local ranges=gg.getRangesList('libil2cpp.so')if not ranges or #ranges==0 then print('未找到 libil2cpp.so')return end local function xzpanduan(v)local name=v.name or v.internalName or"" if name:find('bss',1,true)then return false end if v.internalName and v.internalName:find(':bss$')then return false end return true end local r_xp_xa=nil for _,v in ipairs(ranges)do if xzpanduan(v)and v.type=="r-xp"then r_xp_xa=v.start break end end if not r_xp_xa then print("未找到 r-xp 段(xa模块)")return end local r__p_xa,zuijia_value,rw_p_cd for _,v in ipairs(ranges)do if xzpanduan(v)then if not rw_p_cd and v.type=="rw-p"then rw_p_cd=v.start end if v.type=="r--p"then local firstvalue=gg.getValues({{address=v.start,flags=gg.TYPE_DWORD}})[1].value if firstvalue==1179403647 then local diff=v.start-r_xp_xa local jueduizhi=math.abs(diff) if not zuijia_value or jueduizhi<zuijia_value then zuijia_value=jueduizhi r__p_xa=v.start end end end end end function xztz(base,...)local addr=base;local offsets={...};for i=1,#offsets-1 do local val=gg.getValues({{address=addr+offsets[i],flags=gg.TYPE_QWORD}})[1].value;if not val then return nil end;addr=val end;return addr+offsets[#offsets] end function xz666(address,value)local xznb=r__p_xa;gg.setValues({{address=xznb+address,flags=4,value=value}})end 
local inject={} inject.shellcode= function (addr, code) local results={} for i=1, #code, 2 do table.insert(results, {address=addr+(i+1)/2-1, flags=gg.TYPE_BYTE, value=string.sub(code, i, i+1).."h"}) end gg.setValues(results) return saddr end  local  function jz(type) local jt=gg.getRangesList(type[1])[type[3]].start address=jt if type[4]== true  then add=gg.addListItems else add= function () end  end  for k, v in pairs(type[2]) do  if k==#type[2] then address=address+v add({{address=address, flags=gg.TYPE_QWORD, name="第\b"..k.."\b层"}}) else address=getvalue({{address=address+v, flags=gg.TYPE_QWORD}})[1].value end  end  return address end  function zz(type) local address=type[1] for k, v in pairs(type[2]) do  if k==#type[2] then address=address+v else address=gg.getValues({{address=address+v, flags=gg.TYPE_QWORD}})[1].value end  end  return address end  function utf8.byte(str) local res={} local i=1 while i<=#str do  local c=string.byte(str, i) local unicode if c>=0 and c<=127 then unicode=c i=i+1 elseif c>=192 and c<=223 then  local c2=string.byte(str, i+1) unicode=(bit32.band(c, 31)*64)+bit32.band(c2, 63) i=i+2 elseif c>=224 and c<=239 then  local c2=string.byte(str, i+1) local c3=string.byte(str, i+2) unicode=(bit32.band(c, 15)*4096)+(bit32.band(c2, 63)*64)+bit32.band(c3, 63) i=i+3 elseif c>=240 and c<=247 then  local c2=string.byte(str, i+1) local c3=string.byte(str, i+2) local c4=string.byte(str, i+3) unicode=(bit32.band(c, 7)*262144)+(bit32.band(c2, 63)*4096)+(bit32.band(c3, 63)*64)+bit32.band(c4, 63) i=i+4 else table.insert(res,  nil ) break  end table.insert(res, unicode) end  return res end  function utf8_char_from_value(value) if type(value)=="table" then  local utf8_chars={} for i, value in ipairs(value) do  if value<0 then value=value&0xFFFFFFFF end  if value<0 or value>0x10FFFF then error("无效的Unicode码点") end  end  end  return utf8.char(table.unpack(value)) end  function readPointer(name, offset, i) local re=gg.getRangesList(name) local x64=gg.getTargetInfo().x64 local va={[ true ]=32, [ false ]=4} if re[i or 1] then  local addr=re[i or 1].start+offset[1] for i=2, #offset do addr=gg.getValues({{address=addr, flags=va[x64]}}) if  not x64 then addr[1].value=addr[1].value&0xFFFFFFFF else  end addr=addr[1].value+offset[i] end  return addr end  end  local  function cstr(x, address) local str, addr, set addr={{value=0, address=12, flags=4}, {value=utf8.len(x), address=0x10, flags=4}} set={} for k, v in ipairs(utf8.byte(x)) do addr[#addr+1]={address=0x14+(k-1)*2, value=v, flags=2} end  for k, v in ipairs(addr) do set[k]={address=v.address+address, flags=v.flags, value=v.value} end gg.setValues(set) return address end


