Quote:
Originally Posted by pro4never
It's doubled and also it changes every time you log iirc.
There was some information posted on tracking it down but I haven't done any memory reading/editing so I wouldn't know.
All I remember is that based on a certain calculation the offset changes and the value it holds is also doubled. (so 100 hp = 200 value)
|
Okay, thanks, but for me this is to less to work with. I'm using C++ btw.
EDIT: The spoiler contains raw asm I found with CE and olly. (There are 2, this in only ONE)
Code:
¯
.text:006DC357
.text:006DC357 ; =============== S U B R O U T I N E =======================================
.text:006DC357
.text:006DC357
.text:006DC357 sub_6DC357 proc near ; CODE XREF: sub_624324+51p
.text:006DC357
.text:006DC357 arg_0 = dword ptr 4
.text:006DC357 arg_4 = dword ptr 8
.text:006DC357
.text:006DC357 push ebx
.text:006DC358 push esi
.text:006DC359 push edi
.text:006DC35A mov esi, ecx
.text:006DC35C push [esp+0Ch+arg_4]
.text:006DC360 call sub_6DC56F
.text:006DC365 mov edi, eax
.text:006DC367 mov ebx, offset aBqSSBqInSD ; "í´%s(%s)í´ in %s, %d"
.text:006DC36C test edi, edi
.text:006DC36E jge short loc_6DC38F
.text:006DC370 cmp edi, [esi+8]
.text:006DC373 jl short loc_6DC38F
.text:006DC375 push 7Ch
.text:006DC377 push offset asc_8A95C4 ; "F:\\CQ2ClientRelease-33.0.4\\3DRole\\FDwor"...
.text:006DC37C push offset aFalse_0 ; "false"
.text:006DC381 push offset aAssert ; "ASSERT"
.text:006DC386 push ebx ; Format
.text:006DC387 call sub_6F91DD
.text:006DC38C add esp, 14h
.text:006DC38F
.text:006DC38F loc_6DC38F: ; CODE XREF: sub_6DC357+17j
.text:006DC38F ; sub_6DC357+1Cj
[COLOR="Red"].text:006DC38F mov eax, [esi+0Ch] ; health[/COLOR]
.text:006DC392 test eax, eax
.text:006DC394 jnz short loc_6DC3B2
.text:006DC396 push 1Ch
.text:006DC398 push offset asc_8A95C4 ; "F:\\CQ2ClientRelease-33.0.4\\3DRole\\FDwor"...
.text:006DC39D push offset aM_pdata ; "m_pData"
.text:006DC3A2 push offset aCheck ; "CHECK"
.text:006DC3A7 push ebx ; Format
.text:006DC3A8 call sub_6F91DD
.text:006DC3AD add esp, 14h
.text:006DC3B0 jmp short loc_6DC3C4
.text:006DC3B2 ; ---------------------------------------------------------------------------
.text:006DC3B2
.text:006DC3B2 loc_6DC3B2: ; CODE XREF: sub_6DC357+3Dj
.text:006DC3B2 mov ecx, [esp+0Ch+arg_0]
.text:006DC3B6 lea eax, [eax+edi*4]
.text:006DC3B9 push edi ; Shift
.text:006DC3BA push eax ; int
.text:006DC3BB mov [eax], ecx
.text:006DC3BD mov ecx, esi
[COLOR="Lime"].text:006DC3BF call sub_6DC5D4 ; <--[/COLOR]
.text:006DC3C4
.text:006DC3C4 loc_6DC3C4: ; CODE XREF: sub_6DC357+59j
.text:006DC3C4 pop edi
.text:006DC3C5 pop esi
.text:006DC3C6 pop ebx
.text:006DC3C7 retn 8
.text:006DC3C7 sub_6DC357 endp
.text:006DC3C7
Green point;'
Code:
.text:006DC5D4 ; =============== S U B R O U T I N E =======================================
.text:006DC5D4
.text:006DC5D4 ; Attributes: bp-based frame
.text:006DC5D4
.text:006DC5D4 ; int __stdcall sub_6DC5D4(int, int Shift)
.text:006DC5D4 sub_6DC5D4 proc near ; CODE XREF: sub_6DC357+68p
.text:006DC5D4
.text:006DC5D4 arg_0 = dword ptr 8
.text:006DC5D4 Shift = dword ptr 0Ch
.text:006DC5D4
.text:006DC5D4 push ebp
.text:006DC5D5 mov ebp, esp
.text:006DC5D7 mov eax, [ecx+4]
.text:006DC5DA push esi
.text:006DC5DB mov esi, [ebp+arg_0]
.text:006DC5DE sub eax, 0
.text:006DC5E1 mov edx, [esi]
.text:006DC5E3 jz short loc_6DC5F9
.text:006DC5E5 dec eax
.text:006DC5E6 jz short loc_6DC5EE
.text:006DC5E8 dec eax
.text:006DC5E9 jz short loc_6DC5F9
.text:006DC5EB dec eax
.text:006DC5EC jnz short loc_6DC606
.text:006DC5EE
.text:006DC5EE loc_6DC5EE: ; CODE XREF: sub_6DC5D4+12j
.text:006DC5EE push [ebp+Shift] ; Shift
.text:006DC5F1 push edx ; Value
.text:006DC5F2 call _rotr
.text:006DC5F7 jmp short loc_6DC602
.text:006DC5F9 ; ---------------------------------------------------------------------------
.text:006DC5F9
.text:006DC5F9 loc_6DC5F9: ; CODE XREF: sub_6DC5D4+Fj
.text:006DC5F9 ; sub_6DC5D4+15j
.text:006DC5F9 push [ebp+Shift] ; Shift
.text:006DC5FC push edx ; Value
.text:006DC5FD call _rotl
.text:006DC602
.text:006DC602 loc_6DC602: ; CODE XREF: sub_6DC5D4+23j
.text:006DC602 pop ecx
[COLOR="Red"].text:006DC603 mov [esi], eax ; health[/COLOR]
.text:006DC605 pop ecx
.text:006DC606
.text:006DC606 loc_6DC606: ; CODE XREF: sub_6DC5D4+18j
.text:006DC606 pop esi
.text:006DC607 pop ebp
.text:006DC608 retn 8
.text:006DC608 sub_6DC5D4 endp
.text:006DC608
.text:006DC60B
Okay, I fixed it doesn;'t crash, but doesn't load the value either. I searched for the right way (CE) now;'
Code:
//#define adr_healthp 0x4AD78B // 4AD622
#define adr_healthp 0x4AD622
#define ofs_healthp 0x4
#define ofs_healthp2 0x8
I'm using it like;
Code:
if (CH_Health ==1)
{
DWORD userhealth = adr_healthp + (ofs_healthp*ofs_healthp2);
sprintf(userh, "%d", (void*)userhealth);
}
