Mortal Kombat 11 - table v: 1.0.8 CT

Upload your cheat tables here (No requests)
TimFun13
Expert Cheater
Expert Cheater
Posts: 1353
Joined: Fri Mar 03, 2017 12:31 am
Reputation: 7

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by TimFun13 »

Anyone else having server connection errors in the krypt, I keep getting kicked out. It started last night, wonder if the server got an update.

How to use this cheat table?
  1. Install Cheat Engine
  2. Double-click the .CT file in order to open it.
  3. Click the PC icon in Cheat Engine in order to select the game process.
  4. Keep the list.
  5. Activate the trainer options by checking boxes or setting values from 0 to 1

User avatar
SunBeam
Administration
Administration
Posts: 4932
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4630

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by SunBeam »

ShyTwig16 wrote:
Sun Apr 28, 2019 11:05 pm
Anyone else having server connection errors in the krypt, I keep getting kicked out. It started last night, wonder if the server got an update.
You get kicked out if you try to open up "Locked" content without the item. Like Orbs for example. Server checks if expected item was used before it gives you the reward (opening doors with Orbs give you Ermac Souls and Koins). And since you OR'd that 0x2 with 0x8, you find it normal to press E. That's when you get kicked out :D

User avatar
SunBeam
Administration
Administration
Posts: 4932
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4630

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by SunBeam »

Oh LOL. The base for that 0xE14 bool is a pointer to a table of "MK11KryptStaticActor" UObject pointers :D Wonder if I can iterate through it and if it contains all spawned Actors in the Krypt.

EDIT: Ka-ching!

Code: Select all

MK11.exe+7FB725 - 48 8B 15 54A48702     - mov rdx,[MK11.exe+3075B80] { (A640FE00) }
MK11.exe+7FB72C - 48 89 55 8F           - mov [rbp-71],rdx
[[MK11.exe+3075B80]+E14] == 1 ;) Global 0 Koins cost for any chest :D

TimFun13
Expert Cheater
Expert Cheater
Posts: 1353
Joined: Fri Mar 03, 2017 12:31 am
Reputation: 7

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by TimFun13 »

SunBeam wrote:
Sun Apr 28, 2019 11:07 pm
...
You get kicked out if you try to open up "Locked" content without the item. Like Orbs for example. Server checks if expected item was used before it gives you the reward (opening doors with Orbs give you Ermac Souls and Koins). And since you OR'd that 0x2 with 0x8, you find it normal to press E. That's when you get kicked out :D
Do I need to make that byte 2 then?

User avatar
SunBeam
Administration
Administration
Posts: 4932
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4630

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by SunBeam »

^ No. You need the item with which you open the doors. Remember this: if the action (unlock) is supposed to give you server-sided amounts, you will get kicked. For any other scenario, like in Kytinn Hive where you can use items without owning them, there won't be any disconnect since the action just unlocks something without giving you stuff in return (like a door).

TimFun13
Expert Cheater
Expert Cheater
Posts: 1353
Joined: Fri Mar 03, 2017 12:31 am
Reputation: 7

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by TimFun13 »

^ It's on a door in Goro's throne room, just to the left of the throne.


And here's what I'm using to hook the coord's, not a great spot I need to find a better one. But it works good for a speed multiplier.

Code: Select all

{
	Process			: MK11.exe  -  (x64)
	Module			: MK11.exe
	Game Title		: Mortal Kombat 11
	Game Version	: 1.0.0.0
	CE Version		: 6.83
	Script Version	: 0.0.1
	Date			: 04/28/19
	Author			: ShyTwig16
	Name			: CoordHook

	Coord Hook
}

{$STRICT}

define(address, MK11.exe+1590F1E5)
define(bytes, 44 0F 58 0F 0F 28 C5)

