Hitman Absolution Teleport

[Garik66]

Ссылка на тему, про которую говорю в видео - ТЫК.

Скрипт "Teleport":

Скрытый текст

{ Game   : HMA.exe
  Version: 
  Date   : 2018-01-07
  Author : Garik66

  This script does blah blah blah
}

[ENABLE]
aobscanmodule(Coord,HMA.exe,89 48 2C 8B 4D C8 89 50 30 89 48 34 83) // should be unique
aobscanmodule(Teleport,HMA.exe,F3 0F 7E 71 2C F3)
alloc(newmem,$1000)
label(newmem1)
label(code)
label(code1)
label(return)
label(return1)
label(P_Coord)
alloc(X,$400)
alloc(Y,$400)
alloc(Z,$400)
label(Load)
label(FlagSave)
registersymbol(FlagSave)
label(FlagLoad)
registersymbol(FlagLoad)
registersymbol(Coord)
registersymbol(Teleport)

newmem:
  mov [P_Coord],eax

code:
  mov [eax+2C],ecx
  mov ecx,[ebp-38]
  jmp return

newmem1:
  push ebx
  push edi
  cmp ecx,[P_Coord]
  jne code1
  cmp [FlagSave],0
  je Load
  mov ebx,[FlagSave]
  dec ebx
  mov edi,[ecx+2C]
  mov [X+ebx*4],edi
  mov edi,[ecx+30]
  mov [Z+ebx*4],edi
  mov edi,[ecx+34]
  mov [Y+ebx*4],edi
  mov [FlagSave],0        // Для того, чтобы было один раз.
  jmp code1

Load:
  cmp [FlagLoad],0
  je code1
  mov ebx,[FlagLoad]
  dec ebx
  cmp [X+ebx*4],0         // Защита от телепорта на нулевые координаты
  je code1
  mov edi,[X+ebx*4]
  mov [ecx+2C],edi
  mov edi,[Z+ebx*4]
  mov [ecx+30],edi
  mov edi,[Y+ebx*4]
  mov [ecx+34],edi
  mov [FlagLoad],0        // Для того, чтобы было один раз.

code1:
  pop edi
  pop ebx
  movq xmm6,[ecx+2C]
  jmp return1

P_Coord:
  dd 0
FlagSave:
  dd 0
FlagLoad:
  dd 0

Coord:
  jmp newmem
  db 90
return:

Teleport:
  jmp newmem1
return1:

[DISABLE]
Coord:
  db 89 48 2C 8B 4D C8
Teleport:
  db F3 0F 7E 71 2C

unregistersymbol(FlagSave)
unregistersymbol(FlagLoad)
unregistersymbol(Coord)
unregistersymbol(Teleport)
dealloc(X)
dealloc(Y)
dealloc(Z)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "HMA.exe"+28CB3A

"HMA.exe"+28CB1A: 8B 50 08              -  mov edx,[eax+08]
"HMA.exe"+28CB1D: 8B 40 0C              -  mov eax,[eax+0C]
"HMA.exe"+28CB20: 89 4D F4              -  mov [ebp-0C],ecx
"HMA.exe"+28CB23: 8B 4D C0              -  mov ecx,[ebp-40]
"HMA.exe"+28CB26: 89 45 FC              -  mov [ebp-04],eax
"HMA.exe"+28CB29: 8B 45 EC              -  mov eax,[ebp-14]
"HMA.exe"+28CB2C: 89 55 F8              -  mov [ebp-08],edx
"HMA.exe"+28CB2F: 0F 28 45 F0           -  movaps xmm0,[ebp-10]
"HMA.exe"+28CB33: 8B 55 C4              -  mov edx,[ebp-3C]
"HMA.exe"+28CB36: 0F 11 40 1C           -  movups [eax+1C],xmm0
// ---------- INJECTING HERE ----------
"HMA.exe"+28CB3A: 89 48 2C              -  mov [eax+2C],ecx
"HMA.exe"+28CB3D: 8B 4D C8              -  mov ecx,[ebp-38]
// ---------- DONE INJECTING  ----------
"HMA.exe"+28CB40: 89 50 30              -  mov [eax+30],edx
"HMA.exe"+28CB43: 89 48 34              -  mov [eax+34],ecx
"HMA.exe"+28CB46: 83 C4 08              -  add esp,08
"HMA.exe"+28CB49: 5F                    -  pop edi
"HMA.exe"+28CB4A: 5E                    -  pop esi
"HMA.exe"+28CB4B: 8B E5                 -  mov esp,ebp
"HMA.exe"+28CB4D: 5D                    -  pop ebp
"HMA.exe"+28CB4E: 8B E3                 -  mov esp,ebx
"HMA.exe"+28CB50: 5B                    -  pop ebx
"HMA.exe"+28CB51: C2 04 00              -  ret 0004
}
{
// ORIGINAL CODE - INJECTION POINT: "HMA.exe"+37986B

"HMA.exe"+379840: 75 29                 -  jne HMA.exe+37986B
"HMA.exe"+379842: F3 0F 10 49 34        -  movss xmm1,[ecx+34]
"HMA.exe"+379847: F3 0F 7E 41 2C        -  movq xmm0,[ecx+2C]
"HMA.exe"+37984C: 0F 28 15 00 AF EA 00  -  movaps xmm2,[HMA.exe+AAAF00]
"HMA.exe"+379853: 0F C6 C1 04           -  shufps xmm0,xmm1,04
"HMA.exe"+379857: 0F 28 C8              -  movaps xmm1,xmm0
"HMA.exe"+37985A: 0F C6 D0 AF           -  shufps xmm2,xmm0,-51
"HMA.exe"+37985E: 0F C6 CA 24           -  shufps xmm1,xmm2,24
"HMA.exe"+379862: 0F 29 4D F0           -  movaps [ebp-10],xmm1
"HMA.exe"+379866: E9 E7 00 00 00        -  jmp HMA.exe+379952
// ---------- INJECTING HERE ----------
"HMA.exe"+37986B: F3 0F 7E 71 2C        -  movq xmm6,[ecx+2C]
// ---------- DONE INJECTING  ----------
"HMA.exe"+379870: F3 0F 10 51 34        -  movss xmm2,[ecx+34]
"HMA.exe"+379875: 0F 10 49 1C           -  movups xmm1,[ecx+1C]
"HMA.exe"+379879: 0F C6 F2 04           -  shufps xmm6,xmm2,04
"HMA.exe"+37987D: 0F 54 35 A0 D6 ED 00  -  andps xmm6,[HMA.exe+ADD6A0]
"HMA.exe"+379884: 0F 57 C0              -  xorps xmm0,xmm0
"HMA.exe"+379887: 8D 50 1C              -  lea edx,[eax+1C]
"HMA.exe"+37988A: 0F 29 45 F0           -  movaps [ebp-10],xmm0
"HMA.exe"+37988E: 0F 10 02              -  movups xmm0,[edx]
"HMA.exe"+379891: F3 0F 10 5A 18        -  movss xmm3,[edx+18]
"HMA.exe"+379896: F3 0F 7E 7A 10        -  movq xmm7,[edx+10]
}

 

 Видео:

Табличка:

HMA.CT