-- ============================================================
-- 此脚本已加密，请勿修改
-- ============================================================

local function NvznWBeYCQuwXIi(a, b)
local c = a + b
local d = a * b
if c > d then
return c - d
else
return d - c
end
end
local function RDlMhxBkyGbyjNx(a, b)
local c = a + b
local d = a * b
if c > d then
return c - d
else
return d - c
end
end
local function eZeKAAVxWatVPHj(a, b)
local c = a + b
local d = a * b
if c > d then
return c - d
else
return d - c
end
end
local function oaNwkvSOiDIEEDy(a, b)
local c = a + b
local d = a * b
if c > d then
return c - d
else
return d - c
end
end
local function zYdSytOGCNqKzpQ(a, b)
local c = a + b
local d = a * b
if c > d then
return c - d
else
return d - c
end
end
local luaVersion = "1.0"
local luaNoticeId = 624
local luaIcon= "https://pan.29o.cn/view.php/1fa4d1a0f8a92f6e8405f7b29ef52e41.png"
local authConfig = {
appId = "1613",
appKey = "MvQchKNsEgsmVjXXnBXViUqWOcdcamgG",
signature = {
type = "MD5",
rule = 1
},
encryption = {
type = "RC4",
key = "ZpNbJqjqZ85Z170kiL9byg6bpUq7rkwb"
},
antiHijack = true,
encode = "HEX",
code = 1
}
local ArtAuth = {}
ArtAuth.__index = ArtAuth
assert(luajava, "请使用Luajava修改器执行")
local webUrl = "https://auth.iema.cn"
local function md5(str)
return string.md5(str)
end
local function sha1(str)
return string.sha1(str)
end
local function sha256(str)
return string.sha256(str)
end
local JSON = {}
do
local controls = {["\n"]="\\n", ["\r"]="\\r", ["\t"]="\\t", ["\b"]="\\b", ["\f"]="\\f", ["\""]="\\\"", ["\\"]="\\\\"}
local function isArray(t)
local max = 0; for k, _ in pairs(t) do if type(k) ~= "number" then return false end if k > max then max = k end end
return max == #t
end
function JSON.encode(value)
local t = type(value)
if t == "string" then return '"' .. value:gsub("[%z\1-\31\"\\%z]", controls) .. '"'
elseif t == "number" or t == "boolean" then return tostring(value)
elseif t == "table" then
local res, is_arr = {}, isArray(value)
if is_arr then
for _, v in ipairs(value) do table.insert(res, JSON.encode(v)) end
return "[" .. table.concat(res, ",") .. "]"
else
for k, v in pairs(value) do table.insert(res, JSON.encode(tostring(k)) .. ":" .. JSON.encode(v)) end
return "{" .. table.concat(res, ",") .. "}"
end
elseif t == "nil" then return "null"
else return tostring(value) end
end
local function parse_value(str, pos)
local _, j = string.find(str, "^%s*", pos)
pos = j + 1
local char = string.sub(str, pos, pos)
if char == '"' then
local e = string.find(str, '"', pos + 1)
while e do
local backslashes = 0
local i = e - 1
while i >= pos and string.sub(str, i, i) == '\\' do backslashes = backslashes + 1; i = i - 1 end
if backslashes % 2 == 0 then break end
e = string.find(str, '"', e + 1)
end
if not e then return nil, pos end
local content = string.sub(str, pos + 1, e - 1)
content = content:gsub('\\["\\/bfnrt]', {['"']='"', ['\\']='\\', ['/']='/', ['b']='\b', ['f']='\f', ['n']='\n', ['r']='\r', ['t']='\t'})
return content, e + 1
elseif char == '{' then
local obj = {}; pos = pos + 1
while true do
_, j = string.find(str, "^%s*", pos); pos = j + 1
if string.sub(str, pos, pos) == '}' then return obj, pos + 1 end
local key; key, pos = parse_value(str, pos)
_, j = string.find(str, "^%s*", pos); pos = j + 1
if string.sub(str, pos, pos) ~= ':' then return nil, pos end
local val; val, pos = parse_value(str, pos + 1)
obj[key] = val
_, j = string.find(str, "^%s*", pos); pos = j + 1
if string.sub(str, pos, pos) == ',' then pos = pos + 1 end
end
elseif char == '[' then
local arr = {}; pos = pos + 1
while true do
_, j = string.find(str, "^%s*", pos); pos = j + 1
if string.sub(str, pos, pos) == ']' then return arr, pos + 1 end
local val; val, pos = parse_value(str, pos)
table.insert(arr, val)
_, j = string.find(str, "^%s*", pos); pos = j + 1
if string.sub(str, pos, pos) == ',' then pos = pos + 1 end
end
else
local num_str = string.match(str, "^-?%d+%.?%d*[eE]?[+-]?%d*", pos)
if num_str then return tonumber(num_str), pos + #num_str end
if string.sub(str, pos, pos+3) == 'true' then return true, pos + 4 end
if string.sub(str, pos, pos+4) == 'false' then return false, pos + 5 end
if string.sub(str, pos, pos+3) == 'null' then return nil, pos + 4 end
return nil, pos
end
end
function JSON.decode(str)
local status, res = pcall(parse_value, str, 1)
if status then return res else return nil end
end
end
local hash_funcs = {
MD5 = md5,
SHA1 = sha1,
SHA256 = sha256
}
local function rc4(data, key)
local s, j = {}, 0
for i = 0, 255 do s[i] = i end
for i = 0, 255 do
j = (j + s[i] + string.byte(key, (i % #key) + 1)) % 256
s[i], s[j] = s[j], s[i]
end
local i, k, res = 0, 0, {}
j = 0
for x = 1, #data do
i = (i + 1) % 256
j = (j + s[i]) % 256
s[i], s[j] = s[j], s[i]
table.insert(res, string.char(math.floor(string.byte(data, x) ~ s[(s[i] + s[j]) % 256])))
end
return table.concat(res)
end
local b64chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
local function toBase64(data)
return ((data:gsub('.', function(x)
local r,b='',x:byte()
for i=8,1,-1 do r=r..(b%2^i-b%2^(i-1)>0 and '1' or '0') end
return r;
end)..'0000'):gsub('%d%d%d?%d?%d?%d?', function(x)
if (#x < 6) then return '' end
local c=0
for i=1,6 do c=c+(x:sub(i,i)=='1' and 2^(6-i) or 0) end
return b64chars:sub(c+1,c+1)
end)..({ '', '==', '=' })[#data%3+1])
end
local function fromBase64(data)
data = string.gsub(data, '[^'..b64chars..'=]', '')
return (data:gsub('.', function(x)
if (x == '=') then return '' end
local r,f='', (b64chars:find(x)-1)
for i=6,1,-1 do r=r..(f%2^i-f%2^(i-1)>0 and '1' or '0') end
return r;
end):gsub('%d%d%d?%d?%d?%d?%d?%d?', function(x)
if (#x ~= 8) then return '' end
local c=0
for i=1,8 do c=c+(x:sub(i,i)=='1' and 2^(8-i) or 0) end
return string.char(c)
end))
end
local function toHex(str)
return (str:gsub('.', function (c) return string.format('%02x', string.byte(c)) end))
end
local function fromHex(str)
return (str:gsub('..', function (cc) return string.char(tonumber(cc, 16)) end))
end
local function urlEncode(str)
if not str then return "" end
str = string.gsub(str, "\n", "\r\n")
str = string.gsub(str, "([^%w %-%_%.%~])", function(c) return string.format("%%%02X", string.byte(c)) end)
str = string.gsub(str, " ", "+")
return str
end
local function getRandomString()
local UUID = luajava.bindClass("java.util.UUID")
local result = UUID.randomUUID():toString():gsub("-", "")
return result
end
local function _createNewIdentifierFile()
local Environment = luajava.bindClass("android.os.Environment")
local StatFs = luajava.bindClass("android.os.StatFs")
local Build = luajava.bindClass("android.os.Build")
local dataDir = Environment.getDataDirectory()
local statFs = StatFs(dataDir.getPath())
local totalBytes
if Build.VERSION.SDK_INT >= 18 then
totalBytes = statFs.getTotalBytes()
else
local blockSize = statFs.getBlockSize()
totalBytes = statFs.getBlockCount() * blockSize
end
return md5(tostring(totalBytes))
end
function ArtAuth:new(config)
local obj = {}
setmetatable(obj, ArtAuth)
obj.appId = config.appId
obj.appKey = config.appKey
obj.signatureConfig = config.signature or { type = "MD5", rule = 1 }
obj.encryptionConfig = config.encryption or { type = "RC4", key = nil }
obj.antiHijack = config.antiHijack or false
obj.encode = config.encode or "HEX"
obj.code = config.code
obj.saveCardPath = "/sdcard/Android/art_" .. toHex(config.appKey)
if not obj.appId or not obj.appKey then error("配置错误") end
obj.deviceId = _createNewIdentifierFile()
return obj
end
function ArtAuth:getCode()
return self.code
end
function ArtAuth:verify(result)
if type(result) ~= "table" then return false end
local serverSign = result.signature
if self.signatureConfig.type == "NONE" then return true end
local sortedMap = {}
local function extractParams(jsonObject)
for key, value in pairs(jsonObject) do
if key ~= "signature" and key ~= "appId"then
if type(value) == "table" then
extractParams(value)
else
if value ~= nil then
sortedMap[key] = tostring(value)
else
sortedMap[key] = ""
end
end
end
end
end
