--love1200
local inject = {}
inject.shellcode = function(addr,code)
    local results = {}
    for i=1,#code,2 do
        table.insert(results,{address = addr + (i + 1) / 2 - 1,flags = gg.TYPE_BYTE,value = string.sub(code,i,i + 1).."h"})
    end
    gg.setValues(results)
    return addr
end
local ranges = gg.getRangesList('libil2cpp.so')
if not ranges or #ranges == 0 then
    print('未找到 libmok2.so')
    return
end  
local rw_base = nil
local rp_list = {}          
for _, range in ipairs(ranges) do
    local addr = range.start
    local val = gg.getValues({{address = addr, flags = 4}})
    local value = val and val[1] and val[1].value
    if value == 76 then
        rw_base = range.start
    elseif value == 1179403647 then
        table.insert(rp_list, {base = range.start})
    end
end
if not rw_base then
    print('未找到 rw-p 段（值 76）')
    return
end
if #rp_list == 0 then
    print('未找到任何 r--p 段（值 1179403647）')
    return
end
local mok1, mok2
local unknown = {}
for _, rp in ipairs(rp_list) do
    local distance = rw_base - rp.base
    if distance < 0 then distance = -distance end
    if distance == 0x3B0A000 then
        mok2 = rp.base
    elseif distance == 0x163DE9000 then
        mok1 = rp.base
    else
        table.insert(unknown, rp.base)
    end
end
if not mok1 and #unknown == 1 then
    mok1 = unknown[1]
end
function xz666(address, value)
    local xznb = mok2
    gg.setValues({{address = xznb + address, flags = 4, value = value}})
end
if not mok1 or not mok2 then
    print('未能同时识别出模块1和模块2，请重启游戏')
    if mok1 then print('模块1基址: 0x' .. string.format('%X', mok1)) else print('模块1未找到') end
    if mok2 then print('模块2基址: 0x' .. string.format('%X', mok2)) else print('模块2未找到') end
    return
end
a = gg.getValues({{address = mok2+0xA7F1000 + 0x262100, flags = gg.TYPE_QWORD}})[1].value
b = gg.getValues({{address = a + 0xB8,    flags = gg.TYPE_QWORD}})[1].value
c = gg.getValues({{address = b + 0x48,    flags = gg.TYPE_QWORD}})[1].value
d = gg.getValues({{address = c + 0x10,    flags = gg.TYPE_QWORD}})[1].value
e = gg.getValues({{address = d + 0x28,    flags = gg.TYPE_QWORD}})[1].value
f = gg.getValues({{address = e + 0x40,    flags = gg.TYPE_QWORD}})[1].value
actorid = gg.getValues({{address = f + 0x98, flags = 4}})[1].value
inject.shellcode(mok2+0xA10198C,"FF0302D1FD7B02A940010058210080D222010058230080D2640080D2250080D2ED090497FD7B42A9FF030291C0035FD6")
gg.setValues({{address = mok2+0xA10198C+0x30, flags = 4, value = actorid}})
inject.shellcode(mok2+0x9CF1498,"3D411014")
for fromactorid = 10001040, 10001090 do
gg.setValues({{address = mok2+0xA10198C+0x34, flags = 4, value = fromactorid}})
end
inject.shellcode(mok2+0x9CF1498, "FE0F1EF8")
function S_Pointer(t_So, t_Offset, _bit)
	local function getRanges()
		local ranges = {}
		local t = gg.getRangesList('^/data/*.so*$')
		for i, v in pairs(t) do
			if v.type:sub(2, 2) == 'w' then
table.insert(ranges, v)
			end
		end
		return ranges
	end
	local function Get_Address(N_So, Offset, ti_bit)
		local ti = gg.getTargetInfo()
		local S_list = getRanges()
		local _Q = tonumber(681726122)--Q群
		local t = {}
		local _t
		local _S = nil
		if ti_bit then
			_t = 32
		 else
			_t = 4
		end
		for i in pairs(S_list) do
			local _N = S_list[i].internalName:gsub('^.*/', '')
			if N_So[1] == _N and N_So[2] == S_list[i].state then
_S = S_list[i]
break
			end
		end
		if _S then
			t[#t + 1] = {}
			t[#t].address = _S.start + Offset[1]
			t[#t].flags = _t
			if #Offset ~= 1 then
for i = 2, #Offset do
	local S = gg.getValues(t)
	t = {}
	for _ in pairs(S) do
		if not ti.x64 then
			S[_].value = S[_].value & 0xFFFFFFFF
		end
		t[#t + 1] = {}
		t[#t].address = S[_].value + Offset[i]
		t[#t].flags = _t
	end
end
			end
			_S = t[#t].address
		end
		return _S
	end
	local _A = string.format('0x%X',Get_Address(t_So, t_Offset, _bit))
	return _A
end

