justiny wrote: ↑Wed Mar 18, 2020 1:30 pm
Proper inf item consumable without the inf looting
{ Game : StateOfDecay2-Win64-Shipping.exe
Version:
Date : 2020-03-18
Author : Justiny
This script does blah blah blah
}
[ENABLE]
aobscanmodule(INJECT,StateOfDecay2-Win64-Shipping.exe,89 08 89 1E C6 07 00) // should be unique
alloc(newmem,$1000,"StateOfDecay2-Win64-Shipping.exe"+4ACE08)
label(code)
label(return)
newmem:
code:
sub [rax],0
mov [rsi],ebx
mov byte ptr [rdi],00
jmp return
INJECT:
jmp newmem
nop 2
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 89 08 89 1E C6 07 00
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "StateOfDecay2-Win64-Shipping.exe"+4ACE08
"StateOfDecay2-Win64-Shipping.exe"+4ACDEB: 48 83 EC 20 - sub rsp,20
"StateOfDecay2-Win64-Shipping.exe"+4ACDEF: 48 8B 01 - mov rax,[rcx]
"StateOfDecay2-Win64-Shipping.exe"+4ACDF2: 49 8B F9 - mov rdi,r9
"StateOfDecay2-Win64-Shipping.exe"+4ACDF5: 49 8B F0 - mov rsi,r8
"StateOfDecay2-Win64-Shipping.exe"+4ACDF8: 8B DA - mov ebx,edx
"StateOfDecay2-Win64-Shipping.exe"+4ACDFA: FF 90 08 02 00 00 - call qword ptr [rax+00000208]
"StateOfDecay2-Win64-Shipping.exe"+4ACE00: 8B 08 - mov ecx,[rax]
"StateOfDecay2-Win64-Shipping.exe"+4ACE02: 3B CB - cmp ecx,ebx
"StateOfDecay2-Win64-Shipping.exe"+4ACE04: 7E 19 - jle StateOfDecay2-Win64-Shipping.exe+4ACE1F
"StateOfDecay2-Win64-Shipping.exe"+4ACE06: 2B CB - sub ecx,ebx
// ---------- INJECTING HERE ----------
"StateOfDecay2-Win64-Shipping.exe"+4ACE08: 89 08 - mov [rax],ecx
"StateOfDecay2-Win64-Shipping.exe"+4ACE0A: 89 1E - mov [rsi],ebx
"StateOfDecay2-Win64-Shipping.exe"+4ACE0C: C6 07 00 - mov byte ptr [rdi],00
// ---------- DONE INJECTING ----------
"StateOfDecay2-Win64-Shipping.exe"+4ACE0F: 48 8B 5C 24 30 - mov rbx,[rsp+30]
"StateOfDecay2-Win64-Shipping.exe"+4ACE14: 48 8B 74 24 38 - mov rsi,[rsp+38]
"StateOfDecay2-Win64-Shipping.exe"+4ACE19: 48 83 C4 20 - add rsp,20
"StateOfDecay2-Win64-Shipping.exe"+4ACE1D: 5F - pop rdi
"StateOfDecay2-Win64-Shipping.exe"+4ACE1E: C3 - ret
"StateOfDecay2-Win64-Shipping.exe"+4ACE1F: 75 1B - jne StateOfDecay2-Win64-Shipping.exe+4ACE3C
"StateOfDecay2-Win64-Shipping.exe"+4ACE21: C7 00 00 00 00 00 - mov [rax],00000000
"StateOfDecay2-Win64-Shipping.exe"+4ACE27: 89 1E - mov [rsi],ebx
"StateOfDecay2-Win64-Shipping.exe"+4ACE29: C6 07 01 - mov byte ptr [rdi],01
"StateOfDecay2-Win64-Shipping.exe"+4ACE2C: 48 8B 5C 24 30 - mov rbx,[rsp+30]
}