extractParams(result)
local keys = {}
for k in pairs(sortedMap) do
table.insert(keys, k)
end
table.sort(keys)
local parts = {}
for _, k in ipairs(keys) do
table.insert(parts, k .. "=" .. sortedMap[k])
end
local queryStr = table.concat(parts, "&")
local signStr = ""
if self.signatureConfig.rule == 2 then
signStr = queryStr .. self.appKey
elseif self.signatureConfig.rule == 1 then
local ts = sortedMap["timestamp"]
signStr = ts .. self.appKey
else
return false
end
local algo = hash_funcs[self.signatureConfig.type]
local calc = algo(signStr)
return calc == serverSign
end
function ArtAuth:_sign(params)
local timestamp = os.time() * 1000
params["timestamp"] = timestamp
if self.signatureConfig.type == "NONE" then return end
local keys = {}
for k in pairs(params) do table.insert(keys, k) end
table.sort(keys)
local signStr = ""
if self.signatureConfig.rule == 2 then
local parts = {}
for _, k in ipairs(keys) do table.insert(parts, k .. "=" .. urlEncode(tostring(params[k]))) end
signStr = table.concat(parts, "&") .. self.appKey
else
signStr = tostring(timestamp) .. self.appKey
end
local algo = hash_funcs[self.signatureConfig.type] or md5
params["signature"] = algo(signStr)
end
function ArtAuth:_post(endpoint, params)
local url = webUrl .. "/api" .. endpoint
local finalParams = params or {}
local safeCode = nil
if self.antiHijack then
safeCode = getRandomString()
finalParams["safeCode"] = safeCode
end
self:_sign(finalParams)
local keys = {}
for k in pairs(finalParams) do
table.insert(keys, k)
end
table.sort(keys)
local paramPairs = {}
for _, k in ipairs(keys) do
table.insert(paramPairs, k .. "=" .. urlEncode(tostring(finalParams[k])))
end
local rawQuery = table.concat(paramPairs, "&")
local postBody = ""
if self.encryptionConfig.key then
local encryptedData = rc4(rawQuery, self.encryptionConfig.key)
local outData = ""
if self.encoding == "BASE64" then
outData = toBase64(encryptedData)
else
outData = toHex(encryptedData)
end
local bodyTable = {
appId = self.appId,
params = outData
}
postBody = JSON.encode(bodyTable)
else
finalParams["appId"] = self.appId
postBody = JSON.encode(finalParams)
end
local headers = {
["Content-Type"] = "application/json; charset=utf-8"
}
local resp = gg.makeRequest(url, headers, postBody)
if not resp or not resp.content then return nil, "网络错误" end
local responseContent = resp.content
if self.encryptionConfig.key then
if self.encode == "BASE64" then
local decodedB64 = fromBase64(responseContent)
responseContent = rc4(decodedB64, self.encryptionConfig.key)
else
local binData = fromHex(responseContent)
responseContent = rc4(binData, self.encryptionConfig.key)
end
end
local data = JSON.decode(responseContent)
if not data then
return nil, "解析错误"
end
if self.antiHijack and data.safeCode ~= safeCode then
return nil, "请勿劫持"
end
return data
end
function ArtAuth:getMachineCode()
return self.deviceId
end
function ArtAuth:saveCard(card)
local f = io.open(self.saveCardPath, "w")
if not f then return false end
f:write(card)
f:close()
return true
end
function ArtAuth:getSavedCard()
local f = io.open(self.saveCardPath, "r")
if not f then return "" end
local content = f:read("*a")
f:close()
return content or ""
end
function ArtAuth:login(card)
return self:_post("/single/login", {card = card, mac = self.deviceId })
end
function ArtAuth:logout(token)
return self:_post("/single/logout", { token = token, mac = self.deviceId })
end
function ArtAuth:recharge(card, rechargeCard)
return self:_post("/single/recharge", { card = card, rechargeCard = rechargeCard, mac = self.deviceId })
end
function ArtAuth:unbind(card)
return self:_post("/single/unbind", { card = card, originalMac = self.deviceId })
end
function ArtAuth:heartbeat(token)
return self:_post("/single/heart", { token = token, mac = self.deviceId })
end
function ArtAuth:getCardInfo(card)
return self:_post("/single/info", { card = card, mac = self.deviceId })
end
function ArtAuth:getVariable(variableId)
local vid = variableId or (self.config and self.config.noticeId) or 0
return self:_post("/expand/variable", { variableId = vid })
end
function ArtAuth:getVersion()
return self:_post("/expand/new-ver", {})
end
function ArtAuth:cloudFunc(funcId, jsFuncName, jsParams)
return self:_post("/expand/cloud-func", { funcId = funcId, jsFuncName = jsFuncName, jsParams = jsParams })
end
function ArtAuth:setPrivateData(token, fieldId, values)
return self:_post("/expand/set-private", { token = token, fieldId = fieldId, values = values, mac = self.deviceId })
end
function ArtAuth:getPrivateData(token, fieldId)
return self:_post("/expand/get-private", { token = token, fieldId = fieldId, mac = self.deviceId })
end
function ArtAuth:getAppStatus()
return self:_post("/expand/app-status", { })
end
local auth, err = ArtAuth:new(authConfig)
if not auth then
gg.alert("脚本初始化失败！\n错误代码：" .. tostring(err))
end
function initFK()
local Build = luajava.bindClass("android.os.Build")
local Tools = luajava.bindClass("android.ext.Tools")
if Build.VERSION.SDK_INT > 26 then
Tools.isText = true
end
end
initFK()
function exit()
os.exit()
while true do
_ENV = nil
end
end
local token = nil
function showNotice(noticeId)
if not noticeId then
return
end
local result, notErr = auth:getVariable(tonumber(noticeId))
if not result then
gg.alert("公告获取失败")
exit()
end
if result.code == auth:getCode() then
local notice = result.data
gg.alert("📋脚本公告\n\n"..notice.content)
end
end
function login(card)
local result, err = auth:login(card)
if not result then
gg.alert("登录初始化失败")
window.close()
end
local loginData = result.data
local isSign = auth:verify(result)
if result.code == auth:getCode() and isSign then
toKen = loginData.token
auth:saveCard(card)
window.close()
function initFK()
local Build = luajava.bindClass('android.os.Build')
local Tools = luajava.bindClass('android.ext.Tools')
if Build.VERSION.SDK_INT > 26 then
Tools.isText = true
end
end
initFK()
function cleanProcess()
gg.toast('收到游戏进程退出')
end
function onKey(code)
if code == 24 then
gg.toast("音量键下")
elseif code == 25 then
gg.toast("音量键上")
end
end
function mainAP(Table, func, tabTitle)
local list = {}
for k, v in pairs(Table) do
table.insert(list, {
title = v[1],
subTitle = v[2],
main = function(item)
v[3](item, v[4], v[5])
end
})
end
local list = gg.viewList(list, func)
local window = gg.mainTabs(tabTitle, list.getView(), false, window)
return { this = list, window = window }
end
function switchAp(Table, tabTitle)
local list = {}
for k, v in pairs(Table) do
table.insert(list, { title = v[1], func = v[2], isCheck = v[3] })
end
local swit = gg.viewSwitch(list)
gg.mainTabs(tabTitle, swit, false, window)
return list
end
function sub(fn)
local r = luajava.createProxy("java.lang.Runnable", { run = fn })
local t = luajava.newInstance("java.lang.Thread", r)
t:start()
return t
end
SO = {}
SO['新手'] = 0x25a024c
SO['封号'] = 0x22a7a88
SO['行为1'] = 0x256a4e8
SO['行为2'] = 0x256a57c
SO['行为3'] = 0x256a32c
SO['行为4'] = 0x25637b0
SO['行为5'] = 0x256a204
SO['行为6'] = 0x256a204
SO['行为7'] = 0x233155c
SO['行为8'] = 0x22045cc
SO['行为9'] = 0x25df3a4
SO['行为10'] = 0x25df2c4
SO['行为11'] = 0x255d15c
SO['行为12'] = 0x24b26d0
SO['行为13'] = 0x25df1c0
SO['行为14'] = 0x25dec10
SO['行为15'] = 0x2330e18
SO['行为16'] = 0x2331338
SO['行为17'] = 0x23314b0
SO['行为18'] = 0x27b7c80
SO['行为19'] = 0x1358880
SO['行为20'] = 0x1f23498
SO['行为21'] = 0x1f25430
SO['行为22'] = 0x1376b04
SO['行为23'] = 0x1f27188
SO['行为24'] = 0x1f2dfb4
SO['行为25'] = 0x1f2e060
SO['行为26'] = 0x3b79740
SO['行为27'] = 0x25623d4
SO['行为28'] = 0x256a298
SO['行为29'] = 0x256a3c0
SO['行为30'] = 0x256a454
SO['行为31'] = 0x1f2dc34
SO['行为32'] = 0x1f2dce0
SO['行为33'] = 0x1f2dd8c
SO['行为34'] = 0x1f2de30
SO['行为35'] = 0x1f2e060
SO['行为36'] = 0x1f2dc34
SO['行为37'] = 0x22062f4
SO['行为38'] = 0x1b59edc
SO['行为39'] = 0x2331120
SO['行为40'] = 0x256246c
SO['行为41'] = 0x1f246b8
SO['行为42'] = 0x1f28098
SO['行为43'] = 0x1f2dedc
SO['行为44'] = 0xe42bcc
SO['行为45'] = 0xe42bc0
SO['货币检测'] = 0x13450c4
SO['速度检测'] = 0x222c1f0
SO['防举报1'] = 0x1b59f6c
SO['防举报2'] = 0x1b59e54
SO['防举报3'] = 0x207b868
SO['防举报4'] = 0x27bb774
