Kovitikus

Kingdoms of Amalur CheatEngine - YSA V1.1 Finesse Edition

Jun 24th, 2020
149
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 58.93 KB | None | 0 0
  1. <?xml version="1.0"?>
  2. <CheatTable CheatEngineTableVersion="12">
  3. <CheatEntries>
  4. <CheatEntry>
  5. <ID>57</ID>
  6. <Description>"EXP base script: must be activated FIRST, prerequiste to the next script (exp reduction) (please activate)"</Description>
  7. <Color>80000008</Color>
  8. <VariableType>Auto Assembler Script</VariableType>
  9. <AssemblerScript>[ENABLE]
  10. //code from here to '[DISABLE]' will be used to enable the cheat
  11. alloc(newmem7,2048) //2kb should be enough
  12. label(returnhere7)
  13. label(originalcode7)
  14. label(exit7)
  15. label(hHSubFJMP)
  16. label(skillpoints)
  17. aobscan(EXPChange_AOB,89 48 18 8b 57 1C 5D)
  18. registersymbol(hHSubFJMP)
  19.  
  20.  
  21. newmem7: //this is allocated memory, you have read,write,execute access
  22. //place your code here
  23. push edx
  24. push ebx
  25. //No changes in this script neccessary; just a technical anchor
  26. // in order for the next script to work: it marks a strand of parallel code
  27. skillpoints:
  28. pop ebx
  29. pop edx
  30.  
  31. originalcode7:
  32. mov [eax+18],ecx
  33. mov edx,[edi+1C]
  34. pop ebp
  35.  
  36. exit7:
  37. jmp returnhere7
  38.  
  39. EXPChange_AOB:
  40. hHSubFJMP:
  41. jmp newmem7
  42. nop
  43. nop
  44. returnhere7:
  45.  
  46.  
  47. [DISABLE]
  48. //code from here till the end of the code will be used to disable the cheat
  49. dealloc(newmem7)
  50. hHSubFJMP: //"Reckoning.exe"+3A1051:
  51. //db 5E 89 48 18 8B 57 1C
  52. db 89 48 18 8b 57 1C 5D
  53. //db 66 2B C8 66 89 8E DA 00 00 00
  54. //Alt: mov eax,esi
  55. //Alt: neg eax
  56. //Alt: cmp ecx,eax
  57. unregistersymbol(hHSubFJMP)
  58. </AssemblerScript>
  59. <Hotkeys>
  60. <Hotkey>
  61. <Action>Toggle Activation</Action>
  62. <Keys>
  63. <Key>17</Key>
  64. <Key>49</Key>
  65. </Keys>
  66. <Description>EXP Always first</Description>
  67. <ID>0</ID>
  68. </Hotkey>
  69. </Hotkeys>
  70. </CheatEntry>
  71. <CheatEntry>
  72. <ID>56</ID>
  73. <Description>"60% EXP gain reduction (only works if first script was activated beforehand) (please activate)"</Description>
  74. <Color>80000008</Color>
  75. <VariableType>Auto Assembler Script</VariableType>
  76. <AssemblerScript>[ENABLE]
  77. //code from here to '[DISABLE]' will be used to enable the cheat
  78. alloc(newmem8,2048) //2kb should be enough
  79. label(returnhere8)
  80. label(originalcode8)
  81. label(exit8)
  82. label(hHSubGJMP)
  83. label(skillpoints2)
  84. label(NotZero)
  85. aobscan(EXPChange2_AOB,5E 89 48 18 8b 57 1C 5D)
  86. //globalalloc(EXPPointer,4)
  87. //globalalloc(pTotalEXP,4)
  88. registersymbol(hHSubGJMP)
  89.  
  90.  
  91. newmem8: //this is allocated memory, you have read,write,execute access
  92. //place your code here
  93.  
  94. push edx
  95. push ebx
  96. mov edx,[eax+18]
  97. mov ebx,ecx
  98. sub ebx,edx
  99. cmp ebx,(int)15
  100. jbe skillpoints2
  101. cmp ebx,(int)100
  102. je skillpoints2
  103. cmp [eax+18],ecx
  104. je skillpoints2
  105. cmp ebx,(int)10000
  106. jg skillpoints2
  107. cmp ecx,0
  108. jbe skillpoints2
  109. cmp edx,0
  110. jbe skillpoints2
  111. push eax
  112. push edx
  113. mov eax,ebx
  114. //BEGIN OF ADJUSTABLE BLOCK: EXP REDUCTION//
  115. mov edx,3
  116. //above number is the dividend
  117. mul edx
  118. pop edx
  119. sar eax,3
  120. //above number is the divisor
  121. //a 1 means divide by 2, a 2 means divide by 4, a 3 means by 8...
  122. //above settings result in only 3/8 gain (37,5%)
  123. //if you wanted less severe penality and more gain, like e.g. 50%:
  124. //you could set this e.g. to 1 (first number)/1(second number),
  125. //meaning: 1/2 (50%)
  126. //END OF ADJUSTABLE BLOCK: EXP REDUCTION//
  127. mov ebx,eax
  128. pop eax
  129. add [eax+18],ebx
  130. mov ebx,[eax+18]
  131. //mov [pTotalEXP],ebx
  132. cmp ebx,0
  133. jg NotZero
  134. jmp skillpoints2
  135. NotZero:
  136. pop ebx
  137. pop edx
  138. pop esi
  139. jmp originalcode8
  140.  
  141. skillpoints2:
  142. pop ebx
  143. mov [eax+18],ecx
  144. pop edx
  145. pop esi
  146.  
  147. originalcode8:
  148. //pop esi
  149. //mov [eax+18],ecx
  150. mov edx,[edi+1C]
  151. pop ebp
  152.  
  153. exit8:
  154. jmp returnhere8
  155.  
  156. EXPChange2_AOB:
  157. hHSubGJMP:
  158. jmp newmem8
  159. nop
  160. nop
  161. nop
  162. returnhere8:
  163.  
  164. [DISABLE]
  165. //code from here till the end of the code will be used to disable the cheat
  166. dealloc(newmem8)
  167. dealloc(TotalEXP)
  168. hHSubGJMP: //"Reckoning.exe"+3A1051:
  169. //db 5E 89 48 18 8B 57 1C
  170. db 5E 89 48 18 8b 57 1C 5D
  171. //db 66 2B C8 66 89 8E DA 00 00 00
  172. //Alt: mov eax,esi
  173. //Alt: neg eax
  174. //Alt: cmp ecx,eax
  175. unregistersymbol(hHSubGJMP)
  176. </AssemblerScript>
  177. <Hotkeys>
  178. <Hotkey>
  179. <Action>Toggle Activation</Action>
  180. <Keys>
  181. <Key>17</Key>
  182. <Key>50</Key>
  183. </Keys>
  184. <Description>EXP -60%</Description>
  185. <ID>0</ID>
  186. </Hotkey>
  187. </Hotkeys>
  188. </CheatEntry>
  189. <CheatEntry>
  190. <ID>2</ID>
  191. <Description>"Damage done 50%, damage received 200%, Mob min damage 3%, Soft cap player damage at 1500/12% (please activate)"</Description>
  192. <Color>80000008</Color>
  193. <VariableType>Auto Assembler Script</VariableType>
  194. <AssemblerScript>[ENABLE]
  195. //code from here to '[DISABLE]' will be used to enable the cheat
  196. alloc(newmem1,2048) //2kb should be enough
  197. label(returnhere1)
  198. label(originalcode1)
  199. label(exit1)
  200. globalalloc(pHeroHealth,4)
  201. alloc(pHeroMaxHealth,4)
  202. alloc(pHeroCurrentHealth,4)
  203. aobscan(hHRead_AOB,8B 4B 48 89 4C 24 14 85 C9)
  204. label(hHReadJMP)
  205. registersymbol(hHReadJMP)
  206. alloc(newmem2,2048) //2kb should be enough
  207. label(returnhere2)
  208. label(originalcode2)
  209. label(exit2)
  210. label(MonsterHP)
  211. label(NonBoosted)
  212. label(StillBoosted)
  213. label(NonBoostedDamage)
  214. label(FiveLimit)
  215. label(FiveRemains)
  216. label(FiveSteps)
  217. label(GoOn)
  218. aobscan(hHSubA_AOB,3B C8 76 ** 03 CE 89 4F 48 ** ** 89 5F 48 B1 40)
  219. label(hHSubAJMP)
  220. registersymbol(hHSubAJMP)
  221.  
  222. alloc(newmem6,2048) //2kb should be enough
  223. label(returnhere6)
  224. label(originalcode6)
  225. label(exit6)
  226. label(hHSubEJMP)
  227. aobscan(MaxHPIncrease_AOB,83 F8 01 89 47 4C)
  228. registersymbol(hHSubEJMP)
  229.  
  230.  
  231. newmem1: //this is allocated memory, you have read,write,execute access
  232. //place your code here
  233. mov [pHeroHealth],ebx
  234. push edx
  235. mov edx,[ebx+4c]
  236. mov [pHeroMaxHealth],edx
  237. mov edx,[ebx+48]
  238. mov [pHeroCurrentHealth],edx
  239. pop edx
  240.  
  241. originalcode1:
  242. mov ecx,[ebx+48]
  243. mov [esp+14],ecx
  244.  
  245. exit1:
  246. jmp returnhere1
  247.  
  248. newmem2: //this is allocated memory, you have read,write,execute access
  249. //place your code here
  250. cmp [pHeroHealth],edi
  251. jne MonsterHP
  252. push eax
  253. push ebx
  254. mov eax,esi
  255.  
  256. // ADJUSTABLE BLOCK: SOFT CAP OF HIGH HP BY EXTREME DAMAGE INCREASE//
  257. cmp [pHeroCurrentHealth],(int)2999
  258. //above number is the hero current hp number which has to be exceeded for below
  259. //described extreme damage increase to kick in
  260. //the changes start with 3000+ hp in this case
  261. //when changing this adjust all other "2999" you see in the whole code below
  262. //to the same value
  263. jbe NonBoosted
  264. mov ebx,(int)40
  265. //above number is the dividend for damage received by player when his health
  266. // is 3000+ hp; it's a counterbalance for excessive stat increase due to
  267. //crafting and the way stat multilpliers are stacked in vanilla
  268. mul ebx
  269. sar eax,(int)1
  270. //above number is the divisor for such damage received by high hp player
  271. //a 1 above means divide by 2, a 2 divide by 4, a 3 divide by 8...
  272. //above combination results in 40/2 (2^1), i.e. 20 times the vanilla damage
  273. //(or 2000% or paraphrased +additional +1900%)
  274. mov esi,eax
  275. //END OF ADJUSTABLE BLOCK: SOFT CAP OF HIGH HP BY EXTREME DAMAGE INCREASE//
  276.  
