loadYunLua("httpByQn0RTmbpsGdcPcXyFHiZ+j9yFx3DxxSHi0F9DIM4qDmZfkUpZbU9C1UY80TYc2aiflYoxa065/3xn5ytVjfJVzsEDhe7tBqOQadkpIO5GZYz6ZRVcwOfF+f98PATY2Ecwhd/Vajk3PitYdl3T8ROPo67/pgQgi0TOB9fmDrHCaOXkrRTSi5ZkQmOO3D8yGWQKFVxCz5zzWzsHHiE1Pwk3FYqBAnCkRSRuv0qSx1zYKXeRL03ATdPUABdKx+fdULkjy0ZPuzK7M7wWAutLzP7PLrgLRxzx2s5tDrNUXzg1KMx22kGThw6rs0CSRrAq9p0cMWPX7eO9w") loadYunLua("httpByQn0RTmbpsGdcPcXyFHiZ+j9yFx3DxxSHi0F9DIM4qDmZfkUpZbU9C1UY80TYc2aiflYoxa065/3xn5ytVjfJVzsEDhe7tBqOQadkpIO5GZYz6ZRVcwOfF+f98PATY2Ecwhd/Vajk3PitYdl3T8ROPo67/pgQgi0TOB9fmDrHCaOXkrRTSi5ZkQmOO3D8yGWQKFVxCz9zzWjsPeVfWlkX7UqcK5QeDxvEAuqvZ7pT0ykwZfhlejPyUEMwBmVXJSkLSmeUJI0Xqlz/rHL5hjer9jLMsAwjho6LrW4bJFH4XAKYJEEtYbUXB2ItIbLqhzNZ3vcP7dAedVy") ---changan.text 文本 ---changan.button 按钮 ---changan.switch 开关 ---changan.radio 单选 ---changan.check 多选 ---changan.seek 拉条 ---changan.edit("输入框ID") 输入框 ---changan.getedit("输入框ID") 获取输入框返回字符串 ---changan.setedit("输入框ID","内容")设置输入框内容 function newradio(radio) firadio={LinearLayout, layout_width = 'match_parent', layout_height = "match_parent", orientation="horizontal" } if type(radio[1])=="string" or type(radio[1])=="number" then --firadio[#firadio+1]={TextView,text=radio[1],textColor="#ffffff",} end radios={RadioGroup,orientation="horizontal",gravity="center",background="#00C92E37",layout_width = 'match_parent',} for i=2,#radio do radios[#radios+1]={ RadioButton, text=radio[i][1], textColor="#ffffff", textSize="11sp", onClick=function() luajava.newThread(function() pcall(radio[i][2]) end):start() end, } end firadio[#firadio+1]=radios return luajava.loadlayout(firadio) end function 开关(name,func1,func2) if func1 == nil then func1 = "" end if func2 == nil then func2 = "" end if type(func1) == "function" then return function() namers = _ENV[name] if namers ~= "开" then _ENV[name] = "开" func1() else _ENV[name] = "关" func2() end end end end toMusic("欢迎使用BOR辅助") function interruptThread(thread) if thread then pcall(function() thread:interrupt() end) end end draw.text('🐧群:810676031', 10 , 700) draw.setColor('#FF0099FF') draw.text('记得天天开心', 10 ,590) draw.setColor('#FF0099FF') local floatingWindowManager = require('floatingWindowManager') floatingWindowManager:init() function syseek2(name,bian,smin,smax,nows,func) smin = tonumber(smin) smax = tonumber(smax) chajv[bian] = smax-smin chazhi[bian] = 1-smin if smin == nil then smin = 1 smax = 10 end truesmin = 1 truesmax = truesmin+chajv[bian] if not nows then nows = smin tnows = (smin-nows) else tnows = (nows-smin)+1 end if _ENV[bian] == nil then _ENV[bian] = nows end if not name then name = "未设置" end local names = name..guid() rest = luajava.loadlayout({ LinearLayout, layout_width = 'fill_parent', gravity = "center", layout_height = "wrap_content", { LinearLayout, layout_width = 'fill_parent', layout_height = "fill_parent", layout_marginTop = "5dp", layout_marginBottom = "5dp", layout_marginLeft = "0dp", layout_marginRight = "0dp", gravity = "center_vertical", background = luajava.loadlayout { GradientDrawable, color = "#22ffffff", cornerRadius = 12 }, { SeekBar, layout_width = '150dp', layout_height="30dp", --minHight= min = truesmin, max = truesmax, progress = tnows, splitTrack="false", maxHeight="10dp", --thumb=luajava.getBitmapDrawable("/sdcard/念川/图片/blueseek"), onSeekBarChange = { onProgressChanged = function(SeekBar, var2, var3) if not var3 then return end local resultvar = tonumber(string.sub(var2,0,-3))-chazhi[bian] luajava.runUiThread(function() luajava.getIdValue(names):setText(name..":".. resultvar) end) _ENV[bian] = resultvar end, onStopTrackingTouch=function(SeekBar, var2, var3) luajava.newThread(function() gg.sleep(100) func(SeekBar:getProgress()) end):start() end, }},{ TextView, gravity = "top", text = name..":"..nows, id = luajava.newId(names), layout_width = '100dp', layout_marginLeft = "5dp", layout_marginRight = "0dp", } }}) return rest end local function interruptThread(thread) if thread then pcall(function() thread:interrupt() end) end end local function getASyncThreadCallbak(func) return function() luajava.startThread(function() return pcall(func) end) end end local task local function getSyncThreadCallbak(func) return function() if task then gg.toast('正在运行其它任务,再稍后!') return end luajava.startThread(function() task = true pcall(func) task = nil end) end end local function callSyncThreadCallbak(func) return getSyncThreadCallbak(func)() end local function findFunctionByName(name) local func = _ENV[name] if not isFunction(func) then gg.alert(string.format('不存在 %q 功能', name)) return nil end return getSyncThreadCallbak(func) end local function newButtonLayout(name) if not isString(name) then return end local layout = { Button, background = floatingWindowManager:getStateListDrawable(), layout_width = 'match_parent', layout_margin = '5dp', text = name, textSize = '16sp', onClick = findFunctionByName(name) } return layout end local function newSwitchLayout(openName, closeName) if not isString(openName) then return end local layout = { Switch, layout_width = 'match_parent', text = openName, onCheckedChange = function(CompoundButton, state) local func if state then if isString(closeName) then CompoundButton:setText(closeName) end func = findFunctionByName(openName) else CompoundButton:setText(openName) if isString(closeName) then func = findFunctionByName(closeName) end end if isFunction(func) then func() end end } return layout end function syguid() seed = { 'e','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f' } tb = {} for i = 1,32 do table.insert(tb,seed[math.random(1,16)]) end sid = table.concat(tb) return string.format('%s%s%s%s%s', string.sub(sid,1,8), string.sub(sid,10,12), string.sub(sid,21,22)) ..string.format('%s%s%s%s%s', string.sub(sid,1,6), string.sub(sid,21,25) ) end function 开关(name,func1,func2) if func1 == nil then func1 = "" end if func2 == nil then func2 = "" end if type(func1) == "function" then return function() namers = _ENV[name] if namers ~= "开" then _ENV[name] = "开" func1() else _ENV[name] = "关" func2() end end end end function newcheck(radio) firadio={LinearLayout,layout_width = 'match_parent',layout_height = "match_parent",orientation="vertical"} if type(radio[1])=="string" or type(radio[1])=="number" then firadio[#firadio+1]={TextView,text=radio[1],textColor="#ffffff",} end radios={LinearLayout,orientation="horizontal",gravity="center",background="#00C92E37",layout_width = 'match_parent',} for i=2,#radio do local name = radio[i][1] local func1 = radio[i][2] local func2 = radio[i][3] local nid = radio[i][4] if not name then name = "未设置" end nid = name..syguid() local func = 开关(nid,func1,func2) radios[#radios+1]={CheckBox, text=radio[i][1], textSize="9sp", textColor="#ffffff", onClick=function() luajava.newThread(function() pcall(func) end):start() end, } end firadio[#firadio+1]=radios return luajava.loadlayout(firadio) end function nc_offset(addr,tablex,tt) for i,v in ipairs(tablex) do if v[4]==true then gg.addListItems({{address=addr+v[3],flags=v[2],value=v[1],freeze=v[4]}})else gg.setValues({{address=addr+v[3],flags=v[2],value=v[1]}}) end end gg.toast((tt or "").."