Shadow of War Cheat Table - godmode etc 2020-07-22

[ENABLE]

aobscanmodule(health3,ShadowOfWar.exe,F3 0F 10 80 E4 03 00 00 48)
alloc(newmem,$100,"ShadowOfWar.exe"+15E83E)
aobscanmodule(health_sbtr,ShadowOfWar.exe,F3 0F 5D 93 E0 03 00 00)
alloc(newmemb,$100,"ShadowOfWar.exe"+43568C)
alloc(health_addy,8)
label(code)
label(return)
label(codeb)
label(returnb)
registersymbol(health_addy)

health_addy:
dd 0

newmem:

code:
mov [health_addy],rax
push rbx
mov rbx,[rax+000003E0]
mov [rax+000003E4],rbx
pop rbx
  movss xmm0,[rax+000003E4]
  jmp return

health3:
  jmp newmem
  nop
  nop
  nop
return:
registersymbol(health3)

newmemb:
pushf
cmp [rbx+00000494],0
jne codeb
popf
movss xmm2,[rbx+000003E0]
jmp returnb


codeb:
popf
  minss xmm2,[rbx+000003E0]
  jmp returnb

health_sbtr:
  jmp newmemb
  nop
  nop
  nop
returnb:
registersymbol(health_sbtr)

[DISABLE]

health3:
  db F3 0F 10 80 E4 03 00 00
health_sbtr:
  db F3 0F 5D 93 E0 03 00 00

unregistersymbol(health_sbtr)
unregistersymbol(health3)
unregistersymbol(health_addy)
dealloc(newmem)
dealloc(newmemb)

[ENABLE]
aobscanmodule(stealth2,ShadowOfWar.exe,74 0C 48 8B 01 4C 8B C6 48 8B D5)
aobscanmodule(stealth1,ShadowOfWar.exe,F3 0F 10 78 30 44)
alloc(newmem,$100,"ShadowOfWar.exe"+290B66)
registersymbol(stealth2)
label(code)
label(return)

stealth2:
db EB

newmem:

code:
mov [rax+30],00000000
  movss xmm7,[rax+30]
  jmp return

stealth1:
  jmp newmem
return:
registersymbol(stealth1)

[DISABLE]

stealth1:
  db F3 0F 10 78 30
stealth2:
  db 74 0C 48 8B 01

unregistersymbol(stealth1)
unregistersymbol(stealth2)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "ShadowOfWar.exe"+290B66

"ShadowOfWar.exe"+290B38: 48 85 C0              -  test rax,rax
"ShadowOfWar.exe"+290B3B: 0F 85 D9 4C AA 00     -  jne ShadowOfWar.exe+D3581A
"ShadowOfWar.exe"+290B41: 48 8B 0D 20 A6 09 02  -  mov rcx,[ShadowOfWar.exe+232B168]
"ShadowOfWar.exe"+290B48: 4C 8B C7              -  mov r8,rdi
"ShadowOfWar.exe"+290B4B: 48 8B D3              -  mov rdx,rbx
"ShadowOfWar.exe"+290B4E: E8 5D 80 EB FF        -  call ShadowOfWar.exe+148BB0
"ShadowOfWar.exe"+290B53: BF 02 00 00 00        -  mov edi,00000002
"ShadowOfWar.exe"+290B58: 48 85 C0              -  test rax,rax
"ShadowOfWar.exe"+290B5B: 0F 84 9B 00 00 00     -  je ShadowOfWar.exe+290BFC
"ShadowOfWar.exe"+290B61: 44 0F B6 60 40        -  movzx r12d,byte ptr [rax+40]
// ---------- INJECTING HERE ----------
"ShadowOfWar.exe"+290B66: F3 0F 10 78 30        -  movss xmm7,[rax+30]
// ---------- DONE INJECTING  ----------
"ShadowOfWar.exe"+290B6B: 44 38 58 43           -  cmp [rax+43],r11l
"ShadowOfWar.exe"+290B6F: 75 0B                 -  jne ShadowOfWar.exe+290B7C
"ShadowOfWar.exe"+290B71: 44 38 58 44           -  cmp [rax+44],r11l
"ShadowOfWar.exe"+290B75: 75 05                 -  jne ShadowOfWar.exe+290B7C
"ShadowOfWar.exe"+290B77: 41 8A C3              -  mov al,r11l
"ShadowOfWar.exe"+290B7A: EB 07                 -  jmp ShadowOfWar.exe+290B83
"ShadowOfWar.exe"+290B7C: B0 01                 -  mov al,01
"ShadowOfWar.exe"+290B7E: 44 3B E7              -  cmp r12d,edi
"ShadowOfWar.exe"+290B81: 72 F4                 -  jb ShadowOfWar.exe+290B77
"ShadowOfWar.exe"+290B83: 88 45 48              -  mov [rbp+48],al
}

