Maybe someone knows a guide about this too, that would be great.
This is something harder to cheat than I've thought and still I wanna try and spent hours in.
Currently I try to restore an old script about bloons: Adventure Time TD game
The creator of the code said I can use it and try my best.
Code: Select all
// Game : btdadventuretime.exe
// Version:
// Date :
// Author : Cs
[ENABLE]
aobscanmodule(aobCashGrabber,GameAssembly.dll,01 48 8B 0D ?? ?? ?? ?? 48 8B 9B 10 02 00 00)
alloc(newmemCashGrabber,4096,aobCashGrabber)
label(aobCashGrabber_r)
label(aobCashGrabber_i)
registersymbol(aobCashGrabber_r)
registersymbol(aobCashGrabber_i)
label(lblCashGrabber)
label(lblCashGrabberSkip)
label(lblCashGrabberRet)
label(bEnableMinCash)
label(dMinCash)
registersymbol(bEnableMinCash)
registersymbol(dMinCash)
newmemCashGrabber:
bEnableMinCash:
dd 1
dMinCash:
dq (double)999999.0
lblCashGrabber:
readmem(aobCashGrabber+08,7)
push rax
push rcx
push rdx
push r10
cmp dword ptr [bEnableMinCash],1
jne short lblCashGrabberSkip
mov rax,[GameAssembly.dll+1ED25F8]
mov rax,[rax+000000B8]
mov rcx,[rax]
mov rax,[rbx+10]
mov rdx,[rax+20]
movsxd rax,[rbx+18]
mov rcx,[rcx+rax*8+20]
mov r10,[rcx+20]
xor rdx,r10
mov rax,[dMinCash]
cmp rdx,rax
jge short lblCashGrabberSkip
mov rdx,rax
xor rdx,r10
mov rax,[rbx+10]
mov [rax+20],rdx
lblCashGrabberSkip:
pop r10
pop rdx
pop rcx
pop rax
jmp lblCashGrabberRet
aobCashGrabber_i:
readmem(aobCashGrabber+08,7)
aobCashGrabber+08:
aobCashGrabber_r:
jmp lblCashGrabber
nop
nop
lblCashGrabberRet:
[DISABLE]
aobCashGrabber_r:
readmem(aobCashGrabber_i,7)
unregistersymbol(aobCashGrabber_r)
unregistersymbol(aobCashGrabber_i)
unregistersymbol(bEnableMinCash)
unregistersymbol(dMinCash)
dealloc(newmemCashGrabber)
I know this:
The game uses the CryptVarDouble class to store the cash.
CryptVarDouble is a proprietary class.
It uses a System.Byte[] to store a the byte sausage.
The byte sausage itself is 8 bytes, representing the double.
The byte sausage is continually re-encrypted using a collection of 16 random XOR keys.
I'm curious how to restore the "?? ?? ?? ??" in the code
I feel I'm close to the solution.
currently I try to find the stack value in Tracer (Break and Trace instruction)
Maybe someone has an idea or guides.
ty.
