29
"Integrity Check Bypass Rev 001 AOB"
80000008
Auto Assembler Script
//Crysis 3
//Integrity Check Bypass Rev 001
//Steve Andrew ;)
//Special Thanks: Dark Byte
[enable]
alloc(IntegrityCheckBypass,256)
alloc(OnTheFlyCopy,42352640) //Crysis3.exe image base + 0x1000 - Crysis3.exe image base + 0x2865000
aobscan(IntegrityCheckAddress,0f b6 39 8b f0 c1 ee 18 33 f7 c1 e0 08 33)
label(IntegrityCheckRet)
label(SkipMakingCopy)
label(NotInDumpRange)
label(IntegrityCheckAddy)
registersymbol(IntegrityCheckAddy)
IntegrityCheckBypass:
cmp [OnTheFlyCopy],0
jne SkipMakingCopy
push ecx
lea esi,[Crysis3.exe+1000]
lea edi,[OnTheFlyCopy]
mov ecx,2864000
repe movsb
//Fix this bypass hook itself in copy :D
mov ecx,IntegrityCheckAddress
sub ecx,Crysis3.exe+1000
lea edi,[OnTheFlyCopy]
mov [edi+ecx],8b39b60f //movzx edi,byte ptr [ecx]
mov byte ptr [edi+ecx+4],f0 //mov esi,eax
pop ecx
SkipMakingCopy:
cmp ecx,Crysis3.exe+1000
jb NotInDumpRange
cmp ecx,Crysis3.exe+2865000
ja NotInDumpRange
sub ecx,Crysis3.exe+1000
add ecx,OnTheFlyCopy
NotInDumpRange:
movzx edi,byte ptr [ecx]
mov esi,eax
jmp IntegrityCheckRet
OnTheFlyCopy:
dd 0
IntegrityCheckAddress:
IntegrityCheckAddy:
jmp IntegrityCheckBypass
IntegrityCheckRet:
[disable]
//IntegrityCheckAddy:
//movzx edi,byte ptr [ecx]
//mov esi,eax
//dealloc(IntegrityCheckBypass)
//dealloc(OnTheFlyCopy)
//unregistersymbol(IntegrityCheckAddy)
44
"Integrity Check Bypass Checksum Spoofer Method"
80000008
Auto Assembler Script
//Integrity Check Bypass [Checksum Spoofer Method]
//Crysis 3
//Steve Andrew
[enable]
alloc(IntegrityChecksumSpoofer,512)
aobscan(CheckRoutineStart, 80 3d ? ? ? ? 00 8b 44 24 0c 56 75)
aobscan(CheckRoutineHookAddress, 0f b6 39 8b f0 c1 ee 18 33)
label(CheckRoutineHookAddy)
label(ChecksumSpooferRet)
label(Checksums)
label(ChecksumIndex)
label(CorrectCheckBytes)
label(GetChecksumsWhileCoveringTheseHooks)
label(KeepCounting)
label(GotSizeOfAreaToProtect)
label(SizeOfAreaToProtect)
label(CallHook)
label(SizeOfAreaThisChecksumCovers)
label(AlreadyGotChecksums)
label(GetNextValidChecksum)
label(ReturnValidChecksum)
label(SkipHidingTheseHooks)
registersymbol(CheckRoutineHookAddy)
registersymbol(CallHook)
registersymbol(Checksums)
registersymbol(ChecksumIndex)
IntegrityChecksumSpoofer:
pushfd
cmp [CorrectCheckBytes],8b39b60f
je GetChecksumsWhileCoveringTheseHooks
push eax
push ecx
xor ecx,ecx
mov eax,CheckRoutineHookAddress
KeepCounting:
cmp dword ptr [eax],0c2474ff
je GotSizeOfAreaToProtect
inc eax
inc ecx
jmp KeepCounting
GotSizeOfAreaToProtect:
add ecx,0d //add 13 to it
mov [SizeOfAreaToProtect],ecx
mov esi,CheckRoutineHookAddress
mov edi,CorrectCheckBytes
repe movsb
//fix the only hook copied to that correct memory
mov edi,CorrectCheckBytes
mov [edi],8b39b60f
mov byte ptr [edi+4],f0
//do second hook, hooking the call of this routine
mov esi,CheckRoutineHookAddress
add esi,[SizeOfAreaToProtect]
sub esi,5 //go do the start of the 'call [x]' instruction
//to - from - 5
mov edi,CallHook
sub edi,esi
sub edi,5
//hook that call ;) [change it to a jump]
mov byte ptr [esi],e9
mov [esi+1],edi
pop ecx
pop eax
jmp GetChecksumsWhileCoveringTheseHooks
//so we can get the return value / correct checksums + sizes
CallHook:
//could also use [esp]: base address of checksum area
mov eax,[esp+4] //size of checksum area
mov [SizeOfAreaThisChecksumCovers],eax
call CheckRoutineStart
pushfd
cmp [ChecksumIndex],3
je AlreadyGotChecksums
push ebx
push ecx
push edx
mov ebx,Checksums
mov ecx,[ChecksumIndex]
mov edx,[SizeOfAreaThisChecksumCovers]