function findnull(start_addr, zero_count)
    zero_count = zero_count or 117
    local chunk_size = 512  -- 每次读取 512 个 DWORD（2048 字节）
    local addr = start_addr
    local max_scan = 0x10000  -- 最大向后扫描 64KB，避免死循环
    local end_addr = start_addr + max_scan
    while addr < end_addr do
        -- 构建读取列表
        local items = {}
        for i = 0, chunk_size - 1 do
            items[i + 1] = {address = addr + i * 4, flags = gg.TYPE_DWORD}
        end
        local values = gg.getValues(items)
        -- 检查是否有错误（例如非法地址）
        if not values or #values == 0 then break end
        local count = 0
        for i, v in ipairs(values) do
            if v.value == 0 then
                count = count + 1
                if count == zero_count then
                    -- 找到连续 zero_count 个 0，计算块起始地址
                    local block_start = addr + (i - zero_count + 1) * 4
                    -- 第3个0的地址（索引从0开始，第3个即偏移 2*4）
                    local third_zero_addr = block_start + 2 * 4
                    return third_zero_addr
                end
            else
                count = 0
            end
        end
        -- 移动地址，重叠 (zero_count-1) 个 DWORD，防止跨越边界漏掉
        addr = addr + (chunk_size - zero_count + 1) * 4
    end
    -- 未找到，返回原起始地址作为回退
    return start_addr
end


local base_perfab    = xztz(rw_p_cd, 0x274C08, 0xB8, 0x38, 0x10 + 0x2F9FC + 0x325A20)
local base_stringclass = xztz(rw_p_cd, 0x274C08, 0xB8, 0x38, 0x10 + 0x63744)
local base_stringclass2 = xztz(rw_p_cd, 0x274C08, 0xB8, 0x38, 0x10 - 0xd8c - 0xE2784)
local base_fids      = xztz(rw_p_cd, 0x274C08, 0xB8, 0x38, 0x10 + 0x285E4)
local base_fvalues   = xztz(rw_p_cd, 0x274C08, 0xB8, 0x38, 0x10 + 0x2F9FC)
local base_fviewid   = xztz(rw_p_cd, 0x274C08, 0xB8, 0x38, 0x10 + 0x4710C - 0x125980 + 0x1DBFF8)
local base_tagstring = xztz(rw_p_cd, 0x274C08, 0xB8, 0x38, 0x10 + 0x28558 - 0xB132C + 0x26C890)
local base_cacgepage = xztz(rw_p_cd, 0x274C08, 0xB8, 0x38, 0x10 + 0x28D70 - 0x7D628)


perfab    = findnull(base_perfab) or base_perfab
stringclass = findnull(base_stringclass) or base_stringclass
stringclass2 = findnull(base_stringclass2) or base_stringclass2
fids      = findnull(base_fids) or base_fids
fvalues   = findnull(base_fvalues) or base_fvalues
fviewid   = findnull(base_fviewid) or base_fviewid
tagstring = findnull(base_tagstring) or base_tagstring
cacgepage = findnull(base_cacgepage) or base_cacgepage


xz1 = xztz(r__p_xa, 0xAEC0618, 0xB8, 0x1f0)


stringclassobj = gg.getValues({{address = r__p_xa + 0xAECF798, flags = 32}})[1].value




