[ENABLE]
aobscanmodule(INJECT,JH-Win64-Shipping.exe,25 FF 7F 00 00 F3 0F 5C F7) // should be unique
alloc(newmem,$1000,INJECT)
label(code)
label(return)
alloc(Task_time,4)
registersymbol(Task_time)
Task_time:
db ff 7f 00 00
newmem:
code:
mov eax,[Task_time]
jmp return
INJECT:
jmp newmem
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 25 FF 7F 00 00
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: JH-Win64-Shipping.exe+F9150C
JH-Win64-Shipping.exe+F914DD: 48 8B DA - mov rbx,rdx
JH-Win64-Shipping.exe+F914E0: 0F 29 74 24 50 - movaps [rsp+50],xmm6
JH-Win64-Shipping.exe+F914E5: 0F 28 F3 - movaps xmm6,xmm3
JH-Win64-Shipping.exe+F914E8: 0F 29 7C 24 40 - movaps [rsp+40],xmm7
JH-Win64-Shipping.exe+F914ED: 0F 28 FA - movaps xmm7,xmm2
JH-Win64-Shipping.exe+F914F0: 44 0F 29 44 24 30 - movaps [rsp+30],xmm8
JH-Win64-Shipping.exe+F914F6: F2 44 0F 10 01 - movsd xmm8,[rcx]
JH-Win64-Shipping.exe+F914FB: F2 44 0F 11 44 24 20 - movsd [rsp+20],xmm8
JH-Win64-Shipping.exe+F91502: 89 7C 24 28 - mov [rsp+28],edi
JH-Win64-Shipping.exe+F91506: FF 15 CC 38 F9 02 - call qword ptr [JH-Win64-Shipping.exe+3F24DD8]
// ---------- INJECTING HERE ----------
JH-Win64-Shipping.exe+F9150C: 25 FF 7F 00 00 - and eax,00007FFF
// ---------- DONE INJECTING ----------
JH-Win64-Shipping.exe+F91511: F3 0F 5C F7 - subss xmm6,xmm7
JH-Win64-Shipping.exe+F91515: 66 0F 6E D0 - movd xmm2,eax
JH-Win64-Shipping.exe+F91519: 0F B6 44 24 20 - movzx eax,byte ptr [rsp+20]
JH-Win64-Shipping.exe+F9151E: 0F 5B D2 - cvtdq2ps xmm2,xmm2
JH-Win64-Shipping.exe+F91521: F3 0F 59 15 07 8D FF 02 - mulss xmm2,[JH-Win64-Shipping.exe+3F8A230]
JH-Win64-Shipping.exe+F91529: F3 0F 59 D6 - mulss xmm2,xmm6
JH-Win64-Shipping.exe+F9152D: F3 0F 58 D7 - addss xmm2,xmm7
JH-Win64-Shipping.exe+F91531: 3C 04 - cmp al,04
JH-Win64-Shipping.exe+F91533: 74 24 - je JH-Win64-Shipping.exe+F91559
JH-Win64-Shipping.exe+F91535: 3C 09 - cmp al,09
}
脚本效果见演示视频
说明：Task_time变量控制的是随机变量倍率，0x00007FFF（32767）是1.00，也就是满变，0x0000FFFE（65534）是2.00就是2倍，以此类推
