h3hota.txt

<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="24">
  <CheatEntries>
    <CheatEntry>
      <ID>2</ID>
      <Description>"PlayerID"</Description>
      <LastState Value="6" RealAddress="0069CCF4"/>
      <VariableType>Byte</VariableType>
      <Address>h3hota.exe+29CCF4</Address>
    </CheatEntry>
    <CheatEntry>
      <ID>5</ID>
      <Description>"Unlimited Movement"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : h3hota.exe
  Version:
  Date   : 2016-10-12
  Author : Kien

  This script does blah blah blah
}

//sub edx,ecx
//cmp edx,eax
//mov [esi+4D],edx
define(playerID, [h3hota.exe+29CCF4])
define(move,2B D1 3B D0 89 56 4D)
define(embark,C7 46 4D 00 00 00 00)		//mov [esi+4D],00000000
define(disembark,C7 46 4D 00 00 00 00)		//mov [esi+4D],00000000
define(pond,C7 47 4D 00 00 00 00)	//mov [edi+4D],00000000
define(copyMove,8B 57 49 3B C2)	//mov edx,[edi+49]	//cmp eax,edx
define(dig,C7 42 4D 00 00 00 00)	//mov [edx+4D],00000000

[ENABLE]
//aobscanmodule should be used when the array of bytes change as game restart
//otherwise we use static address for simplicity.
//aobscanmodule(playerMove,h3hota.exe,2B D1 3B D0 89 56 4D) // should be unique
alloc(customcode,2048,h3hota.exe)

label(PlayerMove)
label(moveExit)
label(NPCMove)

label(PlayerEmbark)
label(embarkExit)
label(NPCEmbark)

label(PlayerDisembark)
label(disembarkExit)
label(NPCDisembark)

label(PlayerSwanPond)
label(pondExit)
label(NPCSwanPond)

label(PlayerCompareMove)
label(compareMoveExit)
label(NPCCompareMove)

label(PlayerDig)
label(digExit)
label(NPCDig)

registersymbol(customcode)
//============CUSTOM CODE=====================
customcode:
//section1
PlayerMove:
{$lua}
  return string.format('cmp byte ptr[esi+22],%d', readBytes('h3hota.exe+29CCF4'))
{$asm}
	jne NPCMove
	db 90 90 90 90
	//cmp edx,eax
	//mov [esi+4D],edx
	jmp moveExit

NPCMove:
	db move
	jmp moveExit

//end section1

//section2
PlayerEmbark:
{$lua}
  return string.format('cmp byte ptr[esi+22],%d', readBytes('h3hota.exe+29CCF4'))
{$asm}
	jne NPCEmbark
	db 90 90 90 90 90 90 90
	jmp embarkExit

NPCEmbark:
	db embark
	jmp embarkExit

//end section2

//section3
PlayerDisembark:
{$lua}
  return string.format('cmp byte ptr[esi+22],%d', readBytes('h3hota.exe+29CCF4'))
{$asm}
	jne NPCDisembark
	db 90 90 90 90 90 90 90
	jmp disembarkExit

NPCDisembark:
	db disembark
	jmp disembarkExit

//end section3

//section4
//Swan pond (+2 luck for all movement)
//Could have further memory analysis here
PlayerSwanPond:
{$lua}
  return string.format('cmp byte ptr[esi+22],%d', readBytes('h3hota.exe+29CCF4'))
{$asm}
	jne NPCSwanPond
	db 90 90 90 90 90 90 90
	jmp pondExit

NPCSwanPond:
  mov [edi+4D],00000000
  jmp pondExit

//end section4

//section5
PlayerCompareMove:
{$lua}
  return string.format('cmp byte ptr[esi+22],%d', readBytes('h3hota.exe+29CCF4'))
{$asm}
	jne NPCCompareMove
	mov edx,[edi+4D]
	cmp eax,edx
	jmp compareMoveExit

