114982
"<=== Attach to process"
0000FF
Auto Assembler Script
[ENABLE]
{$lua}
if syntaxcheck then return end
if(getCEVersion() < 7.4) then
ShowMessage('Warning! CE version should be 7.4 or above')
end
OpenProcess("underkeep_demo.exe")
if(process == nil) then
ShowMessage('The process is NOT found!')
end
{$asm}
[DISABLE]
114986
"Gold"
4 Bytes
underkeep_demo.exe+3D03E0
114989
"Set amout of all items in inventory to 10"
Auto Assembler Script
[ENABLE]
aobscanmodule(items,underkeep_demo.exe,8B 8E C8 00 00 00 89)
alloc(newmem,$100,items)
label(code)
label(return)
newmem:
mov ecx,#10
mov [rsi+000000C8],ecx
code:
mov ecx,[rsi+000000C8]
jmp return
items:
jmp newmem
nop
return:
registersymbol(items)
[DISABLE]
items:
db 8B 8E C8 00 00 00
unregistersymbol(items)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: underkeep_demo.exe+157B00
underkeep_demo.exe+157AD3: 42 39 84 01 C4 FA 3C 00 - cmp [rcx+r8+003CFAC4],eax
underkeep_demo.exe+157ADB: 7C 10 - jl underkeep_demo.exe+157AED
underkeep_demo.exe+157ADD: 8B 86 30 01 00 00 - mov eax,[rsi+00000130]
underkeep_demo.exe+157AE3: 42 39 84 01 C0 FA 3C 00 - cmp [rcx+r8+003CFAC0],eax
underkeep_demo.exe+157AEB: 7D 04 - jnl underkeep_demo.exe+157AF1
underkeep_demo.exe+157AED: C6 45 E4 01 - mov byte ptr [rbp-1C],01
underkeep_demo.exe+157AF1: 48 8B CE - mov rcx,rsi
underkeep_demo.exe+157AF4: E8 07 16 03 00 - call underkeep_demo.exe+189100
underkeep_demo.exe+157AF9: 88 45 E5 - mov [rbp-1B],al
underkeep_demo.exe+157AFC: C6 45 E6 00 - mov byte ptr [rbp-1A],00
// ---------- INJECTING HERE ----------
underkeep_demo.exe+157B00: 8B 8E C8 00 00 00 - mov ecx,[rsi+000000C8]
// ---------- DONE INJECTING ----------
underkeep_demo.exe+157B06: 89 4D D0 - mov [rbp-30],ecx
underkeep_demo.exe+157B09: 83 BE F8 00 00 00 0D - cmp dword ptr [rsi+000000F8],0D
underkeep_demo.exe+157B10: 75 2C - jne underkeep_demo.exe+157B3E
underkeep_demo.exe+157B12: 83 F9 01 - cmp ecx,01
underkeep_demo.exe+157B15: 7F 08 - jg underkeep_demo.exe+157B1F
underkeep_demo.exe+157B17: 8B 05 07 EB 1A 00 - mov eax,[underkeep_demo.exe+306624]
underkeep_demo.exe+157B1D: EB 25 - jmp underkeep_demo.exe+157B44
underkeep_demo.exe+157B1F: 83 F9 03 - cmp ecx,03
underkeep_demo.exe+157B22: 7F 08 - jg underkeep_demo.exe+157B2C
underkeep_demo.exe+157B24: 8B 05 86 EA 1A 00 - mov eax,[underkeep_demo.exe+3065B0]
}
114990
"amount of items does not decrease when used"
Auto Assembler Script
[ENABLE]
aobscanmodule(matdecrease,underkeep_demo.exe,FF C8 89 81 C8 00 00 00 48 8B 49 08 48 83 C1 78 E8 A9) // should be unique
alloc(newmem,$1000,matdecrease)
label(code)
label(return)
newmem:
