0 "[X] <== The Haunted Hells Reach (64bits) Script" 80000008 Auto Assembler Script { // '{' opens a block of comments =========================================== Game Title : The Haunted - Hells Reach (64 bits, DX9) Game Version : 1.0.8788.0 Process Name : HauntedGame.exe Script Version: 1.0 CE Version : 6.1 Release date : 13-Dec-2011 Author : Recifense Features: - God Mode - Unlimited Ammo =========================================== } // '}' closes a block of comments [ENABLE] //========================================= // Check if script is compatible to this game version // If false the script will not be loaded assert(HauntedGame.exe+085069,48 8b 54 24 70 48 89 46 10 48 8b 44 24 78 45 33 c0) // The script is only loaded if assert returns TRUE assert(HauntedGame.exe+061897,8b 44 24 50 29 03 8b 03 48 8b 5c 24 40 89 06 48 83 c4 20)// The script is only loaded if assert returns TRUE //========================================= alloc(MyCode,1024) // Allocating memory. 1024 (1Kb) is enough. //========================================= // Declaration section label(_MonAmmo) // Declaring a label label(_BackMA) // Declaring a label label(_ExitMA) // Declaring a label label(_GodMode) // Declaring a label label(_GodM0) // Declaring a label label(_GodM1) // Declaring a label label(_BackGM) // Declaring a label label(_ExitGM) // Declaring a label label(pPlayer) // Declaring a label label(pHP) // Declaring a label label(pAmmo) // Declaring a label label(pWeapon) // Declaring a label label(iEnableGM) // Declaring a label label(iEnableMA) // Declaring a label //========================================= // Registering Symbols registersymbol(MyCode) // Registering "MyCode", so it can be easily find it in the memory viewer. registersymbol(pPlayer) // Registering "pPlayer", so it can be easily used in a table or structure. registersymbol(pHP) // Registering "pHP", so it can be easily used in a table or structure. registersymbol(pAmmo) // Registering "pAmmo", so it can be easily used in a table or structure. registersymbol(pWeapon) // Registering "pWeapon", so it can be easily used in a table or structure. registersymbol(iEnableGM) // Registering "iEnableGM", so it can be easily used in a table or structure. registersymbol(iEnableMA) // Registering "iEnableMA", so it can be easily used in a table or structure. //========================================= MyCode: //========================================= // This script will: // 1) Check if the information is valid -> the content of offsets 00c8 and 010c are equal and not NULL (0) // 2) Identify the addresses of Hero's HP and Ammo // 3) If Unlimited Ammo is enabled (iEnableMA <> 0), current ammo = maximum ammo and current reserve = maximum // RSI = Base of Weapon structure (Don't confuse Base with Bottom. Base here is the first address of a structure) // RDX is free for use since it is modified by the original code // RCX is free for use since it is modified right after the original code (see main code) _MonAmmo: mov rdx,[rsi+000000c8] // Load register RDX with the content of offset 00c8 test rdx,rdx // Test it jz _ExitMA // jcc is a conditional jump. The condition here is Z (if zero). cmp rdx,[rsi+0000010c] // Verify if the content of offset 010c is equal to that of offset 00c8. jne _ExitMA // jcc is a conditional jump. The condition here is NE (not equal to). mov [pPlayer],rdx // RDX is the base of the HP structure. Save it for debugging; mov [pWeapon],rsi // RSI is the base of the Ammo structure. Save it for debugging; lea rdx,[rdx+00000374] // Make RDX = RDX + Offset of current HP; mov [pHP],rdx // RDX points to the exact address of current HP. Save it for further use. lea rdx,[rsi+000003c0] // Make RDX = RSI + Offset of current Ammo; mov [pAmmo],rdx // RDX points to the exact address of current