3
"Always Full Health"
Auto Assembler Script
[ENABLE]
aobscanmodule(health,gorky17.exe,8B 02 50 E8 A6 FE FF FF) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
mov eax,[edx+1c] // load max health
mov [edx],eax // copy to current health
code:
mov eax,[edx]
push eax
call gorky17.exe+B1D20
jmp return
health:
jmp newmem
nop 3
return:
registersymbol(health)
[DISABLE]
health:
db 8B 02 50 E8 A6 FE FF FF
unregistersymbol(health)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "gorky17.exe"+B1E72
"gorky17.exe"+B1E53: 8B 49 14 - mov ecx,[ecx+14]
"gorky17.exe"+B1E56: 81 E1 FF 7F 00 00 - and ecx,00007FFF
"gorky17.exe"+B1E5C: EB 02 - jmp gorky17.exe+B1E60
"gorky17.exe"+B1E5E: 33 C9 - xor ecx,ecx
"gorky17.exe"+B1E60: 8B 07 - mov eax,[edi]
"gorky17.exe"+B1E62: 51 - push ecx
"gorky17.exe"+B1E63: 8B 90 AC 48 02 00 - mov edx,[eax+000248AC]
"gorky17.exe"+B1E69: 8B 0A - mov ecx,[edx]
"gorky17.exe"+B1E6B: 8B 90 A8 48 02 00 - mov edx,[eax+000248A8]
"gorky17.exe"+B1E71: 51 - push ecx
// ---------- INJECTING HERE ----------
"gorky17.exe"+B1E72: 8B 02 - mov eax,[edx]
"gorky17.exe"+B1E74: 50 - push eax
"gorky17.exe"+B1E75: E8 A6 FE FF FF - call gorky17.exe+B1D20
// ---------- DONE INJECTING ----------
"gorky17.exe"+B1E7A: 8B 0D DC 61 6C 00 - mov ecx,[gorky17.exe+2C61DC]
"gorky17.exe"+B1E80: 83 C4 0C - add esp,0C
"gorky17.exe"+B1E83: 83 79 08 02 - cmp dword ptr [ecx+08],02
"gorky17.exe"+B1E87: 7E 0B - jle gorky17.exe+B1E94
"gorky17.exe"+B1E89: 8B 49 0C - mov ecx,[ecx+0C]
"gorky17.exe"+B1E8C: 8B 49 14 - mov ecx,[ecx+14]
"gorky17.exe"+B1E8F: C1 E9 10 - shr ecx,10
"gorky17.exe"+B1E92: EB 02 - jmp gorky17.exe+B1E96
"gorky17.exe"+B1E94: 33 C9 - xor ecx,ecx
"gorky17.exe"+B1E96: 51 - push ecx
}
6
"Always 10 Shots Ammo left"
Auto Assembler Script
[ENABLE]
aobscanmodule(ammo,gorky17.exe,8B 02 A3 4C 62 6C 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
mov [edx],#10
code:
mov eax,[edx]
mov [gorky17.exe+2C624C],eax
jmp return
ammo:
jmp newmem
nop 2
return:
registersymbol(ammo)
[DISABLE]
ammo:
db 8B 02 A3 4C 62 6C 00
unregistersymbol(ammo)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "gorky17.exe"+B2D0A
"gorky17.exe"+B2CED: 50 - push eax
"gorky17.exe"+B2CEE: 8B 86 7C 1A 00 00 - mov eax,[esi+00001A7C]
"gorky17.exe"+B2CF4: 8B 08 - mov ecx,[eax]
"gorky17.exe"+B2CF6: 51 - push ecx
"gorky17.exe"+B2CF7: E8 84 AB FC FF - call gorky17.exe+7D880
"gorky17.exe"+B2CFC: 83 C4 08 - add esp,08
"gorky17.exe"+B2CFF: 85 C0 - test eax,eax
"gorky17.exe"+B2D01: 5E - pop esi
"gorky17.exe"+B2D02: 74 0D - je gorky17.exe+B2D11
"gorky17.exe"+B2D04: 8B 90 6C 03 00 00 - mov edx,[eax+0000036C]
// ---------- INJECTING HERE ----------
"gorky17.exe"+B2D0A: 8B 02 - mov eax,[edx]
"gorky17.exe"+B2D0C: A3 4C 62 6C 00 - mov [gorky17.exe+2C624C],eax
// ---------- DONE INJECTING ----------
"gorky17.exe"+B2D11: C3 - ret
"gorky17.exe"+B2D12: 90 - nop
"gorky17.exe"+B2D13: 90 - nop
"gorky17.exe"+B2D14: 90 - nop
"gorky17.exe"+B2D15: 90 - nop
"gorky17.exe"+B2D16: 90 - nop
"gorky17.exe"+B2D17: 90 - nop
"gorky17.exe"+B2D18: 90 - nop
"gorky17.exe"+B2D19: 90 - nop
"gorky17.exe"+B2D1A: 90 - nop
}
11
"Do not spend Skillpoints"
Auto Assembler Script
[ENABLE]
"gorky17.exe"+B0D03:
nop
nop
nop
[DISABLE]
"gorky17.exe"+B0D03:
mov [ecx+24],eax
8
"Experience"
Auto Assembler Script
[ENABLE]
aobscanmodule(experience,gorky17.exe,DB 00 D9 1A 8B 81 CC 48 02 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
globalalloc(_experience,4)
newmem:
mov [_experience],eax
code:
fild dword ptr [eax]
fstp dword ptr [edx]
mov eax,[ecx+000248CC]
jmp return
experience:
jmp newmem
nop 5
return:
registersymbol(experience)
[DISABLE]
experience:
db DB 00 D9 1A 8B 81 CC 48 02 00
unregistersymbol(experience)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "gorky17.exe"+8FCBA
"gorky17.exe"+8FCA8: 90 - nop
"gorky17.exe"+8FCA9: 90 - nop
"gorky17.exe"+8FCAA: 90 - nop
"gorky17.exe"+8FCAB: 90 - nop
"gorky17.exe"+8FCAC: 90 - nop
"gorky17.exe"+8FCAD: 90 - nop
"gorky17.exe"+8FCAE: 90 - nop
"gorky17.exe"+8FCAF: 90 - nop
"gorky17.exe"+8FCB0: 8B 81 C8 48 02 00 - mov eax,[ecx+000248C8]
"gorky17.exe"+8FCB6: 8B 54 24 04 - mov edx,[esp+04]
// ---------- INJECTING HERE ----------
"gorky17.exe"+8FCBA: DB 00 - fild dword ptr [eax]
"gorky17.exe"+8FCBC: D9 1A - fstp dword ptr [edx]
"gorky17.exe"+8FCBE: 8B 81 CC 48 02 00 - mov eax,[ecx+000248CC]
// ---------- DONE INJECTING ----------
"gorky17.exe"+8FCC4: 8B 10 - mov edx,[eax]
"gorky17.exe"+8FCC6: 52 - push edx
"gorky17.exe"+8FCC7: E8 F4 FC FF FF - call gorky17.exe+8F9C0
"gorky17.exe"+8FCCC: 8B 4C 24 0C - mov ecx,[esp+0C]
"gorky17.exe"+8FCD0: 89 44 24 04 - mov [esp+04],eax
"gorky17.exe"+8FCD4: DB 44 24 04 - fild dword ptr [esp+04]
"gorky17.exe"+8FCD8: 8B 44 24 08 - mov eax,[esp+08]
"gorky17.exe"+8FCDC: D9 18 - fstp dword ptr [eax]
"gorky17.exe"+8FCDE: C7 01 00 00 80 3F - mov [ecx],3F800000
"gorky17.exe"+8FCE4: C2 0C 00 - ret 000C
}
9
"Experience of currently selected hero"
4 Bytes
[_experience]
Change of mov [ecx+24],eax
gorky17.exe+B0D03
20
2B
C7
5F
5E
89
41
24
5B
C3
90
90
90
_experience
001E0000