ChaosHacks

Age of Empires Rise of Rome Infinite build health

Mar 14th, 2019
242
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.87 KB | None | 0 0
  1. { Game : EMPIRESX.EXE Age of Empires Rise of Rome
  2. Version: Latest
  3. Date : 2019-03-15
  4. Author : ChaosHacks
  5.  
  6. This script gives your buildings infinite health. They can take damage but
  7. will always restore themselves to full health.
  8. }
  9.  
  10. [ENABLE]
  11.  
  12. aobscanmodule(InfBuildingHealth,EMPIRESX.EXE,D9 40 30 E8 10 EF 02 00)
  13. alloc(newmem,$1000)
  14.  
  15. label(code)
  16. label(return)
  17. label(farm)
  18. label(house)
  19. label(towncent)
  20. label(barrak)
  21. label(tower)
  22. label(CentTower)
  23. label(GuardTower)
  24. label(smallWall)
  25. label(MedWall)
  26. label(Fortifi)
  27. label(wond)
  28.  
  29. newmem:
  30.  
  31. cmp dword ptr [eax+30],(float)50
  32. je farm
  33.  
  34. cmp dword ptr [eax+30],(float)75
  35. je house
  36.  
  37. cmp dword ptr [eax+30],(float)600
  38. je towncent
  39.  
  40. cmp dword ptr [eax+30],(float)350
  41. je barrak
  42.  
  43. cmp dword ptr [eax+30],(float)100
  44. je tower
  45.  
  46. cmp dword ptr [eax+30],(float)150
  47. je CentTower
  48.  
  49. cmp dword ptr [eax+30],(float)200
  50. je GuardTower
  51.  
  52. cmp dword ptr [eax+30],(float)200
  53. je smallWall
  54.  
  55. cmp dword ptr [eax+30],(float)300
  56. je MedWall
  57.  
  58. cmp dword ptr [eax+30],(float)400
  59. je Fortifi
  60.  
  61. cmp dword ptr [eax+30],(float)500
  62. je wond
  63.  
  64. towncent:
  65. mov dword ptr [eax+30],(float)600
  66. call EMPIRESX.EXE+1283E0
  67. jmp return
  68.  
  69. house:
  70. mov dword ptr [eax+30],(float)75
  71. call EMPIRESX.EXE+1283E0
  72. jmp return
  73.  
  74. barrak:
  75. mov dword ptr [eax+30],(float)350
  76. call EMPIRESX.EXE+1283E0
  77. jmp return
  78.  
  79. farm:
  80. fld dword ptr [eax+30]
  81. call EMPIRESX.EXE+1283E0
  82. jmp return
  83.  
  84. tower:
  85. mov dword ptr [eax+30],(float)100
  86. call EMPIRESX.EXE+1283E0
  87. jmp return
  88.  
  89. CentTower:
  90. mov dword ptr [eax+30],(float)150
  91. call EMPIRESX.EXE+1283E0
  92. jmp return
  93.  
  94. GuardTower:
  95. mov dword ptr [eax+30],(float)200
  96. call EMPIRESX.EXE+1283E0
  97. jmp return
  98.  
  99. smallWall:
  100. mov dword ptr [eax+30],(float)200
  101. call EMPIRESX.EXE+1283E0
  102. jmp return
  103.  
  104. MedWall:
  105. mov dword ptr [eax+30],(float)300
  106. call EMPIRESX.EXE+1283E0
  107. jmp return
  108.  
  109. Fortifi:
  110. mov dword ptr [eax+30],(float)400
  111. call EMPIRESX.EXE+1283E0
  112. jmp return
  113.  
  114. wond:
  115. mov dword ptr [eax+30],(float)500
  116. call EMPIRESX.EXE+1283E0
  117. jmp return
  118.  
  119.  
  120. code:
  121.  
  122. fld dword ptr [eax+30]
  123. call EMPIRESX.EXE+1283E0
  124. jmp return
  125.  
  126. InfBuildingHealth:
  127. jmp newmem
  128. nop
  129. nop
  130. nop
  131. return:
  132. registersymbol(InfBuildingHealth)
  133.  
  134. [DISABLE]
  135.  
  136. InfBuildingHealth:
  137. db D9 40 30 E8 10 EF 02 00
  138.  
  139. unregistersymbol(InfBuildingHealth)
  140. dealloc(newmem)
  141.  
  142. {
  143. // ORIGINAL CODE - INJECTION POINT: "EMPIRESX.EXE"+F94C8
  144.  
  145. "EMPIRESX.EXE"+F949E: C7 03 05 00 00 00 - mov [ebx],00000005
  146. "EMPIRESX.EXE"+F94A4: 89 01 - mov [ecx],eax
  147. "EMPIRESX.EXE"+F94A6: E9 21 FF FF FF - jmp EMPIRESX.EXE+F93CC
  148. "EMPIRESX.EXE"+F94AB: F6 87 9C 01 00 00 20 - test byte ptr [edi+0000019C],20
  149. "EMPIRESX.EXE"+F94B2: 0F 84 14 FF FF FF - je EMPIRESX.EXE+F93CC
  150. "EMPIRESX.EXE"+F94B8: 8B 44 24 18 - mov eax,[esp+18]
  151. "EMPIRESX.EXE"+F94BC: 8A 48 48 - mov cl,[eax+48]
  152. "EMPIRESX.EXE"+F94BF: 84 C9 - test cl,cl
  153. "EMPIRESX.EXE"+F94C1: 75 05 - jne EMPIRESX.EXE+F94C8
  154. "EMPIRESX.EXE"+F94C3: BD 32 00 00 00 - mov ebp,00000032
  155. // ---------- INJECTING HERE ----------
  156. "EMPIRESX.EXE"+F94C8: D9 40 30 - fld dword ptr [eax+30]
  157. "EMPIRESX.EXE"+F94CB: E8 10 EF 02 00 - call EMPIRESX.EXE+1283E0
  158. // ---------- DONE INJECTING ----------
  159. "EMPIRESX.EXE"+F94D0: 85 C0 - test eax,eax
  160. "EMPIRESX.EXE"+F94D2: 0F 8E F4 FE FF FF - jng EMPIRESX.EXE+F93CC
  161. "EMPIRESX.EXE"+F94D8: 3B 44 24 1C - cmp eax,[esp+1C]
  162. "EMPIRESX.EXE"+F94DC: 0F 8D EA FE FF FF - jnl EMPIRESX.EXE+F93CC
  163. "EMPIRESX.EXE"+F94E2: 8B 44 24 38 - mov eax,[esp+38]
  164. "EMPIRESX.EXE"+F94E6: 8D 54 35 00 - lea edx,[ebp+esi+00]
  165. "EMPIRESX.EXE"+F94EA: C7 03 03 00 00 00 - mov [ebx],00000003
  166. "EMPIRESX.EXE"+F94F0: 89 10 - mov [eax],edx
  167. "EMPIRESX.EXE"+F94F2: E9 D5 FE FF FF - jmp EMPIRESX.EXE+F93CC
  168. "EMPIRESX.EXE"+F94F7: 8B 54 24 38 - mov edx,[esp+38]
  169. }
Advertisement
Add Comment
Please, Sign In to add comment