"+1B273B: 66 89 48 08              -  mov [rax+08],cx
"sao_hr.exe"+1B273F: 48 8B 0D CA 01 92 00     -  mov rcx,[sao_hr.exe+AD2910]
// ---------- DONE INJECTING  ----------
"sao_hr.exe"+1B2746: E8 E5 FC FF FF           -  call sao_hr.exe+1B2430
"sao_hr.exe"+1B274B: 48 85 C0                 -  test rax,rax
"sao_hr.exe"+1B274E: 74 21                    -  je sao_hr.exe+1B2771
"sao_hr.exe"+1B2750: 80 78 0C 05              -  cmp byte ptr [rax+0C],05
"sao_hr.exe"+1B2754: 75 1B                    -  jne sao_hr.exe+1B2771
"sao_hr.exe"+1B2756: 0F B7 4B 08              -  movzx ecx,word ptr [rbx+08]
"sao_hr.exe"+1B275A: E8 C1 E4 0B 00           -  call sao_hr.exe+270C20
"sao_hr.exe"+1B275F: 8B D8                    -  mov ebx,eax
"sao_hr.exe"+1B2761: E8 8A 66 55 00           -  call sao_hr.exe+708DF0
"sao_hr.exe"+1B2766: 3B C3                    -  cmp eax,ebx
}

Should multiply SS Mastery value by 4, Not sure yet if it affects other things.

[cdtrico]

Code: Select all

{ Game   : sao_hr.exe
  Version: 
  Date   : 2017-10-28
  Author : qweasdzxc17

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(INJECT,sao_hr.exe,66 89 48 08 48 8B 0D CA 01 92 00) // should be unique
alloc(newmem,$1000,"sao_hr.exe"+1B273B)

label(code)
label(return)

newmem:
  inc cx
  inc cx
  inc cx
  
code:
  mov [rax+08],cx
  mov rcx,[sao_hr.exe+AD2910]
  jmp return

INJECT:
  jmp newmem
  nop
  nop
  nop
  nop
  nop
  nop
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 66 89 48 08 48 8B 0D CA 01 92 00

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "sao_hr.exe"+1B273B

"sao_hr.exe"+1B2716: 44 0F B7 40 08           -  movzx r8d,word ptr [rax+08]
"sao_hr.exe"+1B271B: 33 D2                    -  xor edx,edx
"sao_hr.exe"+1B271D: B9 50 C3 00 00           -  mov ecx,0000C350
"sao_hr.exe"+1B2722: 44 03 C6                 -  add r8d,esi
"sao_hr.exe"+1B2725: 45 85 C0                 -  test r8d,r8d
"sao_hr.exe"+1B2728: 41 0F 4F D0              -  cmovg edx,r8d
"sao_hr.exe"+1B272C: 44 8B 05 E5 01 92 00     -  mov r8d,[sao_hr.exe+AD2918]
"sao_hr.exe"+1B2733: 3B D1                    -  cmp edx,ecx
"sao_hr.exe"+1B2735: 66 0F 4C CA              -  cmovl cx,dx
"sao_hr.exe"+1B2739: 8B D7                    -  mov edx,edi
// ---------- INJECTING HERE ----------
"sao_hr.exe"+1B273B: 66 89 48 08              -  mov [rax+08],cx
"sao_hr.exe"+1B273F: 48 8B 0D CA 01 92 00     -  mov rcx,[sao_hr.exe+AD2910]
// ---------- DONE INJECTING  ----------
"sao_hr.exe"+1B2746: E8 E5 FC FF FF           -  call sao_hr.exe+1B2430
"sao_hr.exe"+1B274B: 48 85 C0                 -  test rax,rax
"sao_hr.exe"+1B274E: 74 21                    -  je sao_hr.exe+1B2771
"sao_hr.exe"+1B2750: 80 78 0C 05              -  cmp byte ptr [rax+0C],05
"sao_hr.exe"+1B2754: 75 1B                    -  jne sao_hr.exe+1B2771
"sao_hr.exe"+1B2756: 0F B7 4B 08              -  movzx ecx,word ptr [rbx+08]
"sao_hr.exe"+1B275A: E8 C1 E4 0B 00           -  call sao_hr.exe+270C20
"sao_hr.exe"+1B275F: 8B D8                    -  mov ebx,eax
"sao_hr.exe"+1B2761: E8 8A 66 55 00           -  call sao_hr.exe+708DF0
"sao_hr.exe"+1B2766: 3B C3                    -  cmp eax,ebx
}

Should multiply SS Mastery value by 4, Not sure yet if it affects other things.

