114982 "<=== Attach to process" 0000FF Auto Assembler Script [ENABLE] {$lua} if syntaxcheck then return end if(getCEVersion() < 7.4) then ShowMessage('Warning! CE version should be 7.4 or above') end OpenProcess("TheDarkModx64.exe") if(process == nil) then ShowMessage('The process is NOT found!') end {$asm} [DISABLE] 1 "get Gold instead of spending it in the shop" Auto Assembler Script [ENABLE] aobscanmodule(gold,TheDarkModx64.exe,F7 D8 01 45 60) // should be unique alloc(newmem,$100,gold) label(code) label(return) newmem: code: // neg eax add [rbp+60],eax jmp return gold: jmp newmem return: registersymbol(gold) [DISABLE] gold: db F7 D8 01 45 60 unregistersymbol(gold) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: TheDarkModx64.exe+3896D5 TheDarkModx64.exe+3896B0: 48 8D 54 24 30 - lea rdx,[rsp+30] TheDarkModx64.exe+3896B5: 48 8B CD - mov rcx,rbp TheDarkModx64.exe+3896B8: E8 D3 07 00 00 - call TheDarkModx64.exe+389E90 TheDarkModx64.exe+3896BD: 90 - nop TheDarkModx64.exe+3896BE: BF FF FF FF FF - mov edi,FFFFFFFF TheDarkModx64.exe+3896C3: 8B D7 - mov edx,edi TheDarkModx64.exe+3896C5: 49 8B CE - mov rcx,r14 TheDarkModx64.exe+3896C8: E8 43 56 00 00 - call TheDarkModx64.exe+38ED10 TheDarkModx64.exe+3896CD: 49 8B CE - mov rcx,r14 TheDarkModx64.exe+3896D0: E8 7B 3E D0 FF - call TheDarkModx64.exe+8D550 // ---------- INJECTING HERE ---------- TheDarkModx64.exe+3896D5: F7 D8 - neg eax // ---------- DONE INJECTING ---------- TheDarkModx64.exe+3896D7: 01 45 60 - add [rbp+60],eax TheDarkModx64.exe+3896DA: 48 83 7C 24 30 00 - cmp qword ptr [rsp+30],00 TheDarkModx64.exe+3896E0: 0F 85 7A 01 00 00 - jne TheDarkModx64.exe+389860 TheDarkModx64.exe+3896E6: B9 B8 00 00 00 - mov ecx,000000B8 TheDarkModx64.exe+3896EB: E8 BC 85 75 00 - call TheDarkModx64.exe+AE1CAC TheDarkModx64.exe+3896F0: 48 8B F0 - mov rsi,rax TheDarkModx64.exe+3896F3: 48 89 84 24 80 00 00 00 - mov [rsp+00000080],rax TheDarkModx64.exe+3896FB: 48 85 C0 - test rax,rax TheDarkModx64.exe+3896FE: 74 2D - je TheDarkModx64.exe+38972D TheDarkModx64.exe+389700: 49 8B CE - mov rcx,r14 } 115033 "always full health" Auto Assembler Script [ENABLE] aobscanmodule(health,TheDarkModx64.exe,83 B8 10 01 00 00 00 0F 8E E1) // should be unique alloc(newmem,$100,health) label(code) label(return) newmem: mov [rax+110],#100 code: cmp dword ptr [rax+00000110],00 jmp return health: jmp newmem nop 2 return: registersymbol(health) [DISABLE] health: db 83 B8 10 01 00 00 00 unregistersymbol(health) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: TheDarkModx64.exe+10A690 TheDarkModx64.exe+10A654: 0F 84 24 04 00 00 - je TheDarkModx64.exe+10AA7E TheDarkModx64.exe+10A65A: 48 8D 0D BF A3 B7 01 - lea rcx,[TheDarkModx64.exe+1C84A20] TheDarkModx64.exe+10A661: E8 2A F2 11 00 - call TheDarkModx64.exe+229890 TheDarkModx64.exe+10A666: 48 8B F0 - mov rsi,rax TheDarkModx64.exe+10A669: 80 BF 34 24 00 00 00 - cmp byte ptr [rdi+00002434],00 TheDarkModx64.exe+10A670: 0F 85 08 04 00 00 - jne TheDarkModx64.exe+10AA7E TheDarkModx64.exe+10A676: F6 80 18 01 00 00 01 - test byte ptr [rax+00000118],01 TheDarkModx64.exe+10A67D: 0F 85 FB 03 00 00 - jne TheDarkModx64.exe+10AA7E TheDarkModx64.exe+10A683: F6 80 19 01 