301
"Disable Hashing (This has to stay active all the time)"
80000008
Auto Assembler Script
[ENABLE]
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
label(next1)
label(next2)
label(continue)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
// Here we mess with the return value...
cmp [esp+8],4D40 // compare the size of the checked region
jne next1// if its not the first one, jump to the next check
mov eax,F25EAAFA // overwrite the result with the spoofed result
jmp continue // continue execution like nothing happend :P
next1:
cmp [esp+8],1894f18
jne next2
mov eax,50667EAF
jmp continue
next2:
cmp [esp+8],FC51A0
jne next2
mov eax,C4E14798
jmp continue
// ... and that's it!
continue:
// original overwritten code? no!
ret
// The following two lines are never hit. We just return our fake result...
exit:
jmp returnhere
"Crysis3.exe"+242ADB7:
jmp newmem
nop
nop
returnhere:
[DISABLE]
"Crysis3.exe"+242ADB7:
cmp byte ptr [3BE3FF1C],00
mov eax,[esp+C]
dealloc(newmem)
304
"Prevent Nade/Arrow Decrease"
80000008
Auto Assembler Script
[ENABLE]
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
call 3729D840
cmp [eax],esi // If [eax] > esi : goto exit
ja exit
mov [eax],esi
exit:
jmp returnhere
"Crysis3.exe"+299191:
jmp newmem
nop
nop
returnhere:
[DISABLE]
dealloc(newmem)
"Crysis3.exe"+299191:
call 3729D840
mov [eax],esi
306
"Always full energy"
80000008
Auto Assembler Script
[ENABLE]
alloc(newmem,500) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
fstp dword ptr [esi]
mov [esi],(float)100
pop esi
add esp,10
exit:
jmp returnhere
"Crysis3.exe"+476171:
jmp newmem
nop
returnhere:
[DISABLE]
dealloc(newmem)
"Crysis3.exe"+476171:
fstp dword ptr [esi]
pop esi
add esp,10
Read ammo for display
376C8B1A
Crysis3.exe
6C8B1A
CF
85
C0
74
F2
8B
40
04
5F
5E
C2
04
00
Write ammo for shooting/reloading
373EFEE7
Crysis3.exe
3EFEE7
24
24
5F
5E
5D
89
42
04
B0
01
5B
83
C4
acces playerX on keypress
384D339B
Crysis3.exe
14D339B
24
F4
00
00
00
F3
0F
58
0F
F3
0F
58
C4
F3
Integrity Check1
3942ADFF
Crysis3.exe
242ADFF
8B
4C
24
08
57
0F
B6
39
8B
F0
C1
EE
18
Integrity Check2 (very rar)
62F58588
nvwgf2um.dll
608588
66
0F
6F
4E
10
66
0F
6F
56
20
66
0F
6F
5E
30
Change ImpactArrow / Nades
37299196
Crysis3.exe
299196
E8
AA
46
00
00
89
30
EB
0F
8D
4C
24
Change Energy
37476171
Crysis3.exe
476171
C1
DE
C1
DE
C9
D9
1E
5E
83
C4
10
C2
Increase Kit Count
377BACB8
Crysis3.exe
7BACB8
04
8B
54
24
08
01
94
81
28
02
00
00
C2
08
00
CC
CC
Change KitCount
381AB0FD
Crysis3.exe
11AB0FD
00
74
0D
8B
CE
89
86
D8
0E
00
00
E8
58
FD
FF
FF
"Crysis3.exe"+22B3C41
EAX is the hash, calculated from the scanned memory region
"Crysis3.exe"+22B3C44
It gets overwritten here, so the result is only stored in [ebp-8]
"Crysis3.exe"+242ADAC
This is a hidden RET 4
"Crysis3.exe"+242ADB5
Jump to RET 4
"Crysis3.exe"+242ADB7
Check if the hashtable is populated
"Crysis3.exe"+242ADBE
Load Initial HashValue
"Crysis3.exe"+242ADC3
Populate the hash table if needed
"Crysis3.exe"+242ADC5
EDX = 0
"Crysis3.exe"+242ADCF
If this is the first iteration?
"Crysis3.exe"+242ADD1
jns = jump on positive numbers
"Crysis3.exe"+242ADDD
This is done on the first iteration
"Crysis3.exe"+242ADF2
load scan size into edx (the parameter stack is skewed because of the 3rd instruction in this function)
"Crysis3.exe"+242ADFA
load scanstart
"Crysis3.exe"+242ADFF
load the target byte
"Crysis3.exe"+242AE02
eax is the accumulator, esi is used to calculate
"Crysis3.exe"+242AE04
esi / eax - gets shifted right, so only one byte is left
"Crysis3.exe"+242AE07
now the old byte is combined with the new one
"Crysis3.exe"+242AE09
the old accumulator value gets shifted left, to make space for the new bytes?
"Crysis3.exe"+242AE0C
esi (the index) is only one byte. This is a dictionary lookup, maybe a mutation table?
"Crysis3.exe"+242AE13
advance the target address by one
"Crysis3.exe"+242AE19
end of integrity check <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
"Crysis3.exe"+242AE2F
Call to integrity check above