C5944D6FD34010868D1367377154891B1F077C0C1C2A0812F7C44D48A4A64D63D3880B68638FEB29EB5DB3DEA80DBF931F82C48D136B3B09CD8D021227EF3B3BBB33CFD8AFBF362D2B9C8F5F92D01F8DA5CA9AEF4EC6AF9AA790E8C6C3666B0278956ABBD70865DE78F1C05962ACD3C60FCB1D4A15839A4652146E7785C1A6D090CD40AC3B2B9CA1C00CBFC02E2BD01B0EA4BB2A4229F912452C6F88CF728D52B47A93F3D9EC8D172A86029437BA6559CEC1EB2D20C20444015E1129CCF5F3AECF1184DE35E4D672D78FE34B2E1521111F72167D22E7C2E7B200D22E91AA259DCB02CB92E4289741A400846F2E006551437ECA56C09B632974856E3FDE911F95E4F6931ADC0EF67DB77D935BF5DC2D4F1DFB29530168D21D9C05D38FFE64B0084661A7DEDAB5B64C51835BC5B6B77F6F57EA8C65D022BE5C2B04551F9AA38E5242927C8CB710D7352ED68CA3DE98E8E713C5125D6756D3755B4931943CB6DC395306ABAA493BB528D328B9C402571CA8F50BD82977FA35F1D343E20F5BE28B3D71674FDCFF4D6427E20B88FF21F0FDE15ED7708F0EE1FA5BB8E99FBF4E1AF1F7C0B9BCF95F7874FBACBD6A5B0756B5ADBD539D01C72B4128E3B563DA95CECC8A50CD6A0BD0C15ACBC03896EE07F2ACF4B287E21A220DF1B1F7561AA1A5A753F0AE0CDEDF7CF5DFEE4CC9192864FCEE8C3A497EC94CD0F0DE734C74697E374BC5F2B665593F01
69
"[X] <== HoMM 6 v1.4.0 Script v1.2"
FF0000
Auto Assembler Script
{
===========================================
Game Title : Might&Magic Heroes VI
Game Version : 1.4.0.0
Script Version: 1.2
CE Version : 6.1
Release date : 25-May-2012 (updated from version 1.3.0.0)
Author : Recifense
Features:
- Minimum Resources
- Unlimited Movement
- Minimum Troop Size for player's moving Army (minimum value can be defined by user)
- Minimum XP for player's moving hero (minimum value can be defined by user)
- Recover Mana (on the move)
===========================================
}
[ENABLE]
//=========================================
// Check if script is compatible to this game version
// If false the script will not be loaded
assert("Might & Magic Heroes VI.exe"+00048396,8b 75 c0 83 c6 04) //_MR
assert("Might & Magic Heroes VI.exe"+012A69AB,f3 0f 11 42 0c) //_MMp
assert("Might & Magic Heroes VI.exe"+01264065,d9 45 fc 8b e5) //_MMa
//=========================================
alloc(MyCode,1024)
//=========================================
// Declaration section
label(_MonResources)
label(_MonR0)
label(_MonR1)
label(_MonR2)
label(_BackMR)
label(_ExitMR)
label(_MonMovement)
label(_MonM0)
label(_MonM1)
label(_MonM2)
label(_MonM3)
label(_MonM4)
label(_BackMM)
label(_ExitMM)
label(_MonMana)
label(_BackMMa)
label(_ExitMMa)
label(pRes)
label(pUnit)
label(pHero)
label(iEnableMR)
label(iEnableMM)
label(iEnableMS)
label(iEnableMX)
label(iEnableMMa)
label(iMinSize)
label(iMinXP)
label(fSaveSS)
//=========================================
// Registering Symbols
registersymbol(MyCode)
registersymbol(pUnit)
registersymbol(pRes)
registersymbol(pHero)
registersymbol(iEnableMR)
registersymbol(iEnableMM)
registersymbol(iEnableMS)
registersymbol(iEnableMX)
registersymbol(iEnableMMa)
registersymbol(iMinSize)
registersymbol(iMinXP)
//=========================================
MyCode:
//========================================= ok
_MonResources:
mov esi,[ebp-40] // Original code
lea edi,[esi-28] // Adjust pointer
mov [pRes],edi // Save it for further use
cmp dword ptr [iEnableMR],0
je _ExitMR // Jump if feature is disabled