Oh, neat, this is really useful, is there a way to increase the multiplier? You need like 2000 uses on a one handed sword skill to unlock Celestial Blades (Dual Wield) iirc.

EDIT: I also played around with the code that puts the skill level on an extreme amount, it gives you a lot of skill points, but other than that I haven't found anything negative out of it.

[qweasdzxc17]

Code: Select all

{ Game   : sao_hr.exe
  Version: 
  Date   : 2017-10-28
  Author : qweasdzxc17

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(INJECT,sao_hr.exe,66 89 48 08 48 8B 0D CA 01 92 00) // should be unique
alloc(newmem,$1000,"sao_hr.exe"+1B273B)

label(code)
label(return)

newmem:
  inc cx
  inc cx
  inc cx
  
code:
  mov [rax+08],cx
  mov rcx,[sao_hr.exe+AD2910]
  jmp return

INJECT:
  jmp newmem
  nop
  nop
  nop
  nop
  nop
  nop
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 66 89 48 08 48 8B 0D CA 01 92 00

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "sao_hr.exe"+1B273B

"sao_hr.exe"+1B2716: 44 0F B7 40 08           -  movzx r8d,word ptr [rax+08]
"sao_hr.exe"+1B271B: 33 D2                    -  xor edx,edx
"sao_hr.exe"+1B271D: B9 50 C3 00 00           -  mov ecx,0000C350
"sao_hr.exe"+1B2722: 44 03 C6                 -  add r8d,esi
"sao_hr.exe"+1B2725: 45 85 C0                 -  test r8d,r8d
"sao_hr.exe"+1B2728: 41 0F 4F D0              -  cmovg edx,r8d
"sao_hr.exe"+1B272C: 44 8B 05 E5 01 92 00     -  mov r8d,[sao_hr.exe+AD2918]
"sao_hr.exe"+1B2733: 3B D1                    -  cmp edx,ecx
"sao_hr.exe"+1B2735: 66 0F 4C CA              -  cmovl cx,dx
"sao_hr.exe"+1B2739: 8B D7                    -  mov edx,edi
// ---------- INJECTING HERE ----------
"sao_hr.exe"+1B273B: 66 89 48 08              -  mov [rax+08],cx
"sao_hr.exe"+1B273F: 48 8B 0D CA 01 92 00     -  mov rcx,[sao_hr.exe+AD2910]
// ---------- DONE INJECTING  ----------
"sao_hr.exe"+1B2746: E8 E5 FC FF FF           -  call sao_hr.exe+1B2430
"sao_hr.exe"+1B274B: 48 85 C0                 -  test rax,rax
"sao_hr.exe"+1B274E: 74 21                    -  je sao_hr.exe+1B2771
"sao_hr.exe"+1B2750: 80 78 0C 05              -  cmp byte ptr [rax+0C],05
"sao_hr.exe"+1B2754: 75 1B                    -  jne sao_hr.exe+1B2771
"sao_hr.exe"+1B2756: 0F B7 4B 08              -  movzx ecx,word ptr [rbx+08]
"sao_hr.exe"+1B275A: E8 C1 E4 0B 00           -  call sao_hr.exe+270C20
"sao_hr.exe"+1B275F: 8B D8                    -  mov ebx,eax
"sao_hr.exe"+1B2761: E8 8A 66 55 00           -  call sao_hr.exe+708DF0
"sao_hr.exe"+1B2766: 3B C3                    -  cmp eax,ebx
}

Should multiply SS Mastery value by 4, Not sure yet if it affects other things.

Oh, neat, this is really useful, is there a way to increase the multiplier? You need like 2000 uses on a one handed sword skill to unlock Celestial Blades (Dual Wield) iirc.

Just add more inc cx

Also for unlocking the celestial blades skills, its a different stat that is also tracked in memory the address for it is 140B15FF4 (sao_hr.exe+B15FF4)

Its a 4-byte value and you should change it to 1999 and execute a 1H SS on a mob, You will also need the prerequisite 1H Sword Mastery in the Skill tree.

