Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- [ENABLE]
- aobscanmodule(InfTowers,age3.exe,3B 75 04 0F 8C 22 FF FF FF)
- alloc(newmem,$1000)
- label(code)
- label(return)
- newmem:
- pushf
- pushad
- //compares list
- //EBP
- //0 me=26431640
- //4 me=4
- //8 me=4
- //EBX is the same apart from the following EBX group 2 0x1D79C5A0
- //0 me=264303216
- //ECX is the same as EBX ECX group 2 0x1D79C5A8
- //RSP
- //EC me=0
- //2D8 me=1
- //cmp [edx+978],#1 sadly you crash game
- cmp EBX,1D79C5A0
- je code
- popad
- popf
- jmp return
- code:
- popad
- popf
- cmp esi,[ebp+04]
- jl age3.exe+3423A
- jmp return
- InfTowers:
- jmp newmem
- nop
- nop
- nop
- nop
- return:
- registersymbol(InfTowers)
- [DISABLE]
- InfTowers:
- db 3B 75 04 0F 8C 22 FF FF FF
- unregistersymbol(InfTowers)
- dealloc(newmem)
- {
- // ORIGINAL CODE - INJECTION POINT: "age3.exe"+3430F
- "age3.exe"+342EA: 80 7B 51 01 - cmp byte ptr [ebx+51],01
- "age3.exe"+342EE: 0F 84 67 0F 21 00 - je age3.exe+24525B
- "age3.exe"+342F4: 80 7B 52 01 - cmp byte ptr [ebx+52],01
- "age3.exe"+342F8: 0F 84 6D 0F 21 00 - je age3.exe+24526B
- "age3.exe"+342FE: 8B 55 00 - mov edx,[ebp+00]
- "age3.exe"+34301: 8B 04 B2 - mov eax,[edx+esi*4]
- "age3.exe"+34304: 50 - push eax
- "age3.exe"+34305: 8B CB - mov ecx,ebx
- "age3.exe"+34307: E8 9F 05 00 00 - call age3.exe+348AB
- "age3.exe"+3430C: 83 C6 01 - add esi,01
- // ---------- INJECTING HERE ----------
- "age3.exe"+3430F: 3B 75 04 - cmp esi,[ebp+04]
- "age3.exe"+34312: 0F 8C 22 FF FF FF - jl age3.exe+3423A
- // ---------- DONE INJECTING ----------
- "age3.exe"+34318: 5F - pop edi
- "age3.exe"+34319: EB 1F - jmp age3.exe+3433A
- "age3.exe"+3431B: 83 EC 24 - sub esp,24
- "age3.exe"+3431E: 53 - push ebx
- "age3.exe"+3431F: 8B 5C 24 30 - mov ebx,[esp+30]
- "age3.exe"+34323: 85 DB - test ebx,ebx
- "age3.exe"+34325: 55 - push ebp
- "age3.exe"+34326: 8B E9 - mov ebp,ecx
- "age3.exe"+34328: 0F 84 72 0D 21 00 - je age3.exe+2450A0
- "age3.exe"+3432E: 56 - push esi
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement