Tutorial-i386.ct

<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="26">
  <Forms>
    <SaveCurScanForm Class="TTrainerForm" Encoding="Ascii85">%}HXR):ZTqleSKq3bX/Nz2)Sh1s9Hp#H1:BYQn_}.*LA9Ni1BuI4+,!.g_Rd4*6($Nt,E7f+aywk3I9_y=IlP0l;-X)E=+dn4oGU*$VpmK2mg0X,{g7k0V-W,q0*?%F0UH-,[)g-u@P0ykWVn;{Mm0$X,ukrWZ{AXKED^,G[w7h%/BVOWiK,D]SDUtSMZcHEmx[ZuZ[uWX(3Mcxx{yOi=P3L7*ma7:.NDl,V#R@l^;E!l*%^fnT^:pr//VIV%Np2:9peg]b1THdZ-R7HHc:WJ_fbj]7RzZR7]Gbk7%AB}^9D,H{4_QfMVP98kJ+meO3^jMS::asTG}sv,=@h]Z-GXBeI8hey?cgI4sDqv#*=[h+=;=Fq7?ULloNn}}=9qV/96#maQOL:^mc1upze]r.j0](Vg+-S,DU^cYAp8-p;O[:+ueZyyq-vkK0O^cB/#x14r;uMUJW^TagI!+fLn=IxsI4J5f#(b$knL/fMG8E/gVS[./;.%gjSV.pZfWuud[WxIM]Pkuff[!(r3yZgf]w!3B*3c7/]8yXCtp%CUw!_r)eUz,Q,:9ay:_H!$aSvNx*jWPYCr;B8ADdnjqN=UMdt]QZbuA0dL?Dl</SaveCurScanForm>
    <DupScanForm_1 Class="TCEForm" Encoding="Ascii85">#gyNU)m*i)hq5q+5*+KDSrZd]/1LYWf]tNE6SCm8)aX*W478zi;M$t2h*;{_81GGd0WZDM3m=Im;0bzSiHUmEnK@T2zW(bn/_[oinvR{9%NULbU1?[(XgVkm/C8I-vvOCdUSn[Jvhp]jwn$ih4:S(]8FR}?O3+,d@GHz5r!??U!vRZ@v{m5?Oaj9vYYfkFIdX.XbCy8mN}S2lz8ZhK:e?vj2^pYL7K%Cs2@b_ltW4epn4V:)u5K@b(Vsi;(R,O+KP+PDhSs!C7$d8TEFLWs-yO(I4v,^HuuD,M0gMh/YZbKQkt$k;1c.VWj+6DiG2kAis*g)confi}$#0Bo$xnW{k%(=)Lb.F^(SMQvvm*vy[OZis:3.%#3!@h,;x{5LO}?.Q7.cRC-++fbQ4:%R:-rsl=}Lo-tvR$b8H#WCUX!yMw8GU(k9x=j%Y}]O92eH-.Y-99Z9hKn#RmBvdk5kC@=.%_*24^;pEHP0s9KLEVxtOxXw%]$V:)#?wnp.rmk.,g=A52BdD8UOZamF4xFk#=gM3NKtLT#KT{/]_X!VIGiWwru3l/$(hRQ#JnCF(jj{r?TS,zMxN-7K{u26aHO?:5[nl)Ng/6yyD-c6v!iT5_0RZvR=zoQ.Gw$OIzjz4!@dc:_DOZ(bpU$4*J]92/PzSJNUNk}3m^H1}qQXq1kQ7!=XacqW+9e(1Ei-$JZ-rKOTS+wZY$FilaV$F?x!Inw_woUW};!$QB)G9W,c?yXsf%1MltNn-O6VMnhi)_)kGERqHtIHxnd5Q)L(2K4kZoW01B$Qi^?.s+e.h:FJHFp/9Mm.5eDxpWjy*[ARf$mt@KmXc$3BWG</DupScanForm_1>
    <FlagsForm Class="TCEForm" Encoding="Ascii85">y[P_5):Zgr-Ly%XwwtsKxNx8nLJSTaJ0OI#OP8,O#I%.BVmFYRxJ@V7XO0WqN8kn+z5$.FX]h6Tz!BSVl4hh,B]QvRv7g]j]S0iF-WULkhW!]%$UN#{5+U3SPGfG;(d]KbO,]CF-qfYln?V,rqv{[nUV097t3NBc2[x#@P{{Sg9QE,$uq^?%Oy5Hx(DJ%O=^ryX5O![qeS#F{TUokvs6Gfyg39MWlTn(D7}={cZ_3H^U^#)/ROK-zRbEQa-:NjUA=:thBo=B2t9x#pelSnE7uM0JDW;GQUxxTPhXK.mF7cq;5CcPx,OFQ1MDHLQ9Q!B/[.v/.k6!Eg/f:#Dgf;no3S[8/2LCt;9W,/K2DjsmMTr,q/BFyZA^4eY*nbX+()NR6ZB4(]p?W0Awqea2ht2nx3T_7_E*XTxZLJ{@FQM-/]@ZNDlN9:Gzy*)+IAww?D3S}^hLA8fPFq)kdhH^9)}i@AI]d+$AHnf{IEW}qHbQeM+=@GxnBZBINS(He;L,Pc]}adVzNA%gl}:^$s$xle1BH=ZDmg[ZIb#;uAKAJZhk4KqZ5I;Ea{dwnG1,bi[Vva1[j4bHQ_gj^gS19:M2$#nWj}]9DRWIXk5Pz-XA2[aEXW0lr2KT2k(2j05XD=6,r5-,;k#vlRs=NUKOHfb@YX,i?K$c_?{gTW?2:#1Uc$SZ@YX,i?G3:KEx8?+B_ebE-4f!1j98^#fw?^[ZYCF5,}f6v4/-2f67XRL-db!VE8y3P[@N0.;jift[,AOPlYu9hS0Gl4#C3ibc!(Hq:/4=,UE/Alky/*u,)y:-S76tQ;[+no+9?Pwk(_-xJDW:mwZew/TP=9E%]u,8zN3d^Pu9+YA8zOdjL9LU6bH+(d:[E5:#m96+%lB//at({/#^CJc[rl]CGseZOo?8Wi{{m%^HOmC#aBI+?$Xl=(?jOt</FlagsForm>
  </Forms>
  <CheatEntries>
    <CheatEntry>
      <ID>38</ID>
      <Description>"Step 2"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
aobscanmodule(step2,Tutorial-i386.exe,75 2C 8B 83 68 04 00 00) // should be unique
step2:
  db 90 90
registersymbol(step2)

[DISABLE]
step2:
  db 75 2C
unregistersymbol(step2)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>2</ID>
      <Description>"Step 3"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
aobscanmodule(step3,Tutorial-i386.exe,75 2C 8B 83 74 04 00 00) // should be unique
step3:
  db 90 90
registersymbol(step3)

[DISABLE]
step3:
  db 75 2C
unregistersymbol(step3)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>95</ID>
      <Description>"Step 4"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
//7A 43 72 41 DD 05 D0 D7 5D 00) // should be unique
aobscanmodule(step4,Tutorial-i386.exe,?? ?? ?? ?? dd 05 ?? ?? ?? ?? dd 83)
step4:
  // nop health float jumps
  db 90 90 90 90
step4+15:
  // nop ammo double jumps
  db 90 90 90 90
return:
registersymbol(step4)

[DISABLE]
step4:
  db 7A 43 72 41
step4+15:
  db 7A 2E 72 2C
unregistersymbol(step4)
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>108</ID>
          <Description>"Step 4 alternative - match starting values"</Description>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>[ENABLE]
"Tutorial-i386.exe"+1A2798:
  dd (float)100
"Tutorial-i386.exe"+1A27A0:
  dq (double)100
[DISABLE]
"Tutorial-i386.exe"+1A2798:
  dd (float)5000
"Tutorial-i386.exe"+1A27A0:
  dq (double)5000

</AssemblerScript>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>6</ID>
      <Description>"Step 5"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
aobscanmodule(step5,Tutorial-i386.exe,00 00 8B 00 3B 45 F4 74 02 EB 1C 8B 45 F8) // should be unique
// noping jmp that prevents passing step
// rather than the c.jmp that matters lol
step5+09:
  db 90 90
registersymbol(step5)

[DISABLE]
step5+09:
  db EB 1C
unregistersymbol(step5)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>9</ID>
      <Description>"Step 6"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
aobscanmodule(step6,Tutorial-i386.exe,00 74 02 EB 1C 8B 45 F8 8B 80 68) // should be unique
step6+03:
  db 90 90
registersymbol(step6)

[DISABLE]
step6+03:
  db EB 1C
unregistersymbol(step6)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>12</ID>
      <Description>"Step 7"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
aobscanmodule(step7,Tutorial-i386.exe,75 1A 39 F2 75 16) // should be unique
step7:
  db 90 90
step7+4:
  db 90 90
registersymbol(step7)

[DISABLE]
step7:
  db 75 1A
step7+4:
  db 75 16
unregistersymbol(step7)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>17</ID>
      <Description>"Step 8 ( 525927 )"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
aobscanmodule(step8,Tutorial-i386.exe,EB 1C 8B 45 F8 8B 80 70) // should be unique
step8:
  db 90 90
registersymbol(step8)

[DISABLE]
step8:
  db EB 1C
unregistersymbol(step8)
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>211</ID>
          <Description>"No description"</Description>
          <VariableType>4 Bytes</VariableType>
          <Address>"Tutorial-i386.exe"+1FD660</Address>
          <Offsets>
            <Offset>18</Offset>
            <Offset>0</Offset>
            <Offset>14</Offset>
            <Offset>C</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>40</ID>
      <Description>"Step 9 - hack starting values (31337157)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{
  Found at "Tutorial-i386.exe"+26313
  AOB 8B 15 ?? ?? ?? ?? 89 50 04 B8 10 27 00 00 E8 ?? ?? ?? ?? 8B 93 B4 04 00 00
  // ?? 85 c0 0f 85 22 03 (beginning of function - v3.2 and v3.3)
  // a1 bc a5

  v3.2 - CE6.5.1 - 005E61D8
  v3.3 - CE6.6   - 005AA5BC
}
[ENABLE]
aobscan(startHealth,00 00 FA 43 04 4B 49 54 54)
startHealth:
dd (float)0
registerSymbol(startHealth)
[DISABLE]
startHealth:
dd (float)500
unregisterSymbol(startHealth)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>31</ID>
      <Description>"Step 9 - bypass"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
//7A 3F 75 3D 8B 83 C0 04 00 00) // should be unique
aobscanmodule(step9_bypass,Tutorial-i386.exe,?? ?? ?? ?? 8b 83 ?? ?? ?? ?? d9 ee d9 40 ?? de d9 df e0 ?? ?? ?? ?? ?? 8b 83 ?? ?? ?? ?? ?? ?? 8b 8b)
step9_bypass:
  db 90 90 90 90
step9_bypass+14:
  db 90 90 90 90
registersymbol(step9_bypass)

[DISABLE]

step9_bypass:
  db 7A 3F 75 3D
step9_bypass+14:
  db 7A 2B 75 29
unregistersymbol(step9_bypass)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>197</ID>
      <Description>"Step 9 - struct compare"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// http://forum.cheatengine.org/viewtopic.php?p=5545364
[ENABLE]
aobscanmodule(step9_sub,Tutorial-i386.exe,D8 6B 04 D9 5D D0)
alloc(newmem,$1000)

label(code)
label(finish)
label(return)

// player is the name of a structure from structure dissect
// .team and .health are named elements in that structure
newmem:
  cmp [ebx+player.team], 1
  jne code
  fstp st(0) // get rid of the damage amount
  fld [ebx+player.health] // load the player's health
  jmp finish
code:
  fsubr dword ptr [ebx+player.health]
finish:
  fstp dword ptr [ebp-30] // store new health
  jmp return

step9_sub:
  jmp newmem
  nop
return:
registersymbol(step9_sub)

[DISABLE]
step9_sub:
  db D8 6B 04 D9 5D D0
unregistersymbol(step9_sub)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+2650C

"Tutorial-i386.exe"+264EE: DE D9                 -  fcompp 
"Tutorial-i386.exe"+264F0: DF E0                 -  fnstsw ax
"Tutorial-i386.exe"+264F2: 9E                    -  sahf 
"Tutorial-i386.exe"+264F3: 7A 11                 -  jp Tutorial-i386.exe+26506
"Tutorial-i386.exe"+264F5: 75 0F                 -  jne Tutorial-i386.exe+26506
"Tutorial-i386.exe"+264F7: A1 04 F5 54 00        -  mov eax,[Tutorial-i386.exe+14F504]
"Tutorial-i386.exe"+264FC: E8 0F 21 0F 00        -  call Tutorial-i386.exe+118610
"Tutorial-i386.exe"+26501: E9 98 00 00 00        -  jmp Tutorial-i386.exe+2659E
"Tutorial-i386.exe"+26506: 89 75 CC              -  mov [ebp-34],esi
"Tutorial-i386.exe"+26509: DB 45 CC              -  fild dword ptr [ebp-34]
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+2650C: D8 6B 04              -  fsubr dword ptr [ebx+04]
"Tutorial-i386.exe"+2650F: D9 5D D0              -  fstp dword ptr [ebp-30]
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+26512: D9 EE                 -  fldz 
"Tutorial-i386.exe"+26514: D9 5D CC              -  fstp dword ptr [ebp-34]
"Tutorial-i386.exe"+26517: D9 45 D0              -  fld dword ptr [ebp-30]
"Tutorial-i386.exe"+2651A: D9 45 CC              -  fld dword ptr [ebp-34]
"Tutorial-i386.exe"+2651D: DE D9                 -  fcompp 
"Tutorial-i386.exe"+2651F: DF E0                 -  fnstsw ax
"Tutorial-i386.exe"+26521: 9E                    -  sahf 
"Tutorial-i386.exe"+26522: 7A 0A                 -  jp Tutorial-i386.exe+2652E
"Tutorial-i386.exe"+26524: 76 08                 -  jna Tutorial-i386.exe+2652E
"Tutorial-i386.exe"+26526: 8B 45 CC              -  mov eax,[ebp-34]
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>52</ID>
      <Description>"-------------------------- Step 5 Auto-Enable Next Attempts --------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>116</ID>
      <Description>"Step 5 - Simulated Click"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// Cheat Engine Tutorial. (v3.3)
[ENABLE]
globalalloc(step5test, 1000)
aobscan(step5code,?? 89 e5 8d ?? ?? ?? 89 45 ?? 89 55 ?? c7 45 ?? ?? ?? ?? ?? b8 01 00 ?? ?? 8d 55 ?? 8d 4d ?? e8 4c 8a)
registerSymbol(step5code)
step5code+B7:
  db F0 // cmp eax,[ebp-C] to cmp eax,[ebp-10]

// simulate clicking the button
step5test:
  mov eax,["THREADSTACK0"-0000014C]
  mov ecx, eax
  mov edx, eax
  mov eax, [eax+144]
  call step5code
  ret

createThread(step5test)

// eax aob (always last) 98 F8 5D 00 00 00 00 00 90 CC 5A 00 ?? ?? ?? 01 ?? ?? ?? 01

[DISABLE]
step5code+B7:
  db F4 // cmp eax,[ebp-C] to cmp eax,[ebp-10]
unregisterSymbol(step5code)
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>117</ID>
          <Description>"888899"</Description>
          <LastState Value="00524230" RealAddress="0054F190"/>
          <ShowAsHex>1</ShowAsHex>
          <VariableType>4 Bytes</VariableType>
          <Address>"Tutorial-i386.exe"+14F190</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>101</ID>
      <Description>"Step 5 (crashes if you don't jump to step 5 with 888899) "</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// Cheat Engine Tutorial. (v3.3)
[ENABLE]
globalalloc(step5test, 1000)
aobscan(step5code,?? 89 e5 8d ?? ?? ?? 89 45 ?? 89 55 ?? c7 45 ?? ?? ?? ?? ?? b8 01 00 ?? ?? 8d 55 ?? 8d 4d ?? e8 4c 8a)
registerSymbol(step5code)
step5code+B7:
  db F0 // cmp eax,[ebp-C] to cmp eax,[ebp-10]

// simulate clicking the button
step5test:
  mov eax,["Tutorial-i386.exe"+14F190]
  add eax, 1170
  mov ecx, eax
  mov edx, eax
  mov eax, [eax+144]
  call step5code
  ret

createThread(step5test)

// eax aob (always last) 98 F8 5D 00 00 00 00 00 90 CC 5A 00 ?? ?? ?? 01 ?? ?? ?? 01

[DISABLE]
step5code+B7:
  db F4 // cmp eax,[ebp-C] to cmp eax,[ebp-10]
unregisterSymbol(step5code)
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>109</ID>
          <Description>"888899"</Description>
          <LastState Value="00524230" RealAddress="0054F190"/>
          <ShowAsHex>1</ShowAsHex>
          <VariableType>4 Bytes</VariableType>
          <Address>"Tutorial-i386.exe"+14F190</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>110</ID>
      <Description>"Step 5 (crashes if you don't go through steps 2-4) "</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// Cheat Engine Tutorial. (v3.3)
[ENABLE]
globalalloc(step5test, 1000)
aobscan(step5code,?? 89 e5 8d ?? ?? ?? 89 45 ?? 89 55 ?? c7 45 ?? ?? ?? ?? ?? b8 01 00 ?? ?? 8d 55 ?? 8d 4d ?? e8 4c 8a)
registerSymbol(step5code)
step5code+B7:
  db F0 // cmp eax,[ebp-C] to cmp eax,[ebp-10]

// simulate clicking the button
step5test:
  mov eax,["Tutorial-i386.exe"+14F190]
  add eax, E30
  mov ecx, eax
  mov edx, eax
  mov eax, [eax+144]
  call step5code
  ret

createThread(step5test)

// eax aob (always last) 98 F8 5D 00 00 00 00 00 90 CC 5A 00 ?? ?? ?? 01 ?? ?? ?? 01

