Partizan

Инструкция на таймер.
add [ebx+00004C38],esi
EBX=004D3030

Инструкция проверки влючён или нет ноклип
cmp byte ptr [esi+3D],00
ESI=004DDA08

VCRUNTIME140.memcpy+11C:
7FFD14621409 - C3 - ret 
7FFD1462140A - 8B 0A  - mov ecx,[rdx]
7FFD1462140C - 89 08  - mov [rax],ecx <<
7FFD1462140E - C3 - ret 
7FFD1462140F - 90 - nop 

RAX=000001F332DDC2C4
RBX=0000000000000000
RCX=000000004333EC58
RDX=00000075CDACEA58
RSI=000001F32A437840
RDI=000001F3196D7080
RSP=00000075CDACE898
RBP=00000075CDACE8C0
RIP=00007FFD1462140E
R8=0000000000000004
R9=00007FFD1462140A
R10=00007FFD14620000
R11=000001F332DDC2C4
R12=000001F332DDBA40
R13=00007FF798E46430
R14=00000075CDACEAB0
R15=0000000000000000

[ENABLE]
aobscanmodule(Stamina,DrugDealerSimulator-Win64-Shipping.exe,4C 8B ? 4C 8D ? ? ? 48 8B ? 48 8B ? 41 FF ? ? ? ? ? 48 8B ? ? ? 0F 28)
alloc(newmem,$1000,Stamina)
label(return)
registersymbol(Stamina)

newmem:
  fld [rbx+880]
 fstp [rbx+884]
  mov r9,[rbx]
  lea r8,[rsp+40]
  jmp return

Stamina:
  jmp newmem
  nop 3
return:

[DISABLE]
Stamina:
db 4C 8B 0B 4C 8D 44 24 40
unregistersymbol(Stamina)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: DrugDealerSimulator-Win64-Shipping.exe+1734E4F
DrugDealerSimulator-Win64-Shipping.exe+1734E28: E8 03 E9 FF FE        - call DrugDealerSimulator-Win64-Shipping.exe+733730
DrugDealerSimulator-Win64-Shipping.exe+1734E2D: 48 85 C0              - test rax,rax
DrugDealerSimulator-Win64-Shipping.exe+1734E30: 74 32                 - je DrugDealerSimulator-Win64-Shipping.exe+1734E64
DrugDealerSimulator-Win64-Shipping.exe+1734E32: 48 8B CF              - mov rcx,rdi
DrugDealerSimulator-Win64-Shipping.exe+1734E35: F3 0F 11 74 24 40     - movss [rsp+40],xmm6
DrugDealerSimulator-Win64-Shipping.exe+1734E3B: E8 80 85 01 FF        - call DrugDealerSimulator-Win64-Shipping.exe+74D3C0
DrugDealerSimulator-Win64-Shipping.exe+1734E40: 48 8B 57 08           - mov rdx,[rdi+08]
DrugDealerSimulator-Win64-Shipping.exe+1734E44: 48 8B C8              - mov rcx,rax
DrugDealerSimulator-Win64-Shipping.exe+1734E47: 48 8B D8              - mov rbx,rax
DrugDealerSimulator-Win64-Shipping.exe+1734E4A: E8 01 E9 FF FE        - call DrugDealerSimulator-Win64-Shipping.exe+733750
// ---------- INJECTING HERE ----------
DrugDealerSimulator-Win64-Shipping.exe+1734E4F: 4C 8B 0B              - mov r9,[rbx]
// ---------- DONE INJECTING  ----------
DrugDealerSimulator-Win64-Shipping.exe+1734E52: 4C 8D 44 24 40        - lea r8,[rsp+40]
DrugDealerSimulator-Win64-Shipping.exe+1734E57: 48 8B D0              - mov rdx,rax
DrugDealerSimulator-Win64-Shipping.exe+1734E5A: 48 8B CB              - mov rcx,rbx
DrugDealerSimulator-Win64-Shipping.exe+1734E5D: 41 FF 91 00 02 00 00  - call qword ptr [r9+00000200]
DrugDealerSimulator-Win64-Shipping.exe+1734E64: 48 8B 7C 24 48        - mov rdi,[rsp+48]
DrugDealerSimulator-Win64-Shipping.exe+1734E69: 0F 28 74 24 20        - movaps xmm6,[rsp+20]
DrugDealerSimulator-Win64-Shipping.exe+1734E6E: 48 83 C4 30           - add rsp,30
DrugDealerSimulator-Win64-Shipping.exe+1734E72: 5B                    - pop rbx
DrugDealerSimulator-Win64-Shipping.exe+1734E73: C3                    - ret 
DrugDealerSimulator-Win64-Shipping.exe+1734E74: CC                    - int 3 
}