mov ecx,#50000
mov edi,[esi+04]
xor edi,[esi+08]
cmp ecx,edi // Gold
jle _MonR0
mov edi,ecx
xor edi,[esi+08]
mov [esi+04],edi
_MonR0:
mov ecx,#5000
mov edi,[esi+0c]
xor edi,[esi+10]
cmp ecx,edi // Wood
jle _MonR1
mov edi,ecx
xor edi,[esi+10]
mov [esi+0c],edi
_MonR1:
mov edi,[esi+14]
xor edi,[esi+18]
cmp ecx,edi // Ore
jle _MonR2
mov edi,ecx
xor edi,[esi+18]
mov [esi+14],edi
_MonR2:
mov edi,[esi+1c]
xor edi,[esi+20]
cmp ecx,edi // Blood Crystal
jle _ExitMR
mov edi,ecx
xor edi,[esi+20]
mov [esi+1c],edi
_ExitMR:
mov esi,[ebp-40] // Original code
add esi,04 // Original code
jmp _BackMR // Back to main code
//=========================================
_MonMovement:
push eax
push ebx
push ecx
push edi
push esi
mov ecx,edx
mov eax,[ecx+10]
mov [pUnit],eax // Save ptr for debugging
// mov edx,[ebp-0c]
// cmp edx,[pRes]
mov ebx,[eax+0000011c]
cmp ebx,00020000
// and ebx,0000ffff
jne _ExitMM
mov [pHero],eax
mov edx,[eax+70] // Get pArmy
test edx,edx
jz _MonM2
mov ebx,[edx+0c] // Get # troops
test ebx,ebx
jz _MonM2
cmp dword ptr [iEnableMS],0 // Troop Size
je _MonM2 // Jump if feature is disabled
mov edx,[edx+04] // get pTroopList
test edx,edx
jz _MonM2
mov eax,[iMinSize]
_MonM0:
dec ebx
mov esi,[edx+ebx*4] // Get Troop
mov edi,[esi+54]
xor edi,[esi+58]
cmp eax,edi
jle _MonM1
mov edi,eax
xor edi,[esi+58]
mov [esi+54],edi
_MonM1:
test ebx,ebx
jnz _MonM0
_MonM2:
cmp dword ptr [iEnableMX],0
je _MonM3 // Jump if feature is disabled
mov eax,[pHero]
mov esi,[eax+00000134] // Get pXP
test esi,esi
jz _MonM3
mov eax,[iMinXP]
mov edi,[esi+0c]
xor edi,[esi+10]
cmp eax,edi
jle _MonM3
mov edi,eax
xor edi,[esi+10]
mov [esi+0c],edi
_MonM3:
mov eax,[pHero]
cmp dword ptr [iEnableMM],0
je _MonM4 // Jump if feature is disabled
mov edx,[eax+00000674]
test edx,edx
jz _MonM4
movss xmm0,[eax+00000674]
_MonM4:
// cmp dword ptr [iEnableMMa],0
// je _ExitMM // Jump if feature is disabled
// mov ebx,[eax+000003c8]
// mov [eax+000006b8],ebx
_ExitMM:
mov edx,ecx
pop esi
pop edi
pop ecx
pop ebx
pop eax
movss [edx+0C],xmm0 // Original code
jmp _BackMM // Back to main code
//=========================================
_MonMana:
push eax
push ebx
cmp dword ptr [iEnableMMa],0
je _ExitMMa // Jump if feature is disabled
mov ebx,[ebp-0c] // Get pHero
cmp ebx,[pHero]
jne _ExitMMa
mov eax,[ebp-04]
mov [ebx+000006e0],eax
_ExitMMa:
pop ebx
pop eax
fld dword ptr [ebp-04] // Original code
mov esp,ebp // Original code
jmp _BackMMa // Back to main code
//=========================================
db '=========================>'
db 'CE6.1 Script by Recifense 052512'
//=========================================
// Variables
iEnableMR:
dd 0
iEnableMM:
dd 0
iEnableMS:
dd 0
iEnableMX:
dd 0
iEnableMMa:
dd 0
pUnit:
dd 0
pRes:
dd 0
pHero:
dd 0
iMinSize:
dd #2000
iMinXP:
dd #10000
fSaveSS:
dd 00
//=========================================
// Hacking Points
"Might & Magic Heroes VI.exe"+00048396:
jmp _MonResources
nop
_BackMR:
"Might & Magic Heroes VI.exe"+012A69AB:
jmp _MonMovement
_BackMM:
"Might & Magic Heroes VI.exe"+01264065:
jmp _MonMana
_BackMMa:
//=========================================
// Script for Restoring Original Codes
[DISABLE]
"Might & Magic Heroes VI.exe"+00048396:
// mov esi,[ebp-40]
// add esi,04
db 8b 75 c0 83 c6 04
"Might & Magic Heroes VI.exe"+012A69AB:
// movss [edx+0C],xmm0
db f3 0f 11 42 0c
"Might & Magic Heroes VI.exe"+01264065:
// fld dword ptr [ebp-04]
// mov esp,ebp
db d9 45 fc 8b e5
//=========================================
// Unregistering Symbols
unregistersymbol(MyCode)
unregistersymbol(pUnit)
unregistersymbol(pRes)
unregistersymbol(pHero)
unregistersymbol(iEnableMR)
unregistersymbol(iEnableMM)
unregistersymbol(iEnableMS)
unregistersymbol(iEnableMX)
unregistersymbol(iEnableMMa)
unregistersymbol(iMinSize)
unregistersymbol(iMinXP)
//=========================================
dealloc(MyCode)
//============= Scripts End ===============
// ****************************************
// NOTES
// ****************************************
{
Heroes of Might & Magic VI:
V1.1.31785
struct HERO:
0000 = 01d22a90
000c = 01fd3164
0070 0010 = pArmy
0120 0120 = pPoints
0128 0128 = pMovePoints
0134 0134 = pXP
0140 = fBaseMightPower
0154 = fBaseMightDefense
0168 = fBaseMightMagic
017c = fBaseMightDefense
0190 = fBaseLeadership
01A4 = fBaseDestiny
0280 = fBaseMovePoints
0288 = fAdditionalMovePoints
03c8 03c8 = fmMana
05f0 = fTearsReputation
05f0 = fBloodReputation
06e0 06b8 = fcMana
struct ARMY:
0000 0000 = i0
0004 0004 = pTroopList
000c 000c = i#Troops
0030 001c = pHero
struct TROOPLIST:
0000 = pTroop#1
0004 = pTroop#2
0008 = pTroop#3
000c = pTroop#4
0010 = pTroop#5
0014 = pTroop#6
0018 = pTroop#7
struct TROOP:
0000 = 01d251e0
0024 = 01c43418
0028 = iTroopType (Encrypted)
002c = iTroopType (XOR)
0054 = iTroopSize (Encrypted)
0058 = iTroopSize (XOR)
struct ABILITY_POINTS:
0000 = 01d241bc
0018 = iPoints
struct MOVE_POINTS:
0000 = f1
000c = fcMP
0010 = pHero
struct XP:
000c = iXP (Encrypted)
0010 = iXP (XOR)
0014 = iLevel (Encrypted)
0018 = iLevel (XOR)
struct RESOURCES:
0000 = 01d2094c
0004 = 01fd3164
0020 = ppRes (+08)
0024 = ppRes (+14)
0028 = 01c43418
002c = iGold (Encrypted)
0030 = iGold (XOR)
0034 = iWood (Encrypted)
0038 = iWood (XOR)
003c = iOre (Encrypted)
0040 = iOre (XOR)
0044 = iCrystal (Encrypted)
0048 = iCrystal (XOR)
}
4
"Enable/Disable Minimum Resources ==> (1/0)"
008000
4 Bytes
iEnableMR
5
"Enable/Disable Unlimited Movement ==> (1/0)"
008000
4 Bytes
iEnableMM
70
"Enable/Disable Fast Recover Mana ==> (1/0)"
008000
4 Bytes
iEnableMMa
6
"Enable/Disable Troop Minimum Sizes ==> (1/0)"
008000
4 Bytes
iEnableMS
7
"Minimum Troop Size Value ==>"
0080FF
4 Bytes
iMinSize
66
"Enable/Disable Hero's Minimum XP ==> (1/0)"
008000
4 Bytes
iEnableMX
67
"Minimum Hero's Minimum XP Value ==>"
0080FF
4 Bytes
iMinXP
10
"Hero's Available Ability Points ==>"
0000FF
4 Bytes
pHero
18
120
Set Value
17
33
4
0
13
"Hero's Base Might Power ==>"
0000FF
Float
pHero
140
14
"Hero's Base Might Defense ==>"
0000FF
Float
pHero
154
15
"Hero's Base Magic Power ==>"
0000FF
Float
pHero
168
16
"Hero's Base Magic Defense ==>"
0000FF
Float
pHero
17C
17
"Hero's Base Leadership ==>"
0000FF
Float
pHero
190
18
"Hero's Base Destiny ==>"
0000FF
Float
pHero
1A4
19
"Hero's Tears Reputation ==>"
0000FF
Float
pHero
5F0
20
"Hero's Blood Reputation ==>"
0000FF
Float
pHero
5F4
pUnit
063501F4
pRes
063501F8
pHero
063501FC