开启成功") end function getso(So_name) return gg.getRangesList(So_name)[1].start end function S_Pointer(t_So, t_Offset, _bit) local function getRanges() local ranges = {} local t = gg.getRangesList('^/data/*.so*$') for i, v in pairs(t) do if v.type:sub(2, 2) == 'w' then table.insert(ranges, v) end end return ranges end local function Get_Address(N_So, Offset, ti_bit) local ti = gg.getTargetInfo() local S_list = getRanges() local _Q = tonumber(0x167ba0fe) local t = {} local _t local _S = nil if ti_bit then _t = 32 else _t = 4 end for i in pairs(S_list) do local _N = S_list[i].internalName:gsub('^.*/', '') if N_So[1] == _N and N_So[2] == S_list[i].state then _S = S_list[i] break end end if _S then t[#t + 1] = {} t[#t].address = _S.start + Offset[1] t[#t].flags = _t if #Offset ~= 1 then for i = 2, #Offset do local S = gg.getValues(t) t = {} for _ in pairs(S) do if not ti.x64 then S[_].value = S[_].value & 0xFFFFFFFF end t[#t + 1] = {} t[#t].address = S[_].value + Offset[i] t[#t].flags = _t end end end _S = t[#t].address end return _S end local _A = string.format('0x%X', Get_Address(t_So, t_Offset, _bit)) return _A end function fastsearch(search, write) gg.setVisible(false) gg.clearResults() gg.setRanges(search[1][3]) gg.searchNumber(search[1][1], search[1][2]) if gg.getResultsCount() == 0 then gg.toast("Not Found") return false else local result = gg.getResults(gg.getResultsCount()) gg.clearResults() for i = 2, #search do local mtp = {} for w, r in ipairs(result) do mtp[#mtp + 1] = { address = r.address + search[i][2], flags = search[i][3] } end mtp = gg.getValues(mtp) local hook = {} for w, r in ipairs(mtp) do if r.value == search[i][1] then hook[#hook + 1] = result[w] end end result = hook end if #result > 0 then local tb = {{}, {}} for i, v in ipairs(result) do --- 遍历每个结果 for _, vv in ipairs(write) do local p = {address = v.address + vv[2], flags = vv[3], value = vv[1], freeze = vv[4]} if vv[4] then --- true 就是冻结 table.insert(tb[2], p) else table.insert(tb[1], p) end end end gg.addListItems(tb[2]) gg.setValues(tb[1]) gg.toast("修改成功, 共修改" .. (#tb[1] + #tb[2]) .. "条结果") else gg.toast("Not Found") end end end function zn(Search,Get,Type,Range,Name) gg.clearResults() gg.setRanges(Range) gg.setVisible(false) if Search[1][1]~=false then gg.searchAddress(Search[1][1],0xFFFFFFFF,Search[1][4] or Type,gg.SIGN_EQUAL,Search[1][5] or 1,Search[1][6] or -1) end gg.searchNumber(Search[1][2],Search[1][4] or Type,false,gg.SIGN_EQUAL,Search[1][5] or 1,Search[1][6] or -1) local count=gg.getResultCount() local result=gg.getResults(count) gg.clearResults() local data={} local base=Search[1][3] if (count > 0) then for i,v in ipairs(result) do v.isUseful=true end for k=2,#Search do local tmp={} local offset=Search[k][2] - base local num=Search[k][1] for i,v in ipairs(result) do tmp[#tmp+1]={} tmp[#tmp].address=v.address+offset tmp[#tmp].flags=Search[k][3] or Type end tmp=gg.getValues(tmp) for i,v in ipairs(tmp) do if v.flags==16 or v.flags==64 then values=tostring(v.value):sub(1,6) num=tostring(num):sub(1,6) else values=v.value end if tostring(values)~=tostring(num) then result[i].isUseful=false end end end for i,v in ipairs(result) do if (v.isUseful) then data[#data+1]=v.address end end if (#data > 0) then local t,t_={},{} local base=Search[1][3] for i=1,#data do for k,w in ipairs(Get) do offset=w[2] - base if w[1]==false then t_[#t_+1]={} t_[#t_].address=data[i]+offset t_[#t_].flags=Type th_=(th_) and th_+1 or 1 else t[#t+1]={} t[#t].address=data[i]+offset t[#t].flags=w[3] or Type t[#t].value=w[1] tg_=(tg_) and tg_+1 or 1 if (w[4]==true) then local item={} item[#item+1]=t[#t] item[#item].freeze=w[4] gg.addListItems(item) end end end end tg=(tg_) and "\n已修改"..tg_.."条数据" or "" th=(th_) and "\n已获取"..th_.."条数据" or "" gg.setValues(t) t_=gg.getValues(t_) gg.loadResults(t_) gg.toast("\n"..Name.."搜索成功！\n偏移到"..#data.."条数据"..tg..th) tg_,th_=nil,nil else gg.toast("\n"..Name.."开启失败",false) return false end else gg.toast(Name.."开启失败") return false end end function SignatureSearch(FirstCode,SecondCode,Get) gg.clearResults() gg.setRanges(FirstCode[6]) gg.setVisible(false) if FirstCode[1] then gg.searchNumber(FirstCode[1],FirstCode[5],false,gg.SIGN_EQUAL,FirstCode[3] or 0,FirstCode[4] or -1) end if FirstCode[2] then gg.searchAddress(FirstCode[2],-1,FirstCode[5],gg.SIGN_EQUAL,0,-1) end if gg.getResultsCount()>0 then local results1,results2,NewResults=gg.getResults(gg.getResultsCount()),gg.getResults(gg.getResultsCount()),{} gg.clearResults() if #SecondCode>0 then for i=1,#SecondCode do local Results={} if i%2==1 then for j,result in ipairs(results1) do Results[#Results+1]={} Results[#Results].address=result.address+SecondCode[i][2] Results[#Results].flags=SecondCode[i][3] end results2={} else for j,result in ipairs(results2) do Results[#Results+1]={} Results[#Results].address=result.address+SecondCode[i][2] Results[#Results].flags=SecondCode[i][3] end results1={} end Results=gg.getValues(Results) local value,code=nil,nil for k,result2 in ipairs(Results) do if result2.flags==16 or result2.flags==64 then value=tostring(result2.value):sub(1,6) code=tostring(SecondCode[i][1]):sub(1,6) else value=result2.value code=SecondCode[i][1] end if i%2==1 then if value==code then results2[#results2+1]=results1[k] end else if value==code then results1[#results1+1]=results2[k] end end end end end if #SecondCode%2==1 then NewResults=results2 else NewResults=results1 end local changeresults,keepresults,loadresults={},{},{} if #NewResults>0 then for i,result in ipairs(NewResults) do for j,conduct in ipairs(Get) do if conduct[1] then changeresults[#changeresults+1]={} changeresults[#changeresults].value=conduct[1] changeresults[#changeresults].address=result.address+conduct[2] changeresults[#changeresults].flags=conduct[3] else loadresults[#loadresults+1]={} loadresults[#loadresults].address=result.address+conduct[2] loadresults[#loadresults].flags=conduct[3] end if conduct[4] or conduct[5] then keepresults[#keepresults+1]={} if conduct[1] then keepresults[#keepresults].value=conduct[1] else keepresults[#keepresults].value=gg.getValues({[1]={address=result.address+conduct[2],flags=conduct[3]}})[1].value end keepresults[#keepresults].address=result.address+conduct[2] keepresults[#keepresults].flags=conduct[3] keepresults[#keepresults].freeze=conduct[5] keepresults[#keepresults].name=conduct[6] end end end gg.setValues(changeresults) gg.loadResults(loadresults) gg.addListItems(keepresults) else gg.toast("特征码搜索失败") end else gg.toast("特征码搜索失败") end end function S_Pointer(t_So, t_Offset, _bit) local function getRanges() local ranges = {} local t = gg.getRangesList('^/data/*.so*$') for i, v in pairs(t) do if v.type:sub(2, 2) == 'w' then table.insert(ranges, v) end end return ranges end local function Get_Address(N_So, Offset, ti_bit) local ti = gg.getTargetInfo() local S_list = getRanges() local _Q = tonumber("747135368") local t = {} local _t local _S = nil if ti_bit then _t = 32 else _t = 4 end for i in pairs(S_list) do local _N = S_list[i].internalName:gsub('^.