Hi guys,
I don't intend to release any additional table for 1.5.1 beta. You guys will have to wait for the official release.
But here is a script that may interest some of you guys:
Code: Select all
//=========================================
[ENABLE]
//=========================================
label(CHP1)
label(CHP2)
label(CHP3)
label(CHP4)
label(CHP5)
registersymbol(CHP1)
registersymbol(CHP2)
registersymbol(CHP3)
registersymbol(CHP4)
registersymbol(CHP5)
aobscanmodule(aob1,$process,80 79 0c 00 74 09 80 79 0d 00 74 03 32 c0 c3 b0 01 c3 cc cc) //show console
aobscanmodule(aob2,$process,80 7f 0c 00 c7 45 fc 00 00 00 00 ?? ?? 80 7f 0d 00) //ironman
aobscanmodule(aob3,$process,80 7f 0c 00 ?? ?? 68 ?? ?? ?? ?? 8d 4d c8 c6 45 c4 00) //dev mode
aobscanmodule(aob4,$process,8b ce 88 47 0e 8d 45 c4 50 e8 ?? ?? ?? ?? 8d 4d e0) //console was used
aobscanmodule(aob5,$process,8B 4D 08 88 47 0e 8d 45 c4 50 e8 ?? ?? ?? ?? 8d 4d e0) //console was used
//=========================================
// Actual script
//=========================================
//Enable to show the console
aob1:
CHP1:
mov al,01
ret
//bypass the check of using console in ironman mode
aob2:
CHP2:
nop
nop
cmp eax,eax
//Removes the check for developer mode
aob3:
CHP3:
nop
nop
cmp eax,eax
//Console was used
aob4:
CHP4:
mov ecx,esi
nop
nop
nop
aob5:
CHP5:
mov ecx,[ebp+08]
nop
nop
nop
//=========================================
[DISABLE]
//=========================================
CHP1:
//cmp byte ptr [eac+0C],00
db 80 79 0C 00
CHP2:
//cmp byte ptr [edi+0C],00
db 80 7F 0C 00
CHP3:
//cmp byte ptr [edi+0C],00
db 80 7F 0C 00
CHP4:
//mov ecx,esi
//mov [edi+0E],al
db 8b ce 88 47 0e
CHP5:
//mov ecx,[ebp+08]
//mov [edi+0E],al
db 8b 4d 08 88 47 0e
unregistersymbol(CHP1)
unregistersymbol(CHP2)
unregistersymbol(CHP3)
unregistersymbol(CHP4)
unregistersymbol(CHP5)
//=========================================
Cheers!