657
"pCoords"
Auto Assembler Script
[ENABLE]
aobscanmodule(_Teleport,DOOMx64.exe,8B 81 C0 1A 00 00) // should be unique
alloc(newmem,$1000,DOOMx64.exe)
alloc(pCoords,8)
alloc(trigger_SavePosition,4)
alloc(trigger_LoadPosition,4)
alloc(trigger_UndoTeleport,4)
alloc(trigger_NoClip_FW,4)
alloc(trigger_NoClip_BW,4)
alloc(trigger_NoClip_L,4)
alloc(trigger_NoClip_R,4)
alloc(trigger_NoClip_Up,4)
alloc(trigger_NoClip_Do,4)
alloc(MP_Location_1,4)
alloc(MP_Location_2,4)
alloc(MP_Location_3,4)
alloc(MP_Location_4,4)
alloc(MP_Location_5,4)
alloc(MP_Location_6,4)
alloc(MP_Location_7,4)
alloc(MP_Location_8,4)
alloc(MP_Location_9,4)
alloc(MP_Location_10,4)
alloc(Costum_Location_X,8)
alloc(Costum_Location_Y,8)
alloc(Costum_Location_Z,8)
alloc(enable_Costum_Location,4)
alloc(StoredCoord_X,8)
alloc(StoredCoord_Y,8)
alloc(StoredCoord_Z,8)
alloc(StoredCoord_Undo_X,8)
alloc(StoredCoord_Undo_Y,8)
alloc(StoredCoord_Undo_Z,8)
alloc(NoclipSpeedValue,8)
alloc(NoclipSpeedValue_Up_Do,8)
label(code)
label(return)
label(SavePosition)
label(LoadPosition)
label(UndoTeleport)
label(Noclip_FW)
label(Noclip_BW)
label(Noclip_L)
label(Noclip_R)
label(Noclip_Up)
label(Noclip_Do)
label(Location_1)
label(Location_2)
label(Location_3)
label(Location_4)
label(Location_5)
label(Location_6)
label(Location_7)
label(Location_8)
label(Location_9)
label(Location_10)
label(Costum_Location)
newmem:
cmp [rcx+68],(int)0 // 0 should be enemys only
// cmp [rcx+260],(int)0 = enemy
//MOV [rcx+00001AC0],(float)-200
je code
mov [pCoords],rcx // move our base into pCoords
cmp byte ptr [trigger_SavePosition],1
je SavePosition
cmp byte ptr [trigger_LoadPosition],1
je LoadPosition
cmp byte ptr [trigger_UndoTeleport],1
je UndoTeleport
cmp byte ptr [trigger_NoClip_FW],1
je Noclip_FW
cmp byte ptr [trigger_NoClip_BW],1
je Noclip_BW
cmp byte ptr [trigger_NoClip_L],1
je Noclip_L
cmp byte ptr [trigger_NoClip_R],1
je Noclip_R
cmp byte ptr [trigger_NoClip_Up],1
je Noclip_Up
cmp byte ptr [trigger_NoClip_Do],1
je Noclip_Do
cmp byte ptr [MP_Location_1],1
je Location_1
cmp byte ptr [MP_Location_2],1
je Location_2
cmp byte ptr [MP_Location_3],1
je Location_3
cmp byte ptr [MP_Location_4],1
je Location_4
cmp byte ptr [MP_Location_5],1
je Location_5
cmp byte ptr [MP_Location_6],1
je Location_6
cmp byte ptr [MP_Location_7],1
je Location_7
cmp byte ptr [MP_Location_8],1
je Location_8
cmp byte ptr [MP_Location_9],1
je Location_9
cmp byte ptr [MP_Location_10],1
je Location_10
cmp byte ptr [enable_Costum_Location],1
je Costum_Location
jmp code
SavePosition:
mov [trigger_SavePosition],0
movss xmm1,[rcx+00001AB8]
movss [StoredCoord_X],xmm1
movss xmm1,[rcx+00001AC0]
movss [StoredCoord_Z],xmm1
movss xmm1,[rcx+00001ABC]
movss [StoredCoord_Y],xmm1
jmp code
LoadPosition:
mov [trigger_LoadPosition],0
//for undo teleport
movss xmm2,[rcx+00001AB8]
movss [StoredCoord_Undo_X],xmm2
movss xmm2,[rcx+00001AC0]
movss [StoredCoord_Undo_Z],xmm2
movss xmm2,[rcx+00001ABC]
movss [StoredCoord_Undo_Y],xmm2
// for undo teleport
movss xmm1,[StoredCoord_X]
movss [rcx+00001AB8],xmm1
movss xmm1,[StoredCoord_Z]
movss [rcx+00001AC0],xmm1
movss xmm1,[StoredCoord_Y]