SO['人物'] = 0x2598dd8
SO['滑板'] = 0x259ab50
SO['背饰'] = 0x25bd044
SO['背饰保存'] = 0x25bd124
SO['像框'] = 0x2608654
SO['相框1'] = 0x227b7f4
SO['装扮'] = 0x258d460
SO['技能'] = 0x254b150
SO['技能勾选'] = 0x254b414
SO['名称'] = 0x13da8d0
SO['获取十倍'] = 0x2562cf0
SO['解锁十倍'] = 0x1082504
SO['内购'] = 0x24e7c58
SO['内购成功'] = 0x24f4040
SO['领奖'] = 0x25f1800
SO['十抽'] = 0x26af8d4
SO['宝物备份'] = 0x26ad4ac
SO['奖励替换'] = 0x2607ec4
SO['人物奖励'] = 0x2608074
SO['滑板奖励'] = 0x2608224
SO['背饰奖励'] = 0x2608584
SO['像框奖励'] = 0x2608654
SO['赛事'] = 0x283df0c
SO['备份1'] = 0x2559fec
SO['备份2'] = 0x25c99c8
SO['备份3'] = 0x2559fec
SO['备份4'] = 0x1f75208
SO['双倍'] = 0x25a6d28
SO['微博'] = 0x15ed684
SO['金币'] = 0x2586bb8
SO['钥匙'] = 0x2586ef8
SO['紫币'] = 0x25f37a0
SO['宝物钥匙'] = 0x25c26bc
SO['开发者'] = 0x255ebdc
SO['抓娃娃'] = 0x25633e4
SO['重生'] = 0x23235b0
SO['邮箱'] = 0x2666304
SO['炫跑卡'] = 0x25be8e4
SO['历史分数1'] = 0x2587404
SO['历史分数2'] = 0x258761c
SO['历史排名'] = 0x25b5c94
SO['等级'] = 0x258a3e8
SO['隐藏1'] = 0x23cfd98
SO['隐藏2'] = 0x255d15c
SO['隐藏3'] = 0x23d0c2c
SO['隐藏4'] = 0x25b1ba0
SO['隐藏5'] = 0x1b564ac
SO['防止卡屏1'] = 0x27b7b9c
SO['防止卡屏2'] = 0x27b7ab4
SO['受到攻击'] = 0x2461580
SO['攻击拾取'] = 0x245bc4c
SO['局内金币'] = 0x253c944
SO['获取能量'] = 0x245b1ec
SO['获取能量1'] = 0x2456ac8
SO['获取能量2'] = 0x2456ac8
SO['跳跃'] = 0x2541b74
SO['下滑'] = 0x25420d8
SO['下滑1'] = 0x2541d38
SO['下滑左'] = 0x2541e08
SO['下滑中'] = 0x2541e80
SO['下滑右'] = 0x2541ef8
SO['滑板跳高'] = 0x1053d90
SO['滑板滑翔'] = 0x105413c
SO['滑板瞬移'] = 0x105428c
SO['无尽装死'] = 0x105d3b4
SO['无限跳跃'] = 0x207ebe8
SO['金币消失'] = 0x20c2924
SO['无尽死亡'] = 0x1066100
SO['道具图标'] = 0x245a0d8
SO['道具图标2'] = 0x245a168
SO['道具图标3'] = 0x245c064
SO['修改道具'] = 0x245b9c0
SO['战绩消失'] = 0x27a76dc
SO['购买界面'] = 0x1350618
SO['反弹道具1'] = 0x2491630
SO['反弹道具2'] = 0x2491718
SO['释放能量'] = 0x245b368
SO['释放'] = 0x245b474
SO['无视道具1'] = 0x24928f4
SO['无视道具2'] = 0x2492e0c
SO['无视道具3'] = 0x1b56830
SO['无视障碍'] = 0x243f4ac
SO['无视侧撞'] = 0x243ffc0
SO['开局道具'] = 0x2586458
SO['能量穿透'] = 0x24564f4
SO['忙碌状态'] = 0x245a660
SO['无限能量'] = 0x2459f6c
SO['Buff模式'] = 0x2460994
SO['派对聚能'] = 0x27c41d8
SO['得到分数'] = 0x253e598
SO['结束游戏'] = 0x27b7ab4
SO['锁定人机'] = 0x27baafc
SO['派对新手'] = 0x255ffcc
SO['派对省份'] = 0x26f3c0c
SO['派对省排'] = 0x26f3b98
SO['派对全服'] = 0x26f3b24
SO['滑板消失'] = 0x2441e38
SO['三倍金币'] = 0x2412498
SO['得分倍增'] = 0x258b640
SO['宝物等级'] = 0x26a9398
SO['段位'] = 0x27f8058
SO['历史段位'] = 0x25b63b4
SO['道具满级'] = 0x1eaaecc
SO['道具等级'] = 0x1eaad2c
SO['退出登录'] = 0x2566c54
SO['超级跑者'] = 0x25ee7cc
SO['使用技能'] = 0x1dcc034
SO['观战对手'] = 0x208a3d4
SO['替换人物'] = 0x1dca508
SO['替换滑板'] = 0x1dcb5dc
SO['替换背饰'] = 0x1dccac8
SO['替换装扮'] = 0x1dcad94
SO['点击表情'] = 0x1edb1e8
SO['宝抽次数'] = 0x25c3560
SO['铁轨金币'] = 0x20c2924
SO['房间防踢'] = 0x244c570
SO['房间防踢1'] = 0x2483864
SO['匹配人机'] = 0x27bc008
SO['道具聚能'] = 0x2460a28
SO['道具备份1'] = 0x25c99c8
SO['道具备份2'] = 0x2559fec
SO['好友'] = 0x282c7e0
SO['踢人'] = 0x282ca38
SO['修改对抗赛'] = 0x222a668
SO['对抗赛好友匹配'] = 0x2483018
SO['观察者室'] = 0x127a02c
SO['自救'] = 0x2227c08
SO['复活结算'] = 0x27a76dc
SO['调出名称'] = 0x25a036c
SO['派对新手1'] = 0x255ffcc
SO['派对新手2'] = 0x256006c
SO['改变角色'] = 0x222dedc
SO['自变保安'] = 0x2226854
SO['时间'] = 0x207c054
SO['异常弹窗'] = 0x24b2408
SO['HFX目标'] = 0x243b988
SO['HP目标'] = 0x2491718
SO['HP使用人'] = 0x2491630
SO['PVP定人'] = 0x27baafc
SO['全宝'] = 0x26b1028
SO['半宝'] = 0x26b1ab0
SO['强制下线'] = 0x23bbb84
SO['时间检测'] = 0x256a170
SO['行为弹窗'] = 0x24b26d0
SO['升级金币'] = 0x26a9874
SO['升级材料'] = 0x26a96e4
SO['道具无限时长'] = 0x25fd794
SO['人物购买按钮'] = 0x1db8cf4
SO['人物购买成功'] = 0x1dbde64
SO['滑板购买按钮'] = 0x1dd5ec8
SO['滑板购买成功'] = 0x1ddaafc
SO['竞赛模式1'] = 0x28688ac
SO['竞赛模式2'] = 0x2797d68
SO['竞赛模式3'] = 0x1bac8b8
SO['匹配机制1'] = 0x1edb5d0
SO['匹配机制2'] = 0x283df0c
SO['匹配机制3'] = 0x127a02c
SO['屏蔽时间检1'] = 0x27f8eb8
SO['屏蔽时间检2'] = 0x27f8e3c
SO['屏蔽时间检4'] = 0x27f896c
SO['屏蔽时间检5'] = 0x27f881c
SO['屏蔽时间检6'] = 0x27f8738
SO['屏蔽时间检8'] = 0x256a170
SO['屏蔽时间检9'] = 0x27f83e8
SO['屏蔽时间检10'] = 0xe42be0
SO['一分40秒1'] = 0x1b564ac
SO['一分40秒2'] = 0x27f8eb8
SO['一分40秒3'] = 0x27f8e3c
SO['一分40秒4'] = 0x27f881c
SO['一分40秒6'] = 0x27f8738
SO['一分40秒7'] = 0x256a170
SO['一分40秒8'] = 0x1b59f6c
SO['一分40秒9'] = 0x1b59e54
SO['一分40秒10'] = 0x27bb774
SO['一分40秒11'] = 0x27bb7dc
SO['轨道位置'] = 0x207cf80
SO['表情退出'] = 0x284e8cc
SO['按钮复制房间'] = 0x1eaa564
SO['无视敏感词'] = 0x27ffd
SO['人物速度'] = 0x207b9e0
SO['滑板时长'] = 0x2442390
SO['弹窗'] = 0x1413208
SO['更新时刻'] = 0x3a123e8
SO['结算检测1'] = 0x27f881c
SO['结算检测2'] = 0x256201c
SO['结算检测3'] = 0x256a170
SO['结算检测4'] = 0x1b564ac
SO['结算退出'] = 0x13f4328
SO['登录1'] = nil
SO['登录2'] = nil
SO['登录3'] = nil
SO['act1'] = nil
SO['act2'] = nil
SO['速度检测1'] = nil
SO['速度检测2'] = nil
SO['速度检测3'] = nil
SO['速度检测4'] = nil
SO['速度检测5'] = nil
SO['蓝扳手'] = nil
SO['金扳手'] = nil
SO['阶段'] = nil
SO['星数'] = nil
SO['国标'] = nil
SO['高级秘典昵称'] = nil
SO['人物全局速度'] = nil
SO['自动速度'] = nil
SO['减速带'] = nil
SO['隐藏敌人'] = nil
SO['过滤十秒'] = nil
SO['获取玩家ID_1'] = nil
SO['获取玩家ID_2'] = nil
SO['获取玩家ID_3'] = nil
SO['获取玩家ID_4'] = nil
SO['改状态'] = 0x299554c
SO['使用道具'] = nil
SO['点击道具图标'] = nil
SO['点击道具图标获取能量回调'] = nil
SO['加能量'] = nil
SO['滑板技能'] = nil
SO['滑板技能勾选'] = nil
SO['人物瞬移'] = nil
SO['人物无敌'] = nil
SO['观战资格'] = nil
SO['新时刻'] = nil
SO['作弊时间'] = nil
SO['结算作弊状态'] = nil
SO['结算异常'] = nil
SO['结算恢复'] = nil
SO['屏蔽人机'] = nil
SO['进入结算屏蔽'] = nil
SO['发表情退出'] = nil
SO['发表情退出回调'] = nil
SO['终点自动退出'] = nil
SO['终点自动退出回调'] = nil
SO['分数赛过检'] = nil
SO['差额分数'] = nil
SO['无限滑板'] = nil
SO['点击'] = nil
SO['结尾'] = nil
SO['状态'] = nil
function setvalue(address, flags, value)
local tt = {}
tt[1] = {}
tt[1].address = address
tt[1].flags = flags
tt[1].value = value
gg.setValues(tt)
end
function SO_PT(FUNCTIONADD, TYPE, VALUE)
local SOMOD = gg.getRangesList("il2cpp.so")
if SOMOD[2] == nil then
gg.alert("开启失败\n━━━━━━━━━━━━━━━\n错误原因:未找到相关内存\n解决方法:请重新选择游戏进程\n━━━━━━━━━━━━━━━")
else
gg.setValues({{address = SOMOD[2].start + FUNCTIONADD, flags = TYPE, value = VALUE}})
gg.setValues({{address = SOMOD[2].start + FUNCTIONADD + 4, flags = TYPE, value = "~A8 RET"}})
end
end
function SO_FPT(FUNCTIONADD, TYPE, VALUE)
local SOMOD = gg.getRangesList("il2cpp.so")
if SOMOD[2] == nil then
gg.alert("开启失败\n━━━━━━━━━━━━━━━\n错误原因:未找到相关内存\n解决方法:请重新选择游戏进程\n━━━━━━━━━━━━━━━")
else
gg.setValues({{address = SOMOD[2].start + FUNCTIONADD + 0x8, flags = 16, value = VALUE}})
gg.setValues({{address = SOMOD[2].start + FUNCTIONADD, flags = TYPE, value = "~A8 LDR S0, [PC,#0x8]"}})
gg.setValues({{address = SOMOD[2].start + FUNCTIONADD + 4, flags = TYPE, value = "~A8 RET"}})
end
end
function SO_Deposit(FUNCTIONADD, TYPE, VALUE)
local SOMOD = gg.getRangesList("il2cpp.so")
if SOMOD[2] == nil then
gg.alert("开启失败\n━━━━━━━━━━━━━━━\n错误原因:未找到相关内存\n解决方法:请重新选择游戏进程\n━━━━━━━━━━━━━━━")
else
gg.setValues({{address = SOMOD[2].start + FUNCTIONADD, flags = 4, value = '~A8 LDR X0, [PC,#0x8]'}})
gg.setValues({{address = SOMOD[2].start + FUNCTIONADD + 4, flags = 4, value = '~A8 RET'}})
gg.setValues({{address = SOMOD[2].start + FUNCTIONADD + 8, flags = TYPE, value = VALUE}})
end
end
function SOGSPY_ST(HDZ, DYZ)
if HDZ >= DYZ then
py = string.format("0x%X", HDZ - DYZ)
return tostring(string.format("-0x%X", py))
else
py = string.format("0x%X", DYZ - HDZ)
return tostring(string.format("0x%X", py))
end
end
function S_Pointer(t_So, t_Offset, _bit)
local function getRanges()
local ranges = {}
local t = gg.getRangesList('^/data/*.so*$')
for i, v in pairs(t) do
if v.type:sub(2, 2) == 'w' then
table.insert(ranges, v)
end
end
return ranges
end
local function Get_Address(N_So, Offset, ti_bit)
local ti = gg.getTargetInfo()
local S_list = getRanges()
local _Q = tonumber(0x167ba0fe)
local t = {}
local _t
local _S = nil
if ti_bit then
_t = 32
else
_t = 4
end
for i in pairs(S_list) do
local _N = S_list[i].internalName:gsub('^.*/', '')
if N_So[1] == _N and N_So[2] == S_list[i].state then
_S = S_list[i]
break
end
end
if _S then
t[#t + 1] = {}
t[#t].address = _S.start + Offset[1]
t[#t].flags = _t
if #Offset ~= 1 then
for i = 2, #Offset do
local S = gg.getValues(t)
t = {}
for _ in pairs(S) do
if not ti.x64 then
S[_].value = S[_].value & 0xFFFFFFFF
end
t[#t + 1] = {}
t[#t].address = S[_].value + Offset[i]
t[#t].flags = _t
end
end
end
_S = t[#t].address
end
return _S
end