code:
// dec eax
mov [rcx+000000C8],eax
jmp return
matdecrease:
jmp newmem
nop 3
return:
registersymbol(matdecrease)
[DISABLE]
matdecrease:
db FF C8 89 81 C8 00 00 00
unregistersymbol(matdecrease)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: underkeep_demo.exe+114112
underkeep_demo.exe+1140EC: 48 85 C9 - test rcx,rcx
underkeep_demo.exe+1140EF: 0F 84 35 02 00 00 - je underkeep_demo.exe+11432A
underkeep_demo.exe+1140F5: 40 32 F6 - xor sil,sil
underkeep_demo.exe+1140F8: 4C 8B F1 - mov r14,rcx
underkeep_demo.exe+1140FB: 40 38 B1 92 03 00 00 - cmp [rcx+00000392],sil
underkeep_demo.exe+114102: 74 2F - je underkeep_demo.exe+114133
underkeep_demo.exe+114104: 8B 81 C8 00 00 00 - mov eax,[rcx+000000C8]
underkeep_demo.exe+11410A: 83 F8 01 - cmp eax,01
underkeep_demo.exe+11410D: 7E 24 - jle underkeep_demo.exe+114133
underkeep_demo.exe+11410F: 40 B6 01 - mov sil,01
// ---------- INJECTING HERE ----------
underkeep_demo.exe+114112: FF C8 - dec eax
// ---------- DONE INJECTING ----------
underkeep_demo.exe+114114: 89 81 C8 00 00 00 - mov [rcx+000000C8],eax
underkeep_demo.exe+11411A: 48 8B 49 08 - mov rcx,[rcx+08]
underkeep_demo.exe+11411E: 48 83 C1 78 - add rcx,78
underkeep_demo.exe+114122: E8 A9 EE FF FF - call underkeep_demo.exe+112FD0
underkeep_demo.exe+114127: 48 8B F8 - mov rdi,rax
underkeep_demo.exe+11412A: 48 85 C0 - test rax,rax
underkeep_demo.exe+11412D: 0F 84 F7 01 00 00 - je underkeep_demo.exe+11432A
underkeep_demo.exe+114133: 4D 8B C6 - mov r8,r14
underkeep_demo.exe+114136: 48 8D 55 C7 - lea rdx,[rbp-39]
underkeep_demo.exe+11413A: 48 8D 0D 3F C4 2B 00 - lea rcx,[underkeep_demo.exe+3D0580]
}
114991
"Godmode"
Auto Assembler Script
[ENABLE]
aobscanmodule(health,underkeep_demo.exe,41 2B C6 89 83 EC 00 00 00) // should be unique
alloc(newmem,$1000,health)
label(code)
label(return)
newmem:
mov eax, [rbx+E0] // get full health value :)
test eax, eax // and set the flag for the following jns
code:
// sub eax,r14d
mov [rbx+000000EC],eax
jmp return
health:
jmp newmem
nop 4
return:
registersymbol(health)
[DISABLE]
health:
db 41 2B C6 89 83 EC 00 00 00
unregistersymbol(health)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: underkeep_demo.exe+1403FC
underkeep_demo.exe+1403DA: 48 0F AF C8 - imul rcx,rax
underkeep_demo.exe+1403DE: 49 8B C7 - mov rax,r15
underkeep_demo.exe+1403E1: 48 83 C1 32 - add rcx,32
underkeep_demo.exe+1403E5: 48 F7 E9 - imul rcx
underkeep_demo.exe+1403E8: 48 03 D1 - add rdx,rcx
underkeep_demo.exe+1403EB: 48 C1 FA 06 - sar rdx,06
underkeep_demo.exe+1403EF: 4C 8B F2 - mov r14,rdx
underkeep_demo.exe+1403F2: 49 C1 EE 3F - shr r14,3F
