[RELEASE] CE Scripts

ocean334 · 03/15/2012, 19:46

How did you get it to work? I get this error message, and it makes sense because CE can't find any values through assembly code search.

shisharkata · 03/15/2012, 20:59

Anyone have working shop hack or its my mistake bcs this one give me error when paste it.

~~MrWali~~ · 03/15/2012, 21:09

All of these works perfectly, any problems contact my on skype " MisterWali "

All creds go to gawron25

Quote:

Originally Posted by gawron25

While not complete the CRC Bypass, provides you a CE Bypass.All scripts are auto update.

Auto Pot

Spoiler

[ENABLE]
aobscan(_aPots,83 78 08 13 0F 85)
label(_aPotsLabel)
registersymbol(_aPotsLabel)
alloc(newmem,1024)
label(returnhere)
label(originalcode)
label(exit)
label(check_mana)
label(finished_check)

_aPots:
_aPotsLabel:
jmp newmem
nop
nop
nop
nop
nop
returnhere:

newmem:
originalcode:
cmp dword ptr [eax+08],01 // checking for HP pot?
jne check_mana
mov dword ptr[eax+08],11 // change to auto pot
mov dword ptr[eax+10],11
check_mana:
cmp dword ptr [eax+08],02 // checking for MP pot?
jne finished_check
mov dword ptr[eax+08],12 // change to auto pot
mov dword ptr[eax+10],12
finished_check:
cmp dword ptr [eax+08],13
je 0052d13a

exit:
jmp returnhere

[DISABLE]
dealloc(newmem)
_aPotsLabel:
cmp dword ptr [eax+08],13
db 0F 84 91 00 00 00
unregistersymbol(_aPotsLabel)

Zoom Hack

Spoiler

[ENABLE]
aobscan(_aZoom,F3 0F 10 47 04 EB)
label(_aZoomLabel)
registersymbol(_aZoomLabel)
alloc(newmem,1024)
label(_returnhere)

newmem:
mov [edi+04],427f0000 // change value to maximum zoom
movss xmm0,[edi+04]
jmp _returnhere

_aZoom:
_aZoomLabel:
jmp newmem
_returnhere:

[DISABLE]
_aZoomLabel:
movss xmm0,[edi+04]
dealloc(newmem)
unregistersymbol(_aZoomLabel)

Far Eye

Spoiler

[ENABLE]
aobscan(FarEye,8B 48 08 8B 50 04 51 8B 4C 24)
label(Label)
registersymbol(Label)
alloc(ChangeClipDistance,64)
label(ReturnClip)
label(ClipDistance)
registersymbol(ClipDistance)

ChangeClipDistance:
mov ecx,[ClipDistance]
mov [eax+08],ecx
mov edx,[eax+04]
jmp ReturnClip
ClipDistance:
db 00 00 48 43

FarEye:
Label:
jmp ChangeClipDistance
nop
ReturnClip:

[DISABLE]
Label:
mov ecx,[eax+08]
mov edx,[eax+04]
dealloc(ChangeClipDistance,64)
unregistersymbol(ClipDistance)
unregistersymbol(FarEye)

Minimap Teleport

Spoiler

[ENABLE]
aobscan(_aGM,8B 80 A0 00 00 00 C3)
label(_aGMLabel)
registersymbol(_aGMLabel)
alloc(newmem, 4096)
label(returnhere)
label(exit)

_aGM:
_aGMLabel:
jmp newmem
db 58
returnhere:

newmem:
mov eax,00000003
nop
ret

exit:
jmp returnhere

[DISABLE]
dealloc(newmem)
_aGMLabel:
mov eax,[eax+000000a0]
ret
unregistersymbol(_aGMLabel)

