Dishonored Death of the Outsider Cheat Table
Features
Sample Scripts
Features
- God Mode
- Infinite Ammo
- Infinite Breath
- Stealth Cheat
- Instant Choke
Sample Scripts
Infinite Health:
[ENABLE]
aobscanmodule(health1,Dishonored_DO.exe,F3 0F 10 77 20 0F) // should be unique
alloc(newmem,$1000,"Dishonored_DO.exe"+7FC96B)
label(code)
label(return)
newmem:
code:
movss [rdi+20],xmm0
movss xmm6,[rdi+20]
jmp return
health1:
jmp newmem
return:
registersymbol(health1)
[DISABLE]
health1:
db F3 0F 10 77 20
unregistersymbol(health1)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "Dishonored_DO.exe"+7FC96B
"Dishonored_DO.exe"+7FC93A: 48 89 6C 24 50 - mov [rsp+50],rbp
"Dishonored_DO.exe"+7FC93F: 48 8B CF - mov rcx,rdi
"Dishonored_DO.exe"+7FC942: 0F 29 74 24 30 - movaps [rsp+30],xmm6
"Dishonored_DO.exe"+7FC947: 0F 29 7C 24 20 - movaps [rsp+20],xmm7
"Dishonored_DO.exe"+7FC94C: 0F B6 A8 D9 00 00 00 - movzx ebp,byte ptr [rax+000000D9]
"Dishonored_DO.exe"+7FC953: 48 8B 07 - mov rax,[rdi]
"Dishonored_DO.exe"+7FC956: 40 C0 ED 03 - shr bpl,03
"Dishonored_DO.exe"+7FC95A: 40 80 E5 01 - and bpl,01
"Dishonored_DO.exe"+7FC95E: FF 90 E0 00 00 00 - call qword ptr [rax+000000E0]
"Dishonored_DO.exe"+7FC964: F6 87 58 01 00 00 08 - test byte ptr [rdi+00000158],08
// ---------- INJECTING HERE ----------
"Dishonored_DO.exe"+7FC96B: F3 0F 10 77 20 - movss xmm6,[rdi+20]
// ---------- DONE INJECTING ----------
"Dishonored_DO.exe"+7FC970: 0F 28 F8 - movaps xmm7,xmm0
"Dishonored_DO.exe"+7FC973: 74 0D - je Dishonored_DO.exe+7FC982
"Dishonored_DO.exe"+7FC975: 48 8B CF - mov rcx,rdi
"Dishonored_DO.exe"+7FC978: E8 43 2C 0C 00 - call Dishonored_DO.exe+8BF5C0
"Dishonored_DO.exe"+7FC97D: 0F 28 C8 - movaps xmm1,xmm0
"Dishonored_DO.exe"+7FC980: EB 03 - jmp Dishonored_DO.exe+7FC985
"Dishonored_DO.exe"+7FC982: 0F 28 CE - movaps xmm1,xmm6
"Dishonored_DO.exe"+7FC985: 48 8B CF - mov rcx,rdi
"Dishonored_DO.exe"+7FC988: E8 F3 36 0C 00 - call Dishonored_DO.exe+8C0080
"Dishonored_DO.exe"+7FC98D: 0F 57 C0 - xorps xmm0,xmm0
}
Infinite Breath cheat:
[ENABLE]
aobscanmodule(breath_sub,Dishonored_DO.exe,F3 0F 5C C8 F3 0F 5F D9 F3 0F 11 59) // should be unique
alloc(newmema,$1000,"Dishonored_DO.exe"+A2EC21)
label(codea)
label(max_breath)
label(returna)
newmema:
codea:
//subss xmm1,xmm0
movss xmm3,[max_breath]
jmp returna
max_breath:
dd (float)100
breath_sub:
jmp newmema
nop
nop
nop
returna:
registersymbol(breath_sub)
[DISABLE]
breath_sub:
db F3 0F 5C C8 F3 0F 5F D9
unregistersymbol(breath_sub)
dealloc(newmema)
{
// ORIGINAL CODE - INJECTION POINT: "Dishonored_DO.exe"+A2EC21
"Dishonored_DO.exe"+A2EBF8: EB 03 - jmp Dishonored_DO.exe+A2EBFD
"Dishonored_DO.exe"+A2EBFA: 0F 28 CF - movaps xmm1,xmm7
"Dishonored_DO.exe"+A2EBFD: 49 8B 8E A8 03 00 00 - mov rcx,[r14+000003A8]
"Dishonored_DO.exe"+A2EC04: 41 0F 28 C0 - movaps xmm0,xmm8
"Dishonored_DO.exe"+A2EC08: 0F 28 DF - movaps xmm3,xmm7
"Dishonored_DO.exe"+A2EC0B: C7 45 60 00 00 00 00 - mov [rbp+60],00000000
"Dishonored_DO.exe"+A2EC12: 8B 45 60 - mov eax,[rbp+60]
