[coding-CE] multi-hit auto-assemble script

[dabnoj]

hello if you want to have the multihit working on new version of PH 12sky2 here is an updated/improved code of original megabytes one ... just add it as autoassemble script in cheat engine... then add it to your cheat table and toggle on/off to make it enable/disable

 Spoiler

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(after)
label(exit)
label(cheat)
label(nocheat)


newmem:
push edx
movzx edx,byte ptr [011BCDFD]

cmp edx,5
je cheat
cmp edx,6
je cheat
cmp edx,7
je cheat
cmp edx,d
je cheat
cmp edx,0x20
jge cheat




nocheat:
// Not an attack just send packet once
mov EAX,1
JMP after
cheat:
// Attack send packet however many times its set for
MOV EAX,15
pop edx
// End that code

after:

PUSH EAX
// Here is the real code
MOV ECX,DWORD PTR SS:[EBP+8]
PUSH ECX
PUSH 0
MOV ECX,011BCD54
CALL 0048F7E0
// Decrease loop counter
POP EAX
DEC EAX
// Test if its reached 0
TEST EAX,EAX
// If not jump back up to top
JNZ newmem
// Jump back to after origional code
JMP exit


exit:
jmp returnhere




"12sky2-PH.exe"+6D88F:
jmp newmem
nop


returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"12sky2-PH.exe"+6D88F:
mov ecx,[ebp+08]
push ecx
push 00
//Alt: db 8B 4D 08 51 6A 00

you can also use wazappo method with this script


first is for single skills, normal atk :

 Spoiler

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
alloc(cheat,4)
label(returnhere)
label(originalcode)
label(exit)
cheat:
dq (float)2.5
newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
fmul dword ptr [cheat]

exit:
jmp returnhere

"12sky2-PH.exe"+94672:
jmp newmem
nop
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"12sky2-PH.exe"+94672:
fmul dword ptr [0056209C]
//Alt: db D8 0D 9C 20 56 00

second for aoe and other skills maybe ^^ :

 Spoiler

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
alloc(cheat,4)
label(originalcode)
label(exit)
cheat:
dq (float)2.5
newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
fmul dword ptr [cheat]

exit:
jmp returnhere

"12sky2-PH.exe"+947F2:
jmp newmem
nop
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"12sky2-PH.exe"+947F2:
fmul dword ptr [0056209C]
//Alt: db D8 0D 9C 20 56 00

as usual, i remember that a thanks is welcome... cheers

[symond10]

I get an error. Error in line 23(cmp edx,0x20) : This instruction can't be compiled

[dabnoj]

Originally Posted by symond10

I get an error. Error in line 23(cmp edx,0x20) : This instruction can't be compiled

wich version of ce do you use? i use 6.4 and it works

[symond10]

I use .dll Cheat engine.
Edit: It was 5.3

[dabnoj]

Originally Posted by symond10

I use .dll Cheat engine.
Edit: It was 5.3

with 6.4 it should work

[symond10]

Thanks. Now only problem left is getting the addy of attack speed >.<

[dabnoj]

Originally Posted by symond10

Thanks. Now only problem left is getting the addy of attack speed >.<

wich version do you play? you dont need atk speed addy at all for this script in newest ph client

[symond10]

Originally Posted by dabnoj

wich version do you play? you dont need atk speed addy at all for this script in newest ph client

It would be faster to level if i have atk speed address xDD.

I still dont get this one >.<

So first to find it i found the animation spot address, which is a float value and incements by little every frame so the players animation goes on, this is near the beginning of the player struct where the coordinates and HP and Chi and that stuff is. The value is constantly changing so its very easy to find with CE memory view.

Next we want to know what code changes it so we can speed it up. I did this with CE's "Find what writes to this address", if you do that, you see that when you stand just one or two opcodes change it but if you click on somewhere and move a bit you see that another opcode changed it this time. Now attack something with a skill and see what writes to it this time.

