36
"Memory Adresses"
1
40
"Oxygen"
Float
OC1.1.exe+B5D838
27
"Green Crystals"
4 Bytes
OC1.1.exe+BF9880
28
"Red Crystals"
0
4 Bytes
OC1.1.exe+BF9884
29
"Metal"
0
4 Bytes
OC1.1.exe+BF9888
33
"Zorkins (Credit$) - Display Value only"
4 Bytes
OC1.1.exe+B2ED2C
35
"Shells"
4 Bytes
OC1.1.exe+BF987C
37
"Scripts"
1
32
"Unlimited Ammo"
Auto Assembler Script
[ENABLE]
aobscanmodule(ammo,OC1.1.exe,29 86 2C 01 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// sub [esi+0000012C],eax
jmp return
ammo:
jmp newmem
nop
return:
registersymbol(ammo)
[DISABLE]
ammo:
db 29 86 2C 01 00 00
unregistersymbol(ammo)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: OC1.1.exe+43E91B
OC1.1.exe+43E8FF: 8B 06 - mov eax,[esi]
OC1.1.exe+43E901: 51 - push ecx
OC1.1.exe+43E902: F3 0F 11 04 24 - movss [esp],xmm0
OC1.1.exe+43E907: FF 50 48 - call dword ptr [eax+48]
OC1.1.exe+43E90A: 8B F8 - mov edi,eax
OC1.1.exe+43E90C: 85 FF - test edi,edi
OC1.1.exe+43E90E: 0F 84 F1 00 00 00 - je OC1.1.exe+43EA05
OC1.1.exe+43E914: 8B 06 - mov eax,[esi]
OC1.1.exe+43E916: 8B CE - mov ecx,esi
OC1.1.exe+43E918: FF 50 5C - call dword ptr [eax+5C]
// ---------- INJECTING HERE ----------
OC1.1.exe+43E91B: 29 86 2C 01 00 00 - sub [esi+0000012C],eax
// ---------- DONE INJECTING ----------
OC1.1.exe+43E921: 79 0A - jns OC1.1.exe+43E92D
OC1.1.exe+43E923: C7 86 2C 01 00 00 00 00 00 00 - mov [esi+0000012C],00000000
OC1.1.exe+43E92D: 83 EC 0C - sub esp,0C
OC1.1.exe+43E930: 8B C4 - mov eax,esp
OC1.1.exe+43E932: 6A 00 - push 00
OC1.1.exe+43E934: 6A 00 - push 00
OC1.1.exe+43E936: 51 - push ecx
OC1.1.exe+43E937: C7 00 00 00 00 00 - mov [eax],00000000
OC1.1.exe+43E93D: C7 04 24 00 00 00 00 - mov [esp],00000000
OC1.1.exe+43E944: 6A 00 - push 00
}
41
"Unlimited Oxygen (under water)"
Auto Assembler Script
[ENABLE]
aobscanmodule(oxygen,OC1.1.exe,F3 0F 5C C8 0F 57 C0 0F 2F C1 F3 0F 11 0D * * * * 76 44) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
// subss xmm1,xmm0
xorps xmm0,xmm0
jmp return
oxygen:
jmp newmem
nop 2
return:
registersymbol(oxygen)
[DISABLE]
oxygen:
db F3 0F 5C C8 0F 57 C0
unregistersymbol(oxygen)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: OC1.1.exe+40FBD
OC1.1.exe+40F88: 85 D2 - test edx,edx
OC1.1.exe+40F8A: 74 47 - je OC1.1.exe+40FD3
OC1.1.exe+40F8C: E8 9F DB 2F 00 - call OC1.1.exe+33EB30
OC1.1.exe+40F91: 85 C0 - test eax,eax
OC1.1.exe+40F93: 75 3E - jne OC1.1.exe+40FD3
OC1.1.exe+40F95: F3 0F 10 05 A0 3A 65 01 - movss xmm0,[OC1.1.exe+B33AA0]