Non Aggro

Spoiler

[ENABLE]
aobscan(_aNoAggro,0F B7 86 64 01 00 00 8B) //OLD005B4D13 NEW005BADDF
aobscan(_aMobRange,89 4C 24 48 8B 4F 0C 8B 11 FF 52 0C 8B 10)
label(_aNoAggroLabel)
label(_aMobRangeLabel)
registersymbol(_aNoAggroLabel)
registersymbol(_aMobRangeLabel)
alloc(newmem, 2048)
alloc(MonsterRange, 2048)
label(returnhere)
label(originalcode)
label(ReturnMonsterRange)
label(exit)

_aNoAggro:
_aNoAggroLabel:
jmp newmem
db 55
db 55
returnhere:

_aMobRange:
_aMobRangeLabel:
jmp MonsterRange
db 55
db 55
ReturnMonsterRange:

MonsterRange:
mov [esp+48],ecx
mov [esp+30],00000000
mov [esp+4c],00000000
//mov [esi+00000240],0000000 //other attack range to 0
//mov [esi+0000023c],0000000 //other attack range to 0
//mov [esi+00000238],0000000 //other attack range to 0
MOV ECX,DWORD PTR DS:[EDI+C]
jmp ReturnMonsterRange

newmem:

originalcode:
movzx eax,word ptr [esi+00000160]

//mov eax,01
//mov word ptr [esi+00000156],ax
//mov [esi+00000070], 41200000 // speed mob
//40c00000 = 6 lv 1 (to replace the above blue color)
//40400000 = 12 lv 2 (to replace the above blue color)
//41c00000 = 24 lv 3 (to replace the above blue color)
mov byte ptr [esi+00000180],00 // malee attack range = 0
mov byte ptr [esi+00000250],00 // magic attack range = 0
mov [esi+0000024c],0000000 //other attack range = 0
mov [esi+00000248],0000000 //other attack range = 0
mov [esi+00000244],0000000 //other attack range = 0
mov eax,06
mov word ptr [esi+00000160],ax

exit:
jmp returnhere

[DISABLE]
dealloc(newmem)
dealloc(MonsterRange)
_aNoAggroLabel:
movzx eax,word ptr [esi+00000160]
unregistersymbol(_aNoAggroLabel)
_aMobRangeLabel:
mov [esp+48],edx
MOV ECX,DWORD PTR DS:[EDI+C]
unregistersymbol(_aMobRangeLabel)

Vac Hack

Spoiler

[ENABLE]
aobscan(_aVac,8B 50 1C 89 51 20) //004B7E8D
label(_aVacLabel)
registersymbol(_aVacLabel)
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

_aVac:
_aVacLabel:
jmp newmem
nop
returnhere:

newmem:
//DwExploreRange eax
mov [eax+08],00000040//DwSight eax+08
mov [eax+04],00000040//DwPersuitRange eax+04
mov [eax+0c],00000001 //DwAvoidRange eax+0C
//mov [eax+10],00000500//DwExploreStandDelay eax+10
//mov [eax+14],00000500//DwExploreMoveDelay eax+14
mov [eax+18],00000100//DwStandDelay eax+18
mov [eax+1C],00000100//DwMoveDelay eax+1C
//DwFollowMyMasterRange eax+20
//DwStopMasterNear eax+24
//DwWarpMyMasterRange eax+28
//mov [eax+2C],00000064//DwCallTeamPossibelHP eax+2C
//mov [eax+30],00000020//DwCallTeamCount eax+30
mov [eax+34],00000000//DwBlockNFirstAttack eax+34//mov [eax+38],00000020//dwCallTeamCell byte[eax+38]
//dwFollowTarget eax+3C
//dwSpecialAttackStartHP
//dwSpecialMeleeAttackRate
//dwSpecialRangeAttackRate
//DwPowerAttacjStartHP
//dwPowerMeleeAttackProbable
//dwPowerRangeAttackProbable
mov [eax+40],00000000//DwUnderAttackAggro eax+40
mov [eax+44],00000000//DwMeleeAttackRangeInAggro eax+44
mov [eax+48],00000000//DwRangeAttackRangeInAggro eax+48
//DwSightInAggro eax+4C
//DwDefeatAggro eax+50
mov [eax+54],00000000//DwBlockedAggro eax+54
mov [eax+58],00000000//DwSlideAggro eax+58
mov [eax+5C],00000000//DwHealAggro eax+5C
//DwMasterUnderAttackAggro eax+50
//DwMasterDefeatAggro eax+54
//DwMasterBlockingAggro eax+58
//DwMasterSlideAggro eax+5C
//DwCOmplusionUnderAttackAggro eax+60
mov [eax+A8],000000c8 //number of spawn
mov [eax+AC],00000001 //time summon
mov [eax+B4],00000001 //summonststartpccount
//mov [eax+70],00000000
//dwMaxSummonsMonsterCount eax+64
//dwReSummonsMonsterTick eax+68
//dwMaxSummonsMonsterRange eax+6C
//dwSummonsStartPcCountPatternType eax+70

