ParkourPenguin I post too much
Reputation: 152
Joined: 06 Jul 2014 Posts: 4711
|
Posted: Sun May 05, 2024 1:46 pm Post subject: |
|
|
CE tutorial x64 step 2; hold "V" to win:
| Code: | define(address,"Tutorial-x86_64.exe"+2B4BC)
define(bytes,29 83 F8 07 00 00)
[ENABLE]
assert(address,bytes)
alloc(newmem,$1000,"Tutorial-x86_64.exe"+2B4BC)
label(code)
label(return)
newmem:
{$ccode damage=rax rbx=rbx}
short GetAsyncKeyState(int);
short res = GetAsyncKeyState('V');
if (res & 0x8000) {
int *healthp = (int *)(rbx+0x7F8);
*healthp = 1000;
damage=0;
}
{$asm}
code:
sub [rbx+000007F8],eax
jmp return
address:
jmp newmem
nop
return:
[DISABLE]
address:
db bytes
// sub [rbx+000007F8],eax
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: Tutorial-x86_64.exe+2B4BC
Tutorial-x86_64.exe+2B490: 55 - push rbp
Tutorial-x86_64.exe+2B491: 48 89 E5 - mov rbp,rsp
Tutorial-x86_64.exe+2B494: 48 8D A4 24 D0 FE FF FF - lea rsp,[rsp-00000130]
Tutorial-x86_64.exe+2B49C: 48 89 9D F0 FE FF FF - mov [rbp-00000110],rbx
Tutorial-x86_64.exe+2B4A3: 48 89 CB - mov rbx,rcx
Tutorial-x86_64.exe+2B4A6: 48 C7 45 F8 00 00 00 00 - mov qword ptr [rbp-08],00000000
Tutorial-x86_64.exe+2B4AE: 90 - nop
Tutorial-x86_64.exe+2B4AF: B9 05 00 00 00 - mov ecx,00000005
Tutorial-x86_64.exe+2B4B4: E8 57 47 FE FF - call Tutorial-x86_64.exe+FC10
Tutorial-x86_64.exe+2B4B9: 83 C0 01 - add eax,01
// ---------- INJECTING HERE ----------
Tutorial-x86_64.exe+2B4BC: 29 83 F8 07 00 00 - sub [rbx+000007F8],eax
// ---------- DONE INJECTING ----------
Tutorial-x86_64.exe+2B4C2: 48 8D 4D F8 - lea rcx,[rbp-08]
Tutorial-x86_64.exe+2B4C6: E8 45 DA FD FF - call Tutorial-x86_64.exe+8F10
Tutorial-x86_64.exe+2B4CB: 8B 8B F8 07 00 00 - mov ecx,[rbx+000007F8]
Tutorial-x86_64.exe+2B4D1: 41 B9 FF 00 00 00 - mov r9d,000000FF
Tutorial-x86_64.exe+2B4D7: 4C 8D 85 F8 FE FF FF - lea r8,[rbp-00000108]
Tutorial-x86_64.exe+2B4DE: 48 C7 C2 FF FF FF FF - mov rdx,FFFFFFFFFFFFFFFF
Tutorial-x86_64.exe+2B4E5: 48 63 C9 - movsxd rcx,ecx
Tutorial-x86_64.exe+2B4E8: E8 A3 AB FD FF - call Tutorial-x86_64.exe+6090
Tutorial-x86_64.exe+2B4ED: 45 31 C0 - xor r8d,r8d
Tutorial-x86_64.exe+2B4F0: 48 8D 95 F8 FE FF FF - lea rdx,[rbp-00000108]
} |
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|