iEnableMR
063501E0
iEnableMM
063501E4
iEnableMS
063501E8
iEnableMX
063501EC
iEnableMMa
063501F0
iMinSize
06350200
iMinXP
06350204
===========================================
Game Title : Might&Magic Heroes VI
Game Version : 1.4.0.0
Script Version: 1.2
CE Version : 6.1
Release date : 25-May-2012 (updated from version 1.3.0.0)
Author : Recifense
Features:
- Minimum Resources
- Unlimited Movement
- Minimum Troop Size for player's moving Army (minimum value can be defined by user)
- Minimum XP for player's moving hero (minimum value can be defined by user)
- Recover Mana (on the move)
===========================================
[Note] The HERO's values are only valid for the last hero that the player moved.
===
In fact, most of the cheats only works when the player moves one of his/her heroes. :)
hiddenbyuser=false --variable set by pressing ~
oldvisiblestate=true --to save on hiding/showing
function keypress(vkey, char)
if vkey==VK_F1 then
if isKeyPressed(VK_CONTROL) then
writeInteger("[[pHero]+120]+18", readInteger("[[pHero]+120]+18")+100)
writeFloat("[pHero]+140", readFloat("[pHero]+140")+1000)
writeFloat("[pHero]+154", readFloat("[pHero]+154")+1000)
writeFloat("[pHero]+168", readFloat("[pHero]+168")+1000)
writeFloat("[pHero]+17c", readFloat("[pHero]+17c")+1000)
writeFloat("[pHero]+190", readFloat("[pHero]+190")+1000)
writeFloat("[pHero]+1a4", readFloat("[pHero]+1a4")+1000)
beep()
else
writeInteger("iEnableMR", (readInteger("iEnableMR")+1) % 2)
end
UpdateStatus()
return false
end
if vkey==VK_F2 then
writeInteger("iEnableMM", (readInteger("iEnableMM")+1) % 2)
UpdateStatus()
return false
end
if vkey==VK_F3 then
writeInteger("iEnableMMa", (readInteger("iEnableMMa")+1) % 2)
UpdateStatus()
return false
end
if vkey==VK_F4 then
writeInteger("iEnableMS", (readInteger("iEnableMS")+1) % 2)
UpdateStatus()
return false
end
if vkey==192 then
hiddenbyuser=not hiddenbyuser
UpdateStatus()
return true
end
end
function UpdateStatus(sender)
--check if a hero is selected. If not, hide
--also responsible for reading the cheat stats
local newvisiblestate=false
if hiddenbyuser or (readInteger('[[pHero]+120]+18')==nil) then
--hide
newvisiblestate=false
else
--show
if readInteger("iEnableMR")==1 then
s1='Disable'
else
s1='Enable'
end
if readInteger("iEnableMM")==1 then
s2='Disable'
else
s2='Enable'
end
if readInteger("iEnableMMa")==1 then
s3='Disable'
else
s3='Enable'
end
if readInteger("iEnableMS")==1 then
s4='Disable'
else
s4='Enable'
end
status=string.format([[F1 : %s Minimum Resources
F2 : %s Unlimited Movement
F3 : %s Fast Recover Mana
F4 : %s Troop Minimum Sizes
Ctrl+F1 : Super Hero
]], s1,s2,s3,s4)
d3dhook_textcontainer_setText(tc, status)
newvisiblestate=true
end
if oldvisiblestate~=newvisiblestate then
d3dhook_renderobject_setVisible(tc, newvisiblestate)
d3dhook_renderobject_setVisible(tc2, newvisiblestate)
d3dhook_renderobject_setVisible(statusbarsprite, newvisiblestate)
d3dhook_renderobject_setVisible(bgsprite, newvisiblestate)
oldvisiblestate=newvisiblestate
end
end
function InjectMenu()
-- control_setCaption(UDF1_CELabel1,"Inside InjectMenu")
--pause() --decrease chance of crashes (won't work in protected trainers...)