[DISABLE]
step5code+B7:
  db F4 // cmp eax,[ebp-C] to cmp eax,[ebp-10]
unregisterSymbol(step5code)
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>111</ID>
          <Description>"888899"</Description>
          <LastState Value="00524230" RealAddress="0054F190"/>
          <ShowAsHex>1</ShowAsHex>
          <VariableType>4 Bytes</VariableType>
          <Address>"Tutorial-i386.exe"+14F190</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>102</ID>
      <Description>"Step 5 (will crash if not at step 5 or if button has been clicked before lol! only tested x86)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// Cheat Engine Tutorial. (v3.3)
[ENABLE]
globalalloc(step5test, 1000)
//aobscan(step5code,?? 89 e5 8d ?? ?? ?? 89 45 ?? 89 55 ?? c7 45 ?? ?? ?? ?? ?? b8 01 00 ?? ?? 8d 55 ?? 8d 4d ?? e8 4c 8a)
//registerSymbol(step5code)
00424AF7:
  db F0 // cmp eax,[ebp-C] to cmp eax,[ebp-10]

// simulate clicking the button
step5test:
  mov eax,["Tutorial-i386.exe"+14F190]
  add eax, 1170
  mov ecx, eax
  mov edx, eax
  mov eax, [eax+144]
  call 00424A40
  ret

createThread(step5test)

// eax aob (always last) 98 F8 5D 00 00 00 00 00 90 CC 5A 00 ?? ?? ?? 01 ?? ?? ?? 01

[DISABLE]
00424AF7:
  db F4 // cmp eax,[ebp-C] to cmp eax,[ebp-10]
//unregisterSymbol(step5code)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>113</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>32</ID>
      <Description>"100 byte code cave"</Description>
      <LastState Value="0" RealAddress="00400290"/>
      <VariableType>4 Bytes</VariableType>
      <Address>"Tutorial-i386.exe"+290</Address>
    </CheatEntry>
    <CheatEntry>
      <ID>42</ID>
      <Description>"No Message Boxs (WIP, disables closing too lol)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
aobscanmodule(noMsgBoxs,Tutorial-i386.exe,?? ?? ?? ?? 8d 45 ?? ?? 8d 45 ?? ?? ff 15 ?? ?? ?? ?? 83 7d ?? ?? ?? ?? 8b 45 ?? 89 45)

noMsgBoxs:
  jmp +16
registersymbol(noMsgBoxs)

[DISABLE]
noMsgBoxs:
  db 6A 00
unregistersymbol(noMsgBoxs)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+105671

"Tutorial-i386.exe"+105645: E8 66 C0 03 00        -  call Tutorial-i386.exe+1416B0
"Tutorial-i386.exe"+10564A: B8 01 00 00 00        -  mov eax,00000001
"Tutorial-i386.exe"+10564F: 8D 95 20 FF FF FF     -  lea edx,[ebp-000000E0]
"Tutorial-i386.exe"+105655: 8D 8D 38 FF FF FF     -  lea ecx,[ebp-000000C8]
"Tutorial-i386.exe"+10565B: E8 50 7E F0 FF        -  call Tutorial-i386.exe+D4B0
"Tutorial-i386.exe"+105660: E8 5B 99 F0 FF        -  call Tutorial-i386.exe+EFC0
"Tutorial-i386.exe"+105665: 50                    -  push eax
"Tutorial-i386.exe"+105666: 85 C0                 -  test eax,eax
"Tutorial-i386.exe"+105668: 75 25                 -  jne Tutorial-i386.exe+10568F
"Tutorial-i386.exe"+10566A: C7 45 F0 02 00 00 00  -  mov [ebp-10],00000002
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+105671: 6A 00                 -  push 00
"Tutorial-i386.exe"+105673: 6A 00                 -  push 00
"Tutorial-i386.exe"+105675: 8D 45 F0              -  lea eax,[ebp-10]
"Tutorial-i386.exe"+105678: 50                    -  push eax
"Tutorial-i386.exe"+105679: 8D 45 88              -  lea eax,[ebp-78]
"Tutorial-i386.exe"+10567C: 50                    -  push eax
"Tutorial-i386.exe"+10567D: FF 15 A0 F0 5F 00     -  call dword ptr [Tutorial-i386.exe+1FF0A0] //-&gt;comctrl32.TaskDialogIndirect
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+105683: 83 7D F0 02           -  cmp dword ptr [ebp-10],02
"Tutorial-i386.exe"+105687: 75 06                 -  jne Tutorial-i386.exe+10568F
"Tutorial-i386.exe"+105689: 8B 45 08              -  mov eax,[ebp+08]
"Tutorial-i386.exe"+10568C: 89 45 F0              -  mov [ebp-10],eax
"Tutorial-i386.exe"+10568F: E8 9C 80 F0 FF        -  call Tutorial-i386.exe+D730
"Tutorial-i386.exe"+105694: 8D 85 78 FF FF FF     -  lea eax,[ebp-00000088]
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>61</ID>
      <Description>"Step 2 Value"</Description>
      <VariableType>4 Bytes</VariableType>
      <Address>"Tutorial-i386.exe"+1FC5D0</Address>
      <Offsets>
        <Offset>480</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>112</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>54</ID>
      <Description>"movzx vs mov"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
globalalloc(mem, 4)
globalalloc(zxMem, 4)
globalalloc(movzxmovValue, 1)

mem:
  dd 0xDEADBEEF
zxMem:
  dd 0xDEADBEEF
movzxmovValue:
  db 'a'

globalalloc(movzxmovCode, 100)

movzxmovCode:
  //mov   eax,   byte ptr [movzxmovValue] // does not compute lol
  mov eax, 'a'
  mov [mem], eax
  movzx eax, byte ptr [movzxmovValue]
  mov [zxMem], eax
  ret

createThread(movzxmovCode)
 
[DISABLE]

mem:
  dd 0xDEADBEEF
zxMem:
  dd 0xDEADBEEF
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>55</ID>
          <Description>"Mov"</Description>
          <VariableType>4 Bytes</VariableType>
          <Address>mem</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>56</ID>
          <Description>"zxMem"</Description>
          <VariableType>4 Bytes</VariableType>
          <Address>zxMem</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>89</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>155</ID>
      <Description>"100 byte code cave"</Description>
      <LastState Value="0" RealAddress="00400290"/>
      <VariableType>4 Bytes</VariableType>
      <Address>"Tutorial-i386.exe"+290</Address>
    </CheatEntry>
    <CheatEntry>
      <ID>154</ID>
      <Description>"Sub if possible"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>define(cave,"Tutorial-i386.exe"+290)
fullaccess(cave,4)
globalalloc(code,1000)

[ENABLE]
code:
  label(continueOn)
  cmp [cave], #100
  jl continueOn
  sub [cave], #100
  continueOn:
  ret

createThread(code)
[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>156</ID>
      <Description>"Sub - min of 0"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>define(cave,"Tutorial-i386.exe"+290)
// current cave is read only (silly me)
fullaccess(cave,4)
globalalloc(code,1000)

[ENABLE]
code:
  label(continueOn)
  sub [cave], #100
  cmp [cave], 0
  jg continueOn
  mov [cave],0
  continueOn:
  ret

createThread(code)
[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>158</ID>
      <Description>"Sub - min of 0 - alt"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>define(cave,"Tutorial-i386.exe"+290)
// current cave is read only (silly me)
fullaccess(cave,4)
globalalloc(code,1000)

[ENABLE]
code:
  label(continueOn)
  sub [cave], #100
  // sub sets the same flags as cmp (and vice versa)
  // so we can just jump based on [cave] being greater than #100
  // instead of [cave] after sub being greater than 0
  jg continueOn
  mov [cave],0
  continueOn:
  ret

createThread(code)
[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>77</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>79</ID>
      <Description>"Step 4 - Float Testing (SSE XMM) + 1000"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Tutorial-i386.exe
  Version: 
  Date   : 2017-02-09
  Author : HJP19

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(floatTesting,Tutorial-i386.exe,d9 9e ?? ?? ?? ?? ff b6) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:
resq 1 // space to save xmm0
dd (float)1000
code:
  movq [newmem], xmm0 // save

  // load double
  movss xmm0, [esi+494]
  addss xmm0, [newmem+8] // add 1000
  movd [esi+494], xmm0

  movq xmm0, [newmem] // restore
  jmp return

floatTesting:
  jmp code   // Make sure you're jumping to code not the stored values!
  nop
return:
registersymbol(floatTesting)

[DISABLE]

floatTesting:
  db D9 9E 94 04 00 00

unregistersymbol(floatTesting)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+2481F

"Tutorial-i386.exe"+247FB: DB 7D C0              -  fstp tword ptr [ebp-40]
"Tutorial-i386.exe"+247FE: B8 04 00 00 00        -  mov eax,00000004
"Tutorial-i386.exe"+24803: E8 E8 9E FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+24808: 89 45 D0              -  mov [ebp-30],eax
"Tutorial-i386.exe"+2480B: DB 45 D0              -  fild dword ptr [ebp-30]
"Tutorial-i386.exe"+2480E: DB 6D C0              -  fld tword ptr [ebp-40]
"Tutorial-i386.exe"+24811: DE C1                 -  faddp 
"Tutorial-i386.exe"+24813: D9 5D FC              -  fstp dword ptr [ebp-04]
"Tutorial-i386.exe"+24816: D9 45 FC              -  fld dword ptr [ebp-04]
"Tutorial-i386.exe"+24819: D8 AE 94 04 00 00     -  fsubr dword ptr [esi+00000494]
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+2481F: D9 9E 94 04 00 00     -  fstp dword ptr [esi+00000494]
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+24825: FF B6 94 04 00 00     -  push [esi+00000494]
"Tutorial-i386.exe"+2482B: 8D 45 BC              -  lea eax,[ebp-44]
"Tutorial-i386.exe"+2482E: 50                    -  push eax
"Tutorial-i386.exe"+2482F: B9 04 00 00 00        -  mov ecx,00000004
"Tutorial-i386.exe"+24834: BA 04 00 00 00        -  mov edx,00000004
"Tutorial-i386.exe"+24839: B8 00 00 00 00        -  mov eax,00000000
"Tutorial-i386.exe"+2483E: E8 8D 88 01 00        -  call Tutorial-i386.exe+3D0D0
"Tutorial-i386.exe"+24843: 8B 55 BC              -  mov edx,[ebp-44]
"Tutorial-i386.exe"+24846: 8B 86 80 04 00 00     -  mov eax,[esi+00000480]
"Tutorial-i386.exe"+2484C: E8 EF ED 06 00        -  call Tutorial-i386.exe+93640
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>80</ID>
      <Description>"Step 4 - Float Testing (FPU) +100"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Tutorial-i386.exe
  Version: 
  Date   : 2017-02-09
  Author : HJP19

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(floatTesting,Tutorial-i386.exe,d8 ae ?? ?? ?? ?? d9 9e) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:
  dd (float)100
code:
  // fsubr dword ptr [esi+00000494] // nop, not doing this!
  // get rid of value we were going to sub by, could nop the load and the sub
  // but this works even if you don't know where that value is loaded at
  fstp st(0)
  fld [esi+494] // fsubr was loading this before, now we need to

  fadd dword ptr [newmem]   // add 100
  // fstp dword ptr [esi+00000494] // done in code
  jmp return

floatTesting:
  jmp code   // Make sure you're jumping to code not the stored values!
  nop
return:
registersymbol(floatTesting)

[DISABLE]

floatTesting:
  db D8 AE 94 04 00 00

unregistersymbol(floatTesting)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+2481F

"Tutorial-i386.exe"+247FB: DB 7D C0              -  fstp tword ptr [ebp-40]
"Tutorial-i386.exe"+247FE: B8 04 00 00 00        -  mov eax,00000004
"Tutorial-i386.exe"+24803: E8 E8 9E FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+24808: 89 45 D0              -  mov [ebp-30],eax
"Tutorial-i386.exe"+2480B: DB 45 D0              -  fild dword ptr [ebp-30]
"Tutorial-i386.exe"+2480E: DB 6D C0              -  fld tword ptr [ebp-40]
"Tutorial-i386.exe"+24811: DE C1                 -  faddp 
"Tutorial-i386.exe"+24813: D9 5D FC              -  fstp dword ptr [ebp-04]
"Tutorial-i386.exe"+24816: D9 45 FC              -  fld dword ptr [ebp-04]
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+24819: D8 AE 94 04 00 00     -  fsubr dword ptr [esi+00000494]
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+2481F: D9 9E 94 04 00 00     -  fstp dword ptr [esi+00000494]
"Tutorial-i386.exe"+24825: FF B6 94 04 00 00     -  push [esi+00000494]
"Tutorial-i386.exe"+2482B: 8D 45 BC              -  lea eax,[ebp-44]
"Tutorial-i386.exe"+2482E: 50                    -  push eax
"Tutorial-i386.exe"+2482F: B9 04 00 00 00        -  mov ecx,00000004
"Tutorial-i386.exe"+24834: BA 04 00 00 00        -  mov edx,00000004
"Tutorial-i386.exe"+24839: B8 00 00 00 00        -  mov eax,00000000
"Tutorial-i386.exe"+2483E: E8 8D 88 01 00        -  call Tutorial-i386.exe+3D0D0
"Tutorial-i386.exe"+24843: 8B 55 BC              -  mov edx,[ebp-44]
"Tutorial-i386.exe"+24846: 8B 86 80 04 00 00     -  mov eax,[esi+00000480]
"Tutorial-i386.exe"+2484C: E8 EF ED 06 00        -  call Tutorial-i386.exe+93640
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>83</ID>
      <Description>"Step 4 - Float Testing (FPU) +50 float + 50 double"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Tutorial-i386.exe
  Version: 
  Date   : 2017-02-09
  Author : HJP19

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(floatTesting,Tutorial-i386.exe,d8 ae ?? ?? ?? ?? d9 9e) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:
  dd (float)50
  dq (double)50
code:
  // fsubr dword ptr [esi+00000494] // nop, not doing this!
  // get rid of value we were going to sub by, could nop the load and the sub
  // but this works even if you don't know where that value is loaded at
  fstp st(0)
  fld [esi+494] // fsubr was loading this before, now we need to

  fadd dword ptr [newmem]   // add float 50
  fadd qword ptr [newmem+4]   // add double 50
  // fstp dword ptr [esi+00000494] // done in code
  jmp return

floatTesting:
  jmp code   // Make sure you're jumping to code not the stored values!
  nop
return:
registersymbol(floatTesting)

[DISABLE]

floatTesting:
  db D8 AE 94 04 00 00

unregistersymbol(floatTesting)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+2481F

"Tutorial-i386.exe"+247FB: DB 7D C0              -  fstp tword ptr [ebp-40]
"Tutorial-i386.exe"+247FE: B8 04 00 00 00        -  mov eax,00000004
"Tutorial-i386.exe"+24803: E8 E8 9E FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+24808: 89 45 D0              -  mov [ebp-30],eax
"Tutorial-i386.exe"+2480B: DB 45 D0              -  fild dword ptr [ebp-30]
"Tutorial-i386.exe"+2480E: DB 6D C0              -  fld tword ptr [ebp-40]
"Tutorial-i386.exe"+24811: DE C1                 -  faddp 
"Tutorial-i386.exe"+24813: D9 5D FC              -  fstp dword ptr [ebp-04]
"Tutorial-i386.exe"+24816: D9 45 FC              -  fld dword ptr [ebp-04]
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+24819: D8 AE 94 04 00 00     -  fsubr dword ptr [esi+00000494]
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+2481F: D9 9E 94 04 00 00     -  fstp dword ptr [esi+00000494]
"Tutorial-i386.exe"+24825: FF B6 94 04 00 00     -  push [esi+00000494]
"Tutorial-i386.exe"+2482B: 8D 45 BC              -  lea eax,[ebp-44]
"Tutorial-i386.exe"+2482E: 50                    -  push eax
"Tutorial-i386.exe"+2482F: B9 04 00 00 00        -  mov ecx,00000004
"Tutorial-i386.exe"+24834: BA 04 00 00 00        -  mov edx,00000004
"Tutorial-i386.exe"+24839: B8 00 00 00 00        -  mov eax,00000000
"Tutorial-i386.exe"+2483E: E8 8D 88 01 00        -  call Tutorial-i386.exe+3D0D0
"Tutorial-i386.exe"+24843: 8B 55 BC              -  mov edx,[ebp-44]
"Tutorial-i386.exe"+24846: 8B 86 80 04 00 00     -  mov eax,[esi+00000480]
"Tutorial-i386.exe"+2484C: E8 EF ED 06 00        -  call Tutorial-i386.exe+93640
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>81</ID>
      <Description>"Step 4 - Float Testing =100"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Tutorial-i386.exe
  Version: 
  Date   : 2017-02-09
  Author : HJP19

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(floatTesting,Tutorial-i386.exe,D9 9E 94 04 00 00) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:

code:
  fstp dword ptr [esi+00000494]
  // overwrite value
  mov [esi+494], (float)100
  jmp return

floatTesting:
  jmp newmem // we can jump to newmem here because it's in the exact same place as code!
  nop
return:
registersymbol(floatTesting)

[DISABLE]

floatTesting:
  db D9 9E 94 04 00 00

unregistersymbol(floatTesting)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+2481F

