171
"Health Step 2 CE Tuto 32Bit"
Auto Assembler Script
[ENABLE]
aobscanmodule(INJECT,Tutorial-i386.exe,89 83 80 04 00 00 8D 55 D4 E8 02) // should be unique
alloc(newmem,$1000)
alloc(org,100)
label(code)
label(return)
newmem:
call rand
code:
mov eax,[RND]
mov [ebx+00000480],eax
mov [org],ebx
add [org],480
jmp return
INJECT:
jmp newmem
nop
return:
registersymbol(INJECT)
registersymbol(org)
[DISABLE]
INJECT:
db 89 83 80 04 00 00
unregistersymbol(INJECT)
unregistersymbol(org)
dealloc(newmem)
dealloc(org)
173
"org"
4 Bytes
[org]
174
"Activate then "call rand" and use 'RND' address"
Auto Assembler Script
[ENABLE]
alloc(rand,$1000)
alloc(RND,100)
alloc(lowerBound,100)
alloc(upperBound,100)
lowerBound:
dd #1
upperBound:
dd #2
rand:
pushad
call msvcrt.rand
xor edx,edx
mov ebx,[lowerBound]
mov ecx,[upperBound]
cmp ecx,ebx
cmovl ecx,ebx
inc ecx
sub ecx,ebx
idiv ecx
mov [RND],edx
add [RND],ebx
popad
ret
registersymbol(rand)
registersymbol(RND)
registersymbol(lowerBound)
registersymbol(upperBound)
[DISABLE]
unregistersymbol(rand)
unregistersymbol(RND)
unregistersymbol(lowerBound)
unregistersymbol(upperBound)
dealloc(rand)
dealloc(RND)
dealloc(lowerBound)
dealloc(upperBound)
172
"RND"
4 Bytes
RND
175
"Min"
1
4 Bytes
lowerBound
176
"Max"
1
4 Bytes
upperBound
asTimeGoesByDisactive
003608AF
asTimeGoesBy
003F0872
myRandomNumber
0174003B
INJECT
00423B00