////
//// ------------------------------ ENABLE ------------------------------
[ENABLE]
// aobScanModule(aobCoordHook, MK11.exe, 44xxxxxxxx0F59xx44xxxxxx0F28xx0F15xx0FC6xxxx0F28)
i2aobScanModule(aobCoordHook, MK11.exe, 44xxxxxxxx0F59xx44xxxxxx0F28xx0F15xx0FC6xxxx0F28)
define(injCoordHook, aobCoordHook+8)
// assert(injCoordHook, bytes)
i2assert(injCoordHook, bytes)
registerSymbol(injCoordHook)

alloc(memCoordHook, 0x400, injCoordHook)

label(fltCoordHook)
registerSymbol(fltCoordHook)
label(flgCoordHook)
registerSymbol(flgCoordHook)

label(ptrCoordHook)
registerSymbol(ptrCoordHook)

label(n_code)
label(o_code)
label(exit)
label(return)

memCoordHook:
	fltCoordHook:
		dd (float)1.5
	align 10
		dd (float)1.5
		dd (float)1.5
		dd (float)1.5
		dd (float)1
	align 10
	flgCoordHook:
		db 00
	align 10
	ptrCoordHook:
		dq 0
	align 10 CC
	n_code:
		pushfq
		mov [ptrCoordHook],rdi
		cmp byte ptr [flgCoordHook],0
		je o_code
		cmp byte ptr [flgCoordHook],1
		jne @f
			movss xmm0,[fltCoordHook]
			movss [fltCoordHook+10],xmm0
			movss [fltCoordHook+14],xmm0
			movss [fltCoordHook+18],xmm0
			mulps xmm9,[fltCoordHook+10]
			jmp o_code
		@@:
		mov byte ptr [flgCoordHook],0
	o_code:
		addps xmm9,[rdi]
		movaps xmm0,xmm5
	exit:
		popfq
		jmp return

		
{$lua}
I2CETeleporter.WriteToCoordsTimerTicksMax = 20
I2CETeleporter.CoordPointerSymbol = 'ptrCoordHook'
I2CETeleporter.Xoffset = 0x0
I2CETeleporter.Yoffset = 0x8
I2CETeleporter.Zoffset = 0x4
-- I2CETeleporter.WaypointPointerSymbol = ''
-- I2CETeleporter.WayXoffset = 0x
-- I2CETeleporter.WayYoffset = 0x
-- I2CETeleporter.WayZoffset = 0x
-- I2CETeleporter.WayYaddOnRead = 0
{$asm}


////
//// ---------- Injection Point ----------
injCoordHook:
	jmp n_code
	nop
	nop
	return:


////
//// ------------------------------ DISABLE ------------------------------
[DISABLE]
////
//// ---------- Injection Point ----------
injCoordHook:
	db bytes

unregisterSymbol(injCoordHook)

unregisterSymbol(fltCoordHook)
unregisterSymbol(flgCoordHook)

unregisterSymbol(ptrCoordHook)

dealloc(memCoordHook)