[cdtrico]

Code: Select all

{ Game   : sao_hr.exe
  Version: 
  Date   : 2017-10-28
  Author : qweasdzxc17

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(INJECT,sao_hr.exe,66 89 48 08 48 8B 0D CA 01 92 00) // should be unique
alloc(newmem,$1000,"sao_hr.exe"+1B273B)

label(code)
label(return)

newmem:
  inc cx
  inc cx
  inc cx
  
code:
  mov [rax+08],cx
  mov rcx,[sao_hr.exe+AD2910]
  jmp return

INJECT:
  jmp newmem
  nop
  nop
  nop
  nop
  nop
  nop
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 66 89 48 08 48 8B 0D CA 01 92 00

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "sao_hr.exe"+1B273B

"sao_hr.exe"+1B2716: 44 0F B7 40 08           -  movzx r8d,word ptr [rax+08]
"sao_hr.exe"+1B271B: 33 D2                    -  xor edx,edx
"sao_hr.exe"+1B271D: B9 50 C3 00 00           -  mov ecx,0000C350
"sao_hr.exe"+1B2722: 44 03 C6                 -  add r8d,esi
"sao_hr.exe"+1B2725: 45 85 C0                 -  test r8d,r8d
"sao_hr.exe"+1B2728: 41 0F 4F D0              -  cmovg edx,r8d
"sao_hr.exe"+1B272C: 44 8B 05 E5 01 92 00     -  mov r8d,[sao_hr.exe+AD2918]
"sao_hr.exe"+1B2733: 3B D1                    -  cmp edx,ecx
"sao_hr.exe"+1B2735: 66 0F 4C CA              -  cmovl cx,dx
"sao_hr.exe"+1B2739: 8B D7                    -  mov edx,edi
// ---------- INJECTING HERE ----------
"sao_hr.exe"+1B273B: 66 89 48 08              -  mov [rax+08],cx
"sao_hr.exe"+1B273F: 48 8B 0D CA 01 92 00     -  mov rcx,[sao_hr.exe+AD2910]
// ---------- DONE INJECTING  ----------
"sao_hr.exe"+1B2746: E8 E5 FC FF FF           -  call sao_hr.exe+1B2430
"sao_hr.exe"+1B274B: 48 85 C0                 -  test rax,rax
"sao_hr.exe"+1B274E: 74 21                    -  je sao_hr.exe+1B2771
"sao_hr.exe"+1B2750: 80 78 0C 05              -  cmp byte ptr [rax+0C],05
"sao_hr.exe"+1B2754: 75 1B                    -  jne sao_hr.exe+1B2771
"sao_hr.exe"+1B2756: 0F B7 4B 08              -  movzx ecx,word ptr [rbx+08]
"sao_hr.exe"+1B275A: E8 C1 E4 0B 00           -  call sao_hr.exe+270C20
"sao_hr.exe"+1B275F: 8B D8                    -  mov ebx,eax
"sao_hr.exe"+1B2761: E8 8A 66 55 00           -  call sao_hr.exe+708DF0
"sao_hr.exe"+1B2766: 3B C3                    -  cmp eax,ebx
}

Should multiply SS Mastery value by 4, Not sure yet if it affects other things.

Oh, neat, this is really useful, is there a way to increase the multiplier? You need like 2000 uses on a one handed sword skill to unlock Celestial Blades (Dual Wield) iirc.

Just add more inc cx

Also for unlocking the celestial blades skills, its a different stat that is also tracked in memory the address for it is 140B15FF4 (sao_hr.exe+B15FF4)

Its a 4-byte value and you should change it to 1999 and execute a 1H SS on a mob, You will also need the prerequisite 1H Sword Mastery in the Skill tree.

Awesome, thanks!

[qweasdzxc17]

Skill Level Multiplier x4

Code: Select all

{ Game   : sao_hr.exe
  Version:
  Date   : 2017-10-28
  Author : qweasdzxc17

  This script does blah blah blah
}

[ENABLE]


aobscanmodule(SkillLevel,sao_hr.exe,66 89 48 02 41 8B EF) // should be unique
alloc(SkillLvlMod,$1000,"sao_hr.exe"+1B25B5)

label(SkillLvlOri)
label(SkillLvlRet)

SkillLvlMod:
  inc cx
  inc cx
  inc cx

SkillLvlOri:
  mov [rax+02],cx
  mov ebp,r15d
  jmp SkillLvlRet

SkillLevel:
  jmp SkillLvlMod
  nop
  nop
SkillLvlRet:
registersymbol(SkillLevel)

