Reading HP

[tanelipe]

NOTE* Addresses change at almost every update on the Conquer.exe, These addresses might not work on the new patch. This code is written for 5068 patch.

I know some people have had trouble reading HP from Conquers memory so, here's a little "tutorial" how to save the real hp value to a static location. I'm not going much to depth how I found the places I'm using in this tutorial.

First of all, you need a OllyDBG. (Well that's what this tutorial is written for) Next thing we do is, open Conquer in OllyDBG and let it analyze the code. Now we need to find a place where the Conquer processes the current hp value. You don't have to worry about this, I've already got it for you. :P

004ECEF1     FF75 0C       PUSH DWORD PTR SS:[EBP+0C]
004ECEF4     52            PUSH EDX
004ECEF5     E8 2EDF0000   CALL <JMP.&MSVCRT._rotl>              
004ECEFA     59            POP ECX
004ECEFB     8906          MOV DWORD PTR DS:[ESI],EAX

In that piece of ASM the EDX contains current hp. (It's updated or accessed all the time) Next thing we need to do is find a place that has about 20 free bytes. Usually this is at the end of the .exe file. We also need two bytes free somewhere in Conquer.exe so we can save the HP value there for easier access.

Anyways, I found the 20 bytes free at end of the exe so -> (Ctrl + G) -> 5302D1; That is the address where we shall start re-generating the old code that is going to be replaced in the original place. So next thing we need to do is to replace the code that is going to get overwritten by our jmp to this codecave.

005302D1      FF75 0C               PUSH DWORD PTR SS:[EBP+0C]
005302D4      8915 70905600         MOV DWORD PTR DS:[569070],EDX
005302DA      52                    PUSH EDX
005302DB      E8 48ABFCFF           CALL <JMP.&MSVCRT._rotl>  ; CALL 004FAE28
005302E0    ^ E9 15CCFBFF           JMP 004ECEFA

What this code does is that, it saves the value of EDX to a static location (569070, hex). So now we can later on read the hp value from that address.

So what we need to do now? We need to make the original code to jump to this our little piece of code :P Lets go back to the codeblock :

004ECEF1     FF75 0C       PUSH DWORD PTR SS:[EBP+0C]
004ECEF4     52            PUSH EDX
004ECEF5     E8 2EDF0000   CALL <JMP.&MSVCRT._rotl>              
004ECEFA     59            POP ECX
004ECEFB     8906          MOV DWORD PTR DS:[ESI],EAX

Remember what code we did manually ? That's right we did these :

004ECEF1     FF75 0C       PUSH DWORD PTR SS:[EBP+0C]
004ECEF4     52            PUSH EDX
004ECEF5     E8 2EDF0000   CALL <JMP.&MSVCRT._rotl>

So now we need to replace the

004ECEF1     FF75 0C       PUSH DWORD PTR SS:[EBP+0C]

With the JMP to our codecave. So now the code should look like this :

004ECEF1     E9 DB330400   JMP 005302D1

So now the original code :

004ECEF1     \FF75 0C       PUSH DWORD PTR SS:[EBP+0C]
004ECEF4      52            PUSH EDX
004ECEF5      E8 2EDF0000   CALL <JMP.&MSVCRT._rotl>                 ; Jump to msvcrt._rotl

Should look like this :

004ECEF1      E9 DB330400   JMP 005302D1
004ECEF6      90            NOP
004ECEF7      90            NOP
004ECEF8      90            NOP
004ECEF9      90            NOP

If you did everything correctly you can now read the HP from address 569070h and the Conquer shouldn't crash.


If you have any comments or questions. Please ask.

[_fobos_]

Nicely done, couldnt have put it down better.

A little off topic, Think this would work with reading a monster name instead,
as the addresses for those keep changing as well, think it would be possible to put them into a static location wich u then can use with the ReadProcessMemory

(I'm asking this for something I'm working on myself at the moment, too slow to go thru all addresses to find a match , eitherway I'll look into it, tho I like to hear your thoughts about it )

[tanelipe]

If you find a place that updates the "Base address" for monsters, then it's possible. I haven't really looked (asm side of this) how the "base address" for monsters change. (I did work on similar thing before, however I had limited knowledge back then, less than now atleast.)

I can try to look on this

[warriorchamp]

Originally Posted by tanelipe

If you find a place that updates the "Base address" for monsters, then it's possible. I haven't really looked (asm side of this) how the "base address" for monsters change. (I did work on similar thing before, however I had limited knowledge back then, less than now atleast.)

I can try to look on this

Yes, monsters have a nice static address and offsets and everything xD
HP value can be find in easier way too
The MP value can't be found. Try to check that tanelipe (im searching for it for a few months but i found nothing related to it)

[_fobos_]

Originally Posted by tanelipe

If you find a place that updates the "Base address" for monsters, then it's possible. I haven't really looked (asm side of this) how the "base address" for monsters change. (I did work on similar thing before, however I had limited knowledge back then, less than now atleast.)

I can try to look on this

If you could look into it that would be really appreciated
When I can find this out all thats needed is if a match is found call the attack function,
Then a nice pretty bot can be made in asm

[tanelipe]

Haven't had any luck so far atleast, I'll probably try it again over this weekend.

[Ian*]

Originally Posted by _fobos_

If you could look into it that would be really appreciated
When I can find this out all thats needed is if a match is found call the attack function,
Then a nice pretty bot can be made in asm

You'd also need to be able to have it figure out when the monster is dead (probably by checking hp and hwen it's dead (or probably at 1 since if it's at 0 there would be no monster lol)) and have the attack function disabled until the monster is dead so it won't just keep sending it to everything it reads. After doing that you'd probably be in pretty good shape.

[leavemealone]

Hey tane, have you attempted this for the new conquer.exe with 5089 still running with 5090. Ive tried it a few times and a few different methods. Seems to either crash or freeze the exe.