Page 1 of 1

AOB Inject Byte Resets w/ Wildcards

Posted: Mon May 01, 2017 3:47 am
by arlight1
Hello everyone, sorry for making a new topic for this question, but I wanted it separate due to the nature of it.

If I've got a AOB injection script that has a signature of:
F3 41 0F 59 B7 ?? 00 00 00

How can I make it's [DISABLE] redefining fill in the ?? or * to what it is supposed to be as when it found that array? So right now it finds and injects at:

F3 41 0F 59 B7 ?? 00 00 00

but redefines those bytes when disabled at:
db F3 41 0F 59 B7 88 00 00 00

As you can the 88 sometimes changes, which is problematic when disabling the script. Any way to do this?

Thanks.

Re: AOB Inject Byte Resets w/ Wildcards

Posted: Mon May 01, 2017 4:10 am
by STN
in [enable}

readmem the bytes to an allocated memory, then in disable, simple restore those saved bytes using readmem on your allocated memory.

Re: AOB Inject Byte Resets w/ Wildcards

Posted: Mon May 01, 2017 5:25 pm
by arlight1
STN wrote:
Mon May 01, 2017 4:10 am
in [enable}

readmem the bytes to an allocated memory, then in disable, simple restore those saved bytes using readmem on your allocated memory.
I'm sorry, could you provide an example, I don't really follow?

Re: AOB Inject Byte Resets w/ Wildcards

Posted: Tue May 02, 2017 2:08 am
by STN
psuedo code
game.exe+92ace 8b 9f 45 44 01 mov bla bla

[enable]
savebytes:
readmem(aobpoint, 5) //8b 9f 45 44 01
cave:
//awesome injection
//if you wish to recreate original code
readmem(aobpoint, 5)
jmp return

aobpoint: //game.exe+92ace
jmp cave
return:

[disable]
aobpoint:
readmem(savebytes, 5) // 8b 9f 45 44 01

Re: AOB Inject Byte Resets w/ Wildcards

Posted: Wed May 03, 2017 1:37 pm
by arlight1
STN wrote:
Tue May 02, 2017 2:08 am
psuedo code
game.exe+92ace 8b 9f 45 44 01 mov bla bla

[enable]
savebytes:
readmem(aobpoint, 5) //8b 9f 45 44 01
cave:
//awesome injection
//if you wish to recreate original code
readmem(aobpoint, 5)
jmp return

aobpoint: //game.exe+92ace
jmp cave
return:

[disable]
aobpoint:
readmem(savebytes, 5) // 8b 9f 45 44 01
Great! Thank you.