The code works partially.
I found the monster life code, trying to search in 8Bytes and doing Changed/Unchanged Valuse (with Decreased/Unchanged values it doesn't work, for some reason -.-)
This is the information to access from the Memory View:
array:
41 89 4B 18 83 E1 03 41
INJECTION POINT:
MonsterHunterRise.exe+3B5C67C
This is my code:
Spoiler
Code: Select all
[ENABLE]
aobscanmodule(MonHpC,MonsterHunterRise.exe,41 89 4B 18 83 E1 03 41) // should be unique
alloc(newmem,$1000,MonHpC)
label(code)
label(return seeMonHp)
registersymbol(seeMonHp)
newmem:
{
R15=0000000000000000
}
cmp r15,0000000000000000
jne code
mov [seeMonHp],r11
sub eax,C350
mov [r11+18],0
mov [r11+18],ecx
code:
mov [r11+18],ecx
and ecx,03
jmp return
seeMonHp:
dq 0
MonHpC:
jmp newmem
nop 2
return:
registersymbol(MonHpC)
[DISABLE]
MonHpC:
db 41 89 4B 18 83 E1 03
unregistersymbol(*)
dealloc(*)
{
// ORIGINAL CODE - INJECTION POINT: MonsterHunterRise.exe+3B5C67C
MonsterHunterRise.exe+3B5C658: 48 0F AF CA - imul rcx,rdx
MonsterHunterRise.exe+3B5C65C: 48 33 C8 - xor rcx,rax
MonsterHunterRise.exe+3B5C65F: 0F B6 45 1A - movzx eax,byte ptr [rbp+1A]
MonsterHunterRise.exe+3B5C663: 48 0F AF CA - imul rcx,rdx
MonsterHunterRise.exe+3B5C667: 48 33 C8 - xor rcx,rax
MonsterHunterRise.exe+3B5C66A: 0F B6 45 1B - movzx eax,byte ptr [rbp+1B]
MonsterHunterRise.exe+3B5C66E: 48 0F AF CA - imul rcx,rdx
MonsterHunterRise.exe+3B5C672: 48 33 C8 - xor rcx,rax
MonsterHunterRise.exe+3B5C675: 8B 45 10 - mov eax,[rbp+10]
MonsterHunterRise.exe+3B5C678: 48 0F AF CA - imul rcx,rdx
// ---------- INJECTING HERE ----------
MonsterHunterRise.exe+3B5C67C: 41 89 4B 18 - mov [r11+18],ecx
// ---------- DONE INJECTING ----------
MonsterHunterRise.exe+3B5C680: 83 E1 03 - and ecx,03
MonsterHunterRise.exe+3B5C683: 41 89 44 8B 1C - mov [r11+rcx*4+1C],eax
MonsterHunterRise.exe+3B5C688: 5D - pop rbp
MonsterHunterRise.exe+3B5C689: C3 - ret
MonsterHunterRise.exe+3B5C68A: 41 83 F8 0A - cmp r8d,0A
MonsterHunterRise.exe+3B5C68E: 0F 85 64 01 00 00 - jne MonsterHunterRise.exe+3B5C7F8
MonsterHunterRise.exe+3B5C694: 49 8B 01 - mov rax,[r9]
MonsterHunterRise.exe+3B5C697: 48 63 48 F8 - movsxd rcx,dword ptr [rax-08]
MonsterHunterRise.exe+3B5C69B: 4A 8B 04 09 - mov rax,[rcx+r9]
MonsterHunterRise.exe+3B5C69F: 48 89 45 18 - mov [rbp+18],rax
}
Code: Select all
code:
mov [r11+18],ecx
and ecx,03
jmp return
Code: Select all
code:
mov [r11+18],ecx
jmp return
I found these instructions
Spoiler
[Link]
I definitely have to edit the part where there is AND
but I do not know how I can do it. Can someone help me?
Thank you