Thomas Crawford
New Member
- Joined
- Aug 19, 2014
- Messages
- 1
- Reaction score
- 0
You are a genius!
Antiviruses sometimes treat trainers as malware or trojans,because they are softwares that are altering a game. If you want to know more, direct here to General Discussions http://mrantifun.net/index.php?threads/why-trainers-show-up-as-virus-sometimes.1308/Everytime i try to open it, it says avg detected a virus and wont let me open it.
New trainer added.
[ENABLE]
aobscanmodule(technology,NMS.exe,49 8B 9E 38 2F 00 00)
alloc(newmem,$1000,technology)
alloc(cGcTechnologyTable,1024,technology)
label(cGcTechnologyTable_end)
registersymbol(cGcTechnologyTable)
registersymbol(cGcTechnologyTable_end)
label(code)
label(return)
newmem:
code:
mov rbx,cGcTechnologyTable
mov rdi,cGcTechnologyTable_end
jmp return
technology:
jmp code
nop
nop
return:
registersymbol(technology)
cGcTechnologyTable+000:
db 'PROTECT'
cGcTechnologyTable+010:
db 'ENERGY'
cGcTechnologyTable+020:
db 'JET1'
cGcTechnologyTable+030:
db 'JETBOOST1'
cGcTechnologyTable+040:
db 'JETBOOST2'
cGcTechnologyTable+050:
db 'JETBOOST3'
cGcTechnologyTable+060:
db 'UNW1'
cGcTechnologyTable+070:
db 'UNW2'
cGcTechnologyTable+080:
db 'UNW3'
cGcTechnologyTable+090:
db 'RAD1'
cGcTechnologyTable+0A0:
db 'RAD2'
cGcTechnologyTable+0B0:
db 'RAD3'
cGcTechnologyTable+0C0:
db 'TOX1'
cGcTechnologyTable+0D0:
db 'TOX2'
cGcTechnologyTable+0E0:
db 'TOX3'
cGcTechnologyTable+0F0:
db 'COLD1'
cGcTechnologyTable+100:
db 'COLD2'
cGcTechnologyTable+110:
db 'COLD3'
cGcTechnologyTable+120:
db 'HOT1'
cGcTechnologyTable+130:
db 'HOT2'
cGcTechnologyTable+140:
db 'HOT3'
cGcTechnologyTable+150:
db 'SHIELDBOOST1'
cGcTechnologyTable+160:
db 'SHIELDBOOST2'
cGcTechnologyTable+170:
db 'SHIELDBOOST3'
cGcTechnologyTable+180:
db 'STAM1'
cGcTechnologyTable+190:
db 'STAM2'
cGcTechnologyTable+1A0:
db 'STAM3'
cGcTechnologyTable+1B0:
db 'ENERGYBOOST1'
cGcTechnologyTable+1C0:
db 'ENERGYBOOST2'
cGcTechnologyTable+1D0:
db 'ARMOUR1'
cGcTechnologyTable+1E0:
db 'ARMOUR2'
cGcTechnologyTable+1F0:
db 'ARMOUR3'
cGcTechnologyTable+200:
db 'SHIPLAS1'
cGcTechnologyTable+210:
db 'SHIPLASCOOL1'
cGcTechnologyTable+220:
db 'SHIPLASCOOL2'
cGcTechnologyTable+230:
db 'SHIPLASCOOL3'
cGcTechnologyTable+240:
db 'SHIPLDMG1'
cGcTechnologyTable+250:
db 'SHIPLDMG2'
cGcTechnologyTable+260:
db 'SHIPLDMG3'
cGcTechnologyTable+270:
db 'SHIPGUN1'
cGcTechnologyTable+280:
db 'SHIPGUNCOOL1'
cGcTechnologyTable+290:
db 'SHIPGUNCOOL2'
cGcTechnologyTable+2A0:
db 'SHIPGUNCOOL3'
cGcTechnologyTable+2B0:
db 'SHIPGUNRATE1'
cGcTechnologyTable+2C0:
db 'SHIPGUNRATE2'
cGcTechnologyTable+2D0:
db 'SHIPGUNRATE3'
cGcTechnologyTable+2E0:
db 'SHIPGDMG1'
cGcTechnologyTable+2F0:
db 'SHIPGDMG2'
cGcTechnologyTable+300:
db 'SHIPGDMG3'
cGcTechnologyTable+310:
db 'SHIPSHIELD'
cGcTechnologyTable+320:
db 'SHIPSHLDBOOST1'
cGcTechnologyTable+330:
db 'SHIPSHLDBOOST2'
cGcTechnologyTable+340:
db 'SHIPSHLDBOOST3'
cGcTechnologyTable+350:
db 'SHIPJUMP1'
cGcTechnologyTable+360:
db 'SHIPJUMP2'
cGcTechnologyTable+370:
db 'SHIPJUMP3'
cGcTechnologyTable+380:
db 'HYPERDRIVE'
cGcTechnologyTable+390:
db 'HDRIVEBOOST1'
cGcTechnologyTable+3A0:
db 'HDRIVEBOOST2'
cGcTechnologyTable+3B0:
db 'HDRIVEBOOST3'
cGcTechnologyTable+3C0:
db 'LAUNCHER'
cGcTechnologyTable+3D0:
db 'PHOTONIX_CORE'
cGcTechnologyTable+3E0:
db 'LASER'
cGcTechnologyTable+3F0:
db 'RAILGUN'
cGcTechnologyTable+400:
db 'LASMINERAD1'
cGcTechnologyTable+410:
db 'LASMINERAD2'
cGcTechnologyTable+420:
db 'LASMINERAD3'
cGcTechnologyTable+430:
db 'LASMINESPEED1'
cGcTechnologyTable+440:
db 'LASMINESPEED2'
cGcTechnologyTable+450:
db 'LASMINESPEED3'
cGcTechnologyTable+460:
db 'LASCOOL1'
cGcTechnologyTable+470:
db 'LASCOOL2'
cGcTechnologyTable+480:
db 'LASCOOL3'
cGcTechnologyTable+490:
db 'LASDMG1'
cGcTechnologyTable+4A0:
db 'LASDMG2'
cGcTechnologyTable+4B0:
db 'LASDMG3'
cGcTechnologyTable+4C0:
db 'LASDMG4'
cGcTechnologyTable+4D0:
db 'BOLT'
cGcTechnologyTable+4E0:
db 'SHOTGUN'
cGcTechnologyTable+4F0:
db 'SMG'
cGcTechnologyTable+500:
db 'BOLTHOMING'
cGcTechnologyTable+510:
db 'BOLTDMG1'
cGcTechnologyTable+520:
db 'BOLTDMG2'
cGcTechnologyTable+530:
db 'BOLTDMG3'
cGcTechnologyTable+540:
db 'BOLTDMG4'
cGcTechnologyTable+550:
db 'BOLTRATE1'
cGcTechnologyTable+560:
db 'BOLTRATE2'
cGcTechnologyTable+570:
db 'BOLTRATE3'
cGcTechnologyTable+580:
db 'BOLTCLIP1'
cGcTechnologyTable+590:
db 'BOLTCLIP2'
cGcTechnologyTable+5A0:
db 'BOLTCLIP3'
cGcTechnologyTable+5B0:
db 'BOLTREL1'
cGcTechnologyTable+5C0:
db 'BOLTREL2'
cGcTechnologyTable+5D0:
db 'BOLTREL3'
cGcTechnologyTable+5E0:
db 'BOLTSTAB1'
cGcTechnologyTable+5F0:
db 'BOLTSTAB2'
cGcTechnologyTable+600:
db 'BOLTSTAB3'
cGcTechnologyTable+610:
db 'BOLTBOUNCE1'
cGcTechnologyTable+620:
db 'BOLTBOUNCE2'
cGcTechnologyTable+630:
db 'BOLTBOUNCE3'
cGcTechnologyTable+640:
db 'GRENADE'
cGcTechnologyTable+650:
db 'GRENHOMING1'
cGcTechnologyTable+660:
db 'GRENBOUNCE1'
cGcTechnologyTable+670:
db 'GRENBOUNCE2'
cGcTechnologyTable+680:
db 'GRENSPEED1'
cGcTechnologyTable+690:
db 'GRENSPEED2'
cGcTechnologyTable+6A0:
db 'GRENRAD1'
cGcTechnologyTable+6B0:
db 'GRENRAD2'
cGcTechnologyTable+6C0:
db 'GRENDMG1'
cGcTechnologyTable+6D0:
db 'GRENDMG2'
cGcTechnologyTable+6E0:
db 'GRENDMG3'
cGcTechnologyTable+6F0:
db 'SCANBINOC1'
cGcTechnologyTable+700:
db 'SCAN1'
cGcTechnologyTable+710:
db 'SCAN2'
cGcTechnologyTable+720:
db 'SCAN3'
cGcTechnologyTable+730:
db 'BOLT_SM'
cGcTechnologyTable+740:
db 'POWERGLOVE'
cGcTechnologyTable+750:
db 'SHIPPLASMA'
cGcTechnologyTable+760:
db 'SHIPMINIGUN'
cGcTechnologyTable+770:
db 'SHIPSHOTGUN'
cGcTechnologyTable+780:
db 'STRONGLASER'
cGcTechnologyTable+790:
db 'SHIPSGUNDMG1'
cGcTechnologyTable+7A0:
db 'SHIPSGUNDMG2'
cGcTechnologyTable+7B0:
db 'SHIPSGUNDMG3'
cGcTechnologyTable+7C0:
db 'SHIPSGUNCOOL1'
cGcTechnologyTable+7D0:
db 'SHIPSGUNCOOL2'
cGcTechnologyTable+7E0:
db 'SHIPSGUNCOOL3'
cGcTechnologyTable+7F0:
db 'SHIPSGUNRATE1'
cGcTechnologyTable+800:
db 'SHIPSGUNRATE2'
cGcTechnologyTable+810:
db 'SHIPSGUNRATE3'
cGcTechnologyTable+820:
db 'SHIPBLOBDMG1'
cGcTechnologyTable+830:
db 'SHIPBLOBDMG2'
cGcTechnologyTable+840:
db 'SHIPBLOBDMG3'
cGcTechnologyTable+850:
db 'SHIPBLOBRATE1'
cGcTechnologyTable+860:
db 'SHIPBLOBRATE2'
cGcTechnologyTable+870:
db 'SHIPBLOBRATE3'
cGcTechnologyTable+880:
db 'SHIPBLOBCOOL1'
cGcTechnologyTable+890:
db 'SHIPBLOBCOOL2'
cGcTechnologyTable+8A0:
db 'SHIPBLOBCOOL3'
cGcTechnologyTable+8B0:
db 'SHIPMGUNDMG1'
cGcTechnologyTable+8C0:
db 'SHIPMGUNDMG2'
cGcTechnologyTable+8D0:
db 'SHIPMGUNDMG3'
cGcTechnologyTable+8E0:
db 'SHIPMGUNRATE1'
cGcTechnologyTable+8F0:
db 'SHIPMGUNRATE2'
cGcTechnologyTable+900:
db 'SHIPMGUNRATE3'
cGcTechnologyTable+910:
db 'SHIPMGUNCOOL1'
cGcTechnologyTable+920:
db 'SHIPMGUNCOOL2'
cGcTechnologyTable+930:
db 'SHIPMGUNCOOL3'
cGcTechnologyTable+940:
db 'VEHICLE_ENGINE'
cGcTechnologyTable+950:
db 'VEHICLE_SCAN'
cGcTechnologyTable+960:
db 'VEHICLE_SCAN1'
cGcTechnologyTable+970:
db 'VEHICLE_SCAN2'
cGcTechnologyTable+980:
db 'VEHICLE_LASER'
cGcTechnologyTable+990:
db 'VEHICLE_LASER1'
cGcTechnologyTable+9A0:
db 'VEHICLE_LASER2'
cGcTechnologyTable+9B0:
db 'VEHICLE_LASER3'
cGcTechnologyTable+9C0:
db 'VEHICLE_GUN'
cGcTechnologyTable+9D0:
db 'VEHICLE_GUN1'
cGcTechnologyTable+9E0:
db 'VEHICLE_BOOST'
cGcTechnologyTable+9F0:
db 'VEHICLE_BOOST1'
cGcTechnologyTable+A00:
db 'VEHICLE_BOOST2'
cGcTechnologyTable+A10:
db 'VEHICLE_BOOST3'
cGcTechnologyTable+A20:
cGcTechnologyTable_end:
[DISABLE]
technology:
db 49 8B 9E 38 2F 00 00
unregistersymbol(technology)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "NMS.exe"+4FCFC5
"NMS.exe"+4FCF8E: 4C 8D 44 24 60 - lea r8,[rsp+60]
"NMS.exe"+4FCF93: 49 8B CC - mov rcx,r12
"NMS.exe"+4FCF96: 83 FF 01 - cmp edi,01
"NMS.exe"+4FCF99: 0F 85 43 02 00 00 - jne NMS.exe+4FD1E2
"NMS.exe"+4FCF9F: 0F 28 05 4A B6 05 01 - movaps xmm0,[NMS.exe+15585F0]
"NMS.exe"+4FCFA6: 0F 29 44 24 60 - movaps [rsp+60],xmm0