-- control_setCaption(UDF1_CELabel1,"After pause")
--create a black transparent background for the hero status
statusbackground=createPicture()
bmp=picture_getBitmap(statusbackground);
graphic_setHeight(bmp,1)
graphic_setWidth(bmp,1)
c=rasterimage_getCanvas(bmp)
canvas_setPixel(c,0,0,0x000000) --black
-- control_setCaption(UDF1_CELabel1,"Going to init")
d3dhook_initializeHook()
-- control_setCaption(UDF1_CELabel1,"After Init")
bgtexture=d3dhook_createTexture(statusbackground)
bgsprite=d3dhook_createSprite(bgtexture);
--load the statusbar
statusbartexture=d3dhook_createTexture(getCheatEngineDir().."trainerwindow.png")
d3dhook_renderobject_setX(bgsprite, -1) --center it horizontally
d3dhook_sprite_setWidth(bgsprite, d3dhook_texture_getWidth(statusbartexture))
d3dhook_sprite_setHeight(bgsprite, d3dhook_texture_getHeight(statusbartexture))
d3dhook_renderobject_setY(bgsprite, 48)
d3dhook_renderobject_setAlphablend(bgsprite, 0.7)
statusbarsprite=d3dhook_createSprite(statusbartexture)
d3dhook_renderobject_setX(statusbarsprite, -1) --center it horizontally
d3dhook_renderobject_setY(statusbarsprite, d3dhook_renderobject_getY(bgsprite))
f=integerToUserData(getProperty(UDF1_Font, "Font"))
fm=d3dhook_createFontmap(f)
tc=d3dhook_createTextContainer(fm, -1, d3dhook_renderobject_getY(bgsprite)+2, 'Initializing...')
f2=integerToUserData(getProperty(UDF1_Font2, "Font"))
fm2=d3dhook_createFontmap(f2)
tc2=d3dhook_createTextContainer(fm2, -1, d3dhook_renderobject_getY(bgsprite)+d3dhook_texture_getHeight(statusbartexture)-d3dhook_texture_getHeight(fm2)-2, 'Press ` to Hide/Show')
--f3=integerToUserData(getProperty(UDF1_Font3, "Font"))
--fm3=d3dhook_createFontmap(f3)
--tc3=d3dhook_createTextContainer(fm3, -1, d3dhook_renderobject_getY(bgsprite)+2+5*d3dhook_texture_getHeight(fm), [[Hero stats
--Ctrl+F1 : Super Hero
--]])
--start a timer that updates the textcontainer (alternatively, I could use a mouseclick event)
d3dhook_onKey(keypress)
t=createTimer(nil)
timer_onInterval(t, UpdateStatus)
timer_setInterval(t, 250)
timer_setEnabled(t, true)
--unpause()
end
strings_add(getAutoAttachList(), "Might & Magic Heroes VI.exe");
scriptentry=addresslist_getMemoryRecordByID(getAddressList(), 69)
function ActivateCheck(sender)
--try to activate the script entry
memoryrecord_freeze(scriptentry)
if memoryrecord_isActive(scriptentry) then
control_setCaption(UDF1_CELabel1,"Script activated. Killing timer")
object_destroy(sender)
control_setCaption(UDF1_CELabel1,"Script activated. Injecting script")
InjectMenu()
--still here so no crash/whatever
control_setCaption(UDF1_CELabel1,"Menu injected. Go into the game and move your hero once")
end
end
function onOpenProcess(pid)
control_setCaption(UDF1_CELabel1,"Process found. Activing script")
t=createTimer(nil)
timer_setInterval(t, 1000)
timer_onTimer(t,ActivateCheck)
timer_setEnabled(t,true)
end
form_show(UDF1)
function FormClose(sender)
closeCE()
return caHide --Possible options: caHide, caFree, caMinimize, caNone
end