I have a question. I made a script for the egg timer, so that one could instantly incubate eggs. It works, kinda. I use the label as a pointer, then I set a hotkey to turn on the script and set the value of the pointer to 1. That part worked without a noticeable problem. Then I have another hotkey to disable the script because... there's no reason to keep it running. Granted, there's not a major reason to shut it down, either. Regardless, when I disable the script, the game instantly crashes to the desktop. Any ideas?
Code: Select all
{ Game : ShooterGame.exe
Version:
Date : 2018-11-10
Author : Sigan
This script does blah blah blah
}
define(address,ShooterGame.ADroppedItemEgg::UpdateEgg+269)
define(bytes,F3 0F 11 87 E4 04 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,"ShooterGame.exe"+161E49)
label(_EggTimer)
label(code)
label(return)
newmem:
code:
mov [_EggTimer],rdi
movss [rdi+000004E4],xmm0
jmp return
_EggTimer:
dq 0
address:
jmp newmem
nop
nop
nop
return:
registersymbol(_EggTimer)
[DISABLE]
address:
db bytes
// movss [rdi+000004E4],xmm0
unregistersymbol(_EggTimer)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "ShooterGame.exe"+161E49
"ShooterGame.exe"+161E0C: FF 90 F0 00 00 00 - call qword ptr [rax+000000F0]
"ShooterGame.exe"+161E12: 48 8B 88 D8 00 00 00 - mov rcx,[rax+000000D8]
"ShooterGame.exe"+161E19: F3 44 0F 59 83 B8 07 00 00 - mulss xmm8,[rbx+000007B8]
"ShooterGame.exe"+161E22: F3 0F 10 83 E4 04 00 00 - movss xmm0,[rbx+000004E4]
"ShooterGame.exe"+161E2A: F3 44 0F 59 83 BC 07 00 00 - mulss xmm8,[rbx+000007BC]
"ShooterGame.exe"+161E33: F3 44 0F 59 81 B0 05 00 00 - mulss xmm8,[rcx+000005B0]
"ShooterGame.exe"+161E3C: F3 41 0F 5C C0 - subss xmm0,xmm8
"ShooterGame.exe"+161E41: 0F 2F C7 - comiss xmm0,xmm7
"ShooterGame.exe"+161E44: 73 03 - jae ShooterGame.exe+161E49
"ShooterGame.exe"+161E46: 0F 28 C7 - movaps xmm0,xmm7
// ---------- INJECTING HERE ----------
"ShooterGame.exe"+161E49: F3 0F 11 87 E4 04 00 00 - movss [rdi+000004E4],xmm0
// ---------- DONE INJECTING ----------
"ShooterGame.exe"+161E51: 49 8B 8C 24 08 06 00 00 - mov rcx,[r12+00000608]
"ShooterGame.exe"+161E59: 8B 81 E4 04 00 00 - mov eax,[rcx+000004E4]
"ShooterGame.exe"+161E5F: 41 89 84 24 98 04 00 00 - mov [r12+00000498],eax
"ShooterGame.exe"+161E67: 0F 2F B9 E4 04 00 00 - comiss xmm7,[rcx+000004E4]
"ShooterGame.exe"+161E6E: 0F 82 A4 03 00 00 - jb ShooterGame.exe+162218
"ShooterGame.exe"+161E74: 41 80 BC 24 30 01 00 00 03 - cmp byte ptr [r12+00000130],03
"ShooterGame.exe"+161E7D: 0F 85 95 03 00 00 - jne ShooterGame.exe+162218
"ShooterGame.exe"+161E83: 49 83 BC 24 B8 06 00 00 00 - cmp qword ptr [r12+000006B8],00
"ShooterGame.exe"+161E8C: 74 69 - je ShooterGame.exe+161EF7
"ShooterGame.exe"+161E8E: 48 8B 0D 2B 7C 33 03 - mov rcx,[ShooterGame.exe+3499AC0]
}