NPCCompareMove:
	db copyMove
	jmp compareMoveExit

//end section5

//section6
PlayerDig:
{$lua}
  return string.format('cmp byte ptr[esi+22],%d', readBytes('h3hota.exe+29CCF4'))
{$asm}
	jne NPCDig
	db 90 90 90 90 90 90 90
	jmp digExit

NPCDig:
	db dig
	jmp digExit

//end section6

//============END CUSTOM CODE=================

//===============INJECION=====================
"h3hota.exe"+80AA8:
	jmp PlayerMove
	nop
	nop
	moveExit:

"h3hota.exe"+9E340:
	jmp PlayerDisembark
	nop
	nop
	disembarkExit:

"h3hota.exe"+A0D08:
	jmp PlayerEmbark
	nop
	nop
	embarkExit:

"h3hota.exe"+A88CB:
	jmp PlayerSwanPond
	nop
	pondExit:

"h3hota.exe"+EC4A:
	jmp PlayerCompareMove
	compareMoveExit:

"h3hota.exe"+F0CC:
	jmp PlayerDig
	nop
	nop
	digExit:

//============END INJECION=====================

[DISABLE]
"h3hota.exe"+80AA8:
	db move

"h3hota.exe"+9E340:
	db disembark

"h3hota.exe"+A0D08:
	db embark

"h3hota.exe"+A88CB:
	db pond

"h3hota.exe"+EC4A:
	db copyMove

"h3hota.exe"+F0CC:
	db dig

unregistersymbol(customcode)
dealloc(customcode)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>928</ID>
      <Description>"Minimum Resource"</Description>
      <Options moHideChildren="1"/>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
[ENABLE]
function setResources()
	local pointer = readPointer("0069CCFC")
	for i = 6, 0, -1 do
		local addr = pointer + 0x9c + 4*i
		if i==6 then
			if readPointer(addr) &lt; 5000000 then
				writeInteger(addr, 5000000)
			else
				break
			end
		else
			if readPointer(addr) &lt; 5000 then
				writeInteger(addr, 5000)
			end
		end
	end
end

setResources()
GameTimer=createTimer(nil)
GameTimer.Interval=5000
GameTimer.OnTimer = setResources
GameTimer.Enabled = true

[DISABLE]
GameTimer.destroy()
{$asm}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>942</ID>
      <Description>"Unlimited Building"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : h3hota.exe
  Version:
  Date   : 2017-08-11
  Author : Kien

  Unlimited Building
}

define(address,"h3hota.exe"+1BF2A0)
define(build,C6 46 02 01 8B 86 50 01 00 00)

[ENABLE]
assert(address,build)
alloc(unlimitedbuild,$1000)

label(PlayerBuild)
label(buildExit)
label(NPCBuild)

registersymbol(unlimitedbuild)
//============CUSTOM CODE=====================
unlimitedbuild:
//section1
PlayerBuild:
{$lua}
  return string.format('cmp byte ptr [esi+1],%d', readBytes('h3hota.exe+29CCF4'))
{$asm}
	jne NPCBuild
	nop
	mov eax,[esi+00000150]
	jmp buildExit

NPCBuild:
	db build
	jmp buildExit

//end section1

//============END CUSTOM CODE=================

//===============INJECION=====================
address:
	jmp PlayerBuild
	db 90 90 90 90 90
	buildExit:

//============END INJECION=====================

[DISABLE]
address:
	db build
	// mov byte ptr [esi+02],01
	// mov eax,[esi+00000150]

unregistersymbol(unlimitedbuild)
dealloc(unlimitedbuild)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>940</ID>
      <Description>"Last Damaged Unit"</Description>
      <VariableType>4 Bytes</VariableType>
      <Address>"hota.dll"+0008C470</Address>
      <Offsets>
        <Offset>4C</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>935</ID>
      <Description>"Unit With Turn in Battle"</Description>
      <VariableType>4 Bytes</VariableType>
      <Address>"hota.dll"+0008C354</Address>
      <Offsets>
        <Offset>4C</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>941</ID>
      <Description>"Godmod"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : h3hota.exe
  Version:
  Date   : 2016-10-29
  Author : Kien

