Code: Select all
[ENABLE]
aobscanmodule(_Teleport,ShadowOfWar.exe,F3 0F 10 80 84 00 00 00 F3) // should be unique
//fullaccess(_Teleport,$1000)
alloc(newmem,$1000,ShadowOfWar.exe)
alloc(_SavePosition,8)
alloc(_LoadPosition,8)
alloc(_UndoTeleport,8)
alloc(_base,8)
alloc(_X_Coord,8)
alloc(_Y_Coord,8)
alloc(_Z_Coord,8)
alloc(_X_Coord_Undo,8)
alloc(_Y_Coord_Undo,8)
alloc(_Z_Coord_Undo,8)
registersymbol(_Teleport)
registersymbol(_SavePosition)
registersymbol(_LoadPosition)
registersymbol(_UndoTeleport)
registersymbol(_X_Coord)
registersymbol(_Y_Coord)
registersymbol(_Z_Coord)
registersymbol(_X_Coord_Undo)
registersymbol(_Y_Coord_Undo)
registersymbol(_Z_Coord_Undo)
registersymbol(_base)
label(return)
label(Save)
label(Load)
label(Undo)
label(code)
newmem:
push rax
mov [_base],rax
pop rax
cmp byte ptr [_SavePosition],1
je Save
cmp byte ptr [_LoadPosition],1
je Load
cmp byte ptr [_UndoTeleport],1
je Undo
jmp code
Save:
mov byte ptr [_SavePosition],0
movss xmm1,[rax+00000080] // X
movss [_X_Coord],xmm1
movss xmm1,[rax+00000084] // Y
movss [_Y_Coord],xmm1
movss xmm1,[rax+00000088] // Z
movss [_Z_Coord],xmm1
jmp code
Load:
mov byte ptr [_LoadPosition],0
// Save Position again for Undo
movss xmm3,[rax+00000080] // X
movss [_X_Coord_Undo],xmm3
movss xmm3,[rax+00000084] // Y
movss [_Y_Coord_Undo],xmm3
movss xmm3,[rax+00000088] // Z
movss [_Z_Coord_Undo],xmm3
// Load Part
movss xmm1,[_X_Coord]
movss [rax+00000080],xmm1
movss xmm1,[_Y_Coord]
movss [rax+00000084],xmm1
movss xmm1,[_Z_Coord]
movss [rax+00000088],xmm1
jmp code
Undo:
mov byte ptr [_UndoTeleport],0
movss xmm1,[_X_Coord_Undo]
movss [rax+00000080],xmm1
movss xmm1,[_Y_Coord_Undo]
movss [rax+00000084],xmm1
movss xmm1,[_Z_Coord_Undo]
movss [rax+00000088],xmm1
jmp code
code:
movss xmm0,[rax+00000084]
jmp return
_Teleport:
jmp newmem
nop
nop
nop
return:
_SavePosition:
dd 0
_LoadPosition:
dd 0
_UndoTeleport:
dd 0
[DISABLE]
_Teleport:
db F3 0F 10 80 84 00 00 00
unregistersymbol(_Teleport)
dealloc(newmem)
dealloc(_SavePosition)
dealloc(_LoadPosition)
dealloc(_UndoTeleport)
dealloc(_X_Coord)
dealloc(_Y_Coord)
dealloc(_Z_Coord)
dealloc(_X_Coord_Undo)
dealloc(_Y_Coord_Undo)
dealloc(_Z_Coord_Undo)
dealloc(_base)
unregistersymbol(_Teleport)
unregistersymbol(_SavePosition)
unregistersymbol(_LoadPosition)
unregistersymbol(_UndoTeleport)
unregistersymbol(_X_Coord)
unregistersymbol(_Y_Coord)
unregistersymbol(_Z_Coord)
unregistersymbol(_base)
{
// ORIGINAL CODE - INJECTION POINT: "ShadowOfWar.exe"+1C3B11
"ShadowOfWar.exe"+1C3AEB: 74 38 - je ShadowOfWar.exe+1C3B25
"ShadowOfWar.exe"+1C3AED: 8B 80 00 2A 00 00 - mov eax,[rax+00002A00]
"ShadowOfWar.exe"+1C3AF3: 3D 00 01 00 00 - cmp eax,00000100
"ShadowOfWar.exe"+1C3AF8: 73 2B - jae ShadowOfWar.exe+1C3B25
"ShadowOfWar.exe"+1C3AFA: 8B D0 - mov edx,eax
"ShadowOfWar.exe"+1C3AFC: 48 8B CB - mov rcx,rbx
"ShadowOfWar.exe"+1C3AFF: E8 38 0C 00 00 - call ShadowOfWar.exe+1C473C
"ShadowOfWar.exe"+1C3B04: C6 00 01 - mov byte ptr [rax],01
"ShadowOfWar.exe"+1C3B07: 41 8B 88 AC 00 00 00 - mov ecx,[r8+000000AC]
"ShadowOfWar.exe"+1C3B0E: 89 48 04 - mov [rax+04],ecx
// ---------- INJECTING HERE ----------
"ShadowOfWar.exe"+1C3B11: 41 8B 88 B0 00 00 00 - mov ecx,[r8+000000B0]
// ---------- DONE INJECTING ----------
"ShadowOfWar.exe"+1C3B18: 89 48 08 - mov [rax+08],ecx
"ShadowOfWar.exe"+1C3B1B: 41 8B 88 B4 00 00 00 - mov ecx,[r8+000000B4]
"ShadowOfWar.exe"+1C3B22: 89 48 0C - mov [rax+0C],ecx
"ShadowOfWar.exe"+1C3B25: 33 F6 - xor esi,esi
"ShadowOfWar.exe"+1C3B27: 49 8D 45 10 - lea rax,[r13+10]
"ShadowOfWar.exe"+1C3B2B: 89 75 48 - mov [rbp+48],esi
"ShadowOfWar.exe"+1C3B2E: 8B D6 - mov edx,esi
"ShadowOfWar.exe"+1C3B30: 48 8B C8 - mov rcx,rax
"ShadowOfWar.exe"+1C3B33: 44 8B D6 - mov r10d,esi
"ShadowOfWar.exe"+1C3B36: E8 9D 0B 00 00 - call ShadowOfWar.exe+1C46D8
}
2. Add those adresses to your Adress List: