.assembly extern mscorlib {} //adds our reference to mscorlib .assembly extern PS3Lib {} //adds our reference to PS3Lib .assembly Test {} //gives our project an assembly .module Test.exe //gives our module a name .class Test.Program extends [mscorlib]System.Object { .field private static class [PS3Lib]PS3Lib.PS3API PS3 //creates our PS3PI variable .method static void Main (string[] args) cil managed //this is our main function { .entrypoint //entry point of our project, this is where your code gets executed first ldc.i4 1 //pushes 1 onto the stack like int r3 = 1 newobj instance void [PS3Lib]PS3Lib.PS3API::.ctor(valuetype [PS3Lib]PS3Lib.SelectAPI) //calls our PS3API constructor stsfld class [PS3Lib]PS3Lib.PS3API Test.Program::PS3//stores the class to our variable call int32 Test.Program::ConnectPS3() //calls our ConnectPS3 function, which connects to the PS3, returns an int32 ldc.i4 1 //pushes 1 onto the stack ceq //checks if the variable that ConnectPS3 returned is equal to one brfalse end //if false, branches to end call void Test.Program::Controller() //runs our controller for buttons monitoring end: //label for end function call string [mscorlib]System.Console::ReadLine() //calls readline so program doesn't exit immediately pop //clears values in stack, I think? I don't have a good explanation http://www.google.com ret //returns } .method public static int32 ConnectPS3() cil managed //declares new function, ConnectPS3 which returns and int32 { ldsfld class [PS3Lib]PS3Lib.PS3API Test.Program::PS3//dunno how2 explain ldc.i4 0 //pushes 0 onto stack, this will be called as the first arg in ConnectTarget, 0 = default console callvirt instance bool [PS3Lib]PS3Lib.PS3API::ConnectTarget(int32) //Connects to PS3, c# would look like PS3Lib.PS3API.ConnectTarget(0) ldc.i4 1 //loads 1 into the stack ceq //compares the two brfalse failedconnect //if they're not equal, will branch to failedconnect ldstr "Successfully connected to PS3" //loads string call void [mscorlib]System.Console::WriteLine(string)//this will print the string we just loaded into the console ldsfld class [PS3Lib]PS3Lib.PS3API Test.Program::PS3//loads our class or something, idk callvirt instance bool [PS3Lib]PS3Lib.PS3API::AttachProcess()//calls AttachProcess, this returns a bool ldc.i4 1 //push 1 ceq //check if equal brfalse failedattach //if not, goes to failedattach ldstr "Successfully attached to process" //loads string call void [mscorlib]System.Console::WriteLine(string)//prints string ldc.i4 1 //push 1 ret //return failedconnect: //label for our branch if cannot connect ldstr "Failed to connect to PS3" //loads string call void [mscorlib]System.Console::WriteLine(string)//prints string ldc.i4 0 //push 0, means we failed ret //will return 0 failedattach: //label for our branch if cannot attach ldstr "Failed to attach to process" //loads string call void [mscorlib]System.Console::WriteLine(string)//prints string ldc.i4 0 //push 0 ret //returns } .method public static int32 getButton() cil managed //new method, returns an int { ldsfld class [PS3Lib]PS3Lib.PS3API Test.Program::PS3//something callvirt instance class [PS3Lib]PS3Lib.Extension [PS3Lib]PS3Lib.PS3API::get_Extension()//dunno how to explain ldc.i4 0x1FC7C90 //pushes our address callvirt instance int32 [PS3Lib]PS3Lib.Extension::ReadInt32(uint32)//will read the int at the address we pushed ret //returns value read from there } .method public static void DrawText(string[], int32) cil managed { .locals init([0] string[] strings, [1] string output, [2] int32 i)//initializes (?) some local variables ldloc output //loads our output string ldstr "~p~IL .net Menu Base\n\n~w~" //loads