52
"Health (freeze me). Full = 53"
Byte
"ddtrilogy.exe"+00118028
3C1
24
53
"Debug"
1
18
"always 3 Lifes left but Score is Zero"
Auto Assembler Script
[ENABLE]
aobscanmodule(life,ddtrilogy.exe,0F B6 8E EA 03 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
mov [esi+000003EA],#3
code:
movzx ecx,byte ptr [esi+000003EA]
jmp return
life:
jmp newmem
nop 2
return:
registersymbol(life)
[DISABLE]
life:
db 0F B6 8E EA 03 00 00
unregistersymbol(life)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "ddtrilogy.exe"+183C6
"ddtrilogy.exe"+183A4: 57 - push edi
"ddtrilogy.exe"+183A5: E8 F6 03 04 00 - call ddtrilogy.exe+587A0
"ddtrilogy.exe"+183AA: 57 - push edi
"ddtrilogy.exe"+183AB: 89 44 24 34 - mov [esp+34],eax
"ddtrilogy.exe"+183AF: E8 3C 04 04 00 - call ddtrilogy.exe+587F0
"ddtrilogy.exe"+183B4: 89 44 24 1C - mov [esp+1C],eax
"ddtrilogy.exe"+183B8: 83 FF 01 - cmp edi,01
"ddtrilogy.exe"+183BB: 75 09 - jne ddtrilogy.exe+183C6
"ddtrilogy.exe"+183BD: 0F B6 8E 48 04 00 00 - movzx ecx,byte ptr [esi+00000448]
"ddtrilogy.exe"+183C4: EB 07 - jmp ddtrilogy.exe+183CD
// ---------- INJECTING HERE ----------
"ddtrilogy.exe"+183C6: 0F B6 8E EA 03 00 00 - movzx ecx,byte ptr [esi+000003EA]
// ---------- DONE INJECTING ----------
"ddtrilogy.exe"+183CD: E8 5E 31 03 00 - call ddtrilogy.exe+4B530
"ddtrilogy.exe"+183D2: 8B 74 24 30 - mov esi,[esp+30]
"ddtrilogy.exe"+183D6: 89 44 24 34 - mov [esp+34],eax
"ddtrilogy.exe"+183DA: B8 05 00 00 00 - mov eax,00000005
"ddtrilogy.exe"+183DF: 3B F0 - cmp esi,eax
"ddtrilogy.exe"+183E1: 0F 4F F0 - cmovg esi,eax
"ddtrilogy.exe"+183E4: E8 77 D6 FE FF - call ddtrilogy.exe+5A60
"ddtrilogy.exe"+183E9: 8B 0D 0C 69 DA 00 - mov ecx,[ddtrilogy.exe+11690C]
"ddtrilogy.exe"+183EF: 83 78 10 00 - cmp dword ptr [eax+10],00
"ddtrilogy.exe"+183F3: 75 4A - jne ddtrilogy.exe+1843F
}
54
"pointerscan result"
Byte
"ddtrilogy.exe"+00118028
3C1
24
2C
4
55
"pointerscan result"
Byte
"ddtrilogy.exe"+00118028
3C1
24
4C
4
84
56
"pointerscan result"
Byte
"ddtrilogy.exe"+00118028
3C1
24
34
C
88
57
"pointerscan result"
Byte
"ddtrilogy.exe"+00118028
3C1
24
34
C
8C
58
"pointerscan result"
Byte
"ddtrilogy.exe"+00118028
3C1
24
24
4
B0
59
"pointerscan result"
Byte
"ddtrilogy.exe"+00118028
3C1
24
24
4
80