pox911 wrote: ↑Thu Jan 30, 2020 5:24 pm
guess i should have checked my room that they were added. I'll have to double check if the area of code accessing the data is accessed by another function as well
Hi pox911, thank you for your attempt on endemic pets. Below is the code written by Seikur0 in his table (unfortunately, it's not working due to the outdated offsets). However, it might be helpful for you to understand his approach on "Catch specific pet".
From what I understand, Seikur0 did it by intercepting the capture net, and change the pet caught with the user specified ID (as seen in the functions "finish_found" and finish_notfound").
Code: Select all
{ Game : MonsterHunterWorld.exe
Version:
Date : 2018-08-24
Author : SeiKur0
}
[ENABLE]
aobscanmodule(inj_catchpet,MonsterHunterWorld.exe,40 88 74 24 50 45 85 FF 75 07 E8)
aobscanmodule(inj_mapfunc_pet,MonsterHunterWorld.exe,45 33 D2 FF C9 45 89 10 83 F9)
alloc(newmem,$1000,"MonsterHunterWorld.exe"+191CD2D)
label(catchid)
registersymbol(catchid)
label(code_normal)
label(return)
newmem:
test r15d,r15d
jne code_normal
cmp dword ptr [catchid],0
je code_normal
push rcx
push rdx
push [r8]
push r9
push r10
xor rdx,rdx
xor rcx,rcx
inc rcx
push rcx //for last result
trynext:
mov [rsp],eax
push rdx
push rcx
call inj_mapfunc_pet
pop rcx
pop rdx
test eax,eax
je next_petgroup
cmp eax,[catchid]
je finish_found
next_pettype:
inc edx
cmp edx,2
jb trynext
cmp eax,[rsp]
jne trynext
next_petgroup:
cmp ecx,29
ja finish_notfound
inc ecx
xor edx,edx
jmp trynext
finish_found:
push rbx
xor rbx,rbx
mov ebx,[offs_petcategory]
add rbx,[rsp]
mov [rbx],ecx
mov [rbx+04],edx
pop rbx
mov [rsp+20],rdx
mov [rsp+28],rcx
finish_notfound:
pop rcx
pop r10
pop r9
pop [r8]
pop rdx
pop rcx
code_normal:
mov [rsp+50],sil
jmp return
catchid:
dd 0
inj_catchpet:
jmp newmem
return:
registersymbol(inj_catchpet)
inj_catchpet+22:
offs_petcategory:
[DISABLE]
inj_catchpet:
db 40 88 74 24 50
unregistersymbol(catchid)
unregistersymbol(inj_catchpet)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "MonsterHunterWorld.exe"+191CD2D
"MonsterHunterWorld.exe"+191CCE9: 0F 1F 80 00 00 00 00 - nop [rax+00000000]
"MonsterHunterWorld.exe"+191CCF0: 8B 93 14 1A 00 00 - mov edx,[rbx+00001A14]
"MonsterHunterWorld.exe"+191CCF6: 4C 8D 85 20 01 00 00 - lea r8,[rbp+00000120]
"MonsterHunterWorld.exe"+191CCFD: 8B 8B 10 1A 00 00 - mov ecx,[rbx+00001A10]
"MonsterHunterWorld.exe"+191CD03: 40 32 F6 - xor sil,sil
"MonsterHunterWorld.exe"+191CD06: 48 C7 44 24 30 00 00 00 00 - mov qword ptr [rsp+30],00000000
"MonsterHunterWorld.exe"+191CD0F: 45 8B F5 - mov r14d,r13d
"MonsterHunterWorld.exe"+191CD12: 48 C7 44 24 38 00 00 00 00 - mov qword ptr [rsp+38],00000000
"MonsterHunterWorld.exe"+191CD1B: 48 C7 44 24 40 00 00 00 00 - mov qword ptr [rsp+40],00000000
"MonsterHunterWorld.exe"+191CD24: 48 C7 44 24 48 00 00 00 00 - mov qword ptr [rsp+48],00000000
// ---------- INJECTING HERE ----------
"MonsterHunterWorld.exe"+191CD2D: 40 88 74 24 50 - mov [rsp+50],sil
// ---------- DONE INJECTING ----------
"MonsterHunterWorld.exe"+191CD32: 45 85 FF - test r15d,r15d
"MonsterHunterWorld.exe"+191CD35: 75 07 - jne MonsterHunterWorld.exe+191CD3E
"MonsterHunterWorld.exe"+191CD37: E8 D4 50 6F FF - call MonsterHunterWorld.exe+1011E10
"MonsterHunterWorld.exe"+191CD3C: EB 05 - jmp MonsterHunterWorld.exe+191CD43
"MonsterHunterWorld.exe"+191CD3E: E8 FD 5C 6F FF - call MonsterHunterWorld.exe+1012A40
"MonsterHunterWorld.exe"+191CD43: 8B F8 - mov edi,eax
"MonsterHunterWorld.exe"+191CD45: 85 C0 - test eax,eax
"MonsterHunterWorld.exe"+191CD47: 0F 84 E9 00 00 00 - je MonsterHunterWorld.exe+191CE36
"MonsterHunterWorld.exe"+191CD4D: 83 BB 10 1A 00 00 20 - cmp dword ptr [rbx+00001A10],20
"MonsterHunterWorld.exe"+191CD54: 75 21 - jne MonsterHunterWorld.exe+191CD77
}