our string that we want to append on to the other string call string [mscorlib]System.String::Concat(string, string) //concats the strings stloc output //stores it into output loop_s: //label for when we branch ldloc i //pushes our int onto stack ldarg.1 //loads argument 1, second one, our int32 ceq //check if equal brfalse notselected //if not, branches to notselected ldloc output //already explained all of this stuff, all repetitive ldstr "~r~" call string [mscorlib]System.String::Concat(string, string) stloc output br appends notselected: ldloc output ldstr "~w~" call string [mscorlib]System.String::Concat(string, string) stloc output appends: ldloc output //pushes our output string onto stack ldarg.0 //as well as our first argument ldloc i //then our int that we're using for this loop ldelem.ref //unsure how to explain this but basically does like 'ldstr ldarg.0[i]' ldstr "\n" //pushes a new line as well call string [mscorlib]System.String::Concat(string, string, string) //will append all the string together stloc output //stores that string into output ldloc i //loads i ldc.i4 1 //loads 1 add //adds them together stloc i //stores back into i, like i += 1 ldloc i //loads i ldarg.0 //loads arg 0 ldlen //gets the length of the array clt //conditional operator, if i < len(arg.0) do... brtrue loop_s //if true, branches to top of the loop and repeats ldsfld class [PS3Lib]PS3Lib.PS3API Test.Program::PS3//been through all this.. callvirt instance class [PS3Lib]PS3Lib.Extension [PS3Lib]PS3Lib.PS3API::get_Extension() ldc.i4 0x02056B04 ldloc output callvirt instance void [PS3Lib]PS3Lib.Extension::WriteString(uint32, string) ret } .method public static void ToggleText(int32) cil managed { .locals init([0] char input) ldc.i4 3 //pushes 3 stloc input //stores 3 into input, input = 3 ldc.i4 1 //push 1 ldarg.0 //loads arg 0, our int ceq //checks if equal brtrue end //if our int is equal to 1, branches to end ldc.i4 2 //pushes 2 to stack stloc input //stores 2 into input end: ldsfld class [PS3Lib]PS3Lib.PS3API Test.Program::PS3 callvirt instance class [PS3Lib]PS3Lib.Extension [PS3Lib]PS3Lib.PS3API::get_Extension() ldc.i4 0x2057217 //loads address ldloc input //loads our variable, input callvirt instance void [PS3Lib]PS3Lib.Extension::WriteByte(uint32, uint8)//writes it to memory ret //returns nothing } .method public static void SelectOption(int32) cil managed { ldarg.0 //load arg 0 ldc.i4 0 //push 0 ceq //compares brtrue dogodmode //if equal goes to godmode ldarg.0 //repetitive, so skipping this stuff. ldc.i4 1 ceq brtrue option1 ldarg.0 ldc.i4 2 ceq brtrue option2 ldarg.0 ldc.i4 3 ceq brtrue option3 ldarg.0 ldc.i4 4 ceq brtrue option4 ldarg.0 ldc.i4 5 ceq brtrue option5 dogodmode: ldsfld class [PS3Lib]PS3Lib.PS3API Test.Program::PS3 callvirt instance class [PS3Lib]PS3Lib.Extension [PS3Lib]PS3Lib.PS3API::get_Extension() ldc.i4 0x1185D08 ldc.i4 0x38607FFF callvirt instance void [PS3Lib]PS3Lib.Extension::WriteUInt32(uint32, uint32) ldsfld class [PS3Lib]PS3Lib.PS3API Test.Program::PS3 callvirt instance class [PS3Lib]PS3Lib.Extension [PS3Lib]PS3Lib.PS3API::get_Extension() ldc.i4 0x1185D0C ldc.i4 0xB07F00B4 callvirt instance void [PS3Lib]PS3Lib.Extension::WriteUInt32(uint32, uint32) ldstr "Enabled godmode!" call void [mscorlib]System.Console::WriteLine(string) ret option1: ldstr "Selected option 1" call void [mscorlib]System.Console::WriteLine(string) ret option2: ldstr "Selected option 2" call void [mscorlib]System.Console::WriteLine(string) ret option3: ldstr "Selected option 3" call void [mscorlib]System.Console::WriteLine(string) ret option4: ldstr "Selected option 4" call void [mscorlib]System.Console::WriteLine(string) ret