local json =json--调用 local g = {} g.file = gg.getFile() g.sel = nil gqlb={"请先搜索歌曲",} idb={"1010"} SN,gc=1,nil g.config = gg.getFile():gsub("%lua$", "").."cfg" function bei() g.data = loadfile("音乐配置"..g.config) if g.data ~= nil then g.sel = g.data() g.data = nil end if g.sel == nil then g.sel = {"","10"} end end bei() function readPointer(name, offset, i) local re = gg.getRangesList(name) local x64 = gg.getTargetInfo().x64 local va = {[true]=32, [false]=4} if re[i or 1] then local addr = re[i or 1].start + offset[1] for i = 2, #offset do addr = gg.getValues({{address=addr, flags=va[x64]}}) if not x64 then addr[1].value = addr[1].value & 0xFFFFFFFF end addr = addr[1].value + offset[i] end return addr end end ---- function PS() end function setvalue(address,flags,value) PS('修改地址数值(地址,数值类型,要修改的值)') local tt={} tt[1]={} tt[1].address=address tt[1].flags=flags tt[1].value=value gg.setValues(tt) end--静态配置 function start(name,sl) fw=gg.makeRequest("http://music.163.com/api/search/get?s="..name.."&type=1&offset=0&total=true&limit="..sl) return fw end function play(id,name) gg.toast("正在播放音乐："..name,true) gg.playMusic("http://music.163.com/song/media/outer/url?id="..id..".mp3") end function Play(gqlb,idb) SN = gg.choice(gqlb,nil,ts) if SN == nil then XGCK =-1 else sn=gg.choice({"播放歌曲","播放并下载"},nil,"歌曲："..gqlb[SN]) if sn == nil then end if sn == 1 then play(idb[SN],gqlb[SN]) end if sn == 2 then local XEY=gg.makeRequest("http://music.163.com/song/media/outer/url?id="..idb[SN]..".mp3").content local XEY1=gg.getFile():gsub("[^/]+$","")..gqlb[SN]..".mp3" io.open(XEY1,"w"):write(XEY) gg.alert("提示:\n\n音乐已成功下载位置:\n\n"..XEY1) end XGCK=-1 end end function zjson(jsonr) local str = jsonr local pattern = "\"[%w]+\":" string.gsub(str, pattern, function(v) if string.find(str, v) then str = string.gsub(str, v, string.gsub(v, "\"", "")) end end) str = string.gsub(str, ":", "=") str = string.gsub(str, "%[", "{") str = string.gsub(str, "%]", "}") local data = "-- WSG PRO 1.0.9(109)\nreturn " .. str local res = load(data)() return res end function json(con) res=zjson(con) zd=res.result.songCount pd=go3-zd if pd <= 0 then else go3=zd end ts="《"..go1.."》找到"..zd.."首歌曲，当前显示"..go3.."首" gqlb={} idb={} for i=1,go3 do gqlb[i]=res.result.songs[i].name idb[i]=res.result.songs[i].id end end function init() stab=分页 ttitle=标题 xfcpic=悬浮窗图标 end loadYunLuaGroup("5C3C4E3813681C4C204C35346F1B4C2F7EFF612D2B22176DCA84CB8CFE5F350E1D4733067DCC9F")--云模块勿动 --[免费UI] 代号E02PROMaterial3 作者长宁1655417786（原作者长宁Q1903351873定制200起 带详细需求来 其他事不管 不包使用教程） --此UI仅支持ELGG使用 --ELGG官方Q群759522588 --支持的控件有： --文字： --changning.text([string 文字] , [颜色RGB十六进制]（可省略） , [string 大小sp]（可省略） , [bool 写true居中false或留空不居中]（可省略）) --第二第三第四参数可省略 详情看下方例子 --颜色可以是string '#ffffffff' 也可以是十六进制 