movss [rcx+00001ABC],xmm1
jmp code
UndoTeleport:
mov [trigger_UndoTeleport],0
movss xmm2,[StoredCoord_Undo_X]
movss [rcx+00001AB8],xmm2
movss xmm2,[StoredCoord_Undo_Z]
movss [rcx+00001AC0],xmm2
movss xmm2,[StoredCoord_Undo_Y]
movss [rcx+00001ABC],xmm2
jmp code
Noclip_FW:
mov byte ptr [trigger_NoClip_FW],0
fld [rcx+00001AB8]
fld [NoclipSpeedValue]
faddp
fstp [rcx+00001AB8]
jmp code
Noclip_BW:
mov byte ptr [trigger_NoClip_BW],0
fld [rcx+00001AB8]
fld [NoclipSpeedValue]
fsubp
fstp [rcx+00001AB8]
jmp code
Noclip_L:
mov byte ptr [trigger_NoClip_L],0
fld [rcx+00001ABC]
fld [NoclipSpeedValue]
faddp
fstp [rcx+00001ABC]
jmp code
Noclip_R:
mov byte ptr [trigger_NoClip_R],0
fld [rcx+00001ABC]
fld [NoclipSpeedValue]
fsubp
fstp [rcx+00001ABC]
jmp code
Noclip_Up:
mov byte ptr [trigger_NoClip_Up],0
fld [rcx+00001AC0]
fld [NoclipSpeedValue_Up_Do]
faddp
fstp [rcx+00001AC0]
jmp code
Noclip_Do:
mov byte ptr [trigger_NoClip_Do],0
fld [rcx+00001AC0]
fld [NoclipSpeedValue_Up_Do]
fsubp
fstp [rcx+00001AC0]
jmp code
Location_1:
mov [MP_Location_1],0
mov [rcx+00001AB8],(float)4011.462158
mov [rcx+00001AC0],(float)1084.205444
mov [rcx+00001ABC],(float)2060.570068
jmp code
Location_2:
mov [MP_Location_2],0
mov [rcx+00001AB8],(float)-293.1150818
mov [rcx+00001AC0],(float)1080.720703
mov [rcx+00001ABC],(float)-1925.415527
jmp code
Location_3:
mov [MP_Location_3],0
mov [rcx+00001AB8],(float)0
mov [rcx+00001AC0],(float)0
mov [rcx+00001ABC],(float)0
jmp code
Location_4:
mov [MP_Location_4],0
mov [rcx+00001AB8],(float)0
mov [rcx+00001AC0],(float)0
mov [rcx+00001ABC],(float)0
jmp code
Location_5:
mov [MP_Location_5],0
mov [rcx+00001AB8],(float)0
mov [rcx+00001AC0],(float)0
mov [rcx+00001ABC],(float)0
jmp code
Location_6:
mov [MP_Location_6],0
mov [rcx+00001AB8],(float)0
mov [rcx+00001AC0],(float)0
mov [rcx+00001ABC],(float)0
jmp code
Location_7:
mov [MP_Location_7],0
mov [rcx+00001AB8],(float)0
mov [rcx+00001AC0],(float)0
mov [rcx+00001ABC],(float)0
jmp code
Location_8:
mov [MP_Location_8],0
mov [rcx+00001AB8],(float)0
mov [rcx+00001AC0],(float)0
mov [rcx+00001ABC],(float)0
jmp code
Location_9:
mov [MP_Location_9],0
mov [rcx+00001AB8],(float)0
mov [rcx+00001AC0],(float)0
mov [rcx+00001ABC],(float)0
jmp code
Location_10:
mov [MP_Location_10],0
mov [rcx+00001AB8],(float)0
mov [rcx+00001AC0],(float)0
mov [rcx+00001ABC],(float)0
jmp code
Costum_Location:
mov [enable_Costum_Location],0
movss xmm2,[Costum_Location_X]
movss [rcx+00001AB8],xmm2
movss xmm2,[Costum_Location_Y]
movss [rcx+00001AC0],xmm2
movss xmm2,[Costum_Location_Z]
movss [rcx+00001ABC],xmm2
jmp code
code:
mov eax,[rcx+00001AC0]
jmp return
_Teleport:
jmp newmem
nop
return:
trigger_SavePosition:
dd 0
trigger_LoadPosition:
dd 0
trigger_UndoTeleport:
dd 0
trigger_NoClip_FW:
dd 0
trigger_NoClip_BW:
dd 0
trigger_NoClip_L:
dd 0
trigger_NoClip_R:
dd 0
trigger_NoClip_Up:
dd 0
trigger_NoClip_Do:
dd 0
StoredCoord_X:
dq 0
StoredCoord_Y:
dq 0
StoredCoord_Z:
dq 0
StoredCoord_Undo_X:
dq 0
StoredCoord_Undo_Y:
dq 0
StoredCoord_Undo_Z:
dq 0
pCoords:
dq 0
NoclipSpeedValue:
dq (float)20.0
NoclipSpeedValue_Up_Do:
dq (float)100.0
MP_Location_1:
dd 0