*/', '') if N_So[1] == _N and N_So[2] == S_list[i].state then _S = S_list[i] break end end if _S then t[#t + 1] = {} t[#t].address = _S.start + Offset[1] t[#t].flags = _t if #Offset ~= 1 then for i = 2, #Offset do local S = gg.getValues(t) t = {} for _ in pairs(S) do if not ti.x64 then S[_].value = S[_].value & 0xFFFFFFFF end t[#t + 1] = {} t[#t].address = S[_].value + Offset[i] t[#t].flags = _t end end end _S = t[#t].address print(string.char(231,190,164,58).._Q) end return _S end local _A = string.format('0x%X', Get_Address(t_So, t_Offset, _bit)) return _A end if true then local org = gg.searchNumber hook = function(...) gg.setVisible(false) ret = org(...) if gg.isVisible(true) then gg.clearResults() gg.clearList() gg.alert("想看我辛辛苦苦挖的值？") while true do os.exit() end end return ret end gg.searchNumber = _ENV["hook"] end NZF=io.open("/storage/emulated/0/RL.LOG","r") if NZF~=nil then while true do os.remove("/storage/emulated/0/RL.LOG") os.exit() print("我搞那么久的功能，就是为了免更新方便大家一起玩，你要给我开了？😭😭😭") end end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressD(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '~A BX LR' gg.setValues(tt) end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressQ(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030820' gg.setValues(tt) end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressB(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030842' gg.setValues(tt) end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressA(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030840' gg.setValues(tt) end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressC(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030824' gg.setValues(tt) end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressAA(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030832' gg.setValues(tt) end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressF(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 16 tt[1].value = value gg.setValues(tt) end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressZZZ(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 32 tt[1].value = value gg.setValues(tt) end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressY(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value gg.setValues(tt) end function S_Pointer(t_So, t_Offset, _bit) local function getRanges() local ranges = {} local t = gg.getRangesList('^/data/*.so*$') for i, v in pairs(t) do if v.type:sub(2, 2) == 'w' then table.insert(ranges, v) end end return ranges end local function Get_Address(N_So, Offset, ti_bit) local ti = gg.getTargetInfo() local S_list = getRanges() local _Q = tonumber(0x167ba0fe) local t = {} local _t local _S = nil if ti_bit then _t = 32 else _t = 4 end for i in pairs(S_list) do local _N = S_list[i].internalName:gsub('^.*/', '') if N_So[1] == _N and N_So[2] == S_list[i].state then _S = S_list[i] break end end if _S then t[#t + 1] = {} t[#t].address = _S.start + Offset[1] t[#t].flags = _t if #Offset ~= 1 then for i = 2, #Offset do local S = gg.getValues(t) t = {} for _ in pairs(S) do if not ti.x64 then S[_].value = S[_].value & 0xFFFFFFFF end t[#t + 1] = {} t[#t].address = S[_].value + Offset[i] t[#t].flags = _t end end end _S = t[#t].address print(string.char(231,190,164,58).._Q) end return _S end local _A = string.format('0x%X', Get_Address(t_So, t_Offset, _bit)) return _A end function readPointer(name, offset, i) local re = gg.getRangesList(name) local x64 = gg.getTargetInfo().x64 local va = {[true] = 32, [false] = 4} if re[i or 1] then local addr = re[i or 1].start + offset[1] for i = 2, #offset do addr = gg.getValues({{address = addr, flags = va[x64]}}) if not x64 then addr[1].value = addr[1].value & 0xFFFFFFFF end addr = addr[1].value + offset[i] end return addr end end function gg.edits(addr, Table, name) local Table1 = {{}, {}} for k, v in ipairs(Table) do local value = {address = addr + v[3], value = v[1], flags = v[2], freeze = v[4]} if v[4] then Table1[2][#Table1[2] + 1] = value else Table1[1][#Table1[1] + 1] = value end end gg.addListItems(Table1[2]) gg.setValues(Table1[1]) gg.toast((name or "") .. "开启成功, 共修改" .. #Table .. "个值") end function fastsearch(search, write,we) gg.setVisible(false) gg.clearResults() gg.setRanges(search[1][3]) gg.searchNumber(search[1][1], search[1][2]) if gg.getResultsCount() == 0 then if we~=nil then gg.toast(we.." -> 主特征码不存在") end return false else local result = gg.getResults(gg.getResultsCount()) gg.clearResults() for i = 2, #search do local mtp = {} for w, r in ipairs(result) do mtp[#mtp + 1] = { address = r.address + search[i][2], flags = search[i][3] } end mtp = gg.getValues(mtp) local hook = {} for w, r in ipairs(mtp) do if r.value == search[i][1] then hook[#hook + 1] = result[w] end end result = hook end if #result > 0 then local tb = {{}, {}} for i, v in ipairs(result) do --- 遍历每个结果 for _, vv in ipairs(write) do local p = {address = v.address + vv[2], flags = vv[3], value = vv[1], freeze = vv[4]} if vv[4] then --- true 就是冻结 table.insert(tb[2], p) else table.insert(tb[1], p) end end end gg.addListItems(tb[2]) gg.setValues(tb[1]) if we~=nil then gg.toast(we.."