Ammo. Save it for further use. cmp dword ptr [iEnableMA],0 // If the content of the memory address pointed by label iEnableMA is 0... je _ExitMA // ... the script will continue at the label _ExitMA (jcc -> E = equal to) mov edx,[rsi+000003bc] // Load EDX with the content of offset 03bc (Maximum Ammo) mov [rsi+000003c0],edx // and copy it to the offset 03c0 (Current Ammo) mov edx,[rsi+000003a0] // Load EDX with the content of offset 03a0 (Maximum Reserve Ammo) mov [rsi+0000039c],edx // and copy it to the offset 039c (Current Reserve Ammo) _ExitMA: pop rcx // Adjust to the original RSP (by popping the returning address) mov rdx,[rsp+70] // Original code mov [rsi+10],rax // Original code mov rax,[rsp+78] // Original code xor r8d,r8d // Original code jmp rcx // Back to main code //========================================= // This script will (if enabled: iEnableMA <> 0 and/or iEnableGM <> 0): // 1) Not let the value to be decreased, if it is at Hero's HP address or at the Hero's Ammo address. // 2) Make the current value equal to maximum // RBX points to the address of the value to be decreased // RAX is free for use since it is modified by the original code // RDI is free for use since it is modified right after the original code (see main code) _GodMode: pop rdi // Adjust to the original RSP (by popping the returning address) cmp rbx,[pAmmo] // Is it the hero's ammo. je _GodM0 // jcc is a conditional jump. The condition here is E (equal to). cmp rbx,[pHP] // Is it the hero's HP. jne _ExitGM // jcc is a conditional jump. The condition here is NE (NOT equal to). cmp dword ptr [iEnableGM],0 // If the content of the memory address pointed by label iEnableGM is 0... je _GodM0 // ... the script will continue at the label _GodM0 (jcc -> E = equal to) mov eax,[rbx+04] // Load EAX with Maximum HP mov [rbx],eax // and copy it to Current HP address jmp _GodM1 // Continue at the label _GodM2 _GodM0: cmp dword ptr [iEnableMA],0 // If the content of the memory address pointed by label iEnableMA is 0... je _ExitGM // ... the script will continue at the label _ExitGM (jcc -> E = equal to) mov eax,[rbx-04] // Load EAX with Maximum Ammo mov [rbx],eax // and copy it to Current Ammo address _GodM1: xor eax,eax // Make EAX = 0 (A xor A = 0) mov [rsp+50],eax // Make value to be decreased at the stack offset 10 = 0 _ExitGM: mov eax,[rsp+50] // Original code (EAX = value to be decreased) sub [rbx],eax // Original code mov eax,[rbx] // Original code mov rbx,[rsp+40] // Original code mov [rsi],eax // Original code add rsp,20 // Original code jmp rdi // Back to main code //========================================= db '=======================>' // The memory at this location is filled with this string db 'CE6.1 Script by Recifense 121311' // The memory at this location is filled with this string //========================================= // Variables // We can put the variables here, right after the last script. iEnableGM: // The variable name followed by : (in fact, it is a lable) dd 1 // Reserving 4 bytes and initializing its value with 1 iEnableMA: // The variable name followed by : (in fact, it is a lable) dd 1 // Reserving 4 bytes and initializing its value with 1 pPlayer: // The variable name followed by : (in fact, it is a lable) dq MyCode // Reserving 8 bytes and initializing its value with MyCode address value pHP: // The variable name followed by : (in fact, it is a lable) dq MyCode // Reserving 8 bytes and initializing its value with MyCode address value pAmmo: // The variable name followed by : (in fact, it is a lable) dq MyCode // Reserving 8 bytes and initializing its value with MyCode address value pWeapon: // The variable name followed by : (in fact, it is a lable) dq MyCode // Reserving 8 bytes and initializing its value with MyCode address value //========================================= // Hacking Points // It can also be placed before the scripts. But let's put it after them, just to remind us // that the script was created and loaded into the computer memory and now can be accessed. HauntedGame.exe+085069: // The address to be intercepted call _MonAmmo // (*) Calling to the script (this instruction is 16 bytes long in a 64 bits system) nop // Adding a NOP (90h) instruction to complete 17 bytes (remember this!) _BackMA: // This label is the address to go back. It is HauntedGame.exe+065121 plus 17 bytes. HauntedGame.exe+061897: // The address to be intercepted call _GodMode // (*) Calling to the script (this instruction is 16 bytes long in a 32 bits system) db 90,90,90 // Adding 3 NOPs (90h) instruction to complete 19 bytes (remember this!) _BackGM: // This label is the address to go back. It is HauntedGame.exe+04810d plus 6 bytes. //(*) Why not JMP? Because AA has a bug and you cannot jump back. The labels are 4 bytes long and ... // ... inside the script a MOV RXX,gamexxx.exe+0YYYYYY is truncated to 32 bits. [DISABLE] //========================================= // This part is performed when we disable the script by unchecking its active box. // Here we should: // - Restore the original codes // - Unregister the symbols // - Deallocate (free) the memory HauntedGame.exe+085069: // The address to restore the code // mov rdx,[rsp+70] // The code to be restored (this instruction is 5 bytes long) // mov [rsi+10],rax // The code to be restored (this instruction is 4 bytes long) // mov rax,[rsp+78] // The code to be restored (this instruction is 5 bytes long) // xor r8d,r8d // The code to be restored (this instruction is 3 bytes long) db 48 8b 54 24 70 48 89 46 // The instruction in byte sequence representation... db 10 48 8b 44 24 78 45 33 c0 // ...The instruction in byte sequence representation HauntedGame.exe+061897: // The address to restore the code // mov eax,[rsp+50] // The code to be restored (this instruction is 4 bytes long) // sub [rbx],eax // The code to be restored (this instruction is 2 bytes long) // mov eax,[rbx] // The code to be restored (this instruction is 2 bytes long) // mov rbx,[rsp+40] // The code to be restored (this instruction is 5 bytes long) // mov [rsi],eax // The code to be restored (this instruction is 2 bytes long) // add rsp,20 // The code to be restored (this instruction is 4 bytes long) db 8b 44 24 50 29 03 8b 03 48 // The instruction in byte sequence representation... db 8b 5c 24 40 89 06 48 83 c4 20 // ...The instruction in byte sequence representation //========================================= // Unregistering Symbols unregistersymbol(MyCode) // UNregistering "MyCode", so it cannot be accessed anymore. unregistersymbol(iEnableGM) // UNregistering "iEnableGM", so it cannot be accessed anymore. unregistersymbol(iEnableMA) // UNregistering "iEnableMA", so it cannot be accessed anymore. unregistersymbol(pPlayer) // UNregistering "pPlayer", so it cannot be accessed anymore. unregistersymbol(pHP) // UNregistering "pHP", so it cannot be accessed anymore. unregistersymbol(pAmmo) // UNregistering "pAmmo", so it cannot be accessed anymore. unregistersymbol(pWeapon) // UNregistering "pWeapon", so it cannot be accessed anymore. //========================================= dealloc(MyCode) // DE-allocating memory so the system can use it for other purposes. //============= Scripts End =============== // **************************************** // NOTES // **************************************** { struct WEAPON: 00c8 = pHero 010c = pHero 039c = current_Reserved_Ammo 03a0 = maximum_Reserved_Ammo 03bc = maximum_Ammo_onCLIP 03c0 = current_Ammo_onCLIP struct HERO: 010c = pSelf 0374 = current_HP 0378 = maximum_HP 0494 = pWeapon } 1 "iEnableMA" 80000008 4 Bytes