MP_Location_2:
dd 0
MP_Location_3:
dd 0
MP_Location_4:
dd 0
MP_Location_5:
dd 0
MP_Location_6:
dd 0
MP_Location_7:
dd 0
MP_Location_8:
dd 0
MP_Location_9:
dd 0
MP_Location_10:
dd 0
Costum_Location_X:
dq 0
Costum_Location_Y:
dq 0
Costum_Location_Z:
dq 0
enable_Costum_Location:
dd 0
registersymbol(_Teleport)
registersymbol(trigger_SavePosition)
registersymbol(trigger_LoadPosition)
registersymbol(trigger_UndoTeleport)
registersymbol(trigger_NoClip_FW)
registersymbol(trigger_NoClip_BW)
registersymbol(trigger_NoClip_L)
registersymbol(trigger_NoClip_R)
registersymbol(trigger_NoClip_Up)
registersymbol(trigger_NoClip_Do)
registersymbol(trigger_UndoTeleport)
registersymbol(StoredCoord_X)
registersymbol(StoredCoord_Y)
registersymbol(StoredCoord_Z)
registersymbol(StoredCoord_Undo_X)
registersymbol(StoredCoord_Undo_Y)
registersymbol(StoredCoord_Undo_Z)
registersymbol(pCoords)
registersymbol(NoclipSpeedValue)
registersymbol(NoclipSpeedValue_Up_Do)
registersymbol(MP_Location_1)
registersymbol(MP_Location_2)
registersymbol(MP_Location_3)
registersymbol(MP_Location_4)
registersymbol(MP_Location_5)
registersymbol(MP_Location_6)
registersymbol(MP_Location_7)
registersymbol(MP_Location_8)
registersymbol(MP_Location_9)
registersymbol(MP_Location_10)
registersymbol(Costum_Location_X)
registersymbol(Costum_Location_Y)
registersymbol(Costum_Location_Z)
registersymbol(enable_Costum_Location)
[DISABLE]
_Teleport:
db 8B 81 C0 1A 00 00
unregistersymbol(_Teleport)
dealloc(newmem)
dealloc(trigger_SavePosition)
dealloc(trigger_LoadPosition)
dealloc(trigger_UndoTeleport)
dealloc(trigger_NoClip_FW)
dealloc(trigger_NoClip_BW)
dealloc(trigger_NoClip_L)
dealloc(trigger_NoClip_R)
dealloc(trigger_NoClip_Up)
dealloc(trigger_NoClip_Do)
dealloc(StoredCoord_X)
dealloc(StoredCoord_Y)
dealloc(StoredCoord_Z)
dealloc(StoredCoord_Undo_X)
dealloc(StoredCoord_Undo_Y)
dealloc(StoredCoord_Undo_Z)
dealloc(pCoords)
dealloc(NoclipSpeedValue)
dealloc(NoclipSpeedValue_Up_Do)
dealloc(MP_Location_1)
dealloc(MP_Location_2)
dealloc(MP_Location_3)
dealloc(MP_Location_4)
dealloc(MP_Location_5)
dealloc(MP_Location_6)
dealloc(MP_Location_7)
dealloc(MP_Location_8)
dealloc(MP_Location_9)
dealloc(MP_Location_10)
dealloc(Costum_Location_X)
dealloc(Costum_Location_Y)
dealloc(Costum_Location_Z)
dealloc(enable_Costum_Location)
unregistersymbol(trigger_SavePosition)
unregistersymbol(trigger_LoadPosition)
unregistersymbol(trigger_UndoTeleport)
unregistersymbol(trigger_NoClip_FW)
unregistersymbol(trigger_NoClip_BW)
unregistersymbol(trigger_NoClip_L)
unregistersymbol(trigger_NoClip_R)
unregistersymbol(trigger_NoClip_Up)
unregistersymbol(trigger_NoClip_Do)
unregistersymbol(StoredCoord_X)
unregistersymbol(StoredCoord_Y)
unregistersymbol(StoredCoord_Z)
unregistersymbol(StoredCoord_Undo_X)
unregistersymbol(StoredCoord_Undo_Y)
unregistersymbol(StoredCoord_Undo_Z)
unregistersymbol(pCoords)
unregistersymbol(NoclipSpeedValue)
unregistersymbol(NoclipSpeedValue_Up_Do)
unregistersymbol(MP_Location_1)
unregistersymbol(MP_Location_2)
unregistersymbol(MP_Location_3)
unregistersymbol(MP_Location_4)
unregistersymbol(MP_Location_5)
