Bonus action point:
76CA9F450543 - 8B 48 54 - mov ecx,[rax+54] <----------
76CA9F450539 - 89 45 D4 - mov [rbp-2C],eax
76CA9F45053C - 89 45 FC - mov [rbp-04],eax
76CA9F45053F - 48 8B 45 10 - mov rax,[rbp+10]
76CA9F450543 - 8B 48 54 - mov ecx,[rax+54] <----------
76CA9F450546 - 89 4D 9C - mov [rbp-64],ecx
76CA9F450549 - 8B 55 FC - mov edx,[rbp-04]
76CA9F45054C - 03 D1 - add edx,ecx
76CA9F45054E - 89 55 D4 - mov [rbp-2C],edx
76CA9F450551 - 48 8B C8 - mov rcx,rax
[ENABLE]
aobscan(bonus,8B 48 54 89 4D 9C) // should be unique
alloc(newmem,$1000,bonus)
label(code)
label(return)
newmem:
mov [rax+54], #3
code:
mov ecx,[rax+54]
mov [rbp-64],ecx
jmp return
bonus:
jmp newmem
nop
return:
registersymbol(bonus)
[DISABLE]
bonus:
db 8B 48 54 89 4D 9C
unregistersymbol(bonus)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 76CA9F450543
76CA9F45051E: 48 8B CA - mov rcx,rdx
76CA9F450521: 49 8B D1 - mov rdx,r9
76CA9F450524: 4D 8B CB - mov r9,r11
76CA9F450527: 48 83 EC 20 - sub rsp,20
76CA9F45052B: E8 C0 B5 5D 00 - call 76CA9FA2BAF0
76CA9F450530: 48 89 6C 24 F8 - mov [rsp-08],rbp
76CA9F450535: 48 83 C4 20 - add rsp,20
76CA9F450539: 89 45 D4 - mov [rbp-2C],eax
76CA9F45053C: 89 45 FC - mov [rbp-04],eax
76CA9F45053F: 48 8B 45 10 - mov rax,[rbp+10]
// ---------- INJECTING HERE ----------
76CA9F450543: 8B 48 54 - mov ecx,[rax+54]
// ---------- DONE INJECTING ----------
76CA9F450546: 89 4D 9C - mov [rbp-64],ecx
76CA9F450549: 8B 55 FC - mov edx,[rbp-04]
76CA9F45054C: 03 D1 - add edx,ecx
76CA9F45054E: 89 55 D4 - mov [rbp-2C],edx
76CA9F450551: 48 8B C8 - mov rcx,rax
76CA9F450554: 48 83 EC 20 - sub rsp,20
76CA9F450558: E8 23 00 00 00 - call 76CA9F450580
76CA9F45055D: 48 89 6C 24 F8 - mov [rsp-08],rbp
76CA9F450562: 48 83 C4 20 - add rsp,20
76CA9F450566: 89 45 9C - mov [rbp-64],eax
}