local t = {"libil2cpp.so", "Cd"}
local tt = {0x2665F0,0xB8,0x8,0x1D0}
local ttt = S_Pointer(t, tt, true)
gg.addListItems({{address = ttt, flags = 4, value = 16842752, freeze = true}})
function S_Pointer(t_So, t_Offset, _bit)
	local function getRanges()
		local ranges = {}
		local t = gg.getRangesList('^/data/*.so*$')
		for i, v in pairs(t) do
			if v.type:sub(2, 2) == 'w' then
table.insert(ranges, v)
			end
		end
		return ranges
	end
	local function Get_Address(N_So, Offset, ti_bit)
		local ti = gg.getTargetInfo()
		local S_list = getRanges()
		local _Q = tonumber(681726122)--Q群
		local t = {}
		local _t
		local _S = nil
		if ti_bit then
			_t = 32
		 else
			_t = 4
		end
		for i in pairs(S_list) do
			local _N = S_list[i].internalName:gsub('^.*/', '')
			if N_So[1] == _N and N_So[2] == S_list[i].state then
_S = S_list[i]
break
			end
		end
		if _S then
			t[#t + 1] = {}
			t[#t].address = _S.start + Offset[1]
			t[#t].flags = _t
			if #Offset ~= 1 then
for i = 2, #Offset do
	local S = gg.getValues(t)
	t = {}
	for _ in pairs(S) do
		if not ti.x64 then
			S[_].value = S[_].value & 0xFFFFFFFF
		end
		t[#t + 1] = {}
		t[#t].address = S[_].value + Offset[i]
		t[#t].flags = _t
	end
end
			end
			_S = t[#t].address
		end
		return _S
	end
	local _A = string.format('0x%X',Get_Address(t_So, t_Offset, _bit))
	return _A
end
    local Fr = gg.prompt({'人物移动速度'},{[1]='5'})
    if Fr == nil then
        gg.alert("未选择")
        return
    end
    local t = {'libil2cpp.so','Cd'}
    local tt = {0x262100,0xB8,0x48,0x1D8}
    local ttt = S_Pointer(t, tt, true)
    if not ttt then
        gg.alert("功能开启失败，未找到对应内存地址")
        return
    end
    gg.setValues({{address = ttt, flags = 16, value = Fr[1]}})
gg.toast("开启成功")
function S_Pointer(t_So, t_Offset, _bit)
	local function getRanges()
		local ranges = {}
		local t = gg.getRangesList('^/data/*.so*$')
		for i, v in pairs(t) do
			if v.type:sub(2, 2) == 'w' then
table.insert(ranges, v)
			end
		end
		return ranges
	end
	local function Get_Address(N_So, Offset, ti_bit)
		local ti = gg.getTargetInfo()
		local S_list = getRanges()
		local _Q = tonumber(681726122)--Q群
		local t = {}
		local _t
		local _S = nil
		if ti_bit then
			_t = 32
		 else
			_t = 4
		end
		for i in pairs(S_list) do
			local _N = S_list[i].internalName:gsub('^.*/', '')
			if N_So[1] == _N and N_So[2] == S_list[i].state then
_S = S_list[i]
break
			end
		end
		if _S then
			t[#t + 1] = {}
			t[#t].address = _S.start + Offset[1]
			t[#t].flags = _t
			if #Offset ~= 1 then
for i = 2, #Offset do
	local S = gg.getValues(t)
	t = {}
	for _ in pairs(S) do
		if not ti.x64 then
			S[_].value = S[_].value & 0xFFFFFFFF
		end
		t[#t + 1] = {}
		t[#t].address = S[_].value + Offset[i]
		t[#t].flags = _t
	end
end
			end
			_S = t[#t].address
		end
		return _S
	end
	local _A = string.format('0x%X',Get_Address(t_So, t_Offset, _bit))
	return _A
end