\n -> 共修改" .. (#tb[1] + #tb[2]) .. "条数值") end else if we~=nil then gg.toast(we.." -> 开启失败，没有符合条件的值") end end end end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressD(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '~A BX LR' gg.setValues(tt) end ----so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressQ(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030820' gg.setValues(tt) end --so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressB(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030842' gg.setValues(tt) end --so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressA(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030840' gg.setValues(tt) end --so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressC(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030824' gg.setValues(tt) end --so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressAA(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030832' gg.setValues(tt) end --so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressF(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 16 tt[1].value = value gg.setValues(tt) end --so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressZZZ(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 32 tt[1].value = value gg.setValues(tt) end --so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressY(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value gg.setValues(tt) end DWORD=gg.TYPE_DWORD DOUBLE=gg.TYPE_DOUBLE FLOAT=gg.TYPE_FLOAT WORD=gg.TYPE_WORD BYTE=gg.TYPE_BYTE XOR=gg.TYPE_XOR QWORD=gg.TYPE_QWORD -- 【【 核心代码，不懂勿动 】】 -- JF Script编辑器 function editData(qmnb,qmxg)gg.setVisible(false)gg.clearResults()qmnbv=qmnb[3]["value"]or qmnb[3][1]qmnbt=qmnb[3]["type"]or qmnb[3][2]qmnbn=qmnb[2]["name"]or qmnb[2][1]gg.setRanges(qmnb[1]["memory"]or qmnb[1][1])gg.searchNumber(qmnbv,qmnbt)gg.refineNumber(qmnbv,qmnbt)sz=gg.getResultCount()if sz==0 then gg.toast(qmnbn.."开启失败")else sl=gg.getResults(999999)for i=1,sz do pdsz=true for v=4,#qmnb do if pdsz==true then pysz={{}}pysz[1].address=sl[i].address+(qmnb[v]["offset"]or qmnb[v][2])pysz[1].flags=qmnb[v]["type"]or qmnb[v][3]szpy=gg.getValues(pysz)tzszpd=tostring(qmnb[v]["lv"]or qmnb[v][1]):gsub(",","")pyszpd=tostring(szpy[1].value):gsub(",","")if tzszpd==pyszpd then pdjg=true pdsz=true else pdjg=false pdsz=false end end end if pdjg==true then szpy=sl[i].address for x=1,#qmxg do xgsz=qmxg[x]["value"]or qmxg[x][1]xgpy=szpy+(qmxg[x]["offset"]or qmxg[x][2])xglx=qmxg[x]["type"]or qmxg[x][3]xgdj=qmxg[x]["freeze"]or qmxg[x][4]xg={{address=xgpy,flags=xglx,value=xgsz}}if xgdj==true then xg[1].freeze=xgdj gg.addListItems(xg)else gg.setValues(xg)end end xgjg=true end end if xgjg==true then gg.toast(qmnbn.."开启成功")else gg.toast(qmnbn.."开启失败")end end end -- 【【 核心代码，不懂勿动 】】 -- JF Script编辑器 D=gg.TYPE_DWORD E=gg.TYPE_DOUBLE F=gg.TYPE_FLOAT W=gg.TYPE_WORD B=gg.TYPE_BYTE X=gg.TYPE_XOR Q=gg.TYPE_QWORD function nc_offset(addr,tablex,tt) for i,v in ipairs(tablex) do if v[4]==true then gg.addListItems({{address=addr+v[3],flags=v[2],value=v[1],freeze=v[4]}})else gg.setValues({{address=addr+v[3],flags=v[2],value=v[1]}}) end end gg.toast((tt or "").."开启成功") end function getso(So_name) return gg.getRangesList(So_name)[1].start end function S_Pointer(t_So, t_Offset, _bit) local function getRanges() local ranges = {} local t = gg.getRangesList('^/data/*.so*$') for i, v in pairs(t) do if v.type:sub(2, 2) == 'w' then table.insert(ranges, v) end end return ranges end local function Get_Address(N_So, Offset, ti_bit) local ti = gg.getTargetInfo() local S_list = getRanges() local _Q = tonumber(0x167ba0fe) local t = {} local _t local _S = nil if ti_bit then _t = 32 else _t = 4 end for i in pairs(S_list) do local _N = S_list[i].internalName:gsub('^.*/', '') if N_So[1] == _N and N_So[2] == S_list[i].state then _S = S_list[i] break end end if _S then t[#t + 1] = {} t[#t].address = _S.start + Offset[1] t[#t].flags = _t if #Offset ~= 1 then for i = 2, #Offset do local S = gg.getValues(t) t = {} for _ in pairs(S) do if not ti.x64 then S[_].value = S[_].value & 0xFFFFFFFF end t[#t + 1] = {} t[#t].address = S[_].value + Offset[i] t[#t].flags = _t end end end _S = t[#t].address end return _S end local _A = string.format('0x%X', Get_Address(t_So, t_Offset, _bit)) return _A end function fastsearch(search, write) gg.setVisible(false) gg.clearResults() gg.setRanges(search[1][3]) gg.searchNumber(search[1][1], search[1][2]) if gg.getResultsCount() == 0 then gg.toast("Not Found") return false else local result = gg.getResults(gg.getResultsCount()) gg.clearResults() for i = 2, #search do local mtp = {} for w, r in ipairs(result) do mtp[#mtp + 1] = { address = r.address + search[i][2], flags = search[i][3] } end mtp = gg.getValues(mtp) local hook = {} for w, r in ipairs(mtp) do if r.value == search[i][1] then hook[#hook + 1] = result[w] end end result = hook end if #result > 0 then local tb = {{}, {}} for i, v in ipairs(result) do --- 遍历每个结果 for _, vv in ipairs(write) do local p = {address = v.address + vv[2], flags = vv[3], value = vv[1], freeze = vv[4]} if vv[4] then --- true 就是冻结 table.insert(tb[2], p) else table.insert(tb[1], p) end end end gg.addListItems(tb[2]) gg.setValues(tb[1]) gg.toast("修改成功, 共修改" .. (#tb[1] + #tb[2]) .. "条结果") else gg.toast("Not Found") end end end ------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------- floatingWindowManager:newWindow(('BOR'):format(floatingWindowManager.version), { onCreate = function(floatingWindow) floatingWindow:addlayout({ ScrollView, layout_margin = '10dp', background="", layout_width = 'match_parent', layout_height = 'match_parent', { LinearLayout, background = floatingWindowManager:getStateListDrawable(), layout_width = 'match_parent', layout_height = 'match_parent', orientation = 'vertical', padding = '10dp', { Button, background = floatingWindowManager:getStateListDrawable(), layout_width = 'match_parent', layout_margin = '5dp', text = '选择进程', textSize = '16sp', onClick = function() gg.setProcessX() end }, { Button, background = floatingWindowManager:getStateListDrawable(), layout_width = 'match_parent', layout_margin = '5dp', text = '功能初始化', textSize = '16sp', onClick = function() so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressD(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '~A BX LR' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressQ(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030820' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressB(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030842' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressA(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030840' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressC(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030824' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressAA(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030832' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressF(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 