  277. // ADJUSTABLE BLOCK: MINIMUM DAMGAE RECEIVED REGARDLESS OF ARMOR/RESISTENCE//
  278. push [pHeroMaxHealth]
  279. sar [pHeroMaxHealth],5
  280. // above number describes the percentage of the hero's maximum hp that is added
  281. // to damage each time a damage occurs; it adds on every hit, but also on every
  282. // posion, burn, bleed etc. tick. There is an exception to this when hero
  283. // current hp drop below 200 hp or max hero hp are below 128 hp;
  284. // these exceptions are described further down in the code;
  285. // purpose of this is to counterbalance excessive stacking of resistence and
  286. // armor modifiers; furthermore it keeps even grey mobs somewhat dangerous;
  287. // you get better in the game, a true hero - but you remain vulnerable
  288. // a 1 above means divide by 2, a 2 divide by 4, a 3 divide by 8...
  289. // above setting results in 1/32 (2^5), i.e. about 3% of hero max hp added
  290. // to each damage received after armor/resistance calculations;e.g a 10000
  291. // max hp hero would receive (round about) additional 300 points of damage per
  292. // hit this values appears double time (see code below); change the other entry
  293. // accordingly
  294. sub esi,[pHeroMaxHealth]
  295. pop [pHeroMaxHealth]
  296. add ecx,esi
  297. pop ebx
  298. pop eax
  299. cmp ecx,(int)2999
  300. //when a hit brings you below of 3000 current hp, this line (and the one below)
  301. // ensures that this very hit will apply no more damage then needed to drop to
  302. // 4999 hp; this is just to make it still attractive to go over 3000+ hp
  303. // otherwise a hero with e.g. 2999 hp might be better of than one with 3001 hp
  304. jge StillBoosted
  305. mov ecx,(int)2999
  306. //see above, change in accordane, as all "2999" numbers in the code
  307. jmp originalcode2
  308. // END OF ADJUSTABLE BLOCK: MINIMUM DAMGAE RECEIVED REGARDLESS OF ARMOR/RES//
  309.  
  310. StillBoosted:
  311. cmp ecx,0
  312. jg originalcode2
  313. mov ecx,0
  314. jmp originalcode2
  315.  
  316. //ADJUSTABLE BLOCK: DAMAGE RECEVEID BY HERO WHEN CURRENT HP BELOW 5000//
  317. NonBoosted:
  318. mov ebx,(int)4
  319. //above number is the dividend for damage received by player
  320. // this muliplier is the normal multiplier used, i.e. when current hero hp are
  321. // below 3000 hp;
  322. mul ebx
  323. sar eax,(int)1
  324. //above number is the divisor for damage received by player
  325. //a 1 above means divide by 2, a 2 divide by 4, a 3 divide by 8...
  326. //above combintaion results in 4/2 (2^1), i.e. double times the damage received
  327. //by hero than in vanilla; that is 200% of vanilla damage received or
  328. //paraphrased + additional 100%
  329. cmp [pHeroMaxHealth],(int)3000
  330. //This number caps the minmum damage received in certain high hp situations;
  331. //not very relevant actually - without the cap heroes with over 3000 max hp
  332. //might get in situations where they would actually wish for less max hp
  333. //which is to be avoided - therefore this cap
  334. jb FiveLimit
  335. mov [pHeroMaxHealth],(int)3000
  336. //END OF ADJUSTABLE BLOCK: DAMAGE RECEVEID BY HERO WHEN CURRENT HP BELOW 5000//
  337.  
  338. //ADJUSTABLE BLOCK: EXECPTIONS TO MINIMUM DAMAGE//
  339. FiveLimit:
  340. mov esi,eax
  341. cmp [pHeroMaxHealth],(int)128
  342. //above number is the minimum full hp of the hero that is neccesssary before the
  343. //minimum damage mechanism described above kicks in; I had crashes when going
  344. //below this; if you lower the divisor for minimum damage below, i.e. increase
  345. //minimum damage, you might want to increase this number, too;
  346. // e.g. when setting the divider to 6 (now 5) I would increase this threshold
  347. // to 256 (now 128)
  348. jb FiveRemains
  349. cmp [pHeroCurrentHealth],(int)200
  350. //above number is a switch point at which minimum damage is calculated as
  351. //absolute value (here: +5 additional damage points) instead of using
  352. //above relative method (here: 3% of of max hp). This switch, occuring when
  353. //current hp go equal or below above value (200), is neccessary to somewhat
  354. //mitigate the effect of damage over time ticks from posion, burn, bleed, etc.;
  355. //your reaction window for healing/fleeing is increased this way;
  356. //without this you will have many sudden death situations when fighting foes
  357. //with damage over time attacks
  358. //to deactivate this safe zone change all three values of "200" here and below
  359. //two times to 0; in any case change all three vlaues in parallel
  360. jbe FiveSteps
  361. push [pHeroMaxHealth]
  362. sar [pHeroMaxHealth],5
  363. //this is again the divisor for minimum damage (1/32 here; 2^5; round about
  364. //3% of max hp: set to the same value as above; it repeats for techncial reasons
  365. //only
  366. sub esi,[pHeroMaxHealth]
  367. pop [pHeroMaxHealth]
  368. push [pHeroCurrentHealth]
  369. add [pHeroCurrentHealth],esi
  370. mov ebx,[pHeroCurrentHealth]
  371. pop [pHeroCurrentHealth]
  372. cmp ebx,(int)150
  373. //again, a threshold value: in case any damage brings your hero to 200 or less
  374. //hp, that very damage only drops you down to exactly 200 hp; otherwise spill
  375. //over damage might simply drop you dead right away before entering the 200 hp
  376. // safe zone with reduced minmum damage mechanism
  377. jg FiveRemains
  378. mov esi,0
  379. mov ecx,(int)150
  380. //see above, always chnage in parallel
  381. jmp FiveRemains
  382.  
  383. FiveSteps:
  384. sub esi,(int)5
  385. //This is the absolute minimum damage added to each damage that occurs within
  386. //the 200 hp safe zone
  387. //END OF ADJUSTABLE BLOCK: EXECPTIONS TO MINIMUM//
  388.  
  389. FiveRemains:
  390. add ecx,esi
  391. pop ebx
  392. pop eax
  393. cmp ecx,0
  394. //do not change or dying will be glitchy
  395. jg originalcode2
  396. mov ecx,0
  397. //do not change or dying will be glitchy
  398. jmp originalcode2
  399.  
  400. MonsterHP:
  401. push eax
  402. push ebx
  403. mov eax,[edi+48]
  404. //mov [edi+48],ecx
  405. //neg eax
  406. //mov ebx,(int)1
  407. //mul ebx
  408. //sar eax,1
  409. //cmp ecx,eax
  410. //jg GoOn
  411. //mov ebx,(int)-1500
  412. add eax,esi
  413. //add eax,(int)30
  414. cmp eax,(int)0
  415. jg GoOn
  416. //mov ebx,[edi+48]
  417. //neg ebx
  418. //cmp eax,ebx
  419. //jb GoOn
  420. //mov ecx,0
  421. add ecx,esi
  422. pop ebx
  423. pop eax
  424. cmp ecx,0
  425. //do not change or dying will be glitchy
  426. jg originalcode2
  427. mov ecx,0
  428. //do not change or dying will be glitchy
  429. jmp originalcode2
  430.  
  431. GoOn:
  432. mov eax,esi
  433.  
  434. //ADJUSTABLE BLOCK: SOFT CAP TO DAMAGE DONE BY HERO//
  435. cmp eax,(int)-1500
  436. //this checks at which damage value a soft cap to the damage the hero deals
  437. //shall be applied; in this case, if you do more than 1500 damage points, you
  438. //get diminishing returns
  439. //purpose is to counterbalance extreme effects due to the way the modifiers
  440. //stack in vanilla; this shall prevent weapon crafting/socketing
  441. //from becoming game breaking in the end game
  442. //this mechanism favors fast weapons over slow a little - I cannot change that
  443. //it will not break stealth kills: there's a glitch though that stealth killed
  444. //opponents need a few extra strikes after they have dropped ;just imagine you
  445. //alredy kncoked them out and now have to finish them off; only a minor glitch
  446. //mind that it's a negative value here
  447. jge NonBoostedDamage
  448. add eax,(int)1629
  449. //change in accordance to above, but use a positive value
  450. sar eax,(int)3
  451. //this is the percentage to which the excess damage, here beyond 1500 damage
  452. //points, is reduced; it's round about 12% right now (1/8, 2^3). E.g when
  453. //dealing 3000 damage points in vanilla this will drop to 1500+1500*12/100=
  454. //1680 damage points
  455. //actually this is not fully correct for I have added additonal 129 points
  456. //to prevent potential crashes (at least 128 should go positive before dividing)
  457. //balancewise these 129 points will have no effect you might notice ingame
  458. sub eax,(int)1629
  459. //change in accordance to above, but use a positive value
  460. //END OF ADJUSTABLE BLOCK: SOFT CAP TO DMAGAE DONE BY HERO//
  461.  
  462. //ADJUSTABLE BLOCK 1: DAMAGE DONE BY HERO//
  463. mov ebx,(int)1
  464. //above number is the dividend for all damage done by hero
  465. //this damage block repeats a few lines below;
  466. //make changes in both blocks (1&amp;2) in accordance
  467. push edx
  468. mul ebx
  469. pop edx
  470. sar eax,(int)1
  471. //above number is the divisor for damage done by hero
  472. //a 1 above means divide by 2, a 2 divide by 4, a 3 divide by 8...
  473. //right now this is 1/2, i.e. 50% of vanilla damahge done by hero or paraphrased
  474. //-50% to the vanilla damage done by the hero
  475. //END OF ADJUSTABLE BLOCK 1: DAMAGE DONE BY HERO//
  476.  
  477. mov esi,eax
  478. add ecx,esi
  479. pop ebx
  480. pop eax
  481. cmp ecx,0
  482. //do not change or dying will be glitchy
  483. jg originalcode2
  484. mov ecx,0
  485. //do not change or dying will be glitchy
  486. jmp originalcode2
  487.  
  488. NonBoostedDamage:
  489. //ADJUSTABLE BLOCK 2: DAMAGE DONE BY HERO//
  490. mov ebx,(int)1
  491. //above number is the dividend for all damage done by hero
  492. //this damage block repeats a few lines above;
  493. //make changes in both blocks (1&amp;2) in accordance
  494. push edx
  495. mul ebx
  496. pop edx
  497. sar eax,(int)1
  498. //above number is the divisor for damage done by hero
  499. //a 1 above means divide by 2, a 2 divide by 4, a 3 divide by 8...
  500. //right now this is 1/2, i.e. 50% of vanilla damage done by hero or paraphrased
  501. //-50% to the vanilla damage done by the hero
  502. //END OF ADJUSTABLE BLOCK 2: DAMAGE DONE BY HERO//
  503.  