unregistersymbol(MP_Location_6)
unregistersymbol(MP_Location_7)
unregistersymbol(MP_Location_8)
unregistersymbol(MP_Location_9)
unregistersymbol(MP_Location_10)
unregistersymbol(Costum_Location_X)
unregistersymbol(Costum_Location_Y)
unregistersymbol(Costum_Location_Z)
unregistersymbol(enable_Costum_Location)
{
// ORIGINAL CODE - INJECTION POINT: "DOOMx64.exe"+18460E51
"DOOMx64.exe"+18460E22: 48 31 E0 - xor rax,rsp
"DOOMx64.exe"+18460E25: 48 89 84 24 E0 00 00 00 - mov [rsp+000000E0],rax
"DOOMx64.exe"+18460E2D: E9 CE F1 4A 05 - jmp 15D910000
"DOOMx64.exe"+18460E32: 90 - nop
"DOOMx64.exe"+18460E33: 48 89 CB - mov rbx,rcx
"DOOMx64.exe"+18460E36: 31 FF - xor edi,edi
"DOOMx64.exe"+18460E38: 89 81 B4 1F 00 00 - mov [rcx+00001FB4],eax
"DOOMx64.exe"+18460E3E: 8B 81 BC 1A 00 00 - mov eax,[rcx+00001ABC]
"DOOMx64.exe"+18460E44: 4C 8D B3 B0 1F 00 00 - lea r14,[rbx+00001FB0]
"DOOMx64.exe"+18460E4B: 89 81 B8 1F 00 00 - mov [rcx+00001FB8],eax
// ---------- INJECTING HERE ----------
"DOOMx64.exe"+18460E51: 8B 81 C0 1A 00 00 - mov eax,[rcx+00001AC0]
// ---------- DONE INJECTING ----------
"DOOMx64.exe"+18460E57: 89 81 BC 1F 00 00 - mov [rcx+00001FBC],eax
"DOOMx64.exe"+18460E5D: 48 8B 89 E0 00 00 00 - mov rcx,[rcx+000000E0]
"DOOMx64.exe"+18460E64: 48 81 C1 94 00 00 00 - add rcx,00000094
"DOOMx64.exe"+18460E6B: 8B 01 - mov eax,[rcx]
"DOOMx64.exe"+18460E6D: 89 83 C0 1F 00 00 - mov [rbx+00001FC0],eax
"DOOMx64.exe"+18460E73: 8B 41 04 - mov eax,[rcx+04]
"DOOMx64.exe"+18460E76: 89 83 C4 1F 00 00 - mov [rbx+00001FC4],eax
"DOOMx64.exe"+18460E7C: 8B 41 08 - mov eax,[rcx+08]
"DOOMx64.exe"+18460E7F: 89 83 C8 1F 00 00 - mov [rbx+00001FC8],eax
"DOOMx64.exe"+18460E85: 8B 41 0C - mov eax,[rcx+0C]
}
666
"Triggrer"
1
661
"Save Position - Hotkey = Numpad +"
1:On
0:Off
Byte
trigger_SavePosition
Set Value
107
1
0
667
"Load Position - Hotkey = Numpad -"
1:On
0:Off
Byte
trigger_LoadPosition
Set Value
109
1
0
668
"UndoTeleportation - Hotkey = Numpad *"
1:On
0:Off
Byte
trigger_UndoTeleport
Set Value
106
1
0
692
"Noclip Upward - HotKey = Page Up"
1:On
0:Off
Byte
trigger_Noclip_Up
691
"Noclip Rightward - HotKey = Arrow Right"
1:On
0:Off
Byte
trigger_Noclip_R
Set Value
39
1
0
690
"Noclip Leftward - HotKey = Arrow Left"
1:On
0:Off
Byte
trigger_Noclip_L
Set Value
37
1
0
688
"Noclip Foward - HotKey = Arrow Up"
1:On
0:Off
Byte
trigger_Noclip_FW
Set Value
38
1
0
693
"Noclip Downward - HotKey = Page Down"
1:On
0:Off
Byte
trigger_Noclip_Do
Set Value
34
1
0
689
"Noclip Backward - HotKey = Arrow Down"
1:On
0:Off
Byte
trigger_Noclip_BW
Set Value
40
1
0
718
"MP Teleport to Location 1 - Demon Ball - HotKey = CTRL+F1"
0:Off
1:On
Byte
MP_Location_1
Set Value
17
112
1
0
719
"MP Teleport to Location 2 - Crane - HotKey = CTRL+F2"
0:Off
1:On
Byte
MP_Location_2
Set Value
17
113
1
0
720
"MP Teleport to Location 3 - Empty"
0:Off
1:On
Byte
MP_Location_3
721
"MP Teleport to Location 4 - Empty"
0:Off
1:On
Byte
MP_Location_4
722
"MP Teleport to Location 5 - Empty"
0:Off
1:On
Byte
MP_Location_5
723
"MP Teleport to Location 6 - Empty"
0:Off
1:On
Byte
MP_Location_6
724
"MP Teleport to Location 7 - Empty"
0:Off
1:On
Byte
MP_Location_7
