[Solved] Instant Kill Assembly

Hi guys,

Im trying to add instant kill to my next trainer and since i cant find a pointer for it but i can find the same code for it in the memory viewer of cheat engine I have gone into the code injection bit and have this for the value that turns instant kill on or off.

this is the assembly code

Code:

Address - 00483DED - Bytes - 8B 56 04 - Opcode - mov edx,[esi+04]
Address - 00483DF0 - Bytes - 83 E0 1F - Opcode - and eax,1F

Code:

alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
mov edx,[esi+04]
and eax,1F

exit:
jmp returnhere

"BlackOps.exe"+83DED:
jmp newmem
nop
returnhere:

Found this In ollydbg at the address if it helps

Code:

00483DED   8B56 04          MOV EDX,DWORD PTR DS:[ESI+4]

Code:

Public Class Form1
    Dim Mem As Injection = New Injection
    Private Sub button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles button1.Click
        Mem.GetProc("BlackOps")
        Mem.Inject_Jmp(&H483DED, "8B4608", "8B5604")
    End Sub
End Class

Also I found

Code:

00483e2f

but i think that is the shown instant kill thing not 100% sure i might have got mixed up
This is what I have I just dont understand how to find the bytes, Would I use ollydbg and what to look for :P

now I am starting to learn assembly with tutorials online but would anyone be able to explain how I would make this work for instant kill on or off into VB, as with the beginner tutorials which im having to start off with I dont think im close to figuring this out but I will continue to follow the tutorials I have Im just wondering if anyone can explain this situation so it would work for me.

Kind Regards
Zolferno

PS: I Have no recoil working just found it, I NOP the addresses but I cant turn it off I cant undo my NOP im using the module from someones post on this forum but ofr the life of me i cant find it this is what i have atm.

Code:

        If CheckBox13.Checked = True Then
            noph4x(&H6563F8, &H90)
            noph4x(&H6563F9, &H90)
            noph4x(&H6563FA, &H90)
            noph4x(&H6563FB, &H90)
            noph4x(&H6563FC, &H90)
            CheckBox13.ForeColor = Color.Lime
        ElseIf CheckBox13.Checked = False Then
            CheckBox13.ForeColor = Color.Red
        End If
    End Sub

now I have tried to do this and replace the bytes with the original ones but it just doesent work as it still NOP its :P hmm I think i might jsut have to writeabyte to these address to their original value

What is this mov edx,[esi+04] <- health or some sort of instant kill boolean.
If it writes to the health address, you could probably make a script like

Code:

[enable]
alloc(Health,128) //create a codecave for our new code

Health: //CodeCave
mov [esi+04],0 //writes zero to the health addy
and eax,1F //next instruction
jmp 483DFC //jump back to next instruction 6 bytes away

483DED: //Starting location
jmp Health //jump to new code
db 90 //nop that last byte cause 5 bytes was needed a 1 byte remained

[disable]
483DED:
mov edx,[esi+04] //default
and eax,1F //default
dealloc(Health) //deallocate codecave to clean up the memory

I cant really help you much, i dont have the game installed. But if you like, i could view your code over team viewer. ping0@hotmail.co.uk
See if i can sort some of the scripts out.

The address i used for instant kill was the one that accessed health when the zombies spawned. Id write zero to the health addy so it would only take one shot to kill. No point me giving the address cause i was using a different version and the instructions have changed. Just need to find it again.

Okay well I found the address for the zombie hp and found what accesses it and 2 other ones came up aswell as the one i showed you before this came up on other one

Code:

alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
mov ecx,[ecx+04]
and eax,1F

exit:
jmp returnhere

"BlackOps.exe"+4A9BC9:
jmp newmem
nop
returnhere:

and

Code:

alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
mov [esi+04],eax
pop esi
ret 

exit:
jmp returnhere

"BlackOps.exe"+83E2F:
jmp newmem
returnhere:

ill try and figure it out but if you get online and see this could you show me what you did before :L as i dident get the 6 bytes before thing that you did for

Code:

jmp 483DFC //jump back to next instruction 6 bytes away

ah i get it now count down 6 bytes and whats there is what you jump to

Yea 6 bytes for that because a jump needs 5 and these 2 instructions take 6 bytes total.
If that second instruction was longer, you would need to nop more bytes.
So you jump to the next instruction atleast 5 bytes away, and nop the rest leading up to it.
Address - 00483DED - Bytes - 8B 56 04 - Opcode - mov edx,[esi+04]
Address - 00483DF0 - Bytes - 83 E0 1F - Opcode - and eax,1F

the thread can be closed now my problem has been solved

/Solved & Closed
Good to see people in the BO Section

[Solved] Instant Kill Assembly

Post a Reply

Similar Threads

Tags for this Thread