option5: ldstr "Selected option 5" call void [mscorlib]System.Console::WriteLine(string) ret } .method public static void Controller() cil managed { .locals init([0] int32 button, [1] string[] strings, [2] int32 option, [3] int32 isopen) //our variables, yeah already explained this ldc.i4 6 //pushes 6 newarr string //will make a string array with length of 6 stloc strings //stores into our strings variable. ex: string[] strings = new string[6] in c# ldloc strings //loads our variable ldc.i4 0 //pushes 0 ldstr "God mode" //pushes our string stelem.ref //stores our string into our array, ex: strings[0] = "God mode" ldloc strings ldc.i4 1 ldstr "Option 1" stelem.ref ldloc strings ldc.i4 2 ldstr "Option 2" stelem.ref ldloc strings ldc.i4 3 ldstr "Option 3" stelem.ref ldloc strings ldc.i4 4 ldstr "Option 4" stelem.ref ldloc strings ldc.i4 5 ldstr "Option 5" stelem.ref loops: call int32 Test.Program::getButton() //gets the button we're pressing stloc button //stores into button ldloc strings //loads our strings that we just made into an array ldloc option //pushes our option call void Test.Program::DrawText(string[], int32) //will draw our text ldc.i4 0 //push 0/false ldloc isopen //pushes isopen, one of our variables ceq //check if equal brtrue monitorup //if menu isn't open, branch to monitorup ldloc button //pushes our button that we press onto stack ldc.i4 0x00000040 //this is the "index" for x button ceq //compares brtrue pressingx //if x is pressed, branches to pressingx ldloc button //skipping the rest ldc.i4 0x00100000 ceq brtrue pressingup ldloc button ldc.i4 0x00400000 ceq brtrue pressingdown ldloc button ldc.i4 0x00000080 ceq brtrue pressingsquare br end pressingup: //label for where we branch to ldloc option //loads our option ldc.i4 0 //pushes 0 ceq //compares the two, this is so we don't like scroll to option -1, which doesnt exist brtrue end //if we're at option 0, will branch to end and ldloc option //otherwise pushes our value ldc.i4 -1 //pushes -1 add //adds them together stloc option //stores back into option, like option -= 1. yeah ik I could use sub as well. ldc.i4 200 //pushes 200 call void [mscorlib]System.Threading.Thread::Sleep(int32) //sleeps for 200 ms br end //branch to end pressingdown: ldloc option //pushes our option num ldloc strings //pushes our strings ldlen //gets length of the array ldc.i4 -1 //pushes 1 add //subtracts 1 from our length ceq //compares brtrue end //if equal, branch to end ldloc option //loads option ldc.i4 1 //push 1 add //adds the two stloc option //stores to option ldc.i4 200 //push 200 call void [mscorlib]System.Threading.Thread::Sleep(int32) //sleeps for 200ms br end //branch to end pressingx: //rest of this should be understandable if you even made it this far ldloc option call void Test.Program::SelectOption(int32) ldc.i4 100 call void [mscorlib]System.Threading.Thread::Sleep(int32) br end pressingsquare: ldc.i4 0 stloc isopen ldc.i4 0 call void Test.Program::ToggleText(int32) ldstr "Closed menu!" call void [mscorlib]System.Console::WriteLine(string) ldc.i4 100 call void [mscorlib]System.Threading.Thread::Sleep(int32) br loops end: ldc.i4 1 //push 1 call void Test.Program::ToggleText(int32)//shows text, like toggletext(true) ldc.i4 0 ldloc isopen ceq brtrue monitorup //checks if menu isn't open, if not, branches to monitor up button so we can re open it br loops //branches back to top of loop monitorup: //already explain ldloc button ldc.i4 0x00100000 ceq brtrue openmenu br loops openmenu: //should be able to understand. ldc.i4 1 stloc isopen ldstr "Opened menu!" call void [mscorlib]System.Console::WriteLine(string) br loops } }