Reading HP

NOTE* Addresses change at almost every update on the Conquer.exe, These addresses might not work on the new patch. This code is written for 5068 patch.

I know some people have had trouble reading HP from Conquers memory so, here's a little "tutorial" how to save the real hp value to a static location. I'm not going much to depth how I found the places I'm using in this tutorial.

First of all, you need a OllyDBG. (Well that's what this tutorial is written for) Next thing we do is, open Conquer in OllyDBG and let it analyze the code. Now we need to find a place where the Conquer processes the current hp value. You don't have to worry about this, I've already got it for you. :P

In that piece of ASM the EDX contains current hp. (It's updated or accessed all the time) Next thing we need to do is find a place that has about 20 free bytes. Usually this is at the end of the .exe file. We also need two bytes free somewhere in Conquer.exe so we can save the HP value there for easier access.

Anyways, I found the 20 bytes free at end of the exe so -> (Ctrl + G) -> 5302D1; That is the address where we shall start re-generating the old code that is going to be replaced in the original place. So next thing we need to do is to replace the code that is going to get overwritten by our jmp to this codecave.


What this code does is that, it saves the value of EDX to a static location (569070, hex). So now we can later on read the hp value from that address.

So what we need to do now? We need to make the original code to jump to this our little piece of code :P Lets go back to the codeblock :

Remember what code we did manually ? That's right we did these :
So now we need to replace the With the JMP to our codecave. So now the code should look like this :

So now the original code :
Should look like this :


If you did everything correctly you can now read the HP from address 569070h and the Conquer shouldn't crash.


If you have any comments or questions. Please ask.

Nicely done, couldnt have put it down better.

A little off topic, Think this would work with reading a monster name instead,
as the addresses for those keep changing as well, think it would be possible to put them into a static location wich u then can use with the ReadProcessMemory :o :o

(I'm asking this for something I'm working on myself at the moment, too slow to go thru all addresses to find a match ;), eitherway I'll look into it, tho I like to hear your thoughts about it )

If you find a place that updates the "Base address" for monsters, then it's possible. I haven't really looked (asm side of this) how the "base address" for monsters change. (I did work on similar thing before, however I had limited knowledge back then, less than now atleast.)

I can try to look on this :D

Quote:

Originally Posted by tanelipe If you find a place that updates the "Base address" for monsters, then it's possible. I haven't really looked (asm side of this) how the "base address" for monsters change. (I did work on similar thing before, however I had limited knowledge back then, less than now atleast.) I can try to look on this :D

Yes, monsters have a nice static address and offsets and everything xD
HP value can be find in easier way too:)
The MP value can't be found. Try to check that tanelipe (im searching for it for a few months but i found nothing related to it) :)

Quote:

Originally Posted by tanelipe If you find a place that updates the "Base address" for monsters, then it's possible. I haven't really looked (asm side of this) how the "base address" for monsters change. (I did work on similar thing before, however I had limited knowledge back then, less than now atleast.) I can try to look on this :D

If you could look into it that would be really appreciated ;):o
When I can find this out all thats needed is if a match is found call the attack function,
Then a nice pretty bot can be made in asm :o

Haven't had any luck so far atleast, I'll probably try it again over this weekend. :)

Quote:

Originally Posted by _fobos_ If you could look into it that would be really appreciated ;):o When I can find this out all thats needed is if a match is found call the attack function, Then a nice pretty bot can be made in asm :o

You'd also need to be able to have it figure out when the monster is dead (probably by checking hp and hwen it's dead (or probably at 1 since if it's at 0 there would be no monster lol)) and have the attack function disabled until the monster is dead so it won't just keep sending it to everything it reads. After doing that you'd probably be in pretty good shape. :p

Hey tane, have you attempted this for the new conquer.exe with 5089 still running with 5090. Ive tried it a few times and a few different methods. Seems to either crash or freeze the exe.