[DISABLE]

SkillLevel:
  db 66 89 48 02 41 8B EF

unregistersymbol(SkillLevel)
dealloc(SkillLvlMod)

{
// ORIGINAL CODE - INJECTION POINT: "sao_hr.exe"+1B25B5

"sao_hr.exe"+1B2593: 48 89 6C 24 40           -  mov [rsp+40],rbp
"sao_hr.exe"+1B2598: 4C 89 7C 24 20           -  mov [rsp+20],r15
"sao_hr.exe"+1B259D: 03 D7                    -  add edx,edi
"sao_hr.exe"+1B259F: 45 33 FF                 -  xor r15d,r15d
"sao_hr.exe"+1B25A2: 3B D1                    -  cmp edx,ecx
"sao_hr.exe"+1B25A4: 7F 08                    -  jg sao_hr.exe+1B25AE
"sao_hr.exe"+1B25A6: 8B CA                    -  mov ecx,edx
"sao_hr.exe"+1B25A8: 85 D2                    -  test edx,edx
"sao_hr.exe"+1B25AA: 41 0F 48 CF              -  cmovs ecx,r15d
"sao_hr.exe"+1B25AE: 44 39 3D 7B 03 92 00     -  cmp [sao_hr.exe+AD2930],r15d
// ---------- INJECTING HERE ----------
"sao_hr.exe"+1B25B5: 66 89 48 02              -  mov [rax+02],cx
"sao_hr.exe"+1B25B9: 41 8B EF                 -  mov ebp,r15d
// ---------- DONE INJECTING  ----------
"sao_hr.exe"+1B25BC: 41 8B FF                 -  mov edi,r15d
"sao_hr.exe"+1B25BF: 7E 68                    -  jle sao_hr.exe+1B2629
"sao_hr.exe"+1B25C1: 48 89 74 24 48           -  mov [rsp+48],rsi
"sao_hr.exe"+1B25C6: 4C 89 74 24 50           -  mov [rsp+50],r14
"sao_hr.exe"+1B25CB: 49 8B F7                 -  mov rsi,r15
"sao_hr.exe"+1B25CE: 66 90                    -  nop
"sao_hr.exe"+1B25D0: 48 8B 05 51 03 92 00     -  mov rax,[sao_hr.exe+AD2928]
"sao_hr.exe"+1B25D7: 45 8B F7                 -  mov r14d,r15d
"sao_hr.exe"+1B25DA: 0F BF 1C 06              -  movsx ebx,word ptr [rsi+rax]
"sao_hr.exe"+1B25DE: E8 BD 1D 1B 00           -  call sao_hr.exe+3643A0
}

SS Mastery Multiplier x4

Code: Select all

{ Game   : sao_hr.exe
  Version:
  Date   : 2017-10-28
  Author : qweasdzxc17

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(SSMastery,sao_hr.exe,66 89 48 08 48 8B 0D CA 01 92 00) // should be unique
alloc(SSMasteryMod,$1000,"sao_hr.exe"+1B273B)

label(SSMasteryOri)
label(SSMastertRet)

SSMasteryMod:
  inc cx
  inc cx
  inc cx

SSMasteryOri:
  mov [rax+08],cx
  mov rcx,[sao_hr.exe+AD2910]
  jmp SSMastertRet

SSMastery:
  jmp SSMasteryMod
  nop
  nop
  nop
  nop
  nop
  nop
SSMastertRet:
registersymbol(SSMastery)

[DISABLE]

SSMastery:
  db 66 89 48 08 48 8B 0D CA 01 92 00

unregistersymbol(SSMastery)
dealloc(SSMasteryMod)