"Tutorial-i386.exe"+247FB: DB 7D C0              -  fstp tword ptr [ebp-40]
"Tutorial-i386.exe"+247FE: B8 04 00 00 00        -  mov eax,00000004
"Tutorial-i386.exe"+24803: E8 E8 9E FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+24808: 89 45 D0              -  mov [ebp-30],eax
"Tutorial-i386.exe"+2480B: DB 45 D0              -  fild dword ptr [ebp-30]
"Tutorial-i386.exe"+2480E: DB 6D C0              -  fld tword ptr [ebp-40]
"Tutorial-i386.exe"+24811: DE C1                 -  faddp 
"Tutorial-i386.exe"+24813: D9 5D FC              -  fstp dword ptr [ebp-04]
"Tutorial-i386.exe"+24816: D9 45 FC              -  fld dword ptr [ebp-04]
"Tutorial-i386.exe"+24819: D8 AE 94 04 00 00     -  fsubr dword ptr [esi+00000494]
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+2481F: D9 9E 94 04 00 00     -  fstp dword ptr [esi+00000494]
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+24825: FF B6 94 04 00 00     -  push [esi+00000494]
"Tutorial-i386.exe"+2482B: 8D 45 BC              -  lea eax,[ebp-44]
"Tutorial-i386.exe"+2482E: 50                    -  push eax
"Tutorial-i386.exe"+2482F: B9 04 00 00 00        -  mov ecx,00000004
"Tutorial-i386.exe"+24834: BA 04 00 00 00        -  mov edx,00000004
"Tutorial-i386.exe"+24839: B8 00 00 00 00        -  mov eax,00000000
"Tutorial-i386.exe"+2483E: E8 8D 88 01 00        -  call Tutorial-i386.exe+3D0D0
"Tutorial-i386.exe"+24843: 8B 55 BC              -  mov edx,[ebp-44]
"Tutorial-i386.exe"+24846: 8B 86 80 04 00 00     -  mov eax,[esi+00000480]
"Tutorial-i386.exe"+2484C: E8 EF ED 06 00        -  call Tutorial-i386.exe+93640
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>85</ID>
      <Description>"Step 4 - Float Testing * -100 (great for xp lol) (32 bit addresses assumed)"</Description>
      <Options moHideChildren="1"/>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Tutorial-i386.exe
  Version: 
  Date   : 2017-02-09
  Author : HJP19

  This script does blah blah blah
}
[ENABLE]
aobscanmodule(floatTesting,Tutorial-i386.exe,D8 AE 94 04 00 00) // should be unique
alloc(newmem,$1000)

label(code)
label(return)
label(floatTestingMultValue)

newmem:
  dd (float)-100 // want to add not sub so -
floatTestingMultValue:
  resd 3
code:
  fmul dword ptr [newmem]
  // show how much it was changed by (note that it's negative!)
  fist [floatTestingMultValue+0]     // Float Integer STore vs Float STore
  fst [floatTestingMultValue+4]      // Float Integer STore vs Float STore
  mov [floatTestingMultValue+8], esi // store base address for testing/verifying
  // fst [floatTestingMultValue]
  fsubr dword ptr [esi+00000494]
  jmp return

floatTesting:
  jmp code   // Make sure you're jumping to code not the stored values!
  nop
return:
registersymbol(floatTesting)
registersymbol(floatTestingMultValue)

[DISABLE]

floatTesting:
  db D8 AE 94 04 00 00

unregistersymbol(floatTesting)
unregistersymbol(floatTestingMultValue)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+24819

"Tutorial-i386.exe"+247F9: DE C1                 -  faddp 
"Tutorial-i386.exe"+247FB: DB 7D C0              -  fstp tword ptr [ebp-40]
"Tutorial-i386.exe"+247FE: B8 04 00 00 00        -  mov eax,00000004
"Tutorial-i386.exe"+24803: E8 E8 9E FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+24808: 89 45 D0              -  mov [ebp-30],eax
"Tutorial-i386.exe"+2480B: DB 45 D0              -  fild dword ptr [ebp-30]
"Tutorial-i386.exe"+2480E: DB 6D C0              -  fld tword ptr [ebp-40]
"Tutorial-i386.exe"+24811: DE C1                 -  faddp 
"Tutorial-i386.exe"+24813: D9 5D FC              -  fstp dword ptr [ebp-04]
"Tutorial-i386.exe"+24816: D9 45 FC              -  fld dword ptr [ebp-04]
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+24819: D8 AE 94 04 00 00     -  fsubr dword ptr [esi+00000494]
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+2481F: D9 9E 94 04 00 00     -  fstp dword ptr [esi+00000494]
"Tutorial-i386.exe"+24825: FF B6 94 04 00 00     -  push [esi+00000494]
"Tutorial-i386.exe"+2482B: 8D 45 BC              -  lea eax,[ebp-44]
"Tutorial-i386.exe"+2482E: 50                    -  push eax
"Tutorial-i386.exe"+2482F: B9 04 00 00 00        -  mov ecx,00000004
"Tutorial-i386.exe"+24834: BA 04 00 00 00        -  mov edx,00000004
"Tutorial-i386.exe"+24839: B8 00 00 00 00        -  mov eax,00000000
"Tutorial-i386.exe"+2483E: E8 8D 88 01 00        -  call Tutorial-i386.exe+3D0D0
"Tutorial-i386.exe"+24843: 8B 55 BC              -  mov edx,[ebp-44]
"Tutorial-i386.exe"+24846: 8B 86 80 04 00 00     -  mov eax,[esi+00000480]
}
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>86</ID>
          <Description>"Amount Changed By"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>floatTestingMultValue</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>88</ID>
          <Description>"Amount Changed By"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>Float</VariableType>
          <Address>floatTestingMultValue+4</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>87</ID>
          <Description>"Value"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>Float</VariableType>
          <Address>[floatTestingMultValue+8]+494</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>67</ID>
      <Description>"Step 4 - Double Testing (SSE XMM) +1000"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Tutorial-i386.exe
  Version: 
  Date   : 2017-02-09
  Author : HJP19

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(doubleTesting,Tutorial-i386.exe,DD 9B 98 04 00 00) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:
resq 1
// you can define doubles in memory but
// you can't move 64 bit immediates in instructions
// eg movq [ebx+498], (double)1000
// like you can with 32 bit floats
dq (double)1000
code:
  movq [newmem], xmm0 // save

  // load double
  movsd xmm0, [ebx+00000498]
  addsd xmm0, [newmem+8] // add 1000
  movq [ebx+498], xmm0

  movq xmm0, [newmem] // restore
  jmp return

doubleTesting:
  jmp code
  nop
return:
registersymbol(doubleTesting)

[DISABLE]

doubleTesting:
  db DD 9B 98 04 00 00

unregistersymbol(doubleTesting)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+24643

"Tutorial-i386.exe"+2461B: E8 D0 A0 FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+24620: 83 C0 01              -  add eax,01
"Tutorial-i386.exe"+24623: 75 05                 -  jne Tutorial-i386.exe+2462A
"Tutorial-i386.exe"+24625: B8 01 00 00 00        -  mov eax,00000001
"Tutorial-i386.exe"+2462A: A1 80 27 5A 00        -  mov eax,[Tutorial-i386.exe+1A2780]
"Tutorial-i386.exe"+2462F: 89 45 F8              -  mov [ebp-08],eax
"Tutorial-i386.exe"+24632: A1 84 27 5A 00        -  mov eax,[Tutorial-i386.exe+1A2784]
"Tutorial-i386.exe"+24637: 89 45 FC              -  mov [ebp-04],eax
"Tutorial-i386.exe"+2463A: DD 45 F8              -  fld qword ptr [ebp-08]
"Tutorial-i386.exe"+2463D: DC AB 98 04 00 00     -  fsubr qword ptr [ebx+00000498]
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+24643: DD 9B 98 04 00 00     -  fstp qword ptr [ebx+00000498]
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+24649: FF B3 9C 04 00 00     -  push [ebx+0000049C]
"Tutorial-i386.exe"+2464F: FF B3 98 04 00 00     -  push [ebx+00000498]
"Tutorial-i386.exe"+24655: 8D 45 CC              -  lea eax,[ebp-34]
"Tutorial-i386.exe"+24658: 50                    -  push eax
"Tutorial-i386.exe"+24659: B9 04 00 00 00        -  mov ecx,00000004
"Tutorial-i386.exe"+2465E: BA 04 00 00 00        -  mov edx,00000004
"Tutorial-i386.exe"+24663: B8 00 00 00 00        -  mov eax,00000000
"Tutorial-i386.exe"+24668: E8 13 8A 01 00        -  call Tutorial-i386.exe+3D080
"Tutorial-i386.exe"+2466D: 8B 55 CC              -  mov edx,[ebp-34]
"Tutorial-i386.exe"+24670: 8B 83 70 04 00 00     -  mov eax,[ebx+00000470]
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>68</ID>
      <Description>"Step 4 - Double Testing (FPU) = 100"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Tutorial-i386.exe
  Version: 
  Date   : 2017-02-09
  Author : HJP19

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(doubleTesting,Tutorial-i386.exe,DD 9B 98 04 00 00) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:
code:
  // original code
  fstp qword ptr [ebx+00000498]

  // double value for 100 is 0x40590000 00000000 in hex
  // http://www.binaryconvert.com/result_double.html?
  // first 4 bytes often 0 and least significant
  // so can usually be ignored but
  mov [ebx+498], 0
  mov [ebx+49c], 40590000
  jmp return

doubleTesting:
  jmp code
  nop
return:
registersymbol(doubleTesting)

[DISABLE]

doubleTesting:
  db DD 9B 98 04 00 00

unregistersymbol(doubleTesting)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+24643

"Tutorial-i386.exe"+2461B: E8 D0 A0 FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+24620: 83 C0 01              -  add eax,01
"Tutorial-i386.exe"+24623: 75 05                 -  jne Tutorial-i386.exe+2462A
"Tutorial-i386.exe"+24625: B8 01 00 00 00        -  mov eax,00000001
"Tutorial-i386.exe"+2462A: A1 80 27 5A 00        -  mov eax,[Tutorial-i386.exe+1A2780]
"Tutorial-i386.exe"+2462F: 89 45 F8              -  mov [ebp-08],eax
"Tutorial-i386.exe"+24632: A1 84 27 5A 00        -  mov eax,[Tutorial-i386.exe+1A2784]
"Tutorial-i386.exe"+24637: 89 45 FC              -  mov [ebp-04],eax
"Tutorial-i386.exe"+2463A: DD 45 F8              -  fld qword ptr [ebp-08]
"Tutorial-i386.exe"+2463D: DC AB 98 04 00 00     -  fsubr qword ptr [ebx+00000498]
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+24643: DD 9B 98 04 00 00     -  fstp qword ptr [ebx+00000498]
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+24649: FF B3 9C 04 00 00     -  push [ebx+0000049C]
"Tutorial-i386.exe"+2464F: FF B3 98 04 00 00     -  push [ebx+00000498]
"Tutorial-i386.exe"+24655: 8D 45 CC              -  lea eax,[ebp-34]
"Tutorial-i386.exe"+24658: 50                    -  push eax
"Tutorial-i386.exe"+24659: B9 04 00 00 00        -  mov ecx,00000004
"Tutorial-i386.exe"+2465E: BA 04 00 00 00        -  mov edx,00000004
"Tutorial-i386.exe"+24663: B8 00 00 00 00        -  mov eax,00000000
"Tutorial-i386.exe"+24668: E8 13 8A 01 00        -  call Tutorial-i386.exe+3D080
"Tutorial-i386.exe"+2466D: 8B 55 CC              -  mov edx,[ebp-34]
"Tutorial-i386.exe"+24670: 8B 83 70 04 00 00     -  mov eax,[ebx+00000470]
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>69</ID>
      <Description>"Step 4 - Double Testing (FPU) +100"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Tutorial-i386.exe
  Version: 
  Date   : 2017-02-09
  Author : HJP19

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(doubleTesting,Tutorial-i386.exe,DD 9B 98 04 00 00) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:
dq (double)100
code:
  // original code
  fadd qword ptr [newmem]   // add 100
  fstp qword ptr [ebx+00000498]
  jmp return

doubleTesting:
  jmp code
  nop
return:
registersymbol(doubleTesting)

[DISABLE]

doubleTesting:
  db DD 9B 98 04 00 00

unregistersymbol(doubleTesting)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+24643

"Tutorial-i386.exe"+2461B: E8 D0 A0 FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+24620: 83 C0 01              -  add eax,01
"Tutorial-i386.exe"+24623: 75 05                 -  jne Tutorial-i386.exe+2462A
"Tutorial-i386.exe"+24625: B8 01 00 00 00        -  mov eax,00000001
"Tutorial-i386.exe"+2462A: A1 80 27 5A 00        -  mov eax,[Tutorial-i386.exe+1A2780]
"Tutorial-i386.exe"+2462F: 89 45 F8              -  mov [ebp-08],eax
"Tutorial-i386.exe"+24632: A1 84 27 5A 00        -  mov eax,[Tutorial-i386.exe+1A2784]
"Tutorial-i386.exe"+24637: 89 45 FC              -  mov [ebp-04],eax
"Tutorial-i386.exe"+2463A: DD 45 F8              -  fld qword ptr [ebp-08]
"Tutorial-i386.exe"+2463D: DC AB 98 04 00 00     -  fsubr qword ptr [ebx+00000498]
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+24643: DD 9B 98 04 00 00     -  fstp qword ptr [ebx+00000498]
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+24649: FF B3 9C 04 00 00     -  push [ebx+0000049C]
"Tutorial-i386.exe"+2464F: FF B3 98 04 00 00     -  push [ebx+00000498]
"Tutorial-i386.exe"+24655: 8D 45 CC              -  lea eax,[ebp-34]
"Tutorial-i386.exe"+24658: 50                    -  push eax
"Tutorial-i386.exe"+24659: B9 04 00 00 00        -  mov ecx,00000004
"Tutorial-i386.exe"+2465E: BA 04 00 00 00        -  mov edx,00000004
"Tutorial-i386.exe"+24663: B8 00 00 00 00        -  mov eax,00000000
"Tutorial-i386.exe"+24668: E8 13 8A 01 00        -  call Tutorial-i386.exe+3D080
"Tutorial-i386.exe"+2466D: 8B 55 CC              -  mov edx,[ebp-34]
"Tutorial-i386.exe"+24670: 8B 83 70 04 00 00     -  mov eax,[ebx+00000470]
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>70</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>34</ID>
      <Description>"Lua Breakpoint Test (Step 2)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
[ENABLE]
  if syntaxcheck then return end
  local aob = AOBScan("29 D0 89 83 ?? ?? ?? ?? 8d 55 ?? e8") -- 3.2 &amp; 3.3
  if aob.Count ~= 1 then
     aob.destroy()
     return 0
  end
  -- prepend 0x, removeBreakpoint doesn't seem to like it without
  -- could probably also parse it as hex but, why bother?
  addr = getAddress(aob[0])
  aob.destroy() -- free list

  -- set breakpoint at addr (first byte), when executed
  -- and run given function when hit
  debug_setBreakpoint(addr, 1, bptExecute,function()
    local value = readInteger(EBX+0x480)
    local newValue = EAX
    if newValue &lt; 90 then
      newValue = 1000
    end
    EAX = newValue
    showMessage("Changing " .. tostring(value) .. " to " .. tostring(newValue))
    return 0 -- return 1 will keep breakpoint active so user must continue
  end)
[DISABLE]
debug_removeBreakpoint(addr)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>47</ID>
      <Description>"Lua Debug Bypass Step 2"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
  if syntaxcheck then return end

[ENABLE]
-- variables to be used in the lua code these can be named pretty much anything
-- but if you change them you need to change where they are used too!
allocatedCode = "test"
scriptString = [[
alloc(test,$1000)
registerSymbol(test)
test:
  cmp [ebx+00000480],#100
  jmp 00423CCD
]]
breakpointAddress = "00423CC3"

-- setup function to handle the breakpoint
function debugger_onBreakpoint()
    -- note that works for _all_ breakpoints if you have multiple you'll probably
    -- need to use a series of if statements based on RIP to determine the proper
    -- address/script-code to set them to

    -- set the IP based on 32/64 bit
    if targetIs64Bit() then
        RIP = getAddress(allocatedCode)
    else
        EIP = getAddress(allocatedCode)
    end
    -- continue from breakpoint
    debug_continueFromBreakpoint(co_run)
end

reinitializeSymbolhandler() -- make sure process is fully loaded if run at start
autoAssemble(scriptString) -- assemble the script
-- 0=default, 1=windows debug, 2=VEHDebug, 3=Kerneldebug
debugProcess(2) -- make sure debugger is attached
debug_setBreakpoint(breakpointAddress) -- set the breakpoint

[DISABLE]
debug_removeBreakpoint(breakpointAddress)
deallocScript = "dealloc(" .. allocatedCode .. ")"
autoAssemble(deallocScript)
unregisterSymbol(allocatedCode)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>58</ID>
      <Description>"Lua Debug Bypass Step 2 - AOB - WIP"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
  if syntaxcheck then return end

[ENABLE]
-- variables to be used in the lua code these can be named pretty much anything
-- but if you change them you need to change where they are used too!
allocatedCode = "LuaBpBypasstest"
-- 3.2 &amp; 3.3
--aobStr = "?? ?? 8b 83 ?? ?? ?? ?? ?? ?? 8b 8b ?? ?? ?? ?? 8b 09 ff 91 ?? ?? ?? ?? 8b 83 ?? ?? ?? ?? ?? ?? 8b 8b ?? ?? ?? ?? 8b 09 ff 91 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 c6"
aobStr = "81 bb ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b 83 ?? ?? ?? ?? ?? ?? 8b 8b ?? ?? ?? ?? 8b 09 ff 91 ?? ?? ?? ?? 8b 83 ?? ?? ?? ?? ?? ?? 8b 8b ?? ?? ?? ?? 8b 09 ff 91 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 c6"
scriptString = [[
alloc(]] .. allocatedCode .. [[,$1000)
registerSymbol(]] .. allocatedCode .. [[)
]] .. allocatedCode .. [[:
  //xor ebx, ebx // set 0 flag
  cmp [ebx+00000480],#100
  pushf
  mov ebx, breakpointAddress
  add ebx, A
  popf
  jmp ebx

  unregisterSymbol(breakpointAddress)
]]

scriptString = [[
alloc(LuaBpBypasstest,$1000)
registerSymbol(LuaBpBypasstest)
LuaBpBypasstest:
  //xor ebx, ebx // set 0 flag
  mov [ebx+00000480],#1000
  cmp [ebx+00000480],#1000
  pushf
  mov ebx, breakpointAddress
  add ebx, A
  popf
  jmp ebx

  unregisterSymbol(breakpointAddress)
]]

local aob = AOBScan(aobStr)
if aob.Count ~= 1 then
   aob.destroy()
   return 0
end
-- prepend 0x, removeBreakpoint doesn't seem to like it without
-- could probably also parse it as hex but, why bother?
breakpointAddress = getAddress(aob[0])
registerSymbol("breakpointAddress", breakpointAddress)
aob.destroy() -- free list

reinitializeSymbolhandler() -- make sure process is fully loaded if run at start
autoAssemble(scriptString) -- assemble the script

function debugger_onBreakpoint()
    -- note that works for _all_ breakpoints if you have multiple you'll probably
    -- need to use a series of if statements based on RIP to determine the proper
    -- address/script-code to set them to