local _A = string.format('0x%X', Get_Address(t_So, t_Offset, _bit))
return _A
end
BJ_SO = SO_PT
BJ_D = SO_Deposit
function search(ss, lx, nc, dz1, dz2)
gg.setVisible(false)
if ss ~= nil then
if lx ~= nil then
if nc == nil then nc = 32 end
gg.setRanges(nc)
if dz1 == nil then dz1 = "-1" end
if dz2 == nil then dz2 = "0" end
gg.searchNumber(ss, lx, false, 536870912, dz1, dz2)
sl = gg.getResultCount()
if sl ~= 0 then
sj = gg.getResults(sl)
gg.toast("搜索到 " .. sl .. " 个结果")
gg.clearResults()
else
gg.toast("未搜索到结果")
end
else
gg.toast("无搜索值类型")
end
else
gg.toast("无需搜索值")
end
end
function py1(value, lx, py)
if #sj ~= nil then
z1 = {} z2 = {}
for i = 1, #sj do
z1[i] = {}
z1[i].address = sj[i].address + py
z1[i].flags = lx
end
z1 = gg.getValues(z1)
for i = 1, #sj do
if z1[i].value == value then
z2[#z2 + 1] = {}
z2[#z2] = sj[i]
end
end
sj = z2 z1 = {} z2 = {}
gg.toast("共偏移 " .. #sj .. " 个数据")
else
gg.toast("没有搜索数据")
end
end
function xg1(value, lx, py, dj)
if #sj ~= nil then
z = {}
for i = 1, #sj do
z[i] = {}
z[i].address = sj[i].address + py
z[i].flags = lx
z[i].value = value
if dj == true then z[i].freeze = true end
end
if dj == true then
gg.addListItems(z)
else
gg.clearList()
gg.setValues(z)
end
gg.toast("共修改 " .. #z .. " 个数据")
else
gg.toast("没有搜索数据")
end
end
function selectProcMain()
local proc = gg.getProcessInfo(true)
local list = {}
for k, v in pairs(proc) do
table.insert(list, { title = v.name, subTitle = tostring(v.info), icon = v.icon, main = function()
v.info.icon = v.icon
local p = gg.setProcessInfo(v.info)
gg.toast("选择["..v.name.."]:"..tostring(p))
end
})
end
function loadData(this)
local data = {}
local proc2 = gg.getProcessInfo(true)
for k, v in pairs(proc2) do
table.insert(data, { title = v.name, subTitle = tostring(v.info), icon = v.icon, main = function()
v.info.icon = v.icon
local p = gg.setProcessInfo(v.info)
gg.toast("选择["..v.name.."]:"..tostring(p))
end
})
end
this.setData(data)
this.updata()
gg.toast("刷新进程列表")
end
local procList = gg.viewList(list, loadData)
gg.mainTabs("选择进程", procList.getView(), false, window)
end
function fengFenView()
mainAP({
{ '选择进程', '选择游戏进程', selectProcMain },
{ '锁定进程', '锁定com.kiloo.subwaysurf', function()
gg.thread("锁定进程", function()
local proc = gg.getProcessInfo(true)
for k, v in pairs(proc) do
if string.find(v.name, "subwaysurf") or string.find(v.name, "kiloo") then
v.info.icon = v.icon
gg.setProcessInfo(v.info)
gg.toast("已锁定: " .. v.name)
return
end
end
gg.toast("未找到subwaysurf进程")
end)
end
},
{ '防闪退/登录开/', '防闪退功能', function()
switchAp({
{ '防闪退/登录开/', function(isCheck)
if isCheck then
gg.thread("防闪退", function()
function setvalue(address, flags, value)
local tt = {}
tt[1] = {}
tt[1].address = address
tt[1].flags = flags
tt[1].value = value
gg.setValues(tt)
end
so = gg.getRangesList('libtersafe2.so')[1].start
py = 0x4FD6AC
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD6BC
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD6DC
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD6FC
setvalue(so + py, 4, "~A8 RET")
gg.toast("防闪退:开启")
end)
end
end
},
{ '防环境/登录开/', function(isCheck)
if isCheck then
gg.thread("防环境", function()
function setvalue(address, flags, value)
local tt = {}
tt[1] = {}
tt[1].address = address
tt[1].flags = flags
tt[1].value = value
gg.setValues(tt)
end
so = gg.getRangesList('libtersafe2.so')[1].start
py = 0x4FD6A0
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD6B0
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD6D0
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD80C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD78C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD68C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD69C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD72C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD73C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD74C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD75C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD76C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD77C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD78C
setvalue(so + py, 4, "~A8 RET")
py = 0x4FD79C
setvalue(so + py, 4, "~A8 RET")
gg.toast("防环境:开启")
end)
end
end
},
{ '配置注入/登录开/', function(isCheck)
if isCheck then
gg.thread("配置注入", function()
local gg = gg
SO_PT(SO['登录1'], 4, "~A8 RET")
SO_PT(SO['登录2'], 4, "~A8 RET")
SO_PT(SO['登录3'], 4, "~A8 RET")
gg.toast("独家登录SO开启成功")
end)
end
end
},
{ '防行为*大厅开*', function(isCheck)
if isCheck then
gg.thread("防行为", function()
local gg = gg
for i = 1, 2 do
if SO['act' .. i] then
SO_PT(SO['act' .. i], 4, "~A8 MOV W0, WZR")
end
end
for i = 1, 42 do
if SO['行为' .. i] then
SO_PT(SO['行为' .. i], 4, "~A8 MOV X0, XZR")
end
end
local so = gg.getRangesList('libil2cpp.so')[2].start
bj = {
{address = so + 0x37418f8, flags = 4, value = "~A8 RET"},
}
gg.setValues(bj)
gg.toast('防行为成功')
end)
end
end
},
{ '速度检测*大厅开*', function(isCheck)
if isCheck then
gg.thread("速度检测", function()
SO_PT(SO['速度检测1'], 4, "~A8 MOV W0, WZR")
SO_PT(SO['速度检测2'], 4, "~A8 MOV W0, WZR")
SO_PT(SO['速度检测3'], 4, "~A8 MOV W0, WZR")
SO_PT(SO['速度检测4'], 4, "~A8 MOV W0, WZR")
SO_PT(SO['速度检测5'], 4, "~A8 MOV W0, WZR")
gg.toast("全过开启成功")
end)
end
end
},
}, "防封开关")
end
},
}, tol, "防封")
end
function shuaHao_dataView()
mainAP({
{ '修改金币', '修改金币数量', function()
gg.thread("修改金币", function()
local p = gg.prompt({"请输入你想要的金币数量\n[改多会封号]"}, {"0"}, {"text"})
if not p then return end
local a = p[1]
SO_PT(SO['金币'], 4, "~A8 MOV W0, #" .. a)
gg.toast("更改成功")
end)
end
},
{ '修改钥匙', '修改钥匙数量', function()
gg.thread("修改钥匙", function()
local OP = gg.prompt({'请输入修改的钥匙\n[改多会封号]'}, {"0"}, {"text"})
if not OP then return end
SO_PT(SO['钥匙'], 4, "~A8 MOV  W0, #" .. OP[1])
gg.toast("更改成功")
end)
end
},
{ '宝物钥匙', '修改宝物钥匙数量', function()
gg.thread("宝物钥匙", function()
local OP = gg.prompt({'请输入修改的宝物钥匙\n[改多会封号]'}, {"0"}, {"text"})
if not OP then return end
SO_PT(SO['宝物钥匙'], 4, "~A8 MOV  W0, #" .. OP[1])
gg.toast("更改成功")
end)
end
},
{ '改赛季币', '修改赛季币数量', function()
gg.thread("改赛季币", function()
local p = gg.prompt({"请输入修改的赛季币数量"}, {"0"}, {"text"})
if not p then return end
SO_Deposit(SO['紫币'], 4, p[1])
gg.toast("更改成功")
end)
end
},
{ '蓝色扳手', '修改蓝色扳手数量', function()
gg.thread("蓝色扳手", function()
local p = gg.prompt({"请输入蓝扳手数量\n可能不是实体"}, {"91"}, {"text"})
if not p then return end
SO_Deposit(SO['蓝扳手'], 4, p[1])
gg.toast("更改成功")
end)
end
},
{ '金色扳手', '修改金色扳手数量', function()
gg.thread("金色扳手", function()
local p = gg.prompt({"请输入金扳手数量\n可能不是实体"}, {"78"}, {"text"})
if not p then return end
SO_Deposit(SO['金扳手'], 4, p[1])
gg.toast("更改成功")
end)
end
},
{ '自改跑卡', '修改炫跑卡等级', function()
gg.thread("自改跑卡", function()
local OP = gg.prompt({'炫跑卡\n输入1～6'}, {"6"}, {"text"})
if not OP then return end
SO_PT(SO['炫跑卡'], 4, "~A8 MOV  W0, #" .. OP[1])
gg.toast("更改成功")
end)
end
},
}, tol, "数据更改")
end
function shuaHao_unlockView()
switchAp({
{ '人物全解', function(isCheck)
if isCheck then
gg.thread("人物全解", function()
SO_PT(SO['人物'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '滑板全解', function(isCheck)
if isCheck then
gg.thread("滑板全解", function()
SO_PT(SO['滑板'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '背饰全解', function(isCheck)
if isCheck then
gg.thread("背饰全解", function()
SO_PT(SO['背饰'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '人物装扮', function(isCheck)
if isCheck then
gg.thread("人物装扮", function()
SO_PT(SO['装扮'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
end
},
}, "全解区域")
end
function shuaHao_specialView()
switchAp({
{ '满级跑卡', function(isCheck)
if isCheck then
gg.thread("满级跑卡", function()
SO_PT(SO['炫跑卡'], 4, "~A8 MOV	 W0, #6")
gg.toast("开启成功")
end)
end
end
},
{ '十倍得分', function(isCheck)
if isCheck then
gg.thread("十倍得分", function()
SO_PT(SO['获取十倍'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['解锁十倍'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '双倍金币', function(isCheck)
if isCheck then
gg.thread("双倍金币", function()
SO_PT(SO['双倍'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '超长名称', function(isCheck)
if isCheck then
