反编译界面追踪到代码片段.选中注入字节, CTRL+A进入注入.选AOB注入 ,自动转化字节注入
[ENABLE]
aobscanmodule(INJECT,PlantsVsZombies.exe,7E 14 C7 47 24 00 00 00 00)
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
je PlantsVsZombies.exe+872AC
mov [edi+24],00000000
jmp return
INJECT:
jmp newmem
nop 4
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 7E 14 C7 47 24 00 00 00 00
unregistersymbol(INJECT)
dealloc(newmem)