  This script does godmod!
}

define(battledamage,"h3hota.exe"+43E0C)
define(origincode,8B C2 89 56 4C)
[ENABLE]
//check whether exe contains this code
assert(battledamage,origincode)
alloc(newcode,$1000)

label(godmod)
label(return)
label(hitkill)
newcode:

godmod:
	//if player casts magic = 1 hit kill
	//cmp [["hota.dll"+0008C354]+4C],0
	//je hitkill

	//if player attacking = 1 hit kill
	mov eax,[esi+4C]
	cmp [["hota.dll"+0008C354]+4C],eax
	je hitkill

	//otherwise do not write to unit's health
	mov eax,edx
    nop
    //mov [esi+4C],edx
    jmp return

hitkill:
	//1 hit kill = 0 hit points for opponent
    mov eax,0
    mov [esi+4C],0
    jmp return

battledamage:
    jmp newcode
return:

[DISABLE]

battledamage:
  db origincode
  // mov eax,edx
  // mov [esi+4C],edx

dealloc(newcode)

{
// ORIGINAL CODE - INJECTION POINT: "h3hota.exe"+43E0C

"h3hota.exe"+43DF0: 88 8E E9 00 00 00     -  mov [esi+000000E9],cl
"h3hota.exe"+43DF6: 7E 06                 -  jle h3hota.exe+43DFE
"h3hota.exe"+43DF8: 8B 56 4C              -  mov edx,[esi+4C]
"h3hota.exe"+43DFB: 89 56 50              -  mov [esi+50],edx
"h3hota.exe"+43DFE: 8B 46 4C              -  mov eax,[esi+4C]
"h3hota.exe"+43E01: 3B F8                 -  cmp edi,eax
"h3hota.exe"+43E03: 7E 02                 -  jle h3hota.exe+43E07
"h3hota.exe"+43E05: 8B F8                 -  mov edi,eax
"h3hota.exe"+43E07: 8B 56 4C              -  mov edx,[esi+4C]
"h3hota.exe"+43E0A: 2B D7                 -  sub edx,edi
// ---------- INJECTING HERE ----------
"h3hota.exe"+43E0C: 8B C2                 -  mov eax,edx
"h3hota.exe"+43E0E: 89 56 4C              -  mov [esi+4C],edx
// ---------- DONE INJECTING  ----------
"h3hota.exe"+43E11: 85 C0                 -  test eax,eax
"h3hota.exe"+43E13: 7F 06                 -  jg h3hota.exe+43E1B
"h3hota.exe"+43E15: E9 97 ED F3 FF        -  jmp 00382BB1
"h3hota.exe"+43E1A: 90                    -  nop
"h3hota.exe"+43E1B: 6A 3E                 -  push 3E
"h3hota.exe"+43E1D: 8B CE                 -  mov ecx,esi
"h3hota.exe"+43E1F: E8 0C 04 00 00        -  call h3hota.exe+44230
"h3hota.exe"+43E24: 6A 46                 -  push 46
"h3hota.exe"+43E26: 8B CE                 -  mov ecx,esi
"h3hota.exe"+43E28: E8 03 04 00 00        -  call h3hota.exe+44230
}
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
  <CheatCodes>
    <CodeEntry>
      <Description>Code :mov [esi+18],00000000</Description>
      <Address>0046320E</Address>
      <ModuleName>h3hota.exe</ModuleName>
      <ModuleNameOffset>6320E</ModuleNameOffset>
      <Before>
        <Byte>C6</Byte>
        <Byte>00</Byte>
        <Byte>55</Byte>
        <Byte>00</Byte>
        <Byte>00</Byte>
      </Before>
      <Actual>
        <Byte>C7</Byte>
        <Byte>46</Byte>
        <Byte>18</Byte>
        <Byte>00</Byte>
