Alright, i wiped up a program to search from 640000 to 64FFFF to find the mob deque... no luck yet.
Has the formula for the size of the DequeEx changed?
PHP Code:
#include <windows.h>
#include <Tlhelp32.h>
#include <stdint.h>
#include <iostream>
#include <iomanip>
#include <string>
#include <conio.h>
using namespace std;
uint32_t const START_ADDR = 0x640000;
uint32_t const END_ADDR = 0x64FFFF;
int main()
{
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(PROCESSENTRY32);
HANDLE hTool32 = CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0);
if (!Process32First(hTool32, &pe32)) {
cerr << "ERROR: Failed to retrieve first running process info." << endl;
return 1;
}
bool conquerFound = false;
do {
if (strcmp(pe32.szExeFile, "Conquer.exe") == 0) {
conquerFound = true;
break;
}
} while (Process32Next(hTool32, &pe32));
if (!conquerFound) {
cerr << "ERROR: Could not find running process of Conquer.exe." << endl;
return 1;
}
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
bool foundDequeEx = false;
uint32_t addr;
for (addr = START_ADDR; addr < END_ADDR; ++addr) {
// From the genius that is high6 ^_^
// unsafe public int GetSize()
// {
// byte[] data = ReadBytes(Handle, Address, 0x20);
//
// fixed (byte* b = data)
// {
// return (((*(int*)(b + 0x1C) - *(int*)(b + 0xC) >> 2) << 5) +
// (*(int*)(b + 0x10) - *(int*)(b + 0x14) >> 2)) +
// (*(int*)(b + 0x8) - *(int*)(b + 0x0) >> 2) - 0x20;
// }
// }
char b[0x20];
ReadProcessMemory(hProcess, (void*)addr, b, 0x20, NULL);
uint32_t size = (((*(int*)(b + 0x1C) - *(int*)(b + 0xC) >> 2) << 5) +
(*(int*)(b + 0x10) - *(int*)(b + 0x14) >> 2)) +
(*(int*)(b + 0x8) - *(int*)(b + 0x0) >> 2) - 0x20;
//if (size < 100) {
if (size < 20) {
foundDequeEx = true;
cout << "DequeEx might be located at " << uppercase << hex << addr << "." << endl;
getch();
// Just test it first.
cout << "TESTING" << endl;
while (!kbhit()) {
char b[0x20];
ReadProcessMemory(hProcess, (void*)addr, b, 0x20, NULL);
uint32_t size = (((*(int*)(b + 0x1C) - *(int*)(b + 0xC) >> 2) << 5) +
(*(int*)(b + 0x10) - *(int*)(b + 0x14) >> 2)) +
(*(int*)(b + 0x8) - *(int*)(b + 0x0) >> 2) - 0x20;
cout << "Number of mobs on screen is " << dec << size << "." << endl;
Sleep(1000);
}
if (getch() == 'n') {
continue;
} else {
break;
}
}
}
if (!foundDequeEx) {
cerr << "ERROR: Could not find DequeEx." << endl;
CloseHandle(hProcess);
return 1;
}
// Test it until keypress.
cout << "DequeEx might be located at " << uppercase << hex << addr << "." << endl;
cout << "Final test run." << endl;
while (!kbhit()) {
char b[0x20];
ReadProcessMemory(hProcess, (void*)addr, b, 0x20, NULL);
uint32_t size = (((*(int*)(b + 0x1C) - *(int*)(b + 0xC) >> 2) << 5) +
(*(int*)(b + 0x10) - *(int*)(b + 0x14) >> 2)) +
(*(int*)(b + 0x8) - *(int*)(b + 0x0) >> 2) - 0x20;
cout << "Number of mobs on screen is " << dec << size << "." << endl;
Sleep(1000);
}
getch();
CloseHandle(hProcess);
return 0;
}
EDIT: WOOT FOUND IT!!! xD @ 6502D4.... i swear that works for me :D
EDIT: Hang on, thats reporting twice as many mobs (exactly x 2)... i know im close atleast. xD
No, the moblist is at like 0x64XXXX. It is around "ClientInfo".