0xffffffff 注意格式不要混 --按钮： --changning.button([string 文字] , [function 功能] , [string 颜色RGB十六进制]（可省略）) --颜色可以是string '#ffffffff' 也可以是十六进制 0xffffffff 注意格式不要混 --注意只传入一个function不要与switch搞混 --switch开关： --changning.switch([string 文字] , [function 功能开] , [function 功能关] , [string 描述]（可省略）) --changning.switch2([string 文字] , [function 功能开] , [function 功能关] , [string 描述]（可省略）) --changning.switch3([string 文字] , [function 功能开] , [function 功能关] , [string 描述]（可省略）) --第四参数描述可省略 详情看下方例子 --注意需传入两个function不要与button搞混 --checkbox小开关列表 --changning.check([table]) --比较复杂这里不说了 看下边例子 按需复制粘贴 只需要搞懂基础语法就能用 不要问我 local function MaterialAlert() local alertBuilder = MaterialAlertDialogBuilder(context) alertBuilder.setTitle("公告").setMessage("有问题联系QQ:1655417786").setPositiveButton("确定") local LayoutParams = luajava.bindClass('android.view.WindowManager$LayoutParams') local alert = alertBuilder.create() alert.getWindow().setType(gg.ANDROID_SDK_INT >= 26 and LayoutParams.TYPE_APPLICATION_OVERLAY or LayoutParams.TYPE_PHONE) alert.show() end luajava.runOnUiThread(MaterialAlert) -- UI 线程运行 --这里写你的验证、前置功能函数，下边UI配置区写按钮调用 function a()--例子，下方UI调用 gg.alert(6) end drawText("Rhea枪战","#FF0000",160,190) drawText("官方群1073094671","#FF0000",150,250) 悬浮窗图标='https://wp.kayyw.com/f/L9OWik/Image_1780118943410_157.jpg' --写图片文件直链 标题='长宁UI' 分页 = { --导航栏分页名字和图标，添加表即可加页数，需要与功能配置页面数量对应 '公告', '防封', '刷号', '竞赛', '音乐', '设置', --'设置',--这样添加新页面 } init()--传递变量勿动 uistart({--每一个功能页面需要有上边分页名字对应，多出来的不显示，少了需要补充 {--1 changning.text('Rhea牛逼官方群1073094671','#005BFF','14sp'), changning.text('--检测必需全部开启--','#000000','12sp',true), changning.text('','#000000','12sp',true), changning.button( '选择进程', function() gg.setProcessX() end), },{--2 changning.text('部分功能会闪退','#005BFF','14sp'), changning.text('','#005BFF','14sp'), changning.text('演戏等于稳定','#000000','12sp',true), changning.switch( "一键全防(登录开)①", function () gg.loopKillGG() local so = gg.getRangesList("libtersafe2.so")[1].start gg.setValues({ { address = so + 0x4FD600, flags = 4, value = -698416192 }, { address = so + 0x4FD61C, flags = 4, value = -698416192 }, { address = so + 0x4FD62C, flags = 4, value = -698416192 }, { address = so + 0x4FD64C, flags = 4, value = -698416192 }, { address = so + 0x4FD65C, flags = 4, value = -698416192 }, { address = so + 0x4FD69C, flags = 4, value = -698416192 }, }) gg.alert('全防开启成功') string.toMusic('全防开启成功') gg.toast("全防开启成功") end), changning.switch( "防行为(大厅开)③", function () for i = 1, 45 do if SO['行为'..i] then SO_PT(SO['行为'..i], 4, "~A8 MOV X0, XZR") end end gg.alert('防行为开启成功') string.toMusic('防止行为开启成功') gg.toast("防行为开启成功") end, function() end), changning.switch("隐藏信息" , function() function SO_PT(FUNCTIONADD, TYPE, VALUE) local SOMOD = gg.getRangesList("il2cpp.so") if SOMOD[2] == nil then