176
"<=== attach to Process"
0000FF
Auto Assembler Script
[ENABLE]
{$lua}
OpenProcess("UnderTheIsland.exe")
{$asm}
[DISABLE]
1337270179
"Get addresses for Coins and Health"
Auto Assembler Script
[ENABLE]
aobscanmodule(health,UnderTheIsland.exe,19 FF FF EB 06 48 8B 02 48 89 03) // should be unique
alloc(newmem,$100,health)
label(code)
label(return)
label(addy)
newmem:
mov [addy],rdx
code:
mov rax,[rdx]
mov [rbx],rax
jmp return
addy:
dq 0
health+05:
jmp newmem
nop
return:
registersymbol(health addy)
[DISABLE]
health+05:
db 48 8B 02 48 89 03
unregistersymbol(*)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: UnderTheIsland.exe+725C1
UnderTheIsland.exe+725A3: 8B 42 08 - mov eax,[rdx+08]
UnderTheIsland.exe+725A6: 89 43 08 - mov [rbx+08],eax
UnderTheIsland.exe+725A9: 83 E1 1F - and ecx,1F
UnderTheIsland.exe+725AC: B8 01 00 00 00 - mov eax,00000001
UnderTheIsland.exe+725B1: D3 E0 - shl eax,cl
UnderTheIsland.exe+725B3: A8 46 - test al,46
UnderTheIsland.exe+725B5: 74 0A - je UnderTheIsland.exe+725C1
UnderTheIsland.exe+725B7: 48 8B CB - mov rcx,rbx
UnderTheIsland.exe+725BA: E8 A1 19 FF FF - call UnderTheIsland.exe+63F60
UnderTheIsland.exe+725BF: EB 06 - jmp UnderTheIsland.exe+725C7
// ---------- INJECTING HERE ----------
UnderTheIsland.exe+725C1: 48 8B 02 - mov rax,[rdx]
// ---------- DONE INJECTING ----------
UnderTheIsland.exe+725C4: 48 89 03 - mov [rbx],rax
UnderTheIsland.exe+725C7: C7 44 24 20 01 00 00 00 - mov [rsp+20],00000001
UnderTheIsland.exe+725CF: 48 8B D7 - mov rdx,rdi
UnderTheIsland.exe+725D2: 48 8B CB - mov rcx,rbx
UnderTheIsland.exe+725D5: E8 F6 2B FF FF - call UnderTheIsland.exe+651D0
UnderTheIsland.exe+725DA: 48 8B C3 - mov rax,rbx
UnderTheIsland.exe+725DD: 48 8B 5C 24 48 - mov rbx,[rsp+48]
UnderTheIsland.exe+725E2: 48 83 C4 30 - add rsp,30
UnderTheIsland.exe+725E6: 5F - pop rdi
UnderTheIsland.exe+725E7: C3 - ret
}
1337270180
"Health (Double value, 12 = 3 hearts)"
0
Double
addy
0
1337270181
"Max Health"
0
Double
addy
D0
1337270184
"Coins"
0
Double
addy
-70
1337270187
"Heart Coins"
0
Double
addy
-140
1337270191
"Bombs in Inventory"
Double
"UnderTheIsland.exe"+020FFC00
490
90
10
48
88