  504. mov esi,eax
  505. add ecx,esi
  506. pop ebx
  507. pop eax
  508. cmp ecx,0
  509. //do not change or dying will be glitchy
  510. jg originalcode2
  511. mov ecx,0
  512. //do not change or dying will be glitchy
  513. jmp originalcode2
  514.  
  515. originalcode2:
  516. mov [edi+48],ecx
  517.  
  518.  
  519. exit2:
  520. jmp returnhere2
  521.  
  522. newmem6: //this is allocated memory, you have read,write,execute access
  523. //place your code here
  524. cmp eax,01
  525. push ebx
  526.  
  527. //ADJUSABLE BLOCK: MAX HP TIMES FIVE//
  528. mov ebx,(int)1
  529. //above value is the muliplier for hero's max hp; it's at vanilla level now
  530. //END OF ADJUSABLE BLOCK: MAX HP TIMES FIVE//
  531.  
  532. mul ebx
  533. pop ebx
  534.  
  535. originalcode6:
  536. //cmp eax,01
  537. mov [edi+4C],eax
  538.  
  539. exit6:
  540. jmp returnhere6
  541.  
  542.  
  543.  
  544. hHRead_AOB: //"Reckoning.exe"+3A18E5:
  545. hHReadJMP:
  546. jmp newmem1
  547. nop
  548. nop
  549. returnhere1:
  550.  
  551. hHSubA_AOB: //"Reckoning.exe"+3A1059:
  552. hHSubAJMP:
  553. jmp newmem2
  554. nop
  555. nop
  556. nop
  557. nop
  558. returnhere2:
  559.  
  560. MaxHPIncrease_AOB:
  561. hHSubEJMP:
  562. jmp newmem6
  563. nop
  564. returnhere6:
  565.  
  566. [DISABLE]
  567. //code from here till the end of the code will be used to disable the cheat
  568. dealloc(newmem1)
  569. dealloc(newmem2)
  570. dealloc(newmem6)
  571.  
  572. hHReadJMP: //"Reckoning.exe"+3A18E5:
  573. db 8B 4B 48 89 4C 24 14
  574. //Alt: mov ecx,[ebx+48]
  575. //Alt: mov [esp+14],ecx
  576. dealloc(pHeroHealth)
  577. dealloc(pHeroMaxHealth)
  578. dealloc(pHeroCurrentHealth)
  579. //dealloc(Intermediate,4)
  580. unregistersymbol(hHReadJMP)
  581.  
  582. hHSubAJMP: //"Reckoning.exe"+3A1059:
  583. db 03 CE 89 4F 48
  584. //Alt: add ecx,esi
  585. //Alt: mov [edi+48],ecx
  586. unregistersymbol(hHSubAJMP)
  587.  
  588. hHSubEJMP: //"Reckoning.exe"+3A1051:
  589. //db 5E 89 48 18 8B 57 1C
  590. db 83 F8 01 89 47 4C
  591. //db 66 2B C8 66 89 8E DA 00 00 00
  592. //Alt: mov eax,esi
  593. //Alt: neg eax
  594. //Alt: cmp ecx,eax
  595. unregistersymbol(hHSubEJMP)
  596. </AssemblerScript>
  597. <Hotkeys>
  598. <Hotkey>
  599. <Action>Toggle Activation</Action>
  600. <Keys>
  601. <Key>17</Key>
  602. <Key>51</Key>
  603. </Keys>
  604. <Description>DAM Changes</Description>
  605. <ID>0</ID>
  606. </Hotkey>
  607. </Hotkeys>
  608. <CheatEntries>
  609. <CheatEntry>
  610. <ID>28</ID>
  611. <Description>"CurrentHealth (leave UNACTIVATED)"</Description>
  612. <Color>80000008</Color>
  613. <VariableType>4 Bytes</VariableType>
  614. <Address>pHeroHealth</Address>
  615. <Offsets>
  616. <Offset>48</Offset>
  617. </Offsets>
  618. </CheatEntry>
  619. </CheatEntries>
  620. </CheatEntry>
  621. <CheatEntry>
  622. <ID>60</ID>
  623. <Description>"Health regeneration 20% effect, Heal potions 50% effect; needs damage script active (please activate)"</Description>
  624. <Color>80000008</Color>
  625. <VariableType>Auto Assembler Script</VariableType>
  626. <AssemblerScript>[ENABLE]
  627. //code from here to '[DISABLE]' will be used to enable the cheat
  628. alloc(newmem3,2048) //2kb should be enough
  629. label(returnhere3)
  630. label(originalcode3)
  631. label(exit3)
  632. label(Collecting)
  633. label(Healpotion)
  634. label(MonsterRegeneration)
  635. globalalloc(Counter,4)
  636. aobscan(hHSubB_AOB,03 CE 83 F8 01 89 4F 48 8D 53 01)
  637. label(hHSubBJMP)
  638. registersymbol(hHSubBJMP)
  639.  
  640. newmem3: //this is allocated memory, you have read,write,execute access
  641. //place your code here
  642. cmp [pHeroHealth],edi
  643. jne MonsterRegeneration
  644. //ADJUSTABLE BLOCK: STRENGTH OF HEALING EFFECTS IN FAVOR OF HERO//
  645. cmp esi,(int)30
  646. //above number is for identifying whether a heal potion (or more general:
  647. //single instance heal) or a regeneration potion (or more genereal: heal
  648. //over time) is used; every heal of 30+ points on one tick is considered as
  649. //heal potion; please note that the number of ticks called per second depends
  650. //on the potion used; small regenration potions tick 3 to 5 times per second
  651. //large ones about 20 times per second
  652. jge Healpotion
  653. cmp [Counter],(int)5
  654. //this number divides the strenth of heal over time effects (e.g. regeneration
  655. //potions); it actually inserts blank ticks without effect: the setting of 5,
  656. // reduces HoT effects to 20% (80% effectiveness lost)
  657. jne Collecting
  658. add ecx,esi
  659. mov [Counter],0
  660. jmp originalcode3
  661. Collecting:
  662. add [Counter],(int)1
  663. jmp originalcode3
  664. Healpotion:
  665. sar esi,1
  666. //above number divides the strength of single instance heals (e.g. heal potions)
  667. // a 1 means divide by 2, a 2 means by 4, a 3 by 8...
  668. //the 2 above brings single instance heals down 50% (50% effectiveness lost)
  669. //END OF ADJUSTABLE BLOCK: STRENGTH OF HEALING EFFECTS IN FAVOR OF HERO//
  670. add ecx,esi
  671. jmp originalcode3
  672.  
  673. MonsterRegeneration:
  674. add ecx,esi
  675. //add ecx,esi
  676. //special: above- if un-commmenetned could double monster heals, but I have not
  677. //seen any so far... I keep it commented and tehrewith dectivated to prevent
  678. //potential hidden glitches
  679.  
  680. originalcode3:
  681. //add ecx,esi
  682. cmp eax,01
  683.  
  684. exit3:
  685. jmp returnhere3
  686.  
  687. hHSubB_AOB: //"Reckoning.exe"+3A0FC9:
  688. hHSubBJMP:
  689. jmp newmem3
  690. returnhere3:
  691.  
  692.  
  693. [DISABLE]
  694. //code from here till the end of the code will be used to disable the cheat
  695. dealloc(newmem3)
  696. hHSubBJMP: //"Reckoning.exe"+3A0FC9:
  697. db 03 CE 83 F8 01
  698. //Alt: add ecx,esi
  699. //Alt: cmp eax,01
  700. unregistersymbol(hHSubBJMP)
  701. </AssemblerScript>
  702. <Hotkeys>
  703. <Hotkey>
  704. <Action>Toggle Activation</Action>
  705. <Keys>
  706. <Key>17</Key>
  707. <Key>52</Key>
  708. </Keys>
  709. <Description>HEAL Changes</Description>
  710. <ID>0</ID>
  711. </Hotkey>
  712. </Hotkeys>
  713. </CheatEntry>
  714. <CheatEntry>
  715. <ID>10</ID>
  716. <Description>"Mana cost 200%, mana reg 33%, mana potions 50%, Min cast cost 10 (please activate)"</Description>
  717. <Color>80000008</Color>
  718. <VariableType>Auto Assembler Script</VariableType>
  719. <AssemblerScript>[ENABLE]
  720. //code from here to '[DISABLE]' will be used to enable the cheat
  721. alloc(newmem,2048) //2kb should be enough
  722. label(returnhere)
  723. label(originalcode)
  724. label(exit)
  725. label(DRUNTER)
  726. label(MinCostReached)
  727. aobscan(MPSub_AOB,8B D0 F7 DA 3B CA ** ** 03 C8 89 8D 84 00 00 00)
  728. label(MPSubJMP)
  729. registersymbol(MPSubJMP)
  730.  
  731. alloc(newmem3,2048) //2kb should be enough
  732. label(returnhere3)
  733. label(originalcode3)
  734. label(exit3)
  735. //label(MonsterRegeneration)
  736. label(Collecting)
  737. label(ManaPotion)
  738. globalalloc(ManaCounter,4)
  739. aobscan(ManaRegSub_AOB,01 85 84 00 00 00 8B B5 84 00 00 00)
  740. label(ManaRegSubJMP)
  741. registersymbol(ManaRegSubJMP)
  742.  
  743. newmem: //this is allocated memory, you have read,write,execute access
  744. //place your code here
  745. push eax
  746. push ebx
  747. push ecx
  748. mov eax,[ebp+00000084]
  749. sub eax,ecx
  750.  
  751. // ADJUSTABLE BLOCK: INCREASED MANA COST//
  752. mov ecx,(int)200
  753. //above number is the dividend for mana cost
  754. mul ecx
  755. mov ebx,(int)100
  756. //above number is the divisor for mana cost
  757. //the combination means double mana cost
  758. //i.e. + additional 100% compared to vanilla
  759. //or paraphrased: 200% of vanilla cost
  760. //Note: The last spell before mana rus out can actually be cast for vanilla
  761. //mana cost; it's out of bounds for me to change this
  762. // END OF ADJUSTABLE BLOCK: INCREASED MANA COST//
  763. push edx
  764. div ebx
  765. //ADJUSTABLE BLOCK: MINIMUM MANA COST
  766. cmp eax,(int)10
  767. //above number it the minimum of mana cost per cast, regardless of
  768. //your equipment or skill boni; change in parallel to second number
  769. //below
  770. jg MinCostReached
  771. mov eax,(int)10
  772. //above number is the minimum of mana cost per cast, regardless of
  773. //your equipment or skill boni; change in parallel to first number
  774. //above
  775. //END OF ADJUSTABLE BLOCK: MINIMUM MANA COST
  776. MinCostReached:
  777. pop edx
  778. cmp [ebp+00000084],eax
  779. jbe DRUNTER
  780. sub [ebp+00000084],eax
  781. pop ecx
  782. pop ebx
  783. pop eax
  784. jmp returnhere
  785. DRUNTER:
  786. mov [ebp+00000084],0
  787. pop ecx
  788. pop ebx
  789. pop eax
  790.  