gg.alert("开启失败\n━━━━━━━━━━━━━━━\n错误原因:未找到相关内存\n解决方法:请重新选择游戏进程\n━━━━━━━━━━━━━━━") else gg.setValues({ { address = SOMOD[2].start + FUNCTIONADD, flags = TYPE, value = VALUE } }) gg.setValues({ { address = SOMOD[2].start + FUNCTIONADD + 4, flags = TYPE, value = "~A8 RET" } }) gg.setValues({ { address = SOMOD[2].start + FUNCTIONADD + 8, flags = 16, value = "1740" } }) end end SO_PT(SO['隐藏1'] ,4,"~A8 MOV W0, WZR") SO_PT(SO['隐藏2'] ,4,"~A8 MOV W0, WZR") SO_PT(SO['隐藏3'] ,4,"~A8 MOV W0, WZR") SO_PT(SO['隐藏4'] ,4,"~A8 MOV W0, WZR") SO_PT(SO['隐藏5'] ,4,"~A8 MOV W0, #1") gg.alert ( '隐藏信息开启成功' ) end), changning.switch("时间检测[必须要开]" , function() SO_PT(SO['新时刻'],4,"~A8 MOV W0, #1")--新时刻 SO_PT(SO['最佳时间'],4,"~A8 MOV W0, #1")--最佳时间 SO_PT(SO['作弊时间'],4,"~A8 MOV W0, WZR")--作弊时间 SO_PT(SO['防举报1'],4,"~A8 MOV W0, WZR")--防举报1 SO_PT(SO['防举报2'],4,"~A8 MOV W0, WZR")--防举报2 SO_PT(SO['防举报3'],4,"~A8 MOV W0, WZR")--防举报3 SO_PT(SO['防举报4'],4,"~A8 MOV W0, WZR")--防举报4 SO_PT(SO['屏蔽时间检10'],4,"~A8 MOV W0, #1")--屏蔽时间检测1 SO_PT(SO['屏蔽时间检9'],4,"~A8 MOV W0, #1")--屏蔽时间检测2 SO_PT(SO['一分40秒2'],4,"~A8 MOV W0, #1")--屏蔽时间检测3 SO_PT(SO['一分40秒6'],4,"~A8 MOV W0, #1")--屏蔽时间检测4 SO_PT(SO['防封号1'], 4, "~A8 MOV X0, XZR") SO_PT(SO['防封号2'], 4, "~A8 MOV X0, XZR") SO_PT(SO['防封号3'], 4, "~A8 MOV X0, XZR") SO_PT(SO['防封号4'], 4, "~A8 MOV X0, XZR") SO_PT(SO['防封号5'], 4, "~A8 MOV X0, XZR") gg.toast("开启成功") string.toMusic("时间检测开启成功") end), },{--3 },{--4 changning.switch("过时间防" , function() SO['速度检测1'] = 0x2501504 SO['速度检测3'] = 0x3715720 SO['速度检测4'] = 0x27d9e6c SO['速度检测5'] = 0x2e5bb84 SO_PT(SO['速度检测1'],4,"~A8 MOV W0, WZR")--滑板速度检测 SO_PT(SO['速度检测2'],4,"~A8 MOV W0, WZR")--滑板速度检测 SO_PT(SO['速度检测3'],4,"~A8 MOV W0, WZR")--滑板速度检测 SO_PT(SO['速度检测4'],4,"~A8 MOV W0, WZR")--滑板速度检测 SO_PT(SO['速度检测5'],4,"~A8 MOV W0, WZR")--滑板速度检测 SO_PT(SO['新时刻'],4,"~A8 MOV W0, #1")--新时刻 SO_PT(SO['最佳时间'],4,"~A8 MOV W0, #1")--最佳时间 SO_PT(SO['作弊时间'],4,"~A8 MOV W0, WZR")--作弊时间 SO_PT(SO['屏蔽时间检10'],4,"~A8 MOV W0, #1")--屏蔽时间检测1 SO_PT(SO['屏蔽时间检9'],4,"~A8 MOV W0, #1")--屏蔽时间检测2 SO_PT(SO['防封号1'], 4, "~A8 MOV X0, XZR") SO_PT(SO['防封号2'], 4, "~A8 MOV X0, XZR") SO_PT(SO['防封号3'], 4, "~A8 MOV X0, XZR") SO_PT(SO['防封号4'], 4, "~A8 MOV X0, XZR") SO_PT(SO['防封号5'], 4, "~A8 MOV X0, XZR") string.toMusic('开启成功') end), changning.switch("断网状态" , function() gg.alert("使用方法: 道具赛开局开\n到跳秒结束后关闭\n一局一开") SO_PT(SO['断网1'] ,4,"~A8 MOV W0, #1") SO_PT(SO['断网2'] ,4,"~A8 MOV W0, #1") SO_PT(SO['断网3'] ,4,"~A8 MOV W0, #1") string.toMusic("断网状态开启成功") end, function () SO_PT(SO['断网1'] ,4,"~A8 MOV W0, WZR") SO_PT(SO['断网2'] ,4,"~A8 MOV W0, WZR") SO_PT(SO['断网3'] ,4,"~A8 MOV W0, WZR") string.toMusic("断网状态恢复成功") end), changning.box({"修改数据", changning.switch("美化段位" , function() BL=gg.prompt({"请输入你要修改的段位\n1青铜\n2白银\n3黄金\n4铂金\n5钻石\n6王者"},{"6"},{"text"})[1] SO_PT(SO['段位'],4,"~A8 MOV