deathguru

//0002 - амазинг троу
//0010 - килы
//0014 - фултон
//001C - котики
//0028 - смерти
//0068 - хэдшоты
//0070 - допрос
//0074 - ?килы?
//0078 - ножи
//00СС - станы
//009C - меня станят
//00A4 - метка
//00A8 - меня отмечают

//00D4 - экспа

[ENABLE]
aobscanmodule(EXP,mgsvmgo.exe,42 8B 0C 80 01 0A)
alloc(newmem,$1000,"mgsvmgo.exe"+2A0EC16)
label(code)
label(return)
registersymbol(EXP)

newmem:
  add dword ptr [rax+D4],#10000

code:
  mov ecx,[rax+r8*4]
  add [rdx],ecx
  jmp return

EXP:
  jmp newmem
  nop
return:

[DISABLE]
EXP:
  db 42 8B 0C 80 01 0A

unregistersymbol(EXP)
dealloc(newmem)

alloc(newmem,2048,"mgsvmgo.exe"+2A12A1B)
label(returnhere)
label(originalcode)
label(exit)

newmem:

originalcode:
mov eax,[rdx+rax*4]
mov rbx,[rsp+08]

//===============//
// BOUNTY HUNTER //
//===============//

mov [rdx+040],00000620 //Bounty claimed
mov [rdx+23C],005F55D1 //Experience points
mov [rdx+1E8],0062DC6C //Score
mov [rdx+13C],00002160 //Kills
mov [rdx+10C],00000D8C //Headshots
mov [rdx+030],00000C49 //Assists
mov [rdx+074],000009C6 //Deaths
mov [rdx+21C],00000861 //Stuns
mov [rdx+1B8],000004FA //Stunned by Enemy
mov [rdx+0BC],000004FD //Fultons
mov [rdx+0CC],00000292 //Fultoned by enemy
mov [rdx+0DC],000005AF //Fulton saves
mov [rdx+1C8],000009AD //Enemies marked
mov [rdx+1D8],00000507 //Marked by Enemy
mov [rdx+12C],00000287 //Interrogations
mov [rdx+14C],0000019F //Knife Kills
mov [rdx+054],000001FF //Enemies Charmed
mov [rdx+22C],00000217 //WG Destroyed
mov [rdx+010],00000020 //Amazing throws
mov [rdx+16C],00000861 //Missions played
mov [rdx+18C],00000840 //Missions won
mov [rdx+20C],0007B0C0 //Time

//==================//
// CLOAK AND DAGGER //
//==================//

mov [rdx+09C],00000458 //Discs Retreived
mov [rdx+098],0000054A //Discs Picked Up
mov [rdx+094],00000461 //Discs Defended
mov [rdx+240],00368C73 //Experience points
mov [rdx+1EC],0025D396 //Score
mov [rdx+140],00001F31 //Kills
mov [rdx+110],00000860 //Headshots
mov [rdx+034],00000B50 //Assists
mov [rdx+078],000009F0 //Deaths
mov [rdx+220],0000089B //Stuns
mov [rdx+1BC],00000515 //Stunned by Enemy
mov [rdx+0C0],00000477 //Fultons
mov [rdx+0D0],0000029D //Fultoned by enemy
mov [rdx+0E0],00000418 //Fulton saves
mov [rdx+1CC],00000989 //Enemies marked
mov [rdx+1DC],000004E2 //Marked by Enemy
mov [rdx+130],000002BA //Interrogations
mov [rdx+150],000001F8 //Knife Kills
mov [rdx+058],00000223 //Enemies Charmed
mov [rdx+230],00000268 //WG Destroyed
mov [rdx+014],00000025 //Amazing throws
mov [rdx+170],00000835 //Missions played
mov [rdx+190],0000081E //Missions won
mov [rdx+210],00075C60 //Time

//==============//
// COMM CONTROL //
//==============//

mov [rdx+0A0],00001418 //Comm Links Captured
mov [rdx+0A8],0000147C //Comm Links Neutralized
mov [rdx+0A4],00000B3A //Comm Links Defended
mov [rdx+244],002D637D //Experience points
mov [rdx+1F0],002FFB85 //Score
mov [rdx+144],00001D8E //Kills
mov [rdx+114],00000BCD //Headshots
mov [rdx+038],00000B6D //Assists
mov [rdx+07C],000009C2 //Deaths
mov [rdx+224],00000AF7 //Stuns
mov [rdx+1C0],00000504 //Stunned by Enemy
mov [rdx+0C4],0000049A //Fultons
mov [rdx+0D4],0000028B //Fultoned by enemy
mov [rdx+0E4],00000478 //Fulton saves
mov [rdx+1D0],00000996 //Enemies marked
mov [rdx+1E0],000004E9 //Marked by Enemy
mov [rdx+134],000002CA //Interrogations
mov [rdx+154],0000018F //Knife Kills
mov [rdx+05C],00000246 //Enemies Charmed
mov [rdx+234],00000201 //WG Destroyed
mov [rdx+018],00000019 //Amazing throws
mov [rdx+174],00000862 //Missions played
mov [rdx+194],0000084C //Missions won
mov [rdx+214],0006B3A0 //Time