  791. originalcode:
  792. //mov [ebp+00000084],ecx
  793.  
  794. exit:
  795. jmp returnhere
  796.  
  797.  
  798. newmem3: //this is allocated memory, you have read,write,execute access
  799. //place your code here
  800. //ADJUSTABLE BLOCK: STRENGTH OF MANA EFFECTS IN FAVOR OF HERO//
  801. cmp eax,(int)30
  802. //above number is for identifying whether a mana potion (or more general:
  803. //single instance managain) or a regeneration potion (or more generel: mana
  804. //over time) is used; every mana gain of 30+ points on one tick is considered as
  805. //mana potion; please note that the number of ticks called per second depends
  806. //on the potion used; small regenration potions tick 3 to 5 times per second
  807. //large ones about 20 times per second
  808. jge ManaPotion
  809. cmp [ManaCounter],(int)3
  810. //this number divides the strength of mana over time effects (e.g. regeneration
  811. //potions); it actually inserts blank ticks without effect: the setting of 3,
  812. // reduces mana over time effects to 33% (67% effectiveness lost)
  813. jne Collecting
  814. add [ebp+00000084],eax
  815. mov [ManaCounter],0
  816. jmp originalcode3
  817. Collecting:
  818. add [ManaCounter],(int)1
  819. jmp originalcode3
  820. ManaPotion:
  821. sar eax,1
  822. //above number divides the strength of single instance mana gains
  823. // a 1 means divide by 2, a 2 means by 4, a 3 by 8...
  824. //the 1 above brings single instance gain down 50% (50% effectiveness lost)
  825. //END OF ADJUSTABLE BLOCK: STRENGTH OF MANA EFFECTS IN FAVOR OF HERO//
  826. add [ebp+00000084],eax
  827. jmp originalcode3
  828.  
  829. originalcode3:
  830. //add [ebp+00000084],eax
  831.  
  832. exit3:
  833. jmp returnhere3
  834.  
  835. MPSub_AOB+A: //"Reckoning.exe"+39A6A1:
  836. MPSubJMP:
  837. jmp newmem
  838. nop
  839. returnhere:
  840.  
  841. ManaRegSub_AOB:
  842. ManaRegSubJMP:
  843. jmp newmem3
  844. nop
  845. returnhere3:
  846.  
  847.  
  848.  
  849. [DISABLE]
  850. //code from here till the end of the code will be used to disable the cheat
  851. dealloc(newmem)
  852. dealloc(newmem3)
  853. MPSubJMP: //"Reckoning.exe"+39A6A1:
  854. mov [ebp+00000084],ecx
  855. //Alt: db 89 8D 84 00 00 00
  856. unregistersymbol(MPSubJMP)
  857. ManaRegSubJMP: //"Reckoning.exe"+39A6A1:
  858. add [ebp+00000084],eax
  859. unregistersymbol(ManaRegSubJMP)
  860. </AssemblerScript>
  861. <Hotkeys>
  862. <Hotkey>
  863. <Action>Toggle Activation</Action>
  864. <Keys>
  865. <Key>17</Key>
  866. <Key>53</Key>
  867. </Keys>
  868. <Description>MANA Changes</Description>
  869. <ID>0</ID>
  870. </Hotkey>
  871. </Hotkeys>
  872. </CheatEntry>
  873. <CheatEntry>
  874. <ID>59</ID>
  875. <Description>"Slower Fatepoints gain: gain speed down to approximately 25% , later in game even less (please activate)"</Description>
  876. <Color>80000008</Color>
  877. <VariableType>Auto Assembler Script</VariableType>
  878. <AssemblerScript>[ENABLE]
  879. //code from here to '[DISABLE]' will be used to enable the cheat
  880. alloc(newmem,2048) //2kb should be enough
  881. label(returnhere)
  882. label(originalcode)
  883. label(exit)
  884. label(MinFive)
  885. aobscan(Fate_AOB,03 82 04 02 00 00 D9 6C 24 0C)
  886. label(FateSubJMP)
  887. registersymbol(FateSubJMP)
  888.  
  889.  
  890. newmem: //this is allocated memory, you have read,write,execute access
  891. //place your code here
  892. cmp eax,(int)250
  893. jg originalcode
  894. cmp eax,(int)5
  895. jae MinFive
  896. mov eax,(int)5
  897.  
  898. MinFive:
  899. sub [edx+00000204],(int)5
  900. //ADJUSTABLE BLOCK: FATE GAIN PER KILL
  901. cmp eax,(int)10
  902. //above line sets the maximal fate points per kill
  903. //it's the above value minus 5; here: 10-5 = 5 max. fate points per kill
  904. //to go down to e.g. 4 max points per kill, set this and the below number to 9
  905. //this setting means about max. 2% of your fate bar (when full: 265 fate points)
  906. //per kill, no more fate agin for attck combos alone, no extra fate agin for
  907. //"elite" opponents of various classes; estimated reducutio of gain speed: 25%
  908. //(and even more when late ron you woudl find mor "elite")
  909. //note that foes 4 lvl below you, even if still yellows, don't yield fate points
  910. jbe originalcode
  911. mov eax,(int)10
  912. //keep this number the same as above number; here both at 10
  913. //END OF ADJUSTABLE BLOCK: FATE GAIN PER KILL
  914.  
  915. originalcode:
  916. add eax,[edx+00000204]
  917.  
  918. exit:
  919. jmp returnhere
  920.  
  921. Fate_AOB:
  922. FateSubJMP:
  923. jmp newmem
  924. nop
  925. returnhere:
  926.  
  927. [DISABLE]
  928. //code from here till the end of the code will be used to disable the cheat
  929. dealloc(newmem)
  930. FateSubJMP: //"Reckoning.exe"+39A6A1:
  931. db 03 82 04 02 00 00
  932. //mov [ebp+00000084],ecx
  933. //Alt: db 89 8D 84 00 00 00
  934. unregistersymbol(FateSubJMP)
  935.  
  936. </AssemblerScript>
  937. <Hotkeys>
  938. <Hotkey>
  939. <Action>Toggle Activation</Action>
  940. <Keys>
  941. <Key>17</Key>
  942. <Key>54</Key>
  943. </Keys>
  944. <Description>FATE Changes</Description>
  945. <ID>0</ID>
  946. </Hotkey>
  947. </Hotkeys>
  948. </CheatEntry>
  949. <CheatEntry>
  950. <ID>18</ID>
  951. <Description>"Gold found and sell value set to 33% of vanilla: Preparation script (please activate)"</Description>
  952. <Color>80000008</Color>
  953. <VariableType>Auto Assembler Script</VariableType>
  954. <AssemblerScript>[ENABLE]
  955. //code from here to '[DISABLE]' will be used to enable the cheat
  956. alloc(newmem,2048) //2kb should be enough
  957. label(returnhere)
  958. label(originalcode)
  959. label(exit)
  960. globalalloc(pMoney,4)
  961. aobscan(moneyRead_AOB,85 C0 74 08 8B 80 64 03 00 00 EB 02 33 C0 33 C9 33 D2 89 44 24 20)
  962. label(moneyReadJMP)
  963. registersymbol(moneyReadJMP)
  964.  
  965. newmem: //this is allocated memory, you have read,write,execute access
  966. //place your code here
  967. mov [pMoney],eax
  968. //just a script preparing the use of the second gold script; no need for
  969. //changes here; always activate both of these gold scripts, preferably this
  970. //one first
  971. originalcode:
  972. mov eax,[eax+00000364]
  973.  
  974. exit:
  975. jmp returnhere
  976.  
  977. moneyRead_AOB+4: //"Reckoning.exe"+7020EC:
  978. moneyReadJMP:
  979. jmp newmem
  980. nop
  981. returnhere:
  982.  
  983.  
  984.  
  985.  
  986. [DISABLE]
  987. //code from here till the end of the code will be used to disable the cheat
  988. dealloc(newmem)
  989. moneyReadJMP: //"Reckoning.exe"+7020EC:
  990. db 8B 80 64 03 00 00
  991. //Alt: mov eax,[eax+00000364]
  992. dealloc(pMoney)
  993. unregistersymbol(moneyReadJMP)
  994. </AssemblerScript>
  995. <Hotkeys>
  996. <Hotkey>
  997. <Action>Toggle Activation</Action>
  998. <Keys>
  999. <Key>17</Key>
  1000. <Key>55</Key>
  1001. </Keys>
  1002. <Description>GOLD Changes</Description>
  1003. <ID>0</ID>
  1004. </Hotkey>
  1005. </Hotkeys>
  1006. <CheatEntries>
  1007. <CheatEntry>
  1008. <ID>19</ID>
  1009. <Description>"Money (leave UNACTIVATED)"</Description>
  1010. <Color>80000008</Color>
  1011. <VariableType>4 Bytes</VariableType>
  1012. <Address>pMoney</Address>
  1013. <Offsets>
  1014. <Offset>364</Offset>
  1015. </Offsets>
  1016. </CheatEntry>
  1017. <CheatEntry>
  1018. <ID>20</ID>
  1019. <Description>"Gold found and sell value set to 33% of vanilla: Executive script (please activate)"</Description>
  1020. <Color>80000008</Color>
  1021. <VariableType>Auto Assembler Script</VariableType>
  1022. <AssemblerScript>[ENABLE]
  1023. //code from here to '[DISABLE]' will be used to enable the cheat
  1024. alloc(newmem,2048) //2kb should be enough
  1025. label(returnhere)
  1026. label(originalcode)
  1027. label(exit)
  1028. aobscan(moneySub_AOB,CC CC 01 86 64 03 00 00 8B 86 64 03 00 00 8B 15 ** ** ** ** 33 C9 85 C0)
  1029. label(moneySubJMP)
  1030. registersymbol(moneySubJMP)
  1031.  
  1032. newmem: //this is allocated memory, you have read,write,execute access
  1033. //place your code here
  1034. cmp [pMoney],esi
  1035. push ebx
  1036. push ecx
  1037. jne originalcode
  1038. cmp eax,(int)0
  1039. jbe originalcode
  1040. mov ebx,[esi+00000364]
  1041. mov ecx,ebx
  1042. add ecx,eax
  1043. cmp ecx,ebx
  1044. jbe originalcode
  1045.  
  1046. //ADJUSTABLE BLOCK: DECREASED GOLD INFLUX//
  1047. mov ebx,(int)33
  1048. //above number is the dividend for gold found and gained by selling
  1049. //please note that the sell values appear a shigh as before, but the money you
  1050. //get will be only one third (33/100) with above setting
  1051. mul ebx
  1052. mov ecx,(int)100
  1053. //above number is the divisor for gold found and gained by selling
  1054. push edx
  1055. div ecx
  1056. pop edx
  1057. //END OF ADJUSTABLE BLOCK: DECREASED GOLD INFLUX//
  1058.  
  1059. originalcode:
  1060. pop ecx
  1061. pop ebx
  1062. add [esi+00000364],eax
  1063.  