725
"MP Teleport to Location 8 - Empty"
0:Off
1:On
Byte
MP_Location_8
726
"MP Teleport to Location 9 - Empty"
0:Off
1:On
Byte
MP_Location_9
727
"MP Teleport to Location 10 - Empty"
0:Off
1:On
Byte
MP_Location_10
695
"Noclip Speed Multiplier"
1
696
"Noclip Speed Y"
Float
NoclipSpeedValue_Up_Do
694
"Noclip Speed X,Z"
Float
NoclipSpeedValue
662
"Debug"
1
663
"Saved Coord X"
Float
StoredCoord_X
665
"Saved Coord Z"
Float
StoredCoord_Z
664
"Saved Coord Y"
Float
StoredCoord_Y
652
"Coordinates"
1
658
"X Coordinate"
Float
pCoords
1AB8
659
"Z Coordinate"
Float
pCoords
1AC0
Increase Value
32
50
0
660
"Y Coordinate"
Float
pCoords
1ABC
732
"Costum Location"
1
728
"MP Teleport to Costum Location"
0:Off
1:On
Byte
enable_Costum_Location
729
"Set Costum Location X here"
Float
Costum_Location_X
730
"Set Costum Location Z here"
Float
Costum_Location_Z
731
"Set Costum Location Y here"
Float
Costum_Location_Y
764
"pGravity"
Auto Assembler Script
[ENABLE]
aobscanmodule(_Gravity,DOOMx64.exe,00 F3 0F 10 96 28 1E 00 00) // should be unique
alloc(newmem,$1000,DOOMx64.exe)
alloc(Increase_Gravity,4)
alloc(Decrease_Gravity,4)
alloc(GravityValue,8)
alloc(GravityValueAddSub,8)
registersymbol(Increase_Gravity)
registersymbol(Decrease_Gravity)
registersymbol(GravityValue)
registersymbol(GravityValueAddSub)
registersymbol(_Gravity)
label(code)
label(return)
label(IncreaseGravity)
label(DecreaseGravity)
label(Restore_0)
label(Restore_1)
newmem:
cmp [rsi+68],(int)0 // 0 should be enemys only
je code
mov [GravityValue],rsi
cmp [Increase_Gravity],1
je IncreaseGravity
cmp [Decrease_Gravity],1
je DecreaseGravity
jmp code
IncreaseGravity:
mov [Increase_Gravity],0
cmp [rsi+00001E28],(float)1
jg Restore_1
fld [rsi+00001E28]
fld [GravityValueAddSub]
faddp
fstp [rsi+00001E28]
jmp code
DecreaseGravity:
mov [Decrease_Gravity],0
cmp [rsi+00001E28],(float)0
jl Restore_0
fld [rsi+00001E28]
fld [GravityValueAddSub]
fsubp
fstp [rsi+00001E28]
jmp code
Restore_1:
mov [rsi+00001E28],(float)1
jmp code
Restore_0:
mov [rsi+00001E28],(float)0
jmp code
code:
movss xmm2,[rsi+00001E28]
jmp return
_Gravity+01:
jmp newmem
nop
nop
nop
return:
GravityValueAddSub:
dq (float)0.025
[DISABLE]
_Gravity+01:
db F3 0F 10 96 28 1E 00 00
unregistersymbol(Increase_Gravity)
unregistersymbol(Decrease_Gravity)
unregistersymbol(GravityValue)
unregistersymbol(GravityValueAddSub)
unregistersymbol(_Gravity)
dealloc(newmem)
dealloc(Increase_Gravity)
dealloc(Decrease_Gravity)
dealloc(GravityValue)
dealloc(GravityValueAddSub)
{
// ORIGINAL CODE - INJECTION POINT: "DOOMx64.exe"+18633A3A
"DOOMx64.exe"+18633A1A: 62 01 - bound eax,[rcx]
"DOOMx64.exe"+18633A1C: 00 00 - add [rax],al
"DOOMx64.exe"+18633A1E: 83 F9 01 - cmp ecx,01
"DOOMx64.exe"+18633A21: 75 0E - jne DOOMx64.exe+18633A31
"DOOMx64.exe"+18633A23: 48 89 F1 - mov rcx,rsi
"DOOMx64.exe"+18633A26: E8 25 55 FD FF - call DOOMx64.exe+18608F50
"DOOMx64.exe"+18633A2B: E9 50 01 00 00 - jmp DOOMx64.exe+18633B80
"DOOMx64.exe"+18633A30: AF - scasd
"DOOMx64.exe"+18633A31: 83 F9 08 - cmp ecx,08
"DOOMx64.exe"+18633A34: 0F 84 46 01 00 00 - je DOOMx64.exe+18633B80
// ---------- INJECTING HERE ----------
