Page 1 of 1

Cannot disable aob script.

Posted: Wed Jul 04, 2018 7:17 pm
by polis27
I am stuck with this code here. I want to replace instruction to NOP. The code work but cannot be disable. Can anyone enlighten me?



[code]

[ENABLE]



aobscanmodule(stoc,Yumina.exe,89 41 04 0F BF 81 4E 02 00 00) // should be unique

define(address,stoc)

define(bytes,89 41 04 0F BF 81 4E 02 00 00)



assert(address,bytes)



address:

nop

nop

nop



[DISABLE]



address:

db 89 41 04 0F BF 81 4E 02 00 00

[/code]

Cannot disable aob script.

Posted: Wed Jul 04, 2018 7:31 pm
by FreeER
get rid of the defines and assert... the aobscan does both.



Then add [icode]registerSymbol(address)[/icode] in the enable section and [icode]unregisterSymbol(address)[/icode] in the disable section and make sure that name is unique (you don't have any other scripts registering the same symbol). That way the disable section can know where the code was found in the enable section (they're run separately and don't automagically know about each other)

Cannot disable aob script.

Posted: Wed Jul 04, 2018 8:13 pm
by polis27
It work. Didn't see that. Thank you