function zwz(perfabname,instanceid,viewidd,entityinitdatabadee,x,y,z)--plana
dmmnetpeer = gg.getValues({{address = xz1, flags = 32}})[1].value
gg.setValues({{address=perfab, flags=32, value=stringclassobj}})
cstr(perfabname,perfab)
inject.shellcode(r__p_xa+0xA540CC4+0x68,"FF0302D1FD7B02A9240080D200020058210200584202005843020058650200588002001C8102001C8202001CC309001CC409001CC509001CC609001CD2C38C96FD7B42A9FF030291C0035FD6")
local cnm = r__p_xa + 0xA540CC4 + 0x68
gg.setValues({
    {address = cnm + 0x4C, flags = 32, value = dmmnetpeer},
    {address = cnm + 0x54, flags = 32, value = perfab},
    {address = cnm + 0x5C, flags = 4,  value = instanceid},
    {address = cnm + 0x60, flags = 32, value = viewidd},
    {address = cnm + 0x68, flags = 32, value = entityinitdatabadee},
    {address = cnm + 0x70, flags = 16, value = x},
    {address = cnm + 0x74, flags = 16, value = y},
    {address = cnm + 0x78, flags = 16, value = z}
})
inject.shellcode(r__p_xa+0xA1307A8,"61411014")
gg.sleep(10)
inject.shellcode(r__p_xa+0xA1307A8,"FE0F1EF8")
end

function hd()--entityid前面
gg.setValues({{address=stringclass, flags=32, value=stringclassobj}})
int_32=gg.getValues({{address = r__p_xa+0xAEBC2E8, flags = 32}})[1].value
gg.setValues({
    {address = fviewid, flags = 32, value = int_32},
    {address = fvalues, flags = 32, value = int_32},
    {address = fids,    flags = 32, value = int_32}
})
cstr("EntityModule.LMNA.Events.EntityInitDataBase",stringclass)
end

function cw()--entityid
    inject.shellcode(r__p_xa+0xA540CC4,"FF0302D1FD7B02A9200100580201D297210080D2AFAA3D97F0000058000600F8FD7B42A9FF030291C0035FD6")
    gg.setValues({
        {address = r__p_xa + 0xA540CC4 + 0x2C, flags = 32, value = stringclass},
        {address = r__p_xa + 0xA540CC4 + 0x34, flags = 32, value = stringclass2}
    })
    inject.shellcode(r__p_xa+0xA1307A8,"47411014")
    gg.sleep(100)
    inject.shellcode(r__p_xa+0xA1307A8,"FE0F1EF8")
    entity = gg.getValues({{address = stringclass2, flags = 32}})[1].value
    gg.setValues({{address = entity + 0x48, flags = 4, value = SHILIID}})
    viewid1 = gg.getValues({{address = entity + 0x50, flags = 32}})[1].value
    gg.setValues({
        {address = viewid1 + 0x10, flags = 32, value = fviewid},
        {address = viewid1 + 0x18, flags = 4, value = 1},
        {address = fviewid + 0x18, flags = 4, value = 4},
        {address = fviewid + 0x20, flags = 4, value = SHILIID}
    })
    ids = gg.getValues({{address = entity + 0x78, flags = 32}})[1].value
    gg.setValues({
        {address = ids + 0x18, flags = 4, value = 3},
        {address = ids + 0x10, flags = 32, value = fids},
        {address = fids + 0x18, flags = 4, value = 3},
        {address = fids + 0x20, flags = 4, value = 4},
        {address = fids + 0x24, flags = 4, value = 5},
        {address = fids + 0x28, flags = 4, value = 5002}
    })
    vv1 = gg.getValues({{address = entity + 0x80, flags = 32}})[1].value
    gg.setValues({
        {address = vv1 + 0x10, flags = 32, value = fvalues},
        {address = vv1 + 0x18, flags = 4, value = 3},
        {address = fvalues + 0x18, flags = 4, value = 3},
        {address = fvalues + 0x20, flags = 4, value = 1012008}--1012008
    })
    gg.setValues({{address = entity + 0x28, flags = 4, value = 65536}})
    tags1 = gg.getValues({{address = entity + 0x40, flags = 32}})[1].value
    tags2 = gg.getValues({{address = tags1 + 0x10, flags = 32}})[1].value
    gg.setValues({{address = tagstring, flags = 32, value = stringclassobj}})
    cstr("HaidaoBossbaoxiang", tagstring)--HaidaoBossbaoxiang
    gg.setValues({
        {address = tags1 + 0x18, flags = 4, value = 1},
        {address = tags2 + 0x18, flags = 4, value = 1}
    })
    gg.addListItems({{address = tags2 + 0x20, flags = 32, value = tagstring, freeze = true}})
    print(string.format("%X",entity))
    gg.sleep(500)
    return entity
end

