Oh, that should explain why. I thought that the HP and mana values are no longer that direct anymore. It is about 5-7 patches ago( i might remember wrongly), I realized that i got to search for double the HP value to find it's temp address.
So, only HP, mana, arrows addresses are dynamically allocated?
I do not know much about asm, but i know it is nearly as close to machine code and therefore is able to perform a lot of amazing tasks. When you're debugging the client, can you do a direct search for current hp/mana/arrow values and locate their address? In other words, does the "encryptions" you're talking about come into play when you were debugging for the hp/mana/arrow address?