underkeep_demo.exe+1403F6: 4C 03 F2 - add r14,rdx
underkeep_demo.exe+1403F9: 41 8B C0 - mov eax,r8d
// ---------- INJECTING HERE ----------
underkeep_demo.exe+1403FC: 41 2B C6 - sub eax,r14d
// ---------- DONE INJECTING ----------
underkeep_demo.exe+1403FF: 89 83 EC 00 00 00 - mov [rbx+000000EC],eax
underkeep_demo.exe+140405: 79 08 - jns underkeep_demo.exe+14040F
underkeep_demo.exe+140407: 89 BB EC 00 00 00 - mov [rbx+000000EC],edi
underkeep_demo.exe+14040D: 8B C7 - mov eax,edi
underkeep_demo.exe+14040F: 45 85 C0 - test r8d,r8d
underkeep_demo.exe+140412: 7E 6F - jle underkeep_demo.exe+140483
underkeep_demo.exe+140414: 85 C0 - test eax,eax
underkeep_demo.exe+140416: 75 6B - jne underkeep_demo.exe+140483
underkeep_demo.exe+140418: 44 89 4D 7F - mov [rbp+7F],r9d
underkeep_demo.exe+14041C: 89 7D 77 - mov [rbp+77],edi
}
114993
"One-Hit-Kill"
Auto Assembler Script
[ENABLE]
aobscanmodule(onehit,underkeep_demo.exe,2B C6 41 0F 48 C7) // should be unique
alloc(newmem,$1000,onehit)
label(code)
label(return)
newmem:
mov eax,0
code:
// sub eax,esi
cmovs eax,r15d
jmp return
onehit:
jmp newmem
nop
return:
registersymbol(onehit)
[DISABLE]
onehit:
db 2B C6 41 0F 48 C7
unregistersymbol(onehit)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: underkeep_demo.exe+18F76B
underkeep_demo.exe+18F740: 44 39 BF E4 00 00 00 - cmp [rdi+000000E4],r15d
underkeep_demo.exe+18F747: 7F 14 - jg underkeep_demo.exe+18F75D
underkeep_demo.exe+18F749: 44 89 BF D4 00 00 00 - mov [rdi+000000D4],r15d
underkeep_demo.exe+18F750: EB 04 - jmp underkeep_demo.exe+18F756
underkeep_demo.exe+18F752: 85 C0 - test eax,eax
underkeep_demo.exe+18F754: 75 07 - jne underkeep_demo.exe+18F75D
underkeep_demo.exe+18F756: 44 89 BF E0 00 00 00 - mov [rdi+000000E0],r15d
underkeep_demo.exe+18F75D: 8B 87 C8 00 00 00 - mov eax,[rdi+000000C8]
underkeep_demo.exe+18F763: 85 C0 - test eax,eax
underkeep_demo.exe+18F765: 0F 8E 8C 05 00 00 - jng underkeep_demo.exe+18FCF7
// ---------- INJECTING HERE ----------
underkeep_demo.exe+18F76B: 2B C6 - sub eax,esi
// ---------- DONE INJECTING ----------
underkeep_demo.exe+18F76D: 41 0F 48 C7 - cmovs eax,r15d
underkeep_demo.exe+18F771: 89 87 C8 00 00 00 - mov [rdi+000000C8],eax
underkeep_demo.exe+18F777: 4C 89 7C 24 68 - mov [rsp+68],r15
underkeep_demo.exe+18F77C: 48 8D 05 61 C8 11 00 - lea rax,[underkeep_demo.exe+2ABFE4]
underkeep_demo.exe+18F783: 48 89 44 24 70 - mov [rsp+70],rax
underkeep_demo.exe+18F788: C7 44 24 78 06 00 00 00 - mov [rsp+78],00000006
underkeep_demo.exe+18F790: 45 33 C0 - xor r8d,r8d
underkeep_demo.exe+18F793: 48 8D 54 24 68 - lea rdx,[rsp+68]