{
//// Injection Point: MK11.exe+1590F1E5  -  000000015590F1E5
//// AOB address: 000000015590F1DD  -  MK11.exe+1590F1DD
//// Process: MK11.exe  -  0000000140000000
//// Module: MK11.exe  -  0000000140000000
//// Module Size: 0000000018215000
MK11.exe+1590F18B:  0F28 4D 80                  -  movaps xmm1,[rbp-80]               
MK11.exe+1590F18F:  48 89 D9                    -  mov rcx,rbx                        
MK11.exe+1590F192:  4C 8B 85 20050000           -  mov r8,[rbp+00000520]              
MK11.exe+1590F199:  48 89 FA                    -  mov rdx,rdi                        
MK11.exe+1590F19C:  0F11 4F 70                  -  movups [rdi+70],xmm1               
MK11.exe+1590F1A0:  66 89 47 36                 -  mov [rdi+36],ax                    
MK11.exe+1590F1A4:  0F10 57 10                  -  movups xmm2,[rdi+10]               
MK11.exe+1590F1A8:  0F28 3D A14262ED            -  movaps xmm7,[142F33450]            [(float)1.0000]
MK11.exe+1590F1AF:  0F28 DA                     -  movaps xmm3,xmm2                   
MK11.exe+1590F1B2:  0F28 6D 80                  -  movaps xmm5,[rbp-80]               
MK11.exe+1590F1B6:  0F28 CA                     -  movaps xmm1,xmm2                   
MK11.exe+1590F1B9:  48 8B 45 A0                 -  mov rax,[rbp-60]                   
MK11.exe+1590F1BD:  44 0F28 4C 24 70            -  movaps xmm9,[rsp+70]               
MK11.exe+1590F1C3:  0FC6 DA FF                  -  shufps xmm3,xmm2,-01               
MK11.exe+1590F1C7:  48 C1 E1 05                 -  shl rcx,05                         
MK11.exe+1590F1CB:  0F10 40 20                  -  movups xmm0,[rax+20]               
MK11.exe+1590F1CF:  0F59 05 6A4362ED            -  mulps xmm0,[142F33540]             [(float)0.5000]
MK11.exe+1590F1D6:  48 03 8D 18050000           -  add rcx,[rbp+00000518]             
MK11.exe+1590F1DD:  44 0F59 48 20               -  mulps xmm9,[rax+20]                <<<--- AOB Starts Here
MK11.exe+1590F1E2:  0F59 E8                     -  mulps xmm5,xmm0                    
////  INJECTING START  ----------------------------------------------------------
MK11.exe+1590F1E5:  44 0F58 0F                  -  addps xmm9,[rdi]                   
MK11.exe+1590F1E9:  0F28 C5                     -  movaps xmm0,xmm5                   
////  INJECTING END  ----------------------------------------------------------
MK11.exe+1590F1EC:  0F15 C7                     -  unpckhps xmm0,xmm7                 
MK11.exe+1590F1EF:  0FC6 E8 C4                  -  shufps xmm5,xmm0,-3C               
MK11.exe+1590F1F3:  0F28 C2                     -  movaps xmm0,xmm2                   
MK11.exe+1590F1F6:  0FC6 C2 C9                  -  shufps xmm0,xmm2,-37               
MK11.exe+1590F1FA:  0F28 F5                     -  movaps xmm6,xmm5                   
MK11.exe+1590F1FD:  0F59 C5                     -  mulps xmm0,xmm5                    
MK11.exe+1590F200:  0F28 E5                     -  movaps xmm4,xmm5                   
MK11.exe+1590F203:  0FC6 F5 C9                  -  shufps xmm6,xmm5,-37               
MK11.exe+1590F207:  0F59 F2                     -  mulps xmm6,xmm2                    
MK11.exe+1590F20A:  0F59 D5                     -  mulps xmm2,xmm5                    
MK11.exe+1590F20D:  0FC6 E5 FF                  -  shufps xmm4,xmm5,-01               
MK11.exe+1590F211:  0F5C F0                     -  subps xmm6,xmm0                    
MK11.exe+1590F214:  0F59 CC                     -  mulps xmm1,xmm4                    
MK11.exe+1590F217:  0F28 C5                     -  movaps xmm0,xmm5                   
MK11.exe+1590F21A:  0F59 E3                     -  mulps xmm4,xmm3                    
MK11.exe+1590F21D:  0F59 C3                     -  mulps xmm0,xmm3                    
MK11.exe+1590F220:  0FC6 F6 C9                  -  shufps xmm6,xmm6,-37               
MK11.exe+1590F224:  44 0F29 4D C0               -  movaps [rbp-40],xmm9               
MK11.exe+1590F229:  0F58 F0                     -  addps xmm6,xmm0                    
//// Template: I2CEA_AOBFullInjection
//// Generated with: I2 Cheat Engine Auto Assembler Script Template Generator
//// Code Happy, Code Freely, Be Awesome.
}

EDIT: you'll have to set the flag flgCoordHook to enable it.

Mongman
What is cheating?
What is cheating?
Posts: 4
Joined: Sun Apr 28, 2019 11:18 pm
Reputation: 0

Re: Mortal Kombat 11

Post by Mongman »

ShyTwig16 wrote:
Sun Apr 28, 2019 9:01 pm
SunBeam wrote:
Sun Apr 28, 2019 7:42 pm
Still haven't figured out where's the stored Koins amount for Kronika Chests. That glass ball spawning randomly on map at given intervals. Also.. where the fuck are the object coordinates? It'd be nice to map them all and do insta-tele to them (I'll just use this for now and map each room out; thanks Zandrial). Will try to adapt mgr.inz.Player's noclip I adjusted for Metro Exodus to also work in MK11. Need the NV first hand (that's where the dumper should come in handy, telling me where the default Camera is and figuring out the offset for the Rotator).
If you mean the Ord things, I posted that the other day. And added to the table today.