    -- set the IP based on 32/64 bit
    if targetIs64Bit() then
        if(RIP == breakpointAddress) then
          RIP = getAddress(allocatedCode)
        end
    else
        if(EIP == breakpointAddress) then
          EIP = getAddress(allocatedCode)
        end
    end
    -- continue from breakpoint
    debug_continueFromBreakpoint(co_run)
end

-- 0=default, 1=windows debug, 2=VEHDebug, 3=Kerneldebug
debugProcess(2) -- make sure debugger is attached
-- set the breakpoint
debug_setBreakpoint(breakpointAddress, 1, bptExecute)

[DISABLE]
debug_removeBreakpoint(breakpointAddress)
deallocScript = "dealloc(" .. allocatedCode .. ")"
autoAssemble(deallocScript)
unregisterSymbol(allocatedCode)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>71</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>35</ID>
      <Description>"readMem example"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
define(fromMem, 00400290)
define(toMem,   00400290+7)
define(saveMem, 00400290+14)
registerSymbol(toMem)
registerSymbol(saveMem)

saveMem:
  Readmem(toMem,4)
toMem:
  Readmem(fromMem,4)
[DISABLE]
toMem:
  Readmem(saveMem,4)
unregisterSymbol(toMem)
unregisterSymbol(saveMem)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>36</ID>
      <Description>"lua readMem example"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
{$lua}
  if syntaxcheck then return end
-- not sure if fromMem/toMem/original will exist in other scripts
-- without being local but they won't exist in [DSIABLE] if they _are_ local
-- without being redefined so...
fromMem = 0x00400290
toMem = fromMem+7
-- address = AOBScan("?? ?? ??")[0]
-- ^ lua AOBScans return a list of addresses (as strings)
-- can also use "aRegisteredSymbol" string as an address
original = readBytes(toMem, 4, true) -- true says return table of bytes
local new = readBytes(fromMem, 4, true)
writeBytes(toMem, new)
{$asm}
// ^ note, you don't _have_ to use {$asm} again here since we
// immediately switch back to lua in disable, but I find it easier
[DISABLE]
{$lua}
writeBytes(toMem, original)
{$asm}

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>131</ID>
      <Description>"readmem actual use (step 2)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Tutorial-i386.exe
  Version: 
  Date   : 2017-03-11
  Author : HJP19

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(INJECT,Tutorial-i386.exe,89 83 80 04 00 00 8D 55 D4 E8 02) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:
  readmem(INJECT,6) // copy original code for restore
code:
  mov eax, #1000 // move decimal 1000 into eax, which will be used in original code
  readmem(INJECT,6) // run original code here
  jmp return

INJECT:
  jmp code
  nop
return:
registersymbol(INJECT)
registersymbol(newmem)

[DISABLE]

INJECT:
  readmem(newmem,6)

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+23B00

"Tutorial-i386.exe"+23ADC: E8 CF 99 FE FF        -  call Tutorial-i386.exe+D4B0
"Tutorial-i386.exe"+23AE1: E8 DA B4 FE FF        -  call Tutorial-i386.exe+EFC0
"Tutorial-i386.exe"+23AE6: 50                    -  push eax
"Tutorial-i386.exe"+23AE7: 85 C0                 -  test eax,eax
"Tutorial-i386.exe"+23AE9: 75 65                 -  jne Tutorial-i386.exe+23B50
"Tutorial-i386.exe"+23AEB: B8 05 00 00 00        -  mov eax,00000005
"Tutorial-i386.exe"+23AF0: E8 FB AB FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+23AF5: 8D 50 01              -  lea edx,[eax+01]
"Tutorial-i386.exe"+23AF8: 8B 83 80 04 00 00     -  mov eax,[ebx+00000480]
"Tutorial-i386.exe"+23AFE: 29 D0                 -  sub eax,edx
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+23B00: 89 83 80 04 00 00     -  mov [ebx+00000480],eax
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+23B06: 8D 55 D4              -  lea edx,[ebp-2C]
"Tutorial-i386.exe"+23B09: E8 02 62 01 00        -  call Tutorial-i386.exe+39D10
"Tutorial-i386.exe"+23B0E: 8B 55 D4              -  mov edx,[ebp-2C]
"Tutorial-i386.exe"+23B11: 8B 83 6C 04 00 00     -  mov eax,[ebx+0000046C]
"Tutorial-i386.exe"+23B17: E8 24 FB 06 00        -  call Tutorial-i386.exe+93640
"Tutorial-i386.exe"+23B1C: 83 BB 80 04 00 00 00  -  cmp dword ptr [ebx+00000480],00
"Tutorial-i386.exe"+23B23: 7D 2B                 -  jnl Tutorial-i386.exe+23B50
"Tutorial-i386.exe"+23B25: A1 24 F2 54 00        -  mov eax,[Tutorial-i386.exe+14F224]
"Tutorial-i386.exe"+23B2A: E8 E1 4A 0F 00        -  call Tutorial-i386.exe+118610
"Tutorial-i386.exe"+23B2F: B8 64 00 00 00        -  mov eax,00000064
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>72</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>53</ID>
      <Description>"CreateThread - Asm MsgBox"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
globalalloc(asmMsgBox,1000) // allocs and registers name. Can't be dealloced
label(msg)
asmMsgBox:
  // push arguments (in reverse) for x86
  // x64 uses RCX, RDX, R8, and R9 registers
  // ParkourPenguin on CE forums summed up x64 nicely
  // http://forum.cheatengine.org/viewtopic.php?p=5722387#5722387
  push 0        // uType MB_OK
  push 0        // lpCaption (NULL, default to "Error")
  push msg      // lpText
  push 0        // hWnd (NULL, no owner)
  call MessageBoxA
  ret
msg:
  db 'Hello! How''s it goin?',0 // note the double ' to escape the '

createThread(asmMsgBox) // make sure this is a registered symbol!

[DISABLE]
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>62</ID>
      <Description>"Christmas x86 Asm MsgBox"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
globalalloc(asmMsgBox,1000) // allocs and registers name. Can't be dealloced
label(msg)
label(title)
asmMsgBox:
  // push arguments (in reverse) for x86
  // x64 uses RCX, RDX, R8, and R9 registers
  // ParkourPenguin on CE forums summed up x64 nicely
  // http://forum.cheatengine.org/viewtopic.php?p=5722387#5722387
  push 0        // uType MB_OK
  push title    // lpCaption (NULL, default to "Error")
  push msg      // lpText
  push 0        // hWnd (NULL, no owner)
  call MessageBoxA
  ret
msg:
  db 'MERRY CHRISTMAS', A // 0xA = 10 = '\n'
  db 'Single Bell..Single Bell..Single all the way!', A
  db 'Oh, what fun is to see '
  db 'the couples fight all the day, hey!',0
title:
  db 'MERRY CHRISTMAS',0

createThread(asmMsgBox) // make sure this is a registered symbol!
{$lua}
timer = createTimer()
timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  al = getAddressList()
  mr = al.getMemoryRecordByID(62)
  mr.active = false
end
timer.interval = 100 -- 1/10 of a second

[DISABLE]
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>65</ID>
      <Description>"Christmas x86 Asm MsgBox Song"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
globalalloc(asmJingleBells,1000) // allocs and registers name. Can't be dealloced
label(chorus)
// too lazy to see how long each string is... or I'd just need 1 lol
label(chorus2)
label(chorus3)
label(chorus4)
label(chorusArray)
registerSymbol(chorusArray)
label(play)
label(done)
label(main)

label(title)
label(caption)

asmJingleBells:
play:
  // some set
  mov esi, chorusArray
  mov [esi+0], chorus
  mov [esi+4], chorus2
  mov [esi+8], chorus3
  mov [esi+C], chorus4

  // and play!
  luacall(playSound(findTableFile('song.wav')))
  push main
  call sing

  call playChorus
  call playChorus
  call playChorus

  push main
  call sing

  call playChorus
  call playChorus

  push main
  call sing
done:
  ret

playChorus:
  mov esi, chorusArray
  xor ebx, ebx
  @@: // anonymous label, great for loops
  push [esi+ebx*4]
  call sing
  inc ebx
  cmp ebx, 4
  jl @b // aka @r jmp to closest label when looking backwards
  ret

chorus:
  db 'Oh, what fun it is to ride', 0
chorus2:
  db 'In a one horse open sleigh', 0
chorus3:
  db 'Hey, Jingle bells, jingle bells', 0
chorus4:
  db 'Jingle all the way', 0

chorusArray:
  //dd chorus,chorus2,chorus3,chorus4,0
  dd 0,0,0,0,0

main:
  db 'It', 27, 's Christmas', 0

sing:
  push ebp
  mov ebp, esp
  push title
  push 0 // class
  call FindWindowA
  //test eax, eax
  //jz fail

  push 0x00001000   // uType MB_OK, MB_SYSTEMMODAL
  push caption      // lpCaption (NULL, default to "Error")
  push  [ebp+8]     // lpText
  push eax          // hWnd (NULL, no owner)
  call MessageBoxA
  mov esp, ebp
  pop ebp
  ret 4
title:
  db 'Cheat Engine Tutorial v3.3',0
caption:
  db 'MERRY CHRISTMAS',0

createThread(asmJingleBells) // aka play

//createThread(asmJingleBells) // aka play
{$lua}
timer = createTimer()
timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  al = getAddressList()
  mr = al.getMemoryRecordByID(65)
  --mr.active = false
end
timer.interval = 100 -- 1/10 of a second

[DISABLE]
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>127</ID>
      <Description>"Christmas x64 Asm MsgBox"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
globalalloc(asmMsgBox,0x9C) // allocs and registers name. Can't be dealloced
label(msg)
label(title)
asmMsgBox:
  xor r9, r9    // 0, uType MB_OK
  mov r8, title // lpCaption (NULL, default to "Error")
  mov rdx, msg  // lpText
  xor rcx, rcx  // hWnd (NULL, no owner)

  // align stack
  mov  rbp, rsp
  and  rsp, -10
  // call
  call MessageBoxA
  // restore stack pointer
  mov rsp, rbp
  ret
msg:
  db 'MERRY CHRISTMAS', A // 0xA = 10 = '\n'
  db 'Single Bell..Single Bell..Single all the way!', A
  db 'Oh, what fun is to see '
  db 'the couples fight all the day, hey!',0
title:
  db 'MERRY CHRISTMAS',0

createThread(asmMsgBox)
[DISABLE]
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>147</ID>
      <Description>"x86/x64 Beep"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>/*
https://msdn.microsoft.com/en-us/library/windows/desktop/ms679277(v=vs.85).aspx
BOOL WINAPI Beep(
  _In_ DWORD dwFreq,
  _In_ DWORD dwDuration
);
*/

globalalloc(dobeep,1000)
[ENABLE]
dobeep:
  // align stack (ce will automatically use ebp/esp for 32 bit, at least in this test lol)
  mov  rbp, rsp
  and  rsp, -10
{$lua}
  if targetIs64Bit() then
    return [[//code for if it is a 64bit application
      mov rcx, #300 // dwFreq
      mov rdx, #750 // dwDuration
    ]]
  else
    return [[//code for if it is a 32bit application
      push #750 // dwDuration
      push #300 // dwFreq
    ]]
  end
{$asm}
  call beep
  // restore stack pointer
  mov rsp, rbp
  ret

createThread(dobeep)

[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>151</ID>
      <Description>"x86/x64 Beep - Step 2"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>/*
https://msdn.microsoft.com/en-us/library/windows/desktop/ms679277(v=vs.85).aspx
BOOL WINAPI Beep(
  _In_ DWORD dwFreq,
  _In_ DWORD dwDuration
);
*/
[ENABLE]
{$lua}
  if targetIs64Bit() then
    return [[//code for if it is a 64bit application
      aobscanmodule(INJECT,Tutorial-x86_64.exe,83 BB 90 07 00 00 00)
      alloc(newmem,$1000,"Tutorial-x86_64.exe"+2AD8C)
    ]]
  else
    return [[//code for if it is a 32bit application
      aobscanmodule(INJECT,Tutorial-i386.exe,83 bb ?? ?? ?? ?? ?? ?? ?? a1 24 f2)
      alloc(newmem,$1000)
    ]]
  end
{$asm}
label(code)
label(return)

newmem:
code:
  push rax
  // align stack
  // ce will automatically use ebp/esp for 32 bit, at least for this lol
  // the opcodes (actual bytes) are probably the same
  push rbp
  mov  rbp, rsp
  and  rsp, -10
{$lua}
  if targetIs64Bit() then
    return [[//code for if it is a 64bit application
      mov rcx, #700 // dwFreq
      mov rdx, #350 // dwDuration
    ]]
  else
    return [[//code for if it is a 32bit application
      push #350 // dwDuration
      push #700 // dwFreq
    ]]
  end
{$asm}

  call beep
  // restore stack pointer
  mov rsp, rbp
  pop rbp
  pop rax

{$lua}
  if targetIs64Bit() then
    return [[//code for if it is a 64bit application
      cmp dword ptr [rbx+00000790],00
    ]]
  else
    return [[//code for if it is a 32bit application
      cmp dword ptr [ebx+00000480],00
    ]]
  end
{$asm}
  jmp return

INJECT:
  jmp newmem
  db 90 90
return:
registersymbol(INJECT)

[DISABLE]
INJECT:
{$lua}
  if targetIs64Bit() then
    return [[//code for if it is a 64bit application
      db 83 BB 90 07 00 00 00
    ]]
  else
    return [[//code for if it is a 32bit application
      db 83 BB 80 04 00 00 00
    ]]
  end
{$asm}

unregistersymbol(INJECT)
dealloc(newmem)


{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+23B1C

"Tutorial-i386.exe"+23AF0: E8 FB AB FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+23AF5: 8D 50 01              -  lea edx,[eax+01]
"Tutorial-i386.exe"+23AF8: 8B 83 80 04 00 00     -  mov eax,[ebx+00000480]
"Tutorial-i386.exe"+23AFE: 29 D0                 -  sub eax,edx
"Tutorial-i386.exe"+23B00: 89 83 80 04 00 00     -  mov [ebx+00000480],eax
"Tutorial-i386.exe"+23B06: 8D 55 D4              -  lea edx,[ebp-2C]
"Tutorial-i386.exe"+23B09: E8 02 62 01 00        -  call Tutorial-i386.exe+39D10
"Tutorial-i386.exe"+23B0E: 8B 55 D4              -  mov edx,[ebp-2C]
"Tutorial-i386.exe"+23B11: 8B 83 6C 04 00 00     -  mov eax,[ebx+0000046C]
"Tutorial-i386.exe"+23B17: E8 24 FB 06 00        -  call Tutorial-i386.exe+93640
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+23B1C: 83 BB 80 04 00 00 00  -  cmp dword ptr [ebx+00000480],00
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+23B23: 7D 2B                 -  jnl Tutorial-i386.exe+23B50
"Tutorial-i386.exe"+23B25: A1 24 F2 54 00        -  mov eax,[Tutorial-i386.exe+14F224]
"Tutorial-i386.exe"+23B2A: E8 E1 4A 0F 00        -  call Tutorial-i386.exe+118610
"Tutorial-i386.exe"+23B2F: B8 64 00 00 00        -  mov eax,00000064
"Tutorial-i386.exe"+23B34: 89 83 80 04 00 00     -  mov [ebx+00000480],eax
"Tutorial-i386.exe"+23B3A: 8D 55 D4              -  lea edx,[ebp-2C]
"Tutorial-i386.exe"+23B3D: E8 CE 61 01 00        -  call Tutorial-i386.exe+39D10
"Tutorial-i386.exe"+23B42: 8B 55 D4              -  mov edx,[ebp-2C]
"Tutorial-i386.exe"+23B45: 8B 83 6C 04 00 00     -  mov eax,[ebx+0000046C]
"Tutorial-i386.exe"+23B4B: E8 F0 FA 06 00        -  call Tutorial-i386.exe+93640
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>152</ID>
      <Description>"x64 Beep - Step 2"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>/*
https://msdn.microsoft.com/en-us/library/windows/desktop/ms679277(v=vs.85).aspx
BOOL WINAPI Beep(
  _In_ DWORD dwFreq,
  _In_ DWORD dwDuration
);
*/
[ENABLE]
aobscanmodule(INJECT,Tutorial-x86_64.exe,83 BB 90 07 00 00 00)
alloc(newmem,$1000,"Tutorial-x86_64.exe"+2AD8C)
label(code)
label(return)

newmem:
code:
  mov rcx, #700 // dwFreq
  mov rdx, #300 // dwDuration
  call beep

  cmp dword ptr [rbx+00000790],00
  jmp return

INJECT:
  jmp newmem
  db 90 90
return:
registersymbol(INJECT)

[DISABLE]
INJECT:
  db 83 BB 90 07 00 00 00

unregistersymbol(INJECT)
dealloc(newmem)


{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+23B1C

"Tutorial-i386.exe"+23AF0: E8 FB AB FE FF        -  call Tutorial-i386.exe+E6F0
"Tutorial-i386.exe"+23AF5: 8D 50 01              -  lea edx,[eax+01]
"Tutorial-i386.exe"+23AF8: 8B 83 80 04 00 00     -  mov eax,[ebx+00000480]
"Tutorial-i386.exe"+23AFE: 29 D0                 -  sub eax,edx
"Tutorial-i386.exe"+23B00: 89 83 80 04 00 00     -  mov [ebx+00000480],eax
"Tutorial-i386.exe"+23B06: 8D 55 D4              -  lea edx,[ebp-2C]
"Tutorial-i386.exe"+23B09: E8 02 62 01 00        -  call Tutorial-i386.exe+39D10
"Tutorial-i386.exe"+23B0E: 8B 55 D4              -  mov edx,[ebp-2C]
"Tutorial-i386.exe"+23B11: 8B 83 6C 04 00 00     -  mov eax,[ebx+0000046C]
"Tutorial-i386.exe"+23B17: E8 24 FB 06 00        -  call Tutorial-i386.exe+93640
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+23B1C: 83 BB 80 04 00 00 00  -  cmp dword ptr [ebx+00000480],00
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+23B23: 7D 2B                 -  jnl Tutorial-i386.exe+23B50
"Tutorial-i386.exe"+23B25: A1 24 F2 54 00        -  mov eax,[Tutorial-i386.exe+14F224]
"Tutorial-i386.exe"+23B2A: E8 E1 4A 0F 00        -  call Tutorial-i386.exe+118610
"Tutorial-i386.exe"+23B2F: B8 64 00 00 00        -  mov eax,00000064
"Tutorial-i386.exe"+23B34: 89 83 80 04 00 00     -  mov [ebx+00000480],eax
"Tutorial-i386.exe"+23B3A: 8D 55 D4              -  lea edx,[ebp-2C]
"Tutorial-i386.exe"+23B3D: E8 CE 61 01 00        -  call Tutorial-i386.exe+39D10
"Tutorial-i386.exe"+23B42: 8B 55 D4              -  mov edx,[ebp-2C]
"Tutorial-i386.exe"+23B45: 8B 83 6C 04 00 00     -  mov eax,[ebx+0000046C]
"Tutorial-i386.exe"+23B4B: E8 F0 FA 06 00        -  call Tutorial-i386.exe+93640
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>153</ID>
      <Description>"x64 Beep every second - ParkourPenguin"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>/*
Credit ParkourPenguin: http://forum.cheatengine.org/viewtopic.php?p=5722387#5722387

x64 calling conventions : https://msdn.microsoft.com/en-us/library/ms235286.aspx
TL;DR:
Parameters go in rcx, rdx, r8, and r9. Any additional parameters go on the stack.
Return value is in rax or xmm0 for floating point numbers.
rax, rcx, rdx, r8-r12, XMM0-5, YMM0-5, and the x87 stack are volatile and should be preserved by the caller if necessary. Everything else is nonvolatile and must be preserved by the callee.
The stack should be aligned on a 16-byte boundary before calling a function.
The stack must have 32 bytes of scratch space for the 4 register parameters before calling a function. Additional parameters are stored below the 32 bytes of scratchspace on the stack.
The caller is responsible for managing the stack.