underkeep_demo.exe+18F798: 48 8B 4F 08 - mov rcx,[rdi+08]
underkeep_demo.exe+18F79C: E8 9F BB F3 FF - call underkeep_demo.exe+CB340
}
114994
"spending Stamina sets it back to max"
Auto Assembler Script
[ENABLE]
aobscanmodule(stamina,underkeep_demo.exe,29 B1 F0 00 00 00) // should be unique
alloc(newmem,$1000,stamina)
label(code)
label(return)
newmem:
mov edx, [rcx+e4] // load max stamina
mov [rcx+f0], edx // and store it as current
test eax,eax
code:
// sub [rcx+000000F0],esi
jmp return
stamina:
jmp newmem
nop
return:
registersymbol(stamina)
[DISABLE]
stamina:
db 29 B1 F0 00 00 00
unregistersymbol(stamina)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: underkeep_demo.exe+146F11
underkeep_demo.exe+146EEA: 85 F6 - test esi,esi
underkeep_demo.exe+146EEC: B8 01 00 00 00 - mov eax,00000001
underkeep_demo.exe+146EF1: 0F 48 F0 - cmovs esi,eax
underkeep_demo.exe+146EF4: 29 B7 F4 00 00 00 - sub [rdi+000000F4],esi
underkeep_demo.exe+146EFA: 0F 89 E1 FE FF FF - jns underkeep_demo.exe+146DE1
underkeep_demo.exe+146F00: 89 97 F4 00 00 00 - mov [rdi+000000F4],edx
underkeep_demo.exe+146F06: 48 8B 74 24 38 - mov rsi,[rsp+38]
underkeep_demo.exe+146F0B: 48 83 C4 20 - add rsp,20
underkeep_demo.exe+146F0F: 5F - pop rdi
underkeep_demo.exe+146F10: C3 - ret
// ---------- INJECTING HERE ----------
underkeep_demo.exe+146F11: 29 B1 F0 00 00 00 - sub [rcx+000000F0],esi
// ---------- DONE INJECTING ----------
underkeep_demo.exe+146F17: BA 00 00 00 00 - mov edx,00000000
underkeep_demo.exe+146F1C: 8B 81 F0 00 00 00 - mov eax,[rcx+000000F0]
underkeep_demo.exe+146F22: 48 8B 74 24 38 - mov rsi,[rsp+38]
underkeep_demo.exe+146F27: 0F 48 C2 - cmovs eax,edx
underkeep_demo.exe+146F2A: 89 81 F0 00 00 00 - mov [rcx+000000F0],eax
underkeep_demo.exe+146F30: 48 83 C4 20 - add rsp,20
underkeep_demo.exe+146F34: 5F - pop rdi
underkeep_demo.exe+146F35: C3 - ret
underkeep_demo.exe+146F36: CC - int 3
underkeep_demo.exe+146F37: CC - int 3
}
114995
"spending Mana sets it back to max"
Auto Assembler Script
[ENABLE]
aobscanmodule(mana,underkeep_demo.exe,29 B7 F4 00 00 00) // should be unique
alloc(newmem,$1000,mana)
label(code)
label(return)
newmem:
mov eax,[rdi+e8]
mov [rdi+f4],e8
test eax,eax
code:
// sub [rdi+000000F4],esi
jmp return
mana:
jmp newmem
nop
return:
registersymbol(mana)
[DISABLE]
mana:
db 29 B7 F4 00 00 00
unregistersymbol(mana)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: underkeep_demo.exe+146EF4
underkeep_demo.exe+146ECA: 83 B8 B4 03 00 00 09 - cmp dword ptr [rax+000003B4],09
underkeep_demo.exe+146ED1: 75 07 - jne underkeep_demo.exe+146EDA