"DOOMx64.exe"+18633A3A: F3 0F 10 96 28 1E 00 00 - movss xmm2,[rsi+00001E28]
// ---------- DONE INJECTING ----------
"DOOMx64.exe"+18633A42: 0F 28 C2 - movaps xmm0,xmm2
"DOOMx64.exe"+18633A45: 0F 28 CA - movaps xmm1,xmm2
"DOOMx64.exe"+18633A48: F3 0F 59 56 4C - mulss xmm2,[rsi+4C]
"DOOMx64.exe"+18633A4D: F3 0F 59 46 44 - mulss xmm0,[rsi+44]
"DOOMx64.exe"+18633A52: F3 0F 59 4E 48 - mulss xmm1,[rsi+48]
"DOOMx64.exe"+18633A57: F3 0F 11 54 24 28 - movss [rsp+28],xmm2
"DOOMx64.exe"+18633A5D: F3 0F 11 44 24 20 - movss [rsp+20],xmm0
"DOOMx64.exe"+18633A63: F3 0F 11 4C 24 24 - movss [rsp+24],xmm1
"DOOMx64.exe"+18633A69: 8B 44 24 20 - mov eax,[rsp+20]
"DOOMx64.exe"+18633A6D: 0B 44 24 24 - or eax,[rsp+24]
}
769
"Trigger"
1
768
"Increase Gravity by 0.025 - Hotkey = F7"
0:Off
1:On
Byte
Increase_Gravity
Set Value
118
1
0
770
"Decrease Gravity - Hotkey = F8"
0:Off
1:On
Byte
Decrease_Gravity
Set Value
119
1
0
771
"Gravity Anmount to Add/Sub"
Float
GravityValueAddSub
765
"Current Gravity"
Float
GravityValue
1E28
766
"Jump Force Forward/Backward (3 is good value)"
Float
GravityValue
1E0C
767
"Jump Force Left/Right (3 is good value)"
Float
GravityValue
1E10
714
"No Spread"
Auto Assembler Script
{ Game : DOOMx64.exe
Version:
Date : 2016-07-05
Author : Schr4nzi
This script does blah blah blah
}
[ENABLE]
aobscanmodule(_SpreadFunc,DOOMx64.exe,55 56 57 41 54 41 55 41 56 41 57 B8 40 81)
aobscanmodule(_NoSpread,DOOMx64.exe,F3 0F 10 41 18 48 83 C4 18 C3 88) // should be unique
alloc(newmem,$1000,"DOOMx64.exe"+184FFC40)
label(code)
label(return)
_SpreadFunc:
db c3
newmem:
cmp [rcx+18],(float)0.9
jg code
cmp [rcx+18],(float)1
je code
cmp [rcx+18],(float)2
je code
cmp [rcx+18],(float)6
je code
mov [rcx+18],(float)0
code:
movss xmm0,[rcx+18]
jmp return
_NoSpread:
jmp newmem
return:
registersymbol(_NoSpread)
registersymbol(_SpreadFunc)
[DISABLE]
_NoSpread:
db F3 0F 10 41 18
_SpreadFunc:
db 55
unregistersymbol(_NoSpread)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "DOOMx64.exe"+184FFC40
"DOOMx64.exe"+184FFC23: F3 0F 10 41 18 - movss xmm0,[rcx+18]
"DOOMx64.exe"+184FFC28: 48 83 C4 18 - add rsp,18
"DOOMx64.exe"+184FFC2C: C3 - ret
"DOOMx64.exe"+184FFC2D: 00 31 - add [rcx],dh
"DOOMx64.exe"+184FFC2F: 38 69 0F - cmp [rcx+0F],ch
"DOOMx64.exe"+184FFC32: 39 D0 - cmp eax,edx
"DOOMx64.exe"+184FFC34: 7C 15 - jl DOOMx64.exe+184FFC4B
"DOOMx64.exe"+184FFC36: 8B 41 10 - mov eax,[rcx+10]
"DOOMx64.exe"+184FFC39: 0F 28 34 24 - movaps xmm6,[rsp]
"DOOMx64.exe"+184FFC3D: 89 41 18 - mov [rcx+18],eax
// ---------- INJECTING HERE ----------
"DOOMx64.exe"+184FFC40: F3 0F 10 41 18 - movss xmm0,[rcx+18]
// ---------- DONE INJECTING ----------
"DOOMx64.exe"+184FFC45: 48 83 C4 18 - add rsp,18
"DOOMx64.exe"+184FFC49: C3 - ret
"DOOMx64.exe"+184FFC4A: 88 F3 - mov bl,dh
"DOOMx64.exe"+184FFC4C: 0F 10 61 10 - movups xmm4,[rcx+10]
"DOOMx64.exe"+184FFC50: 66 0F 6F 2D C8 DF 70 E9 - movdqa xmm5,[DOOMx64.exe+1C0DC20]
"DOOMx64.exe"+184FFC58: F3 0F 10 35 88 DF 70 E9 - movss xmm6,[DOOMx64.exe+1C0DBE8]
"DOOMx64.exe"+184FFC60: 66 0F 6E D0 - movd xmm2,eax
"DOOMx64.exe"+184FFC64: F3 0F 10 59 0C - movss xmm3,[rcx+0C]
"DOOMx64.exe"+184FFC69: 0F 28 CC - movaps xmm1,xmm4
"DOOMx64.exe"+184FFC6C: 0F 5B D2 - cvtdq2ps xmm2,xmm2
}
687
"No Reload"
Auto Assembler Script
[ENABLE]
aobscanmodule(_InfiniteAmmo,DOOMx64.exe,89 7B 38 89 F8) // should be unique
alloc(newmem,$1000,DOOMx64.exe)
label(code)
label(return)
newmem:
code:
push eax
mov edi,eax // EAX Contains Max Ammo, so we store eax into edi
mov [rbx+38],edi // Move max ammo onto current ammo
pop eax
mov eax,edi
jmp return
_InfiniteAmmo:
jmp code
return:
registersymbol(_InfiniteAmmo)
[DISABLE]
_InfiniteAmmo:
db 89 7B 38 89 F8
unregistersymbol(_InfiniteAmmo)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "DOOMx64.exe"+18C026E0
"DOOMx64.exe"+18C026C4: 8B 71 38 - mov esi,[rcx+38]
"DOOMx64.exe"+18C026C7: 45 84 C0 - test r8l,r8l
"DOOMx64.exe"+18C026CA: 74 2A - je DOOMx64.exe+18C026F6
"DOOMx64.exe"+18C026CC: 48 8B 01 - mov rax,[rcx]
"DOOMx64.exe"+18C026CF: FF 90 98 00 00 00 - call qword ptr [rax+00000098]
"DOOMx64.exe"+18C026D5: 85 F6 - test esi,esi
"DOOMx64.exe"+18C026D7: 78 07 - js DOOMx64.exe+18C026E0
"DOOMx64.exe"+18C026D9: 89 F7 - mov edi,esi
"DOOMx64.exe"+18C026DB: 39 C6 - cmp esi,eax
"DOOMx64.exe"+18C026DD: 0F 4F F8 - cmovg edi,eax
// ---------- INJECTING HERE ----------
"DOOMx64.exe"+18C026E0: 89 7B 38 - mov [rbx+38],edi
"DOOMx64.exe"+18C026E3: 89 F8 - mov eax,edi
// ---------- DONE INJECTING ----------
"DOOMx64.exe"+18C026E5: 48 8B 5C 24 30 - mov rbx,[rsp+30]
"DOOMx64.exe"+18C026EA: 48 8B 74 24 38 - mov rsi,[rsp+38]
"DOOMx64.exe"+18C026EF: 48 83 C4 20 - add rsp,20
"DOOMx64.exe"+18C026F3: 5F - pop rdi
"DOOMx64.exe"+18C026F4: C3 - ret
"DOOMx64.exe"+18C026F5: A9 85 F6 78 07 - test eax,0778F685
"DOOMx64.exe"+18C026FA: 89 F7 - mov edi,esi
"DOOMx64.exe"+18C026FC: 39 F6 - cmp esi,esi
"DOOMx64.exe"+18C026FE: 0F 4F FE - cmovg edi,esi
"DOOMx64.exe"+18C02701: 48 8B 5C 24 30 - mov rbx,[rsp+30]
}
717
"Rapid Fire"
Auto Assembler Script
[ENABLE]
aobscanmodule(rapid_fire,DOOMx64.exe,F3 0F 2C F8 89 F8)
rapid_fire:
db 31 FF 90 90
registersymbol(rapid_fire)
[DISABLE]
rapid_fire:
db F3 0F 2C F8
unregistersymbol(rapid_fire)
{
// ORIGINAL CODE - INJECTION POINT: "DOOMx64.exe"+18A2F532
"DOOMx64.exe"+18A2F50A: E8 D1 50 73 FF - call DOOMx64.exe+181645E0
"DOOMx64.exe"+18A2F50F: 66 0F 6E F7 - movd xmm6,edi
"DOOMx64.exe"+18A2F513: 48 89 C1 - mov rcx,rax
"DOOMx64.exe"+18A2F516: 48 8B 10 - mov rdx,[rax]
"DOOMx64.exe"+18A2F519: 0F 5B F6 - cvtdq2ps xmm6,xmm6
"DOOMx64.exe"+18A2F51C: FF 92 A8 04 00 00 - call qword ptr [rdx+000004A8]
"DOOMx64.exe"+18A2F522: 0F 28 CE - movaps xmm1,xmm6
"DOOMx64.exe"+18A2F525: 48 89 C1 - mov rcx,rax
"DOOMx64.exe"+18A2F528: E8 E3 E1 F7 FF - call DOOMx64.exe+189AD710
"DOOMx64.exe"+18A2F52D: 0F 28 74 24 20 - movaps xmm6,[rsp+20]
// ---------- INJECTING HERE ----------
"DOOMx64.exe"+18A2F532: F3 0F 2C F8 - cvttss2si edi,xmm0
"DOOMx64.exe"+18A2F536: 89 F8 - mov eax,edi
// ---------- DONE INJECTING ----------
"DOOMx64.exe"+18A2F538: 48 8B 7C 24 58 - mov rdi,[rsp+58]
"DOOMx64.exe"+18A2F53D: E9 AA FE FF FF - jmp DOOMx64.exe+18A2F3EC
"DOOMx64.exe"+18A2F542: 00 31 - add [rcx],dh
"DOOMx64.exe"+18A2F544: C0 48 83 C4 - ror byte ptr [rax-7D],-3C
"DOOMx64.exe"+18A2F548: 38 5D 5B - cmp [rbp+5B],bl
"DOOMx64.exe"+18A2F54B: C3 - ret
"DOOMx64.exe"+18A2F54C: CC - int 3
"DOOMx64.exe"+18A2F54D: CC - int 3
"DOOMx64.exe"+18A2F54E: CC - int 3
"DOOMx64.exe"+18A2F54F: CC - int 3
}
777
"Super Speed"
Auto Assembler Script
{ Game : DOOMx64.exe
Version:
Date : 2016-07-06
Author : Schr4nzi
This script does blah blah blah
}
[ENABLE]
aobscanmodule(_SuperSpeed,DOOMx64.exe,F3 41 0F 59 81 58 20 00 00) // should be unique
alloc(newmem,$1000,DOOMx64.exe)
label(code)
label(return)
newmem:
mov [r9+00002058],(float)1000
code:
mulss xmm0,[r9+00002058]
jmp return
_SuperSpeed:
jmp newmem
nop
nop
nop
nop
return:
registersymbol(_SuperSpeed)
[DISABLE]
_SuperSpeed:
db F3 41 0F 59 81 58 20 00 00
unregistersymbol(_SuperSpeed)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "DOOMx64.exe"+18606C97
"DOOMx64.exe"+18606C70: F3 0F 52 C4 - rsqrtss xmm0,xmm4
"DOOMx64.exe"+18606C74: F3 0F 59 D8 - mulss xmm3,xmm0
"DOOMx64.exe"+18606C78: F3 0F 59 D8 - mulss xmm3,xmm0
"DOOMx64.exe"+18606C7C: F3 0F 5C DA - subss xmm3,xmm2
"DOOMx64.exe"+18606C80: F3 0F 59 D8 - mulss xmm3,xmm0
"DOOMx64.exe"+18606C84: 66 0F 6E C1 - movd xmm0,ecx
"DOOMx64.exe"+18606C88: F3 0F 59 D9 - mulss xmm3,xmm1
"DOOMx64.exe"+18606C8C: F3 0F 59 E3 - mulss xmm4,xmm3
"DOOMx64.exe"+18606C90: 0F 5B C0 - cvtdq2ps xmm0,xmm0
"DOOMx64.exe"+18606C93: F3 0F 59 E3 - mulss xmm4,xmm3
// ---------- INJECTING HERE ----------
"DOOMx64.exe"+18606C97: F3 41 0F 59 81 58 20 00 00 - mulss xmm0,[r9+00002058]
// ---------- DONE INJECTING ----------
"DOOMx64.exe"+18606CA0: F3 0F 5C E2 - subss xmm4,xmm2
"DOOMx64.exe"+18606CA4: F3 0F 59 E3 - mulss xmm4,xmm3
"DOOMx64.exe"+18606CA8: F3 0F 59 E1 - mulss xmm4,xmm1
"DOOMx64.exe"+18606CAC: F3 0F 59 C4 - mulss xmm0,xmm4
"DOOMx64.exe"+18606CB0: F3 0F 59 05 64 9A 63 E9 - mulss xmm0,[DOOMx64.exe+1C4071C]
"DOOMx64.exe"+18606CB8: C3 - ret
"DOOMx64.exe"+18606CB9: CC - int 3
"DOOMx64.exe"+18606CBA: CC - int 3
"DOOMx64.exe"+18606CBB: CC - int 3
"DOOMx64.exe"+18606CBC: CC - int 3
}
Weapon Spread
158191A42
DOOMx64.exe
18191A42
D4
F3
0F
58
C2
F3
0F
11
41
18
48
83
C4
18
C3
Rotation
158C4EC21
DOOMx64.exe
18C4EC21
55
A0
48
89
F1
E8
5A
7E
8E
FF
0F
B6
46
69
84
Code :movss [rsi+000000C0],xmm0
158C4EC35
DOOMx64.exe
18C4EC35
0F
10
44
24
50
F3
0F
11
86
C0
00
00
00
F3
0F
10
4C
24
Code :movss [rsi+000000C4],xmm1
158C4EC43
DOOMx64.exe
18C4EC43
0F
10
4C
24
54
F3
0F
11
8E
C4
00
00
00
F3
0F
10
44
24
Code :movss [rsi+000000C8],xmm0
158C4EC51
DOOMx64.exe
18C4EC51
0F
10
44
24
58
F3
0F
11
86
C8
00
00
00
90
90
90
90
90
Spread Visual
158B98C9F
DOOMx64.exe
18B98C9F
89
F9
45
31
C0
E8
5C
9A
01
00
F3
0F
10
93
A8
Code :movss xmm1,[rbx+00002058]
1585F9625
DOOMx64.exe
185F9625
80
F2
5D
3C
6F
F3
0F
10
8B
58
20
00
00
F3
0F
59
D2
F3
Code :mulss xmm0,[r9+00002058]
158606C97
DOOMx64.exe
18606C97
C0
F3
0F
59
E3
F3
41
0F
59
81
58
20
00
00
F3
0F
5C
E2
F3
PlayerBase
158ADDD24
cooldown
158BEA824
instant_charge
158DBFA24
grenades
158CECA5D
_NoSpread
1584FFC40
_SpreadFunc
158BB2700
_InfiniteAmmo
158DAC700
rapid_fire
158DA0154
_Gravity
158633A39
_Teleport
158602FA1
_SuperSpeed
158606C97