Here's a really annoying example AA script that will beep every second it's activated:
Code:
*/
[ENABLE]
alloc(newmem,2048,kernel32.dll)
label(shouldExit)
registersymbol(shouldExit)

createthread(newmem)

newmem:
  push rbp
  mov rbp,rsp
  sub rsp,20
  and spl,F0
@@:
  xor ecx,ecx
  call User32.MessageBeep
  mov ecx,#1000
  call kernel32.Sleep
  cmp byte ptr[shouldExit],0
  je @b
// free memory, return
  mov rsp,rbp
  pop rbp
  mov rcx,newmem
  xor rdx,rdx
  mov r8d,8000
  jmp kernel32.VirtualFree
shouldExit:
  db 0

[DISABLE]
shouldExit:
  db 1

unregistersymbol(shouldExit)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>73</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>45</ID>
      <Description>"CreateThread SetWindowText (Win API x86) - and free allocated thread mem"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>alloc(setWindowTextMem,1000)

[ENABLE]
label(set)
label(new)
label(old)
label(fail)
label(failMsg)
label(cleanup)
registerSymbol(set)

setWindowTextMem:
failMsg:
  db 'No window found!',0

new:
  db 'Hello Kitty',0

old:
  db 'Cheat Engine Tutorial v3.3',0

set:
  push old         // lpWindowName
  push 0           // lpClassName (NULL)
  call USER32.FindWindowA
  test eax,eax
  je fail          // if eax = 0 quit now
  // otherwise we got a non-null HWND to the tutorial window
  push new         // lpString
  push eax         // hWnd
  call USER32.SetWindowTextA
  jmp cleanup

fail:
  push 0        // uType MB_OK
  push 0        // lpCaption (NULL, default to "Error")
  push failMsg  // lpText
  push 0        // hWnd (NULL, no owner)
  call USER32.MessageBoxA
cleanup:
  // http://www.cheatengine.org/forum/viewtopic.php?p=5682784&amp;sid=0820319213699ee4b25e403d6f7035a0
  // cleanup and exit
  pop eax                   // pop return address of this thread into eax

  // push arguments (cdecl so reverse order)
  push 8000                 // MEM_RELEASE
  push 0                    // dwSize
  push setWindowTextMem     // lpAddress

  // jmp instead of call so VirtualFree returns to kill this thread gracefully
  push eax                  // push return address of this thread
  jmp kernel32.VirtualFree  // jmp to VirtualFree

createThread(set)
// lua (stdcall): executeCode(set)

[DISABLE]
unregisterSymbol(set)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>225</ID>
      <Description>"executeCode SetWindowText (Win API x86)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
[ENABLE]
function setWindowText(old, new, reverse)
  assert(type(old) == 'string' and type(new) == 'string', 'setWindowText requires two strings!')
  -- x86 code
  local script = [[
    [%s]
    alloc(setWindowTextMem,1000)
    registersymbol(setWindowTextMem)
    label(fail)
    setWindowTextMem:
      mov ebx, [ebp+8] // pointer to args
      push [ebx] // window name
      push 0 // lpClassName
      call FindWindowA
      test eax,eax
      je fail // both findwindow and setwindow ret 0 on fail
      push [ebx+4] // new caption
      push eax // hWnd
      call SetWindowTextA
    fail:
      ret 4 // stdcall so func must pop arg
    [%s]
    unregistersymbol(setWindowTextMem)
    dealloc(setWindowTextMem)
  ]]
  script = script:format('ENABLE','DISABLE')

  local success, di = autoAssemble(script)
  if success then
    -- assuming all these allocs work fine
    local params = allocateMemory(8)
    if false or reverse then old,new = new,old end -- swap names for testing
    local asmname = allocateMemory(#old+1)
    local asmnewname = allocateMemory(#new+1)

    writeString(asmname, old)
    writeString(asmnewname, new)
    writeInteger(params, asmname)
    writeInteger(params+4, asmnewname)

    local res = executeCode('setWindowTextMem', params)

    autoAssemble(script,di)
    deAlloc(asmname)
    deAlloc(asmnewname)
    deAlloc(params)
    if res == 0 then
      return false, 'Failed to find and change caption'
    else
      return true, 'success'
    end
  else
    return false,('Failed to create intermediate function to call win api'):format(success)
  end
end
if syntaxcheck then return end

setWindowText('Cheat Engine Tutorial v3.4', 'Hello Kitty')
[DISABLE]
setWindowText('Cheat Engine Tutorial v3.4', 'Hello Kitty', true)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>226</ID>
      <Description>"sendMessage SetWindowText (WM_SETTEXT)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
-- SetWindowCaption courtesy of panraven http://forum.cheatengine.org/viewtopic.php?p=5707848#5707848
-- discovery thanks to ParkourPenguin in http://forum.cheatengine.org/viewtopic.php?p=5730323#5730323
local function SetWindowCaption(hwnd,caption)
  if hwnd~=0 then
    -- use createMemoryStream to get memory in CE's process space instead of target's (sendMessage is called by CE)
    local lpStr = createMemoryStream()
    -- write new caption (0 terminated) to the memory stream
    lpStr.write(stringToByteTable(tostring(caption)))
    -- 0 terminate, don't concat, causes duplication due to immutable strings (https://www.lua.org/pil/3.4.html)
    lpStr.write(0)

    -- https://msdn.microsoft.com/en-us/library/windows/desktop/ms632644(v=vs.85).aspx
    local WM_SETTEXT = 0xC
    -- https://msdn.microsoft.com/en-us/library/ms912676.aspx
    sendMessage(hwnd,WM_SETTEXT,nil,lpStr.Memory)
    lpStr.Destroy()
   end
end

local name = 'Cheat Engine Tutorial v3.4'
-- create global variable called memoryrecord_globals_ .. memory record id
-- that can store other variables so they are available in both enable and disable
-- but don't risk clobbering values in other scripts
local id = 'memoryrecord_globals_' .. (memrec and memrec.id or 226)
_G[id] = _G[id] or {}
[ENABLE]

if syntaxcheck then return end
local hwnd = findWindow(nil,name)
_G[id].hwnd = hwnd
assert(hwnd ~= 0, 'Failed to get window with caption ' .. name)
SetWindowCaption(hwnd,'hello kitty')
-- note seems to have 254 max, 255 with 0 terminator, tested win 10
-- based on #getWindowCaption(hwnd)

[DISABLE]
if syntaxcheck then return end
if _G[id].hwnd then
  SetWindowCaption(_G[id].hwnd,name)
end
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>227</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>43</ID>
      <Description>"CreateThread step2"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>define(step2Base,5FC5D0)
alloc(set,1000)

[ENABLE]
set:
  mov eax, [step2Base]
  lea eax, [eax+480]
  mov [eax], #1000

  // http://www.cheatengine.org/forum/viewtopic.php?p=5682784&amp;sid=0820319213699ee4b25e403d6f7035a0
  // cleanup and exit
  pop eax                   // pop return address of this thread into eax

  // push arguments (cdecl so reverse order)
  push 8000                 // MEM_RELEASE
  push 0                    // dwSize
  push set                  // lpAddress

  // jmp instead of call so VirtualFree returns to kill this thread gracefully
  push eax                  // push return address of this thread
  jmp kernel32.VirtualFree  // jmp to VirtualFree

createThread(set)

{$lua}
timer = createTimer(nil)
timer.OnTimer = function(theTimer)
  al = getAddressList()
  --script = al.getMemoryRecordByID(43)
  script = al.getMemoryRecordByID(43)
  script.Active = false -- disable this script since it's job is done
  theTimer.destroy() -- free the timer and stop it from running again
end
timer.Interval = 100 -- run 1/10 a second later
{$asm}

[DISABLE]
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>44</ID>
          <Description>"No description"</Description>
          <VariableType>4 Bytes</VariableType>
          <Address>5FC5D0</Address>
          <Offsets>
            <Offset>480</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>201</ID>
          <Description>"No description"</Description>
          <LastState Value="00000064" RealAddress="01822C68"/>
          <ShowAsHex>1</ShowAsHex>
          <VariableType>4 Bytes</VariableType>
          <Address>"Tutorial-i386.exe"+1FD5D0</Address>
          <Offsets>
            <Offset>480</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>37</ID>
      <Description>"CreateThread Readmem Simple"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// http://forum.cheatengine.org/viewtopic.php?t=481033&amp;sid=0279508f988ce601f542401d826a5519

define(fromMem,00400290)
define(toMem,00400290+7)
define(saveMem,00400290+14)
globalalloc(set,1000)

// code cave is read only, oops lol
FULLACCESS(fromMem,18)
[ENABLE]
set:
  push eax
  mov eax, dword ptr [toMem]
  mov dword ptr [saveMem], eax
  mov eax, dword ptr [fromMem]
  mov dword ptr [toMem], eax
  pop eax
  ret

createThread(set)
// lua (stdcall): executeCode(set)

[DISABLE]
alloc(restore,1000)
restore:
  push eax
  mov eax, dword ptr [saveMem]
  mov dword ptr [toMem], eax
  pop eax
  ret

createThread(restore)
// lua (stdcall): executeCode(restore)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>46</ID>
      <Description>"CreateThread Readmem"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>define(fromMem,00400290)
define(toMem,00400290+7)
define(saveMem,00400290+14)
alloc(set,1000)

// code cave is read only, oops lol
FULLACCESS(fromMem,18)
[ENABLE]
set:
  mov eax, dword ptr [toMem]
  mov dword ptr [saveMem], eax
  mov eax, dword ptr [fromMem]
  mov dword ptr [toMem], eax
  // http://www.cheatengine.org/forum/viewtopic.php?p=5682784&amp;sid=0820319213699ee4b25e403d6f7035a0
  // cleanup and exit
  pop eax                   // pop return address of this thread into eax

  // push arguments (cdecl so reverse order)
  push 8000                 // MEM_RELEASE
  push 0                    // dwSize
  push set                  // lpAddress

  // jmp instead of call so VirtualFree returns to kill this thread gracefully
  push eax                  // push return address of this thread
  jmp kernel32.VirtualFree  // jmp to VirtualFree

createThread(set)
// lua (stdcall): executeCode(set)

[DISABLE]
alloc(restore,1000)
restore:
  mov eax, dword ptr [saveMem]
  mov dword ptr [toMem], eax
  // http://www.cheatengine.org/forum/viewtopic.php?p=5682784&amp;sid=0820319213699ee4b25e403d6f7035a0
  // cleanup and exit
  pop eax                   // pop return address of this thread
  push 8000                 // MEM_RELEASE
  push 0                    // dwSize
  push set                  // lpAddress
  push eax                  // push return address of this thread
  jmp kernel32.VirtualFree  // jmp to VirtualFree
  // jmp instead of call so VirtualFree returns to kill this thread gracefully

createThread(restore)
// lua (stdcall): executeCode(restore)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>74</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>49</ID>
      <Description>"Disable Me Empty"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
{$lua}
timer = createTimer()

if memrec then -- memrec add in 6.7
  mr = memrec
else
  al = getAddressList()
  -- ids are found by opening the cheat table in a text editor
  -- or installing the extraMemRecInfo lua extension
  mr = al.getMemoryRecordByID(49)
end

timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  mr.active = false
end
timer.interval = 100 -- 1/10 of a second

[DISABLE]
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>51</ID>
      <Description>"Disable Me From Assembly (step2)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>loadlibrary(luaclient-i386.dll)
luacall(openLuaServer('CELUASERVER'))
// http://forum.cheatengine.org/viewtopic.php?p=5726944#5726944  basic x64 call example
// http://forum.cheatengine.org/viewtopic.php?t=604761           faster call with CELUA_ExecuteFunctionByReference

CELUA_ServerName:
  db 'CELUASERVER',0

globalalloc(luaFunctionCode, 200)
luaFunctionCode:
db 'al = getAddressList() '
db 'mr = al.getMemoryRecordByID(51) '
db 'mr.active = false', 0

[ENABLE]
aobscan(step2HitMeCode, 89 83 ?? ?? ?? ?? 8d 55 ?? e8 ?2 62)
registerSymbol(step2HitMeCode)
globalalloc(step2HitMeNewCode, 0x1B) // globalalloc mem is not dealloced

label(return)

step2HitMeCode:
  jmp step2HitMeNewCode
  nop
return:

step2HitMeNewCode:
  mov [ebx+00000480], #1000 // set step 2 value
  push 0 // unused parameter
  push luaFunctionCode // lua code to run
  call CELUA_ExecuteFunction // run it, make sure it doesn't dealloc mem that's running lol
  jmp return

[DISABLE]
step2HitMeCode:
  mov [ebx+00000480], eax
unregisterSymbol(step2HitMeCode)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>224</ID>
      <Description>"Run lua function with one agument/parameter from AA (step 2)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// http://forum.cheatengine.org/viewtopic.php?p=5726944#5726944  basic x64 call example
// http://forum.cheatengine.org/viewtopic.php?t=604761           faster call with CELUA_ExecuteFunctionByReference

{$lua}
-- could be in global table
function testMe(id)
  print('testMe was called with id ' .. tostring(id) .. '!')
  --[[
  -- registers are not updated unfortunatetly, even with get/set context...
  -- I suppose a breakpoint could be set on the return address and set them there,
  -- a registered symbol would make it easy to find
  debug_getContext() -- update registers for lua
  print(('%x'):format(EBX+0x480))
  print(EAX)
  debug_setContext() -- update registers for asm
  --]]

  -- disable the mem rec, after a delay for the script to finish
  -- or you'll probably crash when you return from the lua function
  -- to the asm code that was deallocated.... lol
  local t = createTimer()
  t.Interval = 300 -- milliseconds 3/10 of a second
  t.OnTimer = function(t)
    local mr = getAddressList().getMemoryRecordByID(id)
    if mr then mr.Active = false end
    t.destroy()
  end
end
{$asm}

loadlibrary(luaclient-i386.dll)
luacall(openLuaServer('CELUASERVER'))


CELUA_ServerName:
  db 'CELUASERVER',0

globalalloc(luaFunctionCode, 200)
luaFunctionCode:
db 'testMe(parameter)',0 // parameter set by CELUA_ExecuteFunction

[ENABLE]
aobscan(step2HitMeCode, 89 83 ?? ?? ?? ?? 8d 55 ?? e8 ?2 62)
alloc(newmem, $1000) // globalalloc mem is not dealloced

label(return)

newmem:
  mov [ebx+00000480], eax // set step 2 value
  push eax // save eax
  // push this scripts id (could be pointer to arguments in memory somewhere)
{$lua}
  return memrec and ('push #' .. memrec.id) or ('push #224') -- pre CE6.7 doesn't have memrec
{$asm}
  push luaFunctionCode // lua code to run
  call CELUA_ExecuteFunction // run it, make sure it doesn't dealloc mem that's running lol
  pop eax
  jmp return

step2HitMeCode:
  jmp newmem
  nop
return:
registerSymbol(step2HitMeCode)

[DISABLE]
step2HitMeCode:
  mov [ebx+00000480], eax
unregisterSymbol(step2HitMeCode)
dealloc(newmem)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>75</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>136</ID>
      <Description>"Lua Auto Write (step 2)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
[ENABLE]
if syntaxcheck then return end

local timer = createTimer()
timer.onTimer = function(timer)
  writeInteger("[Tutorial-i386.exe+1FC5D0]+480", 333)
end

local al = getAddressList()
local mr = al.getMemoryRecordByID(136)
mr.OnDeactivate = function(mr,before,cs)
  -- if about to change state, return true to let it contine and deactivate
  if before then return true end
  -- otherwise state has changed so stop the timer
  timer.destroy()
end

timer.interval = 100 -- 1/10 of a second

[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>137</ID>
      <Description>"Asm Auto Write (step 2)"</Description>
      <Options moHideChildren="1"/>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>globalalloc(code,1000)
[ENABLE]
label(codeDisable)
label(loop)

code:
  //mov eax, [JohnnyMoves+20] // assumes JohnnyMoves is a registered symbol already
  mov eax, 0
  add eax, 170
  //mov [JohnnyMoves], eax
  mov ebx, ["Tutorial-i386.exe"+1FC5D0]
  mov [ebx+480], eax

  cmp byte ptr [codeDisable], 0
  je loop
  ret

loop:
  // wait 100 milliseconds
  push #100 // note: mov into ecx for x64
  call kernel32.sleep // returns only after time requested has elapsed
  jmp code // loop

// byte to set when disabling script to let thread know it should die
codeDisable:
  db 0

// register codeDisable as a symbol so it can be used in DISABLE section
// note 'code' needs to be registered for createThread to work but globalalloc does it for us
registerSymbol(codeDisable)

createThread(code)

[DISABLE]
codeDisable:
  db 1
unregisterSymbol(codeDisable)
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>139</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>159</ID>
      <Description>"lua register symbol after reading memory for value"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// based on https://www.facebook.com/groups/CheatTheGame/permalink/358822604449257/

{$lua}
  if syntaxcheck then return end
[ENABLE]
-- scan for AI AOB
--local strAddrList = AOBScan("44 38 3d * * * * 48 8b b4")
local strAddrList = AOBScan("75 2C 8B 83 68 04 00 00")

-- if there is 1 result set addr
-- otherwise do nothing, could also just use first etc.

if strAddrList ~= nil and strAddrList.Count == 1 then
--get numeric address from string
local addr = getAddress(strAddrList[0])
-- add address/offset at addr+3 to addr and add 7
addr = addr + readInteger(addr + 3) + 7
-- register addr as AiIgnoreFlag, not saved with table
registerSymbol("AiIgnoreFlag",addr, true)
end

-- free the list
if strAddrList ~= nil then strAddrList.destroy() end

[DISABLE]
unregisterSymbol("AiIgnoreFlag")
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>76</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>90</ID>
      <Description>"Compare string manual loop"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
globalalloc(asmMsgBox,1000) // allocs and registers name. Can't be dealloced
label(msgDiff)
label(msgEqual)
label(str1)
label(str2)
label(str3)
label(str4)
label(display)
asmMsgBox:
  // msgbox setup
  push 0        // uType MB_OK
  push 0        // lpCaption (NULL, default to "Error")

  mov esi, str1
  mov edi, str2
  @@: // anonymous loop label
  mov al, [esi]
  cmp al, [edi]
  jne diff
  cmp al, 0 // if at end (were equal so only need 1 check)
  je same
  inc esi
  inc edi
  jmp @b // equal but not end, so jump back to last label to repeat

  same:
    push msgEqual
    jmp display
  diff:
    push msgDiff

display:
  push 0        // hWnd (NULL, no owner)
  call MessageBoxA
  ret
msgDiff:
  db 'They do not match!',0
msgEqual:
  db 'Yay! They matched!',0
str1:
  db 'test me',0
str2:
  db 'test me',0
str3:
  db 'Test me',0
str4:
  db 'ha no.',0

createThread(asmMsgBox)

{$lua}
timer = createTimer()
timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  al = getAddressList()
  mr = al.getMemoryRecordByID(90)
  --mr.active = false
end
timer.interval = 100 -- 1/10 of a second

[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>93</ID>
      <Description>"Compare string manual loop with counter"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
globalalloc(asmMsgBox,1000) // allocs and registers name. Can't be dealloced
label(msgDiff)
label(msgEqual)
label(str1)
label(str2)
label(str3)
label(str4)
label(display)
asmMsgBox:
  // msgbox setup
  push 0        // uType MB_OK
  push 0        // lpCaption (NULL, default to "Error")

  mov esi, str1
  mov edi, str3
  mov edx, 0
  @@: // anonymous loop label
  mov al, [esi+edx]
  cmp al, [edi+edx]
  jne diff
  cmp al, 0 // if at end (were equal so only need 1 check)
  je same
  inc edx
  jmp @b // equal but not end, so jump back to last label to repeat

  same:
    push msgEqual

    jmp display
  diff:
    push msgDiff

display:
  push 0        // hWnd (NULL, no owner)
  call MessageBoxA
  ret
msgDiff:
  db 'They do not match!',0
msgEqual:
  db 'Yay! They matched!',0
str1:
  db 'test me',0
str2:
  db 'test me',0
str3:
  db 'Test me',0
str4:
  db 'ha no.',0

createThread(asmMsgBox)

{$lua}
timer = createTimer()
timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  al = getAddressList()
  mr = al.getMemoryRecordByID(93)
  --mr.active = false
end
timer.interval = 100 -- 1/10 of a second

[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>91</ID>
      <Description>"Compare string - strcmp"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
globalalloc(asmMsgBox,1000) // allocs and registers name. Can't be dealloced
label(msgDiff)
label(msgEqual)
label(str1)
label(str2)
label(str3)
label(str4)
label(display)
asmMsgBox:
  // msgbox setup
  push 0        // uType MB_OK
  push 0        // lpCaption (NULL, default to "Error")

  push str2
  push str3
  call strcmp
  add esp,8 // clean up pushed pointers
  cmp eax, 0
  jne diff // returns 0 when equal

  same:
    push msgEqual
    jmp display
  diff:
    push msgDiff

display:
  push 0        // hWnd (NULL, no owner)
  call MessageBoxA
  ret
msgDiff:
  db 'They do not match!',0
msgEqual:
  db 'Yay! They matched!',0
str1:
  db 'test me',0
str2:
  db 'test me',0
str3:
  db 'Test me',0
str4:
  db 'ha no.',0


createThread(asmMsgBox)

{$lua}
timer = createTimer()
timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  al = getAddressList()
  mr = al.getMemoryRecordByID(91)
  --mr.active = false
end
timer.interval = 100 -- 1/10 of a second
[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>92</ID>
      <Description>"Compare string stricmp (case insensitive)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
globalalloc(asmMsgBox,1000) // allocs and registers name. Can't be dealloced
label(msgDiff)
label(msgEqual)
label(str1)
label(str2)
label(str3)
label(str4)
label(display)
asmMsgBox:
  // msgbox setup
  push 0        // uType MB_OK
  push 0        // lpCaption (NULL, default to "Error")

  push str2
  push str3
  call stricmp // windows-standard, not c-standard (strcasecmp for linux)
  add esp,8 // clean up pushed pointers
  cmp eax, 0
  jne diff // returns 0 when equal

  same:
    push msgEqual
    jmp display
  diff:
    push msgDiff

display:
  push 0        // hWnd (NULL, no owner)
  call MessageBoxA
  ret
msgDiff:
  db 'They do not match!',0
msgEqual:
  db 'Yay! They matched!',0
str1:
  db 'test me',0
str2:
  db 'test me',0
str3:
  db 'Test me',0
str4:
  db 'ha no.',0


createThread(asmMsgBox)

{$lua}
timer = createTimer()
timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  al = getAddressList()
  mr = al.getMemoryRecordByID(92)
  --mr.active = false
end
timer.interval = 100 -- 1/10 of a second
[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>157</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>160</ID>
      <Description>"Bypass Tutorial Steps by Enabling Next Button via win32 api (run as admin)"</Description>
      <Options moHideChildren="1"/>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>161</ID>
          <Description>"https://pastebin.com/Frp0jJJt"</Description>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
        <CheatEntry>
          <ID>162</ID>
          <Description>"https://www.dropbox.com/s/f9226hfohmh1kgx/bypassTutorial.exe?dl=0"</Description>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
        <CheatEntry>
          <ID>163</ID>
          <Description>"Enable Next Button (WIP)"</Description>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>[enable]
{$lua}
if syntaxcheck then return end
pid = allocateSharedMemory("procid", 4)
registerSymbol("procid",pid)
writeInteger(pid, getOpenedProcessID())

asm = "[ENABLE]\n" .. [[
globalalloc(test,$1000)
label(class)
label(nextCaption)
label(testcode)
label(msg)
label(gethwnd)

test:
class:
  db 'Window',0
nextCaption:
  db 'Next',0
msg:
  db 'i: %i',0
  resd 5 // 20 bytes to write into
testcode:
  // align stack
  // ce will automatically use ebp/esp for 32 bit, at least for this lol
  // the opcodes (actual bytes) are probably the same
  push rbp
  mov  rbp, rsp
  and  rsp, -10
  /*
  // get handle from id (set by lua)
  push procid
  push 0
  push 0x001F0FFF // PROCESS_ALL_ACCESS based on google
  call OpenProcess
  */

  push gethwnd
  push procid
  call EnumWindows

  // find child process
  push eax
  push 0
  push 0
  push nextCaption
  call FindWindowExA
  push eax

  // sprintf(buffer, "%i", eax)
  push eax
  push msg
  push msg+6
  call sprintf
  add esp, C // pop arguments

  push 0        // uType MB_OK
  push 0        // lpCaption (NULL, default to "Error")
  push msg+6
  push 0        // hWnd (NULL, no owner)
  call MessageBoxA

  pop eax
  push 1
  push eax
  call EnableWindow

  pop rbp
  ret
gethwnd: // stdcall
  push ebp
  mov ebp,esp
  mov ecx, [ebp+8]
  mov edx, [ebp+c]
  push 0
  push ecx
  call GetWindowThreadProcessId
  xor eax, eax
  cmp eax, edx
  sete al
  pop ebp
  ret 8

registerSymbol(testcode)
createThread(testcode)
]] .. "\n[DISABLE]"

autoAssemble(asm)
[DISABLE]
unregisterSymbol(procid)
</AssemblerScript>
        </CheatEntry>
        <CheatEntry>
          <ID>164</ID>
          <Description>"Enable Next Button (WIP)"</Description>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>[ENABLE]
globalalloc(bypassScript,$1000)
label(findHandle)
label(hwnd)
label(nextCaption)
label(CECaption)
label(stepCaption)
label(findHandleRet)
label(className)
label(onAStep)

bypassScript:
  push ebp
  mov  ebp, esp
  and spl,F0
  push 0
  push findHandle
  call EnumWindows // stdcall

  push nextCaption
  push 0
  push 0
  push [hwnd]
  call FindWindowExA  // stdcall

  push 1
  push eax
  call EnableWindow // stdcall
  mov esp,ebp
  pop ebp
  ret
  db 90 90 90 90 90 90
findHandle: // stdcall
  push ebp
  mov ebp,esp
  sub esp, F0 // stack space for window caption/class

  push F0  // buffer size
  push ebp // buffer addr, I think
  mov ebx, [ebp+C] // hwnd, I think
  push ebx
  call GetWindowTextA // stdcall

  push CECaption
  push ebp // buffer
  call strstr // cdecl
  je @f // 0 if not found, je = jump if not found
  // matched
  mov [hwnd],ebx
  add esp, 8 // clean strstr stack
  xor eax,eax
  jmp findHandleRet

  // no match, check for stepCaption
  @@:
  mov [esp-8], stepCaption
  call strstr // cdecl
  jne @f

  // no match
  add esp, 8 // clean strstr stack
  mov eax,1
  jmp findHandleRet

  @@:  // matched
  add esp, 8 // clean strstr stack
  // double check using classname
  push F0
  push ebp
  push ebx
  call GetClassNameA // stdcall

  push ebp
  push className
  call strcmp // cdecl
  je @f
  // not equal
  add esp,8
  mov eax,1
  jmp findHandleRet

  @@:
  add esp,8 // clean strcmp stack
  mov [hwnd],ebx
  mov byte ptr [onAStep],1
  xor eax,eax
  jmp findHandleRet // unnecessary but.

  findHandleRet:
  add esp,F0
  pop ebp
  return:
  ret 8 // 2 4-byte args in x86, stdcall
hwnd:
  dd 0
onAStep:
  db 0
nextCaption:
  db 'Next',0
CECaption:
  db 'Cheat Engine Tutorial',0
stepCaption:
  db 'Step ',0
className:
  db 'Window',0

createThread(bypassScript)
[DISABLE]
</AssemblerScript>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>199</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>198</ID>
      <Description>"Generate step 2 aob record"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
{$lua}
if syntaxcheck then return end
results = AOBScan("29 D0 89 83 80 04 00 00")
if not results then
  error("failed to find aob")
end

al = getAddressList()
for i=0, results.Count-1 do
  -- AA script didn't like parsing [ENABLE] and [DISABLE] so... format to the rescue lol
  local script = [[
  // nop step 2 sub instruction
  [%s]
  define(INJECT, %s)
  INJECT:
    db 90 90
  registersymbol(INJECT)
  [%s]
  INJECT:
    db 29 D0
  unregistersymbol(INJECT)
  ]]
  script = string.format(script, "ENABLE", results[i], "DISABLE")

  mr = al.createMemoryRecord()
  mr.Type = vtAutoAssembler
  mr.Script = script
  mr.Description = "Autogenerated aob script"
  mr.DontSave = true
  if memrec then -- if in CE 6.7 then nest generated scripts
    mr.appendToEntry(memrec)
  end
end
results.destroy()

-- auto disable this script if in CE 6.7+
if memrec then
  local timer = createTimer()
  timer.Interval = 100
  timer.OnTimer = function(timer)
    memrec.Active = false
    timer.destroy()
  end
end

[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>177</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>202</ID>
      <Description>"Lua address in AA"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
function calcAddr()
  return readPointer('Tutorial-i386.exe+1FD5D0')+0x400+math.pow(2,7)
end
{$asm}

[ENABLE]
$calcAddr():
{$lua}
return "dd " .. math.random(-80,80)

[DISABLE]
$getAddress('[Tutorial-i386.exe+1FD5D0]')+0x400+math.pow(2,7):
  dd #100
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>204</ID>
          <Description>"Step 2"</Description>
          <LastState Value="100" RealAddress="01822C68"/>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>[Tutorial-i386.exe+1FD5D0]+480</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>203</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>212</ID>
      <Description>"x86 compare signed qwords"</Description>
      <Options moHideChildren="1"/>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// x86 signed qword compare
// https://stackoverflow.com/questions/12944690/working-with-qwords
// http://forum.cheatengine.org/viewtopic.php?p=5730174#5730174

globalalloc(test,1024)
[ENABLE]
label(data)
label(strings)
label(equal)
label(greater)
label(less)
label(docall)

test:
  // load first vlaue
  mov eax, [data+4]
  mov edx, [data]
  // add second
  sub edx, [data+8]
  sbb eax, [data+C]
  // save result
  mov [data+10], edx
  mov [data+14], eax
  // check
  mov ecx, edx
  or ecx, eax
  cmovz ecx, [strings+0] //equal
  je docall
  // if positive A greater
  // positive if edx &amp;lt; 0x80000000
  cmp eax,80000000
  cmovb ecx, [strings+4] // positive, greater
  cmovnb ecx, [strings+8] //negative, less
docall:
  push 0 // uType OK
  push 0 // caption
  push ecx // text
  push 0 // hwnd
  call MessageBoxA
  ret
data:
  dq #55
  dq #635
  dq 1
equal:
  db 'They are eq',0
greater:
  db 'First is gtr, pos',0
less:
  db 'First is les, neg',0
strings:
  dd equal
  dd greater
  dd less

registerSymbol(data)

createThread(test)
[DISABLE]
unregisterSymbol(data)
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>213</ID>
          <Description>"qword 1"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>8 Bytes</VariableType>
          <Address>data</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>214</ID>
          <Description>"qword 2"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>8 Bytes</VariableType>
          <Address>data+8</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>215</ID>
          <Description>"res"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>8 Bytes</VariableType>
          <Address>data+10</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>217</ID>
      <Description>"compare doubles using fpu"</Description>
      <Options moHideChildren="1"/>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// fpu double compare
// http://forum.cheatengine.org/viewtopic.php?p=5730174#5730174

globalalloc(test,1024)
[ENABLE]
label(data)
label(strings)
label(equal)
label(greater)
label(less)
label(docall)

test:
  // load second value so that first is in ST(0)
  fld qword ptr [data+8]
  // load first into ST(0)
  fld qword ptr [data]
  // check
  fucomip st(1)
  cmovz ecx, [strings+0] //equal
  je docall
  cmova ecx, [strings+4] // positive, greater
  cmovna ecx, [strings+8] //negative, less
docall:
  push 0 // uType OK
  push 0 // caption
  push ecx // text
  push 0 // hwnd
  call MessageBoxA
  ret
data:
  dq (double)-55
  dq (double)-353
equal:
  db 'They are eq',0
greater:
  db 'First is gtr',0
less:
  db 'First is les',0
strings:
  dd equal
  dd greater
  dd less

registerSymbol(data)

createThread(test)
[DISABLE]
unregisterSymbol(data)
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>218</ID>
          <Description>"No description"</Description>
          <VariableType>Double</VariableType>
          <Address>data</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>220</ID>
          <Description>"No description"</Description>
          <VariableType>Double</VariableType>
          <Address>data+8</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>221</ID>
      <Description>"compare doubles using sse"</Description>
      <Options moHideChildren="1"/>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>// fpu double compare
// https://docs.oracle.com/cd/E18752_01/html/817-5477/epmpv.html
// http://forum.cheatengine.org/viewtopic.php?p=5730174#5730174

globalalloc(test,1024)
[ENABLE]
label(data)
label(strings)
label(equal)
label(greater)
label(less)
label(docall)

test:
  // load first value
  movsd xmm0, [data]
  // load second value
  movsd xmm1, [data+8]
  // check
  ucomisd xmm0, xmm1
  cmovz ecx, [strings+0] //equal
  je docall
  cmova ecx, [strings+4] // positive, greater
  cmovna ecx, [strings+8] //negative, less
docall:
  push 0 // uType OK
  push 0 // caption
  push ecx // text
  push 0 // hwnd
  call MessageBoxA
  ret
data:
  dq (double)55
  dq (double)53
equal:
  db 'They are eq',0
greater:
  db 'First is gtr',0
less:
  db 'First is les',0
strings:
  dd equal
  dd greater
  dd less

registerSymbol(data)

createThread(test)
[DISABLE]
unregisterSymbol(data)
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>222</ID>
          <Description>"No description"</Description>
          <VariableType>Double</VariableType>
          <Address>data</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>223</ID>
          <Description>"No description"</Description>
          <VariableType>Double</VariableType>
          <Address>data+8</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>216</ID>
      <Description>"---------------------------------- Technical Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>178</ID>
      <Description>"DE AD C0 DE 15 DE AD"</Description>
      <Options moHideChildren="1"/>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>176</ID>
          <Description>"https://www.facebook.com/Sn34kyMofo/posts/1885553898368803"</Description>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
        <CheatEntry>
          <ID>0</ID>
          <Description>"Script"</Description>
          <Options moHideChildren="1"/>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
define(cave,00400290)
fullaccess(cave,100)

label(aFloat)
cave:
  push ebp

  // setup to prevent crash
  fld [aFloat]
  // set ebp to 21EA2140+400292 (cave+2) = 222A23D2
  // aka hex 40 02 AB 05 (backwards in mem viewer) = 1073921541
  mov ebp, 21EA2140
  add ebp, aFloat+4
  mov esi, cave
  // B5 05 D9 55 (backwards in mem viwer, push ebp + part of fld bytes)