When you follow the address in CE's asm view you should see this:
Code:
0049B34F - D8 1D BC7C5600 - fcomp dword ptr [00567CBC] : [(float)121.0000]
0049B355 - DFE0 - fnstsw ax
0049B357 - F6 C4 05 - test ah,F6
0049B35A - 7A 1E - jp 0049B37A //this jumps over the animation stuff if your not using a attack skill
0049B35C - D9 45 0C - fld dword ptr [ebp+0C] //load the base animation value
0049B35F - D8 4D FC - fmul dword ptr [ebp-04] //multiplies it by elapsed time probably
0049B362 - D8 0D B87C5600 - fmul dword ptr [00567CB8] : [(float)0.3000] //heres what we are looking for: a constant address holding a float that is used in the animation calculation
0049B368 - 8B 45 F4 - mov eax,[ebp-0C]
0049B36B - D8 80 AB000000 - fadd dword ptr [eax+000000AB] //add the old animation value to it
0049B371 - 8B 4D F4 - mov ecx,[ebp-0C]
0049B374 - D9 99 AB000000 - fstp dword ptr [ecx+000000AB] //this writes the final animation value to the address in player struct
0049B37A - DB 45 F8 - fild dword ptr [ebp-08]
0049B37D - 8B 55 F4 - mov edx,[ebp-0C]
0049B380 - D8 9A AB000000 - fcomp dword ptr [edx+000000AB]
0049B386 - DFE0 - fnstsw ax

[dabnoj]

Originally Posted by symond10

It would be faster to level if i have atk speed address xDD.

I still dont get this one >.<

So first to find it i found the animation spot address, which is a float value and incements by little every frame so the players animation goes on, this is near the beginning of the player struct where the coordinates and HP and Chi and that stuff is. The value is constantly changing so its very easy to find with CE memory view.

Next we want to know what code changes it so we can speed it up. I did this with CE's "Find what writes to this address", if you do that, you see that when you stand just one or two opcodes change it but if you click on somewhere and move a bit you see that another opcode changed it this time. Now attack something with a skill and see what writes to it this time.

When you follow the address in CE's asm view you should see this:
Code:
0049B34F - D8 1D BC7C5600 - fcomp dword ptr [00567CBC] : [(float)121.0000]
0049B355 - DFE0 - fnstsw ax
0049B357 - F6 C4 05 - test ah,F6
0049B35A - 7A 1E - jp 0049B37A //this jumps over the animation stuff if your not using a attack skill
0049B35C - D9 45 0C - fld dword ptr [ebp+0C] //load the base animation value
0049B35F - D8 4D FC - fmul dword ptr [ebp-04] //multiplies it by elapsed time probably
0049B362 - D8 0D B87C5600 - fmul dword ptr [00567CB8] : [(float)0.3000] //heres what we are looking for: a constant address holding a float that is used in the animation calculation
0049B368 - 8B 45 F4 - mov eax,[ebp-0C]
0049B36B - D8 80 AB000000 - fadd dword ptr [eax+000000AB] //add the old animation value to it
0049B371 - 8B 4D F4 - mov ecx,[ebp-0C]
0049B374 - D9 99 AB000000 - fstp dword ptr [ecx+000000AB] //this writes the final animation value to the address in player struct
0049B37A - DB 45 F8 - fild dword ptr [ebp-08]
0049B37D - 8B 55 F4 - mov edx,[ebp-0C]
0049B380 - D8 9A AB000000 - fcomp dword ptr [edx+000000AB]
0049B386 - DFE0 - fnstsw ax

why you dont try to get a sig scan from it? is that original code? or modded one?

[symond10]

It is original posted by wazapooo years ago. I dont know where to start im so confuse

[dabnoj]

"12sky2-PH.exe"+9465F
"12sky2-PH.exe"+947DF

you may test those address...

[symond10]

What are those address for? Multi-Hit? Sorry noob >.<

[dabnoj]

Originally Posted by symond10

What are those address for? Multi-Hit? Sorry noob >.<

those address are the result of sig scan for wazapo old code i tested it, multihit works with it..... look at assembly... the first address is the good one

add me skype if you wanna help -> send me in private message or here


first is for single skills, normal atk :

 Spoiler

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
alloc(cheat,4)
label(returnhere)
label(originalcode)
label(exit)
cheat:
dq (float)2.5
newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
fmul dword ptr [cheat]

exit:
jmp returnhere

"12sky2-PH.exe"+94672:
jmp newmem
nop
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"12sky2-PH.exe"+94672:
fmul dword ptr [0056209C]
//Alt: db D8 0D 9C 20 56 00

second for aoe and other skills maybe ^^ :

 Spoiler

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
alloc(cheat,4)
label(originalcode)
label(exit)
cheat:
dq (float)2.5
newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
fmul dword ptr [cheat]

exit:
jmp returnhere

"12sky2-PH.exe"+947F2:
jmp newmem
nop
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"12sky2-PH.exe"+947F2:
fmul dword ptr [0056209C]
//Alt: db D8 0D 9C 20 56 00

[symond10]

THANK YOU! For the time and help ^_^

Gonna Sleep now its 3am here thank you again ^___^

[regedll]

how xtrap bypass? thanks