{
// ORIGINAL CODE - INJECTION POINT: "sao_hr.exe"+1B273B

"sao_hr.exe"+1B2716: 44 0F B7 40 08           -  movzx r8d,word ptr [rax+08]
"sao_hr.exe"+1B271B: 33 D2                    -  xor edx,edx
"sao_hr.exe"+1B271D: B9 50 C3 00 00           -  mov ecx,0000C350
"sao_hr.exe"+1B2722: 44 03 C6                 -  add r8d,esi
"sao_hr.exe"+1B2725: 45 85 C0                 -  test r8d,r8d
"sao_hr.exe"+1B2728: 41 0F 4F D0              -  cmovg edx,r8d
"sao_hr.exe"+1B272C: 44 8B 05 E5 01 92 00     -  mov r8d,[sao_hr.exe+AD2918]
"sao_hr.exe"+1B2733: 3B D1                    -  cmp edx,ecx
"sao_hr.exe"+1B2735: 66 0F 4C CA              -  cmovl cx,dx
"sao_hr.exe"+1B2739: 8B D7                    -  mov edx,edi
// ---------- INJECTING HERE ----------
"sao_hr.exe"+1B273B: 66 89 48 08              -  mov [rax+08],cx
"sao_hr.exe"+1B273F: 48 8B 0D CA 01 92 00     -  mov rcx,[sao_hr.exe+AD2910]
// ---------- DONE INJECTING  ----------
"sao_hr.exe"+1B2746: E8 E5 FC FF FF           -  call sao_hr.exe+1B2430
"sao_hr.exe"+1B274B: 48 85 C0                 -  test rax,rax
"sao_hr.exe"+1B274E: 74 21                    -  je sao_hr.exe+1B2771
"sao_hr.exe"+1B2750: 80 78 0C 05              -  cmp byte ptr [rax+0C],05
"sao_hr.exe"+1B2754: 75 1B                    -  jne sao_hr.exe+1B2771
"sao_hr.exe"+1B2756: 0F B7 4B 08              -  movzx ecx,word ptr [rbx+08]
"sao_hr.exe"+1B275A: E8 C1 E4 0B 00           -  call sao_hr.exe+270C20
"sao_hr.exe"+1B275F: 8B D8                    -  mov ebx,eax
"sao_hr.exe"+1B2761: E8 8A 66 55 00           -  call sao_hr.exe+708DF0
"sao_hr.exe"+1B2766: 3B C3                    -  cmp eax,ebx
}

Now they should not conflict with each other.

[qweasdzxc17]

While in the solo multiplayer section addresses will temporaily offset to another reigon around 1Cxxxxxxx and higher reigon, when you exit solo multiplayer the values stored there will get dumped back into the 14xxxxxxx range.

Modiftying 14xxxxxxx reigon values will have no effect during the solo multiplayer session. You are able to modify the value in the 1Cxxxxxxx reigon.

[kuruna]

Hi guys, Is it possible to make the stuff above into a table...i suck at doing the stuff xD

Thanks

[kuruna]

Script for No Blacksmith Material Use:

Code: Select all

{ Game   : sao_hr.exe
  Version: 
  Date   : 2017-10-27
  Author : qweasdzxc17

  This script does blah blah blah
}

[ENABLE]
aobscanmodule(Blacksmith,sao_hr.exe,89 73 04 48 8B 7C 24 30 48 8B 5C 24 38 48 83 C4 20 5E C3 CC CC CC CC CC CC CC) // should be unique
registersymbol(Blacksmith)

Blacksmith:
  nop
  nop
  nop

[DISABLE]

Blacksmith:
  db 89 73 04 48 8B 7C 24 30

unregistersymbol(Blacksmith)

{
// ORIGINAL CODE - INJECTION POINT: "sao_hr.exe"+36B3E0

"sao_hr.exe"+36B3C2: 75 24                    -  jne sao_hr.exe+36B3E8
"sao_hr.exe"+36B3C4: 48 89 7C 24 30           -  mov [rsp+30],rdi
"sao_hr.exe"+36B3C9: 0F B6 7B 02              -  movzx edi,byte ptr [rbx+02]
"sao_hr.exe"+36B3CD: 8B CF                    -  mov ecx,edi
"sao_hr.exe"+36B3CF: E8 0C C1 FF FF           -  call sao_hr.exe+3674E0
"sao_hr.exe"+36B3D4: 85 C0                    -  test eax,eax
"sao_hr.exe"+36B3D6: 78 08                    -  js sao_hr.exe+36B3E0
"sao_hr.exe"+36B3D8: 8D 47 FF                 -  lea eax,[rdi-01]
"sao_hr.exe"+36B3DB: 83 F8 3B                 -  cmp eax,3B
"sao_hr.exe"+36B3DE: 76 03                    -  jna sao_hr.exe+36B3E3
// ---------- INJECTING HERE ----------
"sao_hr.exe"+36B3E0: 89 73 04                 -  mov [rbx+04],esi
"sao_hr.exe"+36B3E3: 48 8B 7C 24 30           -  mov rdi,[rsp+30]
// ---------- DONE INJECTING  ----------
"sao_hr.exe"+36B3E8: 48 8B 5C 24 38           -  mov rbx,[rsp+38]
"sao_hr.exe"+36B3ED: 48 83 C4 20              -  add rsp,20
"sao_hr.exe"+36B3F1: 5E                       -  pop rsi
"sao_hr.exe"+36B3F2: C3                       -  ret 
"sao_hr.exe"+36B3F3: CC                       -  int 3 
"sao_hr.exe"+36B3F4: CC                       -  int 3 
"sao_hr.exe"+36B3F5: CC                       -  int 3 
"sao_hr.exe"+36B3F6: CC                       -  int 3 
"sao_hr.exe"+36B3F7: CC                       -  int 3 
"sao_hr.exe"+36B3F8: CC                       -  int 3 
}