gg.thread("超长名称", function()
SO_PT(SO['名称'], 4, "~A8 B [PC,#0x100]")
gg.toast("开启成功")
end)
end
end
},
{ '粉色名称', function(isCheck)
if isCheck then
gg.thread("粉色名称", function()
SO_PT(SO['高级秘典昵称'], 4, "~A8 MOV  X0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '金色名称', function(isCheck)
if isCheck then
gg.thread("金色名称", function()
SO_PT(SO['炫跑卡'], 4, "~A8 MOV  W0, #6")
SO_PT(SO['高级秘典昵称'], 4, "~A8 MOV  X0, #1")
gg.toast("秘典调用成功")
end)
end
end
},
}, "特殊区域")
end
function shuaHao_baowuView()
switchAp({
{ '十抽全宝', function(isCheck)
if isCheck then
gg.thread("十抽全宝", function()
SO_PT(SO['十抽'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['十抽'], SO['全宝']) .. "]")
gg.toast("开启成功")
end)
end
end
},
{ '十抽购买', function(isCheck)
if isCheck then
gg.thread("十抽购买", function()
SO_PT(SO['十抽'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['十抽'], SO['购买界面']) .. "]")
gg.toast("开启成功")
end)
end
end
},
{ '十抽保存', function(isCheck)
if isCheck then
gg.thread("十抽保存", function()
SO_PT(SO['十抽'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['十抽'], SO['宝物备份']) .. "]")
gg.toast("开启成功")
end)
end
end
},
}, "修改宝物")
end
function shuaHaoView()
mainAP({
{ '数据更改', '修改金币/钥匙/赛季币等', shuaHao_dataView },
{ '全解区域', '人物/滑板/背饰/装扮全解', shuaHao_unlockView },
{ '特殊区域', '满级跑卡/十倍得分/双倍金币等', shuaHao_specialView },
{ '修改宝物', '十抽全宝/十抽购买/十抽保存', shuaHao_baowuView },
}, tol, "刷号")
end
function jingSai_daojuView()
switchAp({
{ '去除断网弹窗', function(isCheck)
if isCheck then
gg.thread("去除断网弹窗", function()
so = gg.getRangesList('libil2cpp.so')[2].start
L = {
{address = so + SO['弹窗'], flags = 4, value = "~A8 MOV	 W0, #0x1"},
{address = so + SO['弹窗'] + 4, flags = 4, value = "~A8 RET"},
}
gg.setValues(L)
gg.toast("开启成功")
end)
end
end
},
{ '冲榜配置', function(isCheck)
if isCheck then
gg.thread("冲榜配置", function()
local gg = gg
SO_PT(SO['跳跃'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['跳跃'], SO['获取能量2']) .. "]")
SO_PT(SO['下滑'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑'], SO['获取能量2']) .. "]")
SO_PT(SO['无视障碍'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
gg.alert('开启成功 不要搭配任何功能')
end)
end
end
},
{ '作者配置', function(isCheck)
if isCheck then
gg.thread("作者配置", function()
local gg = gg
SO_PT(SO['无视道具1'], 4, "~A8 MOV  W0, #1")
SO_PT(SO['无视道具2'], 4, "~A8 MOV  W0, #1")
SO_PT(SO['跳跃'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['跳跃'], SO['获取能量2']) .. "]")
SO_PT(SO['下滑'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑'], SO['获取能量2']) .. "]")
SO_PT(SO['Buff模式'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['Buff模式'], SO['获取能量1']) .. "]")
SO_PT(SO['无视障碍'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['无视侧撞'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['减速带'], 4, "~A8 MOV W0, WZR")
gg.toast("开启成功")
end)
end
end
},
{ '快能量倍增', function(isCheck)
if isCheck then
gg.thread("快能量倍增", function()
SO_PT(SO['跳跃'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['跳跃'], SO['获取能量1']) .. "]")
SO_PT(SO['下滑1'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑1'], SO['获取能量1']) .. "]")
SO_PT(SO['下滑左'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑左'], SO['获取能量1']) .. "]")
SO_PT(SO['下滑中'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑中'], SO['获取能量1']) .. "]")
SO_PT(SO['下滑右'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑右'], SO['获取能量1']) .. "]")
gg.toast("开启成功")
end)
end
end
},
{ '新量倍增', function(isCheck)
if isCheck then
gg.thread("新量倍增", function()
SO_PT(SO['跳跃'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['跳跃'], SO['获取能量2']) .. "]")
SO_PT(SO['下滑'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑'], SO['获取能量2']) .. "]")
SO_PT(SO['Buff模式'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['Buff模式'], SO['获取能量1']) .. "]")
gg.toast("开启成功")
end)
end
end
},
{ 'Buff聚能', function(isCheck)
if isCheck then
gg.thread("Buff聚能", function()
SO_PT(SO['Buff模式'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['Buff模式'], SO['获取能量1']) .. "]")
gg.toast("开启成功")
end)
end
end
},
{ '图标聚能', function(isCheck)
if isCheck then
gg.thread("图标聚能", function()
SO_PT(SO['使用道具'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['使用道具'], SO['加能量']) .. "]")
SO_PT(SO['点击道具图标'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['点击道具图标'], SO['点击道具图标获取能量回调']) .. "]")
gg.toast("开启成功")
end)
end
end
},
{ '过滤十秒', function(isCheck)
if isCheck then
gg.thread("过滤十秒", function()
SO_PT(SO['过滤十秒'], 4, "~A8 MOV X0, WZR")
gg.toast("开启成功")
end)
end
end
},
{ '概率敌人进不去', function(isCheck)
if isCheck then
gg.thread("概率敌人进不去", function()
il2cpp = gg.getRangesList('il2cpp.so')[2].start
Values = {
{address = il2cpp + SO['获取玩家ID_1'], flags = 4, value = huitiao(SO['获取玩家ID_1'], SO['获取玩家ID_4'])},
{address = il2cpp + SO['获取玩家ID_2'], flags = 4, value = '~A8 MOV X0, XZR'},
{address = il2cpp + SO['获取玩家ID_2'] + 4, flags = 4, value = '~A8 RET'},
{address = il2cpp + SO['获取玩家ID_3'], flags = 4, value = '~A8 MOV X0, XZR'},
{address = il2cpp + SO['获取玩家ID_3'] + 4, flags = 4, value = '~A8 RET'},
{address = il2cpp + 0x1c5feac, flags = 4, value = '~A8 MOV X0, XZR'},
{address = il2cpp + 0x1c5d5fc + 4, flags = 4, value = '~A8 RET'},
{address = il2cpp + 0x1c5f184, flags = 4, value = '~A8 MOV X0, XZR'},
{address = il2cpp + 0x1b9b0a4 + 4, flags = 4, value = '~A8 RET'},
}
gg.setValues(Values)
gg.toast("开启成功")
end)
end
end
},
{ '定住人机', function(isCheck)
if isCheck then
gg.thread("定住人机开", function()
SO_PT(SO['PVP定人'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
else
gg.thread("定住人机关", function()
SO_PT(SO['PVP定人'], 4, "~A8 MOV W0, WZR")
gg.toast("关闭成功")
end)
end
end
},
{ '人机匹配机制', function(isCheck)
if isCheck then
gg.thread("人机匹配机制", function()
SO_PT(SO['匹配机制3'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['匹配机制3'], SO['竞赛模式1']) .. "]")
SO_PT(SO['匹配机制2'], 4, "~A8 MOV  W0, #1")
gg.toast("匹配机制开启成功")
end)
end
end
},
{ 'ACC状态', function(isCheck)
if isCheck then
gg.thread("ACC状态", function()
local SO = {}
SO['改状态'] = 0x299554c
so = gg.getRangesList('libil2cpp.so')[2].start
py = SO['改状态']
bj = {
{address = so + py + 0xDC, flags = 4, value = "~A8 MOV	 W1, #0x2"},
}
gg.setValues(bj)
gg.toast("ACC状态开启成功")
end)
end
end
},
{ '开关加速', function(isCheck)
if isCheck then
gg.thread("开关加速开", function()
SO_FPT(SO['人物全局速度'], 4, "0")
gg.toast("开启成功")
end)
else
gg.thread("开关加速关", function()
SO_FPT(SO['人物全局速度'], 4, "99999")
gg.toast("开启成功")
end)
end
end
},
{ '无视道具', function(isCheck)
if isCheck then
gg.thread("无视道具", function()
SO_PT(SO['无视道具1'], 4, "~A8 MOV  W0, #1")
SO_PT(SO['无视道具2'], 4, "~A8 MOV  W0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '能量穿透', function(isCheck)
if isCheck then
gg.thread("能量穿透", function()
SO_PT(SO['能量穿透'], 4, "~A8 MOV  W0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '无视障碍', function(isCheck)
if isCheck then
gg.thread("无视障碍", function()
SO_PT(SO['无视障碍'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['无视侧撞'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['减速带'], 4, "~A8 MOV W0, WZR")
gg.toast("开启成功")
end)
end
end
},
{ '反弹道具', function(isCheck)
if isCheck then
gg.thread("反弹道具开", function()
SO_PT(SO['反弹道具1'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['反弹道具2'], 4, "~A8 MOV W0, WZR")
gg.toast("开启成功")
end)
else
gg.thread("反弹道具关", function()
SO_PT(SO['反弹道具2'], 4, "~A8 MOV W0, WZR")
SO_PT(SO['反弹道具1'], 4, "~A8 MOV	 W0, #1")
gg.toast("关闭成功")
end)
end
end
},
{ '隐藏敌人', function(isCheck)
if isCheck then
gg.thread("隐藏敌人", function()
il2cpp = gg.getRangesList('il2cpp.so')[2].start
Values = {
{address = il2cpp + SO['隐藏敌人'], flags = 4, value = '~A8 MOV X0, XZR'},
{address = il2cpp + SO['隐藏敌人'] + 4, flags = 4, value = '~A8 RET'},
}
gg.setValues(Values)
gg.toast("开启成功")
end)
end
end
},
{ '间隔满板', function(isCheck)
if isCheck then
gg.thread("间隔满板", function()
SO_PT(SO['无限能量'], 4, "~A8 MOV W0, WZR")
gg.toast("开启成功")
end)
end
end
},
{ '受击道具', function(isCheck)
if isCheck then
gg.thread("受击道具", function()
SO_PT(SO['受到攻击'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['受到攻击'], SO['攻击拾取']) .. "]")
gg.toast("开启成功")
end)
end
end
},
{ '无限滑板', function(isCheck)