iEnableMA

2 "iEnableGM" 80000008 4 Bytes

iEnableGM

3 "pHero" 1 80000008 8 Bytes

pPlayer

4 "pWeapon" 1 80000008 8 Bytes

pWeapon

5 "pHP" 1 80000008 8 Bytes

pHP

6 "pAmmo" 1 80000008 8 Bytes

pAmmo

Code :mov eax,[r8] HP

1400F736E

HauntedGame.exe F736E 83 FA 01 75 07 41 8B 00 41 89 02 C3 8B Code :sub [rbx],eax HP (R14 = pHero)

14006189B

HauntedGame.exe 6189B 02 8B 44 24 50 29 03 8B 03 48 8B 5C Code :mov eax,[rbx] HP

14006189D

HauntedGame.exe 6189D 44 24 50 29 03 8B 03 48 8B 5C 24 40 Code :cmp dword ptr [rcx+00000374],00 HP

140670344

HauntedGame.exe 670344 CC 48 83 EC 38 83 B9 74 03 00 00 00 41 8B 00 4C 8D Code :mov [rsi+10],rax ammo

14008506E

HauntedGame.exe 8506E 48 8B 54 24 70 48 89 46 10 48 8B 44 24 78 Code :and [rsi+10],r11 ammo

1400850A5

HauntedGame.exe 850A5 FF FF DF FF FF 4C 21 5E 10 F6 46 10 04 0F MyCode

1F3E0000

pPlayer

1F3E0128

pHP

1F3E0130

pAmmo

1F3E0138

pWeapon

1F3E0140

iEnableGM

1F3E0120

iEnableMA

1F3E0124

Hero 0 Pointer -16 8 1 8 8 Pointer -16 8 1 8 16 Byte -1 1 17 Byte -1 1 18 Byte -1 1 19 Byte -1 1 20 Byte -1 1 21 Byte -1 1 22 Byte -1 1 23 Word -4 2 25 Byte -1 1 26 Byte -1 1 27 Word -4 2 29 Byte -1 1 30 Byte -1 1 31 Byte -1 1 32 Pointer -16 8 1 8 40 Dword -7 4 44 Dword -7 4 48 Byte -1 1 49 Byte -1 1 50 Byte -1 1 51 Byte -1 1 52 Byte -1 1 53 Byte -1 1 54 Byte -1 1 55 Byte -1 1 56 Byte -1 1 57 Byte -1 1 58 Byte -1 1 59 Word -4 2 61 Byte -1 1 62 Byte -1 1 63 Byte -1 1 64 Pointer -16 8 1 8 72 Byte -1 1 73 Byte -1 1 74 Byte -1 1 75 Byte -1 1 76 Dword -7 4 80 Pointer -16 8 1 8 88 Pointer -16 8 1 8 96 Pointer -16 8 1 8 104 Dword -7 4 108 Dword -7 4 112 Pointer -16 8 1 8 120 Dword -7 4 124 Dword -7 4 128 Float -12 4 132 Float -12 4 136 Pointer -16 8 1 8 144 Byte -1 1 145 Byte -1 1 146 Byte -1 1 147 Byte -1 1 148 Double -13 8 156 Float -12 4 160 Float -12 4 164 Float -12 4 168 Dword -7 4 172 Dword -7 4 176 Dword -7 4 180 Dword -7 4 184 Double -13 8 192 Byte -1 1 193 Byte -1 1 194 Byte -1 1 195 Byte -1 1 196 Dword -7 4 200 Pointer -16 8 1 8 208 Pointer -16 8 1 8 216 Pointer -16 8 1 8 224 Dword -7 4 228 Dword -7 4 232 Byte -1 1 233 Byte -1 1 234 Byte -1 1 235 Byte -1 1 236 Byte -1 1 237 Byte -1 1 238 Byte -1 1 239 Byte -1 1 240 Dword -7 4 244 Dword -7 4 248 Dword -7 4 252 Float -12 4 256 Float -12 4 260 Dword -7 4 264 Dword -7 4 268 **pSelf -9 8 1 4 276 Byte -1 1 277 Byte -1 1 278 Word -4 2 280 Dword -7 4 284 Double -13 8 292 Float -12 4 296 Byte -1 1 297 Byte -1 1 298 Byte -1 1 299 Byte -1 1 300 Dword -7 4 304 Dword -7 4 308 Dword -7 4 312 Dword -7 4 316 Dword -7 4 320 Dword -7 4 324 Dword -7 4 328 Dword -7 4 332 Dword -7 4 336 Dword -7 4 340 Dword -7 4 344 Dword -7 4 348 Dword -7 4 352 Pointer -16 8 1 8 360 Dword -7 4 364 Dword -7 4 368 Dword -7 4 372 Dword -7 4 376 Dword -7 4 380 Byte -1 1 381 Byte -1 1 382 Byte -1 1 383 Word -4 2 385 Byte -1 1 386 Byte -1 1 387 Byte -1 1 388 Dword -7 4 392 Dword -7 4 396 Dword -7 4 400 Dword -7 4 404 Dword -7 4 408 Dword -7 4 412 Dword -7 4 416 Dword -7 4 420 Dword -7 4 424 Dword -7 4 428 Dword -7 4 432 Dword -7 4 436 Dword -7 4 440 Pointer -16 8 1 8 448 Dword -7 4 452 Dword -7 4 456 Float -12 4 460 Float -12 4 464 Pointer -16 8 1 8 472 Dword -7 4 476 Dword -7 4 480 Pointer -16 8 1 8 488 Byte -1 1 489 Byte -1 1 490 Byte -1 1 491 Byte -1 1 492 Dword -7 4 496 Dword -7 4 500 Dword -7 4 504 Dword -7 4 508 Dword -7 4 512 Pointer -16 8 1 8 520 Pointer -16 8 1 8 528 Dword -7 4 532 Dword -7 4 536 Dword -7 4 540 Dword -7 4 544 Dword -7 4 548 Dword -7 4 552 Dword -7 4 556 Dword -7 4 560 Dword -7 4 564 Dword -7 4 568 Pointer -16 8 1 8 576 Float -12 4 580 Float -12 4 584 String -14 5 589 Byte -1 1 590 Byte -1 1 591 Byte -1 1 592 Dword -7 4 596 Dword -7 4 600 Dword -7 4 604 Byte -1 1 605 Byte -1 1 606 Byte -1 1 607 Word -4 2 609 Byte -1 1 610 Byte -1 1 611 Byte -1 1 612 Dword -7 4 616 Dword -7 4 620 Dword -7 4 624 Dword -7 4 628 Dword -7 4 632 Dword -7 4 636 Dword -7 4 640 Byte -1 1 641 Byte -1 1 642 Byte -1 1 643 Word -4 2 645 Byte -1 1 646 Byte -1 1 647 Byte -1 1 648 Dword -7 4 652 Dword -7 4 656 Dword -7 4 660 Float -12 4 664 Float -12 4 668 Double -13 8 676 Dword -7 4 680 Dword -7 4 684 Dword -7 4 688 Double -13 8 696 Float -12 4 700 Float -12 4 704 Dword -7 4 708 Float -12 4 712 Dword -7 4 716 Float -12 4 720 Float -12 4 724 Byte -1 1 725 Byte -1 1 726 Byte -1 1 727 Byte -1 1 728 Dword -7 4 732 Byte -1 1 733 Byte -1 1 734 Byte -1 1 735 Byte -1 1 736 Dword -7 4 740 Dword -7 4 744 Pointer -16 8 1 8 752 Dword -7 4 756 Float -12 4 760 Dword -7 4 764 Dword -7 4 768 Dword -7 4 772 Dword -7 4 776 Dword -7 4 780 Dword -7 4 784 Double -13 8 792 Dword -7 4 796 Float -12 4 800 Float -12 4 804 Float -12 4 808 Float -12 4 812 Float -12 4 816 Float -12 4 820 Float -12 4 824 Float -12 4 828 Double -13 8 836 Float -12 4 840 Float -12 4 844 Float -12 4 848 Float -12 4 852 Float -12 4 856 Float -12 4 860 Dword -7 4 864 Double -13 8 872 Dword -7 4 876 Byte -1 1 877 Byte -1 1 878 Byte -1 1 879 Word -4 2 881 Byte -1 1 882 Byte -1 1 883 Byte -1 1 884 **icHP -7 4 888 **imHP -7 4 892 Dword -7 4 896 Dword -7 4 900 Float -12 4 904 Dword -7 4 908 Dword -7 4 912 Dword -7 4 916 Dword -7 4 920 Float -12 4 924 Float -12 4 928 Float -12 4 932 Float -12 4 936 Dword -7 4 940 Double -13 8 948 Dword -7 4 952 Dword -7 4 956 Dword -7 4 960 Float -12 4 964 Dword -7 4 968 Dword -7 4 972 Double -13 8 980 Float -12 4 984 Dword -7 4 988 Dword -7 4 992 Dword -7 4 996 Dword -7 4 1000 Pointer -16 8 1 8 1008 Pointer -16 8 1 8 1016 Dword -7 4 1020 Dword -7 4 1024 Dword -7 4 1028 Dword -7 4 1032 Dword -7 4 1036 Dword -7 4 1040 Pointer -16 8 1 8 1048 Pointer -16 8 1 8 1056 Dword -7 4 1060 Dword -7 4 1064 Dword -7 4 1068 Dword -7 4 1072 Dword -7 4 1076 Dword -7 4 1080 Dword -7 4 1084 Byte -1 1 1085 Byte -1 1 1086 Byte -1 1 1087 Byte -1 1 1088 Dword -7 4 1092 Byte -1 1 1093 Byte -1 1 1094 Byte -1 1 1095 Byte -1 1 1096 Dword -7 4 1100 Float -12 4 1104 Float -12 4 1108 Dword -7 4 1112 Dword -7 4 1116 Byte -1 1 1117 Byte -1 1 1118 Byte -1 1 1119 Byte -1 1 1120 Float -12 4 1124 Byte -1 1 1125 Byte -1 1 1126 Byte -1 1 1127 Byte -1 1 1128 Dword -7 4 1132 Float -12 4 1136 Float -12 4 1140 Dword -7 4 1144 Dword -7 4 1148 Byte -1 1 1149 Byte -1 1 1150 Byte -1 1 1151 Byte -1 1 1152 Dword -7 4 1156 Dword -7 4 1160 Dword -7 4 1164 Byte -1 1 1165 Byte -1 1 1166 Byte -1 1 1167 Byte -1 1 1168 Dword -7 4 1172 **pWeapon -9 8 1 4 1184 Dword -7 4 1188 Dword -7 4 1192 Dword -7 4 1196 Dword -7 4 1200 Dword -7 4 1204 Dword -7 4 1208 Dword -7 4 1212 Dword -7 4 1216 Dword -7 4 1220 Dword -7 4 1224 Dword -7 4 1228 Dword -7 4 1232 Dword -7 4 1236 Dword -7 4 1240 Dword -7 4 1244 Dword -7 4 1248 Dword -7 4 1252 Dword -7 4 1256 Dword -7 4 1260 Dword -7 4 1264 Dword -7 4 1268 Dword -7 4 1272 Dword -7 4 1276 Dword -7 4 Weapon 0 Pointer -16 8 1 8 8 Pointer -16 8 1 8 16 i -9 4 20 i -9 4 24 Pointer -16 8 1 8 32 Pointer -16 8 1 8 40 Dword -7 4 44 Dword -7 4 48 Byte -1 1 49 Byte -1 1 50 Byte -1 1 51 Byte -1 1 52 Byte -1 1 53 Byte -1 1 54 Byte -1 1 55 Byte -1 1 56 Byte -1 1 57 Byte -1 1 58 Byte -1 1 59 Word -4 2 61 Byte -1 1 62 Byte -1 1 63 Byte -1 1 64 Pointer -16 8 1 8 72 Byte -1 1 73 Byte -1 1 74 Byte -1 1 75 Byte -1 1 76 Dword -7 4 80 Pointer -16 8 1 8 88 Pointer -16 8 1 8 96 Dword -7 4 100 Dword -7 4 104 