I know many of you might be new to all this but generally please always ask other table makers for permission before including their tables in your own posts / tables.
Besides that we have 25 sites in this thread which have a lot of useful information so please take the time to go through it and read it.
You'll for example find the information that you can simply use
$process instead of the actual process name, this way it doesn't matter if the process name is
FSD-Win64-Shipping.exe or
FSD-WinGDK-Shipping.exe.
You can even open a table with notepad++, select search & replace and then search for the process name and replace with
$process, replace all, save the file and start the table.
I also see many scripts that have all the same injection name (
INJECT), this can / will cause issues, please use unique names.
Then there's also the fact that ppl make script like this:
Code: Select all
[ENABLE]
aobscanmodule(INJECT,FSD-Win64-Shipping.exe,89 87 8C 03 00 00 48 85) // should be unique
alloc(newmem,$1000,INJECT)
label(code)
label(return)
newmem:
code:
// mov [rdi+0000038C],eax
jmp return
INJECT:
jmp newmem
nop
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 89 87 8C 03 00 00
unregistersymbol(INJECT)
dealloc(newmem)
If you just want to get rid of the original code it would be enough to do:
Code: Select all
[ENABLE]
aobscanmodule(myUniqueInjectionName,$process,89 87 8C 03 00 00 48 85)
registersymbol(myUniqueInjectionName)
myUniqueInjectionName.
db 90 90 90 90 90 90
[DISABLE]
myUniqueInjectionName:
db 89 87 8C 03 00 00
unregistersymbol(myUniqueInjectionName)