  // code
  // fisubr [ebp-21EA2140] // DE AD C0 DE 15 DE
  // lodsd // Load doubleword at address DS:(E)SI into EAX
  db DE AD C0 DE 15 DE AD

  // store results for viewing
  fstp [aFloat+8] // store resulting float in reserved space
  mov [aFloat+C], eax // store loaded "string" value(s) in reserved space

  pop ebp
  ret

aFloat:
  dd (float)32767
  dd #32768
// reserve space for 2 dwords
  resd 2

registerSymbol(aFloat)
createThread(cave)
 
[DISABLE]
unregisterSymbol(aFloat)
//code from here till the end of the code will be used to disable the cheat

</AssemblerScript>
          <CheatEntries>
            <CheatEntry>
              <ID>172</ID>
              <Description>"Int"</Description>
              <VariableType>4 Bytes</VariableType>
              <Address>aFloat+4</Address>
            </CheatEntry>
            <CheatEntry>
              <ID>175</ID>
              <Description>"Int as signed 2 byte int"</Description>
              <ShowAsSigned>1</ShowAsSigned>
              <VariableType>2 Bytes</VariableType>
              <Address>aFloat+4</Address>
            </CheatEntry>
            <CheatEntry>
              <ID>171</ID>
              <Description>"Float"</Description>
              <VariableType>Float</VariableType>
              <Address>aFloat</Address>
            </CheatEntry>
            <CheatEntry>
              <ID>173</ID>
              <Description>"signed 2 byte int - float ="</Description>
              <VariableType>Float</VariableType>
              <Address>aFloat+8</Address>
            </CheatEntry>
            <CheatEntry>
              <ID>174</ID>
              <Description>"lodsd = push ebp + part of fld [aFloat]"</Description>
              <ShowAsHex>1</ShowAsHex>
              <ShowAsSigned>1</ShowAsSigned>
              <VariableType>4 Bytes</VariableType>
              <Address>aFloat+C</Address>
            </CheatEntry>
          </CheatEntries>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>106</ID>
      <Description>"---------------------------------- Useful Technique Examples ----------------------------------"</Description>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>105</ID>
      <Description>"Assembly Code Search by ForgeByGames"</Description>
      <Options moHideChildren="1"/>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>107</ID>
          <Description>"https://www.youtube.com/watch?v=f2D-giMv1Mo"</Description>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>118</ID>
      <Description>"Duplicating Scan Tabs by FreeER (me)"</Description>
      <Options moHideChildren="1"/>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>119</ID>
          <Description>"https://www.youtube.com/watch?v=cSQlM1nYX7w"</Description>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
        <CheatEntry>
          <ID>120</ID>
          <Description>"Windows program to mostly do it for you:"</Description>
          <Options moHideChildren="1"/>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
          <CheatEntries>
            <CheatEntry>
              <ID>121</ID>
              <Description>"https://www.dropbox.com/s/ol9qpmuz3mi9cne/CEDupScanTab.exe?dl=0"</Description>
              <LastState Value="" RealAddress="00000000"/>
              <GroupHeader>1</GroupHeader>
            </CheatEntry>
            <CheatEntry>
              <ID>122</ID>
              <Description>"Source (if you can improve this or create a CE plugin that'd be awesome)"</Description>
              <Options moHideChildren="1"/>
              <LastState Value="" RealAddress="00000000"/>
              <GroupHeader>1</GroupHeader>
              <CheatEntries>
                <CheatEntry>
                  <ID>123</ID>
                  <Description>"https://www.dropbox.com/s/pvcjsqaas9wxo5q/CEDupScanTab.cpp?dl=0"</Description>
                  <LastState Value="" RealAddress="00000000"/>
                  <GroupHeader>1</GroupHeader>
                </CheatEntry>
              </CheatEntries>
            </CheatEntry>
          </CheatEntries>
        </CheatEntry>
        <CheatEntry>
          <ID>124</ID>
          <Description>"See Table-&gt;SaveCurScanForm and Table-&gt;DupScanForm"</Description>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
        <CheatEntry>
          <ID>125</ID>
          <Description>"Display form to save current scan"</Description>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>{$lua}
[ENABLE]

function SaveCurScan(sender)
  local scan = getCurrentMemscan()
  scan.saveCurrentResults(SaveCurScanForm.CEEdit1.Text)
  shellExecute(scan.ScanResultFolder) -- ScanResultFolder existence found on forums
  --saveCurrentResults saves two files in %temp%\Cheat Engine\&lt;UID for scan&gt;
  --named ADDRESSES.&lt;given name&gt; and MEMORY.&lt;given name&gt;
  --so if you set the edit box to "Test" for example you'll find two files named
  --ADDRESSES.Test and MEMORY.Test
  --You can then switch tabs (so CE unlocks the file) and replace the
  -- .TMP files with the .Test files or create a new scan tab and do the same

  -- Since it's used as part of a filename there may be some limitations
  -- like colons :

  -- note that beyond duplicating you can compare to these scans using the
  -- "compare to first scan" option
end

function SaveCurScanFormCloseClick()
  SaveCurScanForm.hide()
end

if syntaxcheck then return end

SaveCurScanForm.show()

timer = createTimer()
timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  al = getAddressList()
  -- using desc rather than id because I expect it to be copy/pasted
  mr = al.getMemoryRecordByDescription("Display form to save current scan")
  mr.active = false
end
timer.interval = 100 -- 1/10 of a second

[DISABLE]
</AssemblerScript>
        </CheatEntry>
        <CheatEntry>
          <ID>126</ID>
          <Description>"Display form to duplicate scan"</Description>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>{$lua}
[ENABLE]
state = 0
scan = nil
path = nil
name = nil
dupscan = nil
duppath = nil

function DupScanFormCloseClick()
  DupScanForm.hide()
end

function CEButton1Click(sender)
  if state == 0 then
    scan = getCurrentMemscan()
    path = scan.scanResultFolder
    name = DupScanForm.CEEdit1.Text
    DupScanForm.CELabel1.Caption = "Switch to a scan tab to overwrite"
    DupScanForm.CEButton1.Caption = "Next"
    state = 1
  elseif state == 1 then
    dupscan = getCurrentMemscan()
    duppath = dupscan.scanResultFolder
    state = 2
    DupScanForm.CELabel1.Caption = "Switch to another tab (to let CE Unlock files)"
    DupScanForm.CEButton1.Caption = "Finish"
  elseif state == 2 then
    print(path)
    print(duppath)

    -- replace dupscan data (delete and copy)
    os.execute("del \"" .. duppath .. "*\" /Q") -- not sure why shellExecute did not work...
    os.execute("copy \"" .. path .. "*\" \"" .. duppath .. "\"")

    if DupScanForm.CECheckbox1.Checked then
      scan.saveCurrentResults(name)
    end

    -- reset state
    state = 0
    DupScanForm.CELabel1.Caption = "Select the scan tab to duplicate and enter name below"
    DupScanForm.CEButton1.Caption = "Start"
  else
    print("Unknown state " .. state)
    state = 0
  end
end

if syntaxcheck then return end

DupScanForm.show()

timer = createTimer()
timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  al = getAddressList()
  -- using desc rather than id because I expect it to be copy/pasted
  mr = al.getMemoryRecordByDescription("Display form to duplicate scan")
  mr.active = false
end
timer.interval = 100 -- 1/10 of a second
[DISABLE]

</AssemblerScript>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>133</ID>
      <Description>"Reverse bits for binary scan by panraven"</Description>
      <Options moHideChildren="1"/>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>134</ID>
          <Description>"http://forum.cheatengine.org/viewtopic.php?p=5721688#5721688"</Description>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
        <CheatEntry>
          <ID>132</ID>
          <Description>"panraven - Reverse bits for binary scan"</Description>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>{$lua}
-- credit to panraven http://forum.cheatengine.org/viewtopic.php?p=5721688#5721688
function bitReverse(bp)
  if type(bp)=='string' and bp:len()&gt;0 and not bp:find"[^01]" then
    -- bit pattern in string, leading and trailing zeros is significant
    return bp:reverse()
  elseif type(bp)~='number' then -- error! but...
    return "**can't convert "..tostring(bp)
  else -- beware negative,
    local sum = 0
    while bp~=0 do
      sum,bp = sum*2 + (bAnd(bp,1)~=0 and 1 or 0), bShr(bp,1)
    end
    return sum
  end
end

if syntaxcheck then return end

local mf = GetMainForm()

local isBinary = mf.VarType.ItemIndex&gt;=0 and
  mf.VarType.Items[mf.VarType.ItemIndex]=='Binary'

if not isBinary then showMessage"Not Binary scan type." end

local isBits = mf.rbBit.Checked or not mf.rbDec.Checked

local input = inputQuery(isBits and "B I T S" or "D E C I M A L",
  isBits and "Enter only 0/1 digits" or "enter a decimal Number or prefix '0x' for hex",
  '&lt;value&gt;')

local output = input and input:sub(1,1)=='*' and input or
  bitReverse(isBits and input or tonumber(input))

if output then mf.scanvalue.Text = output end

[ENABLE]
[DISABLE]
-- auto disable added by FreeER
timer = createTimer()
timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  al = getAddressList()
  -- using desc rather than id because I expect it to be copy/pasted
  mr = al.getMemoryRecordByDescription("panraven - Reverse bits for binary scan")
  --mr.active = false
end
timer.interval = 100 -- 1/10 of a second
</AssemblerScript>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>165</ID>
      <Description>"Wide String by panraven"</Description>
      <Options moHideChildren="1"/>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>166</ID>
          <Description>"http://forum.cheatengine.org/viewtopic.php?p=5723462#5723462"</Description>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
        <CheatEntry>
          <ID>167</ID>
          <Description>"panraven declare widestring"</Description>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>// code courtesy of panraven on CE forums, comments by FreeER (Cheat The Game Facebook group)
// http://forum.cheatengine.org/viewtopic.php?p=5723462#5723462
define(cave,"Tutorial-i386.exe"+290)
FULLACCESS(cave, 20) // cave is read-only...
// but scanning causes OS crash on close so haven't bothered to find a new one
[ENABLE]
{$lua}
-- custom function making use of CE functions to create byte string for db
-- prefixSize for things like mono
function wideStr2Aob(s, zeroTerminate, prefixSize)
  -- assert (lua) issues an error when the first arg is "false" (nil or false)
  -- othrwise returns all it's arguments, second, opitional arg is error message
  -- which defaults to "assertion failed!" if not given

  -- wideStringToByteTable (CE) Converts string to widestring and then bytetable
  local b = assert(wideStringToByteTable(s),"Can't convert WideStr2Aob")

  if prefixSize then
    -- sz = number of characters (2 bytes per character, thus /2)
    local sz = math.floor(#b/2)

    -- string.pack returns a binary string according to format
    -- &gt;I4 specifies using big endian (&gt;), with unsigned ints (I) of 4 bytes (4)
    -- gmatch returns an iterator (to "iterate" aka loop over), . matches any/every character

    -- so for each binary value in the byte table, which is sz converted to bytes
    -- insert it at the start of the table, this also reverses the order leaving
    -- it as little endian, hence the reason for using big endian (&gt;) in format
    --[[
    ]]
    for c in string.pack("&gt;I4",sz):gmatch"." do
      table.insert(b,1,c:byte())
    end

    --[[ more typical/obvious method (dwordToByteTable is a CE function however)
    -- note pairs does not have a defined order,
    -- ipairs does but only works for numeric/array indexes/indices
    for k,v in ipairs(dwordToByteTable(sz)) do
      table.insert(b,k,v)
    end
    ]]
  end

  -- append 2 0 bytes if asked for
  if zeroTerminate then b[#b+1],b[#b+2] = 0,0 end

  -- return a string comprised of converting each byte to hex
  -- using gsub to run the conversion on each byte
  -- the :sub(2) eliminates the ' ' from the start of the string
  return byteTableToString(b):gsub(".",
    function(c)return string.format(" %02X",c:byte())end):sub(2)
end
{$asm}

cave:
{$lua}
-- any returned string will be treated as code in the script
-- original example
return "db " .. wideStr2Aob([[Дракон]],true,true) -- Russian 'dragon'
--return "db " .. wideStr2Aob([[Дракон]],true) -- Russian 'dragon', no prefix
--return "db " .. wideStr2Aob([[russian]],true, false) -- 'russian', no prefix
{$asm}
[DISABLE]
cave:
{$lua}
-- another example, use lua to write db followed by 20 0 bytes.
return "db " .. ("00 "):rep(20)
{$asm}
</AssemblerScript>
        </CheatEntry>
        <CheatEntry>
          <ID>168</ID>
          <Description>"String (prefixed length)"</Description>
          <LastState RealAddress="00400294"/>
          <VariableType>String</VariableType>
          <Length>6</Length>
          <Unicode>1</Unicode>
          <CodePage>0</CodePage>
          <ZeroTerminate>1</ZeroTerminate>
          <Address>"Tutorial-i386.exe"+290+4</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>169</ID>
          <Description>"String (prefixed) length"</Description>
          <LastState Value="0" RealAddress="00400290"/>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>"Tutorial-i386.exe"+290</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>190</ID>
      <Description>"Set Flags"</Description>
      <Options moHideChildren="1"/>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>191</ID>
          <Description>"http://forum.cheatengine.org/viewtopic.php?p=5724635#5724635"</Description>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
        <CheatEntry>
          <ID>179</ID>
          <Description>"Set flags via form by FreeER (me)"</Description>
          <Options moHideChildren="1"/>
          <LastState/>
          <VariableType>Auto Assembler Script</VariableType>
          <AssemblerScript>[ENABLE]
{$lua}
values = {
  [0]={caption="Open", name="Open", value=0x01},
  [1]={caption="Same", name="Same", value=0x02},
  [2]={caption="Plus", name="Plus", value=0x04},
  [3]={caption="Random", name="Random", value=0x08},
  [4]={caption="SuddenDeath", name="SuddenDeath", value=0x10},
  [5]={caption="Retry", name="Retry", value=0x20},
  [6]={caption="SameWall", name="SameWall", value=0x40},
  [7]={caption="Elemental", name="Elemental", value=0x80},
}

flagsAddress = "[Tutorial-i386.exe+1FC5D0]+480"

isSet = function(index)
  return bAnd(readInteger(flagsAddress), values[index].value)~=0
end

updateComboCheckbox = function(set)
  FlagsForm.CECheckbox9.Checked = set
  FlagsForm.CECheckbox9.Caption = set and 'Enabled' or 'Disabled'
end

function FlagsFormActivate(sender)
  for k,v in pairs(values) do
    set = isSet(k)
    FlagsForm[v.name].Checked = set
    if k == FlagsForm.CEComboBox1.ItemIndex then updateComboCheckbox(set) end
  end
end

doSet = function(index, onoff)
  currentValue = readInteger(flagsAddress)
  indexValue = values[index].value
  value = onoff and bOr(currentValue,indexValue) or bAnd(currentValue,bNot(indexValue))
  writeInteger(flagsAddress, value)
end

function CEComboBox1Change(sender)
  updateComboCheckbox(isSet(sender.ItemIndex))
end

function CECheckbox9Change(sender)
  sender.Caption = sender.Checked and 'Enabled' or 'Disabled'
  index = FlagsForm.CEComboBox1.ItemIndex
  name = values[index].name
  if FlagsForm[name] then
    FlagsForm[name].Checked = sender.Checked
  else
    print("um.. how'd that happen?")
  end
  doSet(index, sender.Checked)
end

function GenericChecked(sender)
  name = sender.Name
  -- probably a better way but...
  index = 0
  for k,v in pairs(values) do
    if v.name == name then
      index = k
      break
    end
  end

  set = sender.Checked
  doSet(index, set)
  if FlagsForm.CEComboBox1.ItemIndex == index then
    updateComboCheckbox(set)
  end

end

FlagsForm.show()

[DISABLE]
</AssemblerScript>
          <CheatEntries>
            <CheatEntry>
              <ID>180</ID>
              <Description>"Step 2"</Description>
              <VariableType>4 Bytes</VariableType>
              <Address>"Tutorial-i386.exe"+1FC5D0</Address>
              <Offsets>
                <Offset>480</Offset>
              </Offsets>
            </CheatEntry>
          </CheatEntries>
        </CheatEntry>
        <CheatEntry>
          <ID>192</ID>
          <Description>"Binary Type - DarkByte Suggestions"</Description>
          <Options moHideChildren="1"/>
          <LastState Value="" RealAddress="00000000"/>
          <GroupHeader>1</GroupHeader>
          <CheatEntries>
            <CheatEntry>
              <ID>189</ID>
              <Description>"Open"</Description>
              <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Off
1:On
</DropDownList>
              <VariableType>Binary</VariableType>
              <BitStart>0</BitStart>
              <BitLength>1</BitLength>
              <ShowAsBinary>0</ShowAsBinary>
              <Address>"Tutorial-i386.exe"+1FC5D0</Address>
              <Offsets>
                <Offset>480</Offset>
              </Offsets>
            </CheatEntry>
            <CheatEntry>
              <ID>187</ID>
              <Description>"Plus"</Description>
              <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Off
1:On
</DropDownList>
              <VariableType>Binary</VariableType>
              <BitStart>2</BitStart>
              <BitLength>1</BitLength>
              <ShowAsBinary>0</ShowAsBinary>
              <Address>"Tutorial-i386.exe"+1FC5D0</Address>
              <Offsets>
                <Offset>480</Offset>
              </Offsets>
            </CheatEntry>
            <CheatEntry>
              <ID>188</ID>
              <Description>"Same"</Description>
              <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Off
1:On
</DropDownList>
              <VariableType>Binary</VariableType>
              <BitStart>1</BitStart>
              <BitLength>1</BitLength>
              <ShowAsBinary>0</ShowAsBinary>
              <Address>"Tutorial-i386.exe"+1FC5D0</Address>
              <Offsets>
                <Offset>480</Offset>
              </Offsets>
            </CheatEntry>
            <CheatEntry>
              <ID>186</ID>
              <Description>"Random"</Description>
              <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Off
1:On
</DropDownList>
              <VariableType>Binary</VariableType>
              <BitStart>3</BitStart>
              <BitLength>1</BitLength>
              <ShowAsBinary>0</ShowAsBinary>
              <Address>"Tutorial-i386.exe"+1FC5D0</Address>
              <Offsets>
                <Offset>480</Offset>
              </Offsets>
            </CheatEntry>
            <CheatEntry>
              <ID>185</ID>
              <Description>"Sudden Death"</Description>
              <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Off
1:On
</DropDownList>
              <VariableType>Binary</VariableType>
              <BitStart>4</BitStart>
              <BitLength>1</BitLength>
              <ShowAsBinary>0</ShowAsBinary>
              <Address>"Tutorial-i386.exe"+1FC5D0</Address>
              <Offsets>
                <Offset>480</Offset>
              </Offsets>
            </CheatEntry>
            <CheatEntry>
              <ID>184</ID>
              <Description>"Retry"</Description>
              <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Off
1:On
</DropDownList>
              <VariableType>Binary</VariableType>
              <BitStart>5</BitStart>
              <BitLength>1</BitLength>
              <ShowAsBinary>0</ShowAsBinary>
              <Address>"Tutorial-i386.exe"+1FC5D0</Address>
              <Offsets>
                <Offset>480</Offset>
              </Offsets>
            </CheatEntry>
            <CheatEntry>
              <ID>183</ID>
              <Description>"Same Wall"</Description>
              <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Off
1:On
</DropDownList>
              <VariableType>Binary</VariableType>
              <BitStart>6</BitStart>
              <BitLength>1</BitLength>
              <ShowAsBinary>0</ShowAsBinary>
              <Address>"Tutorial-i386.exe"+1FC5D0</Address>
              <Offsets>
                <Offset>480</Offset>
              </Offsets>
            </CheatEntry>
            <CheatEntry>
              <ID>182</ID>
              <Description>"Elemental"</Description>
              <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Off
1:On
</DropDownList>
              <VariableType>Binary</VariableType>
              <BitStart>7</BitStart>
              <BitLength>1</BitLength>
              <ShowAsBinary>0</ShowAsBinary>
              <Address>"Tutorial-i386.exe"+1FC5D0</Address>
              <Offsets>
                <Offset>480</Offset>
              </Offsets>
            </CheatEntry>
          </CheatEntries>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>193</ID>
      <Description>"Count instructions - By FreeER (me)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
[ENABLE]
thestart = 0x0054D910
theend = thestart+0x100 -- not included in count
count = 0
current = thestart
if syntaxcheck then return end
repeat
  count = count + 1
  size = getInstructionSize(current)
  --print(disassemble(current)) -- show each instruction
  current = current + size
until current &gt;= theend
-- use getAddress incase a symbol was used, so that the actual address is shown
print(string.format("There are %i instructions from %#X to %#X", count, getAddress(thestart), getAddress(theend)))
 

-- auto disable
timer = createTimer()
timer.onTimer = function()
  timer.destroy() -- destroy the timer so this code isn't run again
  getAddressList().getMemoryRecordByID(193).active = false
end
timer.interval = 100 -- 1/10 of a second
[DISABLE]

</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>195</ID>
      <Description>"Hold key to set value, reset on release - By FreeER (me)"</Description>
      <Options moHideChildren="1"/>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
[ENABLE]
-- code to find the hotkeys
al = getAddressList()
mr = al.getMemoryRecordByID(194)
-- get hotkeys, I think based on position in list aka index not ID...
hk = mr.Hotkey[0]
-- reset the keys to be 1 for the first hotkey (the other never has any set)
hk.Keys = {VK_1}

-- set a function to run the second hotkey after the first has run
-- and the first key has been released
hk.onPostHotKey = function(sender)
  timer = createTimer()
  timer.Interval = 100
  timer.OnTimer = function(timer)
    if not isKeyPressed(hk.keys[1]) then
      sender.Owner.Hotkey[1].doHotkey()
      timer.destroy()
    end
  end
end

[DISABLE]
-- remove the function and remove the keys from the first hotkey
-- to prevent it accidentally being triggered when not wanted
hk.onPostHotKey = nil
hk.Keys = {}
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>194</ID>
          <Description>"Step 2"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>"Tutorial-i386.exe"+1FC5D0</Address>
          <Offsets>
            <Offset>480</Offset>
          </Offsets>
          <Hotkeys>
            <Hotkey>
              <Action>Set Value</Action>
              <Keys/>
              <Value>15</Value>
              <ID>0</ID>
            </Hotkey>
            <Hotkey>
              <Action>Set Value</Action>
              <Keys/>
              <Value>-40</Value>
              <ID>1</ID>
            </Hotkey>
          </Hotkeys>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>1</ID>
      <Description>"memrec example - By FreeER (me)"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{$lua}
memrecInfo = "in %s memrec is %s\r\nmemrec.id = %s\r\nmemrec.description = %s"
[ENABLE]
if syntaxcheck then print("Enable during syntax check:\r\n") end
if memrec then
  print(memrecInfo:format("enable", memrec, memrec.id, memrec.description))
elseif getCEVersion() &lt; 6.7 then
  print("memrec only exists post 6.7!\r\nYou'll need to use one of the getAddressList().getMemoryRecord* functions :(")
else
  print("Initial syntaxcheck when adding to table or you just clicked execute so no memory record exists yet!")
end
print("\r\n\r\n")


[DISABLE]
if syntaxcheck then print("Disable during syntax check:\r\n") end
if memrec then
  print(memrecInfo:format("disable", memrec, memrec.id, memrec.description))
elseif getCEVersion() &lt; 6.7 then
  print("memrec only exists post 6.7!\r\nYou'll need to use one of the getAddressList().getMemoryRecord* functions :(")
else
  print("Initial syntaxcheck when adding to table or you just clicked execute so no memory record exists yet!")
end
print("\r\n\r\n")
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>146</ID>
      <Description>"---------------------------------- AOB Examples (Tutorial-i386 v3.3) ----------------------------------"</Description>
      <Options moHideChildren="1"/>
      <LastState Value="" RealAddress="00000000"/>
      <GroupHeader>1</GroupHeader>
      <CheatEntries>
        <CheatEntry>
          <ID>140</ID>
          <Description>"b9 ?-* K?,Z? ba *?,*,?,* b8 z h k _ E8 &amp;-(,)-# E8 !!-@@-#,$"</Description>
          <LastState Value="75 6B 8B 55 B4 8D 42 18 BA 3C A3 5F 00 E8 A7 B2 EB FF 8D 45 C0 50 8D 4D C4" RealAddress="0054D917"/>
          <ShowAsHex>1</ShowAsHex>
          <VariableType>Array of byte</VariableType>
          <ByteLength>25</ByteLength>
          <Address>"Tutorial-i386.exe"+14D917</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>141</ID>
          <Description>"B9 * * * * BA * * * * B8 * * * * E8 * * * * E8 * * * *"</Description>
          <LastState Value="75 6B 8B 55 B4 8D 42 18 BA 3C A3 5F 00 E8 A7 B2 EB FF 8D 45 C0 50 8D 4D C4" RealAddress="0054D917"/>
          <ShowAsHex>1</ShowAsHex>
          <VariableType>Array of byte</VariableType>
          <ByteLength>25</ByteLength>
          <Address>"Tutorial-i386.exe"+14D917</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>142</ID>
          <Description>"B9 ?? ?? ?? ?? BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??"</Description>
          <LastState Value="75 6B 8B 55 B4 8D 42 18 BA 3C A3 5F 00 E8 A7 B2 EB FF 8D 45 C0 50 8D 4D C4" RealAddress="0054D917"/>
          <ShowAsHex>1</ShowAsHex>
          <VariableType>Array of byte</VariableType>
          <ByteLength>25</ByteLength>
          <Address>"Tutorial-i386.exe"+14D917</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>143</ID>
          <Description>"B9 googling BA Horowitz B8 insultin E8 humuns__ E8 knowhows"</Description>
          <LastState Value="75 6B 8B 55 B4 8D 42 18 BA 3C A3 5F 00 E8 A7 B2 EB FF 8D 45 C0 50 8D 4D C4" RealAddress="0054D917"/>
          <ShowAsHex>1</ShowAsHex>
          <VariableType>Array of byte</VariableType>
          <ByteLength>25</ByteLength>
          <Address>"Tutorial-i386.exe"+14D917</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>144</ID>
          <Description>"B9 * * * * BA * * * * B8 * * * * E8 * * * * E8"</Description>
          <LastState Value="75 6B 8B 55 B4 8D 42 18 BA 3C A3 5F 00 E8 A7 B2 EB FF 8D 45 C0" RealAddress="0054D917"/>
          <ShowAsHex>1</ShowAsHex>
          <VariableType>Array of byte</VariableType>
          <ByteLength>21</ByteLength>
          <Address>"Tutorial-i386.exe"+14D917</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>145</ID>
          <Description>"* * * * B9 * * * * BA * * * * B8 * * * * E8 * * * * E8"</Description>
          <LastState Value="EB FF 85 C0 75 6B 8B 55 B4 8D 42 18 BA 3C A3 5F 00 E8 A7 B2 EB FF 8D 45 C0" RealAddress="0054D913"/>
          <ShowAsHex>1</ShowAsHex>
          <VariableType>Array of byte</VariableType>
          <ByteLength>25</ByteLength>
          <Address>"Tutorial-i386.exe"+14D913</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
  </CheatEntries>
  <CheatCodes>
    <CodeEntry>
      <Description>Step 9 - Losing message call</Description>
      <Address>004267E7</Address>
      <ModuleName>Tutorial-i386.exe</ModuleName>
      <ModuleNameOffset>267E7</ModuleNameOffset>
      <Before>
        <Byte>A1</Byte>
        <Byte>F4</Byte>
        <Byte>F4</Byte>
        <Byte>54</Byte>
        <Byte>00</Byte>
      </Before>
      <Actual>
        <Byte>E8</Byte>
        <Byte>04</Byte>
        <Byte>FB</Byte>
        <Byte>0E</Byte>
        <Byte>00</Byte>
      </Actual>
      <After>
        <Byte>8B</Byte>
        <Byte>83</Byte>
        <Byte>88</Byte>
        <Byte>04</Byte>
        <Byte>00</Byte>
      </After>
    </CodeEntry>
    <CodeEntry>
      <Description>Step 9 - Winning change...</Description>
      <Address>0042684C</Address>
      <ModuleName>Tutorial-i386.exe</ModuleName>
      <ModuleNameOffset>2684C</ModuleNameOffset>
      <Before>
        <Byte>15</Byte>
        <Byte>E4</Byte>
        <Byte>F4</Byte>
        <Byte>54</Byte>
        <Byte>00</Byte>
      </Before>
      <Actual>
        <Byte>E8</Byte>
        <Byte>BF</Byte>
        <Byte>AB</Byte>
        <Byte>06</Byte>
        <Byte>00</Byte>
      </Actual>
      <After>
        <Byte>EB</Byte>
        <Byte>24</Byte>
        <Byte>8B</Byte>
        <Byte>83</Byte>
        <Byte>88</Byte>
      </After>
    </CodeEntry>
    <CodeEntry>
      <Description>accesses showmessage str</Description>
      <Address>00450146</Address>
      <ModuleName>Tutorial-i386.exe</ModuleName>
      <ModuleNameOffset>50146</ModuleNameOffset>
      <Before>
        <Byte>55</Byte>
        <Byte>F4</Byte>
        <Byte>8B</Byte>
        <Byte>45</Byte>
        <Byte>E8</Byte>
      </Before>
      <Actual>
        <Byte>8A</Byte>
        <Byte>04</Byte>
        <Byte>02</Byte>
      </Actual>
      <After>
        <Byte>88</Byte>
        <Byte>45</Byte>
        <Byte>E4</Byte>
        <Byte>83</Byte>
        <Byte>45</Byte>
      </After>
    </CodeEntry>
    <CodeEntry>
      <Description>terminate?</Description>
      <Address>0054DCC0</Address>
      <ModuleName>Tutorial-i386.exe</ModuleName>
      <ModuleNameOffset>14DCC0</ModuleNameOffset>
      <Before>
        <Byte>00</Byte>
        <Byte>00</Byte>
        <Byte>00</Byte>
        <Byte>00</Byte>
        <Byte>00</Byte>
      </Before>
      <Actual>
        <Byte>55</Byte>
      </Actual>
      <After>
        <Byte>89</Byte>
        <Byte>E5</Byte>
        <Byte>8B</Byte>
        <Byte>45</Byte>
        <Byte>08</Byte>
      </After>
    </CodeEntry>
    <CodeEntry>
      <Description>Closing Message Box Call</Description>
      <Address>00518516</Address>
      <ModuleName>Tutorial-i386.exe</ModuleName>
      <ModuleNameOffset>118516</ModuleNameOffset>
      <Before>
        <Byte>55</Byte>
        <Byte>00</Byte>
        <Byte>8B</Byte>
        <Byte>4D</Byte>
        <Byte>E0</Byte>
      </Before>
      <Actual>
        <Byte>E8</Byte>
        <Byte>95</Byte>
        <Byte>85</Byte>
        <Byte>F3</Byte>
        <Byte>FF</Byte>
      </Actual>
      <After>
        <Byte>8B</Byte>
        <Byte>04</Byte>
        <Byte>85</Byte>
        <Byte>FC</Byte>
        <Byte>74</Byte>
      </After>
    </CodeEntry>
  </CheatCodes>
  <UserdefinedSymbols>
    <SymbolEntry>
      <Name>bypassScript</Name>
      <Address>01750000</Address>
    </SymbolEntry>
    <SymbolEntry>
      <Name>luaFunctionCode</Name>
      <Address>048D0000</Address>
    </SymbolEntry>
    <SymbolEntry>
      <Name>step2HitMeNewCode</Name>
      <Address>048D00D0</Address>
    </SymbolEntry>
    <SymbolEntry>
      <Name>test</Name>
      <Address>016F0000</Address>
    </SymbolEntry>
  </UserdefinedSymbols>
  <Structures StructVersion="2">
    <Structure Name="player2" AutoFill="0" AutoCreate="1" DefaultHex="0" AutoDestroy="0" DoNotSaveLocal="1" RLECompression="0" AutoCreateStructsize="4096">
      <Elements>
        <Element Offset="0" Vartype="Pointer" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="4" Vartype="Float" Bytesize="4" Description="health" DisplayMethod="Unsigned Integer"/>
        <Element Offset="8" Vartype="4 Bytes" Bytesize="4" Description="idk" DisplayMethod="Unsigned Integer"/>
        <Element Offset="12" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Hexadecimal"/>
        <Element Offset="16" Vartype="4 Bytes" Bytesize="4" Description="team" DisplayMethod="Unsigned Integer"/>
        <Element Offset="20" Vartype="Byte" Bytesize="1" Description="NameLength" DisplayMethod="Unsigned Integer"/>
        <Element Offset="21" Vartype="Unicode String" Bytesize="5" Description="Name" DisplayMethod="Unsigned Integer"/>
        <Element Offset="26" Vartype="Byte" Bytesize="1" DisplayMethod="Unsigned Integer"/>
        <Element Offset="27" Vartype="Byte" Bytesize="1" DisplayMethod="Unsigned Integer"/>
        <Element Offset="28" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="32" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="36" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="40" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="44" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="48" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="52" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="56" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="60" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="64" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="68" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="72" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="76" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="80" Vartype="4 Bytes" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="84" Vartype="Pointer" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="88" Vartype="Pointer" Bytesize="4" DisplayMethod="Unsigned Integer"/>
      </Elements>
    </Structure>
    <Structure Name="player" AutoFill="0" AutoCreate="1" DefaultHex="0" AutoDestroy="0" DoNotSaveLocal="0" RLECompression="1" AutoCreateStructsize="4096">
      <Elements>
        <Element Offset="0" Vartype="Pointer" Bytesize="4" DisplayMethod="Unsigned Integer"/>
        <Element Offset="4" Vartype="Float" Bytesize="4" Description="health" DisplayMethod="Unsigned Integer"/>
        <Element Offset="8" Vartype="4 Bytes" Bytesize="4" RLECount="2" DisplayMethod="Unsigned Integer"/>
        <Element Offset="16" Vartype="4 Bytes" Bytesize="4" Description="team" DisplayMethod="Unsigned Integer"/>
        <Element Offset="20" Vartype="Byte" Bytesize="1" Description="NameLength" DisplayMethod="Unsigned Integer"/>
        <Element Offset="21" Vartype="String" Bytesize="5" Description="Name" DisplayMethod="Unsigned Integer"/>
        <Element Offset="26" Vartype="Byte" Bytesize="1" RLECount="2" DisplayMethod="Unsigned Integer"/>
        <Element Offset="28" Vartype="4 Bytes" Bytesize="4" RLECount="14" DisplayMethod="Unsigned Integer"/>
        <Element Offset="84" Vartype="Pointer" Bytesize="4" RLECount="2" PointerSize="4" DisplayMethod="Unsigned Integer"/>
      </Elements>
    </Structure>
  </Structures>
  <DisassemblerComments>
    <DisassemblerComment>
      <Address>"Tutorial-i386.exe"+267E7</Address>
      <Comment>You Lose message
</Comment>
    </DisassemblerComment>
    <DisassemblerComment>
      <Address>"Tutorial-i386.exe"+2684C</Address>
      <Comment>Winning Change
</Comment>
    </DisassemblerComment>
    <DisassemblerComment>
      <Address>"Tutorial-i386.exe"+10567D</Address>
      <Comment>%s
</Comment>
    </DisassemblerComment>
  </DisassemblerComments>
</CheatTable>