3
"Gold"
4 Bytes
ys1plus.exe+13180C
6
"Invincibility"
Auto Assembler Script
[ENABLE]
aobscanmodule(INVINCIBILITY,ys1plus.exe,8B 5C 24 30 C6 05 90 7D 52 00 01) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
mov ebx,[ys1plus.exe+131800]
//mov ebx,[esp+30]
mov byte ptr [ys1plus.exe+127D90],01
jmp return
INVINCIBILITY:
jmp newmem
nop 6
return:
registersymbol(INVINCIBILITY)
[DISABLE]
INVINCIBILITY:
db 8B 5C 24 30 C6 05 90 7D 52 00 01
unregistersymbol(INVINCIBILITY)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ys1plus.exe+1CEDE
ys1plus.exe+1CEAD: 8B 44 24 28 - mov eax,[esp+28]
ys1plus.exe+1CEB1: C7 80 28 02 00 00 B5 B4 24 42 - mov [eax+00000228],4224B4B5
ys1plus.exe+1CEBB: FF 74 24 60 - push [esp+60]
ys1plus.exe+1CEBF: B9 80 7D 52 00 - mov ecx,ys1plus.exe+127D80
ys1plus.exe+1CEC4: FF 74 24 20 - push [esp+20]
ys1plus.exe+1CEC8: FF 74 24 20 - push [esp+20]
ys1plus.exe+1CECC: E8 DF A0 03 00 - call ys1plus.exe+56FB0
ys1plus.exe+1CED1: FF 74 24 5C - push [esp+5C]
ys1plus.exe+1CED5: 8B 7C 24 58 - mov edi,[esp+58]
ys1plus.exe+1CED9: B9 F0 7B 52 00 - mov ecx,ys1plus.exe+127BF0
// ---------- INJECTING HERE ----------
ys1plus.exe+1CEDE: 8B 5C 24 30 - mov ebx,[esp+30]
// ---------- DONE INJECTING ----------
ys1plus.exe+1CEE2: C6 05 90 7D 52 00 01 - mov byte ptr [ys1plus.exe+127D90],01
ys1plus.exe+1CEE9: C7 05 B4 BA 54 00 00 00 52 43 - mov [ys1plus.exe+14BAB4],43520000
ys1plus.exe+1CEF3: FF B7 84 01 00 00 - push [edi+00000184]
ys1plus.exe+1CEF9: 53 - push ebx
ys1plus.exe+1CEFA: E8 B1 A0 03 00 - call ys1plus.exe+56FB0
ys1plus.exe+1CEFF: 89 1D FC 17 53 00 - mov [ys1plus.exe+1317FC],ebx
ys1plus.exe+1CF05: 5F - pop edi
ys1plus.exe+1CF06: 5E - pop esi
ys1plus.exe+1CF07: 5D - pop ebp
ys1plus.exe+1CF08: 5B - pop ebx
}
0
"EXP"
4 Bytes
ys1plus.exe+131810
1
"EXP Multiplier"
Auto Assembler Script
[ENABLE]
aobscanmodule(EXP_MULTIPLIER,ys1plus.exe,01 41 14 8B 71 14) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(exp_value)
registersymbol(exp_value)
newmem:
code:
imul eax, [exp_value]
add [ecx+14],eax
mov esi,[ecx+14]
jmp return
exp_value:
dd 1
EXP_MULTIPLIER:
jmp newmem
nop
return:
registersymbol(EXP_MULTIPLIER)
[DISABLE]
EXP_MULTIPLIER:
db 01 41 14 8B 71 14
unregistersymbol(EXP_MULTIPLIER)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ys1plus.exe+17D6D
ys1plus.exe+17D51: 83 79 1C 00 - cmp dword ptr [ecx+1C],00
ys1plus.exe+17D55: 53 - push ebx
ys1plus.exe+17D56: 55 - push ebp
ys1plus.exe+17D57: 56 - push esi
ys1plus.exe+17D58: 57 - push edi
ys1plus.exe+17D59: 0F 85 F8 00 00 00 - jne ys1plus.exe+17E57
ys1plus.exe+17D5F: 8B 19 - mov ebx,[ecx]