if isCheck then
gg.thread("无限滑板", function()
function _lib(libs, state)
local lib = gg.getRangesList(libs)
for seed in ipairs(lib) do
if lib[seed].state == state then
return lib[seed].start
end
end
end
function zhix()
local il2cpp_start = _lib('il2cpp', 'Xa')
local targetOffset = il2cpp_start + SO['点击']
local getClass = il2cpp_start + SO['结尾']
local destinationOffset = il2cpp_start + SO['状态']
local ReleaseEnergyOffset = il2cpp_start + SO['释放能量']
local CollectPropOffset = il2cpp_start + SO['攻击拾取']
local register = {
[0] = {0xB8, 32, 0};
[1] = {0x208, 4, 5};
[2] = {0x20C, 16, 80};
[3] = {0x210, 4, 0};
[4] = {0x214, 4, 1};
[5] = {0x218, 32, destinationOffset};
}
local mmap = gg.allocatePage(1 | 2 | 4) + 8
local table_correct = {
{
address = mmap + (#register + 1) * 4,
flags = 4,
value = '~A8 BR X5'
},
{address = ReleaseEnergyOffset, flags = 4, value = '~A8 MOV W0, #1'},
{address = ReleaseEnergyOffset + 4, flags = 4, value = '~A8 RET'},
{address = CollectPropOffset, flags = 4, value = '~A8 RET'},
{address = targetOffset, flags = 4, value = '~A8 LDR X1, [PC,#0x8]'},
{address = targetOffset + 4, flags = 4, value = '~A8 BR X1'},
{address = targetOffset + 8, flags = 32, value = mmap},
{address = getClass, flags = 4, value = '~A8 LDR X2, [PC,#0x8]'},
{address = getClass + 4, flags = 4, value = '~A8 BR X2'},
{
address = getClass + 8,
flags = 32,
value = (mmap - 8)
},
{
address = (mmap - 8),
flags = 4,
value = '~A8 STR X0, [X2,#0xC0]'
},
{
address = (mmap - 4),
flags = 4,
value = '~A8 RET'
},
}
for search = 0, #register do
table_correct[#table_correct + 1], table_correct[#table_correct + 2] = {
address = mmap + search * 4,
flags = 4,
value = '~A8 LDR X' .. search .. ', [PC,#' .. string.format('0x%X', register[search][1]) .. ']'
}, {
address = mmap + (search * 4) + register[search][1],
flags = register[search][2],
value = register[search][3]
}
end
return gg.setValues(table_correct)
end
zhix()
gg.toast("开启成功")
end)
end
end
},
{ '开局道具', function(isCheck)
if isCheck then
gg.thread("开局道具", function()
local gg = gg
local p = gg.prompt({'道具代码:\n1=恶魔 2=乌龟 3=颜料 4=能量10%[1;4]'}, {[1] = 2}, {[1] = 'number'})
if not p then return end
local a = p[1]
SO_PT(SO['开局道具'], 4, "~A8 MOV W0, #" .. a)
gg.toast("更改成功")
end)
end
end
},
}, "道具赛区")
end
function huitiao(a, b)
pyl = b - a
if string.find(pyl, "-") then
gsub = string.gsub(pyl, "-", "")
format = string.format("-0x%X", gsub)
else
format = string.format("0x%X", pyl)
end
format = '~A8 B [PC,#' .. format .. ']'
return format
end
function jingSai_yuleView()
switchAp({
{ '滑板瞬移', function(isCheck)
if isCheck then
gg.thread("滑板瞬移开", function()
SO_PT(SO['滑板瞬移'], 4, "~A8 MOV  W0, #1")
SO_PT(SO['滑板技能'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['滑板技能勾选'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
else
gg.thread("滑板瞬移关", function()
SO_PT(SO['滑板瞬移'], "~A8 MOV W0, WZR")
gg.toast("关闭成功")
end)
end
end
},
{ '人物瞬移', function(isCheck)
if isCheck then
gg.thread("人物瞬移开", function()
SO_PT(SO['人物瞬移'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
else
gg.thread("人物瞬移关", function()
SO_PT(SO['人物瞬移'], 4, "~A8 MOV W0, WZR")
gg.toast("关闭成功")
end)
end
end
},
{ '人物无敌', function(isCheck)
if isCheck then
gg.thread("人物无敌", function()
SO_PT(SO['人物无敌'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '无限跳跃', function(isCheck)
if isCheck then
gg.thread("无限跳跃开", function()
SO_PT(SO['无限跳跃'], 4, "~A8 MOV  W0, #1")
gg.toast("开启成功")
end)
else
gg.thread("无限跳跃关", function()
SO_PT(SO['无限跳跃'], 4, "~A8 MOV W0, WZR")
gg.toast("关闭成功")
end)
end
end
},
{ '滑板滑翔', function(isCheck)
if isCheck then
gg.thread("滑板滑翔开", function()
SO_PT(SO['滑板滑翔'], 4, "~A8 MOV  W0, #1")
gg.toast("开启成功")
end)
else
gg.thread("滑板滑翔关", function()
SO_PT(SO['滑板滑翔'], 4, "~A8 MOV  W0, #1")
gg.toast("关闭成功")
end)
end
end
},
{ '滑板跳高', function(isCheck)
if isCheck then
gg.thread("滑板跳高开", function()
SO_PT(SO['滑板跳高'], 4, "~A8 MOV  W0, #1")
gg.toast("开启成功")
end)
else
gg.thread("滑板跳高关", function()
SO_PT(SO['滑板跳高'], 4, "~A8 MOV W0, #1")
gg.toast("关闭成功")
end)
end
end
},
{ '滑板消失', function(isCheck)
if isCheck then
gg.thread("滑板消失开", function()
SO_PT(SO['滑板消失'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
else
gg.thread("滑板消失关", function()
SO_PT(SO['滑板消失'], 4, "~A8 MOV W0, WZR")
gg.toast("关闭成功")
end)
end
end
},
{ '下滑穿透', function(isCheck)
if isCheck then
gg.thread("下滑穿透", function()
function getMmap()
local AddrList = {}
local RangesList = gg.getRangesList()
for _, __ in pairs(RangesList) do
if __["state"] == "A" and __["type"] == "rwxp" then
for ___ = 0, 4096, 8 do
table.insert(AddrList, {address = __["start"] + ___, flags = 32, value = 0})
end
gg.setValues(AddrList)
return __["start"]
end
end
end
function getMmap_1()
il2cpp = gg.getRangesList('il2cpp.so')
for k, v in ipairs(il2cpp) do
if v.state == 'Xa' then
il2cpp = v.start
break
end
end
TargetOffset_ByMmap = il2cpp + _ENV['刷新函数_2']
mmap = getMmap()
local hook = {
{address = TargetOffset_ByMmap, value = "~A8 LDR X16, [PC,#0x8]", flags = 4},
{address = TargetOffset_ByMmap + 0x4, value = "~A8 BR X16", flags = 4},
{address = TargetOffset_ByMmap + 0x8, value = mmap, flags = 32},
{value = "~A8 LDR X16, [PC,#0x54]", flags = 4, address = mmap},
{value = "~A8 STP X29, X30, [SP,#-0x20]!", flags = 4, address = mmap + 0x4},
{value = "~A8 MOV X0, XZR", flags = 4, address = mmap + 0x8},
{value = "~A8 MOV X1, #4096", flags = 4, address = mmap + 0xC},
{value = "~A8 MOV X2, #7", flags = 4, address = mmap + 0x10},
{value = "~A8 MOV X3, #0x22", flags = 4, address = mmap + 0x14},
{value = "~A8 MOV X4, XZR", flags = 4, address = mmap + 0x18},
{value = "~A8 MOV X5, XZR", flags = 4, address = mmap + 0x1C},
{value = "~A8 MOV X8, #222", flags = 4, address = mmap + 0x20},
{value = "~A8 B [PC,#0x200]", flags = 4, address = mmap + 0x24},
{value = mmap + 0x5C, flags = 32, address = mmap + 0x54},
{address = mmap + 0x224, flags = 4, value = '~A8 LDR X11, [X16,#0x100]'},
{address = mmap + 0x224 + 4, flags = 4, value = '~A8 ADD X11, X11, #1'},
{address = mmap + 0x224 + 8, flags = 4, value = '~A8 STR X11, [X16,#0x100]'},
{address = mmap + 0x224 + 12, flags = 4, value = '~A8 CMP X11, #1'},
{address = mmap + 0x224 + 16, flags = 4, value = '~A8 B.EQ [PC,#0x8]'},
{address = mmap + 0x224 + 20, flags = 4, value = '~A8 RET'},
{address = mmap + 0x224 + 24, flags = 4, value = '~A8 SVC #0x0'},
{address = mmap + 0x224 + 28, flags = 4, value = '~A8 STR X0, [X16]'},
{address = mmap + 0x224 + 32, flags = 4, value = '~A8 LDP X29, X30, [SP], #0x20'},
{address = mmap + 0x224 + 36, flags = 4, value = '~A8 RET'},
}
gg.setValues(hook)
getMmap_Addr = mmap + 0x5C
return getMmap_Addr
end
function GetMmap()
mmap = gg.allocatePage(gg.PROT_READ | gg.PROT_WRITE | gg.PROT_EXEC)
if mmap ~= '无法分配内存页。错误 0' then
return mmap
else
if not getMmap_Addr then
gg.processPause()
getMmap_Addr = getMmap_1()
gg.processResume()
end
gg.setValues({{address = getMmap_Addr + 0x100, flags = 4, value = 0}})
while true do
Value_Addr = gg.getValues({{address = getMmap_Addr, flags = 32}})[1].value
gg.sleep(20)
if Value_Addr ~= 0 then
return Value_Addr
end
end
end
end
function getPointer(Address)
return gg.getValues({{address = Address, flags = 32}})[1].value
end
function getString(a)
local utf, u16 = {}, {}
for i = 1, 64, 1 do
utf[i] = {address = a + i * 2, flags = 2}
end
utf = gg.getValues(utf)
for k, v in ipairs(utf) do
if v.value == 0 then
break
end
u16[k] = v.value & 0xFFFF
end
return utf8.char(table.unpack(u16))
end
function zl_table(a, b, c)
return not a[c] and b or a[c]
end
_ENV['获取Character实例'] = 0x3506d70
_ENV['游戏刷新函数'] = 0x3c0cee8
il2cpp = gg.getRangesList('il2cpp.so')[2].start
TargetOffset = il2cpp + _ENV['游戏刷新函数']
if not Character_1 then
mmap = GetMmap()
SetValues_1 = {
{address = TargetOffset, flags = 4, value = '~A8 LDR X16, [PC,#0x8]'},
{address = TargetOffset + 4, flags = 4, value = '~A8 BR X16'},
{address = TargetOffset + 8, flags = 32, value = mmap},
{address = mmap, flags = 4, value = '~A8 STP	 X29, X30, [SP,#-0x20]!'},
{address = mmap + 4, flags = 4, value = '~A8 MOV	 X29, SP'},
