The extra push and such just because someone might wonder why I'm doing it is that the name is stored through a pointer (IE. address points to an address that then points to the value)
Code: Select all
[ENABLE]
aobscanmodule(Characters,EoCApp.exe,41 8B 87 24 01 00 00 41) // should be unique
alloc(newmem,$1000,"EoCApp.exe"+D5797D)
label(code)
label(return)
label(hero_base)
registersymbol(hero_base)
newmem:
push ebx
mov ebx,[r15+28]
mov [hero_base],ebx
cmp [ebx+0],'FemaleHero'
pop ebx
jne code
mov [hero_base],r15
code:
mov eax,[r15+00000124]
jmp return
hero_base:
dd 0
Characters:
jmp newmem
nop
nop
return:
registersymbol(Characters)
[DISABLE]
Characters:
db 41 8B 87 24 01 00 00
unregistersymbol(Characters)
unregistersymbol(hero_base)
dealloc(newmem)