2
"avg speed"
80000008
Auto Assembler Script
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
mov [ebp+000026C8],(float)240.0
originalcode:
//movss [ebp+000026C8],xmm0
exit:
jmp returnhere
"NFS13.exe"+2EA7BB:
jmp newmem
nop
nop
nop
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"NFS13.exe"+2EA7BB:
movss [ebp+000026C8],xmm0
//Alt: db F3 0F 11 85 C8 26 00 00
6
"first place"
80000008
Auto Assembler Script
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
mov ebp,1
originalcode:
mov [esi+58],ebp
movss xmm0,[esi+eax*4+60]
exit:
jmp returnhere
"NFS13.exe"+339D6A:
jmp newmem
nop
nop
nop
nop
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"NFS13.exe"+339D6A:
mov [esi+58],ebp
movss xmm0,[esi+eax*4+60]
//Alt: db 89 6E 58 F3 0F 10 44 86 60
70
"speed-break-jump"
80000008
Auto Assembler Script
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048) //2kb should be enough
alloc(SavedPos,500)
label(returnhere)
label(originalcode)
label(vec4SetLength)
label(vec4GetLength)
label(setVec4)
label(vec4Copy)
label(superSpeed)
label(superBreak)
label(operate)
label(jump)
SavedPos:
dd 00000000
newmem: //this is allocated memory, you have read,write,execute access
movaps [eax+20],xmm3
pushfd
pushad
push 41
call GetKeyState
test ax,8000
jnz superSpeed
push 12
call GetKeyState
test ax,8000
jnz jump
mov [SavedPos],(float)50.0
push 5A
call GetKeyState
test ax,8000
jnz superBreak
jmp originalcode
superSpeed:
push (float)200.0
mov ecx,["NFS13.exe"+00CD1938]
mov ecx,[ecx+19C]
mov ecx,[ecx+148]
mov ecx,[ecx+14]
lea ecx,[ecx+40]
push ecx
call operate
add esp,8
push (float)200.0
mov ecx,["NFS13.exe"+00CD1938]
mov ecx,[ecx+19C]
mov ecx,[ecx+148]
mov ecx,[ecx+18]
lea ecx,[ecx+40]
push ecx
call operate
add esp,8
jmp originalcode
superBreak:
push (float)0.01
mov ecx,["NFS13.exe"+00CD1938]
mov ecx,[ecx+19C]
mov ecx,[ecx+148]
mov ecx,[ecx+14]
lea ecx,[ecx+40]
push ecx
call operate
add esp,8
push (float)0.01
mov ecx,["NFS13.exe"+00CD1938]
mov ecx,[ecx+19C]
mov ecx,[ecx+148]
mov ecx,[ecx+18]
lea ecx,[ecx+40]
push ecx
call operate
add esp,8
push (float)0.01
mov ecx,["NFS13.exe"+00CD1938]
mov ecx,[ecx+19C]
mov ecx,[ecx+148]
mov ecx,[ecx+1C]
lea ecx,[ecx+40]
push ecx
call operate
add esp,8
push (float)0.01
mov ecx,["NFS13.exe"+00CD1938]
mov ecx,[ecx+19C]
mov ecx,[ecx+148]
mov ecx,[ecx+20]
lea ecx,[ecx+40]
push ecx
call operate
add esp,8
jmp originalcode
jump:
mov ecx,["NFS13.exe"+00CD1938]
mov ecx,[ecx+19C]
mov ecx,[ecx+148]
push ecx
mov ecx,[esp]
mov ecx,[ecx+14]
add esp,4
fld [ecx+0044]
fadd [SavedPos]
fstp [ecx+0044]
fld [ecx+00C4]
fadd [SavedPos]
fstp [ecx+00C4]
fld [ecx+0144]
fadd [SavedPos]
fstp [ecx+0144]
fld [ecx+01C4]
fadd [SavedPos]
fstp [ecx+01C4]
mov [SavedPos],(float)0.0
jmp originalcode
originalcode:
popad
popfd
ret 0008
operate:
push [esp+4]
call vec4GetLength
mov eax,[esp+8]
fld [eax]
fmul [esp+0C]
fdiv [esp]
fstp [eax]
fld [eax+4]
fmul [esp+0C]
fdiv [esp]
fstp [eax+4]
fld [eax+8]
fmul [esp+0C]
fdiv [esp]
fstp [eax+8]
fld [eax+0C]
fmul [esp+0C]
fdiv [esp]
fstp [eax+0C]
add esp,4
ret
vec4SetLength:
push [esp+4]
call vec4GetLength
fld [esp+0c]
fdiv [esp]
fstp [esp]
mov eax,[esp+8]
fld [eax]
fmul [esp]
fstp [eax]
fld [eax+4]
fmul [esp]
fstp [eax+4]
fld [eax+8]
fmul [esp]
fstp [eax+8]
fld [eax+c]
fmul [esp]
fstp [eax+c]
add esp,4
ret 008
vec4GetLength:
mov eax,[esp+4]
fld [eax]
fld st(0)
fmulp
fld [eax+4]
fld st(0)
fmulp
faddp
fld [eax+8]
fld st(0)
fmulp
faddp
fsqrt
fstp [esp+4]
ret
setVec4:
mov eax,[esp+4]
fld [esp+8]
fst [eax+0]
fst [eax+4]
fst [eax+8]
fstp [eax+C]
ret
vec4Copy:
mov eax,[esp+08]
push [eax+C]
push [eax+8]
push [eax+4]
push [eax+0]
mov eax,[esp+14]
pop [eax+0]
pop [eax+4]
pop [eax+8]
pop [eax+c]
ret 0008
"NFS13.exe"+5C59B6:
jmp newmem
nop
nop
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
dealloc(SavedPos)
"NFS13.exe"+5C59B6:
movaps [eax+20],xmm3
ret 0008
//Alt: db 0F 29 58 20 C2 08 00
71
"all cars body base"
80000008
4 Bytes
"NFS13.exe"+00CC75F0
0
F4
82
"car body base"
80000008
4 Bytes
"NFS13.exe"+00CD1938
0
10
148
19C
83
"front left wheel"
80000008
4 Bytes
"NFS13.exe"+00CD1938
0
14
148
19C
84
"front right wheel"
80000008
4 Bytes
"NFS13.exe"+00CD1938
0
18
148
19C
85
"back left wheel"
80000008
4 Bytes
"NFS13.exe"+00CD1938
0
1C
148
19C
86
"back back right wheel"
80000008
4 Bytes
"NFS13.exe"+00CD1938
0
20
148
19C
avg
006EA7AB
label1
006748DA
06870000
jmp 06870000