  1064. exit:
  1065. jmp returnhere
  1066.  
  1067. moneySub_AOB+2: //"Reckoning.exe"+63C490:
  1068. moneySubJMP:
  1069. jmp newmem
  1070. nop
  1071. returnhere:
  1072.  
  1073.  
  1074.  
  1075.  
  1076. [DISABLE]
  1077. //code from here till the end of the code will be used to disable the cheat
  1078. dealloc(newmem)
  1079. moneySubJMP: //"Reckoning.exe"+63C490:
  1080. db 01 86 64 03 00 00
  1081. //Alt: add [esi+00000364],eax
  1082. unregistersymbol(moneySubJMP)
  1083. </AssemblerScript>
  1084. <Hotkeys>
  1085. <Hotkey>
  1086. <Action>Toggle Activation</Action>
  1087. <Keys>
  1088. <Key>17</Key>
  1089. <Key>55</Key>
  1090. </Keys>
  1091. <Description>GOLD Changes</Description>
  1092. <ID>0</ID>
  1093. </Hotkey>
  1094. </Hotkeys>
  1095. </CheatEntry>
  1096. </CheatEntries>
  1097. </CheatEntry>
  1098. <CheatEntry>
  1099. <ID>29</ID>
  1100. <Description>"MaximumHealth (leave UNACTIVATED)"</Description>
  1101. <Color>80000008</Color>
  1102. <VariableType>4 Bytes</VariableType>
  1103. <Address>pHeroHealth</Address>
  1104. <Offsets>
  1105. <Offset>4C</Offset>
  1106. </Offsets>
  1107. </CheatEntry>
  1108. <CheatEntry>
  1109. <ID>61</ID>
  1110. <Description>"Attack Weight Preparation (please activate; afterwards switch ingame from diffculty hard to medium to hard again)"</Description>
  1111. <Color>80000008</Color>
  1112. <VariableType>Auto Assembler Script</VariableType>
  1113. <AssemblerScript>[ENABLE]
  1114. //code from here to '[DISABLE]' will be used to enable the cheat
  1115. alloc(newmem5,2048) //2kb should be enough
  1116. label(returnhere5)
  1117. label(originalcode5)
  1118. label(exit5)
  1119. label(hHSubDJMP)
  1120. globalalloc(AttackWeightPointer,4)
  1121. aobscan(AttackWeight_AOB,66 2B C8 66 89 8E DA 00 00 00)
  1122. registersymbol(hHSubDJMP)
  1123.  
  1124. newmem5: //this is allocated memory, you have read,write,execute access
  1125. //place your code here
  1126. sub cx,ax
  1127.  
  1128. //ADJUSTABLE BLOCK: ATTACK WEIGHT//
  1129. mov [esi+000000DA],(int)100
  1130. //The game uses a parameter called attack weight to determine how many opponents
  1131. //attack you simultaneously with which of their attacks; usually this is 14 on
  1132. //hard vanilla difficulty; it's increased to 100 here;
  1133. //to have this increase take effect, you have to change diffculty back and
  1134. //forth ingame on each restart of the game, like hard-medium-hard
  1135. //after doing so place the check mark in front of the Attack Weight Pointer in
  1136. //the Cheat Engine menu to lock its value at 100
  1137. //END OF ADJUSTABLE BLOCK: ATTACK WEIGHT//
  1138.  
  1139. mov [AttackWeightPointer],esi
  1140.  
  1141. originalcode5:
  1142. //sub cx,ax
  1143. //mov [esi+000000DA],cx
  1144.  
  1145. exit5:
  1146. jmp returnhere5
  1147.  
  1148. AttackWeight_AOB:
  1149. hHSubDJMP:
  1150. jmp newmem5
  1151. nop
  1152. nop
  1153. nop
  1154. nop
  1155. nop
  1156. returnhere5:
  1157.  
  1158.  
  1159. [DISABLE]
  1160. //code from here till the end of the code will be used to disable the cheat
  1161. dealloc(newmem5)
  1162. hHSubDJMP: //"Reckoning.exe"+3A1051:
  1163. //db 5E 89 48 18 8B 57 1C
  1164. db 66 2B C8 66 89 8E DA 00 00 00
  1165. //Alt: mov eax,esi
  1166. //Alt: neg eax
  1167. //Alt: cmp ecx,eax
  1168. unregistersymbol(hHSubDJMP)
  1169. </AssemblerScript>
  1170. <Hotkeys>
  1171. <Hotkey>
  1172. <Action>Toggle Activation</Action>
  1173. <Keys>
  1174. <Key>17</Key>
  1175. <Key>56</Key>
  1176. </Keys>
  1177. <Description>AW Change now</Description>
  1178. <ID>0</ID>
  1179. </Hotkey>
  1180. </Hotkeys>
  1181. </CheatEntry>
  1182. <CheatEntry>
  1183. <ID>49</ID>
  1184. <Description>"AttackWeight Freeze (please activate after having activated the script above and having done that hard-medium-hard switch ingame)"</Description>
  1185. <Color>80000008</Color>
  1186. <VariableType>Byte</VariableType>
  1187. <Address>AttackWeightPointer</Address>
  1188. <Offsets>
  1189. <Offset>DA</Offset>
  1190. </Offsets>
  1191. <Hotkeys>
  1192. <Hotkey>
  1193. <Action>Toggle Activation</Action>
  1194. <Keys>
  1195. <Key>17</Key>
  1196. <Key>57</Key>
  1197. </Keys>
  1198. <Description>AW alt+tab</Description>
  1199. <ID>0</ID>
  1200. </Hotkey>
  1201. </Hotkeys>
  1202. </CheatEntry>
  1203. </CheatEntries>
  1204. <CheatCodes>
  1205. <CodeEntry>
  1206. <Description>hp +- 1 Code :mov [edi+48],ecx</Description>
  1207. <Address>007A105B</Address>
  1208. <ModuleName>Reckoning.exe</ModuleName>
  1209. <ModuleNameOffset>3A105B</ModuleNameOffset>
  1210. <Before>
  1211. <Byte>C8</Byte>
  1212. <Byte>76</Byte>
  1213. <Byte>07</Byte>
  1214. <Byte>03</Byte>
  1215. <Byte>CE</Byte>
  1216. </Before>
  1217. <Actual>
  1218. <Byte>89</Byte>
  1219. <Byte>4F</Byte>
  1220. <Byte>48</Byte>
  1221. </Actual>
  1222. <After>
  1223. <Byte>EB</Byte>
  1224. <Byte>03</Byte>
  1225. <Byte>89</Byte>
  1226. <Byte>5F</Byte>
  1227. <Byte>48</Byte>
  1228. </After>
  1229. </CodeEntry>
  1230. <CodeEntry>
  1231. <Description>hp access 1 Code :mov ecx,[ebx+48]</Description>
  1232. <Address>007A18E5</Address>
  1233. <ModuleName>Reckoning.exe</ModuleName>
  1234. <ModuleNameOffset>3A18E5</ModuleNameOffset>
  1235. <Before>
  1236. <Byte>8E</Byte>
  1237. <Byte>98</Byte>
  1238. <Byte>01</Byte>
  1239. <Byte>00</Byte>
  1240. <Byte>00</Byte>
  1241. </Before>
  1242. <Actual>
  1243. <Byte>8B</Byte>
  1244. <Byte>4B</Byte>
  1245. <Byte>48</Byte>
  1246. </Actual>
  1247. <After>
  1248. <Byte>89</Byte>
  1249. <Byte>4C</Byte>
  1250. <Byte>24</Byte>
  1251. <Byte>14</Byte>
  1252. <Byte>85</Byte>
  1253. </After>
  1254. </CodeEntry>
  1255. <CodeEntry>
  1256. <Description>arrow - Code :mov [ebp+00000084],eax</Description>
  1257. <Address>008C16DB</Address>
  1258. <ModuleName>Reckoning.exe</ModuleName>
  1259. <ModuleNameOffset>4C16DB</ModuleNameOffset>
  1260. <Before>
  1261. <Byte>48</Byte>
  1262. <Byte>3B</Byte>
  1263. <Byte>C3</Byte>
  1264. <Byte>7C</Byte>
  1265. <Byte>06</Byte>
  1266. </Before>
  1267. <Actual>
  1268. <Byte>89</Byte>
  1269. <Byte>85</Byte>
  1270. <Byte>84</Byte>
  1271. <Byte>00</Byte>
  1272. <Byte>00</Byte>
  1273. <Byte>00</Byte>
  1274. </Actual>
  1275. <After>
  1276. <Byte>38</Byte>
  1277. <Byte>9C</Byte>
  1278. <Byte>24</Byte>
  1279. <Byte>F4</Byte>
  1280. <Byte>01</Byte>
  1281. </After>
  1282. </CodeEntry>
  1283. <CodeEntry>
  1284. <Description>arrow + 1 Code :mov [esi+00000084],eax</Description>
  1285. <Address>008866C0</Address>
  1286. <ModuleName>Reckoning.exe</ModuleName>
  1287. <ModuleNameOffset>4866C0</ModuleNameOffset>
  1288. <Before>
  1289. <Byte>5E</Byte>
  1290. <Byte>6C</Byte>
  1291. <Byte>89</Byte>
  1292. <Byte>5E</Byte>
  1293. <Byte>60</Byte>
  1294. </Before>
  1295. <Actual>
  1296. <Byte>89</Byte>
  1297. <Byte>86</Byte>
  1298. <Byte>84</Byte>
  1299. <Byte>00</Byte>
  1300. <Byte>00</Byte>
  1301. <Byte>00</Byte>
  1302. </Actual>
  1303. <After>
  1304. <Byte>F3</Byte>
  1305. <Byte>0F</Byte>
  1306. <Byte>11</Byte>
  1307. <Byte>86</Byte>
  1308. <Byte>88</Byte>
  1309. </After>
  1310. </CodeEntry>
  1311. <CodeEntry>
  1312. <Description>arrow + 2 Code :mov [esi+00000084],ebx</Description>
  1313. <Address>008C4A6C</Address>
  1314. <ModuleName>Reckoning.exe</ModuleName>
  1315. <ModuleNameOffset>4C4A6C</ModuleNameOffset>