originalcode:
mov edx,[eax+1c]
mov [ecx+20],edx

//mov edx,30 // number spawn
//mov [eax+8c],edx

//mov edx,64 // time delay spawn
//mov [eax+90],edx

mov edx,ff // # follow monster
mov [eax+3C],edx

mov [ecx+20],edx // # follow my master
exit:
jmp returnhere

[DISABLE]
dealloc(newmem)
_aVacLabel:
mov edx,[eax+1c]
mov [ecx+20],edx
unregistersymbol(_aVacLabel)

Wall Hack

Spoiler

[ENABLE]
aobscan(_aWall,FF 50 10 8B F0 8D BC 24 88 00 00 00 B9 75 04 00 00 F3 A5)
label(_aWallLabel)
registersymbol(_aWallLabel)
alloc(Wall,64)
label(ReturnWall)

_aWall:
_aWallLabel:
jmp Wall
nop
nop
nop
nop
nop
nop
nop
ReturnWall:

Wall:
call dword ptr [eax+10]
mov esi,eax
lea edi,ss:[esp+00000088]
cmp [eax+00000402],5f626577
je ReturnWall
mov [eax+00000402],5f626577
mov [eax+00000406],67616d69
mov [eax+0000040a],616d2e65
mov [eax+0000040e],00000063
jmp ReturnWall

[DISABLE]
dealloc(Wall)
_aWallLabel:
call dword ptr [eax+10]
mov esi,eax
lea edi,[esp+00000088]
unregistersymbol(_aWallLabel)

Mob Speed

Spoiler

[ENABLE]
aobscan(_aMobSpeed,80 7C 24 04 00 74 06 D9 40 7C) //005B5990 OLD new005BBE20
label(_aMobSpeedLabel)
registersymbol(_aMobSpeedLabel)
alloc(DrakoMobSpeedBace,2048)
label(MobIsWalking)
label(MobRunSpeedValue)
label(MobWalkSpeedValue)
label(ReturnMobSpeed)
registersymbol(MobRunSpeedValue)
registersymbol(MobWalkSpeedValue)

DrakoMobSpeedBace:
cmp byte ptr [esp+04],00
je MobIsWalking
fld dword ptr [MobRunSpeedValue]
ret 0004
MobIsWalking:
fld dword ptr [MobWalkSpeedValue]
ret 0004

MobRunSpeedValue:
db 00 00 60 41
MobWalkSpeedValue:
db 00 00 40 40

_aMobSpeed:
_aMobSpeedLabel:
jmp DrakoMobSpeedBace
ReturnMobSpeed:

[DISABLE]
dealloc(DrakoMobSpeedBace)
unregistersymbol(MobRunSpeedValue)
unregistersymbol(MobWalkSpeedValue)
_aMobSpeedLabel:
cmp byte ptr [esp+04],00
unregistersymbol(_aMobSpeedLabel)