Dword -7 4 108 Dword -7 4 112 Dword -7 4 116 Dword -7 4 120 Dword -7 4 124 Dword -7 4 128 Float -12 4 132 Float -12 4 136 Float -12 4 140 Dword -7 4 144 Byte -1 1 145 Byte -1 1 146 Byte -1 1 147 Byte -1 1 148 Double -13 8 156 Float -12 4 160 Float -12 4 164 Float -12 4 168 Dword -7 4 172 Dword -7 4 176 Dword -7 4 180 Dword -7 4 184 Double -13 8 192 Byte -1 1 193 Byte -1 1 194 Byte -1 1 195 Byte -1 1 196 Dword -7 4 200 **pHero -7 8 1 8 208 Dword -7 4 212 Dword -7 4 216 Dword -7 4 220 Dword -7 4 224 Dword -7 4 228 Dword -7 4 232 Byte -1 1 233 Byte -1 1 234 Byte -1 1 235 Byte -1 1 236 Byte -1 1 237 Byte -1 1 238 Byte -1 1 239 Byte -1 1 240 Byte -1 1 241 Byte -1 1 242 Byte -1 1 243 Byte -1 1 244 Dword -7 4 248 Dword -7 4 252 Float -12 4 256 Pointer -16 8 1 8 264 Dword -7 4 268 **pHero -9 8 1 4 276 Byte -1 1 277 Byte -1 1 278 Word -4 2 280 Dword -7 4 284 Double -13 8 292 Dword -7 4 296 Byte -1 1 297 Byte -1 1 298 Byte -1 1 299 Byte -1 1 300 Dword -7 4 304 Dword -7 4 308 Dword -7 4 312 Dword -7 4 316 Dword -7 4 320 Dword -7 4 324 Dword -7 4 328 Dword -7 4 332 Dword -7 4 336 Dword -7 4 340 Dword -7 4 344 Dword -7 4 348 Dword -7 4 352 Dword -7 4 356 Dword -7 4 360 Dword -7 4 364 Dword -7 4 368 Dword -7 4 372 Dword -7 4 376 Dword -7 4 380 Byte -1 1 381 Byte -1 1 382 Byte -1 1 383 Word -4 2 385 Byte -1 1 386 Byte -1 1 387 Byte -1 1 388 Dword -7 4 392 Dword -7 4 396 Dword -7 4 400 Dword -7 4 404 Dword -7 4 408 Dword -7 4 412 Dword -7 4 416 Dword -7 4 420 Dword -7 4 424 Dword -7 4 428 Dword -7 4 432 Dword -7 4 436 Dword -7 4 440 Dword -7 4 444 Dword -7 4 448 Dword -7 4 452 Dword -7 4 456 Dword -7 4 460 Dword -7 4 464 Dword -7 4 468 Dword -7 4 472 Dword -7 4 476 Dword -7 4 480 Dword -7 4 484 Dword -7 4 488 Dword -7 4 492 Dword -7 4 496 Dword -7 4 500 Dword -7 4 504 Dword -7 4 508 Dword -7 4 512 Pointer -16 8 1 8 520 Pointer -16 8 1 8 528 Dword -7 4 532 Dword -7 4 536 Dword -7 4 540 Dword -7 4 544 Dword -7 4 548 Dword -7 4 552 Dword -7 4 556 Dword -7 4 560 Dword -7 4 564 Dword -7 4 568 Pointer -16 8 1 8 576 Pointer -16 8 1 8 584 Pointer -16 8 1 8 592 Dword -7 4 596 Dword -7 4 600 Dword -7 4 604 Float -12 4 608 Float -12 4 612 Byte -1 1 613 Byte -1 1 614 Byte -1 1 615 Byte -1 1 616 Dword -7 4 620 Dword -7 4 624 Dword -7 4 628 Dword -7 4 632 Dword -7 4 636 Dword -7 4 640 Dword -7 4 644 Dword -7 4 648 Dword -7 4 652 Byte -1 1 653 Byte -1 1 654 Byte -1 1 655 Byte -1 1 656 Dword -7 4 660 