[ENABLE]

aobscanmodule(fast_xp2,ShadowOfWar.exe,89 83 24 05 00 00 74) // should be unique
alloc(newmem,$1000,"ShadowOfWar.exe"+43A4AC)

label(code)
label(return)

newmem:

code:
add eax,eax
add eax,[rbx+00000524]
  mov [rbx+00000524],eax
  jmp return

fast_xp2:
  jmp newmem
  nop
return:
registersymbol(fast_xp2)

[DISABLE]

fast_xp2:
  db 89 83 24 05 00 00

unregistersymbol(fast_xp2)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "ShadowOfWar.exe"+43A4AC

"ShadowOfWar.exe"+43A48A: E8 5D 00 00 00        -  call ShadowOfWar.exe+43A4EC
"ShadowOfWar.exe"+43A48F: 84 C0                 -  test al,al
"ShadowOfWar.exe"+43A491: 74 11                 -  je ShadowOfWar.exe+43A4A4
"ShadowOfWar.exe"+43A493: 8B 57 14              -  mov edx,[rdi+14]
"ShadowOfWar.exe"+43A496: 41 B1 01              -  mov r9l,01
"ShadowOfWar.exe"+43A499: 45 33 C0              -  xor r8d,r8d
"ShadowOfWar.exe"+43A49C: 48 8B CB              -  mov rcx,rbx
"ShadowOfWar.exe"+43A49F: E8 68 B3 02 00        -  call ShadowOfWar.exe+46580C
"ShadowOfWar.exe"+43A4A4: 48 83 7B 40 00        -  cmp qword ptr [rbx+40],00
"ShadowOfWar.exe"+43A4A9: 8B 47 18              -  mov eax,[rdi+18]
// ---------- INJECTING HERE ----------
"ShadowOfWar.exe"+43A4AC: 89 83 24 05 00 00     -  mov [rbx+00000524],eax
// ---------- DONE INJECTING  ----------
"ShadowOfWar.exe"+43A4B2: 74 2B                 -  je ShadowOfWar.exe+43A4DF
"ShadowOfWar.exe"+43A4B4: 48 8B D7              -  mov rdx,rdi
"ShadowOfWar.exe"+43A4B7: 48 8B CB              -  mov rcx,rbx
"ShadowOfWar.exe"+43A4BA: E8 7D 00 00 00        -  call ShadowOfWar.exe+43A53C
"ShadowOfWar.exe"+43A4BF: 48 8B 0D 1A 0B EF 01  -  mov rcx,[ShadowOfWar.exe+232AFE0]
"ShadowOfWar.exe"+43A4C6: 44 8B 83 24 05 00 00  -  mov r8d,[rbx+00000524]
"ShadowOfWar.exe"+43A4CD: 8B 93 20 05 00 00     -  mov edx,[rbx+00000520]
"ShadowOfWar.exe"+43A4D3: 48 8B 89 20 6D 00 00  -  mov rcx,[rcx+00006D20]
"ShadowOfWar.exe"+43A4DA: E8 9D C7 39 00        -  call ShadowOfWar.exe+7D6C7C
"ShadowOfWar.exe"+43A4DF: 48 8B 5C 24 38        -  mov rbx,[rsp+38]
}