Bards Tale 4 Cheat Table - Gold Hack, One Hit Kills, Experience Hack
Features
Features
- Gold Hack
- One Hit Kills
- Experience Hack
- skill points
- wealthy merchants
Infinite Health & 1 Hit Kills:
{ Game : BardsTale4-Win64-Shipping.exe
Version:
Date : 2018-09-23
Author : ChrisFaytePC
This script does blah blah blah
}
[ENABLE]
aobscanmodule(god3,BardsTale4-Win64-Shipping.exe,41 03 8F 98 01 00 00)
alloc(newmem,$1000,god3)
label(code)
label(return)
label(onehit)
label(code2)
registersymbol(onehit)
newmem:
add ecx,[r15+00000198]
cmp [r15+48],00
jne code
mov rax,rcx
jmp code2
code:
cmp [onehit],1
jne code2
mov [r15+5C],00 // replace 00 with eax for normal damage
jmp return
code2:
mov [r15+5C],eax
jmp return
onehit:
dd 0
god3:
jmp newmem
nop
nop
nop
nop
nop
nop
return:
registersymbol(god3)
[DISABLE]
god3:
db 41 03 8F 98 01 00 00 41 89 47 5C
unregistersymbol(god3)
unregistersymbol(onehit)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "BardsTale4-Win64-Shipping.exe"+29DBDF
"BardsTale4-Win64-Shipping.exe"+29DBB5: 41 8B 47 64 - mov eax,[r15+64]
"BardsTale4-Win64-Shipping.exe"+29DBB9: 89 4C 24 70 - mov [rsp+70],ecx
"BardsTale4-Win64-Shipping.exe"+29DBBD: 2B CB - sub ecx,ebx
"BardsTale4-Win64-Shipping.exe"+29DBBF: 89 44 24 78 - mov [rsp+78],eax
"BardsTale4-Win64-Shipping.exe"+29DBC3: 41 8B 47 68 - mov eax,[r15+68]
"BardsTale4-Win64-Shipping.exe"+29DBC7: 89 44 24 7C - mov [rsp+7C],eax
"BardsTale4-Win64-Shipping.exe"+29DBCB: 41 8B C0 - mov eax,r8d
"BardsTale4-Win64-Shipping.exe"+29DBCE: 0F 49 C1 - cmovns eax,ecx
"BardsTale4-Win64-Shipping.exe"+29DBD1: 41 8B 8F F0 01 00 00 - mov ecx,[r15+000001F0]
"BardsTale4-Win64-Shipping.exe"+29DBD8: 41 03 8F AC 01 00 00 - add ecx,[r15+000001AC]
// ---------- INJECTING HERE ----------
"BardsTale4-Win64-Shipping.exe"+29DBDF: 41 03 8F 98 01 00 00 - add ecx,[r15+00000198]
// ---------- DONE INJECTING ----------
"BardsTale4-Win64-Shipping.exe"+29DBE6: 41 89 47 5C - mov [r15+5C],eax
"BardsTale4-Win64-Shipping.exe"+29DBEA: 79 07 - jns BardsTale4-Win64-Shipping.exe+29DBF3
"BardsTale4-Win64-Shipping.exe"+29DBEC: 44 89 44 24 50 - mov [rsp+50],r8d
"BardsTale4-Win64-Shipping.exe"+29DBF1: EB 0B - jmp BardsTale4-Win64-Shipping.exe+29DBFE
"BardsTale4-Win64-Shipping.exe"+29DBF3: 3B CE - cmp ecx,esi
"BardsTale4-Win64-Shipping.exe"+29DBF5: 8B C6 - mov eax,esi
"BardsTale4-Win64-Shipping.exe"+29DBF7: 0F 4C C1 - cmovl eax,ecx
"BardsTale4-Win64-Shipping.exe"+29DBFA: 89 44 24 50 - mov [rsp+50],eax
"BardsTale4-Win64-Shipping.exe"+29DBFE: 41 8B 8F FC 01 00 00 - mov ecx,[r15+000001FC]
"BardsTale4-Win64-Shipping.exe"+29DC05: 41 03 8F B8 01 00 00 - add ecx,[r15+000001B8]
}
Experience Hack:
{ Game : BardsTale4-Win64-Shipping.exe
Version:
Date : 2018-09-19
Author : ChrisPC
This script does blah blah blah
}
[ENABLE]
aobscanmodule(xp1,BardsTale4-Win64-Shipping.exe,03 91 B0 02 00 00) // should be unique
alloc(newmem,$1000,"BardsTale4-Win64-Shipping.exe"+2C3AEA)
label(code)
label(return)
label(xp)
registersymbol(xp)
newmem:
{cmp [rcx+2B0],#99999
jge code
add edx,[rcx+000002B0]
add edx,edx
jmp return}
cmp [rcx+1c],2
jl code
mov [xp],rcx
code:
//shl [rcx+000002B0],3
add edx,[rcx+000002B0]
jmp return
xp:
dd 0
xp1:
jmp newmem
nop
return:
registersymbol(xp1)
[DISABLE]
xp1:
db 03 91 B0 02 00 00
unregistersymbol(xp1)
unregistersymbol(xp)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "BardsTale4-Win64-Shipping.exe"+2C3AEA
"BardsTale4-Win64-Shipping.exe"+2C3AC5: 48 8B 6C 24 78 - mov rbp,[rsp+78]
"BardsTale4-Win64-Shipping.exe"+2C3ACA: 48 8B B4 24 80 00 00 00 - mov rsi,[rsp+00000080]
"BardsTale4-Win64-Shipping.exe"+2C3AD2: 48 83 C4 60 - add rsp,60
"BardsTale4-Win64-Shipping.exe"+2C3AD6: 5F - pop rdi
"BardsTale4-Win64-Shipping.exe"+2C3AD7: 48 FF A0 38 02 00 00 - jmp qword ptr [rax+00000238]
"BardsTale4-Win64-Shipping.exe"+2C3ADE: CC - int 3
"BardsTale4-Win64-Shipping.exe"+2C3ADF: CC - int 3
"BardsTale4-Win64-Shipping.exe"+2C3AE0: 48 89 5C 24 10 - mov [rsp+10],rbx
"BardsTale4-Win64-Shipping.exe"+2C3AE5: 57 - push rdi
"BardsTale4-Win64-Shipping.exe"+2C3AE6: 48 83 EC 30 - sub rsp,30
// ---------- INJECTING HERE ----------
"BardsTale4-Win64-Shipping.exe"+2C3AEA: 03 91 B0 02 00 00 - add edx,[rcx+000002B0]
// ---------- DONE INJECTING ----------
"BardsTale4-Win64-Shipping.exe"+2C3AF0: 48 8B F9 - mov rdi,rcx
"BardsTale4-Win64-Shipping.exe"+2C3AF3: 8B 59 70 - mov ebx,[rcx+70]
"BardsTale4-Win64-Shipping.exe"+2C3AF6: 89 91 B0 02 00 00 - mov [rcx+000002B0],edx
"BardsTale4-Win64-Shipping.exe"+2C3AFC: 48 8B 89 80 02 00 00 - mov rcx,[rcx+00000280]
"BardsTale4-Win64-Shipping.exe"+2C3B03: E8 E8 14 FE FF - call BardsTale4-Win64-Shipping.exe+2A4FF0
"BardsTale4-Win64-Shipping.exe"+2C3B08: 3B C3 - cmp eax,ebx
"BardsTale4-Win64-Shipping.exe"+2C3B0A: 89 47 70 - mov [rdi+70],eax
"BardsTale4-Win64-Shipping.exe"+2C3B0D: 0F 9F C3 - setg bl
"BardsTale4-Win64-Shipping.exe"+2C3B10: 84 DB - test bl,bl
"BardsTale4-Win64-Shipping.exe"+2C3B12: 0F 84 92 00 00 00 - je BardsTale4-Win64-Shipping.exe+2C3BAA
}
Skill points max:
{ Game : BardsTale4-Win64-Shipping.exe
