define(address,"Tutorial-i386.exe"+23B78)
define(bytes,8B 83 80 04 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$100)
label(code)
label(return)
label(jumpto)
newmem:
code:
cmp [ecx+08],1
je jumpto
cmp eax,eax
jmp return
jumpto:
mov [ecx+14],(float)100
jmp return
address:
jmp newmem
nop
return:
[DISABLE]
address:
db bytes
dealloc(newmem)
define(address,"Tutorial-i386.exe"+23B78)
define(bytes,8B 83 80 04 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$100)
label(code)
label(return)
label(jumpto)
newmem:
code:
cmp [ecx+08],1
je jumpto
cmp eax,eax
jmp return
jumpto:
mov [ecx+14],(float)100
jmp return
address:
jmp newmem
nop
return:
[DISABLE]
address:
db bytes
dealloc(newmem)
define(address,"Tutorial-i386.exe"+23B78)
define(bytes,8B 83 80 04 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$100)
label(code)
label(return)
label(jumpto)
newmem:
code:
cmp [ecx+08],1
je jumpto
cmp eax,eax
jmp return
jumpto:
mov [ecx+14],(float)100
jmp return
address:
jmp newmem
nop
return:
[DISABLE]
address:
db bytes
dealloc(newmem)
define(address,"Tutorial-i386.exe"+23B78)
define(bytes,8B 83 80 04 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$100)
label(code)
label(return)
label(jumpto)
newmem:
code:
cmp [ecx+08],1
je jumpto
cmp eax,eax
jmp return
jumpto:
mov [ecx+14],(float)100
jmp return
address:
jmp newmem
nop
return:
[DISABLE]
address:
db bytes
dealloc(newmem)
[ENABLE]
aobscanmodule(Inf_Money,game.exe,89 87 A4 01 00 00 EB)
alloc(newmem,$1000)
globalalloc(playeronlyflag,1)
playeronlyflag:
db 0 //Write a '0' byte to the playeronlyflag to initialize it after allocating. db writes a byte, dd 4 bytes, dq 8 bytes. A flag is (usually) a boolean (true/false, 1/0) so we only need a byte.
label(code)
label(return)
label(player)
newmem:
cmp [edi+000001EC],0 //check if this is player
jne code //jump to original code if this is not player
cmp [playeronlyflag],1 //check if playeronly is active
je player
code:
mov [edi+000001A4],eax
jmp return
player:
sub [edi+000001A4],eax
push ebx
mov ebx,[edi+000001A4]
mov [edi+000001A4],eax
add [edi+000001A4],ebx // money wont decrease, adding spent money instead of deduct
pop ebx
jmp return
Inf_Money:
jmp newmem
nop
return:
registersymbol(Inf_Money)
[DISABLE]
Inf_Money:
db 89 87 A4 01 00 00
unregistersymbol(Inf_Money)
unregistersymbol(playeronlyflag)
dealloc(newmem)
dealloc(playeronlyflag)