for
( gold feathers ) inf fly
{ Game : A Short Hike.exe
Version: q1
Date : 2024-02-28
Author : AdminsUP
This script does blah blah blah
}
define(address,296D6271C58)
define(bytes,89 86 C4 02 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,296D6271C58)
label(code)
label(return)
newmem:
code:
mov eax,(byte)17
mov [rsi+000002C4],eax
jmp return
address:
jmp newmem
nop
return:
[DISABLE]
address:
db bytes
// mov [rsi+000002C4],eax
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 296D6271C58
296D6271C3A: 00 00 - add [rax],al
296D6271C3C: 00 00 - add [rax],al
296D6271C3E: 00 00 - add [rax],al
296D6271C40: 55 - push rbp
296D6271C41: 48 8B EC - mov rbp,rsp
296D6271C44: 48 83 EC 30 - sub rsp,30
296D6271C48: 48 89 75 F8 - mov [rbp-08],rsi
296D6271C4C: 48 8B F1 - mov rsi,rcx
296D6271C4F: 48 63 86 C4 02 00 00 - movsxd rax,dword ptr [rsi+000002C4]
296D6271C56: FF C8 - dec eax
// ---------- INJECTING HERE ----------
296D6271C58: 89 86 C4 02 00 00 - mov [rsi+000002C4],eax
// ---------- DONE INJECTING ----------
296D6271C5E: 48 8B 86 C0 00 00 00 - mov rax,[rsi+000000C0]
296D6271C65: 48 8B C8 - mov rcx,rax
296D6271C68: BA 01 00 00 00 - mov edx,00000001
296D6271C6D: 83 38 00 - cmp dword ptr [rax],00
296D6271C70: 48 8D 64 24 00 - lea rsp,[rsp+00]
296D6271C75: 90 - nop
296D6271C76: 49 BB 10 1D 27 D6 96 02 00 00 - mov r11,00000296D6271D10
296D6271C80: 41 FF D3 - call r11
296D6271C83: 48 63 86 C4 02 00 00 - movsxd rax,dword ptr [rsi+000002C4]
296D6271C8A: 85 C0 - test eax,eax
}
Code: Select all
{ Game :A Short Hike.exe
Version: q1
Date : 2024-02-28
Author : AdminsUP
This script does blah blah blah[attachment=0]A Short Hike1.CT[/attachment]
}
define(address,296D6271C58)
define(bytes,89 86 C4 02 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,296D6271C58)
label(code)
label(return)
newmem:
code:
mov eax,(byte)17
mov [rsi+000002C4],eax
jmp return
address:
jmp newmem
nop
return:
[DISABLE]
address:
db bytes
// mov [rsi+000002C4],eax
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 296D6271C58
296D6271C3A: 00 00 - add [rax],al
296D6271C3C: 00 00 - add [rax],al
296D6271C3E: 00 00 - add [rax],al
296D6271C40: 55 - push rbp
296D6271C41: 48 8B EC - mov rbp,rsp
296D6271C44: 48 83 EC 30 - sub rsp,30
296D6271C48: 48 89 75 F8 - mov [rbp-08],rsi
296D6271C4C: 48 8B F1 - mov rsi,rcx
296D6271C4F: 48 63 86 C4 02 00 00 - movsxd rax,dword ptr [rsi+000002C4]
296D6271C56: FF C8 - dec eax
// ---------- INJECTING HERE ----------
296D6271C58: 89 86 C4 02 00 00 - mov [rsi+000002C4],eax
// ---------- DONE INJECTING ----------
296D6271C5E: 48 8B 86 C0 00 00 00 - mov rax,[rsi+000000C0]
296D6271C65: 48 8B C8 - mov rcx,rax
296D6271C68: BA 01 00 00 00 - mov edx,00000001
296D6271C6D: 83 38 00 - cmp dword ptr [rax],00
296D6271C70: 48 8D 64 24 00 - lea rsp,[rsp+00]
296D6271C75: 90 - nop
296D6271C76: 49 BB 10 1D 27 D6 96 02 00 00 - mov r11,00000296D6271D10
296D6271C80: 41 FF D3 - call r11
296D6271C83: 48 63 86 C4 02 00 00 - movsxd rax,dword ptr [rsi+000002C4]
296D6271C8A: 85 C0 - test eax,eax
}
downlod TEst work
(
)