        <Byte>00</Byte>
        <Byte>00</Byte>
        <Byte>00</Byte>
      </Actual>
      <After>
        <Byte>8D</Byte>
        <Byte>4E</Byte>
        <Byte>CC</Byte>
        <Byte>C7</Byte>
        <Byte>06</Byte>
      </After>
    </CodeEntry>
    <CodeEntry>
      <Description>Code :mov [ebx+4C],ecx</Description>
      <Address>0043D466</Address>
      <ModuleName>h3hota.exe</ModuleName>
      <ModuleNameOffset>3D466</ModuleNameOffset>
      <Before>
        <Byte>4D</Byte>
        <Byte>0C</Byte>
        <Byte>89</Byte>
        <Byte>43</Byte>
        <Byte>34</Byte>
      </Before>
      <Actual>
        <Byte>89</Byte>
        <Byte>4B</Byte>
        <Byte>4C</Byte>
      </Actual>
      <After>
        <Byte>8D</Byte>
        <Byte>14</Byte>
        <Byte>C5</Byte>
        <Byte>00</Byte>
        <Byte>00</Byte>
      </After>
    </CodeEntry>
    <CodeEntry>
      <Description>Building</Description>
      <Address>005BF2A0</Address>
      <ModuleName>h3hota.exe</ModuleName>
      <ModuleNameOffset>1BF2A0</ModuleNameOffset>
      <Before>
        <Byte>46</Byte>
        <Byte>02</Byte>
        <Byte>02</Byte>
        <Byte>EB</Byte>
        <Byte>04</Byte>
      </Before>
      <Actual>
        <Byte>C6</Byte>
        <Byte>46</Byte>
        <Byte>02</Byte>
        <Byte>01</Byte>
      </Actual>
      <After>
        <Byte>8B</Byte>
        <Byte>86</Byte>
        <Byte>50</Byte>
        <Byte>01</Byte>
        <Byte>00</Byte>
      </After>
    </CodeEntry>
    <CodeEntry>
      <Description>New day: reset building</Description>
      <Address>004C7D7F</Address>
      <ModuleName>h3hota.exe</ModuleName>
      <ModuleNameOffset>C7D7F</ModuleNameOffset>
      <Before>
        <Byte>14</Byte>
        <Byte>16</Byte>
        <Byte>02</Byte>
        <Byte>00</Byte>
        <Byte>47</Byte>
      </Before>
      <Actual>
        <Byte>C6</Byte>
        <Byte>44</Byte>
        <Byte>31</Byte>
        <Byte>02</Byte>
        <Byte>00</Byte>
      </Actual>
      <After>
        <Byte>81</Byte>
        <Byte>C6</Byte>
        <Byte>68</Byte>
        <Byte>01</Byte>
        <Byte>00</Byte>
      </After>
    </CodeEntry>
  </CheatCodes>
  <UserdefinedSymbols>    
    <SymbolEntry>
      <Name>stats</Name>
      <Address>7FF65FBEF1D2</Address>
    </SymbolEntry>
    <SymbolEntry>
      <Name>player</Name>
      <Address>7FF6F55C23AC</Address>
    </SymbolEntry>
    <SymbolEntry>
      <Name>player_ptr</Name>
      <Address>7FF6F4BE0022</Address>
    </SymbolEntry>
    <SymbolEntry>
      <Name>god</Name>
      <Address>7FF6F5966C0A</Address>
    </SymbolEntry>
    <SymbolEntry>
      <Name>god_code</Name>
      <Address>7FF6F4BD0000</Address>
    </SymbolEntry> 
  </UserdefinedSymbols>  
  <Comments>Info about this table:
</Comments>
</CheatTable>