//==========//
// SABOTAGE //
//==========//

mov [rdx+1A4],000003EA //Missiles Fultoned
mov [rdx+1A0],000003FD //Missiles Destroyed
mov [rdx+19C],000014C4 //Missile Damage
mov [rdx+208],00000A3A //Terminal Hacks
mov [rdx+248],002CF2CD //Experience points
mov [rdx+1F4],002F5534 //Score
mov [rdx+148],00001FBD //Kills
mov [rdx+118],00000699 //Headshots
mov [rdx+03C],00000BC4 //Assists
mov [rdx+080],000009C3 //Deaths
mov [rdx+228],000007DB //Stuns
mov [rdx+1C4],00000509 //Stunned by enemy
mov [rdx+0C8],0000040B //Fultons
mov [rdx+0D8],000002A5 //Fultoned by enemy
mov [rdx+0E8],00000475 //Fulton saves
mov [rdx+1D4],00000929 //Enemies Marked
mov [rdx+1E4],000004F0 //Marked by Enemy
mov [rdx+138],000002B0 //Interrogations
mov [rdx+158],0000019C //Knife kills
mov [rdx+060],00000298 //Enemies Charmed
mov [rdx+238],00000299 //WG destroyed
mov [rdx+01C],00000034 //Amazing throws
mov [rdx+178],00000B35 //Missions Played
mov [rdx+198],00000B12 //Mission Won
mov [rdx+218],00098EE0 //Time

exit:
jmp returnhere

"mgsvmgo.exe"+2A12A1B:
jmp newmem
nop
nop
nop
returnhere:

[ENABLE] 
aobscanmodule(EXP,mgsvmgo.exe,42 8B 0C 80 01 0A)
alloc(newmem,$1000,"mgsvmgo.exe"+2A0EC16)
label(code)
label(return)
newmem:
  mov [rax+D4],186A0
code:
  mov ecx,[rax+r8*4]
  add [rdx],ecx
  jmp return
EXP:
  jmp newmem
  nop
return:
registersymbol(EXP)

[DISABLE]
EXP:
  db 42 8B 0C 80 01 0A
unregistersymbol(EXP)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "mgsvmgo.exe"+2A0EC16
"mgsvmgo.exe"+2A0EBFC: 3B 04 01                 -  cmp eax,[rcx+rax]
"mgsvmgo.exe"+2A0EBFF: C3                       -  ret 
"mgsvmgo.exe"+2A0EC00: FA                       -  cli 
"mgsvmgo.exe"+2A0EC01: 89 F8                    -  mov eax,edi
"mgsvmgo.exe"+2A0EC03: 0F B7 C8                 -  movzx ecx,ax
"mgsvmgo.exe"+2A0EC06: 39 F9                    -  cmp ecx,edi
"mgsvmgo.exe"+2A0EC08: 74 21                    -  je mgsvmgo.exe+2A0EC2B
"mgsvmgo.exe"+2A0EC0A: 48 8B 46 38              -  mov rax,[rsi+38]
"mgsvmgo.exe"+2A0EC0E: 48 8D 14 88              -  lea rdx,[rax+rcx*4]
"mgsvmgo.exe"+2A0EC12: 48 8B 46 28              -  mov rax,[rsi+28]
// ---------- INJECTING HERE ----------
"mgsvmgo.exe"+2A0EC16: 42 8B 0C 80              -  mov ecx,[rax+r8*4]
"mgsvmgo.exe"+2A0EC1A: 01 0A                    -  add [rdx],ecx
// ---------- DONE INJECTING  ----------
"mgsvmgo.exe"+2A0EC1C: 44 0F B7 1D 24 7B 44 FF  -  movzx r11d,word ptr [mgsvmgo.exe+1E56748]
"mgsvmgo.exe"+2A0EC24: 4C 8B 15 05 7B 44 FF     -  mov r10,[mgsvmgo.exe+1E56730]
"mgsvmgo.exe"+2A0EC2B: 41 FF C0                 -  inc r8d
"mgsvmgo.exe"+2A0EC2E: 41 0F B7 C3              -  movzx eax,r11w
"mgsvmgo.exe"+2A0EC32: 41 39 C0                 -  cmp r8d,eax
"mgsvmgo.exe"+2A0EC35: 0F 82 73 FF FF FF        -  jb mgsvmgo.exe+2A0EBAE
"mgsvmgo.exe"+2A0EC3B: 48 8B 5C 24 30           -  mov rbx,[rsp+30]
"mgsvmgo.exe"+2A0EC40: 48 8B 74 24 40           -  mov rsi,[rsp+40]
"mgsvmgo.exe"+2A0EC45: 48 83 C4 20              -  add rsp,20
"mgsvmgo.exe"+2A0EC49: 5F                       -  pop rdi
}