2
"请多存档，作者对任何使用此作弊表而产生的问题与风险不承担任何责任"
Auto Assembler Script
[ENABLE]
aobscanmodule(FirstInject,Rance10.exe,89 3C 98 E9 14 01 00 00)
aobscanmodule(SecondInject,Rance10.exe,8B 04 B0 89 45 FC 5F 5E 5D C3)
registersymbol(FirstInject)
registersymbol(SecondInject)
alloc(newmem,2048)
//======functions======
label(FunctionGetPointer)
label(ReturnZero)
label(ReturnValue)
label(IsInvalidPointer)
label(FunctionRevivify)
//======functions======
//======Variables======
label(AddrTagMaxAP)
registersymbol(AddrTagMaxAP)
//======Variables======
label(BeginKDCheck)
label(returnhereKD)
label(originalcodeKD)
label(LblHP)
label(LblDrop)
label(LblExpTotal)
label(LblExpBase)
label(LblOneKillAndAP)
label(LblAP)
label(LblCleanAndNext)
label(SwitchDrop)
label(SwitchExp)
label(SwitchAP)
label(SwitchOneKill)
label(SwitchHP)
registersymbol(SwitchDrop)
registersymbol(SwitchExp)
registersymbol(SwitchAP)
registersymbol(SwitchOneKill)
registersymbol(SwitchHP)
//////////////////////////////
label(BeginFBPCheck)
label(returnhereFBP)
label(originalcodeFBP)
label(LblCheckESI)
label(LblLockPoint)
label(LblLockFBF)
label(SwitchPoint)
label(SwitchFood)
label(SwitchBadge)
label(SwitchFriendship)
registersymbol(SwitchPoint)
registersymbol(SwitchFood)
registersymbol(SwitchBadge)
registersymbol(SwitchFriendship)
newmem:
////////////////////////Custom Functions/////////////////////
/* Function: Gets the pointer based on the given offsets.
* Push: 3 pass offset / 4 pass offset
* return: Eax=Pointer*/
FunctionGetPointer:
mov eax,["Rance10.exe"+003FCBB4]
push edi
push edx
push ecx
////////////
lea edi,[eax+8]
push 4
push edi
call IsBadReadPtr
cmp eax,0
jne ReturnZero
mov eax,[edi]
////////////
mov edi,[esp+10]
lea edi,[eax+edi*4]
push 4
push edi
call IsBadReadPtr
cmp eax,0
jne ReturnZero
mov eax,[edi]
////////////
mov edi,[esp+14]
lea edi,[eax+edi*4]
push 4
push edi
call IsBadReadPtr
cmp eax,0
jne ReturnZero
mov eax,[edi]
////////////
lea edi,[eax+10]
push 4
push edi
call IsBadReadPtr
cmp eax,0
jne ReturnZero
mov eax,[edi]
jmp ReturnValue
ReturnZero:
mov eax,0
ReturnValue:
pop ecx
pop edx
pop edi
mov [esp+4],edi
pop edi
mov [esp+4],edi
pop edi
ret
/* Function: Determines if the given pointer is invalid.