Use only on Enhancing and Transforming, any side effects not yet discovered. Best disable when not in use.

sorry to ask a newb question but how to i use this in cheatengine?

[qweasdzxc17]

Script for No Blacksmith Material Use:

Code: Select all

{ Game   : sao_hr.exe
  Version: 
  Date   : 2017-10-27
  Author : qweasdzxc17

  This script does blah blah blah
}

[ENABLE]
aobscanmodule(Blacksmith,sao_hr.exe,89 73 04 48 8B 7C 24 30 48 8B 5C 24 38 48 83 C4 20 5E C3 CC CC CC CC CC CC CC) // should be unique
registersymbol(Blacksmith)

Blacksmith:
  nop
  nop
  nop

[DISABLE]

Blacksmith:
  db 89 73 04 48 8B 7C 24 30

unregistersymbol(Blacksmith)

{
// ORIGINAL CODE - INJECTION POINT: "sao_hr.exe"+36B3E0

"sao_hr.exe"+36B3C2: 75 24                    -  jne sao_hr.exe+36B3E8
"sao_hr.exe"+36B3C4: 48 89 7C 24 30           -  mov [rsp+30],rdi
"sao_hr.exe"+36B3C9: 0F B6 7B 02              -  movzx edi,byte ptr [rbx+02]
"sao_hr.exe"+36B3CD: 8B CF                    -  mov ecx,edi
"sao_hr.exe"+36B3CF: E8 0C C1 FF FF           -  call sao_hr.exe+3674E0
"sao_hr.exe"+36B3D4: 85 C0                    -  test eax,eax
"sao_hr.exe"+36B3D6: 78 08                    -  js sao_hr.exe+36B3E0
"sao_hr.exe"+36B3D8: 8D 47 FF                 -  lea eax,[rdi-01]
"sao_hr.exe"+36B3DB: 83 F8 3B                 -  cmp eax,3B
"sao_hr.exe"+36B3DE: 76 03                    -  jna sao_hr.exe+36B3E3
// ---------- INJECTING HERE ----------
"sao_hr.exe"+36B3E0: 89 73 04                 -  mov [rbx+04],esi
"sao_hr.exe"+36B3E3: 48 8B 7C 24 30           -  mov rdi,[rsp+30]
// ---------- DONE INJECTING  ----------
"sao_hr.exe"+36B3E8: 48 8B 5C 24 38           -  mov rbx,[rsp+38]
"sao_hr.exe"+36B3ED: 48 83 C4 20              -  add rsp,20
"sao_hr.exe"+36B3F1: 5E                       -  pop rsi
"sao_hr.exe"+36B3F2: C3                       -  ret 
"sao_hr.exe"+36B3F3: CC                       -  int 3 
"sao_hr.exe"+36B3F4: CC                       -  int 3 
"sao_hr.exe"+36B3F5: CC                       -  int 3 
"sao_hr.exe"+36B3F6: CC                       -  int 3 
"sao_hr.exe"+36B3F7: CC                       -  int 3 
"sao_hr.exe"+36B3F8: CC                       -  int 3 
}

Use only on Enhancing and Transforming, any side effects not yet discovered. Best disable when not in use.

sorry to ask a newb question but how to i use this in cheatengine?

Memory View -> Tools -> Auto-Assemble -> Copy & Paste -> File -> Assign to current cheat table