Shantae Half-Genie Hero Cheat Table
Features
Features
- remote antidebug
- god mode
- infinite magic
- super jump
- increase health capacity
- massive damage
- increase gems on purchase
Patch isdebuggerPresent:
{ Game : ShantaeHero64.exe
Version:
Date : 2019-03-25
Author : ChrisFaytePC
This script does blah blah blah
}
[ENABLE]
aobscanmodule(debug,KERNELBASE.dll,65 48 8B 04 25 60 00 00 00 0F B6 40) // should be unique
alloc(newmem,$1000,"KERNELBASE.dll"+28C10)
alloc(dbg,8)
label(code)
label(return)
registersymbol(dbg)
dbg:
dq 0
newmem:
code:
mov rax,gs:[00000060]
mov [dbg],rax
mov byte ptr [rax+02],00
jmp return
debug:
jmp newmem
nop
nop
nop
nop
return:
registersymbol(debug)
[DISABLE]
debug:
db 65 48 8B 04 25 60 00 00 00
unregistersymbol(debug)
unregistersymbol(dbg)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "KERNELBASE.dll"+28C10
"KERNELBASE.dll"+28C00: 48 8D 05 89 34 1E 00 - lea rax,[KERNELBASE.dll+20C090]
"KERNELBASE.dll"+28C07: C3 - ret
"KERNELBASE.dll"+28C08: CC - int 3
"KERNELBASE.dll"+28C09: CC - int 3
"KERNELBASE.dll"+28C0A: CC - int 3
"KERNELBASE.dll"+28C0B: CC - int 3
"KERNELBASE.dll"+28C0C: CC - int 3
"KERNELBASE.dll"+28C0D: CC - int 3
"KERNELBASE.dll"+28C0E: CC - int 3
"KERNELBASE.dll"+28C0F: CC - int 3
// ---------- INJECTING HERE ----------
"KERNELBASE.dll"+28C10: 65 48 8B 04 25 60 00 00 00 - mov rax,gs:[00000060]
// ---------- DONE INJECTING ----------
"KERNELBASE.dll"+28C19: 0F B6 40 02 - movzx eax,byte ptr [rax+02]
"KERNELBASE.dll"+28C1D: C3 - ret
"KERNELBASE.dll"+28C1E: CC - int 3
"KERNELBASE.dll"+28C1F: CC - int 3
"KERNELBASE.dll"+28C20: CC - int 3
"KERNELBASE.dll"+28C21: CC - int 3
"KERNELBASE.dll"+28C22: CC - int 3
"KERNELBASE.dll"+28C23: CC - int 3
"KERNELBASE.dll"+28C24: CC - int 3
"KERNELBASE.dll"+28C25: CC - int 3
}
god mode:
{ Game : ShantaeHero64.exe
Version:
Date : 2019-03-26
Author : ChrisFaytePC
This script does blah blah blah
}
[ENABLE]
aobscanmodule(health1,ShantaeHero64.exe,0F 2F 88 E8 02 00 00) // should be unique
alloc(newmem,$1000,"ShantaeHero64.exe"+170C8F)
alloc(hlth,8)
label(code)
label(return)
registersymbol(hlth)
hlth:
dq 0
newmem:
code:
mov [hlth],rax
//mov [rax+000002E4],(float)70
movss xmm1,[rax+000002E4]
movss [rax+000002E8],xmm1
xorps xmm1,xmm1
comiss xmm1,[rax+000002E8]
jmp return
health1:
jmp newmem
nop
nop
return:
registersymbol(health1)
[DISABLE]
health1:
db 0F 2F 88 E8 02 00 00
unregistersymbol(health1)
unregistersymbol(hlth)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "ShantaeHero64.exe"+170C8F
"ShantaeHero64.exe"+170C61: 48 8B 05 58 3E 51 00 - mov rax,[ShantaeHero64.exe+684AC0]
"ShantaeHero64.exe"+170C68: 48 85 C0 - test rax,rax
"ShantaeHero64.exe"+170C6B: 74 09 - je ShantaeHero64.exe+170C76
"ShantaeHero64.exe"+170C6D: 80 B8 49 01 00 00 00 - cmp byte ptr [rax+00000149],00
"ShantaeHero64.exe"+170C74: 75 49 - jne ShantaeHero64.exe+170CBF
"ShantaeHero64.exe"+170C76: 80 3D 2A 40 51 00 00 - cmp byte ptr [ShantaeHero64.exe+684CA7],00
"ShantaeHero64.exe"+170C7D: 75 40 - jne ShantaeHero64.exe+170CBF
"ShantaeHero64.exe"+170C7F: 80 B9 68 10 00 00 00 - cmp byte ptr [rcx+00001068],00
"ShantaeHero64.exe"+170C86: 75 37 - jne ShantaeHero64.exe+170CBF
"ShantaeHero64.exe"+170C88: 48 8B 81 B8 05 00 00 - mov rax,[rcx+000005B8]