  1316. <Before>
  1317. <Byte>00</Byte>
  1318. <Byte>03</Byte>
  1319. <Byte>D8</Byte>
  1320. <Byte>78</Byte>
  1321. <Byte>06</Byte>
  1322. </Before>
  1323. <Actual>
  1324. <Byte>89</Byte>
  1325. <Byte>9E</Byte>
  1326. <Byte>84</Byte>
  1327. <Byte>00</Byte>
  1328. <Byte>00</Byte>
  1329. <Byte>00</Byte>
  1330. </Actual>
  1331. <After>
  1332. <Byte>33</Byte>
  1333. <Byte>DB</Byte>
  1334. <Byte>EB</Byte>
  1335. <Byte>12</Byte>
  1336. <Byte>8B</Byte>
  1337. </After>
  1338. </CodeEntry>
  1339. <CodeEntry>
  1340. <Description>arrow + 3 Code :mov [ecx+00000084],eax</Description>
  1341. <Address>008B9C03</Address>
  1342. <ModuleName>Reckoning.exe</ModuleName>
  1343. <ModuleNameOffset>4B9C03</ModuleNameOffset>
  1344. <Before>
  1345. <Byte>0A</Byte>
  1346. <Byte>8B</Byte>
  1347. <Byte>4C</Byte>
  1348. <Byte>24</Byte>
  1349. <Byte>2C</Byte>
  1350. </Before>
  1351. <Actual>
  1352. <Byte>89</Byte>
  1353. <Byte>81</Byte>
  1354. <Byte>84</Byte>
  1355. <Byte>00</Byte>
  1356. <Byte>00</Byte>
  1357. <Byte>00</Byte>
  1358. </Actual>
  1359. <After>
  1360. <Byte>83</Byte>
  1361. <Byte>7D</Byte>
  1362. <Byte>0C</Byte>
  1363. <Byte>00</Byte>
  1364. <Byte>74</Byte>
  1365. </After>
  1366. </CodeEntry>
  1367. <CodeEntry>
  1368. <Description>arrow access Code :mov eax,[eax+00000084]</Description>
  1369. <Address>0088AFE5</Address>
  1370. <ModuleName>Reckoning.exe</ModuleName>
  1371. <ModuleNameOffset>48AFE5</ModuleNameOffset>
  1372. <Before>
  1373. <Byte>40</Byte>
  1374. <Byte>20</Byte>
  1375. <Byte>01</Byte>
  1376. <Byte>74</Byte>
  1377. <Byte>0A</Byte>
  1378. </Before>
  1379. <Actual>
  1380. <Byte>8B</Byte>
  1381. <Byte>80</Byte>
  1382. <Byte>84</Byte>
  1383. <Byte>00</Byte>
  1384. <Byte>00</Byte>
  1385. <Byte>00</Byte>
  1386. </Actual>
  1387. <After>
  1388. <Byte>01</Byte>
  1389. <Byte>44</Byte>
  1390. <Byte>24</Byte>
  1391. <Byte>18</Byte>
  1392. <Byte>83</Byte>
  1393. </After>
  1394. </CodeEntry>
  1395. <CodeEntry>
  1396. <Description>repair - Code :movss [esi+00000088],xmm0</Description>
  1397. <Address>008BC1CF</Address>
  1398. <ModuleName>Reckoning.exe</ModuleName>
  1399. <ModuleNameOffset>4BC1CF</ModuleNameOffset>
  1400. <Before>
  1401. <Byte>28</Byte>
  1402. <Byte>C2</Byte>
  1403. <Byte>0F</Byte>
  1404. <Byte>2F</Byte>
  1405. <Byte>D0</Byte>
  1406. </Before>
  1407. <Actual>
  1408. <Byte>F3</Byte>
  1409. <Byte>0F</Byte>
  1410. <Byte>11</Byte>
  1411. <Byte>86</Byte>
  1412. <Byte>88</Byte>
  1413. <Byte>00</Byte>
  1414. <Byte>00</Byte>
  1415. <Byte>00</Byte>
  1416. </Actual>
  1417. <After>
  1418. <Byte>0F</Byte>
  1419. <Byte>82</Byte>
  1420. <Byte>3B</Byte>
  1421. <Byte>01</Byte>
  1422. <Byte>00</Byte>
  1423. </After>
  1424. </CodeEntry>
  1425. <CodeEntry>
  1426. <Description>mp - Code :mov [ebp+00000084],ecx</Description>
  1427. <Address>0079A6A1</Address>
  1428. <ModuleName>Reckoning.exe</ModuleName>
  1429. <ModuleNameOffset>39A6A1</ModuleNameOffset>
  1430. <Before>
  1431. <Byte>CA</Byte>
  1432. <Byte>76</Byte>
  1433. <Byte>0A</Byte>
  1434. <Byte>03</Byte>
  1435. <Byte>C8</Byte>
  1436. </Before>
  1437. <Actual>
  1438. <Byte>89</Byte>
  1439. <Byte>8D</Byte>
  1440. <Byte>84</Byte>
  1441. <Byte>00</Byte>
  1442. <Byte>00</Byte>
  1443. <Byte>00</Byte>
  1444. </Actual>
  1445. <After>
  1446. <Byte>EB</Byte>
  1447. <Byte>0A</Byte>
  1448. <Byte>C7</Byte>
  1449. <Byte>85</Byte>
  1450. <Byte>84</Byte>
  1451. </After>
  1452. </CodeEntry>
  1453. <CodeEntry>
  1454. <Description>mp + Code :add [ebp+00000084],eax</Description>
  1455. <Address>0079A602</Address>
  1456. <ModuleName>Reckoning.exe</ModuleName>
  1457. <ModuleNameOffset>39A602</ModuleNameOffset>
  1458. <Before>
  1459. <Byte>8C</Byte>
  1460. <Byte>8F</Byte>
  1461. <Byte>00</Byte>
  1462. <Byte>00</Byte>
  1463. <Byte>00</Byte>
  1464. </Before>
  1465. <Actual>
  1466. <Byte>01</Byte>
  1467. <Byte>85</Byte>
  1468. <Byte>84</Byte>
  1469. <Byte>00</Byte>
  1470. <Byte>00</Byte>
  1471. <Byte>00</Byte>
  1472. </Actual>
  1473. <After>
  1474. <Byte>8B</Byte>
  1475. <Byte>B5</Byte>
  1476. <Byte>84</Byte>
  1477. <Byte>00</Byte>
  1478. <Byte>00</Byte>
  1479. </After>
  1480. </CodeEntry>
  1481. <CodeEntry>
  1482. <Description>hp +- 2 Code :mov [edi+48],ecx</Description>
  1483. <Address>007A0FD1</Address>
  1484. <ModuleName>Reckoning.exe</ModuleName>
  1485. <ModuleNameOffset>3A0FD1</ModuleNameOffset>
  1486. <Before>
  1487. <Byte>03</Byte>
  1488. <Byte>CE</Byte>
  1489. <Byte>83</Byte>
  1490. <Byte>F8</Byte>
  1491. <Byte>01</Byte>
  1492. </Before>
  1493. <Actual>
  1494. <Byte>89</Byte>
  1495. <Byte>4F</Byte>
  1496. <Byte>48</Byte>
  1497. </Actual>
  1498. <After>
  1499. <Byte>8D</Byte>
  1500. <Byte>53</Byte>
  1501. <Byte>01</Byte>
  1502. <Byte>7C</Byte>
  1503. <Byte>02</Byte>
  1504. </After>
  1505. </CodeEntry>
  1506. <CodeEntry>
  1507. <Description>hp +- 3 Code :mov [edi+48],ebx</Description>
  1508. <Address>007A1060</Address>
  1509. <ModuleName>Reckoning.exe</ModuleName>
  1510. <ModuleNameOffset>3A1060</ModuleNameOffset>
  1511. <Before>
  1512. <Byte>F7</Byte>
  1513. <Byte>10</Byte>
  1514. <Byte>01</Byte>
  1515. <Byte>EB</Byte>
  1516. <Byte>03</Byte>
  1517. </Before>
  1518. <Actual>
  1519. <Byte>89</Byte>
  1520. <Byte>5F</Byte>
  1521. <Byte>48</Byte>
  1522. </Actual>
  1523. <After>
  1524. <Byte>B1</Byte>
  1525. <Byte>40</Byte>
  1526. <Byte>84</Byte>
  1527. <Byte>8F</Byte>
  1528. <Byte>DC</Byte>
  1529. </After>
  1530. </CodeEntry>
  1531. <CodeEntry>
  1532. <Description>fate + 1 Code :mov [edx+00000204],eax</Description>
  1533. <Address>0082D30E</Address>
  1534. <ModuleName>Reckoning.exe</ModuleName>
  1535. <ModuleNameOffset>42D30E</ModuleNameOffset>
  1536. <Before>
  1537. <Byte>0C</Byte>
  1538. <Byte>3B</Byte>
  1539. <Byte>C1</Byte>
  1540. <Byte>73</Byte>
  1541. <Byte>0C</Byte>
  1542. </Before>
  1543. <Actual>
  1544. <Byte>89</Byte>
  1545. <Byte>82</Byte>
  1546. <Byte>04</Byte>
  1547. <Byte>02</Byte>
  1548. <Byte>00</Byte>
  1549. <Byte>00</Byte>
  1550. </Actual>
  1551. <After>
  1552. <Byte>83</Byte>
  1553. <Byte>C4</Byte>
  1554. <Byte>08</Byte>
  1555. <Byte>C2</Byte>
  1556. <Byte>04</Byte>
  1557. </After>
  1558. </CodeEntry>
  1559. <CodeEntry>
  1560. <Description>fate + 2 Code :mov [edx+00000204],ecx</Description>
  1561. <Address>0082D31A</Address>
  1562. <ModuleName>Reckoning.exe</ModuleName>
  1563. <ModuleNameOffset>42D31A</ModuleNameOffset>
  1564. <Before>
  1565. <Byte>C4</Byte>
  1566. <Byte>08</Byte>
  1567. <Byte>C2</Byte>
  1568. <Byte>04</Byte>
  1569. <Byte>00</Byte>
  1570. </Before>
  1571. <Actual>
  1572. <Byte>89</Byte>
  1573. <Byte>8A</Byte>
  1574. <Byte>04</Byte>
  1575. <Byte>02</Byte>
  1576. <Byte>00</Byte>
  1577. <Byte>00</Byte>
  1578. </Actual>
  1579. <After>
  1580. <Byte>83</Byte>
  1581. <Byte>C4</Byte>
  1582. <Byte>08</Byte>
  1583. <Byte>C2</Byte>
  1584. <Byte>04</Byte>
  1585. </After>
  1586. </CodeEntry>
  1587. <CodeEntry>
  1588. <Description>fate - Code :mov [eax+00000204],esi</Description>
  1589. <Address>00AF7D00</Address>
  1590. <ModuleName>Reckoning.exe</ModuleName>
  1591. <ModuleNameOffset>6F7D00</ModuleNameOffset>
  1592. <Before>
  1593. <Byte>F1</Byte>
  1594. <Byte>72</Byte>
  1595. <Byte>02</Byte>
  1596. <Byte>8B</Byte>
  1597. <Byte>F1</Byte>
  1598. </Before>