OC1.1.exe+40F9D: F3 0F 59 05 98 2B 4B 01 - mulss xmm0,[OC1.1.exe+992B98]
OC1.1.exe+40FA5: F3 0F 10 0D 38 D8 67 01 - movss xmm1,[OC1.1.exe+B5D838]
OC1.1.exe+40FAD: F3 0F 5E 05 74 D5 63 01 - divss xmm0,[OC1.1.exe+B1D574]
OC1.1.exe+40FB5: F3 0F 59 05 04 DA 63 01 - mulss xmm0,[OC1.1.exe+B1DA04]
// ---------- INJECTING HERE ----------
OC1.1.exe+40FBD: F3 0F 5C C8 - subss xmm1,xmm0
// ---------- DONE INJECTING ----------
OC1.1.exe+40FC1: 0F 57 C0 - xorps xmm0,xmm0
OC1.1.exe+40FC4: 0F 2F C1 - comiss xmm0,xmm1
OC1.1.exe+40FC7: F3 0F 11 0D 38 D8 67 01 - movss [OC1.1.exe+B5D838],xmm1
OC1.1.exe+40FCF: 76 44 - jna OC1.1.exe+41015
OC1.1.exe+40FD1: EB 37 - jmp OC1.1.exe+4100A
OC1.1.exe+40FD3: F3 0F 10 0D A0 3A 65 01 - movss xmm1,[OC1.1.exe+B33AA0]
OC1.1.exe+40FDB: F3 0F 59 0D 20 2B 4B 01 - mulss xmm1,[OC1.1.exe+992B20]
OC1.1.exe+40FE3: F3 0F 10 05 54 CE 4A 01 - movss xmm0,[OC1.1.exe+98CE54]
OC1.1.exe+40FEB: F3 0F 58 0D 38 D8 67 01 - addss xmm1,[OC1.1.exe+B5D838]
OC1.1.exe+40FF3: 0F 2F C8 - comiss xmm1,xmm0
}
42
"Set Zorks to 100.009 when looting it"
Auto Assembler Script
[ENABLE]
aobscanmodule(zorkins,OC1.1.exe,F3 0F 10 81 48 0F 00 00 F3 0F 58 05 * * * * F3 0F 11 04 24 E8 2B) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
push eax
mov eax,(float)99999
mov [ecx+00000F48], eax
pop eax
code:
movss xmm0,[ecx+00000F48]
jmp return
zorkins:
jmp newmem
nop 3
return:
registersymbol(zorkins)
[DISABLE]
zorkins:
db F3 0F 10 81 48 0F 00 00
unregistersymbol(zorkins)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: OC1.1.exe+31AF6B
OC1.1.exe+31AF4D: CC - int 3
OC1.1.exe+31AF4E: CC - int 3
OC1.1.exe+31AF4F: CC - int 3
OC1.1.exe+31AF50: E8 3B 90 FF FF - call OC1.1.exe+313F90
OC1.1.exe+31AF55: 8B 0D F0 A8 67 01 - mov ecx,[OC1.1.exe+B5A8F0]
OC1.1.exe+31AF5B: 6A 01 - push 01
OC1.1.exe+31AF5D: 6A 0A - push 0A
OC1.1.exe+31AF5F: E8 8C 03 D3 FF - call OC1.1.exe+4B2F0
OC1.1.exe+31AF64: 8B 0D F0 A8 67 01 - mov ecx,[OC1.1.exe+B5A8F0]
OC1.1.exe+31AF6A: 51 - push ecx
// ---------- INJECTING HERE ----------
OC1.1.exe+31AF6B: F3 0F 10 81 48 0F 00 00 - movss xmm0,[ecx+00000F48]
// ---------- DONE INJECTING ----------
OC1.1.exe+31AF73: F3 0F 58 05 7C E8 64 01 - addss xmm0,[OC1.1.exe+B2E87C]
OC1.1.exe+31AF7B: F3 0F 11 04 24 - movss [esp],xmm0
OC1.1.exe+31AF80: E8 2B F4 D3 FF - call OC1.1.exe+5A3B0
OC1.1.exe+31AF85: C3 - ret
OC1.1.exe+31AF86: CC - int 3
OC1.1.exe+31AF87: CC - int 3
OC1.1.exe+31AF88: CC - int 3
OC1.1.exe+31AF89: CC - int 3
OC1.1.exe+31AF8A: CC - int 3
OC1.1.exe+31AF8B: CC - int 3
}