// ---------- INJECTING HERE ----------
"ShantaeHero64.exe"+170C8F: 0F 2F 88 E8 02 00 00 - comiss xmm1,[rax+000002E8]
// ---------- DONE INJECTING ----------
"ShantaeHero64.exe"+170C96: 73 27 - jae ShantaeHero64.exe+170CBF
"ShantaeHero64.exe"+170C98: 48 8B 05 A1 40 51 00 - mov rax,[ShantaeHero64.exe+684D40]
"ShantaeHero64.exe"+170C9F: 48 85 C0 - test rax,rax
"ShantaeHero64.exe"+170CA2: 74 06 - je ShantaeHero64.exe+170CAA
"ShantaeHero64.exe"+170CA4: 80 78 30 00 - cmp byte ptr [rax+30],00
"ShantaeHero64.exe"+170CA8: 74 15 - je ShantaeHero64.exe+170CBF
"ShantaeHero64.exe"+170CAA: 48 8B 82 60 0A 00 00 - mov rax,[rdx+00000A60]
"ShantaeHero64.exe"+170CB1: 48 85 C0 - test rax,rax
"ShantaeHero64.exe"+170CB4: 74 06 - je ShantaeHero64.exe+170CBC
"ShantaeHero64.exe"+170CB6: 80 78 30 00 - cmp byte ptr [rax+30],00
}
infinite mana:
{ Game : ShantaeHero64.exe
Version:
Date : 2019-03-27
Author : ChrisFaytePC
This script does blah blah blah
}
[ENABLE]
aobscanmodule(magic_subtract,ShantaeHero64.exe,F3 0F 5C C8 E8 6E 03 00 00)
aobscanmodule(magic2,ShantaeHero64.exe,F3 0F 5C CE 48 8B CF)
aobscanmodule(magic3,ShantaeHero64.exe,F3 0F 10 49 44 EB 03 0F 28)
alloc(newmem,$1000,"ShantaeHero64.exe"+10BE89)
alloc(newmema,$1000,"ShantaeHero64.exe"+A3BE7)
label(code)
label(return)
label(magic)
label(codea)
label(returna)
registersymbol(magic)
registersymbol(magic2)
magic2:
db 90 90 90 90
newmem:
code:
movss xmm1,[rcx+48]
call ShantaeHero64.exe+10C200
jmp return
magic:
dd 0
magic_subtract:
jmp newmem
nop
nop
nop
nop
return:
registersymbol(magic_subtract)
newmema:
codea:
movss xmm1,[rcx+48]
movss [rcx+44],xmm1
movss xmm1,[rcx+44]
jmp returna
magic3:
jmp newmema
returna:
registersymbol(magic3)
[DISABLE]
magic_subtract:
db F3 0F 5C C8 E8 6E 03 00 00
magic2:
db F3 0F 5C CE
magic3:
db F3 0F 10 49 44
unregistersymbol(magic3)
unregistersymbol(magic2)
unregistersymbol(magic_subtract)
dealloc(newmem)
dealloc(newmema)
{
// ORIGINAL CODE - INJECTION POINT: "ShantaeHero64.exe"+10BE89
"ShantaeHero64.exe"+10BE68: 0F 2F C1 - comiss xmm0,xmm1
"ShantaeHero64.exe"+10BE6B: 72 1C - jb ShantaeHero64.exe+10BE89
"ShantaeHero64.exe"+10BE6D: 0F 28 CA - movaps xmm1,xmm2
"ShantaeHero64.exe"+10BE70: E8 8B 03 00 00 - call ShantaeHero64.exe+10C200
"ShantaeHero64.exe"+10BE75: 33 D2 - xor edx,edx
"ShantaeHero64.exe"+10BE77: 48 8B CF - mov rcx,rdi
"ShantaeHero64.exe"+10BE7A: 48 8B 5C 24 30 - mov rbx,[rsp+30]
"ShantaeHero64.exe"+10BE7F: 48 83 C4 20 - add rsp,20
"ShantaeHero64.exe"+10BE83: 5F - pop rdi
"ShantaeHero64.exe"+10BE84: E9 07 FB FF FF - jmp ShantaeHero64.exe+10B990
// ---------- INJECTING HERE ----------
"ShantaeHero64.exe"+10BE89: F3 0F 5C C8 - subss xmm1,xmm0
"ShantaeHero64.exe"+10BE8D: E8 6E 03 00 00 - call ShantaeHero64.exe+10C200
// ---------- DONE INJECTING ----------
"ShantaeHero64.exe"+10BE92: 48 8B 5C 24 30 - mov rbx,[rsp+30]
"ShantaeHero64.exe"+10BE97: 48 83 C4 20 - add rsp,20
"ShantaeHero64.exe"+10BE9B: 5F - pop rdi
"ShantaeHero64.exe"+10BE9C: C3 - ret
"ShantaeHero64.exe"+10BE9D: CC - int 3
"ShantaeHero64.exe"+10BE9E: CC - int 3
"ShantaeHero64.exe"+10BE9F: CC - int 3
"ShantaeHero64.exe"+10BEA0: 48 89 5C 24 08 - mov [rsp+08],rbx
"ShantaeHero64.exe"+10BEA5: 48 89 74 24 10 - mov [rsp+10],rsi
"ShantaeHero64.exe"+10BEAA: 57 - push rdi
}