W0, #"..BL.."") string.toMusic('段位美化成功') end), changning.switch("美化星数" , function() BL=gg.prompt({"请输入你要修改的星星数量"},{"520"},{"text"})[1] SO_PT(SO['星数'],4,"~A8 MOV W0, #"..BL.."") string.toMusic('星数美化成功') end), changning.switch("美化国标" , function() SO_PT(SO['全服'],4,"~A8 MOV W0, #"..gg.prompt({"输入你想要的排名"},{"1"},{"text"})[1]) string.toMusic('全服排名美化成功') end), changning.switch("美化省标" , function() SO_PT(SO['省标'],4,"~A8 MOV W0, #"..gg.prompt({"输入你想要的排名"},{"1"},{"text"})[1]) string.toMusic('省份排名美化成功') end), }), changning.box({"道具赛", changning.switch("buff聚能" , function() SO_PT(SO['Buff模式'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['Buff模式'] ,SO['获取能量2']).."]") SO_PT(SO['跳跃'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['跳跃'] ,SO['获取能量2']).."]") SO_PT(SO['下滑'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['下滑'] ,SO['获取能量2']).."]") SO_PT(SO['下滑左'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['下滑左'] ,SO['获取能量2']).."]") SO_PT(SO['下滑右'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['下滑右'] ,SO['获取能量2']).."]") string.toMusic("Buff聚能开启成功") end), changning.switch("走路聚能(慢)" , function() SO_PT(SO['Buff模式'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['Buff模式'] ,SO['获取能量2']).."]") string.toMusic("Buff聚能开启成功") end), changning.switch("走路聚能(快)" , function() SO_PT(SO['Buff模式'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['Buff模式'] ,SO['获取能量2']).."]") string.toMusic("Buff聚能开启成功") end), changning.switch("能量倍增" , function() SO_PT(SO['跳跃'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['跳跃'] ,SO['获取能量2']).."]") SO_PT(SO['下滑'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['下滑'] ,SO['获取能量2']).."]") string.toMusic("能量倍增开启成功") end), changning.switch("新量倍增" , function() SO_PT(SO['跳跃'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['跳跃'],SO['获取能量2']).."]") SO_PT(SO['下滑1'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['下滑1'],SO['获取能量2']).."]") SO_PT(SO['Buff模式'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['Buff模式'],SO['获取能量2']).."]") string.toMusic("新版能量倍增开启成功") end), changning.switch("超量倍增" , function() SO_PT(SO['跳跃'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['跳跃'] ,SO['获取能量2']).."]") SO_PT(SO['下滑1'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['下滑1'] ,SO['获取能量2']).."]") SO_PT(SO['下滑'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['下滑'] ,SO['获取能量2']).."]") SO_PT(SO['下滑中'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['下滑中'] ,SO['获取能量2']).."]") SO_PT(SO['下滑左'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['下滑左'] ,SO['获取能量2']).."]") SO_PT(SO['下滑右'] ,4,"~A8 B [PC,#"..SOGSPY_ST(SO['下滑右'] ,SO['获取能量2']).."]") string.toMusic("超强能量倍增Pro开启成功") end), changning.switch("图标聚能" , function() SO_PT(SO['点击道具'],4,"~A8 B [PC,#"..SOGSPY_ST(SO['点击道具'] ,SO['获取能量2']).."]") string.toMusic("点击道具图标获取能量开启成功") end), changning.switch("能量穿透" , function() SO_PT(SO['能量穿透'] ,4,"~A8 MOV W0, WZR") string.toMusic("己为您开启能量穿透") end), changning.switch("过滤10秒", function() SO_PT( 0x2a2cebc,4, "~A8 MOV W0, #1") gg.alert('过滤10秒开启成功') end, function() end), changning.switch("退出游戏", function() local lib = gg.getRangesList() do do for _FORV_4_ in ipairs(lib) do if string.find(lib[_FORV_4_].name, "libil2cpp.so") and lib[_FORV_4_].state == "Xa" and lib[_FORV_4_].type == "r-xp" then module = lib[_FORV_4_].start break end end end end hook = {StaticUpdater = 0x1998c20} function HookCall(set) local action = module + set.hook local recover = gg.getValues({ {address = action, flags = 4} })[1].value local offset = function(a, b) if b <= a then return string.format("-0x%X", a - b) else return string.format("0x%X", b - a) end return 0 end local original = {} do do for _FORV_8_, _FORV_9_ in pairs(set.method) do original[#original + 1] = { address = action, flags = 4, value = "~A8 B [PC,#" .. offset(action, module + _FORV_9_) .. "]" } end end end original[#original + 1] = { address = action, flags = 4, value = recover } do do for _FORV_8_ in ipairs(original) do gg.setValues({ original[_FORV_8_] }) gg.sleep(math.random(28, 35)) end end end return true end HookCall({ method = {0x25dd11c}, -- RealPVPDisconnectPopup,Open hook = hook.StaticUpdater }) gg.toast("开启成功") string.toMusic("开启成功") end), changning.switch("半自动上分" , function() function SO_PT(FUNCTIONADD, TYPE, VALUE) local SOMOD = gg.getRangesList("il2cpp.so") if SOMOD[2] == nil then gg.alert("开启失败\n━━━━━━━━━━━━━━━\n错误原因:未找到相关内存\n解决方法:请重新选择游戏进程\n━━━━━━━━━━━━━━━") else gg.setValues({ { address = SOMOD[2].start + FUNCTIONADD, flags = TYPE, value = VALUE } }) gg.setValues({ { address = SOMOD[2].start + FUNCTIONADD + 4, flags = TYPE, value = "~A8 RET" } }) gg.setValues({ { address = SOMOD[2].start + FUNCTIONADD + 8, flags = 16, value = "1740" } }) end end SO_PT(SO['微加速'],4,"~A8 LDR S0, [PC,#0x8]")--微加速 SO_PT(SO['反弹道具1'] ,4,"~A8 MOV W0, #1","~A8 RET") SO_PT(SO['反弹道具2'] ,4,"~A8 MOV W0, WZR","~A8 RET") SO_PT(SO['无视障碍'],4,"~A8 MOV W0, #1") string.toMusic('开启成功') end), changning.switch("敌人进不去" , function() local so = gg.getRangesList("libil2cpp.so")[2].start local py = 0x319468C local set = { {address = so + 0x276878c, flags = 4, value = "~A8 B [PC,#0xF1740]"}, } gg.setValues(set) gg.addListItems(set) -- 将表添加到保存列表 print(set) -- 将表给打印出来 gg.toast("开启成功") string.toMusic("开启成功") end), changning.switch("无视道具", function () SO_PT(SO['无视道具1'],4,"~A8 MOV W0, #1")--无视道具 SO_PT(SO['无视道具2'],4,"~A8 MOV W0, #1")--无视道具 string.toMusic("己为您开启无视道具") end, function () end), changning.switch("无视障碍", function () SO_PT(SO['无视障碍'],4,"~A8 MOV W0, #1") SO_PT(SO['无视侧撞'] ,4,"~A8 MOV W0, #1") SO_PT(SO['减速带'],4,"~A8 MOV W0, WZR") string.toMusic("己为您开启无视障碍") end, function () end), changning.switch("弹射起步", function() -- 通用函数：根据模块名和状态取基址 function _lib(libs, state) local lib = gg.getRangesList(libs) for _, v in ipairs(lib) do if v.state == state then return v.start end end return nil end -- 1. 