  1599. <Actual>
  1600. <Byte>89</Byte>
  1601. <Byte>B0</Byte>
  1602. <Byte>04</Byte>
  1603. <Byte>02</Byte>
  1604. <Byte>00</Byte>
  1605. <Byte>00</Byte>
  1606. </Actual>
  1607. <After>
  1608. <Byte>5F</Byte>
  1609. <Byte>33</Byte>
  1610. <Byte>C0</Byte>
  1611. <Byte>5E</Byte>
  1612. <Byte>C3</Byte>
  1613. </After>
  1614. </CodeEntry>
  1615. <CodeEntry>
  1616. <Description>skill point - Code :mov [eax+18],ecx</Description>
  1617. <Address>0089CFBA</Address>
  1618. <ModuleName>Reckoning.exe</ModuleName>
  1619. <ModuleNameOffset>49CFBA</ModuleNameOffset>
  1620. <Before>
  1621. <Byte>00</Byte>
  1622. <Byte>8B</Byte>
  1623. <Byte>4F</Byte>
  1624. <Byte>18</Byte>
  1625. <Byte>5E</Byte>
  1626. </Before>
  1627. <Actual>
  1628. <Byte>89</Byte>
  1629. <Byte>48</Byte>
  1630. <Byte>18</Byte>
  1631. </Actual>
  1632. <After>
  1633. <Byte>8B</Byte>
  1634. <Byte>57</Byte>
  1635. <Byte>1C</Byte>
  1636. <Byte>5D</Byte>
  1637. <Byte>89</Byte>
  1638. </After>
  1639. </CodeEntry>
  1640. <CodeEntry>
  1641. <Description>$ +- 1 Code :add [esi+00000364],eax</Description>
  1642. <Address>00A3C490</Address>
  1643. <ModuleName>Reckoning.exe</ModuleName>
  1644. <ModuleNameOffset>63C490</ModuleNameOffset>
  1645. <Before>
  1646. <Byte>00</Byte>
  1647. <Byte>5B</Byte>
  1648. <Byte>C3</Byte>
  1649. <Byte>CC</Byte>
  1650. <Byte>CC</Byte>
  1651. </Before>
  1652. <Actual>
  1653. <Byte>01</Byte>
  1654. <Byte>86</Byte>
  1655. <Byte>64</Byte>
  1656. <Byte>03</Byte>
  1657. <Byte>00</Byte>
  1658. <Byte>00</Byte>
  1659. </Actual>
  1660. <After>
  1661. <Byte>8B</Byte>
  1662. <Byte>86</Byte>
  1663. <Byte>64</Byte>
  1664. <Byte>03</Byte>
  1665. <Byte>00</Byte>
  1666. </After>
  1667. </CodeEntry>
  1668. <CodeEntry>
  1669. <Description>$ +- 2 Code :mov [esi+00000364],eax</Description>
  1670. <Address>00A3C4AC</Address>
  1671. <ModuleName>Reckoning.exe</ModuleName>
  1672. <ModuleNameOffset>63C4AC</ModuleNameOffset>
  1673. <Before>
  1674. <Byte>9C</Byte>
  1675. <Byte>C1</Byte>
  1676. <Byte>49</Byte>
  1677. <Byte>23</Byte>
  1678. <Byte>C1</Byte>
  1679. </Before>
  1680. <Actual>
  1681. <Byte>89</Byte>
  1682. <Byte>86</Byte>
  1683. <Byte>64</Byte>
  1684. <Byte>03</Byte>
  1685. <Byte>00</Byte>
  1686. <Byte>00</Byte>
  1687. </Actual>
  1688. <After>
  1689. <Byte>8B</Byte>
  1690. <Byte>8A</Byte>
  1691. <Byte>DC</Byte>
  1692. <Byte>32</Byte>
  1693. <Byte>00</Byte>
  1694. </After>
  1695. </CodeEntry>
  1696. <CodeEntry>
  1697. <Description>$ +- 3 Code :mov [esi+00000364],eax</Description>
  1698. <Address>00A3C4C4</Address>
  1699. <ModuleName>Reckoning.exe</ModuleName>
  1700. <ModuleNameOffset>63C4C4</ModuleNameOffset>
  1701. <Before>
  1702. <Byte>0D</Byte>
  1703. <Byte>8C</Byte>
  1704. <Byte>5A</Byte>
  1705. <Byte>BF</Byte>
  1706. <Byte>00</Byte>
  1707. </Before>
  1708. <Actual>
  1709. <Byte>89</Byte>
  1710. <Byte>86</Byte>
  1711. <Byte>64</Byte>
  1712. <Byte>03</Byte>
  1713. <Byte>00</Byte>
  1714. <Byte>00</Byte>
  1715. </Actual>
  1716. <After>
  1717. <Byte>8B</Byte>
  1718. <Byte>49</Byte>
  1719. <Byte>24</Byte>
  1720. <Byte>8B</Byte>
  1721. <Byte>11</Byte>
  1722. </After>
  1723. </CodeEntry>
  1724. <CodeEntry>
  1725. <Description>$ access Code :mov eax,[eax+00000364]</Description>
  1726. <Address>00B020EC</Address>
  1727. <ModuleName>Reckoning.exe</ModuleName>
  1728. <ModuleNameOffset>7020EC</ModuleNameOffset>
  1729. <Before>
  1730. <Byte>FF</Byte>
  1731. <Byte>85</Byte>
  1732. <Byte>C0</Byte>
  1733. <Byte>74</Byte>
  1734. <Byte>08</Byte>
  1735. </Before>
  1736. <Actual>
  1737. <Byte>8B</Byte>
  1738. <Byte>80</Byte>
  1739. <Byte>64</Byte>
  1740. <Byte>03</Byte>
  1741. <Byte>00</Byte>
  1742. <Byte>00</Byte>
  1743. </Actual>
  1744. <After>
  1745. <Byte>EB</Byte>
  1746. <Byte>02</Byte>
  1747. <Byte>33</Byte>
  1748. <Byte>C0</Byte>
  1749. <Byte>33</Byte>
  1750. </After>
  1751. </CodeEntry>
  1752. <CodeEntry>
  1753. <Description>cool down start Code :mov [ecx+esi+04],edx</Description>
  1754. <Address>00892ED0</Address>
  1755. <ModuleName>Reckoning.exe</ModuleName>
  1756. <ModuleNameOffset>492ED0</ModuleNameOffset>
  1757. <Before>
  1758. <Byte>04</Byte>
  1759. <Byte>8B</Byte>
  1760. <Byte>54</Byte>
  1761. <Byte>24</Byte>
  1762. <Byte>1C</Byte>
  1763. </Before>
  1764. <Actual>
  1765. <Byte>89</Byte>
  1766. <Byte>54</Byte>
  1767. <Byte>31</Byte>
  1768. <Byte>04</Byte>
  1769. </Actual>
  1770. <After>
  1771. <Byte>8B</Byte>
  1772. <Byte>43</Byte>
  1773. <Byte>04</Byte>
  1774. <Byte>80</Byte>
  1775. <Byte>4C</Byte>
  1776. </After>
  1777. </CodeEntry>
  1778. <CodeEntry>
  1779. <Description>cooling down Code :sub [esi+04],eax</Description>
  1780. <Address>00886D6B</Address>
  1781. <ModuleName>Reckoning.exe</ModuleName>
  1782. <ModuleNameOffset>486D6B</ModuleNameOffset>
  1783. <Before>
  1784. <Byte>00</Byte>
  1785. <Byte>00</Byte>
  1786. <Byte>00</Byte>
  1787. <Byte>EB</Byte>
  1788. <Byte>07</Byte>
  1789. </Before>
  1790. <Actual>
  1791. <Byte>29</Byte>
  1792. <Byte>46</Byte>
  1793. <Byte>04</Byte>
  1794. </Actual>
  1795. <After>
  1796. <Byte>FF</Byte>
  1797. <Byte>44</Byte>
  1798. <Byte>24</Byte>
  1799. <Byte>0C</Byte>
  1800. <Byte>45</Byte>
  1801. </After>
  1802. </CodeEntry>
  1803. <CodeEntry>
  1804. <Description>cool down set zero Code :mov [esi+04],00000000</Description>
  1805. <Address>00886D49</Address>
  1806. <ModuleName>Reckoning.exe</ModuleName>
  1807. <ModuleNameOffset>486D49</ModuleNameOffset>
  1808. <Before>
  1809. <Byte>02</Byte>
  1810. <Byte>C6</Byte>
  1811. <Byte>46</Byte>
  1812. <Byte>08</Byte>
  1813. <Byte>00</Byte>
  1814. </Before>
  1815. <Actual>
  1816. <Byte>C7</Byte>
  1817. <Byte>46</Byte>
  1818. <Byte>04</Byte>
  1819. <Byte>00</Byte>
  1820. <Byte>00</Byte>
  1821. <Byte>00</Byte>
  1822. <Byte>00</Byte>
  1823. </Actual>
  1824. <After>
  1825. <Byte>7C</Byte>
  1826. <Byte>11</Byte>
  1827. <Byte>8B</Byte>
  1828. <Byte>0D</Byte>
  1829. <Byte>54</Byte>
  1830. </After>
  1831. </CodeEntry>
  1832. <CodeEntry>
  1833. <Description>Heal HPCode :mov [edi+48],ecx</Description>
  1834. <Address>007A14F1</Address>
  1835. <ModuleName>Reckoning.exe</ModuleName>
  1836. <ModuleNameOffset>3A14F1</ModuleNameOffset>
  1837. <Before>
  1838. <Byte>94</Byte>
  1839. <Byte>07</Byte>
  1840. <Byte>83</Byte>
  1841. <Byte>F8</Byte>
  1842. <Byte>01</Byte>
  1843. </Before>
  1844. <Actual>
  1845. <Byte>89</Byte>
  1846. <Byte>4F</Byte>
  1847. <Byte>48</Byte>
  1848. </Actual>
  1849. <After>
  1850. <Byte>8D</Byte>
  1851. <Byte>53</Byte>
  1852. <Byte>01</Byte>
  1853. <Byte>7C</Byte>
  1854. <Byte>02</Byte>
  1855. </After>
  1856. </CodeEntry>
  1857. <CodeEntry>
  1858. <Description>Raise EXP Code :mov [eax+18],ecx</Description>
  1859. <Address>0089D7AA</Address>
  1860. <ModuleName>Reckoning.exe</ModuleName>
  1861. <ModuleNameOffset>49D7AA</ModuleNameOffset>
  1862. <Before>
  1863. <Byte>00</Byte>
  1864. <Byte>8B</Byte>
  1865. <Byte>4F</Byte>
  1866. <Byte>18</Byte>
  1867. <Byte>5E</Byte>
  1868. </Before>
  1869. <Actual>
  1870. <Byte>89</Byte>
  1871. <Byte>48</Byte>
  1872. <Byte>18</Byte>
  1873. </Actual>
  1874. <After>
  1875. <Byte>8B</Byte>
  1876. <Byte>57</Byte>
  1877. <Byte>1C</Byte>
  1878. <Byte>5D</Byte>
  1879. <Byte>89</Byte>
  1880. </After>
  1881. </CodeEntry>
  1882. <CodeEntry>
