Roman012 !BEWARE! Deletes post on answer
Reputation: 0
Joined: 25 Dec 2022 Posts: 41
|
Posted: Mon Oct 02, 2023 10:17 am Post subject: Is it not working |
|
|
Why is it not working?
[ENABLE]
aobscanmodule(TELE,X.X.X.X.exe,F2 0F 10 00 8B 4B 3C)
alloc(newmem,$1000)
label(code)
label(return)
label(coords2)
label(tflag)
registersymbol(tflag)
newmem:
cmp byte ptr [tflag],0
je code
cmp byte ptr [tflag],1
jne @F
push edi
mov edi,[eax]
mov [coords2],edi
mov edi,[eax+8]
mov [coords2+4],edi
mov edi,[eax+10]
mov [coords2+8],edi
pop edi
mov byte ptr [tflag],0
jmp code
@@:
cmp byte ptr [tflag],2
jne code
push edi
mov edi,[coords2]
mov [eax],edi
mov edi,[coords2+4]
mov [eax+8],edi
mov edi,[coords2+8]
mov [eax+10],edi
pop edi
mov byte ptr [tflag],0
code:
movsd xmm0,[eax]
mov ecx,[ebx+3C]
jmp return
tflag:
db 00
coords2:
db 00 00 00 00 00 00 00 00 00 00 00 00
TELE:
jmp newmem
nop 2
return:
registersymbol(TELE)
[DISABLE]
TELE:
db F2 0F 10 00 8B 4B 3C
unregistersymbol(TELE)
unregistersymbol(tflag)
dealloc(newmem)
| Description: |
|
| Filesize: |
134.89 KB |
| Viewed: |
1734 Time(s) |

|
| Description: |
|
| Filesize: |
325.47 KB |
| Viewed: |
1734 Time(s) |

|
|
|
ParkourPenguin I post too much
Reputation: 152
Joined: 06 Jul 2014 Posts: 4715
|
Posted: Mon Oct 02, 2023 11:49 am Post subject: |
|
|
`movsd` means "move scalar double". A double is 8 bytes, not 4.
Why are you writing your code in blue text? Use the code tag
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|