先拿到 il2cpp 基址 local base = _lib('il2cpp', 'Xa') if not base then print('找不到 il2cpp，脚本结束') os.exit() end -- local addr1 = base + SO['弹射起步'] gg.setValues({ -- 第 1 组 {address = addr1, flags = 4, value = '~A8 LDR S0, [PC,#0x8]'}, {address = addr1 + 4, flags = 4, value = '~A8 RET'}, {address = addr1 + 8, flags = 16, value = 9999}, -- 第 2 组 }) SO_PT(SO['攻击拾取'], 4, "~A8 RET") string.toMusic('开启成功') gg.alert("开启成功") end, function() end), changning.switch ("后程加速" , function () SO_PT(SO['攻击拾取'], 4, "~A8 RET") -- 通用函数：根据模块名和状态取基址 function _lib(libs, state) local lib = gg.getRangesList(libs) for _, v in ipairs(lib) do if v.state == state then return v.start end end return nil end -- 1. 先拿到 il2cpp 基址 local base = _lib('il2cpp', 'Xa') if not base then print('找不到 il2cpp，脚本结束') os.exit() end -- local addr1 = base + SO['后程加速'] gg.setValues({ -- 第 1 组 {address = addr1, flags = 4, value = '~A8 LDR S0, [PC,#0x8]'}, {address = addr1 + 4, flags = 4, value = '~A8 RET'}, {address = addr1 + 8, flags = 16, value = 99999}, -- 第 2 组 }) gg.toast("开启成功") string.toMusic("开启成功") end), changning.switch("反弹道具" , function() SO_PT(SO['反弹道具1'] ,4,"~A8 MOV W0, #1") SO_PT(SO['反弹道具2'] ,4,"~A8 MOV W0, WZR") string.toMusic("反弹道具开启成功") end, function() SO_PT(SO['反弹道具2'] ,4,"~A8 MOV W0, WZR") SO_PT(SO['反弹道具1'] ,4,"~A8 MOV W0, #1") string.toMusic("反弹道具关闭成功") end, function () end), changning.switch("开局道具" , function() a = gg.prompt({'道具代码:\n1=恶魔 2=乌龟 3=颜料 4=能量10%[1;4]'},{[1]=2},{[1]='number'})[1] if not a then return end SO_PT(SO['开局道具'],4,"~A8 MOV W0, #"..a.."","~A8 RET") string.toMusic("开局道具修改成功") end, function () end), changning.switch("无限滑板[安全]", function() function _lib(libs, state) local lib = gg.getRangesList(libs) for seed in ipairs(lib) do if lib[seed].state == state then return lib[seed].start end end end function zhix() local il2cpp_start = _lib('il2cpp', 'Xa') local targetOffset = il2cpp_start + SO['点击'] local getClass = il2cpp_start + SO['结尾'] local destinationOffset = il2cpp_start + SO['状态'] local ReleaseEnergyOffset = il2cpp_start + SO['释放能量'] local CollectPropOffset = il2cpp_start + SO['攻击拾取'] local register = { [0] = {0xB8, 32, 0}; [1] = {0x208, 4, 5}; [2] = {0x20C, 16, 80}; [3] = {0x210, 4, 0}; [4] = {0x214, 4, 1}; [5] = {0x218, 32, destinationOffset}; } local mmap = gg.allocatePage(1 | 2 | 4) + 8 local table_correct = { { address = mmap + ( #register + 1) * 4, flags = 4, value = '~A8 BR X5' }, {address = ReleaseEnergyOffset, flags = 4, value = '~A8 MOV W0, #1'}, {address = ReleaseEnergyOffset + 4, flags = 4, value = '~A8 RET'}, {address = CollectPropOffset, flags = 4, value = '~A8 RET'}, {address = targetOffset, flags = 4, value = '~A8 LDR X1, [PC,#0x8]'}, {address = targetOffset + 4, flags = 4, value = '~A8 BR X1'}, {address = targetOffset + 8, flags = 32, value = mmap}, {address = getClass, flags = 4, value = '~A8 LDR X2, [PC,#0x8]'}, {address = getClass + 4, flags = 4, value = '~A8 BR X2'}, { address = getClass + 8, flags = 32, value = (mmap - 8) }, { address = (mmap - 8), flags = 4, value = '~A8 STR X0, [X2,#0xC0]' }, { address = (mmap - 4), flags = 4, value = '~A8 RET' }, } for search = 0, #register do table_correct[ #table_correct + 1], table_correct[ #table_correct + 2] = { address = mmap + search * 4, flags = 4, value = '~A8 LDR X' .. search .. ', [PC,#' .. string.format('0x%X', register[search][1]) .. ']' }, { address = mmap + (search * 4) + register[search][1], flags = register[search][2], value = register[search][3] } end return gg.setValues(table_correct) end zhix() gg.alert("配置已完成修改 请在局内使用") end), }), changning.box({"分数赛", changning.switch("分数过检", function() SO_PT(SO['行为弹窗'] ,4, "~A8 RET") function setvalue(address, flags, value) local tt = {} tt[1] = {} tt[1].address = address tt[1].flags = flags tt[1].value = value gg.setValues(tt) end --[1].楠业地址:7679D7D6AC 楠业数值:-698416192 so=gg.getRangesList('libtersafe2.so')[1].start py=0x4FD6AC--tsssdksetus setvalue(so+py,4,-698416192) --[2].楠业地址:7679D7D6DC 楠业数值:-698416192 so=gg.getRangesList('libtersafe2.so')[1].start py=0x4FD6DC--tsssdkseex setvalue(so+py,4,-698416192) --[3].楠业地址:7679D7D6FC 楠业数值:-698416192 so=gg.getRangesList('libtersafe2.so')[1].start py=0x4FD6FC---tp2seinfo setvalue(so+py,4,-698416192) --[4].楠业地址:7679D7D73C 楠业数值:-698416192 so=gg.getRangesList('libtersafe2.so')[1].start py=0x4FD73C----tssgetdata2 setvalue(so+py,4,-698416192) gg.toast("限制已跳过") end), changning.switch("修改倍数[30/107]", function() SO_PT(SO['得分倍增'],4,"~A8 MOV W0, #107") gg.toast("倍数修改107级成功") end, function() SO_PT(SO['得分倍增'],4,"~A8 MOV W0, #30") string.toMusic("倍数修改30级成功") end), changning.switch("修改速度", function() local lib = gg.getRangesList() for _ in ipairs(lib) do if string.find(lib[_].name, 'libil2cpp.so') and lib[_].state == 'Xa' and lib[_].type == 'r-xp' then module = lib[_].start break end end function returnValue(set) local inputRegister local page = module + set[1] local mmap = set[4] local setva = { {address = mmap + 0x4, flags = 4, value = '~A8 BR X30'}, {address = mmap + set[2], flags = 16, value = set[3]}, {address = page, flags = 4, value = '~A8 LDR X0, [PC,#0x8]'}, {address = page + 0x4, flags = 4, value = '~A8 BR X0'}, {address = page + 0x8, flags = 32, value = mmap}, } if set[3] % 1 == 0 then inputRegister = 'X0' else inputRegister = 'S0' end table.insert(setva, {address = mmap, flags = 4, value = '~A8 LDR '..inputRegister..', [PC,#'..string.format('0x%X', set[2])..']'