Code: Select all
[ENABLE]
aobscanmodule(8PathSteal,Octopath_Traveler-Win64-Shipping.exe,E8 60EA6401) // should be unique
alloc(newmem,$1000,8PathSteal)
label(scrutinize)
label(allure)
label(thieving)
label(inquiry)
label(lvl99)
label(newvalue)
label(code)
label(return)
newmem:
call Octopath_Traveler-Win64-Shipping.exe+19B7340
push rbx
mov rbx,Octopath_Traveler-Win64-Shipping.exe+0289CC48
mov rbx,[rbx]
cmp r14d,#1
jne code
cmp r8d,#4
jne code
mov rbx,[rbx+370]
mov rbx,[rbx+1C8]
cmp [rdx-4],#3
je scrutinize
cmp [rdx-4],#4
je allure
cmp [rdx-4],#6
je thieving
cmp [rdx-4],#8
je inquiry
jmp code
scrutinize:
lea rbx,[rbx+194]
cmp rdx,rbx
jne code
cmp r15,8BF9A8 //8C7028
je lvl99
cmp r15,8C6E08 //8CE488
je lvl99
jmp code
allure:
lea rbx,[rbx+25C]
cmp rdx,rbx
jne code
cmp r15,8C6798 //8CDE18 //subnemu
je lvl99
cmp r15,8BEF78 //8C65F8 //action
je lvl99
jmp code
thieving:
lea rbx,[rbx+3EC]
cmp rdx,rbx
jne code
cmp r15,8C67C8 //8CDE48
je newvalue
jmp code
inquiry:
lea rbx,[rbx+57C]
cmp rdx,rbx
jne code
cmp r15,8C4D68 //8CC3E8 //field commands preview
je newvalue
cmp r15,8C6968 //8CDFE8 //submenu
je newvalue
cmp r15,8BEA88 //8C6108 //inquiry
je newvalue
jmp code
lvl99:
cmp [rdx],#0
jl code
cmp [rdx],#99
jg code
mov ecx,#99
mov [rax],#99
jmp code
newvalue:
cmp [rdx],#0
jl code
cmp [rdx],#99
jg code
mov ecx,#200
mov [rax],#200
code:
pop rbx
jmp return
8PathSteal:
jmp newmem
return:
registersymbol(8PathSteal)
[DISABLE]
8PathSteal:
db E8 60EA6401
unregistersymbol(8PathSteal)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "Octopath_Traveler-Win64-Shipping.exe"+3671EB
"Octopath_Traveler-Win64-Shipping.exe"+3671CB: 4E 8D 14 39 - lea r10,[rcx+r15]
"Octopath_Traveler-Win64-Shipping.exe"+3671CF: 4C 3B D2 - cmp r10,rdx
"Octopath_Traveler-Win64-Shipping.exe"+3671D2: 74 34 - je Octopath_Traveler-Win64-Shipping.exe+367208 > 3688F8
"Octopath_Traveler-Win64-Shipping.exe"+3671D4: 8B 46 38 - mov eax,[rsi+38]
"Octopath_Traveler-Win64-Shipping.exe"+3671D7: 48 0F BA E0 1E - bt rax,1E
"Octopath_Traveler-Win64-Shipping.exe"+3671DC: 73 14 - jae Octopath_Traveler-Win64-Shipping.exe+3671F2 > 3688E2
"Octopath_Traveler-Win64-Shipping.exe"+3671DE: 8B 46 34 - mov eax,[rsi+34]
"Octopath_Traveler-Win64-Shipping.exe"+3671E1: 49 8B CA - mov rcx,r10
"Octopath_Traveler-Win64-Shipping.exe"+3671E4: 0F AF 46 30 - imul eax,[rsi+30]
"Octopath_Traveler-Win64-Shipping.exe"+3671E8: 4C 63 C0 - movsxd r8,eax
// ---------- INJECTING HERE ----------
"Octopath_Traveler-Win64-Shipping.exe"+3671EB: E8 90 F9 64 01 - call Octopath_Traveler-Win64-Shipping.exe+19B6B80 > 19B7340
// ---------- DONE INJECTING ----------
"Octopath_Traveler-Win64-Shipping.exe"+3671F0: EB 16 - jmp Octopath_Traveler-Win64-Shipping.exe+367208 > 3688F8
"Octopath_Traveler-Win64-Shipping.exe"+3671F2: 48 8B 06 - mov rax,[rsi]
"Octopath_Traveler-Win64-Shipping.exe"+3671F5: 4C 8B C2 - mov r8,rdx
"Octopath_Traveler-Win64-Shipping.exe"+3671F8: 44 8B 4E 30 - mov r9d,[rsi+30]
"Octopath_Traveler-Win64-Shipping.exe"+3671FC: 49 8B D2 - mov rdx,r10
"Octopath_Traveler-Win64-Shipping.exe"+3671FF: 48 8B CE - mov rcx,rsi
"Octopath_Traveler-Win64-Shipping.exe"+367202: FF 90 98 02 00 00 - call qword ptr [rax+00000298]
"Octopath_Traveler-Win64-Shipping.exe"+367208: 49 03 DC - add rbx,r12
"Octopath_Traveler-Win64-Shipping.exe"+36720B: 49 83 EE 01 - sub r14,01
"Octopath_Traveler-Win64-Shipping.exe"+36720F: 75 AF - jne Octopath_Traveler-Win64-Shipping.exe+3671C0 > 3688BO
"NEW ARRAY = E8 60EA6401"
}