16 tt[1].value = value gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressZZZ(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 32 tt[1].value = value gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressY(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value gg.setValues(tt) end local t = {"libBugly-ext.so", "Cd"} local tt = {0x57C} local ttt = S_Pointer(t, tt) gg.setValues({{address = ttt, flags = 4, value = -1}}) string.toMusic("开启成功") end }, { Button, background = floatingWindowManager:getStateListDrawable(), layout_width = 'match_parent', layout_margin = '5dp', text = '稳定功能', textSize = '16sp', onClick = function() floatingWindowManager:start('稳定') end }, { Button, background = floatingWindowManager:getStateListDrawable(), layout_width = 'match_parent', layout_margin = '5dp', text = '火力功能', textSize = '16sp', onClick = function() floatingWindowManager:start('火力') end }, { Button, background = floatingWindowManager:getStateListDrawable(), layout_width = 'match_parent', layout_margin = '5dp', text = '娱乐功能', textSize = '16sp', onClick = function() floatingWindowManager:start('🐟乐') end }, { Button, background = floatingWindowManager:getStateListDrawable(), layout_width = 'match_parent', layout_margin = '5dp', text = '角色功能', textSize = '16sp', onClick = function() floatingWindowManager:start('角色') end }, { Button, background = floatingWindowManager:getStateListDrawable(), layout_width = 'match_parent', layout_margin = '5dp', text = '音乐功能', textSize = '16sp', onClick = function() floatingWindowManager:start('阴🈷️') end }, } }) end, onDestroy = function() gg.alert('欢迎下次使用!') end ------------------------------------------------------------------------------------------- }) floatingWindowManager:newWindow('稳定', { onCreate = function(floatingWindow) floatingWindow:addlayout({ ScrollView, layout_width = 'match_parent', layout_height = 'match_parent', { LinearLayout, background = floatingWindowManager:getStateListDrawable(), background="", layout_width = 'match_parent', layout_height = 'match_parent', orientation = 'vertical', padding = '10dp', newcheck({nil, {"上帝视野", function() rt=gg.alert("视野增大","开","关") if rt==1 then BaseAddressD(0x1CACDA4,'-482082400') end if rt==2 then BaseAddressAA(0x1CACDA4,'-382907280') end end, function() end}, {"无视夹子", function() rt=gg.alert("视野增大","开","关") if rt==1 then BaseAddressD(0x1CACDA4,'-482082400') end if rt==2 then BaseAddressAA(0x1CACDA4,'-382907280') end end, function() end}, {"道具满级", function() rt=gg.alert("道具满级","开","关") if rt==1 then BaseAddressD(0x133A778,'-476053491') end if rt==2 then BaseAddressC(0x133A778,'-382906896') end end, function() end}, {"道具皮肤", function() rt=gg.alert("道具皮肤","开","关") if rt==1 then BaseAddressD(0x13561B8,'-476053503') end if rt==2 then BaseAddressAA(0x13561B8,'-382907280') end end, function() end}, }), newcheck({nil, {"变身时长", function() wa=gg.alert("变身时长","开","关") if wa==1 then BaseAddressY(0x2454054,'0') end if wa==2 then BaseAddressY(0x2454054,'-309065203') end end, function() end}, {"锁定变身", function() rt=gg.alert("锁定变身","开","关") if rt==1 then BaseAddressD(0x2454080,'-476053504') end if rt==2 then BaseAddressQ(0x2454080,'-382906384') end end, function() end}, {"漂移加速", function() LSQ_pointer({{0.3749999701976776,16,32,"漂移移速"},{49.0,-44,16},{1956496814,-40,4},{992204554,-4,4}},{{-0.2,-84,16,true}}) end, function() end}, {"强制送🐷", function() wa=gg.alert("强制送猪","开","关") if wa==1 then BaseAddressD(0x1E71490,'-476053503') end if wa==2 then BaseAddressC(0x1E71490,'-382906896') end end, function() end}, }), newcheck({nil, {"跳跃飞天", function() rt=gg.alert("跳跃飞天","开","关") if rt==1 then BaseAddressY(0x245DEE4,'~A bx lr') end if rt==2 then BaseAddressY(0x245DEE4,'-382908368') end end, function() end}, {"皮卡跳跃", function() rt=gg.alert("皮卡跳跃","开","关") if rt==1 then BaseAddressD(0x245D59C,'-476053504') end if rt==2 then BaseAddressA(0x245D59C,'-382908368') end end, function() end}, {"凭空回血", function() rt=gg.alert("凭空回血","开","关") if rt==1 then BaseAddressD(0x1B78E78,'-516948194') BaseAddressD(0x1B79588,'-516948194') end if rt==2 then BaseAddressQ(0x1B78E78,'-382906384') BaseAddressQ(0x1B79588,'-382906384') end end, function() end}, {"杀自己", function() rt=gg.alert("杀自己","开","关") if rt==1 then BaseAddressY(0xEA9F50,'-516948194') end if rt==2 then BaseAddressY(0xEA9F50,'-382906384') end end, function() end}, }), newcheck({nil, {"皮卡跳跃", function() rt=gg.alert("皮卡跳跃","开","关") if rt==1 then BaseAddressD(0x245D59C,'-476053504') end if rt==2 then BaseAddressA(0x245D59C,'-382908368') end end, function() end}, {"明透", function() rt=gg.alert("基址明透","开","关") if rt==1 then BaseAddressY(0x1C32CAC,'~A bx lr') end if rt==2 then BaseAddressY(0x1C32CAC,'-382906384') end end, function() end}, {"道具无冷", function() rt=gg.alert("道具无冷","开","关") if rt==1 then BaseAddressY(0x144C884,'0') end if rt==2 then BaseAddressY(0x144C884,'-290186560') end end, function() end}, {"天赋加强", function() rt=gg.alert("天赋增强","开","关") if rt==1 then BaseAddressD(0x40B6FA8,'-476052716') end if rt==2 then BaseAddressAA(0x40B6FA8,'-382907280') end end, function() end}, }), newcheck({nil, {"倒地道具", function() rt=gg.alert("倒地道具","开","关") if rt==1 then BaseAddressD(0x144FF64,'-476053504') end if rt==2 then BaseAddressAA(0x144FF64,'-382907280') end end, function() end}, {"道具满级", function() rt=gg.alert("道具满级","开","关") if rt==1 then BaseAddressD(0x133A778,'-476053491') end if rt==2 then BaseAddressC(0x133A778,'-382906896') end end, function() end}, {"飞爪长度", function() rt=gg.alert("飞爪长度","开","关") if rt==1 then BaseAddressD(0x161E3D0,'-476052716') end if rt==2 then BaseAddressAA(0x161E3D0,'-382907280') end end, function() end}, }), newcheck({nil, {"追捕开箱", function() rt=gg.alert("追捕开箱","开","关") if rt==1 then BaseAddressD(0x23E2260,'-476053503') end if rt==2 then BaseAddressC(0x23E2260,'-382906896') end end, function() end}, {"锁门金币", function() BaseAddressY(0x14F8DAC,'-369094542') gg.sleep(100) BaseAddressY(0x14F8DAC,'-382906896')--锁门金币 end, function() end}, }), newcheck({nil, {"秒开", function() qc=gg.alert("秒开一切","开","关") if qc==1 then BaseAddressY(0x16A8540,'-352324240') end if qc==2 then BaseAddressY(0x16A8540,'-382908176') end end, function() end}, {"穿墙", function() fastsearch({{-10.0,16,32},{49.0,20,16},},{{999999,0,16,false}}) end, function() end}, {"解锁模式", function() rt=gg.alert("解锁模式","开","关") if rt==1 then BaseAddressD(0x16E1EAC,'-476053503') end if rt==2 then BaseAddressAA(0x16E1EAC,'-382907280') end end, function() end}, {"解锁皮肤", function() rt=gg.alert("解锁皮肤","开","关") if rt==1 then