"NMS.exe"+4FCFAB: 48 8D 15 56 17 E3 00 - lea rdx,[NMS.exe+132E708]
"NMS.exe"+4FCFB2: E8 E9 04 F6 FF - call NMS.exe+45D4A0
"NMS.exe"+4FCFB7: 4C 8B 2D 1A 98 11 01 - mov r13,[NMS.exe+16167D8]
"NMS.exe"+4FCFBE: 49 8B BD B0 09 00 00 - mov rdi,[r13+000009B0]
// ---------- INJECTING HERE ----------
"NMS.exe"+4FCFC5: 49 8B 9D A8 09 00 00 - mov rbx,[r13+000009A8]
// ---------- DONE INJECTING ----------
"NMS.exe"+4FCFCC: 48 3B DF - cmp rbx,rdi
"NMS.exe"+4FCFCF: 0F 84 1B 03 00 00 - je NMS.exe+4FD2F0
"NMS.exe"+4FCFD5: 33 F6 - xor esi,esi
"NMS.exe"+4FCFD7: 44 8D 66 01 - lea r12d,[rsi+01]
"NMS.exe"+4FCFDB: 0F 1F 44 00 00 - nop [rax+rax+00]
"NMS.exe"+4FCFE0: 4C 8B C3 - mov r8,rbx
"NMS.exe"+4FCFE3: 48 8D 55 A0 - lea rdx,[rbp-60]
"NMS.exe"+4FCFE7: 49 8D 8D D0 00 00 00 - lea rcx,[r13+000000D0]
"NMS.exe"+4FCFEE: E8 0D C6 02 00 - call NMS.exe+529600
"NMS.exe"+4FCFF3: 48 8B 45 A0 - mov rax,[rbp-60]
}
[ENABLE]
aobscanmodule(products,NMS.exe,49 8B 9E 50 2F 00 00)
alloc(newmem,$1000,products)
alloc(cGcProductTable,1024,products)
label(cGcProductTable_end)
registersymbol(cGcProductTable)
registersymbol(cGcProductTable_end)
label(code)
label(return)
newmem:
code:
mov rbx,cGcProductTable
mov rdi,cGcProductTable_end
jmp return
products:
jmp code
nop
nop
return:
registersymbol(products)
cGcProductTable+000:
db 'ACCESS1'
cGcProductTable+010:
db 'ACCESS2'
cGcProductTable+020:
db 'ACCESS3'
cGcProductTable+030:
db 'ALBUMENPEARL'
cGcProductTable+040:
db 'ALLOY1'
cGcProductTable+050:
db 'ALLOY2'
cGcProductTable+060:
db 'ALLOY3'
cGcProductTable+070:
db 'ALLOY4'
cGcProductTable+080:
db 'ALLOY5'
cGcProductTable+090:
db 'ALLOY6'
cGcProductTable+0A0:
db 'ALLOY7'
cGcProductTable+0B0:
db 'AQUASPHERE'
cGcProductTable+0C0:
db 'CAVECUBE'
cGcProductTable+0D0:
db 'COMMODITY1'
cGcProductTable+0E0:
db 'COMMODITY2'
cGcProductTable+0F0:
db 'COMMODITY3'
cGcProductTable+100:
db 'COMMODITY4'
cGcProductTable+110:
db 'COMMODITY5'
cGcProductTable+120:
db 'COMMODITY6'
cGcProductTable+130:
db 'COMMODITY7'
cGcProductTable+140:
db 'CURIO1'
cGcProductTable+150:
db 'CURIO2'
cGcProductTable+160:
db 'CURIO3'
cGcProductTable+170:
db 'CURIO4'
cGcProductTable+180:
db 'CURIO5'
cGcProductTable+190:
db 'CURIO6'
cGcProductTable+1A0:
db 'CURIO7'
cGcProductTable+1B0:
db 'CURIO8'
cGcProductTable+1C0:
db 'CURIO9'
cGcProductTable+1D0:
db 'DRUGS1'
cGcProductTable+1E0:
db 'GRAVBALL'
cGcProductTable+1F0:
db 'GRENFUEL1'
cGcProductTable+200:
db 'HACK1'
cGcProductTable+210:
db 'HYPERFUEL1'
cGcProductTable+220:
db 'PRODFUEL1'
cGcProductTable+230:
db 'PRODFUEL2'
cGcProductTable+240:
db 'PRODFUEL3'
cGcProductTable+250:
db 'SACVENOM'
cGcProductTable+260:
db 'SENTINEL1'