ys1plus.exe+17D61: 85 DB - test ebx,ebx
ys1plus.exe+17D63: 0F 8E EE 00 00 00 - jng ys1plus.exe+17E57
ys1plus.exe+17D69: 8B 44 24 18 - mov eax,[esp+18]
// ---------- INJECTING HERE ----------
ys1plus.exe+17D6D: 01 41 14 - add [ecx+14],eax
// ---------- DONE INJECTING ----------
ys1plus.exe+17D70: 8B 71 14 - mov esi,[ecx+14]
ys1plus.exe+17D73: 81 FE 9F 86 01 00 - cmp esi,0001869F
ys1plus.exe+17D79: 7E 0C - jle ys1plus.exe+17D87
ys1plus.exe+17D7B: C7 41 14 9F 86 01 00 - mov [ecx+14],0001869F
ys1plus.exe+17D82: BE 9F 86 01 00 - mov esi,0001869F
ys1plus.exe+17D87: 8B 79 18 - mov edi,[ecx+18]
ys1plus.exe+17D8A: 8B C7 - mov eax,edi
ys1plus.exe+17D8C: C1 E0 04 - shl eax,04
ys1plus.exe+17D8F: 3B B0 60 B9 4F 00 - cmp esi,[eax+ys1plus.exe+FB960]
ys1plus.exe+17D95: 0F 8C BC 00 00 00 - jl ys1plus.exe+17E57
}
2
"EXP Factor"
0
4 Bytes
"exp_value"
10
"Damage Multiplier"
Auto Assembler Script
[ENABLE]
aobscanmodule(DAMAGE_MULTIPLIER,ys1plus.exe,2B C2 BA 00 00 00 00 0F 49 D0 3B CA 74 0F) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
label(dmg_value)
registersymbol(dmg_value)
newmem:
code:
imul edx,[dmg_value]
sub eax,edx
mov edx,00000000
jmp return
dmg_value:
dd 1
DAMAGE_MULTIPLIER:
jmp newmem
nop 2
return:
registersymbol(DAMAGE_MULTIPLIER)
[DISABLE]
DAMAGE_MULTIPLIER:
db 2B C2 BA 00 00 00 00
unregistersymbol(DAMAGE_MULTIPLIER)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ys1plus.exe+1A8B2
ys1plus.exe+1A898: EB 0C - jmp ys1plus.exe+1A8A6
ys1plus.exe+1A89A: 8D 04 92 - lea eax,[edx+edx*4]
ys1plus.exe+1A89D: 99 - cdq
ys1plus.exe+1A89E: 83 E2 03 - and edx,03
ys1plus.exe+1A8A1: 03 D0 - add edx,eax
ys1plus.exe+1A8A3: C1 FA 02 - sar edx,02
ys1plus.exe+1A8A6: 85 D2 - test edx,edx
ys1plus.exe+1A8A8: 7E 25 - jle ys1plus.exe+1A8CF
ys1plus.exe+1A8AA: 8B 8E 80 01 00 00 - mov ecx,[esi+00000180]
ys1plus.exe+1A8B0: 8B C1 - mov eax,ecx
// ---------- INJECTING HERE ----------
ys1plus.exe+1A8B2: 2B C2 - sub eax,edx
// ---------- DONE INJECTING ----------
ys1plus.exe+1A8B4: BA 00 00 00 00 - mov edx,00000000
ys1plus.exe+1A8B9: 0F 49 D0 - cmovns edx,eax
ys1plus.exe+1A8BC: 3B CA - cmp ecx,edx
ys1plus.exe+1A8BE: 74 0F - je ys1plus.exe+1A8CF
ys1plus.exe+1A8C0: 89 96 80 01 00 00 - mov [esi+00000180],edx
ys1plus.exe+1A8C6: B8 01 00 00 00 - mov eax,00000001
ys1plus.exe+1A8CB: 5E - pop esi
ys1plus.exe+1A8CC: C2 08 00 - ret 0008
ys1plus.exe+1A8CF: 33 C0 - xor eax,eax
ys1plus.exe+1A8D1: 5E - pop esi
}
11
"Damage Factor"
0
4 Bytes
"dmg_value"
Code :mov [ys1plus.exe+1317FC],ebx
ys1plus.exe+1CEFF
E8
B1
A0
03
00
89
1D
FC
17
53
00
5F
5E
5D
5B
83