  1883. <Description>Gain Level Code :mov eax,[eax+000001F4]</Description>
  1884. <Address>00B0454C</Address>
  1885. <ModuleName>Reckoning.exe</ModuleName>
  1886. <ModuleNameOffset>70454C</ModuleNameOffset>
  1887. <Before>
  1888. <Byte>FF</Byte>
  1889. <Byte>85</Byte>
  1890. <Byte>C0</Byte>
  1891. <Byte>74</Byte>
  1892. <Byte>08</Byte>
  1893. </Before>
  1894. <Actual>
  1895. <Byte>8B</Byte>
  1896. <Byte>80</Byte>
  1897. <Byte>F4</Byte>
  1898. <Byte>01</Byte>
  1899. <Byte>00</Byte>
  1900. <Byte>00</Byte>
  1901. </Actual>
  1902. <After>
  1903. <Byte>EB</Byte>
  1904. <Byte>02</Byte>
  1905. <Byte>33</Byte>
  1906. <Byte>C0</Byte>
  1907. <Byte>33</Byte>
  1908. </After>
  1909. </CodeEntry>
  1910. <CodeEntry>
  1911. <Description>Real get level 1 Code :mov [edi+000001F4],eax</Description>
  1912. <Address>00847E0E</Address>
  1913. <ModuleName>Reckoning.exe</ModuleName>
  1914. <ModuleNameOffset>447E0E</ModuleNameOffset>
  1915. <Before>
  1916. <Byte>C6</Byte>
  1917. <Byte>50</Byte>
  1918. <Byte>12</Byte>
  1919. <Byte>00</Byte>
  1920. <Byte>00</Byte>
  1921. </Before>
  1922. <Actual>
  1923. <Byte>89</Byte>
  1924. <Byte>87</Byte>
  1925. <Byte>F4</Byte>
  1926. <Byte>01</Byte>
  1927. <Byte>00</Byte>
  1928. <Byte>00</Byte>
  1929. </Actual>
  1930. <After>
  1931. <Byte>E8</Byte>
  1932. <Byte>87</Byte>
  1933. <Byte>01</Byte>
  1934. <Byte>1D</Byte>
  1935. <Byte>00</Byte>
  1936. </After>
  1937. </CodeEntry>
  1938. <CodeEntry>
  1939. <Description>Real Get Level 2 Code :mov eax,[edi+000001F4]</Description>
  1940. <Address>00847E2C</Address>
  1941. <ModuleName>Reckoning.exe</ModuleName>
  1942. <ModuleNameOffset>447E2C</ModuleNameOffset>
  1943. <Before>
  1944. <Byte>BF</Byte>
  1945. <Byte>00</Byte>
  1946. <Byte>8B</Byte>
  1947. <Byte>49</Byte>
  1948. <Byte>24</Byte>
  1949. </Before>
  1950. <Actual>
  1951. <Byte>8B</Byte>
  1952. <Byte>87</Byte>
  1953. <Byte>F4</Byte>
  1954. <Byte>01</Byte>
  1955. <Byte>00</Byte>
  1956. <Byte>00</Byte>
  1957. </Actual>
  1958. <After>
  1959. <Byte>8B</Byte>
  1960. <Byte>11</Byte>
  1961. <Byte>8B</Byte>
  1962. <Byte>52</Byte>
  1963. <Byte>10</Byte>
  1964. </After>
  1965. </CodeEntry>
  1966. <CodeEntry>
  1967. <Description>DepleteFatebarCode :mov [eax+00000204],esi</Description>
  1968. <Address>09DA0000</Address>
  1969. <ModuleName/>
  1970. <ModuleNameOffset>0</ModuleNameOffset>
  1971. <Before/>
  1972. <Actual>
  1973. <Byte>89</Byte>
  1974. <Byte>B0</Byte>
  1975. <Byte>04</Byte>
  1976. <Byte>02</Byte>
  1977. <Byte>00</Byte>
  1978. <Byte>00</Byte>
  1979. </Actual>
  1980. <After>
  1981. <Byte>E9</Byte>
  1982. <Byte>DB</Byte>
  1983. <Byte>83</Byte>
  1984. <Byte>D5</Byte>
  1985. <Byte>F6</Byte>
  1986. </After>
  1987. </CodeEntry>
  1988. <CodeEntry>
  1989. <Description>EXPCode :mov [eax+18],ecx</Description>
  1990. <Address>0089D7AA</Address>
  1991. <ModuleName>Reckoning.exe</ModuleName>
  1992. <ModuleNameOffset>49D7AA</ModuleNameOffset>
  1993. <Before>
  1994. <Byte>00</Byte>
  1995. <Byte>8B</Byte>
  1996. <Byte>4F</Byte>
  1997. <Byte>18</Byte>
  1998. <Byte>5E</Byte>
  1999. </Before>
  2000. <Actual>
  2001. <Byte>89</Byte>
  2002. <Byte>48</Byte>
  2003. <Byte>18</Byte>
  2004. </Actual>
  2005. <After>
  2006. <Byte>8B</Byte>
  2007. <Byte>57</Byte>
  2008. <Byte>1C</Byte>
  2009. <Byte>5D</Byte>
  2010. <Byte>89</Byte>
  2011. </After>
  2012. </CodeEntry>
  2013. <CodeEntry>
  2014. <Description>MaxHPIncreasonlvlupCode :mov [edi+4C],eax</Description>
  2015. <Address>007A0C5B</Address>
  2016. <ModuleName>Reckoning.exe</ModuleName>
  2017. <ModuleNameOffset>3A0C5B</ModuleNameOffset>
  2018. <Before>
  2019. <Byte>CE</Byte>
  2020. <Byte>FF</Byte>
  2021. <Byte>83</Byte>
  2022. <Byte>F8</Byte>
  2023. <Byte>01</Byte>
  2024. </Before>
  2025. <Actual>
  2026. <Byte>89</Byte>
  2027. <Byte>47</Byte>
  2028. <Byte>4C</Byte>
  2029. </Actual>
  2030. <After>
  2031. <Byte>B9</Byte>
  2032. <Byte>01</Byte>
  2033. <Byte>00</Byte>
  2034. <Byte>00</Byte>
  2035. <Byte>00</Byte>
  2036. </After>
  2037. </CodeEntry>
  2038. </CheatCodes>
  2039. <UserdefinedSymbols>
  2040. <SymbolEntry>
  2041. <Name>EnemyNummberPointer</Name>
  2042. <Address>18430000</Address>
  2043. </SymbolEntry>
  2044. <SymbolEntry>
  2045. <Name>pSkillPt</Name>
  2046. <Address>01870000</Address>
  2047. </SymbolEntry>
  2048. <SymbolEntry>
  2049. <Name>pHeroHealth</Name>
  2050. <Address>1E9C0000</Address>
  2051. </SymbolEntry>
  2052. <SymbolEntry>
  2053. <Name>pMoney</Name>
  2054. <Address>1EA30000</Address>
  2055. </SymbolEntry>
  2056. <SymbolEntry>
  2057. <Name>cooldownJMP</Name>
  2058. <Address>00888EDE</Address>
  2059. </SymbolEntry>
  2060. <SymbolEntry>
  2061. <Name>repairJMP</Name>
  2062. <Address>008BE36F</Address>
  2063. </SymbolEntry>
  2064. <SymbolEntry>
  2065. <Name>fateBJMP</Name>
  2066. <Address>0082DA0C</Address>
  2067. </SymbolEntry>
  2068. <SymbolEntry>
  2069. <Name>pLvlUpPt</Name>
  2070. <Address>19820000</Address>
  2071. </SymbolEntry>
  2072. <SymbolEntry>
  2073. <Name>pExp</Name>
  2074. <Address>19830000</Address>
  2075. </SymbolEntry>
  2076. <SymbolEntry>
  2077. <Name>AttackWeightPointer</Name>
  2078. <Address>1EA60000</Address>
  2079. </SymbolEntry>
  2080. <SymbolEntry>
  2081. <Name>EXPPointer</Name>
  2082. <Address>003D0000</Address>
  2083. </SymbolEntry>
  2084. <SymbolEntry>
  2085. <Name>hHSubCJMP</Name>
  2086. <Address>007A1571</Address>
  2087. </SymbolEntry>
  2088. <SymbolEntry>
  2089. <Name>Counter</Name>
  2090. <Address>1E9E0000</Address>
  2091. </SymbolEntry>
  2092. <SymbolEntry>
  2093. <Name>ManaCounter</Name>
  2094. <Address>1EA00000</Address>
  2095. </SymbolEntry>
  2096. <SymbolEntry>
  2097. <Name>TotalEXP</Name>
  2098. <Address>00230000</Address>
  2099. </SymbolEntry>
  2100. <SymbolEntry>
  2101. <Name>pTotalEXP</Name>
  2102. <Address>0A920000</Address>
  2103. </SymbolEntry>
  2104. <SymbolEntry>
  2105. <Name>hHSubFJMP</Name>
  2106. <Address>0086441A</Address>
  2107. </SymbolEntry>
  2108. <SymbolEntry>
  2109. <Name>hHSubGJMP</Name>
  2110. <Address>0089D7A9</Address>
  2111. </SymbolEntry>
  2112. <SymbolEntry>
  2113. <Name>hHReadJMP</Name>
  2114. <Address>007A1E05</Address>
  2115. </SymbolEntry>
  2116. <SymbolEntry>
  2117. <Name>hHSubAJMP</Name>
  2118. <Address>007A1575</Address>
  2119. </SymbolEntry>
  2120. <SymbolEntry>
  2121. <Name>hHSubEJMP</Name>
  2122. <Address>007A0C58</Address>
  2123. </SymbolEntry>
  2124. <SymbolEntry>
  2125. <Name>hHSubBJMP</Name>
  2126. <Address>007A14EC</Address>
  2127. </SymbolEntry>
  2128. <SymbolEntry>
  2129. <Name>MPSubJMP</Name>
  2130. <Address>0079ABC1</Address>
  2131. </SymbolEntry>
  2132. <SymbolEntry>
  2133. <Name>ManaRegSubJMP</Name>
  2134. <Address>0079AB22</Address>
  2135. </SymbolEntry>
  2136. <SymbolEntry>
  2137. <Name>FateSubJMP</Name>
  2138. <Address>0082DA00</Address>
  2139. </SymbolEntry>
  2140. <SymbolEntry>
  2141. <Name>moneyReadJMP</Name>
  2142. <Address>00B027CC</Address>
  2143. </SymbolEntry>
  2144. <SymbolEntry>
  2145. <Name>moneySubJMP</Name>
  2146. <Address>00A3BE30</Address>
  2147. </SymbolEntry>
  2148. <SymbolEntry>
  2149. <Name>hHSubDJMP</Name>
  2150. <Address>0088A42E</Address>
  2151. </SymbolEntry>
  2152. </UserdefinedSymbols>
  2153. </CheatTable>
Add Comment
Please, Sign In to add comment