function zb()--getid
inject.shellcode(r__p_xa+0xA540D00,"FF0302D1FD7B02A9200080D2A3E78C96B0000058000600F8FD7B42A9FF030291C0035FD6")
gg.setValues({{address=r__p_xa+0xA540D00+0x24, flags=32, value=cacgepage}})
inject.shellcode(r__p_xa+0xA1307A8,"56411014")
gg.sleep(100)
inject.shellcode(r__p_xa+0xA1307A8,"FE0F1EF8")
ViewID=gg.getValues({{address = cacgepage, flags = 32}})[1].value
idnumber=gg.getValues({{address = ViewID+0x20, flags = 4}})[1].value
return ViewID,idnumber
end



function zw(x,y)
zb()
SHILIID=idnumber
hd()
cw()
zwz("SceneUsable_SDCBox_ECS",SHILIID,ViewID,entity,x,0.5,y)--SceneUsable_SDCBox_ECS
gg.sleep(3000)
end

--[[
SceneUsable_SDCBox_ECS
NewbieRareBox 1001024  垃圾
NewbieNormalBox1 1001023
NewbieNormalBox2 1001025
HaidaoZhongjibaoxiang 1012002   垃圾
HaidaoDijibaoxiang 1012001
HaidaoMaomaoxiang 1012009  垃圾  刷甲的
HaidaoXiaobaoxianxiang 1012006
]]

function Main()
menu = gg.multiChoice({
        "Z字形",
        "横着刷",
        "竖着刷",
        "横竖都刷",
        "退出",
}, nil, os.date("摸金专用"))
if menu == nil then else
if menu[1] == true then z() end
if menu[2] == true then heng() end
if menu[3] == true then shu() end
if menu[4] == true then hs() end
if menu[5] == true then os.exit() end
end
XGCK=-1
end

function z()
xz=xztz(rw_p_cd,0x274C08, 0xB8, 0x48, 0x30, 0x6c)
x=gg.getValues({{address=xz,flags=16}})[1].value
y=gg.getValues({{address=xz+0x8,flags=16}})[1].value
gg.alert("自身x"..x.."\n自身y"..y)
for i=0,5 do
zw(x+i,y)
end
zw(x+4,y-1)
zw(x+3,y-2)
zw(x+2,y-3)
zw(x+1,y-4)
for i=0,5 do
zw(x+i,y-5)
end
end

function heng()
xz=xztz(rw_p_cd,0x274C08, 0xB8, 0x48, 0x30, 0x6c)
x=gg.getValues({{address=xz,flags=16}})[1].value
y=gg.getValues({{address=xz+0x8,flags=16}})[1].value
gg.alert("自身x"..x.."\n自身y"..y)
for i=1,15 do
zw(x+i,y)
end
end

function shu()
xz=xztz(rw_p_cd,0x274C08, 0xB8, 0x48, 0x30, 0x6c)
x=gg.getValues({{address=xz,flags=16}})[1].value
y=gg.getValues({{address=xz+0x8,flags=16}})[1].value
gg.alert("自身x"..x.."\n自身y"..y)
for i=1,15 do
zw(x,y+i)
end
--[[
gg.addListItems({
    {address = perfab, flags = 4, name = "perfab"},
    {address = stringclass, flags = 4, name = "stringclass"},
    {address = stringclass2, flags = 4, name = "stringclass2"},
    {address = fids, flags = 4, name = "fids"},
    {address = fvalues, flags = 4, name = "fvalues"},
    {address = fviewid, flags = 4, name = "fviewid"},
    {address = tagstring, flags = 4, name = "tagstring"},
    {address = cacgepage, flags = 4, name = "cacgepage"}
})
]]
end

function hs()
xzcnm=gg.prompt({"横刷几个","竖刷几个"},{"10","10"},{"number","number"})
    xz = xztz(rw_p_cd, 0x274C08, 0xB8, 0x48, 0x30, 0x6c)
    x = gg.getValues({{address = xz, flags = 16}})[1].value
    y = gg.getValues({{address = xz + 0x8, flags = 16}})[1].value
    gg.alert("自身x" .. x .. "\n自身y" .. y)
    for a = 0, xzcnm[2] do--竖
        for b = 0, xzcnm[1] do--横
            zw(x + b, y - a)
            gg.sleep(500)
        end
    end
end

while true do
    if gg.isVisible(true) then
        XGCK = 0
        gg.setVisible(false)
    end
    if XGCK == 0 then
        Main()
    end
end