cGcProductTable+270:
db 'SENTINEL2'
cGcProductTable+280:
db 'SHIELDFUEL1'
cGcProductTable+290:
db 'SHIELDFUEL2'
cGcProductTable+2A0:
db 'SHIELDFUEL3'
cGcProductTable+2B0:
db 'COM1'
cGcProductTable+2C0:
db 'COMRARE1'
cGcProductTable+2D0:
db 'COMUNCOMMON1'
cGcProductTable+2E0:
db 'FUEL1'
cGcProductTable+2F0:
db 'FUELRARE1'
cGcProductTable+300:
db 'FUELUNCOMMON1'
cGcProductTable+310:
db 'TECH1'
cGcProductTable+320:
db 'TECHRARE1'
cGcProductTable+330:
db 'TECHUNCOMMON1'
cGcProductTable+340:
db 'TRADEABLE1'
cGcProductTable+350:
db 'TRADEABLE2'
cGcProductTable+360:
db 'TRADEABLE3'
cGcProductTable+370:
db 'TRADEABLE4'
cGcProductTable+380:
db 'TRADEABLE5'
cGcProductTable+390:
db 'TRADEABLE6'
cGcProductTable+3A0:
db 'TRADEABLE7'
cGcProductTable+3B0:
db 'TRADEABLE8'
cGcProductTable+3C0:
db 'TRADEABLE9'
cGcProductTable+3D0:
db 'TRADEABLE10'
cGcProductTable+3E0:
db 'BATTERY'
cGcProductTable+3F0:
db 'CWIRE'
cGcProductTable+400:
db 'MPLATE'
cGcProductTable+410:
db 'GLASS'
cGcProductTable+420:
db 'SFIBRES'
cGcProductTable+430:
db 'ACID'
cGcProductTable+440:
db 'GEL'
cGcProductTable+450:
db 'LUBE'
cGcProductTable+460:
db 'EXPLOSIVE'
cGcProductTable+470:
db 'CBOARD'
cGcProductTable+480:
db 'BIOROOM'
cGcProductTable+490:
cGcProductTable_end:
[DISABLE]
products:
db 49 8B 9E 50 2F 00 00
unregistersymbol(products)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "NMS.exe"+4FD208
"NMS.exe"+4FD1D0: 48 83 C3 10 - add rbx,10
"NMS.exe"+4FD1D4: 48 3B DF - cmp rbx,rdi
"NMS.exe"+4FD1D7: 0F 85 03 FE FF FF - jne NMS.exe+4FCFE0
"NMS.exe"+4FD1DD: E9 01 01 00 00 - jmp NMS.exe+4FD2E3
"NMS.exe"+4FD1E2: 0F 28 05 F7 B4 05 01 - movaps xmm0,[NMS.exe+15586E0]
"NMS.exe"+4FD1E9: 0F 29 44 24 60 - movaps [rsp+60],xmm0
"NMS.exe"+4FD1EE: 48 8D 15 53 15 E3 00 - lea rdx,[NMS.exe+132E748]
"NMS.exe"+4FD1F5: E8 A6 02 F6 FF - call NMS.exe+45D4A0
"NMS.exe"+4FD1FA: 4C 8B 2D D7 95 11 01 - mov r13,[NMS.exe+16167D8]
"NMS.exe"+4FD201: 49 8B BD C8 09 00 00 - mov rdi,[r13+000009C8]
// ---------- INJECTING HERE ----------
"NMS.exe"+4FD208: 49 8B 9D C0 09 00 00 - mov rbx,[r13+000009C0]
// ---------- DONE INJECTING ----------
"NMS.exe"+4FD20F: 48 3B DF - cmp rbx,rdi
"NMS.exe"+4FD212: 0F 84 D8 00 00 00 - je NMS.exe+4FD2F0
"NMS.exe"+4FD218: BE 02 00 00 00 - mov esi,00000002
"NMS.exe"+4FD21D: 45 33 E4 - xor r12d,r12d
"NMS.exe"+4FD220: 4C 8B C3 - mov r8,rbx
"NMS.exe"+4FD223: 48 8D 55 A0 - lea rdx,[rbp-60]
"NMS.exe"+4FD227: 49 8D 8D 10 01 00 00 - lea rcx,[r13+00000110]
"NMS.exe"+4FD22E: E8 CD C3 02 00 - call NMS.exe+529600
"NMS.exe"+4FD233: 48 8B 45 A0 - mov rax,[rbp-60]
"NMS.exe"+4FD237: 49 3B 85 10 01 00 00 - cmp rax,[r13+00000110]
}