Thanks for the pointer, rambo99jose, but you made the whole thing sound a lot easier than it seems to be. Or I'm just not smart enough
I'm fairly new to this and would like to learn more, since after about 4 hours I only managed to narrow the address down to
Code: Select all
48 8B 01 48 8B D9 FF 90 48 01 00 00 48 85 C0 74 19 48 8B 03 48 8B CB FF 90 48 01 00 00 48 8B C8 48 83 C4 20 5B E9 D0 DD F6 FF
I found it after narrowing the query down to
Code: Select all
48 8B 01 48 8B D9 FF 90 * * * * 48 ?? ?? 74 * 48 8B 03 48 8B CB FF 90
Unfortunately, just a couple of things work now. The values for money, knowledge etc. seem to be wrong and of course most more sophisticated scripts do not work.
The original injection was:
Code: Select all
{
// ORIGINAL CODE - INJECTION POINT: "Tropico6-Win64-Shipping.exe"+5905D6
"Tropico6-Win64-Shipping.exe"+5905C8: CC - int 3
"Tropico6-Win64-Shipping.exe"+5905C9: CC - int 3
"Tropico6-Win64-Shipping.exe"+5905CA: CC - int 3
"Tropico6-Win64-Shipping.exe"+5905CB: CC - int 3
"Tropico6-Win64-Shipping.exe"+5905CC: CC - int 3
"Tropico6-Win64-Shipping.exe"+5905CD: CC - int 3
"Tropico6-Win64-Shipping.exe"+5905CE: CC - int 3
"Tropico6-Win64-Shipping.exe"+5905CF: CC - int 3
"Tropico6-Win64-Shipping.exe"+5905D0: 40 53 - push rbx
"Tropico6-Win64-Shipping.exe"+5905D2: 48 83 EC 20 - sub rsp,20
// ---------- INJECTING HERE ----------
"Tropico6-Win64-Shipping.exe"+5905D6: 48 8B 01 - mov rax,[rcx]
"Tropico6-Win64-Shipping.exe"+5905D9: 48 8B D9 - mov rbx,rcx
// ---------- DONE INJECTING ----------
"Tropico6-Win64-Shipping.exe"+5905DC: FF 90 48 01 00 00 - call qword ptr [rax+00000148]
"Tropico6-Win64-Shipping.exe"+5905E2: 48 85 C0 - test rax,rax
"Tropico6-Win64-Shipping.exe"+5905E5: 74 49 - je Tropico6-Win64-Shipping.exe+590630
"Tropico6-Win64-Shipping.exe"+5905E7: 48 8B 03 - mov rax,[rbx]
"Tropico6-Win64-Shipping.exe"+5905EA: 48 8B CB - mov rcx,rbx
"Tropico6-Win64-Shipping.exe"+5905ED: FF 90 48 01 00 00 - call qword ptr [rax+00000148]
"Tropico6-Win64-Shipping.exe"+5905F3: 48 8B 98 48 01 00 00 - mov rbx,[rax+00000148]
"Tropico6-Win64-Shipping.exe"+5905FA: 48 85 DB - test rbx,rbx
"Tropico6-Win64-Shipping.exe"+5905FD: 74 31 - je Tropico6-Win64-Shipping.exe+590630
"Tropico6-Win64-Shipping.exe"+5905FF: E8 3C 55 55 00 - call Tropico6-Win64-Shipping.exe+AE5B40
}
I get the feeling, I need to understand the rest of the script as well, but that's just beyond me.
For example, wouldn't we need to change the second line of the script as well?
Code: Select all
alloc(newmem,$1000,"Tropico6-Win64-Shipping.exe"+57A186)
I obviously have no idea what I'm doing and sadly even with the instructions I can manage to dig up, the whole process looks like wizardry to me