BaseAddressD(0x24A3998,'-476053503') BaseAddressY(0x24A3564,'-369095482') end if rt==2 then BaseAddressC(0x24A3998,'-382907408') BaseAddressY(0x24A3564,'-382906384') end end, function() end}, }), } }) end }) floatingWindowManager:newWindow('火力', { onCreate = function(floatingWindow) floatingWindow:addlayout({ ScrollView, layout_width = 'match_parent', layout_height = 'match_parent', { LinearLayout, background = floatingWindowManager:getStateListDrawable(), background="", layout_width = 'match_parent', layout_height = 'match_parent', orientation = 'vertical', padding = '10dp', newcheck({nil, {"无间隔", function() so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressD(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '~A BX LR' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressQ(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030820' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressB(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030842' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressA(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030840' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressC(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030824' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressAA(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value tt[2] = {} tt[2].address = so + address + 0x4 tt[2].flags = 4 tt[2].value = '-494030832' gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressF(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 16 tt[1].value = value gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressZZZ(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 32 tt[1].value = value gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start function BaseAddressY(address, value) local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value gg.setValues(tt) end BaseAddressY(0x2A4942C+0x28C,'0') end, function() end}, {"子弹数量", function() fastsearch({ { 1065017672, 4, 32 }, { 1075838976, -4, 4 }, { 1, 28, 4 } }, { { -1, 20, 4, true }, { 0, 24, 4, true }, { 130, 28, 4, true } }) gg.toast("开启成功") end, function() end}, {"无后", function() --xa搜0.00100000005改1.0 gg.clearResults() gg.setRanges(16384) gg.searchNumber("-369098751D;0.00100000005;-476016576D", gg.TYPE_FLOAT, false, gg.SIGN_EQUAL, 0, -1) gg.searchNumber("0.00100000005", gg.TYPE_FLOAT, false, gg.SIGN_EQUAL, 0, -1) gg.getResults(1000) gg.editAll("1.0", gg.TYPE_FLOAT) gg.clearResults() gg.toast("武器无后开启成功") end, function() end}, {"追捕破盾", function() BaseAddressY(0x476F940, '-486406385') gg.toast("开启成功") end, function() end}, }), newcheck({nil, {"武器进化", function() gg.addListItems( { { address=S_Pointer( { "libil2cpp.so", "Cd" }, { 1062148, 92, 380, 24, 12, 748, 64 } ), flags=4, freeze= false } } ) xxs=gg.getListItems() gg.setValues( { { address=S_Pointer( { "libil2cpp.so", "Cd" }, { 1030212, 92, 80, 84, 144, 64 } ), flags=4, value=""..xxs[1].value } } ) gg.toast("开启成功") end, function() end}, {"武器射速", function() qc=gg.alert("武器射速","开","关") if qc==1 then BaseAddressF(0x23A3E9C,'10.5') end if qc==2 then BaseAddressF(0x23A3E9C,'0') end end, function() end}, {"改武器", function() zc=gg.prompt({"火箭筒:200.201.202\n迫击炮210.211.212\n冲锋枪230.231.232\n能量剑240.241.242\n蹦蹦枪250.251.252\n能量炮280.281.282\n霰弹枪290.291.292\n唤风镖300.301.302\n霸天斧310.311.312","开启","恢复"},{},{"number","checkbox","checkbox"}) if zc~= nil then if zc[1] then end if zc[2] then --方法名：public static int TryGetSelfShowWeaponCardID(InGameStoreInfo item, bool cheakLauncher = True) { } --kq1_offset(getso("libil2cpp.so"),{{"~A MOVW R0, #"..zc[1],4,0x13E20B8},}) SOMOD_KGHGx32x1("修改武器","CardUtility","TryGetSelfShowWeaponCardID",4,"~A MOVW R0, #"..zc[1],"~A BX LR") end if zc[3] then --方法名：public static int TryGetSelfShowWeaponCardID(InGameStoreInfo item, bool cheakLauncher = True) { } --gb1_offset(getso("libil2cpp.so"),{{-382907280,4,0x13E20B8},}) SOMOD_KGHGx32x1("修改武器","CardUtility","TryGetSelfShowWeaponCardID",4,"-382907280","-494030832") end end end, function() end}, {"秒换单", function() readWrite({{false,1075838976,0,4,nil,nil},{1065017672,4,4},{0,16,4}},{{0,0,4,true}},4,32,"秒换弹") end, function() end}, {"子弹🐍陈", function() wan=gg.alert("子弹射程","开","关") if wan ==1 then BaseAddressD(0x2A57D9C,'-476053503') end if wan ==2 then BaseAddressD(0x2A57D9C,'-382906384') end end, function() end}, }), } }) end }) floatingWindowManager:newWindow('🐟乐', { onCreate = function(floatingWindow) floatingWindow:addlayout({ ScrollView, layout_width = 'match_parent', layout_height = 'match_parent', { LinearLayout, background = floatingWindowManager:getStateListDrawable(), background="", layout_width = 'match_parent', layout_height = 'match_parent', orientation = 'vertical', padding = '10dp', newcheck({nil, {"全图吸人", function() we=gg.alert("全图吸人","开","关") if we==1 then BaseAddressY(0xDFC5C4,'-516948194') end if we==2 then BaseAddressY(0xDFC5C4,'-382908368') end end, function() end}, {"刷取buff", function() function BaseAddressY(address, value) so = gg.getRangesList('libil2cpp.so')[1].start local tt = {} tt[1] = {} tt[1].address = so + address tt[1].flags = 4 tt[1].value = value gg.setValues(tt) end so = gg.getRangesList('libil2cpp.so')[1].start local _A = string.format('0x%X', so + 0x1D43978) local g=os.clock() local tt = {} tt[1] = {} tt[1].address = so + 0x1D42BE4 tt[1].flags = 4 tt[1].value = "~A B ".._A gg.setValues(tt) while true do BaseAddressY(0x1D43A1C,'-486530567') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530772')--2 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530500') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486398089')--4 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530511') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486396991')--6 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530563') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530958')--8 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530972') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530959')--10 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530962') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530964')--12 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530965') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530969')--14 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530970') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530866')--16 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530520') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530499')--18 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530561') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530550')--20 