underkeep_demo.exe+146ED3: 44 03 80 BC 03 00 00 - add r8d,[rax+000003BC]
underkeep_demo.exe+146EDA: 41 2B F0 - sub esi,r8d
underkeep_demo.exe+146EDD: 49 FF C1 - inc r9
underkeep_demo.exe+146EE0: 49 83 F9 0B - cmp r9,0B
underkeep_demo.exe+146EE4: 0F 8C 46 FF FF FF - jl underkeep_demo.exe+146E30
underkeep_demo.exe+146EEA: 85 F6 - test esi,esi
underkeep_demo.exe+146EEC: B8 01 00 00 00 - mov eax,00000001
underkeep_demo.exe+146EF1: 0F 48 F0 - cmovs esi,eax
// ---------- INJECTING HERE ----------
underkeep_demo.exe+146EF4: 29 B7 F4 00 00 00 - sub [rdi+000000F4],esi
// ---------- DONE INJECTING ----------
underkeep_demo.exe+146EFA: 0F 89 E1 FE FF FF - jns underkeep_demo.exe+146DE1
underkeep_demo.exe+146F00: 89 97 F4 00 00 00 - mov [rdi+000000F4],edx
underkeep_demo.exe+146F06: 48 8B 74 24 38 - mov rsi,[rsp+38]
underkeep_demo.exe+146F0B: 48 83 C4 20 - add rsp,20
underkeep_demo.exe+146F0F: 5F - pop rdi
underkeep_demo.exe+146F10: C3 - ret
stamina: E9 EA 90 E8 FF - jmp 7FF6C6E80000
underkeep_demo.exe+146F16: 90 - nop
underkeep_demo.exe+146F17: BA 00 00 00 00 - mov edx,00000000
underkeep_demo.exe+146F1C: 8B 81 F0 00 00 00 - mov eax,[rcx+000000F0]
}
114983
"Debug"
C0C0C0
1
0
"Experience Character 1"
4 Bytes
underkeep_demo.exe+3CFA4C
3
"Experience Character 2"
0
4 Bytes
underkeep_demo.exe+3CFCD4
1
"Experience Character 3"
4 Bytes
underkeep_demo.exe+3CFF5C
2
"Experience Character 4"
4 Bytes
underkeep_demo.exe+3D01E4
4
"Character 1"
0
1
underkeep_demo.exe+3CF9C0
115058
"No description"
4 Bytes
underkeep_demo.exe+3CFC10
114997
"Character Name"
0
String
20
0
0
1
+8
8
5
"Experience Points"
0
4 Bytes
+8c
9
"Maximum Health"
0
FF0000
4 Bytes
+e0
19
"Maximum Stamina"
0
FF0000
4 Bytes
+e4
20
"Maximum Mana"
0
FF0000
4 Bytes
+e8
21
"Current Health"
0
0000FF
4 Bytes
+ec
22
"Current Stamina"
0
0000FF
4 Bytes
+f0
23
"Current Mana"
0
0000FF
4 Bytes
+f4
18
"Strength"
0
FF0000
4 Bytes
+f8
14
"Dexterity"
0
FF0000
4 Bytes
+fc
15
"Endurance"
0
FF0000
4 Bytes
+100
16
"Wisdom"
0
FF0000
4 Bytes
+104
24
"Evasion"
0
000000
4 Bytes
+114
25
"Armor"
0
000000
4 Bytes
+118
26
"Fire Resistance"
0
000000
4 Bytes
+15c
28
"Ice Resistance"
0
000000
4 Bytes
+160
29
"Lightning Resistance"
0
000000
4 Bytes
+164
30
"Blood Magic Resistance"
0
000000
4 Bytes
+168
31
"Poison Resistance"
0
000000
4 Bytes
+16c
115059
"available Skill Points"
0
000000
4 Bytes
+250
114998
"Character 2"
0
1
underkeep_demo.exe+3CFC48
114999
"Character Name"
0
String
20
0
0
1
+8
8
115000
"Experience Points"
0
4 Bytes
+8c
115001
"Maximum Health"
0
FF0000
4 Bytes
+e0
115002
"Maximum Stamina"
0
FF0000
4 Bytes
+e4
115003
