3
"Infinite Resources"
Auto Assembler Script
[ENABLE]
aobscan(Cash,89 08 8B 43 30 40 89 43 30 8D 65 F4 5E 5F 5B C9 C3 6A) // should be unique
alloc(newmem,$100)
label(code)
label(return)
newmem:
code:
//mov [eax],ecx
mov [eax],(int)9999
mov eax,[ebx+30]
jmp return
Cash:
jmp code
return:
registersymbol(Cash)
[DISABLE]
Cash:
db 89 08 8B 43 30
unregistersymbol(Cash)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 060EC6AF
""+60EC68A: 8D 4F 01 - lea ecx,[edi+01]
""+60EC68D: 39 70 0C - cmp [eax+0C],esi
""+60EC690: 0F 86 36 00 00 00 - jbe 060EC6CC
""+60EC696: 8D 44 B0 10 - lea eax,[eax+esi*4+10]
""+60EC69A: 89 08 - mov [eax],ecx
""+60EC69C: 8B 43 14 - mov eax,[ebx+14]
""+60EC69F: 39 78 0C - cmp [eax+0C],edi
""+60EC6A2: 0F 86 18 00 00 00 - jbe 060EC6C0
""+60EC6A8: 8D 44 B8 10 - lea eax,[eax+edi*4+10]
""+60EC6AC: 8B 4D 10 - mov ecx,[ebp+10]
// ---------- INJECTING HERE ----------
""+60EC6AF: 89 08 - mov [eax],ecx
""+60EC6B1: 8B 43 30 - mov eax,[ebx+30]
// ---------- DONE INJECTING ----------
""+60EC6B4: 40 - inc eax
""+60EC6B5: 89 43 30 - mov [ebx+30],eax
""+60EC6B8: 8D 65 F4 - lea esp,[ebp-0C]
""+60EC6BB: 5E - pop esi
""+60EC6BC: 5F - pop edi
""+60EC6BD: 5B - pop ebx
""+60EC6BE: C9 - leave
""+60EC6BF: C3 - ret
""+60EC6C0: 6A 2A - push 2A
""+60EC6C2: 68 78 06 00 00 - push 00000678
}
5
"Troll&Castle HP"
Auto Assembler Script
[ENABLE]
aobscan(INJECT,D9 5F 5C D9 47 60) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
fstp dword ptr [edi+5C]
mov dword ptr [edi+5C],(float)9999999
fld dword ptr [edi+60]
jmp return
INJECT:
jmp code
nop
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db D9 5F 5C D9 47 60
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 403CC667
""+403CC64D: 73 15 - jae 403CC664
""+403CC64F: 8B 47 1C - mov eax,[edi+1C]
""+403CC652: 8B C8 - mov ecx,eax
""+403CC654: 39 09 - cmp [ecx],ecx
""+403CC656: D9 40 10 - fld dword ptr [eax+10]
""+403CC659: D9 5D F8 - fstp dword ptr [ebp-08]
""+403CC65C: D9 45 F8 - fld dword ptr [ebp-08]
""+403CC65F: D9 5F 5C - fstp dword ptr [edi+5C]
""+403CC662: EB 06 - jmp 403CC66A
""+403CC664: D9 45 0C - fld dword ptr [ebp+0C]
// ---------- INJECTING HERE ----------
""+403CC667: D9 5F 5C - fstp dword ptr [edi+5C]
""+403CC66A: D9 47 60 - fld dword ptr [edi+60]
// ---------- DONE INJECTING ----------
""+403CC66D: D9 47 5C - fld dword ptr [edi+5C]
""+403CC670: DF F1 - fcomip st(0),st(1)
""+403CC672: DD D8 - fstp st(0)
""+403CC674: 7A 02 - jp 403CC678
""+403CC676: 74 25 - je 403CC69D
""+403CC678: 8B 47 38 - mov eax,[edi+38]
""+403CC67B: 85 C0 - test eax,eax
""+403CC67D: 74 1E - je 403CC69D
""+403CC67F: 8B 47 38 - mov eax,[edi+38]
""+403CC682: D9 47 5C - fld dword ptr [edi+5C]
}
Change of fstp dword ptr [edi+5C]
403CC667
0
EB
06
D9
45
0C
D9
5F
5C
D9
47
60
D9
47
Cash
0609ABA7
INJECT
40ACAF97