Version:
Date : 2018-09-20
Author : ChrisPC
This script does blah blah blah
}
[ENABLE]
aobscanmodule(skill_points,BardsTale4-Win64-Shipping.exe,41 8B D7 48 8B 88 80 02 00 00)
alloc(newmem,$1000,"BardsTale4-Win64-Shipping.exe"+32BA17)
label(code)
label(return)
newmem:
code:
mov r15,10-3
mov edx,r15d
mov rcx,[rax+00000280]
jmp return
skill_points:
jmp newmem
nop
nop
nop
nop
nop
return:
registersymbol(skill_points)
[DISABLE]
skill_points:
db 41 8B D7 48 8B 88 80 02 00 00
unregistersymbol(skill_points)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "BardsTale4-Win64-Shipping.exe"+32BA17
"BardsTale4-Win64-Shipping.exe"+32B9E9: 48 8B 8E 48 03 00 00 - mov rcx,[rsi+00000348]
"BardsTale4-Win64-Shipping.exe"+32B9F0: 8B D7 - mov edx,edi
"BardsTale4-Win64-Shipping.exe"+32B9F2: E8 D9 57 FB FF - call BardsTale4-Win64-Shipping.exe+2E11D0
"BardsTale4-Win64-Shipping.exe"+32B9F7: 4C 8B AC 24 90 00 00 00 - mov r13,[rsp+00000090]
"BardsTale4-Win64-Shipping.exe"+32B9FF: 4D 85 E4 - test r12,r12
"BardsTale4-Win64-Shipping.exe"+32BA02: 74 08 - je BardsTale4-Win64-Shipping.exe+32BA0C
"BardsTale4-Win64-Shipping.exe"+32BA04: 49 8B CC - mov rcx,r12
"BardsTale4-Win64-Shipping.exe"+32BA07: E8 34 C3 10 00 - call BardsTale4-Win64-Shipping.exe+437D40
"BardsTale4-Win64-Shipping.exe"+32BA0C: 4C 8B 65 6F - mov r12,[rbp+6F]
"BardsTale4-Win64-Shipping.exe"+32BA10: 48 8B 86 48 03 00 00 - mov rax,[rsi+00000348]
// ---------- INJECTING HERE ----------
"BardsTale4-Win64-Shipping.exe"+32BA17: 41 8B D7 - mov edx,r15d
"BardsTale4-Win64-Shipping.exe"+32BA1A: 48 8B 88 80 02 00 00 - mov rcx,[rax+00000280]
// ---------- DONE INJECTING ----------
"BardsTale4-Win64-Shipping.exe"+32BA21: E8 1A 96 F7 FF - call BardsTale4-Win64-Shipping.exe+2A5040
"BardsTale4-Win64-Shipping.exe"+32BA26: 48 8B 8E 48 03 00 00 - mov rcx,[rsi+00000348]
"BardsTale4-Win64-Shipping.exe"+32BA2D: 8B D0 - mov edx,eax
"BardsTale4-Win64-Shipping.exe"+32BA2F: E8 DC 6B FB FF - call BardsTale4-Win64-Shipping.exe+2E2610
"BardsTale4-Win64-Shipping.exe"+32BA34: 8B 96 84 03 00 00 - mov edx,[rsi+00000384]
"BardsTale4-Win64-Shipping.exe"+32BA3A: 48 8B 8E 48 03 00 00 - mov rcx,[rsi+00000348]
"BardsTale4-Win64-Shipping.exe"+32BA41: E8 6A 70 F9 FF - call BardsTale4-Win64-Shipping.exe+2C2AB0
"BardsTale4-Win64-Shipping.exe"+32BA46: 48 8B 96 48 03 00 00 - mov rdx,[rsi+00000348]
"BardsTale4-Win64-Shipping.exe"+32BA4D: 49 8B CC - mov rcx,r12
"BardsTale4-Win64-Shipping.exe"+32BA50: E8 9B EB EF FF - call BardsTale4-Win64-Shipping.exe+22A5F0
}