* Eax: Pointer
* return: Eax=0=OK, otherwise, invalid. */
IsInvalidPointer:
push edx
push ecx
push 4
push eax
call IsBadReadPtr
pop ecx
pop edx
ret
/* Function: revivify the stack and registers.*/
FunctionRevivify:
mov eax,edi
mov edi,[esp+C]
pop ecx
mov [esp+8],ecx
pop ecx
pop edx
ret
////////////////////////////////////////////////////////////
BeginKDCheck:
////////////////////////////////
push edi
push edx
push ecx
mov edi,eax
////////////////////////////////
SwitchHP:
// cmp ebx,4
// je LblHP
db 90 90 90 90 90 90 90 90 90
SwitchDrop:
// cmp ebx,D
// je LblDrop
db 90 90 90 90 90 90 90 90 90
SwitchExp:
// cmp ebx,7
// je LblExpTotal
// cmp ebx,3
// je LblExpBase
db 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
cmp ebx,0
je LblOneKillAndAP
call FunctionRevivify
jmp originalcodeKD
////////////////////////////////
LblHP:
push 3
push 10E
call FunctionGetPointer
cmp eax,edi
call FunctionRevivify
jne originalcodeKD
mov edi,#10000000
jmp originalcodeKD
////////////////////////////////
LblDrop:
push 1
push 11E
call FunctionGetPointer
cmp eax,edi
call FunctionRevivify
jne originalcodeKD
mov edi,#100
jmp originalcodeKD
////////////////////////////////
LblExpTotal:
push 3
push 10B
call FunctionGetPointer
cmp eax,edi
call FunctionRevivify
jne originalcodeKD
mov edi,#100000000
jmp originalcodeKD
////////////////////////////////
LblExpBase:
push 2
push 148
call FunctionGetPointer
cmp eax,edi
call FunctionRevivify
jne originalcodeKD
mov edi,#100000000
jmp originalcodeKD
////////////////////////////////
LblOneKillAndAP:
push 0
push 0
call FunctionGetPointer
cmp eax,0
je LblCleanAndNext
mov ecx,eax
lea eax,[ecx+488]
call IsInvalidPointer
cmp eax,0
jne LblCleanAndNext
mov eax,[ecx+488]
cmp eax,FFFFFFFF
je LblAP
mov edx,eax
shr eax,2
and edx,3
push edx
push eax
call FunctionGetPointer
cmp eax,edi
jne LblAP
call FunctionRevivify
SwitchOneKill:
// mov edi,0
db 90 90 90 90 90
jmp originalcodeKD
///////////////////
LblAP:
lea eax,[ecx+48C]
call IsInvalidPointer
cmp eax, 0
jne LblCleanAndNext
mov eax,[ecx+48C]
cmp eax,FFFFFFFF
je LblCleanAndNext
mov edx,eax
shr eax,2
and edx,3
push edx
push eax
call FunctionGetPointer
cmp eax,0
je LblCleanAndNext
lea ecx,[eax+38]
mov eax, ecx
call IsInvalidPointer
cmp eax, 0
jne LblCleanAndNext
mov eax,[ecx]
mov edx,eax
shr eax,2
and edx,3
push edx
push eax
call FunctionGetPointer
cmp eax,edi
call FunctionRevivify
jne originalcodeKD
cmp edi,0
je originalcodeKD
SwitchAP:
jmp originalcodeKD
mov edi,[AddrTagMaxAP]
jmp originalcodeKD
LblCleanAndNext:
call FunctionRevivify
////////////////////////////////
originalcodeKD:
mov [eax+ebx*4],edi
jmp Rance10.exe+21356A
jmp returnhereKD
////////////////////////////////////////////////////////////////////////
BeginFBPCheck:
cmp edx,10B
je LblCheckESI
cmp edx,135
jne originalcodeFBP
SwitchPoint:
// cmp esi,2
// je LblLockPoint
db 90 90 90 90 90 90 90 90 90
jmp originalcodeFBP
///////////////////////////////
LblLockPoint:
push eax
mov esi,eax
push 1
push 135
call FunctionGetPointer
cmp eax,esi
mov esi,2
pop eax
jne originalcodeFBP
mov [eax+esi*4],#20
jmp originalcodeFBP
///////////////////////////////
LblCheckESI:
SwitchFood:
// cmp esi,0
// je LblLockFBF
db 90 90 90 90 90 90 90 90 90
SwitchBadge:
// cmp esi,1
// je LblLockFBF
db 90 90 90 90 90 90 90 90 90
SwitchFriendship:
// cmp esi,2
// je LblLockFBF
db 90 90 90 90 90 90 90 90 90
jmp originalcodeFBP
///////////////////////////////
LblLockFBF:
push eax
push edi
mov edi,eax
//////////////////
push 3
push 10B
call FunctionGetPointer
cmp eax, edi
pop edi
pop eax
jne originalcodeFBP
mov [eax+esi*4],3
originalcodeFBP:
mov eax,[eax+esi*4]
mov [ebp-04],eax
jmp returnhereFBP
//////////////////////////////////////
AddrTagMaxAP:
db 06 00 00 00
//===================================================
//===================================================
//"Rance10.exe"+21344E:
FirstInject:
jmp BeginKDCheck
nop
nop
nop
returnhereKD:
//=======================================
SecondInject:
jmp BeginFBPCheck
nop
returnhereFBP:
[DISABLE]
//"Rance10.exe"+21344E:
FirstInject:
mov [eax+ebx*4],edi
jmp Rance10.exe+21356A
//Alt: db 89 3C 98 E9 14 01 00 00
//"Rance10.exe"+212F49:
SecondInject:
mov eax,[eax+esi*4]
mov [ebp-04],eax
//Alt: db 8B 04 B0 89 45 FC
unregistersymbol(FirstInject)
unregistersymbol(SecondInject)
unregistersymbol(AddrTagMaxAP)
unregistersymbol(SwitchDrop)
unregistersymbol(SwitchExp)
unregistersymbol(SwitchAP)
unregistersymbol(SwitchOneKill)
unregistersymbol(SwitchHP)
//////////////////////////////////////
unregistersymbol(SwitchPoint)
unregistersymbol(SwitchFood)
unregistersymbol(SwitchBadge)
unregistersymbol(SwitchFriendship)
dealloc(newmem)
4
"生命最大"
90 90 90 90 90 90 90 90 90:OFF
83 FB 04 0F 84 2E 00 00 00:ON
1
Array of byte
9
SwitchHP
3
"见面秒杀"
BF 00 00 00 00:ON
90 90 90 90 90:OFF
1
Array of byte
5
SwitchOneKill
114
"AP最大"
1
116
"AP最大值不是修改游戏的，而是必须设定为游戏对应的最大值。"
0080FF
1
117
"目前我没找到自动获取这个值的方法，只能手动设置。"
0080FF
1
109
"AP最大值"
06:06
0A:10
1
Byte
AddrTagMaxAP
115
"AP最大(其实是6)"
90 90 90 90 90:ON
E9 10 00 00 00:OFF
1
Array of byte
5
SwitchAP
5
"掉落率最大"
83 FB 0D 0F 84 48 00 00 00:ON
90 90 90 90 90 90 90 90 90:OFF
1
Array of byte
9
SwitchDrop
107
"经验最大"
83 FB 07 0F 84 62 00 00 00 83 FB 03 0F 84 7C 00 00 00:ON
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90:OFF
1
Array of byte
18
SwitchEXP
6
"食券/金块最大"
83 FE 00 0F 84 17 00 00 00:ON
90 90 90 90 90 90 90 90 90:OFF
1
Array of byte
9
SwitchFood
7
"徽章最大"
83 FE 01 0F 84 0E 00 00 00:ON
90 90 90 90 90 90 90 90 90:OFF
1
Array of byte
9
SwitchBadge
108
"友情值最大"
83 FE 02 0F 84 05 00 00 00:ON
90 90 90 90 90 90 90 90 90:OFF
1
Array of byte
9
SwitchFriendship
8
"Point最大"
83 FE 02 0F 84 05 00 00 00:ON
90 90 90 90 90 90 90 90 90:OFF
1
Array of byte
9
SwitchPoint
112
"使用说明"
FF0000
1
113
"点击程序左上角的计算机图标，在弹出的窗口中选择R10的进程(Rance10.exe)"
FF0000
1
111
"开启脚本后，双击条目对应的“数值”位置，设置ON/OFF。"
FF0000
1
110
"关闭CE之前务必要先关闭脚本，否则修改效果将维持。"
0000FF
1