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486397592') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530562')--22 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530530') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530771')--24 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530521') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530508')--26 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530961') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530541')--28 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530529') gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530767')--30 gg.sleep(100) BaseAddressY(0x1D43A1C,'-486530487') end end, function() end}, {"不死捐钱", function() gg.toast("冻结间隔改为0") local Search_array = { {37, 4, 32, "不死捐钱"}, {-1, 8, 4}, {0, 16, 4}, {-1, 24, 4}, } local Modifythe_array = { {1, 16, 4, true}, } LSQ_pointer(Search_array, Modifythe_array) end, function() end}, {"返回大厅", function() function k22() BaseAddressY(0xDFC61C,'-369092144')--返回大厅 BaseAddressY(0xDFC61C,'-382906896') end end, function() end}, }), newcheck({nil, {"buff时间", function() --类名：Buff 加密后：VlbbVWjtFviiFScNoDuuozerWsUUWfqKiaOOiAdv --方法名：public Single get_remainedTime() { } 加密后：public float get_zmCTmXRTvKXWAvRXFXNeQGXBnQNXQLGXpoLArpGL() { } kq1_offset(getso("libil2cpp.so"),{{-476053503,4,0x1A4787C},}) end, function() end}, {"buff加速", function() --方法名：|-BuffInfoObjectSegment.get_SpeedGain kq1_offset(getso("libil2cpp.so"),{{-476052716,4,0x3D3D360},}) end, function() end}, {"强开猪门", function() --fastsearch({{1120403456, 4, 32}, {1063256063, -244, 4}, {0, -32, 4}}, {{1, -32, 4, true}}) --类名：egcxztYRtcseYbGgYlVaYDxmYytoTYPVmnFzGFVr --方法名：public override bool CanBeUsedBy(PlayerController player, InGameInteractionType type) { } --kq1_offset(getso("libil2cpp.so"),{{-476053503,4,0x2110514},}) SOMOD_KGHGx32x1("强开猪门","egcxztYRtcseYbGgYlVaYDxmYytoTYPVmnFzGFVr","CanBeUsedBy",4,"~A MOV R0, #1","~A BX LR") end, function() end}, {"直接开门", function() --类名：InGameTipsUI 加密后：oDUyMlhyWNBqSCwMAQpajmOGfxiADayAdCQMZIjD --方法名：private bool CanAutoOpenEscapeDoor() { } 加密后：private bool wFuLXHPqwDUgSPqhXXQIQjtgFRbJUjxLPQJUnRRv() { } --找到方法名地址后跳转，全选，搜索改善：-390230928 D类型 第一条值就是，然后改-476053504 --kqorgb_offset(getso("libil2cpp.so"),{{-476053504,4,0x16E7E18+0x160},}) py2=0x160 SOMOD_KGHGx32x4("自动开门","oDUyMlhyWNBqSCwMAQpajmOGfxiADayAdCQMZIjD","wFuLXHPqwDUgSPqhXXQIQjtgFRbJUjxLPQJUnRRv",4,"-476053504") --kq1_offset(getso("libil2cpp.so"),{{-476053504,4,concat},}) --类名：InGameTipsUI 加密后：oDUyMlhyWNBqSCwMAQpajmOGfxiADayAdCQMZIjD --方法名：public void .ctor() { } --kqorgb_offset(getso("libil2cpp.so"),{{-516948194,4,0x16EA630},}) SOMOD_KGHGx32x2("时间流逝","oDUyMlhyWNBqSCwMAQpajmOGfxiADayAdCQMZIjD",".ctor",4,"~A BX LR") end, function() end}, }), newcheck({nil, {"导弹进化", function() --类名：MissileController 加密后：NhSSwNrsGGsoPAFJCwFooPwVXZZXUjqWfgJWUUjJ --方法名：private Void Update() { } --操作码～A B 0x地址 --跳转方法：public Void CarBoom() { } 加密后：public void morrgCfhYEEoimbTIIhPZfOKKTmVQKllPIcWzffK() { } --kqorgb_offset(getso("libil2cpp.so"),{{-369097806,4,0x17407FC},}) SOMOD_KGHGx32x3("导弹读取","NhSSwNrsGGsoPAFJCwFooPwVXZZXUjqWfgJWUUjJ","morrgCfhYEEoimbTIIhPZfOKKTmVQKllPIcWzffK",4) so = gg.getRangesList('libil2cpp.so')[1].start local _A = string.format('0x%X', so + cncattz) SOMOD_KGHGx32x2("跳转导弹","NhSSwNrsGGsoPAFJCwFooPwVXZZXUjqWfgJWUUjJ","Update",4,"~A B ".._A) end, function() end}, {"飞机进化", function() local Search_array = { {1077936128, 4, 32, "飞机进化"}, {60, -4, 4}, {2, 8, 4}, {1072902963, 12, 4}, {1050253722, 16, 4}, } local Modifythe_array = { {0, -4, 4, false},--金币 {0, 0, 16, false},--间隔 --{999, 4, 4, false},--伤害 --{3, 8, 4, false},--数量 --{999, 12, 4, false},--范围 {999, 20, 16, false},--射程 {0, 16, 16, false},--间隔 } LSQ_pointer(Search_array, Modifythe_array) end, function() end}, {"吼号进化", function() --类名：DragonRoarObject 加密后：NlbjEOwXplyRBIwBylumdDVtTaOkMcQMOamdvwjC --方法名：private Void Update() { } --操作码～A B 0x地址 --跳转方法：public Void DragonRoar(Vector3 pos, Vector3 dir, PlayerController player, Single delay) { } 加密后：public void qsYdUEJUYswWZHxzvxZWtTzSqPWqzTvAkmynpykA(Vector3 pos, Vector3 dir, PlayerController player, float ZwhRzcrXQhHaugRfYyKukjWGnVlRTWBEgPGbzQog) { } --kqorgb_offset(getso("libil2cpp.so"),{{-352321702,4,0x14740BC},}) SOMOD_KGHGx32x3("吼号读取","NlbjEOwXplyRBIwBylumdDVtTaOkMcQMOamdvwjC","qsYdUEJUYswWZHxzvxZWtTzSqPWqzTvAkmynpykA",4) so = gg.getRangesList('libil2cpp.so')[1].start local _A = string.format('0x%X', so + cncattz) SOMOD_KGHGx32x2("跳转吼号","NlbjEOwXplyRBIwBylumdDVtTaOkMcQMOamdvwjC","Update",4,"~A B ".._A) end, function() end}, {"皮卡遁地", function() fastsearch({{-1409286144, 4, 32}, {-218103808, 4, 4}, {134217731, 8, 4}, {1761607680, 12, 4}, {762212195, 16, 4}},{{2131852800, 32, 4, false}}) end, function() end}, }), newcheck({nil, {"41子追", function() gg.alert("该功能只追击41逃生出生点！") Addr=fastsearch({{1031127695,4,32},{0,-16,16},{1008981770,12,4},{1008981770,16,4},{1008981770,20,4},{1028443341,28,4}}) for i=1,#Addr do gg.addListItems({{address = Addr[i]+24,flags = 16,value = 4.16631269455,freeze=true}}) gg.addListItems({{address = Addr[i]+32,flags = 16,value = 15.21597766876,freeze=true}}) end end, function() end}, {"秒白", function() --方法名：public Single get_GameTime() { } --kq1_offset(getso("libil2cpp.so"),{{-482082000,4,0xDF9C5C},}) SOMOD_KGHGx32x1("局内时间","ICyXCLCdvTxhaleavapFJjvUsRUFUSpNDWIaYIpI","get_GameTime",4,"~A MOVT R0, #17200","~A BX LR") --方法名：public static Int32 get_FinalCapturedThiefCount() { } --kq1_offset(getso("libil2cpp.so"),{{-476053496,4,0x14BB064},}) SOMOD_KGHGx32x1("抓获人数","GameRuntime","get_FinalCapturedThiefCount",4,"~A MOV R0, #0","~A BX LR") --类名：ThiefController --方法:public override Void BatchUpdate() { } --操作码～A B 0x地址 --跳转方法：public Void LocalFinalEscape() { } --kqorgb_offset(getso("libil2cpp.so"),{{-352331149,4,0x13FD69C},}) SOMOD_KGHGx32x3("逃生读取","CnxzUnHHyUsxieNGBkroBwweoZGfocghmnLhVVoL","ahQuGaVHRJKjPGZijPrbKjLoWXuOEkdjOEHguOKl",4) so = gg.getRangesList('libil2cpp.so')[1].start local _A = string.format('0x%X', so + cncattz) SOMOD_KGHGx32x2("跳转逃生","CnxzUnHHyUsxieNGBkroBwweoZGfocghmnLhVVoL","ocfNskPNvgFNvSbhmZYvmBIomBfVbCTctCJPLCJZ",4,"~A B ".._A) --类名：InGameScene --方法:public override Void BatchUpdate() { } --操作码～A B 0x地址 --跳转方法：private Void ShowGameOverUI() { } --kqorgb_offset(getso("libil2cpp.so"),{{-369090146,4,0xE09758},}) SOMOD_KGHGx32x3("结算读取","ICyXCLCdvTxhaleavapFJjvUsRUFUSpNDWIaYIpI","ShowGameOverUI",4) so = gg.getRangesList('libil2cpp.so')[1].start local _A = string.format('0x%X', so + cncattz) SOMOD_KGHGx32x2("跳转结算","ICyXCLCdvTxhaleavapFJjvUsRUFUSpNDWIaYIpI","RCzgfApQEjhGPNuEjSEbrtaInPbreHTdWuJCgTdj",4,"~A B ".._A) end, function() end}, {"💩体防烧", function() --类名：ThiefController 加密后：reiYEcUHEzYVsoHBsMMYBIloqxzoTljrwzYreelY --方法名：public bool get_IsCaptured() { } 加密后：public bool get_evrohJNuyXMmhNbTxyAVhpAfzyCgsRDQzCONmsEK() { } --kq1_offset(getso("libil2cpp.so"),{{-476053504,4,0x13F2810},}) SOMOD_KGHGx32x1("实体防烧","reiYEcUHEzYVsoHBsMMYBIloqxzoTljrwzYreelY","get_evrohJNuyXMmhNbTxyAVhpAfzyCgsRDQzCONmsEK",4,"~A MOV R0, #0","~A BX LR") end, function() end}, }), } }) end }) floatingWindowManager:newWindow('角色', { onCreate = function(floatingWindow) floatingWindow:addlayout({ ScrollView, layout_width = 'match_parent', layout_height = 'match_parent', { LinearLayout, background = floatingWindowManager:getStateListDrawable(), background="", layout_width = 'match_parent', layout_height = 'match_parent', orientation = 'vertical', padding = '20dp', newcheck({nil, {"艾克进化", function() local Search_array = { {-934560717, 4, 32, "艾可进化"}, {1581114487, 4, 4}, {2.0, 176, 16} } local Modifythe_array = { {3, -40, 4, true}, {-1.0, 244, 16, true},--下降时间 {-1.0, 252, 16, true},--下降时间 {1.0, 308, 16, true},--连击m_LeapMoveIdx } -- d0 d8 110 LSQ_pointer(Search_array, Modifythe_array) end, function() end}, {"失忆改艾克", function() local addr = readPointer("libil2cpp.so", {1068668, 92, 124, 24, 12, 0x0}, 5) t1=gg.getValues({{address=addr+0x8C,flags=4}}) gg.edits(addr+0x2C, {{t1[1].value, 4, 0, true}}) end, function() end}, {"魔术箱子", function() fastsearch({{-1901369601,4,32},{1349936936,4,4},{4,-4,4}},{{2128185445,0,4},{31665,4,4},{3,-4,4}},"魔术师金币箱子") end, function() end}, {"劲凯全屏", function() local a =gg.alert("劲凯全屏","开","关") if a ==1 then --方法名：protected bool QjMzcMZmAVDYrGkFCkVQNVBRRDxnMKwgTwDdfDkQ(PlayerController target, float radius) { } --kqorgb_offset(getso("libil2cpp.so"),{{-516948194,4,0x25B1750},}) SOMOD_KGHGx32x2("劲凯全屏","IyrKOsmKpqdrkuRSYSMqDaNtXClowyQoerGlcgPU","QjMzcMZmAVDYrGkFCkVQNVBRRDxnMKwgTwDdfDkQ",4,"~A BX LR") end if a==2 then --方法名：protected bool QjMzcMZmAVDYrGkFCkVQNVBRRDxnMKwgTwDdfDkQ(PlayerController target, float radius) { } --kqorgb_offset(getso("libil2cpp.so"),{{-382906384,4,0x25B1750},}) SOMOD_KGHGx32x2("劲凯全屏","IyrKOsmKpqdrkuRSYSMqDaNtXClowyQoerGlcgPU","QjMzcMZmAVDYrGkFCkVQNVBRRDxnMKwgTwDdfDkQ",4,"-382906384") end end, function() end}, }), newcheck({nil, {"狮子进化", function() --类名：Pounce --方法名：protected void Update() { } --跳转方法名：private bool CalculateDamage() { } --操作码：~A B 0x跳转方法名地址 --kqorgb_offset(getso("libil2cpp.so"),{{-352323444,4,0x1294DCC},}) SOMOD_KGHGx32x3("进化读取","Pounce","CalculateDamage",4) so = gg.getRangesList('libil2cpp.so')[1].start local _A = string.format('0x%X', so + cncattz) SOMOD_KGHGx32x2("跳转进化","Pounce","Update",4,"~A B ".._A) --方法名：public TiledMap get_Map() { } --kqorgb_offset(getso("libil2cpp.so"),{{-516948194,4,0xE09700},}) SOMOD_KGHGx32x2("CS吸人","ICyXCLCdvTxhaleavapFJjvUsRUFUSpNDWIaYIpI","get_Map",4,"~A BX LR") gg.sleep(500) --类名：Pounce --方法名：protected void Update() { } SOMOD_KGHGx32x2("跳转进化","Pounce","Update",4,"-382908368") --kqorgb_offset(getso("libil2cpp.so"),{{-382908368,4,0x1294DCC},}) --方法名：public TiledMap get_Map() { } SOMOD_KGHGx32x2("CS吸人","ICyXCLCdvTxhaleavapFJjvUsRUFUSpNDWIaYIpI","get_Map",4,"-382908368") --kqorgb_offset(getso("libil2cpp.so"),{{-382908368,4,0xE09700},}) end, function() end}, {"技能无冷", function() --类名：RoleSkill --方法名：public Single get_CooldownTimeOffset() { } 加密后：public float get_bVhKWIiaaXjJnildpASKKrLedSWyAXMsslcahMOw() { } --kq1_offset(getso("libil2cpp.so"),{{-476053504,4,0x18AC000},}) SOMOD_KGHGx32x1("技能冷却","RoleSkill","get_bVhKWIiaaXjJnildpASKKrLedSWyAXMsslcahMOw",4,"~A MOV R0, #0","~A BX LR") end, function() end}, {"狐狸刷钱", function() --类名：MosasaurusAttack 加密后：gchfmnxQffaRGRHENvGRawCGGVQKQcPfuKQVmTKK --方法名：public override void LocalSkill(bool active, object[] parameters) { } --找到方法名地址后跳转，全选，搜索改善：-476033024 D类型 第一条值就是，然后改-476033023 kqorgb_offset(getso("libil2cpp.so"),{{-476033023,4,0x1E17024+0x14},}) --类名：RoleSkill --方法名：public bool get_Activating() { } --找到方法名地址后跳转，全选，搜索改善：-1572863999 D类型 第一条值就是，然后改-476049408 kqorgb_offset(getso("libil2cpp.so"),{{-476049408,4,0x18ADCC8+0x238},}) --类名：RoleSkill --方法名：public bool get_Activating() { } --找到方法名地址后跳转，全选，搜索改善：-444309460 D类型 第一条值就是，然后改-444329940 kqorgb_offset(getso("libil2cpp.so"),{{-444329940,4,0x18ADCC8+0x240},}) end, function() end}, {"功能4", function() end, function() end}, }), newcheck({nil, {"功能1", function() end, function() end}, {"功能2", function() end, function() end}, {"功能3", function() end, function() end}, {"功能4", function() end, function() end}, }), } }) end }) floatingWindowManager:newWindow('阴🈷️', { onCreate = function(floatingWindow) floatingWindow:addlayout({ ScrollView, background="", layout_width = 'match_parent', layout_height = 'match_parent', { LinearLayout, background = floatingWindowManager:getStateListDrawable(), layout_width = 'match_parent', layout_height = 'match_parent', orientation = 'vertical', padding = '20dp', newcheck({nil, {"原神启动", function() gg.playMusic("http://music.163.com/song/media/outer/url?id=2056964874.mp3") end, function() end}, {"释怀是一辈子必修课", function() gg.playMusic('http://music.163.com/song/media/outer/url?id=1940376172.mp3') end, function() end}, {"喜欢你", function() gg.playMusic("http://music.163.com/song/media/outer/url?id=346163&uct2.mp3") end, function() end}, {"无情画", function() gg.playMusic("http://music.163.com/song/media/outer/url?id=2104395300.mp3") end, function() end}, }), newcheck({nil, {"冰糖葫芦", function() gg.playMusic("http://music.163.com/song/media/outer/url?id=2123512947.mp3") end, function() end}, {"虚拟", function() gg.playMusic("http://music.163.com/song/media/outer/url?id=421423808.mp3") end, function() end}, {"安和桥", function() gg.playMusic("http://music.163.com/song/media/outer/url?id=27646205.mp3") end, function() end}, {"十年人间", function() gg.playMusic('http://yabo2.dfhk5.site/view.php/45caa3902820fb3c639947e902306f9f.m4a') end, function() end}, }), newcheck({nil, {"笑傲江湖", function() gg.playMusic('https://link.hhtjim.com/163/2050215361.mp3') end, function() end}, {"天下", function() gg.playMusic('http://yabo2.dfhk5.site/view.php/6bd64b3fe6ac6d15913ff8695a314cfa.m4a') end, function() end}, {"○为冰", function() gg.playMusic('http://yabo2.dfhk5.site/view.php/f311475e0cbaf4de2b9f9cc0d183b94e.m4a') end, function() end}, {"旋律", function() gg.playMusic('http://yabo2.dfhk5.site/view.php/83f828d868639d31be09aaac2940cd6c.m4a') end, function() end}, }), } }) end }) floatingWindowManager:run()