Char Speed

Spoiler

[ENABLE]
aobscan(_aSpeed,D9 40 08 5F 5E C3 8B 0D)
label(_aSpeedLabel)
registersymbol(_aSpeedLabel)
alloc(newmem,16)
label(ReturnSpeed)
label(SpeedValue)
registersymbol(SpeedValue)

_aSpeed:
_aSpeedLabel:
jmp newmem
ReturnSpeed:

newmem:
fld dword ptr [SpeedValue]
pop edi
pop esi
jmp ReturnSpeed
push esi
push edi
call dword ptr [SpeedValue]
SpeedValue:
db 00 00 00 41

//0082523F:
//ret

[DISABLE]
dealloc(newmem)
unregistersymbol(SpeedValue)
_aSpeedLabel:
fld dword ptr [eax+08]
pop edi
pop esi
unregistersymbol(_aSpeedLabel)

Map Hack (0:5)

Spoiler

[ENABLE]
aobscan(_aMaphack,0F B7 98 04 01 00 00 8B 45 00 8B CD FF 50 04 8B)
label(_aMaphackLabel)
registersymbol(_aMaphackLabel)
alloc(newmem,1024)
label(returnhere)
label(originalcode)
label(exit)
label(change_teleport)

_aMaphack:
_aMaphackLabel:
jmp newmem
nop
nop
returnhere:

newmem:
originalcode:
movzx ebx,word ptr [eax]
cmp bx,0483 // check for python castle -> tomb of the black dragon
je change_teleport

cmp bx,0484 //test
je change_teleport

cmp bx,0487 // check for Requies Beach -> Avalon Island
je change_teleport

cmp bx,048D // check for tomb of the black dragon -> Cursed Mazed
je change_teleport

cmp bx,0495 // check for Avalon Island -> Aquarius
je change_teleport

cmp bx,4E20 // check for Braiken Castle -> Draco Desert
je change_teleport

cmp bx,2B8C // check for North Morte -> Aquirai
je change_teleport

cmp bx,2BB0 // check for Space of Pilgrimage -> Morse Yahweh
je change_teleport

cmp bx,2B84 // check for Requies Coast -> The Qualine
je change_teleport

jmp exit

change_teleport:
mov word ptr [eax+00000106],0005 // change location to 0,5
mov word ptr [eax+0000010C],0005 // change location to 0,5

exit:
movzx ebx,word ptr [eax+00000104]
jmp returnhere

[DISABLE]
dealloc(newmem)
_aMaphackLabel:
movzx ebx,word ptr [eax+00000104]
unregistersymbol(_aMaphackLabel)

I just came over a new problem, when I'm on cheat engine I can't enable wall hack? I was able to do this yesterday but not anymore...?

ocean334 · 03/15/2012, 22:24

MrWali, the wall hack (auto update one you used) didn't work for me for a moment then it did. Try it now.

Bleander · 03/15/2012, 22:34

Quote:

Originally Posted by MrWali

All of these works perfectly, any problems contact my on skype " MisterWali "

All creds go to gawron25

I just came over a new problem, when I'm on cheat engine I can't enable wall hack? I was able to do this yesterday but not anymore...?

Just restart comp.

boomboxer · 03/17/2012, 16:42

There is no exp on maps that r higher than my lvl ?

Bleander · 03/17/2012, 16:50

If u go to a map above ur lvl u will dc when u kill a moob cos of lvl cap.

boomboxer · 03/17/2012, 16:54

Quote:

Originally Posted by Bleander

If u go to a map above ur lvl u will dc when u kill a moob cos of lvl cap.

I didnt get dced just have no exp for the mobs.

Bleander · 03/17/2012, 17:14

that hapens cos the lvl cap m8.

jefimrox · 03/17/2012, 20:00

[ENABLE]
aobscan(_aVac,8B 50 1C 89 51 20) //004B7E8D
label(_aVacLabel)
registersymbol(_aVacLabel)
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

_aVac:
_aVacLabel:
jmp newmem
nop
returnhere:

newmem:
//DwExploreRange eax
mov [eax+08],00000040//DwSight eax+08
mov [eax+04],00000040//DwPersuitRange eax+04
mov [eax+0c],00000001 //DwAvoidRange eax+0C
//mov [eax+10],00000500//DwExploreStandDelay eax+10
//mov [eax+14],00000500//DwExploreMoveDelay eax+14
mov [eax+18],00000100//DwStandDelay eax+18
mov [eax+1C],00000100//DwMoveDelay eax+1C
//DwFollowMyMasterRange eax+20
//DwStopMasterNear eax+24
//DwWarpMyMasterRange eax+28
//mov [eax+2C],00000064//DwCallTeamPossibelHP eax+2C
//mov [eax+30],00000020//DwCallTeamCount eax+30
mov [eax+34],00000000//DwBlockNFirstAttack eax+34//mov [eax+38],00000020//dwCallTeamCell byte[eax+38]
//dwFollowTarget eax+3C
//dwSpecialAttackStartHP
//dwSpecialMeleeAttackRate
//dwSpecialRangeAttackRate
//DwPowerAttacjStartHP
//dwPowerMeleeAttackProbable
//dwPowerRangeAttackProbable
mov [eax+40],00000000//DwUnderAttackAggro eax+40
mov [eax+44],00000000//DwMeleeAttackRangeInAggro eax+44
mov [eax+48],00000000//DwRangeAttackRangeInAggro eax+48
//DwSightInAggro eax+4C
//DwDefeatAggro eax+50
mov [eax+54],00000000//DwBlockedAggro eax+54
mov [eax+58],00000000//DwSlideAggro eax+58
mov [eax+5C],00000000//DwHealAggro eax+5C
//DwMasterUnderAttackAggro eax+50
//DwMasterDefeatAggro eax+54
//DwMasterBlockingAggro eax+58
//DwMasterSlideAggro eax+5C
//DwCOmplusionUnderAttackAggro eax+60
mov [eax+A8],000000c8 //number of spawn
mov [eax+AC],00000001 //time summon
mov [eax+B4],00000001 //summonststartpccount
//mov [eax+70],00000000
//dwMaxSummonsMonsterCount eax+64
//dwReSummonsMonsterTick eax+68
//dwMaxSummonsMonsterRange eax+6C
//dwSummonsStartPcCountPatternType eax+70

originalcode:
mov edx,[eax+1c]
mov [ecx+20],edx

//mov edx,30 // number spawn
//mov [eax+8c],edx

//mov edx,64 // time delay spawn
//mov [eax+90],edx

mov edx,ff // # follow monster
mov [eax+3C],edx

mov [ecx+20],edx // # follow my master
exit:
jmp returnhere

[DISABLE]
dealloc(newmem)
_aVacLabel:
mov edx,[eax+1c]
mov [ecx+20],edx
unregistersymbol(_aVacLabel)

Where i change to set up more speed on mobs?
They r so slowing following me...

gawron25 · 03/17/2012, 23:12

Ultra Spawn Hack (Ultra Slow)

Spoiler

kimkata · 03/18/2012, 10:20

gawron is that mass spawn hack better than the other ? cos from the other i had like 1 mob in 2 secs from oread :S If some1 fixed it to spawn much mobs please share the script :P Thanks

demonkiller19 · 03/18/2012, 10:48

Quote:

Originally Posted by kimkata

gawron is that mass spawn hack better than the other ? cos from the other i had like 1 mob in 2 secs from oread :S If some1 fixed it to spawn much mobs please share the script :P Thanks

i hope they wont share it because then there will be always nub hackers at oread..!
and you need to find the aob of those mobs and they havent found it yet..

Regards,

Demon

boomboxer · 03/18/2012, 12:34

Yup m8's. Don't realese it, go and exp inside dungeons, like it was few years before.

xZerious · 03/18/2012, 12:53

A litte question, is there anyone with fully working hacks like they worked before without any problems with such a method? Or is it useless to start it yet and i should work for further infos?