5 "Item Box Opened Count Never Increase (always 0)" Auto Assembler Script [ENABLE] aobscanmodule(openChestCount,re2.exe,44 01 72 18 E9 8E 00 00 00) // should be unique alloc(newmem,$1000,openChestCount) label(code) label(return) newmem: mov r14d,#0 code: add [rdx+18],r14d jmp re2.exe+F5ABC1 jmp return openChestCount: jmp newmem nop 4 return: registersymbol(openChestCount) [DISABLE] openChestCount: db 44 01 72 18 E9 8E 00 00 00 unregistersymbol(openChestCount) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: re2.exe+F5AB2A re2.exe+F5AAFF: 48 85 C9 - test rcx,rcx re2.exe+F5AB02: 74 05 - je re2.exe+F5AB09 re2.exe+F5AB04: E8 F7 B8 FC 00 - call re2.exe+1F26400 re2.exe+F5AB09: 48 8B 43 50 - mov rax,[rbx+50] re2.exe+F5AB0D: 48 83 78 18 00 - cmp qword ptr [rax+18],00 re2.exe+F5AB12: 0F 85 5B 01 00 00 - jne re2.exe+F5AC73 re2.exe+F5AB18: E9 A4 00 00 00 - jmp re2.exe+F5ABC1 re2.exe+F5AB1D: 48 8B 57 70 - mov rdx,[rdi+70] re2.exe+F5AB21: 48 85 D2 - test rdx,rdx re2.exe+F5AB24: 0F 84 1D 01 00 00 - je re2.exe+F5AC47 // ---------- INJECTING HERE ---------- re2.exe+F5AB2A: 44 01 72 18 - add [rdx+18],r14d // ---------- DONE INJECTING ---------- re2.exe+F5AB2E: E9 8E 00 00 00 - jmp re2.exe+F5ABC1 re2.exe+F5AB33: 48 8B 57 70 - mov rdx,[rdi+70] re2.exe+F5AB37: 48 85 D2 - test rdx,rdx re2.exe+F5AB3A: 0F 84 07 01 00 00 - je re2.exe+F5AC47 re2.exe+F5AB40: 44 01 72 1C - add [rdx+1C],r14d re2.exe+F5AB44: EB 7B - jmp re2.exe+F5ABC1 re2.exe+F5AB46: 48 8B D7 - mov rdx,rdi re2.exe+F5AB49: 48 8B CB - mov rcx,rbx re2.exe+F5AB4C: E8 3F 44 35 FF - call re2.exe+2AEF90 re2.exe+F5AB51: 44 8B C0 - mov r8d,eax } 7 "Max Save Count = 3" Auto Assembler Script [ENABLE] aobscanmodule(pSaveCount,re2.exe,01 89 41 24 48 8B 43 50) // should be unique alloc(newmem,$1000,pSaveCount) label(code) label(return) newmem: cmp eax,#3 jle @f mov eax,#3 code: mov [rcx+24],eax mov rax,[rbx+50] jmp return pSaveCount+01: jmp newmem nop 2 return: registersymbol(pSaveCount) [DISABLE] pSaveCount+01: db 89 41 24 48 8B 43 50 unregistersymbol(pSaveCount) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: re2.exe+1E93B77 re2.exe+1E93B52: 0F 85 D5 00 00 00 - jne re2.exe+1E93C2D re2.exe+1E93B58: 48 8B 8F A0 01 00 00 - mov rcx,[rdi+000001A0] re2.exe+1E93B5F: 48 85 C9 - test rcx,rcx re2.exe+1E93B62: 75 10 - jne re2.exe+1E93B74 re2.exe+1E93B64: 8D 51 38 - lea edx,[rcx+38] re2.exe+1E93B67: 45 33 C0 - xor r8d,r8d re2.exe+1E93B6A: 48 8B CB - mov rcx,rbx re2.exe+1E93B6D: E8 4E C6 0A 00 - call re2.exe+1F401C0 re2.exe+1E93B72: EB 06 - jmp re2.exe+1E93B7A re2.exe+1E93B74: 8D 42 01 - lea eax,[rdx+01] // ---------- INJECTING HERE ---------- re2.exe+1E93B77: 89 41 24 - mov [rcx+24],eax // ---------- DONE INJECTING ---------- re2.exe+1E93B7A: 48 8B 43 50 - mov rax,[rbx+50] re2.exe+1E93B7E: 48 39 70 18 - cmp [rax+18],rsi re2.exe+1E93B82: 0F 85 A5 00 00 00 - jne re2.exe+1E93C2D re2.exe+1E93B88: 48 8B 0D 09 43 2D 07 - mov rcx,[re2.exe+9167E98] re2.exe+1E93B8F: 48 85 C9 - test rcx,rcx re2.exe+1E93B92: 0F 84 86 00 00 00 - je re2.exe+1E93C1E re2.exe+1E93B98: 48 8B 81 A0 01 00 00 - mov rax,[rcx+000001A0] re2.exe+1E93B9F: 48 85 C0 - test rax,rax re2.exe+1E93BA2: 75 1A - jne re2.exe+1E93BBE re2.exe+1E93BA4: 45 33 C0 - xor r8d,r8d } 10 "Infinite Ammo (Ammo Always Max)" Auto Assembler Script [ENABLE] aobscanmodule(INJECT,re2.exe,8B 00 89 41 20 48 8B 7C) // should be unique alloc(newmem,$1000,INJECT) label(code) label(return) newmem: code: mov eax,[rax] mov [rcx+20],edx //always set to maximum capacity jmp return INJECT: jmp newmem return: registersymbol(INJECT) [DISABLE] INJECT: db 8B 00 89 41 20 unregistersymbol(INJECT) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: re2.exe+C0A8AF re2.exe+C0A887: 41 8D 50 38 - lea edx,[r8+38] re2.exe+C0A88B: 48 8B 7C 24 40 - mov rdi,[rsp+40] re2.exe+C0A890: 48 8B 5C 24 48 - mov rbx,[rsp+48] re2.exe+C0A895: 48 83 C4 20 - add rsp,20 re2.exe+C0A899: 5E - pop rsi re2.exe+C0A89A: E9 21 59 33 01 - jmp re2.exe+1F401C0 re2.exe+C0A89F: 3B F2 - cmp esi,edx re2.exe+C0A8A1: 48 8D 44 24 30 - lea rax,[rsp+30] re2.exe+C0A8A6: 4C 8D 44 24 38 - lea r8,[rsp+38] re2.exe+C0A8AB: 49 0F 4D C0 - cmovge rax,r8 // ---------- INJECTING HERE ---------- re2.exe+C0A8AF: 8B 00 - mov eax,[rax] // ---------- DONE INJECTING ---------- re2.exe+C0A8B1: 89 41 20 - mov [rcx+20],eax re2.exe+C0A8B4: 48 8B 7C 24 40 - mov rdi,[rsp+40] re2.exe+C0A8B9: 48 8B 5C 24 48 - mov rbx,[rsp+48] re2.exe+C0A8BE: 48 83 C4 20 - add rsp,20 re2.exe+C0A8C2: 5E - pop rsi re2.exe+C0A8C3: C3 - ret re2.exe+C0A8C4: CC - int 3 re2.exe+C0A8C5: CC - int 3 re2.exe+C0A8C6: CC - int 3 re2.exe+C0A8C7: CC - int 3 }