"Maximum Mana"
0
FF0000
4 Bytes
+e8
115004
"Current Health"
0
0000FF
4 Bytes
+ec
115005
"Current Stamina"
0
0000FF
4 Bytes
+f0
115006
"Current Mana"
0
0000FF
4 Bytes
+f4
115007
"Strength"
0
FF0000
4 Bytes
+f8
115008
"Dexterity"
0
FF0000
4 Bytes
+fc
115009
"Endurance"
0
FF0000
4 Bytes
+100
115010
"Wisdom"
0
FF0000
4 Bytes
+104
115011
"Evasion"
0
000000
4 Bytes
+114
115012
"Armor"
0
000000
4 Bytes
+118
115013
"Fire Resistance"
0
000000
4 Bytes
+15c
115014
"Ice Resistance"
0
000000
4 Bytes
+160
115015
"Lightning Resistance"
0
000000
4 Bytes
+164
115016
"Blood Magic Resistance"
0
000000
4 Bytes
+168
115017
"Poison Resistance"
0
000000
4 Bytes
+16c
115060
"available Skill Points"
0
000000
4 Bytes
+250
115018
"Character 3"
0
1
underkeep_demo.exe+3CFed0
115019
"Character Name"
0
String
20
0
0
1
+8
8
115020
"Experience Points"
0
4 Bytes
+8c
115021
"Maximum Health"
0
FF0000
4 Bytes
+e0
115022
"Maximum Stamina"
0
FF0000
4 Bytes
+e4
115023
"Maximum Mana"
0
FF0000
4 Bytes
+e8
115024
"Current Health"
0
0000FF
4 Bytes
+ec
115025
"Current Stamina"
0
0000FF
4 Bytes
+f0
115026
"Current Mana"
0
0000FF
4 Bytes
+f4
115027
"Strength"
0
FF0000
4 Bytes
+f8
115028
"Dexterity"
0
FF0000
4 Bytes
+fc
115029
"Endurance"
0
FF0000
4 Bytes
+100
115030
"Wisdom"
0
FF0000
4 Bytes
+104
115031
"Evasion"
0
000000
4 Bytes
+114
115032
"Armor"
0
000000
4 Bytes
+118
115033
"Fire Resistance"
0
000000
4 Bytes
+15c
115034
"Ice Resistance"
0
000000
4 Bytes
+160
115035
"Lightning Resistance"
0
000000
4 Bytes
+164
115036
"Blood Magic Resistance"
0
000000
4 Bytes
+168
115037
"Poison Resistance"
0
000000
4 Bytes
+16c
115061
"available Skill Points"
0
000000
4 Bytes
+250
115038
"Character 4"
0
1
underkeep_demo.exe+3D0158
115039
"Character Name"
0
String
20
0
0
1
+8
8
115040
"Experience Points"
0
4 Bytes
+8c
115041
"Maximum Health"
0
FF0000
4 Bytes
+e0
115042
"Maximum Stamina"
0
FF0000
4 Bytes
+e4
115043
"Maximum Mana"
0
FF0000
4 Bytes
+e8
115044
"Current Health"
0
0000FF
4 Bytes
+ec
115045
"Current Stamina"
0
0000FF
4 Bytes
+f0
115046
"Current Mana"
0
0000FF
4 Bytes
+f4
115047
"Strength"
0
FF0000
4 Bytes
+f8
115048
"Dexterity"
0
FF0000
4 Bytes
+fc
115049
"Endurance"
0
FF0000
4 Bytes
+100
115050
"Wisdom"
0
FF0000
4 Bytes
+104
115051
"Evasion"
0
000000
4 Bytes
+114
115052
"Armor"
0
000000
4 Bytes
+118
115053
"Fire Resistance"
0
000000
4 Bytes
+15c
115054
"Ice Resistance"
0
000000
4 Bytes
+160
115055
"Lightning Resistance"
0
000000
4 Bytes
+164
115056
"Blood Magic Resistance"
0
000000
4 Bytes
+168
115057
"Poison Resistance"
0
000000
4 Bytes
+16c
115062
"available Skill Points"
0
000000
4 Bytes
+250