Code: Select all

{
	Process			: MK11.exe  -  (x64)
	Module			: MK11.exe
	Game Title		: Mortal Kombat 11
	Game Version	: 1.0.0.0
	CE Version		: 6.83
	Script Version	: 0.0.1
	Date			: 04/26/19
	Author			: ShyTwig16
	Name			: KryptOrbCostReadHook

	Krypt Orb Cost Read Hook
}

{$STRICT}

define(address, MK11.exe+C32C3E0)
define(bytes, 8B 41 10 41 89 00)

////
//// ------------------------------ ENABLE ------------------------------
[ENABLE]
aobScanModule(aobKryptOrbCostReadHook, MK11.exe, 8Bxxxx89xx8Bxxxx41xxxx8BxxxxC1)
define(injKryptOrbCostReadHook, aobKryptOrbCostReadHook+5)
assert(injKryptOrbCostReadHook, bytes)
registerSymbol(injKryptOrbCostReadHook)

alloc(memKryptOrbCostReadHook, 0x400, injKryptOrbCostReadHook)

label(ptrKryptOrbCostReadHook)
registerSymbol(ptrKryptOrbCostReadHook)

label(n_code)
label(o_code)
label(exit)
label(return)

memKryptOrbCostReadHook:
	ptrKryptOrbCostReadHook:
		dq 0
	align 10 CC
	n_code:
		mov [ptrKryptOrbCostReadHook],rcx
		mov eax,1
		mov [rcx+10],eax
	o_code:
		// mov eax,[rcx+10]
		mov [r8],eax
	exit:
		jmp return


////
//// ---------- Injection Point ----------
injKryptOrbCostReadHook:
	jmp n_code
	nop
	return:


////
//// ------------------------------ DISABLE ------------------------------
[DISABLE]
////
//// ---------- Injection Point ----------
injKryptOrbCostReadHook:
	db bytes

unregisterSymbol(injKryptOrbCostReadHook)

unregisterSymbol(ptrKryptOrbCostReadHook)

dealloc(memKryptOrbCostReadHook)

{
//// Injection Point: MK11.exe+C32C3E0  -  000000014C32C3E0
//// AOB address: 000000014C32C3DB  -  MK11.exe+C32C3DB
//// Process: MK11.exe  -  0000000140000000
//// Module: MK11.exe  -  0000000140000000
//// Module Size: 0000000018215000
MK11.exe+C32C399:  4C 8D 2D CD526D06           -  lea r13,[152A0166D]                [DBBB8B4D]
MK11.exe+C32C3A0:  4C 87 2C 24                 -  xchg [rsp],r13                     
MK11.exe+C32C3A4:  C3                          -  ret                                
MK11.exe+C32C3A5:  8D 66 2E                    -  lea esp,[rsi+2E]                   
MK11.exe+C32C3A8:  0F1F 84 00 00000000         -  nop [rax+rax+00000000]             
MK11.exe+C32C3B0:  48 89 5C 24 08              -  mov [rsp+08],rbx                   
MK11.exe+C32C3B5:  48 89 74 24 10              -  mov [rsp+10],rsi                   
MK11.exe+C32C3BA:  57                          -  push rdi                           
MK11.exe+C32C3BB:  48 83 EC 20                 -  sub rsp,20                         
MK11.exe+C32C3BF:  31 C0                       -  xor eax,eax                        
MK11.exe+C32C3C1:  48 89 CE                    -  mov rsi,rcx                        
MK11.exe+C32C3C4:  89 02                       -  mov [rdx],eax                      
MK11.exe+C32C3C6:  4C 89 C3                    -  mov rbx,r8                         
MK11.exe+C32C3C9:  41 89 00                    -  mov [r8],eax                       
MK11.exe+C32C3CC:  48 89 D7                    -  mov rdi,rdx                        
MK11.exe+C32C3CF:  48 8B 89 C8010000           -  mov rcx,[rcx+000001C8]             
MK11.exe+C32C3D6:  48 85 C9                    -  test rcx,rcx                       
MK11.exe+C32C3D9:  74 25                       -  je 14C32C400                       
MK11.exe+C32C3DB:  8B 41 0C                    -  mov eax,[rcx+0C]                   <<<--- AOB Starts Here
MK11.exe+C32C3DE:  89 02                       -  mov [rdx],eax                      
////  INJECTING START  ----------------------------------------------------------
MK11.exe+C32C3E0:  8B 41 10                    -  mov eax,[rcx+10]                   
MK11.exe+C32C3E3:  41 89 00                    -  mov [r8],eax                       
////  INJECTING END  ----------------------------------------------------------
MK11.exe+C32C3E6:  8B 41 08                    -  mov eax,[rcx+08]                   
MK11.exe+C32C3E9:  C1 E8 0F                    -  shr eax,0F                         
MK11.exe+C32C3EC:  F6 D0                       -  not al                             
MK11.exe+C32C3EE:  24 01                       -  and al,01                          
MK11.exe+C32C3F0:  48 8B 5C 24 30              -  mov rbx,[rsp+30]                   
MK11.exe+C32C3F5:  48 8B 74 24 38              -  mov rsi,[rsp+38]                   
MK11.exe+C32C3FA:  48 83 C4 20                 -  add rsp,20                         
MK11.exe+C32C3FE:  5F                          -  pop rdi                            
MK11.exe+C32C3FF:  C3                          -  ret                                
MK11.exe+C32C400:  48 89 F1                    -  mov rcx,rsi                        
MK11.exe+C32C403:  E8 A8504CF4                 -  call 1407F14B0                     
MK11.exe+C32C408:  41 89 C0                    -  mov r8d,eax                        
MK11.exe+C32C40B:  FF C8                       -  dec eax                            
MK11.exe+C32C40D:  83 F8 16                    -  cmp eax,16                         
MK11.exe+C32C410:  77 1E                       -  ja 14C32C430                       
MK11.exe+C32C412:  48 63 C8                    -  movsxd  rcx,eax                    
MK11.exe+C32C415:  48 8D 05 E43BCDF3           -  lea rax,[140000000]                [00905A4D]
MK11.exe+C32C41C:  0FB6 8C 08 6C227F00         -  movzx ecx,byte ptr [rax+rcx+007F226C]
MK11.exe+C32C424:  8B 94 88 64227F00           -  mov edx,[rax+rcx*4+007F2264]       
//// Template: I2CEA_AOBFullInjection
//// Generated with: I2 Cheat Engine Auto Assembler Script Template Generator
//// Code Happy, Code Freely, Be Awesome.
}

Would it be possible to make it change the value of the orb to a negative number instead of 1? To return koins instead of taking?

TimFun13
Expert Cheater
Expert Cheater
Posts: 1353
Joined: Fri Mar 03, 2017 12:31 am
Reputation: 7

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by TimFun13 »

^ mov eax,(int)-100

User avatar
SunBeam
Administration
Administration
Posts: 4932
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4630

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by SunBeam »

People want to hack chests that way to GET Koins so they can use them for those Forges or whatever the fuck they're called. The ones that give you stuff for Koin amounts. Nothing else T_T.. Then it's still them bitching they want to set amounts to original T_T.. Go figure.

TimFun13
Expert Cheater
Expert Cheater
Posts: 1353
Joined: Fri Mar 03, 2017 12:31 am
Reputation: 7

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by TimFun13 »

SunBeam wrote:
Sun Apr 28, 2019 11:16 pm
^ No. You need the item with which you open the doors. Remember this: if the action (unlock) is supposed to give you server-sided amounts, you will get kicked. For any other scenario, like in Kytinn Hive where you can use items without owning them, there won't be any disconnect since the action just unlocks something without giving you stuff in return (like a door).
I think you're right, seems I ran out of the skeleton keys.

SunBeam wrote:
Sun Apr 28, 2019 11:24 pm
People want to hack chests that way to GET Koins so they can use them for those Forges or whatever the fuck they're called. The ones that give you stuff for Koin amounts. Nothing else T_T.. Then it's still them bitching they want to set amounts to original T_T.. Go figure.
Yeah, I'm pretty much just not responding the reset requests and the requests for koin amount fixes.

Holdo
Noobzor
Noobzor
Posts: 9
Joined: Sun Apr 28, 2019 11:15 pm
Reputation: 2

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by Holdo »

Hi guys. First of all thanks for sharing. I've got 437 chests opened (tried to get all invisible chests and the only place I'm missing is the Throne Room). Even with the head chests and Throne Room let's say it's 500 chests, the rest could be just Kronika Vaults, Forge, Kollector and Shrine (100k coin donations like wtf).

KS212
Expert Cheater
Expert Cheater
Posts: 1139
Joined: Fri Mar 03, 2017 5:29 pm
Reputation: 143

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by KS212 »

SunBeam wrote:
Sun Apr 28, 2019 10:48 pm
As for using the Blindfold.. the fuckers added some wraith or spirit or whatever the fuck. If you stay too much with it on, that fucker finds you and kills you. Meh T_T.. Will see if I can force those invisible chests to pop-out without the need to use the Blindfold :)
Kill that fucker with the hammer for a guaranteed costume and 100 hearts (no joke).

User avatar
SunBeam
Administration
Administration
Posts: 4932
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4630

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by SunBeam »

^ Didn't know you can hit him :D I'll try now :P

KS212
Expert Cheater
Expert Cheater
Posts: 1139
Joined: Fri Mar 03, 2017 5:29 pm
Reputation: 143

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by KS212 »

SunBeam wrote:
Sun Apr 28, 2019 11:30 pm
^ Didn't know you can hit him :D I'll try now :P
And while you're at it, if you triggered Reptile (hidden invisible wall off to the side near the Carcass of the Kytinn Queen), you can find him in the world somewhere and smack him too for a guaranteed reward.

TimFun13
Expert Cheater
Expert Cheater
Posts: 1353
Joined: Fri Mar 03, 2017 12:31 am
Reputation: 7

Re: Mortal Kombat 11 - table v: 1.0.3 CT

Post by TimFun13 »

SunBeam wrote:
Sun Apr 28, 2019 11:12 pm
Oh LOL. The base for that 0xE14 bool is a pointer to a table of "MK11KryptStaticActor" UObject pointers :D Wonder if I can iterate through it and if it contains all spawned Actors in the Krypt.

EDIT: Ka-ching!

Code: Select all

MK11.exe+7FB725 - 48 8B 15 54A48702     - mov rdx,[MK11.exe+3075B80] { (A640FE00) }
MK11.exe+7FB72C - 48 89 55 8F           - mov [rbp-71],rdx
[[MK11.exe+3075B80]+E14] == 1 ;) Global 0 Koins cost for any chest :D
Yeah, this is work for koins and hearts but not souls.

Code: Select all

{
	Process			: MK11.exe  -  (x64)
	Module			: MK11.exe
	Game Title		: Mortal Kombat 11
	Game Version	: 1.0.0.0
	CE Version		: 6.83
	Script Version	: 0.0.1
	Date			: 04/28/19
	Author			: SunBeam
					: ShyTwig16
	Name			: KryptUnlockerHook

	Krypt Unlocker Hook
}

{$STRICT}

define(address, MK11.exe+7FB854)
define(bytes, 80 B8 14 0E 00 00 00)

////
//// ------------------------------ ENABLE ------------------------------
[ENABLE]
aobScanModule(aobKryptUnlockerHook, MK11.exe, 44xxxx48xxxxxx80xxxxxxxxxxxx74xx41xxxxxx75)
define(injKryptUnlockerHook, aobKryptUnlockerHook+7)
assert(injKryptUnlockerHook, bytes)
registerSymbol(injKryptUnlockerHook)

alloc(memKryptUnlockerHook, 0x400, injKryptUnlockerHook)

label(ptrKryptUnlockerHook)
registerSymbol(ptrKryptUnlockerHook)

label(n_code)
label(o_code)
label(exit)
label(return)

memKryptUnlockerHook:
	ptrKryptUnlockerHook:
		dq 0
	align 10 CC
	n_code:
		mov [ptrKryptUnlockerHook],rax
		mov byte ptr [rax+E14],01
	o_code:
		cmp byte ptr [rax+00000E14],00
	exit:
		jmp return


////
//// ---------- Injection Point ----------
injKryptUnlockerHook:
	jmp n_code
	nop
	nop
	return:


////
//// ------------------------------ DISABLE ------------------------------
[DISABLE]
////
//// ---------- Injection Point ----------
injKryptUnlockerHook:
	db bytes

unregisterSymbol(injKryptUnlockerHook)

unregisterSymbol(ptrKryptUnlockerHook)

dealloc(memKryptUnlockerHook)

