Worms Armageddon Infinite HP + OHK + Rename unit

[Garik66]

Скрипт:

Скрытый текст

{ Game   : WA.exe
  Version: 
  Date   : 2017-08-09
  Author : Garik66

  This script does blah blah blah
}

[ENABLE]
aobscanmodule(rename,WA.exe,83 BC 0A 78 40 00 00 00 8D) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(IHP)
label(OHK1)
label(InfiniteHP)
registersymbol(InfiniteHP)
label(OHK)
registersymbol(OHK)
label(RenameUnit)
registersymbol(RenameUnit)
label(Unit11)
registersymbol(Unit11)
label(Unit12)
registersymbol(Unit12)
label(Unit13)
registersymbol(Unit13)
label(Unit14)
registersymbol(Unit14)
label(Unit21)
registersymbol(Unit21)
label(Unit22)
registersymbol(Unit22)
label(Unit23)
registersymbol(Unit23)
label(Unit24)
registersymbol(Unit24)
registersymbol(rename)

newmem:
  cmp [RenameUnit],1
  jne IHP
  cmp edx,5B8
  jne @f
  lea esi,[ebp+300]
  mov [Unit11],esi
  jmp IHP

@@:
  cmp edx,654
  jne @f
  lea esi,[ebp+300]
  mov [Unit12],esi
  jmp IHP

@@:
  cmp edx,6F0
  jne @f
  lea esi,[ebp+300]
  mov [Unit13],esi
  jmp IHP

@@:
  cmp edx,78C
  jne @f
  lea esi,[ebp+300]
  mov [Unit14],esi
  jmp IHP

@@:
  cmp edx,AD4
  jne @f
  lea esi,[ebp+300]
  mov [Unit21],esi
  jmp IHP

@@:
  cmp edx,B70
  jne @f
  lea esi,[ebp+300]
  mov [Unit22],esi
  jmp IHP

@@:
  cmp edx,C0C
  jne @f
  lea esi,[ebp+300]
  mov [Unit23],esi
  jmp IHP

@@:
  cmp edx,CA8
  jne @f
  lea esi,[ebp+300]
  mov [Unit24],esi
  jmp IHP

IHP:
  cmp eax,0000051C
  jne OHK1
  cmp [InfiniteHP],1
  jne OHK1
  mov esi,dword ptr [edx+ecx+00004074]
  mov dword ptr [edx+ecx+00004078],esi
  jmp code

OHK1:
  cmp [OHK],1
  jne code
  mov dword ptr [edx+ecx+00004078],0

code:
  cmp dword ptr [edx+ecx+00004078],00
  jmp return

InfiniteHP:
  dd 0
OHK:
  dd 0
RenameUnit:
  dd 0
Unit11:
  dd 0
Unit12:
  dd 0
Unit13:
  dd 0
Unit14:
  dd 0
Unit21:
  dd 0
Unit22:
  dd 0
Unit23:
  dd 0
Unit24:
  dd 0

rename:
  jmp newmem
  db 90 90 90
return:

[DISABLE]
rename:
  db 83 BC 0A 78 40 00 00 00

unregistersymbol(Unit11)
unregistersymbol(Unit12)
unregistersymbol(Unit13)
unregistersymbol(Unit14)
unregistersymbol(Unit21)
unregistersymbol(Unit22)
unregistersymbol(Unit23)
unregistersymbol(Unit24)
unregistersymbol(InfiniteHP)
unregistersymbol(OHK)
unregistersymbol(RenameUnit)
unregistersymbol(rename)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "WA.exe"+EE45A

"WA.exe"+EE42C: 83 BC 01 78 40 00 00 00        -  cmp dword ptr [ecx+eax+00004078],00
"WA.exe"+EE434: 7F 07                          -  jg WA.exe+EE43D
"WA.exe"+EE436: 8B F5                          -  mov esi,ebp
"WA.exe"+EE438: E8 23 9E FF FF                 -  call WA.exe+E8260
"WA.exe"+EE43D: 8B 85 0C 01 00 00              -  mov eax,[ebp+0000010C]
"WA.exe"+EE443: 8B 95 10 01 00 00              -  mov edx,[ebp+00000110]
"WA.exe"+EE449: 69 C0 1C 05 00 00              -  imul eax,eax,0000051C
"WA.exe"+EE44F: 8B 4D 34                       -  mov ecx,[ebp+34]
"WA.exe"+EE452: 69 D2 9C 00 00 00              -  imul edx,edx,0000009C
"WA.exe"+EE458: 03 D0                          -  add edx,eax
// ---------- INJECTING HERE ----------
"WA.exe"+EE45A: 83 BC 0A 78 40 00 00 00        -  cmp dword ptr [edx+ecx+00004078],00
// ---------- DONE INJECTING  ----------
"WA.exe"+EE462: 8D 34 0A                       -  lea esi,[edx+ecx]
"WA.exe"+EE465: 74 27                          -  je WA.exe+EE48E
"WA.exe"+EE467: 83 BC 08 A4 45 00 00 00        -  cmp dword ptr [eax+ecx+000045A4],00
"WA.exe"+EE46F: 75 1D                          -  jne WA.exe+EE48E
"WA.exe"+EE471: 8B 89 64 05 00 00              -  mov ecx,[ecx+00000564]
"WA.exe"+EE477: B8 D3 4D 62 10                 -  mov eax,10624DD3
"WA.exe"+EE47C: F7 E9                          -  imul ecx
"WA.exe"+EE47E: C1 FA 06                       -  sar edx,06
"WA.exe"+EE481: 8B C2                          -  mov eax,edx
"WA.exe"+EE483: C1 E8 1F                       -  shr eax,1F
}

 

Видео:

WA.CT