"Островки" - взлом по заякам

[Garik66]

1. Сам запрос - здесь.

2. Скрипт "Freeze Timer":

Скрытый текст

{ Game   : game.exe
  Version: 
  Date   : 2017-01-09
  Author : Garik66

  This script does blah blah blah
}

[ENABLE]
aobscanmodule(Timer,game.exe,D9 86 D4 03 00 00 89 45 EC D8 9E CC 03 00 00 57) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
registersymbol(Timer)

newmem:
  mov dword ptr [esi+000003D4],0

code:
  fld dword ptr [esi+000003D4]
  jmp return

Timer:
  jmp newmem
  db 90
return:

[DISABLE]
Timer:
  db D9 86 D4 03 00 00

unregistersymbol(Timer)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "game.exe"+14017C

"game.exe"+14015A: 64 A1 00 00 00 00     -  mov eax,fs:[00000000]
"game.exe"+140160: 50                    -  push eax
"game.exe"+140161: 64 89 25 00 00 00 00  -  mov fs:[00000000],esp
"game.exe"+140168: 51                    -  push ecx
"game.exe"+140169: B8 54 11 00 00        -  mov eax,00001154
"game.exe"+14016E: E8 3D 5F 1F 00        -  call game.exe+3360B0
"game.exe"+140173: A1 6C 84 92 00        -  mov eax,[game.exe+52846C]
"game.exe"+140178: 53                    -  push ebx
"game.exe"+140179: 56                    -  push esi
"game.exe"+14017A: 8B F1                 -  mov esi,ecx
// ---------- INJECTING HERE ----------
"game.exe"+14017C: D9 86 D4 03 00 00     -  fld dword ptr [esi+000003D4]
// ---------- DONE INJECTING  ----------
"game.exe"+140182: 89 45 EC              -  mov [ebp-14],eax
"game.exe"+140185: D8 9E CC 03 00 00     -  fcomp dword ptr [esi+000003CC]
"game.exe"+14018B: 57                    -  push edi
"game.exe"+14018C: 89 65 F0              -  mov [ebp-10],esp
"game.exe"+14018F: C7 45 FC 00 00 00 00  -  mov [ebp-04],00000000
"game.exe"+140196: DF E0                 -  fnstsw ax
"game.exe"+140198: F6 C4 05              -  test ah,05
"game.exe"+14019B: 7A 7E                 -  jp game.exe+14021B
"game.exe"+14019D: D9 86 CC 03 00 00     -  fld dword ptr [esi+000003CC]
"game.exe"+1401A3: 8B 8E DC 03 00 00     -  mov ecx,[esi+000003DC]
}

 

3. Видео:

 

4. Табличка

Табличку выложил в следующем сообщении.

Изменено 23 января, 2017 пользователем Garik66

[Garik66]

2. Скрипт "Resources":

Скрытый текст

{ Game   : game.exe
  Version: 
  Date   : 2017-01-23
  Author : Garik66

  This script does blah blah blah
}

[ENABLE]
aobscanmodule(resources,game.exe,08 56 8B C8 8B 31 8B 44 24 1C) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(flag)
registersymbol(flag)
label(p_resources)
registersymbol(p_resources)
registersymbol(resources)

newmem:
  cmp [flag],1
  jne @f
  mov [ecx],a
  mov [ecx+04],a
  mov [ecx+08],a
  mov [ecx+10],a
  mov [ecx+0c],a
  jmp code

@@:
  cmp [flag],2
  jne code
  lea esi,[ecx]
  mov [p_resources],esi

code:
  mov esi,[ecx]
  mov eax,[esp+1C]
  jmp return

flag:
  dd 0
p_resources:
  dd 0

resources+04:
  jmp newmem
  db 90
return:

[DISABLE]
resources+04:
  db 8B 31 8B 44 24 1C

unregistersymbol(flag)
unregistersymbol(p_resources)
unregistersymbol(resources)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "game.exe"+1879CD

"game.exe"+1879AD: 50                    -  push eax
"game.exe"+1879AE: 64 89 25 00 00 00 00  -  mov fs:[00000000],esp
"game.exe"+1879B5: 83 EC 08              -  sub esp,08
"game.exe"+1879B8: A1 6C 84 92 00        -  mov eax,[game.exe+52846C]
"game.exe"+1879BD: 89 04 24              -  mov [esp],eax
"game.exe"+1879C0: 8B 41 04              -  mov eax,[ecx+04]
"game.exe"+1879C3: 8B 50 04              -  mov edx,[eax+04]
"game.exe"+1879C6: 8D 44 0A 08           -  lea eax,[edx+ecx+08]
"game.exe"+1879CA: 56                    -  push esi
"game.exe"+1879CB: 8B C8                 -  mov ecx,eax
// ---------- INJECTING HERE ----------
"game.exe"+1879CD: 8B 31                 -  mov esi,[ecx]
"game.exe"+1879CF: 8B 44 24 1C           -  mov eax,[esp+1C]
// ---------- DONE INJECTING  ----------
"game.exe"+1879D3: 8B D0                 -  mov edx,eax
"game.exe"+1879D5: 89 32                 -  mov [edx],esi
"game.exe"+1879D7: 8B 71 04              -  mov esi,[ecx+04]
"game.exe"+1879DA: 89 72 04              -  mov [edx+04],esi
"game.exe"+1879DD: 8B 71 08              -  mov esi,[ecx+08]
"game.exe"+1879E0: 89 72 08              -  mov [edx+08],esi
"game.exe"+1879E3: 8B 71 0C              -  mov esi,[ecx+0C]
"game.exe"+1879E6: 89 72 0C              -  mov [edx+0C],esi
"game.exe"+1879E9: 8B 49 10              -  mov ecx,[ecx+10]
"game.exe"+1879EC: 89 4A 10              -  mov [edx+10],ecx
}

 

Видео:

 

Табличка:

For_antony.CT

Изменено 23 января, 2017 пользователем Garik66