{
//// Injection Point: MK11.exe+7FB854  -  00000001407FB854
//// AOB address: 00000001407FB84D  -  MK11.exe+7FB84D
//// Process: MK11.exe  -  0000000140000000
//// Module: MK11.exe  -  0000000140000000
//// Module Size: 0000000018215000
MK11.exe+7FB815:  74 51                       -  je 1407FB868                       
MK11.exe+7FB817:  48 8B 48 60                 -  mov rcx,[rax+60]                   
MK11.exe+7FB81B:  48 85 C9                    -  test rcx,rcx                       
MK11.exe+7FB81E:  74 0E                       -  je 1407FB82E                       
MK11.exe+7FB820:  48 3B CA                    -  cmp rcx,rdx                        
MK11.exe+7FB823:  74 43                       -  je 1407FB868                       
MK11.exe+7FB825:  48 8B 49 70                 -  mov rcx,[rcx+70]                   
MK11.exe+7FB829:  48 85 C9                    -  test rcx,rcx                       
MK11.exe+7FB82C:  75 F2                       -  jne 1407FB820                      
MK11.exe+7FB82E:  32 C0                       -  xor al,al                          
MK11.exe+7FB830:  41 0FB6 4F 20               -  movzx ecx,byte ptr [r15+20]        
MK11.exe+7FB835:  88 4C 24 20                 -  mov [rsp+20],cl                    
MK11.exe+7FB839:  45 33 ED                    -  xor r13d,r13d                      
MK11.exe+7FB83C:  0FB6 C0                     -  movzx eax,al                       
MK11.exe+7FB83F:  84 C9                       -  test cl,cl                         
MK11.exe+7FB841:  44 0F44 E8                  -  cmove r13d,eax                     
MK11.exe+7FB845:  48 8B CE                    -  mov rcx,rsi                        
MK11.exe+7FB848:  E8 635CFFFF                 -  call 1407F14B0                     
MK11.exe+7FB84D:  44 8B F8                    -  mov r15d,eax                       <<<--- AOB Starts Here
MK11.exe+7FB850:  48 8B 45 8F                 -  mov rax,[rbp-71]                   
////  INJECTING START  ----------------------------------------------------------
MK11.exe+7FB854:  80 B8 140E0000 00           -  cmp byte ptr [rax+00000E14],00     
////  INJECTING END  ----------------------------------------------------------
MK11.exe+7FB85B:  74 2E                       -  je 1407FB88B                       
MK11.exe+7FB85D:  41 83 FF 0A                 -  cmp r15d,0A                        
MK11.exe+7FB861:  75 28                       -  jne 1407FB88B                      
MK11.exe+7FB863:  45 33 E4                    -  xor r12d,r12d                      
MK11.exe+7FB866:  EB 56                       -  jmp 1407FB8BE                      
MK11.exe+7FB868:  49 8B CD                    -  mov rcx,r13                        
MK11.exe+7FB86B:  E8 B0C5FEFF                 -  call 1407E7E20                     
MK11.exe+7FB870:  4C 8D 44 24 28              -  lea r8,[rsp+28]                    
MK11.exe+7FB875:  48 8D 55 87                 -  lea rdx,[rbp-79]                   
MK11.exe+7FB879:  49 8B CD                    -  mov rcx,r13                        
MK11.exe+7FB87C:  E8 BF68FFFF                 -  call 1407F2140                     
MK11.exe+7FB881:  8B 5D 87                    -  mov ebx,[rbp-79]                   
MK11.exe+7FB884:  44 8B 64 24 28              -  mov r12d,[rsp+28]                  
MK11.exe+7FB889:  EB A5                       -  jmp 1407FB830                      
MK11.exe+7FB88B:  F3 0F10 90 040E0000         -  movss xmm2,[rax+00000E04]          
MK11.exe+7FB893:  0F57 C0                     -  xorps xmm0,xmm0                    
MK11.exe+7FB896:  0F2F D0                     -  comiss xmm2,xmm0                   
MK11.exe+7FB899:  76 23                       -  jna 1407FB8BE                      
MK11.exe+7FB89B:  41 83 FF 0A                 -  cmp r15d,0A                        
MK11.exe+7FB89F:  75 1D                       -  jne 1407FB8BE                      
//// Template: I2CEA_AOBFullInjection
//// Generated with: I2 Cheat Engine Auto Assembler Script Template Generator
//// Code Happy, Code Freely, Be Awesome.
}


Post Reply

Who is online

Users browsing this forum: 86sewer, admantx, BiohazardD, Divinehero, Google Adsense [Bot], hugimpu, KASTROKING10, Serenities, SnakeJhon, soloneko777, wenwen500