5 "Invulnerability when playing Rabbits" Auto Assembler Script [ENABLE] aobscanmodule(health,swine.exe,F3 0F 10 86 88 02 00 00 83) // should be unique alloc(newmem,$1000) label(code) label(return) newmem: // just for debugging purposes ("find what this code accesses" to fill dissect data) push eax mov eax,[esi] pop eax // at first, check out if it us our unit or not cmp [esi+258],0 jne code cmp [esi+25c],0 jne code // if we get here, it should be our unit. // so load max health and put it to current health push eax mov eax,[esi+28] mov [esi+288],eax // then load 100 to eax mov eax, (float)100 // and write it to fuel mov [esi+28c],eax { other way would be mov eax, [esi+78] // load max fuel as integer movd xmm47,eax // and convert it to float cvtdq2ps xmm47,xmm47 } // copy maximum ammo to current ammo mov eax,[esi+94] mov [esi+290],eax // restore original eax to prevent crashes pop eax code: movss xmm0,[esi+00000288] jmp return health: jmp newmem nop nop nop return: registersymbol(health) [DISABLE] health: db F3 0F 10 86 88 02 00 00 unregistersymbol(health) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: "swine.exe"+B41C3 "swine.exe"+B4197: 0F 2E 0D 70 27 2F 00 - ucomiss xmm1,[swine.exe+142770] "swine.exe"+B419E: F3 0F 59 5D F4 - mulss xmm3,[ebp-0C] "swine.exe"+B41A3: 9F - lahf "swine.exe"+B41A4: F3 0F 11 55 F8 - movss [ebp-08],xmm2 "swine.exe"+B41A9: F6 C4 44 - test ah,44 "swine.exe"+B41AC: F3 0F 11 5D F4 - movss [ebp-0C],xmm3 "swine.exe"+B41B1: F3 0F 11 4D F0 - movss [ebp-10],xmm1 "swine.exe"+B41B6: 8B 01 - mov eax,[ecx] "swine.exe"+B41B8: F3 0F 11 4D FC - movss [ebp-04],xmm1 "swine.exe"+B41BD: 0F 8B E3 03 00 00 - jnp swine.exe+B45A6 // ---------- INJECTING HERE ---------- "swine.exe"+B41C3: F3 0F 10 86 88 02 00 00 - movss xmm0,[esi+00000288] // ---------- DONE INJECTING ---------- "swine.exe"+B41CB: 83 EC 08 - sub esp,08 "swine.exe"+B41CE: F3 0F 5E 46 28 - divss xmm0,[esi+28] "swine.exe"+B41D3: F3 0F 11 45 EC - movss [ebp-14],xmm0 "swine.exe"+B41D8: 0F 5A C1 - vcvtps2pd xmm0,xmm1 "swine.exe"+B41DB: F2 0F 59 05 B8 6D 2F 00 - mulsd xmm0,[swine.exe+146DB8] "swine.exe"+B41E3: 66 0F 5A C0 - cvtpd2ps xmm0,xmm0 "swine.exe"+B41E7: F3 0F 58 C3 - addss xmm0,xmm3 "swine.exe"+B41EB: F3 0F 11 44 24 04 - movss [esp+04],xmm0 "swine.exe"+B41F1: F3 0F 11 14 24 - movss [esp],xmm2 "swine.exe"+B41F6: FF B6 E0 02 00 00 - push [esi+000002E0] } 1 "Invulnerability when playing Swines" Auto Assembler Script [ENABLE] aobscanmodule(health,swine.exe,F3 0F 10 86 88 02 00 00 83) // should be unique alloc(newmem,$1000) label(code) label(return) newmem: // just for debugging purposes ("find what this code accesses" to fill dissect data) push eax mov eax,[esi] pop eax // at first, check out if it us our unit or not cmp [esi+25c],1 jne code // if we get here, it should be our unit. // so load max health and put it to current health push eax mov eax,[esi+28] mov [esi+288],eax // then load 100 to eax mov eax, (float)100 // and write it to fuel mov [esi+28c],eax { other way would be mov eax, [esi+78] // load max fuel as integer movd xmm47,eax // and convert it to float cvtdq2ps xmm47,xmm47 and put xmm47 into es+28c } // copy maximum ammo to current ammo mov eax,[esi+94] mov [esi+290],eax // restore original eax to prevent crashes pop eax code: movss xmm0,[esi+00000288] jmp return health: jmp newmem nop nop nop return: registersymbol(health) [DISABLE] health: db F3 0F 10 86 88 02 00 00 unregistersymbol(health) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: "swine.exe"+B41C3 "swine.exe"+B4197: 0F 2E 0D 70 27 2F 00 - ucomiss xmm1,[swine.exe+142770] "swine.exe"+B419E: F3 0F 59 5D F4 - mulss xmm3,[ebp-0C] "swine.exe"+B41A3: 9F - lahf "swine.exe"+B41A4: F3 0F 11 55 F8 - movss [ebp-08],xmm2 "swine.exe"+B41A9: F6 C4 44 - test ah,44 "swine.exe"+B41AC: F3 0F 11 5D F4 - movss [ebp-0C],xmm3 "swine.exe"+B41B1: F3 0F 11 4D F0 - movss [ebp-10],xmm1 "swine.exe"+B41B6: 8B 01 - mov eax,[ecx] "swine.exe"+B41B8: F3 0F 11 4D FC - movss [ebp-04],xmm1 "swine.exe"+B41BD: 0F 8B E3 03 00 00 - jnp swine.exe+B45A6 // ---------- INJECTING HERE ---------- "swine.exe"+B41C3: F3 0F 10 86 88 02 00 00 - movss xmm0,[esi+00000288] // ---------- DONE INJECTING ---------- "swine.exe"+B41CB: 83 EC 08 - sub esp,08 "swine.exe"+B41CE: F3 0F 5E 46 28 - divss xmm0,[esi+28] "swine.exe"+B41D3: F3 0F 11 45 EC - movss [ebp-14],xmm0 "swine.exe"+B41D8: 0F 5A C1 - vcvtps2pd xmm0,xmm1 "swine.exe"+B41DB: F2 0F 59 05 B8 6D 2F 00 - mulsd xmm0,[swine.exe+146DB8] "swine.exe"+B41E3: 66 0F 5A C0 - cvtpd2ps xmm0,xmm0 "swine.exe"+B41E7: F3 0F 58 C3 - addss xmm0,xmm3 "swine.exe"+B41EB: F3 0F 11 44 24 04 - movss [esp+04],xmm0 "swine.exe"+B41F1: F3 0F 11 14 24 - movss [esp],xmm2 "swine.exe"+B41F6: FF B6 E0 02 00 00 - push [esi+000002E0] } 3 "Spend no money in Shop" Auto Assembler Script [ENABLE] aobscanmodule(gold,swine.exe,58 26 00 00 29 87 20 5B 00 00) // should be unique alloc(newmem,$1000) label(code) label(return) newmem: code: // sub [edi+00005B20],eax jmp return gold+04: jmp newmem nop return: registersymbol(gold) [DISABLE] gold+04: db 29 87 20 5B 00 00 unregistersymbol(gold) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: "swine.exe"+F204F "swine.exe"+F2013: 8B 87 BC 5A 00 00 - mov eax,[edi+00005ABC] "swine.exe"+F2019: 89 44 0A 0C - mov [edx+ecx+0C],eax "swine.exe"+F201D: 8B 8F DC 5A 00 00 - mov ecx,[edi+00005ADC] "swine.exe"+F2023: 8B 87 C0 5A 00 00 - mov eax,[edi+00005AC0] "swine.exe"+F2029: 89 44 0A 10 - mov [edx+ecx+10],eax "swine.exe"+F202D: 8B 87 DC 5A 00 00 - mov eax,[edi+00005ADC] "swine.exe"+F2033: C7 44 02 14 00 00 00 00 - mov [edx+eax+14],00000000 "swine.exe"+F203B: 8B 87 DC 5A 00 00 - mov eax,[edi+00005ADC] "swine.exe"+F2041: C7 44 02 18 00 00 00 00 - mov [edx+eax+18],00000000 "swine.exe"+F2049: 8B 87 58 26 00 00 - mov eax,[edi+00002658] // ---------- INJECTING HERE ---------- "swine.exe"+F204F: 29 87 20 5B 00 00 - sub [edi+00005B20],eax // ---------- DONE INJECTING ---------- "swine.exe"+F2055: A1 40 FA 33 00 - mov eax,[swine.exe+18FA40] "swine.exe"+F205A: FF B7 20 5B 00 00 - push [edi+00005B20] "swine.exe"+F2060: 68 30 5C 30 00 - push swine.exe+155C30 "swine.exe"+F2065: 8B 30 - mov esi,[eax] "swine.exe"+F2067: E8 84 1E 00 00 - call swine.exe+F3EF0 "swine.exe"+F206C: 83 C4 04 - add esp,04 "swine.exe"+F206F: 50 - push eax "swine.exe"+F2070: 6A 02 - push 02 "swine.exe"+F2072: 6A 00 - push 00 "swine.exe"+F2074: FF B7 40 26 00 00 - push [edi+00002640] } OnClick: Read max and current health swine.SGameWorld::ShowEvent+E - 83 FF 27 - cmp edi,27 { 39 } swine.SGameWorld::ShowEvent+11- 7D 1C - jnl swine.SGameWorld::ShowEvent+2F swine.SGameWorld::ShowEvent+13- 8B 83 F4030000 - mov eax,[ebx+000003F4] swine.SGameWorld::ShowEvent+19- 8B 44 C8 04 - mov eax,[eax+ecx*8+04] swine.SGameWorld::ShowEvent+1D- 8B 80 58020000 - mov eax,[eax+00000258] swine.SGameWorld::ShowEvent+23- 3B 83 EC030000 - cmp eax,[ebx+000003EC] swine.SGameWorld::ShowEvent+29- 0F85 91010000 - jne swine.SGameWorld::ShowEvent+1C0 swine.SGameWorld::ShowEvent+2F- 85 FF - test edi,edi swine.SGameWorld::ShowEvent+31- 75 32 - jne swine.SGameWorld::ShowEvent+65 swine.SGameWorld::ShowEvent+33- 8B 83 F4030000 - mov eax,[ebx+000003F4] swine.SGameWorld::ShowEvent+39- 8B 44 C8 04 - mov eax,[eax+ecx*8+04] ------------------------------------------------------------------------------- swine.SGameWorld::ShowEvent+3D- F3 0F10 40 28 - movss xmm0,[eax+28] swine.SGameWorld::ShowEvent+42- F3 0F10 88 88020000 - movss xmm1,[eax+00000288] ------------------------------------------------------------------------------- swine.SGameWorld::ShowEvent+4A- 0F5A C0 - vcvtps2pd xmm0,xmm0 swine.SGameWorld::ShowEvent+4D- 0F5A C9 - vcvtps2pd xmm1,xmm1 swine.SGameWorld::ShowEvent+50- F2 0F59 05 50F62F00 - mulsd xmm0,[swine._real] { (858993459) } swine.SGameWorld::ShowEvent+58- 66 0F2F C1 - comisd xmm0,xmm1 swine.SGameWorld::ShowEvent+5C- 76 4C - jna swine.SGameWorld::ShowEvent+AA swine.SGameWorld::ShowEvent+5E- BF 01000000 - mov edi,00000001 { 1 } swine.SGameWorld::ShowEvent+63- EB 45 - jmp swine.SGameWorld::ShowEvent+AA swine.SGameWorld::ShowEvent+65- 83 FF 02 - cmp edi,02 { 2 } swine.SGameWorld::ShowEvent+68- 74 0F - je swine.SGameWorld::ShowEvent+79 swine.SGameWorld::ShowEvent+6A- 83 FF 03 - cmp edi,03 { 3 } Readhealth: swine.SUnit::ClientRefresh+EE - F3 0F59 5D F4 - mulss xmm3,[ebp-0C] swine.SUnit::ClientRefresh+F3 - 9F - lahf swine.SUnit::ClientRefresh+F4 - F3 0F11 55 F8 - movss [ebp-08],xmm2 swine.SUnit::ClientRefresh+F9 - F6 C4 44 - test ah,44 { 68 } swine.SUnit::ClientRefresh+FC - F3 0F11 5D F4 - movss [ebp-0C],xmm3 swine.SUnit::ClientRefresh+101- F3 0F11 4D F0 - movss [ebp-10],xmm1 swine.SUnit::ClientRefresh+106- 8B 01 - mov eax,[ecx] swine.SUnit::ClientRefresh+108- F3 0F11 4D FC - movss [ebp-04],xmm1 swine.SUnit::ClientRefresh+10D- 0F8B E3030000 - jnp swine.SUnit::ClientRefresh+4F6 ------------------------------------------------------------------------------- swine.SUnit::ClientRefresh+113- F3 0F10 86 88020000 - movss xmm0,[esi+00000288] ------------------------------------------------------------------------------- swine.SUnit::ClientRefresh+11B- 83 EC 08 - sub esp,08 { 00000008 } swine.SUnit::ClientRefresh+11E- F3 0F5E 46 28 - divss xmm0,[esi+28] swine.SUnit::ClientRefresh+123- F3 0F11 45 EC - movss [ebp-14],xmm0 swine.SUnit::ClientRefresh+128- 0F5A C1 - vcvtps2pd xmm0,xmm1 swine.SUnit::ClientRefresh+12B- F2 0F59 05 B86D2F00 - mulsd xmm0,[swine._real] { (0) } swine.SUnit::ClientRefresh+133- 66 0F5A C0 - cvtpd2ps xmm0,xmm0