"Dishonored_DO.exe"+A2EC15: F3 0F 59 C1 - mulss xmm0,xmm1
"Dishonored_DO.exe"+A2EC19: 89 41 44 - mov [rcx+44],eax
"Dishonored_DO.exe"+A2EC1C: F3 0F 10 49 40 - movss xmm1,[rcx+40]
// ---------- INJECTING HERE ----------
"Dishonored_DO.exe"+A2EC21: F3 0F 5C C8 - subss xmm1,xmm0
"Dishonored_DO.exe"+A2EC25: F3 0F 5F D9 - maxss xmm3,xmm1
// ---------- DONE INJECTING ----------
"Dishonored_DO.exe"+A2EC29: F3 0F 11 59 40 - movss [rcx+40],xmm3
"Dishonored_DO.exe"+A2EC2E: 33 D2 - xor edx,edx
"Dishonored_DO.exe"+A2EC30: 48 8B CE - mov rcx,rsi
"Dishonored_DO.exe"+A2EC33: E8 F8 05 00 00 - call Dishonored_DO.exe+A2F230
"Dishonored_DO.exe"+A2EC38: 4D 8B AE 60 03 00 00 - mov r13,[r14+00000360]
"Dishonored_DO.exe"+A2EC3F: F3 0F 10 57 64 - movss xmm2,[rdi+64]
"Dishonored_DO.exe"+A2EC44: F3 0F 10 5F 74 - movss xmm3,[rdi+74]
"Dishonored_DO.exe"+A2EC49: 49 8B 45 48 - mov rax,[r13+48]
"Dishonored_DO.exe"+A2EC4D: F3 0F 5C 5F 78 - subss xmm3,[rdi+78]
"Dishonored_DO.exe"+A2EC52: 0F 28 C2 - movaps xmm0,xmm2
}
instant Choke:
[ENABLE]
aobscanmodule(choke_add,Dishonored_DO.exe,F3 0F 58 83 CC 00 00 00) // should be unique
alloc(newmem,$1000,"Dishonored_DO.exe"+A0C5FB)
label(code)
label(return)
newmem:
code:
movss [rbx+000000CC],xmm3
addss xmm0,[rbx+000000CC]
jmp return
choke_add:
jmp newmem
nop
nop
nop
return:
registersymbol(choke_add)
[DISABLE]
choke_add:
db F3 0F 58 83 CC 00 00 00
unregistersymbol(choke_add)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "Dishonored_DO.exe"+A0C5FB
"Dishonored_DO.exe"+A0C5CB: 48 03 C9 - add rcx,rcx
"Dishonored_DO.exe"+A0C5CE: 8B 8C C8 68 7C 2F 00 - mov ecx,[rax+rcx*8+002F7C68]
"Dishonored_DO.exe"+A0C5D5: 89 4C 24 40 - mov [rsp+40],ecx
"Dishonored_DO.exe"+A0C5D9: 8B 8B E0 00 00 00 - mov ecx,[rbx+000000E0]
"Dishonored_DO.exe"+A0C5DF: F3 0F 10 4C 24 40 - movss xmm1,[rsp+40]
"Dishonored_DO.exe"+A0C5E5: 48 D3 E6 - shl rsi,cl
"Dishonored_DO.exe"+A0C5E8: 48 23 B7 98 00 00 00 - and rsi,[rdi+00000098]
"Dishonored_DO.exe"+A0C5EF: 48 85 B7 80 00 00 00 - test [rdi+00000080],rsi
"Dishonored_DO.exe"+A0C5F6: 74 15 - je Dishonored_DO.exe+A0C60D
"Dishonored_DO.exe"+A0C5F8: 0F 28 C1 - movaps xmm0,xmm1
// ---------- INJECTING HERE ----------
"Dishonored_DO.exe"+A0C5FB: F3 0F 58 83 CC 00 00 00 - addss xmm0,[rbx+000000CC]
// ---------- DONE INJECTING ----------
"Dishonored_DO.exe"+A0C603: F3 0F 11 83 CC 00 00 00 - movss [rbx+000000CC],xmm0
"Dishonored_DO.exe"+A0C60B: EB 12 - jmp Dishonored_DO.exe+A0C61F
"Dishonored_DO.exe"+A0C60D: C7 44 24 40 00 00 00 00 - mov [rsp+40],00000000
"Dishonored_DO.exe"+A0C615: 8B 44 24 40 - mov eax,[rsp+40]
"Dishonored_DO.exe"+A0C619: 89 83 CC 00 00 00 - mov [rbx+000000CC],eax
"Dishonored_DO.exe"+A0C61F: F3 0F 58 8B D0 00 00 00 - addss xmm1,[rbx+000000D0]
"Dishonored_DO.exe"+A0C627: 48 8B 6C 24 50 - mov rbp,[rsp+50]
"Dishonored_DO.exe"+A0C62C: 48 8B 74 24 58 - mov rsi,[rsp+58]
"Dishonored_DO.exe"+A0C631: F3 0F 11 8B D0 00 00 00 - movss [rbx+000000D0],xmm1
"Dishonored_DO.exe"+A0C639: 48 8B 5C 24 48 - mov rbx,[rsp+48]
}
