Cannot disable aob script.
Posted: Wed Jul 04, 2018 7:17 pm
I am stuck with this code here. I want to replace instruction to NOP. The code work but cannot be disable. Can anyone enlighten me?
[code]
[ENABLE]
aobscanmodule(stoc,Yumina.exe,89 41 04 0F BF 81 4E 02 00 00) // should be unique
define(address,stoc)
define(bytes,89 41 04 0F BF 81 4E 02 00 00)
assert(address,bytes)
address:
nop
nop
nop
[DISABLE]
address:
db 89 41 04 0F BF 81 4E 02 00 00
[/code]
[code]
[ENABLE]
aobscanmodule(stoc,Yumina.exe,89 41 04 0F BF 81 4E 02 00 00) // should be unique
define(address,stoc)
define(bytes,89 41 04 0F BF 81 4E 02 00 00)
assert(address,bytes)
address:
nop
nop
nop
[DISABLE]
address:
db 89 41 04 0F BF 81 4E 02 00 00
[/code]