NStW_x64.exe+4EE43E - mov rcx,[rdi+18]----------------Указатель
NStW_x64.exe+4EE442 - movss xmm1,[rcx+0000012C]-------Максимальное ХП
NStW_x64.exe+4EE44A - ucomiss xmm1,xmm10
NStW_x64.exe+4EE44E - jp NStW_x64.exe+4EE452
NStW_x64.exe+4EE450 - je NStW_x64.exe+4EE48B
NStW_x64.exe+4EE452 - test byte ptr [rcx+000000A8],01
NStW_x64.exe+4EE459 - je NStW_x64.exe+4EE46D
NStW_x64.exe+4EE45B - movss xmm0,[rcx+00000130]-------Текушее ХП

[ENABLE]
aobscanmodule(off_trigger,GameAssembly.dll,74 ? 8B 43 ? 89 41 ? 33 D2 E8 ? ? ? ? 48 8B)
registersymbol(off_trigger)
off_trigger:
db EB 4D

[DISABLE]
off_trigger:
db 74 4D
unregistersymbol(off_trigger)
{
// ORIGINAL CODE - INJECTION POINT: GameAssembly.dll+F2452F
GameAssembly.dll+F24511: 74 65              - je GameAssembly.dll+F24578
GameAssembly.dll+F24513: 48 8B 49 18        - mov rcx,[rcx+18]
GameAssembly.dll+F24517: 48 85 C9           - test rcx,rcx
GameAssembly.dll+F2451A: 74 56              - je GameAssembly.dll+F24572
GameAssembly.dll+F2451C: 33 D2              - xor edx,edx
GameAssembly.dll+F2451E: E8 FD 68 0A 00     - call GameAssembly.dll+FCAE20
GameAssembly.dll+F24523: 48 85 C0           - test rax,rax
GameAssembly.dll+F24526: 74 5C              - je GameAssembly.dll+F24584
GameAssembly.dll+F24528: 48 8B 48 28        - mov rcx,[rax+28]
GameAssembly.dll+F2452C: 48 85 C9           - test rcx,rcx
// ---------- INJECTING HERE ----------
GameAssembly.dll+F2452F: 74 4D              - je GameAssembly.dll+F2457E
// ---------- DONE INJECTING  ----------
GameAssembly.dll+F24531: 8B 43 2C           - mov eax,[rbx+2C]
GameAssembly.dll+F24534: 89 41 10           - mov [rcx+10],eax
GameAssembly.dll+F24537: 00 00              - add [rax],al
GameAssembly.dll+F24539: 46 93              - xchg eax,ebx
GameAssembly.dll+F2453B: 17                 - pop ss
GameAssembly.dll+F2453C: 02 00              - add al,[rax]
GameAssembly.dll+F2453E: 00 90 0D F3 F9 4F  - add [rax+4FF9F30D],dl
GameAssembly.dll+F24544: 03 F6              - add esi,esi
GameAssembly.dll+F24546: 81 27 01 00 00 02  - and [rdi],02000001
GameAssembly.dll+F2454C: 74 0E              - je GameAssembly.dll+F2455C
}

function myattach(timer)
  if getProcessIDFromProcessName("xxx.exe") ~= nil then
    object_destroy(timer)
    openProcess("xxx.exe") 
  end
end

t=createTimer(nil);
timer_setInterval(t,10)
timer_onTimer(t,myattach)