Few record fixes for anyone who wants them:
Print Global Variables: Change line 8 to
Code: Select all
local globals = "EoCApp.exe+298EAB8"
Global Variables: Change the Base Address entry from
EoCApp.exe+1F8F0E8
to
EoCApp.exe+298EAB8
Print Treasure Identifiers: Change line 8 to
Code: Select all
local treasure = "EoCApp.exe+298EAB8"
Set Treasure Level: Seems to work reverting back to:
Code: Select all
[ENABLE]
aobscanmodule(treasure_level,EoCApp.exe,8B AE 28 02 00 00 85)
label(treasure_level_value)
treasure_level:
db 90 BD
treasure_level_value:
dd #10
registersymbol(treasure_level)
registersymbol(treasure_level_value)
[DISABLE]
treasure_level:
db 8B AE 28 02 00 00
unregistersymbol(treasure_level)
unregistersymbol(treasure_level_value)
{
// ORIGINAL CODE - INJECTION POINT: "EoCApp.exe"+12D3B93
"EoCApp.exe"+12D3B72: 48 85 C0 - test rax,rax
"EoCApp.exe"+12D3B75: 74 0C - je EoCApp.exe+12D3B83
"EoCApp.exe"+12D3B77: 48 8B C8 - mov rcx,rax
"EoCApp.exe"+12D3B7A: E8 51 D1 03 00 - call EoCApp.exe+1310CD0
"EoCApp.exe"+12D3B7F: 8B E8 - mov ebp,eax
"EoCApp.exe"+12D3B81: EB 16 - jmp EoCApp.exe+12D3B99
"EoCApp.exe"+12D3B83: 48 8B 0D D6 5D D0 00 - mov rcx,[EoCApp.exe+1FD9960]
"EoCApp.exe"+12D3B8A: E8 E1 A9 0B 00 - call EoCApp.exe+138E570
"EoCApp.exe"+12D3B8F: 8B E8 - mov ebp,eax
"EoCApp.exe"+12D3B91: EB 06 - jmp EoCApp.exe+12D3B99
// ---------- INJECTING HERE ----------
"EoCApp.exe"+12D3B93: 8B AE 28 02 00 00 - mov ebp,[rsi+00000228]
// ---------- DONE INJECTING ----------
"EoCApp.exe"+12D3B99: 85 ED - test ebp,ebp
"EoCApp.exe"+12D3B9B: 79 15 - jns EoCApp.exe+12D3BB2
"EoCApp.exe"+12D3B9D: 4D 85 D2 - test r10,r10
"EoCApp.exe"+12D3BA0: 74 10 - je EoCApp.exe+12D3BB2
"EoCApp.exe"+12D3BA2: 4C 8B C6 - mov r8,rsi
"EoCApp.exe"+12D3BA5: 49 8B D6 - mov rdx,r14
"EoCApp.exe"+12D3BA8: 49 8B CA - mov rcx,r10
"EoCApp.exe"+12D3BAB: E8 70 78 15 00 - call EoCApp.exe+142B420
"EoCApp.exe"+12D3BB0: 8B E8 - mov ebp,eax
"EoCApp.exe"+12D3BB2: 48 8B 1D A7 1A CA 00 - mov rbx,[EoCApp.exe+1F75660]
}
{
// ORIGINAL CODE - INJECTION POINT: "EoCApp.exe"+12B95E0
"EoCApp.exe"+12B95BD: 48 85 C0 - test rax,rax
"EoCApp.exe"+12B95C0: 74 0D - je EoCApp.exe+12B95CF
"EoCApp.exe"+12B95C2: 48 8B C8 - mov rcx,rax
"EoCApp.exe"+12B95C5: E8 36 B8 03 00 - call EoCApp.exe+12F4E00
"EoCApp.exe"+12B95CA: 44 8B E0 - mov r12d,eax
"EoCApp.exe"+12B95CD: EB 18 - jmp EoCApp.exe+12B95E7
"EoCApp.exe"+12B95CF: 48 8B 0D 22 D1 CE 00 - mov rcx,[EoCApp.exe+1FA66F8]
"EoCApp.exe"+12B95D6: E8 55 7B 0B 00 - call EoCApp.exe+1371130
"EoCApp.exe"+12B95DB: 44 8B E0 - mov r12d,eax
"EoCApp.exe"+12B95DE: EB 07 - jmp EoCApp.exe+12B95E7
// ---------- INJECTING HERE ----------
"EoCApp.exe"+12B95E0: 45 8B A6 28 02 00 00 - mov r12d,[r14+00000228]
// ---------- DONE INJECTING ----------
"EoCApp.exe"+12B95E7: 45 85 E4 - test r12d,r12d
"EoCApp.exe"+12B95EA: 79 16 - jns EoCApp.exe+12B9602
"EoCApp.exe"+12B95EC: 4D 85 D2 - test r10,r10
"EoCApp.exe"+12B95EF: 74 11 - je EoCApp.exe+12B9602
"EoCApp.exe"+12B95F1: 4D 8B C6 - mov r8,r14
"EoCApp.exe"+12B95F4: 49 8B D7 - mov rdx,r15
"EoCApp.exe"+12B95F7: 49 8B CA - mov rcx,r10
"EoCApp.exe"+12B95FA: E8 01 33 15 00 - call EoCApp.exe+140C900
"EoCApp.exe"+12B95FF: 44 8B E0 - mov r12d,eax
"EoCApp.exe"+12B9602: 4C 89 6C 24 40 - mov [rsp+40],r13
}