{address = mmap + 8, flags = 4, value = '~A8 LDR	 X17, [X16,#0x200]'},
{address = mmap + 12, flags = 4, value = '~A8 BLR X17'},
{address = mmap + 16, flags = 4, value = '~A8 STR X0, [X16,#0x210]'},
{address = mmap + 20, flags = 4, value = '~A8 LDR X16, [PC,#0x20]'},
{address = mmap + 24, flags = 4, value = '~A8 LDP	 X29, X30, [SP], #0x20'},
{address = mmap + 28, flags = 4, value = '~A8 RET'},
{address = mmap + 32, flags = 32, value = mmap},
{address = mmap + 0x200, flags = 32, value = il2cpp + _ENV['获取Character实例']},
}
gg.setValues(SetValues_1)
while true do
gg.sleep(20)
Value = gg.getValues({{address = mmap + 0x210, flags = 32}})[1].value
if Value ~= 0 then
Character_1 = Value
break
end
end
end
mmap = GetMmap()
gg.setValues({
{address = TargetOffset, flags = 4, value = '~A8 LDR X16, [PC,#0x8]'},
{address = TargetOffset + 4, flags = 4, value = '~A8 BR X16'},
{address = TargetOffset + 8, flags = 32, value = mmap},
{address = mmap, flags = 4, value = '~A8 LDR X0, [X16,#0x200]'},
{address = mmap + 4, flags = 4, value = '~A8 LDR W1, [X16,#0x210]'},
{address = mmap + 8, flags = 4, value = '~A8 STR W1, [X0,#0x3F4]'},
{address = mmap + 12, flags = 4, value = '~A8 STR W1, [X0,#0x404]'},
{address = mmap + 16, flags = 4, value = '~A8 RET'},
{address = mmap + 0x200, flags = 32, value = Character_1},
{address = mmap + 0x210, flags = 16, value = 9999},
})
gg.toast("开启成功")
end)
end
end
},
}, "娱乐区")
end
function jingSai_guanzhanView()
switchAp({
{ '调出观战', function(isCheck)
if isCheck then
gg.thread("调出观战开", function()
SO_PT(SO['观战资格'], 4, "~A8 MOV W0, #1", "~A8 RET")
SO_PT(SO['对抗赛好友匹配'], 4, "~A8 MOV W0, #1", "~A8 RET")
gg.toast("调用成功")
end)
else
gg.thread("调出观战关", function()
SO_PT(SO['观战资格'], 4, "~A8 RET")
gg.toast("关闭成功")
end)
end
end
},
{ '房间踢人', function(isCheck)
if isCheck then
gg.thread("房间踢人", function()
SO_PT(SO['好友'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['好友'], SO['踢人']) .. "]")
gg.toast("更改成功")
end)
end
end
},
{ '房间防踢', function(isCheck)
if isCheck then
gg.thread("房间防踢", function()
SO_PT(SO['房间防踢1'], 4, "~A8 MOV W0, WZR")
SO_PT(SO['房间防踢'], 4, "~A8 MOV W0, WZR")
gg.toast("更改成功")
end)
end
end
},
}, "调出观战区")
end
function jingSai_paiduiView()
switchAp({
{ '防止卡屏', function(isCheck)
if isCheck then
gg.thread("防止卡屏", function()
SO_PT(SO['防止卡屏1'], 4, "~A8 MOV	 W0, #1", "~A8 RET")
SO_PT(SO['防止卡屏2'], 4, "~A8 MOV W0, WZR", "~A8 RET")
gg.toast("更改成功")
end)
end
end
},
{ '过结算检测', function(isCheck)
if isCheck then
gg.thread("过结算检测", function()
SO_PT(SO['新时刻'], 4, "~A8 MOV W0, #1")
SO_PT(SO['作弊时间'], 4, "~A8 MOV W0, WZR")
gg.toast("更改成功")
end)
end
end
},
{ '结算得分', function(isCheck)
if isCheck then
gg.thread("结算得分开", function()
local nc = {}
local so = gg.getRangesList("il2cpp.so")
for i = 1, #so do
nc[i] = so[i].state
if nc[i] == "Xa" then nc = i break end
end
local so = so[nc].start
local py = SO['结束游戏']
gg.setValues({{address = so + py, flags = 4, value = "~A8 MOV  W0, #1"}})
gg.setValues({{address = so + py + 4, flags = 4, value = "~A8 RET"}})
gg.toast("开启成功")
end)
else
gg.thread("结算得分关", function()
SO_PT(SO['结束游戏'], "~A8 MOV	 W0, WZR", "~A8 RET")
gg.toast("关闭成功")
end)
end
end
},
{ '一分钟结算', function(isCheck)
if isCheck then
gg.thread("一分钟结算", function()
SO_PT(SO['结算作弊状态'], 4, "~A8 MOV W0, WZR")
SO_PT(SO['结算异常'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['结算恢复'], 4, "~A8 MOV W0, WZR")
SO_PT(SO['屏蔽人机'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['进入结算屏蔽'], 4, "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '发表情退出', function(isCheck)
if isCheck then
gg.thread("发表情退出", function()
SO_PT(SO['发表情退出'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['发表情退出'], SO['发表情退出回调']) .. "]")
SO_PT(SO['终点自动退出'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['终点自动退出'], SO['终点自动退出回调']) .. "]")
gg.toast("开启成功")
end)
end
end
},
{ '表情退出', function(isCheck)
if isCheck then
gg.thread("表情退出", function()
SO_PT(SO['表情退出'], 4, "~A8 B	 [PC,#-0x67BF4]")
gg.toast("开启成功")
end)
end
end
},
{ '自动上分', function(isCheck)
if isCheck then
gg.thread("自动上分", function()
setvalue(gg.getRangesList('libil2cpp.so')[2].start + SO['速度检测'], 4, -698416192)
setvalue(gg.getRangesList('libil2cpp.so')[2].start + SO['速度检测2'], 4, -698416192)
local t = {"libunity.so:bss", "Cb"}
local tt = {0xF83B8, 0x698, 0x668, 0x688, 0x218, 0x3F4}
local ttt = S_Pointer(t, tt, true)
gg.addListItems({{address = ttt, flags = 16, value = 9191, freeze = true}})
local t = {"libunity.so:bss", "Cb"}
local tt = {0xF83B8, 0x698, 0x668, 0x688, 0x218, 0x3F4 + 0x10}
local ttt = S_Pointer(t, tt, true)
gg.addListItems({{address = ttt, flags = 16, value = 9191, freeze = true}})
local mk = gg.getRangesList('libil2cpp.so')[2].start
local pyl = SO['自动速度']
local xg = {
{address = mk + pyl, flags = 4, value = "~A8 RET"},
{address = mk + pyl + 4, flags = 4, value = "~A8 LDR S17, [PC,#0x90000]"},
{address = mk + pyl + 4 + 0x90000, flags = 16, value = 136.0},
{address = mk + pyl + 8, flags = 4, value = "~A8 FCMP S16, S17"},
{address = mk + pyl + 12, flags = 4, value = "~A8 B.GT [PC,#0xC]"},
{address = mk + pyl + 12 + 0xC, flags = 4, value = "~A8 LDR S0, [PC,#0x90000]"},
{address = mk + pyl + 12 + 0xC + 4, flags = 4, value = "~A8 RET"},
{address = mk + pyl + 12 + 0xC + 0x90000, flags = 16, value = 11100.0},
{address = mk + pyl + 16, flags = 4, value = "~A8 LDR S0, [PC,#0x90000]"},
{address = mk + pyl + 16 + 0x90000, flags = 16, value = 0.0},
{address = mk + pyl + 20, flags = 4, value = "~A8 RET"},
{address = mk + pyl, flags = 4, value = "~A8 LDR S16, [X0,#0xF4]"},
}
gg.setValues(xg)
gg.toast("开启成功")
gg.alert('开启成功\n局内下滑一次')
end)
end
end
},
{ '受击道具', function(isCheck)
if isCheck then
gg.thread("受击道具_派对", function()
SO_PT(SO['受到攻击'], 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['受到攻击'], SO['攻击拾取']) .. "]")
gg.toast("开启成功")
end)
end
end
},
{ '无限滑板', function(isCheck)
if isCheck then
gg.thread("无限滑板_派对", function()
function _lib(libs, state)
local lib = gg.getRangesList(libs)
for seed in ipairs(lib) do
if lib[seed].state == state then
return lib[seed].start
end
end
end
function zhix()
local il2cpp_start = _lib('il2cpp', 'Xa')
local targetOffset = il2cpp_start + SO['点击']
local getClass = il2cpp_start + SO['结尾']
local destinationOffset = il2cpp_start + SO['状态']
local ReleaseEnergyOffset = il2cpp_start + SO['释放能量']
local CollectPropOffset = il2cpp_start + SO['攻击拾取']
local register = {
[0] = {0xB8, 32, 0};
[1] = {0x208, 4, 5};
[2] = {0x20C, 16, 80};
[3] = {0x210, 4, 0};
[4] = {0x214, 4, 1};
[5] = {0x218, 32, destinationOffset};
}
local mmap = gg.allocatePage(1 | 2 | 4) + 8
local table_correct = {
{
address = mmap + (#register + 1) * 4,
flags = 4,
value = '~A8 BR X5'
},
{address = ReleaseEnergyOffset, flags = 4, value = '~A8 MOV W0, #1'},
{address = ReleaseEnergyOffset + 4, flags = 4, value = '~A8 RET'},
{address = CollectPropOffset, flags = 4, value = '~A8 RET'},
{address = targetOffset, flags = 4, value = '~A8 LDR X1, [PC,#0x8]'},
{address = targetOffset + 4, flags = 4, value = '~A8 BR X1'},
{address = targetOffset + 8, flags = 32, value = mmap},
{address = getClass, flags = 4, value = '~A8 LDR X2, [PC,#0x8]'},
{address = getClass + 4, flags = 4, value = '~A8 BR X2'},
{
address = getClass + 8,
flags = 32,
value = (mmap - 8)
},
{
address = (mmap - 8),
flags = 4,
value = '~A8 STR X0, [X2,#0xC0]'
},
{
address = (mmap - 4),
flags = 4,
value = '~A8 RET'
},
}
for search = 0, #register do
table_correct[#table_correct + 1], table_correct[#table_correct + 2] = {
address = mmap + search * 4,
flags = 4,
value = '~A8 LDR X' .. search .. ', [PC,#' .. string.format('0x%X', register[search][1]) .. ']'
}, {
address = mmap + (search * 4) + register[search][1],
flags = register[search][2],
value = register[search][3]
}
end
return gg.setValues(table_correct)
end
zhix()
gg.toast("开启成功")
end)
end
end
},
{ '无视道具', function(isCheck)
if isCheck then
gg.thread("无视道具_派对", function()
SO_PT(SO['无视道具1'], 4, "~A8 MOV  W0, #1")
SO_PT(SO['无视道具2'], 4, "~A8 MOV  W0, #1")
gg.toast("开启成功")
end)
end
end
},
{ '无视障碍', function(isCheck)
if isCheck then
gg.thread("无视障碍_派对", function()
SO_PT(SO['无视障碍'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['无视侧撞'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['减速带'], 4, "~A8 MOV W0, WZR")
gg.toast("开启成功")
end)
end
end
},
{ '反弹道具', function(isCheck)
if isCheck then
gg.thread("反弹道具_派对开", function()
SO_PT(SO['反弹道具1'], 4, "~A8 MOV	 W0, #1")
SO_PT(SO['反弹道具2'], 4, "~A8 MOV W0, WZR")
gg.toast("开启成功")
end)
else
gg.thread("反弹道具_派对关", function()
SO_PT(SO['反弹道具2'], 4, "~A8 MOV W0, WZR")
SO_PT(SO['反弹道具1'], 4, "~A8 MOV	 W0, #1")
gg.toast("关闭成功")
end)
end
end
},
{ '快速收集能量', function(isCheck)
if isCheck then
gg.thread("快速收集能量开", function()
gg.alert("使用说明:\n踩加减速带,撞墙,被攻击,跳跃翻滚后/拾取能量.踩加减速带/增加能量\n最好隔一秒再开下一次的滑板否则容易被踢出\n如果因多次行为被踢出,会封号。例如开滑板太快被踢出,包括所有提示行为被踢出")
SO_PT({SO['Buff模式']}, 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['Buff模式'], SO['获取能量1']) .. "]")
SO_PT({SO['跳跃']}, 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['跳跃'], SO['获取能量1']) .. "]")
SO_PT({SO['下滑1']}, 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑1'], SO['获取能量1']) .. "]")
SO_PT({SO['下滑左']}, 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑左'], SO['获取能量1']) .. "]")
SO_PT({SO['下滑中']}, 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑中'], SO['获取能量1']) .. "]")
SO_PT({SO['下滑右']}, 4, "~A8 B [PC,#" .. SOGSPY_ST(SO['下滑右'], SO['获取能量1']) .. "]")
gg.toast("快速收集能量开启成功")
end)
else
gg.thread("快速收集能量关", function()
SO_PT({SO['Buff模式']}, 4, "~A8 MOV  W0, #1")
SO_PT({SO['跳跃']}, 4, "~A8 MOV  W0, #1")
SO_PT({SO['下滑1']}, 4, "~A8 MOV  W0, #1")
SO_PT({SO['下滑左']}, 4, "~A8 MOV  W0, #1")
SO_PT({SO['下滑中']}, 4, "~A8 MOV  W0, #1")
SO_PT({SO['下滑右']}, 4, "~A8 MOV  W0, #1")
gg.toast("快速收集能量关闭成功")
end)
end
end
},
}, "派对赛区")
end
function jingSai_fenshuView()
mainAP({
{ '屏蔽分数检测', '屏蔽分数检测', function()
gg.thread("屏蔽分数检测", function()
BJ_SO(SO['分数赛过检'], 4, "~A8 MOV W0, #1")
gg.toast("开启成功")
end)
end
},
{ '局内分数', '修改局内分数', function()
gg.thread("局内分数", function()
local p = gg.prompt({"输入要修改的分数"}, {""}, {"text"})
if not p then return end
local a = tonumber(p[1])
BJ_D(SO['得到分数'], 4, a, "~A8 RET")
end)
end
},
{ '修改倍数107', '修改倍数107级', function()
switchAp({
{ '修改倍数107', function(isCheck)
if isCheck then
gg.thread("修改倍数107开", function()
BJ_SO(SO['得分倍增'], 4, "~A8 MOV W0, #107")
gg.toast("倍数修改107级成功")
end)
else
gg.thread("修改倍数107关", function()
BJ_SO(SO['得分倍增'], 4, "~A8 MOV W0, #30")
gg.toast("倍数修改30级成功")
end)
end
end
},
}, "修改倍数")
end
},
{ '修改速度', '修改人物速度', function()
gg.thread("修改速度", function()
local lib = gg.getRangesList()
for _ in ipairs(lib) do
if string.find(lib[_].name, 'libil2cpp.so') and lib[_].state == 'Xa' and lib[_].type == 'r-xp' then
module = lib[_].start
break
end
end
function returnValue(set)
local inputRegister
local page = module + set[1]
local mmap = set[4]
local setva = {
{address = mmap + 0x4, flags = 4, value = '~A8 BR X30'},
{address = mmap + set[2], flags = 16, value = set[3]},
{address = page, flags = 4, value = '~A8 LDR X0, [PC,#0x8]'},
{address = page + 0x4, flags = 4, value = '~A8 BR X0'},
{address = page + 0x8, flags = 32, value = mmap},
}
if set[3] % 1 == 0 then
inputRegister = 'X0'
else
inputRegister = 'S0'
end
table.insert(setva, {address = mmap, flags = 4, value = '~A8 LDR ' .. inputRegister .. ', [PC,#' .. string.format('0x%X', set[2]) .. ']'})
return gg.setValues(setva)
end
returnValue{
SO['人物速度'],
0x3BC,
417.5,
gg.allocatePage(gg.PROT_READ | gg.PROT_WRITE | gg.PROT_EXEC),
}
gg.toast("开启成功")
end)
end
},
{ '下滑穿透', '下滑穿透功能', function()
gg.thread("下滑穿透_分数", function()
gg.alert("开启稍慢")
search(4.5, 16)
py1(5.5, 16, 16)
xg1(9191, 16, 0, true)
xg1(9192, 16, 16, true)
gg.alert("开启成功")
end)
end
},
{ '无尽装死', '无尽装死功能', function()
gg.thread("无尽装死", function()
SO_PT(SO['无尽死亡'], "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
},
{ '无限跳跃', '无限跳跃功能', function()
gg.thread("无限跳跃_分数", function()
SO_PT(SO['无限跳跃'], "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
},
{ '滑板飞翔', '滑板飞翔功能', function()
gg.thread("滑板飞翔开", function()
SO_PT(SO['滑板滑翔'], "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
},
{ '滑板跳高', '滑板跳高功能', function()
gg.thread("滑板跳高开", function()
SO_PT(SO['滑板跳高'], "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
},
{ '滑板瞬移', '滑板瞬移功能', function()
gg.thread("滑板瞬移开", function()
SO_PT(SO['滑板瞬移'], "~A8 MOV	 W0, #1")
gg.toast("开启成功")
end)
end
},
{ '撞墙撑杆', '撞墙撑杆功能', function()
gg.thread("撞墙撑杆", function()
SO_PT(SO['无尽死亡'], "~A B	 -0x0000062C")
gg.toast("开启成功")
end)
end
},
{ '金币消失', '金币消失功能', function()
gg.thread("金币消失", function()
SO_PT(SO['金币消失'], '~A8 MOV W0, WZR')
gg.toast("开启成功")
end)
end
},
{ '平板视角', '平板视角功能', function()
gg.thread("平板视角开", function()
search(1.5, 16, 32)
py1(33, 16, 0xC)
py1(20, 16, 0x18)
xg1(45, 16, 0x1C, true)
gg.toast("平板视角开启成功")
end)
end
},
}, tol, "分数赛区")
end
function jingSai_chaonengView()
mainAP({
{ '修改差额分数', '修改差额分数', function()
gg.thread("修改差额分数", function()
local p = gg.prompt({"输入要修改的分数"}, {""}, {"text"})
if not p then return end
local a = tonumber(p[1])
SO_Deposit(SO["差额分数"], 4, a, "~A8 RET")
gg.toast("开启成功")
end)
end
},
{ '无限滑板', '无限滑板功能', function()
gg.thread("无限滑板_超能", function()
SO_PT(SO["无限滑板"], 4, "~A8 MOV  W0, #1")
gg.toast("开启成功")
end)
end
},
}, tol, "超能无尽区")
end
function jingSaiView()
mainAP({
{ '道具赛区', '道具赛相关功能', function()
jingSai_daojuView()
end
},
{ '娱乐区', '娱乐区功能', function()
jingSai_yuleView()
end
},
{ '调出观战区', '观战相关功能', function()
jingSai_guanzhanView()
end
},
{ '派对赛区', '派对赛相关功能', function()
jingSai_paiduiView()
end
},
{ '分数赛区', '分数赛相关功能', function()
jingSai_fenshuView()
end
},
{ '超能无尽区', '超能无尽区功能', function()
jingSai_chaonengView()
end
},
}, tol, "竞赛")
end
function settingView()
mainAP({
{ '退出', '退出脚本', function()
os.exit()
end
},
}, tol, "设置")
end
function tol()
gg.sleep(500)
gg.toast('刷新完成')
end
menuTable = mainAP({
{ '防封', '防封/防闪退/防环境等', fengFenView },
{ '刷号', '数据更改/全解/特殊功能', shuaHaoView },
{ '竞赛', '道具赛/娱乐/观战/派对/分数', jingSaiView },
{ '设置', '退出脚本', settingView },
}, tol, "椎名真晝")
window = menuTable.window
window.setTitle("作者：椎名真晝")
gg.setVisible(false)
gg.setTabVisible(false)
gg.sleep(800)
gg.setTabVisible(true)
gg.toast("欢迎使用")
local serviceMain = import("android.ext.MainService")
local hotPoint = serviceMain.instance.hotPoint
hotPoint.hide()
else
gg.alert(result.msg)
end
end
function unbind(card)
local result, err = auth:unbind(card)
if not result then
gg.alert("解绑初始化失败")
end
if result.code == auth:getCode() then
gg.alert(result.msg)
else
gg.alert(result.msg)
end
end
function checkVersion()
local result, verErr = auth:getVersion()
if result.code == auth:getCode() then
local ver = result.data
local verText = string.format("脚本已更新！\n\n" .. "⏳最新版本: %s \n" .. "⌛️当前版本: %s \n" .. "⏱️更新时间: %s\n" .. "---------------------------\n%s", ver.num or "N/A", luaVersion or "N/A", ver.updateTime or "N/A", ver.content or "无")
if ver.num ~= luaVersion then
info = gg.alert(verText, "", nil, nil)
if info and ver.forced == 1 and ver.addr ~= "" then
local f = io.open(gg.File(), "w")
f:write(gg.makeRequest(ver.addr).content)
f:close()
gg.alert("更新成功！")
exit()
else
exit()
end
end
end
end
if not auth then
gg.alert("初始化失败", err or "未知错误")
os.exot()
end
function tol()
gg.sleep(2000)
gg.toast("刷新完成")
end
function show()
function run(prompt)
if not prompt then
gg.alert("数据异常")
window.close()
end
local card = prompt[1]
local select = prompt[2]
if #card < 5 then
gg.alert("单码长度最少需要5位")
else
if select == 2 then
unbind(card)
else
login(card)
end
end
end
local view = gg.viewPrompt({
"请输入您的单码",
{"单码登录", "单码解绑"}
}, {
auth:getSavedCard(),
1,
}, {
"password",
"number"
}, run, implements)
window = gg.mainTabs("卡密登录", view, false, window)
window.setIcon(luaIcon)
window.setTitle("ArtAuth")
window.setMinIcon(luaIcon)
end
checkVersion()
showNotice(luaNoticeId)
show()
gg.setVisible(false)
gg.setTabVisible(false)
gg.sleep(800)
gg.setTabVisible(true)
gg.toast("欢迎使用")
local serviceMain = import("android.ext.MainService")
local hotPoint = serviceMain.instance.hotPoint
hotPoint.hide()