mov [ebx+ecx*8],edx //backup size of checksum
mov [ebx+ecx*8+4],eax //backup checksum itself
inc [ChecksumIndex]
pop edx
pop ecx
pop ebx
popfd
add esp,0c
ret
AlreadyGotChecksums:
push ebx
push ecx
push edx
xor edx,edx
mov ebx,Checksums
mov ecx,[SizeOfAreaThisChecksumCovers]
GetNextValidChecksum:
cmp [ebx+edx*8],ecx
je ReturnValidChecksum
inc edx
jmp GetNextValidChecksum
ReturnValidChecksum:
mov eax,[ebx+edx*8+4] //Return That VALID Checksum :D
pop edx
pop ecx
pop ebx
popfd
add esp,0c
ret
GetChecksumsWhileCoveringTheseHooks:
push eax
mov eax,CheckRoutineHookAddress
cmp ecx,eax
jb SkipHidingTheseHooks
add eax,[SizeOfAreaToProtect]
cmp ecx,eax
jae SkipHidingTheseHooks
push ecx // this was the trick ;)
sub ecx,CheckRoutineHookAddress
add ecx,CorrectCheckBytes
movzx edi,byte ptr [ecx]
pop ecx
jmp SkipHidingTheseHooks+3
SkipHidingTheseHooks:
movzx edi,byte ptr [ecx]
pop eax
popfd
mov esi,eax
jmp ChecksumSpooferRet
SizeOfAreaToProtect:
dd 0
SizeOfAreaThisChecksumCovers:
dd 0
ChecksumIndex:
dd 0
Checksums: //enough room for 3 checksums + sizes
dd 0 0 0 0 0 0
CorrectCheckBytes:
dd 0
CheckRoutineHookAddress:
CheckRoutineHookAddy:
jmp IntegrityChecksumSpoofer
ChecksumSpooferRet:
[disable]
unregistersymbol(CheckRoutineHookAddy)
unregistersymbol(CallHook)
unregistersymbol(Checksums)
unregistersymbol(ChecksumIndex)
45
"Checksum Index"
80000008
4 Bytes
ChecksumIndex
2
"Infinite Ammo No Reload"
80000008
Auto Assembler Script
//Infinite Ammo + No Reload
//Crysis 3
[enable]
alloc(NoReload,64)
label(NoReloadRet)
NoReload:
mov eax,63
mov [edx+4],eax
mov al,1
jmp NoReloadRet
Crysis3.exe+234f47:
jmp NoReload
NoReloadRet:
[disable]
Crysis3.exe+234f47:
mov [edx+4],eax
mov al,1
dealloc(NoReload)
32
"Infinite Energy"
80000008
Auto Assembler Script
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
label(FullEnergy)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
fld dword ptr [FullEnergy]
mov edx,[edx+08]
exit:
jmp returnhere
FullEnergy:
dd (float)100
"Crysis3.exe"+3C173B:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Crysis3.exe"+3C173B:
fld dword ptr [eax]
mov edx,[edx+08]
//Alt: db D9 00 8B 52 08
40
"Infinite Arrows"
80000008
Auto Assembler Script
[enable]
alloc(InfiniteArrows,64)
InfiniteArrows:
mov eax,9
ret 0004
Crysis3.exe+3b3574:
jmp InfiniteArrows
nop
[disable]
Crysis3.exe+3b3574:
mov eax,[edx+14]
ret 0004
//Alt: db 8B 42 14 C2 04 00
dealloc(InfiniteArrows)
Code :movzx edi,byte ptr [ecx]
3942D00F
Crysis3.exe
242D00F
8B
4C
24
08
57
0F
B6
39
8B
F0
C1
EE
18
Change of jmp 567D0035
567D0035
0
04
F0
59
5F
5E
EB
FE
81
F9
00
10
00
Change of je Crysis3.exe+22B5E78
392B5E65
Crysis3.exe
22B5E65
68
35
1B
00
00
74
11
81
04
24
06
43
Change of jne Crysis3.exe+22B5EA0
392B5EB5
Crysis3.exe
22B5EB5
FF
4C
24
10
90
75
E9
80
4C
24
14
01
Change of jna Crysis3.exe+22B5ED8
392B5EC4
Crysis3.exe
22B5EC4
14
77
03
00
00
76
12
90
C7
04
24
38
Change of jna Crysis3.exe+22C6187
392C617C
Crysis3.exe
22C617C
1C
F9
0C
00
00
76
09
90
BC
00
00
00
Change of jle Crysis3.exe+22C5F99
392C5F92
Crysis3.exe
22C5F92
6C
07
00
00
90
7E
05
83
C4
08
FF
E1
Change of je Crysis3.exe+242D028
3942D008
Crysis3.exe
242D008
54
24
0C
85
D2
74
1E
8B
4C
24
08
57
CopyDone
65690404
DisablingInfiniteLoopBypass
021D001C
CurrentAddy
022B009E
IntegrityCheckAddy
3942D00F
ChecksumAddressBase
0E190041
SizeOfChecksum
01E5003A
CheckRoutineHookAddy
3942D00F
Checksums
01E2012B
ChecksumIndex
01E20127
SizeOfAreaThisChecksumCovers
01E20123
CorrectCheckBytes
01E2015F
SizeOfAreaToProtect
01E2011F
CallHook
01E20073