Хз что за версия.....
[ENABLE]
aobscanmodule(ogran,Stronghold Crusader.exe,0F ? ? ? ? ? ? 01 ? 0F ? ? ? ? ? ? 8B ? ? ? ? ? ? FF)
alloc(newmem,$1000)
label(return)
registersymbol(ogran)
newmem:
mov word ptr [eax+000001AA],#100
movsx edx,word ptr [eax+000001AA]
jmp return
ogran:
jmp newmem
nop 2
return:
[DISABLE]
ogran:
db 0F BF 90 AA 01 00 00
unregistersymbol(ogran)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Stronghold Crusader.exe+230A7
Stronghold Crusader.exe+23077: 66 39 9C 31 A8 01 00 00 - cmp [ecx+esi+000001A8],bx
Stronghold Crusader.exe+2307F: 8D 8C 31 A8 01 00 00 - lea ecx,[ecx+esi+000001A8]
Stronghold Crusader.exe+23086: 7E 09 - jle "Stronghold Crusader.exe"+23091
Stronghold Crusader.exe+23088: 66 83 01 FF - add word ptr [ecx],-01
Stronghold Crusader.exe+2308C: A1 E8 63 B9 00 - mov eax,["Stronghold Crusader.exe"+7963E8]
Stronghold Crusader.exe+23091: 69 C0 2C 03 00 00 - imul eax,eax,0000032C
Stronghold Crusader.exe+23097: 8B D5 - mov edx,ebp
Stronghold Crusader.exe+23099: 69 D2 F4 39 00 00 - imul edx,edx,000039F4
Stronghold Crusader.exe+2309F: 03 C6 - add eax,esi
Stronghold Crusader.exe+230A1: 8D 8A B4 82 19 01 - lea ecx,[edx+"Stronghold Crusader.exe"+D982B4]
// ---------- INJECTING HERE ----------
Stronghold Crusader.exe+230A7: 0F BF 90 AA 01 00 00 - movsx edx,word ptr [eax+000001AA]
// ---------- DONE INJECTING ----------
Stronghold Crusader.exe+230AE: 01 11 - add [ecx],edx
Stronghold Crusader.exe+230B0: 0F BF 80 E6 00 00 00 - movsx eax,word ptr [eax+000000E6]
Stronghold Crusader.exe+230B7: 8B 0C 85 A8 89 5B 00 - mov ecx,[eax*4+"Stronghold Crusader.exe"+1B89A8]
Stronghold Crusader.exe+230BE: FF D1 - call ecx
Stronghold Crusader.exe+230C0: 8B 0D E8 63 B9 00 - mov ecx,["Stronghold Crusader.exe"+7963E8]
Stronghold Crusader.exe+230C6: 8B D1 - mov edx,ecx
Stronghold Crusader.exe+230C8: 69 D2 2C 03 00 00 - imul edx,edx,0000032C
Stronghold Crusader.exe+230CE: 66 39 9C 32 E4 00 00 00 - cmp [edx+esi+000000E4],bx
Stronghold Crusader.exe+230D6: 8D 04 32 - lea eax,[edx+esi]
Stronghold Crusader.exe+230D9: 0F 84 2A 02 00 00 - je "Stronghold Crusader.exe"+23309
}