00 00 08 - test byte ptr [rax+00000119],08 TheDarkModx64.exe+10A68A: 0F 85 EE 03 00 00 - jne TheDarkModx64.exe+10AA7E // ---------- INJECTING HERE ---------- TheDarkModx64.exe+10A690: 83 B8 10 01 00 00 00 - cmp dword ptr [rax+00000110],00 // ---------- DONE INJECTING ---------- TheDarkModx64.exe+10A697: 0F 8E E1 03 00 00 - jng TheDarkModx64.exe+10AA7E TheDarkModx64.exe+10A69D: 48 8B 1F - mov rbx,[rdi] TheDarkModx64.exe+10A6A0: 48 8B 00 - mov rax,[rax] TheDarkModx64.exe+10A6A3: 48 8D 54 24 68 - lea rdx,[rsp+68] TheDarkModx64.exe+10A6A8: 48 8B CE - mov rcx,rsi TheDarkModx64.exe+10A6AB: FF 90 E8 03 00 00 - call qword ptr [rax+000003E8] TheDarkModx64.exe+10A6B1: 48 8B D0 - mov rdx,rax TheDarkModx64.exe+10A6B4: 48 8B CF - mov rcx,rdi TheDarkModx64.exe+10A6B7: FF 93 F8 03 00 00 - call qword ptr [rbx+000003F8] TheDarkModx64.exe+10A6BD: 84 C0 - test al,al } 115034 "always in the dark" 1 115029 "Darkness 1" Auto Assembler Script [ENABLE] aobscanmodule(stealth,TheDarkModx64.exe,F3 0F 59 35 A2 AF A1 00) // should be unique alloc(newmem,$100,stealth) label(code) label(return) newmem: code: // mulss xmm6,[TheDarkModx64.exe+D4AFC8] xorps xmm6,xmm6 jmp return stealth: jmp newmem nop 3 return: registersymbol(stealth) [DISABLE] stealth: db F3 0F 59 35 A2 AF A1 00 unregistersymbol(stealth) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: TheDarkModx64.exe+33001E TheDarkModx64.exe+32FFEB: 66 49 0F 7E D0 - movq r8,xmm2 TheDarkModx64.exe+32FFF0: E8 6B 3B E8 FF - call TheDarkModx64.exe+1B3B60 TheDarkModx64.exe+32FFF5: 48 8B 83 E8 22 00 00 - mov rax,[rbx+000022E8] TheDarkModx64.exe+32FFFC: 48 8D 8B E8 22 00 00 - lea rcx,[rbx+000022E8] TheDarkModx64.exe+330003: FF 90 38 02 00 00 - call qword ptr [rax+00000238] TheDarkModx64.exe+330009: 83 F8 03 - cmp eax,03 TheDarkModx64.exe+33000C: 7C 10 - jl TheDarkModx64.exe+33001E TheDarkModx64.exe+33000E: 48 8D 8B E8 22 00 00 - lea rcx,[rbx+000022E8] TheDarkModx64.exe+330015: E8 16 81 FB FF - call TheDarkModx64.exe+2E8130 TheDarkModx64.exe+33001A: F3 0F 5C F0 - subss xmm6,xmm0 // ---------- INJECTING HERE ---------- TheDarkModx64.exe+33001E: F3 0F 59 35 A2 AF A1 00 - mulss xmm6,[TheDarkModx64.exe+D4AFC8] // ---------- DONE INJECTING ---------- TheDarkModx64.exe+330026: 48 8B CB - mov rcx,rbx TheDarkModx64.exe+330029: F3 0F 2C D6 - cvttss2si edx,xmm6 TheDarkModx64.exe+33002D: E8 BE 72 FF FF - call TheDarkModx64.exe+3272F0 TheDarkModx64.exe+330032: 0F 28 74 24 20 - movaps xmm6,[rsp+20] TheDarkModx64.exe+330037: 48 8B 74 24 48 - mov rsi,[rsp+48] TheDarkModx64.exe+33003C: 89 83 30 2A 00 00 - mov [rbx+00002A30],eax TheDarkModx64.exe+330042: 40 38 3D F9 48 95 01 - cmp [TheDarkModx64.exe+1C84942],dil TheDarkModx64.exe+330049: 75 48 - jne TheDarkModx64.exe+330093 TheDarkModx64.exe+33004B: 40 38 3D E5 48 95 01 - cmp [TheDarkModx64.exe+1C84937],dil TheDarkModx64.exe+330052: 75 3F - jne TheDarkModx64.exe+330093 } 115030 "Darkness 2" Auto Assembler Script [ENABLE] aobscanmodule(stealth2,TheDarkModx64.exe,3B C1 0F 4F F9) // should be unique alloc(newmem,$100,stealth2) label(code) label(return) newmem: code: //cmp eax,ecx //cmovg edi,ecx mov edi,0 jmp return stealth2: jmp newmem return: registersymbol(stealth2) [DISABLE] stealth2: db 3B C1 0F 4F F9 unregistersymbol(stealth2) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: TheDarkModx64.exe+3300A9 TheDarkModx64.exe+330076: 48 89 2D E3 48 95 01 - mov [TheDarkModx64.exe+1C84960],rbp TheDarkModx64.exe+33007D: C7 05 E5 48 95 01 B5 26 00 00 - mov [TheDarkModx64.exe+1C8496C],000026B5 TheDarkModx64.exe+330087: 44 8B 83 30 2A 00 00 - mov r8d,[rbx+00002A30] TheDarkModx64.exe+33008E: E8 CD 3A E8 FF - call TheDarkModx64.exe+1B3B60 TheDarkModx64.exe+330093: 48 8B 6C 24 40 - mov rbp,[rsp+40] TheDarkModx64.exe+330098: 8B 83 30 2A 00 00 - mov eax,[rbx+00002A30] TheDarkModx64.exe+33009E: 3B C7 - cmp eax,edi TheDarkModx64.exe+3300A0: 7C 0C - jl TheDarkModx64.exe+3300AE TheDarkModx64.exe+3300A2: B9 20 00 00 00 - mov ecx,00000020 TheDarkModx64.exe+3300A7: 8B F8 - mov edi,eax // ---------- INJECTING HERE ---------- TheDarkModx64.exe+3300A9: 3B C1 - cmp eax,ecx // ---------- DONE INJECTING ---------- TheDarkModx64.exe+3300AB: 0F 4F F9 - cmovg edi,ecx TheDarkModx64.exe+3300AE: 89 BB 30 2A 00 00 - mov [rbx+00002A30],edi TheDarkModx64.exe+3300B4: 8B C7 - mov eax,edi TheDarkModx64.exe+3300B6: 48 8B 7C 24 50 - mov rdi,[rsp+50] TheDarkModx64.exe+3300BB: 48 83 C4 30 - add rsp,30 TheDarkModx64.exe+3300BF: 5B - pop rbx TheDarkModx64.exe+3300C0: C3 - ret TheDarkModx64.exe+3300C1: 8B 81 30 2A 00 00 - mov eax,[rcx+00002A30] TheDarkModx64.exe+3300C7: 48 83 C4 30 - add rsp,30 TheDarkModx64.exe+3300CB: 5B - pop rbx } 115036 "always 20 ammo after shooting" Auto Assembler Script [ENABLE] aobscanmodule(ammo,TheDarkModx64.exe,85 C0 0F 48 C2 89) // should be unique alloc(newmem,$1000,ammo) label(code) label(return) newmem: code: test eax,eax mov eax,#20 jmp return ammo: jmp newmem return: registersymbol(ammo) [DISABLE] ammo: db 85 C0 0F 48 C2 unregistersymbol(ammo) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: TheDarkModx64.exe+2607C2 TheDarkModx64.exe+26079E: CC - int 3 TheDarkModx64.exe+26079F: CC - int 3 TheDarkModx64.exe+2607A0: 44 8B 81 6C 01 00 00 - mov r8d,[rcx+0000016C] TheDarkModx64.exe+2607A7: 44 2B C2 - sub r8d,edx TheDarkModx64.exe+2607AA: 80 B9 74 01 00 00 00 - cmp byte ptr [rcx+00000174],00 TheDarkModx64.exe+2607B1: 75 1A - jne TheDarkModx64.exe+2607CD TheDarkModx64.exe+2607B3: 8B 81 68 01 00 00 - mov eax,[rcx+00000168] TheDarkModx64.exe+2607B9: 44 3B C0 - cmp r8d,eax TheDarkModx64.exe+2607BC: 41 0F 4E C0 - cmovle eax,r8d TheDarkModx64.exe+2607C0: 33 D2 - xor edx,edx // ---------- INJECTING HERE ---------- TheDarkModx64.exe+2607C2: 85 C0 - test eax,eax // ---------- DONE INJECTING ---------- TheDarkModx64.exe+2607C4: 0F 48 C2 - cmovs eax,edx TheDarkModx64.exe+2607C7: 89 81 6C 01 00 00 - mov [rcx+0000016C],eax TheDarkModx64.exe+2607CD: C3 - ret TheDarkModx64.exe+2607CE: CC - int 3 TheDarkModx64.exe+2607CF: CC - int 3 TheDarkModx64.exe+2607D0: 40 57 - push rdi TheDarkModx64.exe+2607D2: 48 81 EC A0 0F 00 00 - sub rsp,00000FA0 TheDarkModx64.exe+2607D9: 48 8B F9 - mov rdi,rcx TheDarkModx64.exe+2607DC: E8 7F 66 F7 FF - call TheDarkModx64.exe+1D6E60 TheDarkModx64.exe+2607E1: 48 85 C0 - test rax,rax } Light usually is 4 to 27 Full health is 100, the 4byte value is the REAL value, not the float one