Download ArmA 2 Free script injection

[c5]

This game is so trashed and abandoned, I even feel sorry of it.

Anyhow, this is really easy to port over to Dayz or ArmA 3 to make it work there..

This is really old but it should work with the ArmA 2 Free 1.10 or 1.11 or something version of the game, nonetheless I've included a sig.. use the additional information below as a reference to port it for Dayz/ArmA 3.

#include <Windows.h>
#include <stdio.h>

#pragma warning(disable: 4996) // ktnxbye

DWORD dwInstance = 0xB9F640;
DWORD dwParam = 0xB788CC;
DWORD dwThis = 0xBDA648;
DWORD dwCall = 0x8FCCF3;
DWORD dwScriptFlags = 0x5DC;

bool exec(char* szExec)
{
	if (!dwInstance || !dwParam || !dwThis || !dwCall)
		return false;

	size_t tempSize = strlen(szExec) + 14;

	char* code = new char[tempSize];
	memset(code, 0, tempSize);
	sprintf(code, "[] spawn {%s};", szExec);

	DWORD dwThisScriptFlags = *(DWORD*)dwInstance + dwScriptFlags;
	dwThisScriptFlags = *(DWORD*)dwThisScriptFlags;
		
	__asm
	{
		push dword ptr ds:[dwThisScriptFlags]
		mov ecx, dword ptr ds:[dwThis]
		push dword ptr ds:[dwParam] 
		push tempCode
		call [dwCall]
	}

	Sleep(20);

	delete[] code;
	code = 0;

	return true;
}

/* ARMA 2 Free
Sig: 8B 80 DC 05 00 00 50 68 CC 88 B7 00 56

00409A5F   83CA FF          OR EDX,0xFFFFFFFF
00409A62   F0:0FC110        LOCK XADD DWORD PTR DS:[EAX],EDX         ; LOCK prefix
00409A66   4A               DEC EDX
00409A67   75 07            JNZ SHORT arma2fre.00409A70
00409A69   8B01             MOV EAX,DWORD PTR DS:[ECX]
00409A6B   8B50 04          MOV EDX,DWORD PTR DS:[EAX+0x4]
00409A6E   FFD2             CALL EDX
00409A70   A1 40F6B900      MOV EAX,DWORD PTR DS:[0xB9F640]          ; dwInstance (CLIENTPTR)
pat>00409A75   8B80 DC050000    MOV EAX,DWORD PTR DS:[EAX+0x5DC]         ; dwExec . scriptFlags
00409A7B   50               PUSH EAX
00409A7C   68 CC88B700      PUSH arma2fre.00B788CC                   ; dwParam
00409A81   56               PUSH ESI
00409A82   B9 48A6BD00      MOV ECX,arma2fre.00BDA648                ; dwThis
00409A87   E8 67324F00      CALL arma2fre.008FCCF3                   ; dwCall
00409A8C   84C0             TEST AL,AL
00409A8E   74 0D            JE SHORT arma2fre.00409A9D
00409A90   8B4D EC          MOV ECX,DWORD PTR SS:[EBP-0x14]
00409A93   C781 E0470000 00>MOV DWORD PTR DS:[ECX+0x47E0],0x0
00409A9D   B9 48A6BD00      MOV ECX,arma2fre.00BDA648
00409AA2   E8 E9124F00      CALL arma2fre.008FAD90
00409AA7   8D4D C8          LEA ECX,DWORD PTR SS:[EBP-0x38]
00409AAA   E8 52624F00      CALL arma2fre.008FFD01
00409AAF   85FF             TEST EDI,EDI
00409AB1   74 0B            JE SHORT arma2fre.00409ABE
00409AB3   8B57 10          MOV EDX,DWORD PTR DS:[EDI+0x10]
*/

Credits/Thanks Darky, s0beit

 

[Rake]

Thank you for sharing, c5.