}) return gg.setValues(setva) end returnValue{ SO['人物速度'], 0x3BC, 417.5, gg.allocatePage(gg.PROT_READ | gg.PROT_WRITE | gg.PROT_EXEC), } string.toMusic('速度修改成功') end), changning.switch("下滑穿透", function() gg.alert("开启稍慢") search(4.5,16) py1(5.5,16,16) xg1(9191,16,0,true) xg1(9192,16,16,true) string.toMusic("开启成功") end), }), changning.box({"无尽", changning.switch("人物大跳", function() local qmnb= { {['memory']=32}, {['name']='人物大跳'}, {['value']=1091567616, ['type']=32}, {['lv']=20.0,['offset']=-608, ['type']=16}, {['lv']=1.0,['offset']=12, ['type']=16}, {['lv']=10.0,['offset']=16, ['type']=16}, } local qmxg= { {['value']=60.0,['offset']=-608,['type']=16,['freeze']=true}, } xqmnb(qmnb,qmxg) string.toMusic("已为您开启") end, function() local qmnb= { {['memory']=32}, {['name']='恢复大跳'}, {['value']=1091567616, ['type']=32}, {['lv']=60.0,['offset']=-608, ['type']=16}, {['lv']=1.0,['offset']=12, ['type']=16}, {['lv']=10.0,['offset']=16, ['type']=16}, } local qmxg= { {['value']=20.0,['offset']=-608,['type']=16,['freeze']=true}, } xqmnb(qmnb,qmxg) end), changning.switch('平板视角',function() search(1.5,16,32) py1(33,16,0xC) py1(20,16,0x18) xg1(45,16,0x1C,true) string.toMusic('平板视角开启成功') end, function() search(1.5,16,32) py1(33,16,0xC) py1(20,16,0x18) xg1(40,16,0x1C,true) end), changning.switch("无尽装死", function() SO_PT(SO['无尽装死'],4,"~A8 MOV W0, #1") end), changning.switch("无限跳跃", function() SO_PT(SO['无限跳跃'],4,"~A8 MOV W0, #1") end), changning.switch("滑板飞翔", function() SO_PT(SO['滑板滑翔'],4,"~A8 MOV W0, #1") end, function() SO_PT(SO['滑板滑翔'],4,"~A8 MOV W0, #1") end), changning.switch("滑板跳高", function() SO_PT(SO['滑板跳高'],4,"~A8 MOV W0, #1") end, function() SO_PT(SO['滑板跳高'],4,"~A8 MOV W0, WZR") end), changning.switch("滑板瞬移", function() SO_PT(SO['滑板瞬移'],4,"~A8 MOV W0, #1") end, function() SO_PT(SO['滑板瞬移'],4,"~A8 MOV W0, WZR") end), changning.switch('金币消失', function() SO_PT(SO['金币消失'],4,'~A8 MOV W0, WZR') end), }), },{--5 changning.switch( "播放音乐", function() search = gg.prompt({ "输入要搜索的歌曲\n可加上歌手名字", "设置显示数量(数字)", },g.sel,{ "text", }) if not search then return end gg.saveVariable(search,g.config) bei() go1=search[1] go3=search[2] jg=start(go1,go3) if jg.code == 200 then fh=jg.content fh=json(fh) --print(fh) Play(gqlb,idb) else function inspect() gg.alert("访问网络异常，错误代码：\n\n"..jg.code) end if not pcall(inspect) then print("网络异常，请先连接上网络") os.exit() end end XGCK=-1 end, function() end ), },{--6 changning.switch( "退出", function() Lock.unUi() end, function() end), }, }) Lock.Ui(invoke,nil,function(err) print(err) end)