Pretty good. It also applies to enemies, though. I noticed that, near the XP, there's a pointer to the struct for the character it belongs to, that has flags for which team its on. This code is an expansion on yours that makes it only apply to the player characters, while making enemy characters get 0 XP. Guest/allied characters get normal XP.
Code: Select all
[ENABLE]
aobscanmodule(INJECT,GameAssembly.dll,89 41 58 5D C2 04 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(playerteam)
label(foeteam)
label(xpmul)
registersymbol(xpmul)
newmem:
push ebx
push edx
mov ebx,[ecx+64]
mov edx,[ebx+4C]
cmp edx,1
je playerteam
mov edx,[ebx+58]
cmp edx,1
je foeteam
code:
pop edx
pop ebx
mov [ecx+58],eax
pop ebp
ret 0004
jmp return
playerteam:
sub eax,[ecx+58]
imul eax,[xpmul]
add eax,[ecx+58]
jmp code
foeteam:
xor eax,eax
jmp code
xpmul:
dd 2
INJECT:
jmp newmem
nop 2
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 89 41 58 5D C2 04 00
unregistersymbol(INJECT)
unregistersymbol(xpmul)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "GameAssembly.dll"+173706
"GameAssembly.dll"+1736F3: 8B 45 08 - mov eax,[ebp+08]
"GameAssembly.dll"+1736F6: 89 41 54 - mov [ecx+54],eax
"GameAssembly.dll"+1736F9: 5D - pop ebp
"GameAssembly.dll"+1736FA: C2 04 00 - ret 0004
"GameAssembly.dll"+1736FD: CC - int 3
"GameAssembly.dll"+1736FE: CC - int 3
"GameAssembly.dll"+1736FF: CC - int 3
"GameAssembly.dll"+173700: 55 - push ebp
"GameAssembly.dll"+173701: 8B EC - mov ebp,esp
"GameAssembly.dll"+173703: 8B 45 08 - mov eax,[ebp+08]
// ---------- INJECTING HERE ----------
"GameAssembly.dll"+173706: 89 41 58 - mov [ecx+58],eax
"GameAssembly.dll"+173709: 5D - pop ebp
"GameAssembly.dll"+17370A: C2 04 00 - ret 0004
// ---------- DONE INJECTING ----------
"GameAssembly.dll"+17370D: CC - int 3
"GameAssembly.dll"+17370E: CC - int 3
"GameAssembly.dll"+17370F: CC - int 3
"GameAssembly.dll"+173710: 55 - push ebp
"GameAssembly.dll"+173711: 8B EC - mov ebp,esp
"GameAssembly.dll"+173713: 8A 45 08 - mov al,[ebp+08]
"GameAssembly.dll"+173716: 88 41 5F - mov [ecx+5F],al
"GameAssembly.dll"+173719: 5D - pop ebp
"GameAssembly.dll"+17371A: C2 04 00 - ret 0004
"GameAssembly.dll"+17371D: CC - int 3
}
Trying to fix the AP multiplier from the OP. Managed to fix the infinite AP thing (there was a static address that needed updating) but the AP multiplier is proving trickier (its static address is no longer even a thing). The AP update code is also the update code for hundreds of other values, so there needs to be some way to ensure the cheat code only affects AP, which is what is getting confusing.