local t = {"libil2cpp.so", "Cd"}--锁子弹
local tt = {0x262100, 0xB8, 0x48, 0xC0, 0xC4}
local ttt = S_Pointer(t, tt, true)
gg.addListItems({{address = ttt, flags = 4, value = 0, freeze = true}})
gg.addListItems({{address = ttt+0x4, flags = 4, value = 0, freeze = true}})
function S_Pointer(t_So, t_Offset, _bit)
    local function getRanges()
        local ranges = {}
        local t = gg.getRangesList('^/data/*.so*$')
        for i, v in pairs(t) do
            if v.type:sub(2, 2) == 'w' then
                table.insert(ranges, v)
            end
        end
        return ranges
    end
    local function Get_Address(N_So, Offset, ti_bit)
        local ti = gg.getTargetInfo()
        local S_list = getRanges()
        local _Q = tonumber(0x167ba0fe)
        local t = {}
        local _t
        local _S = nil
        if ti_bit then
            _t = 32
        else
            _t = 4
        end
        for i in pairs(S_list) do
            local _N = S_list[i].internalName:gsub('^.*/', '')
            if N_So[1] == _N and N_So[2] == S_list[i].state then
                _S = S_list[i]
                break
            end
        end
        if _S then
            t[#t + 1] = {}
            t[#t].address = _S.start + Offset[1]
            t[#t].flags = _t
            if #Offset ~= 1 then
                for i = 2, #Offset do
                    local S = gg.getValues(t)
                    t = {}
                    for _ in pairs(S) do
                        if not ti.x64 then
                            S[_].value = S[_].value & 0xFFFFFFFF
                        end
                        t[#t + 1] = {}
                        t[#t].address = S[_].value + Offset[i]
                        t[#t].flags = _t
                    end
                end
            end
            _S = t[#t].address
        end
        return _S
    end
    local _A = string.format('0x%X', Get_Address(t_So, t_Offset, _bit))
    return _A
end
function taosheng_jiesuan()
    math.randomseed(os.clock() * 1000000)
    local jiuren_value = math.random(5, 15)
    local shanghai_value = math.random(600, 1500)
    local jidao_value = math.random(6, 15)
    local libList = gg.getRangesList('libil2cpp.so')
    if not libList or #libList < 2 then
        gg.alert("未检测到游戏进程，请先选择进程")
        return
    end
    local t = {"libil2cpp.so", "Cd"}
    local tt = {0x262100, 0x40, 0xB8, 0x48, 0x528}
    local ttt = S_Pointer(t, tt, true)
    -- 修复ttt为空nil报错
    if not ttt then
        gg.alert("功能开启失败，未找到对应内存地址")
        return
    end
    gg.setValues({{address = ttt, flags = 4, value = jiuren_value}})
    gg.setValues({{address = ttt+0x8, flags = 16, value = shanghai_value}})
    gg.setValues({{address = ttt+0x1c, flags = 4, value = jidao_value}})          
          
    local lib=gg.getRangesList("libil2cpp.so")[2].start
    gg.setValues({{address=lib+0x46f6b10,flags=4,value=-763363072}})--逃亡小偷计数
    gg.setValues({{address=lib+0x46f6b10+0x4,flags=4,value=-698416192}})
    gg.setValues({{address=lib+0x6bd1b0c,flags=4,value=335548810}})--秒
    gg.setValues({{address=lib+0x6bd1b0c,flags=4,value=-65204248}})

    gg.clearList()
    gg.clearResults()
    gg.alert("开启成功")
end
taosheng_jiesuan()
function S_Pointer(t_So, t_Offset, _bit)
	local function getRanges()
		local ranges = {}
		local t = gg.getRangesList('^/data/*.so*$')
		for i, v in pairs(t) do
			if v.type:sub(2, 2) == 'w' then
table.insert(ranges, v)
			end
		end
		return ranges
	end
	local function Get_Address(N_So, Offset, ti_bit)
		local ti = gg.getTargetInfo()
		local S_list = getRanges()
		local _Q = tonumber(681726122)--Q群
		local t = {}
		local _t
		local _S = nil
		if ti_bit then
			_t = 32
		 else
			_t = 4
		end
		for i in pairs(S_list) do
			local _N = S_list[i].internalName:gsub('^.*/', '')
			if N_So[1] == _N and N_So[2] == S_list[i].state then
_S = S_list[i]
break
			end
		end
		if _S then
			t[#t + 1] = {}
			t[#t].address = _S.start + Offset[1]
			t[#t].flags = _t
			if #Offset ~= 1 then
for i = 2, #Offset do
	local S = gg.getValues(t)
	t = {}
	for _ in pairs(S) do
		if not ti.x64 then
			S[_].value = S[_].value & 0xFFFFFFFF
		end
		t[#t + 1] = {}
		t[#t].address = S[_].value + Offset[i]
		t[#t].flags = _t
	end
end
			end
			_S = t[#t].address
		end
		return _S
	end
	local _A = string.format('0x%X',Get_Address(t_So, t_Offset, _bit))
	return _A
end

local t = {"libil2cpp.so", "Cd"}--武器间隔
local tt = {0x262100, 0xB8, 0x48, 0xC0,0x9C}
local ttt = S_Pointer(t, tt, true)
gg.addListItems({{address = ttt, flags = 4, value = 0, freeze = true}})