Dword -7 4 664 Dword -7 4 668 Dword -7 4 672 Dword -7 4 676 Dword -7 4 680 Dword -7 4 684 Dword -7 4 688 Pointer -16 8 1 8 696 Dword -7 4 700 Dword -7 4 704 Pointer -16 8 1 8 712 Dword -7 4 716 Dword -7 4 720 Dword -7 4 724 Dword -7 4 728 Dword -7 4 732 Dword -7 4 736 Pointer -16 8 1 8 744 Dword -7 4 748 Dword -7 4 752 Pointer -16 8 1 8 760 Dword -7 4 764 Dword -7 4 768 Pointer -16 8 1 8 776 Dword -7 4 780 Dword -7 4 784 Pointer -16 8 1 8 792 Dword -7 4 796 Dword -7 4 800 Pointer -16 8 1 8 808 Dword -7 4 812 Dword -7 4 816 Pointer -16 8 1 8 824 Dword -7 4 828 Dword -7 4 832 Dword -7 4 836 Dword -7 4 840 Float -12 4 844 Dword -7 4 848 Double -13 8 856 Float -12 4 860 Dword -7 4 864 Dword -7 4 868 Dword -7 4 872 Dword -7 4 876 Dword -7 4 880 Double -13 8 888 Dword -7 4 892 Dword -7 4 896 Dword -7 4 900 Dword -7 4 904 Dword -7 4 908 Dword -7 4 912 Dword -7 4 916 Dword -7 4 920 Dword -7 4 924 **icReserve -7 4 928 **imReserve -7 4 932 Dword -7 4 936 Byte -1 1 937 Byte -1 1 938 Byte -1 1 939 Byte -1 1 940 Dword -7 4 944 Dword -7 4 948 Dword -7 4 952 Dword -7 4 956 **imAmmo -7 4 960 **icAmmo -7 4 968 Dword -7 4 972 Dword -7 4 976 Dword -7 4 980 Dword -7 4 984 Dword -7 4 988 Dword -7 4 992 Float -12 4 996 Double -13 8 1004 Double -13 8 1012 Double -13 8 1020 Dword -7 4 1024 Dword -7 4 1028 Double -13 8 1036 Float -12 4 1040 Dword -7 4 1044 Byte -1 1 1045 Byte -1 1 1046 Byte -1 1 1047 Byte -1 1 1048 Double -13 8 1056 Dword -7 4 1060 Dword -7 4 1064 Dword -7 4 1068 Dword -7 4 1072 Dword -7 4 1076 Float -12 4 1080 Float -12 4 1084 Float -12 4 1088 Float -12 4 1092 Dword -7 4 1096 Dword -7 4 1100 Dword -7 4 1104 Dword -7 4 1108 Float -12 4 1112 Double -13 8 1120 Float -12 4 1124 Dword -7 4 1128 Pointer -16 8 1 8 1136 Pointer -16 8 1 8 1144 Dword -7 4 1148 Dword -7 4 1152 Double -13 8 1160 Dword -7 4 1164 Float -12 4 1168 Float -12 4 1172 Float -12 4 1176 Pointer -16 8 1 8 1184 Dword -7 4 1188 Dword -7 4 1192 Dword -7 4 1196 Float -12 4 1200 Float -12 4 1204 Float -12 4 1208 Dword -7 4 1212 Float -12 4 1216 Float -12 4 1220 Float -12 4 1224 Float -12 4 1228 String -14 4 1232 Float -12 4 1236 Byte -1 1 1237 Byte -1 1 1238 Word -4 2 1240 Dword -7 4 1244 Byte -1 1 1245 Byte -1 1 1246 Word -4 2 1248 Dword -7 4 1252 Byte -1 1 1253 Byte -1 1 1254 Byte -1 1 1255 Byte -1 1 1256 Dword -7 4 1260 Float -12 4 1264 Float -12 4 1268 Float -12 4 1272 Float -12 4 1276 Float -12 4 Do it Yourself