Finding MobAdress From MobID (C#)

tarafından **Hello EMO** Paz Nis. 24, 2011 6:56 am

[quote name='new124tan' timestamp='1296581002' post='1098']
here is the C# and asm code,if you want to learn mob's attributes you need to add function return to theese offsets:

For mobx 0xF0
moby 0xF8
mobZ 0xD8
Hp 0x5E4
maxHp 0x5E0

and this is assembly code :

Kod:: 01360024 60 PUSHAD 01360025 8B35 78003601 MOV ESI,DWORD PTR DS:[1360078] 0136002B 8B3D 246CC200 MOV EDI,DWORD PTR DS:[C26C24] 01360031 6A 01 PUSH 1 01360033 56 PUSH ESI 01360034 8BCF MOV ECX,EDI 01360036 BF C0944900 MOV EDI,4994C0 0136003B FFD7 CALL EDI 0136003D 890D 82003601 MOV DWORD PTR DS:[1360082],ECX 01360043 61 POPAD 01360044 C3 RET

This is the C# code

Kod:: public int mobAdresbul(IntPtr ProcessHandle, int mobID,IntPtr KO_FLDB,IntPtr KO_FMSM) { int fonksiyonSonucu ; Byte[] sonucByteDizi = new Byte[4]; IntPtr fonksiyonSonucuAdres = VirtualAllocEx(ProcessHandle, IntPtr.Zero, 1024, MEM_COMMIT, PAGE_READWRITE); IntPtr mobIdAdres = VirtualAllocEx(ProcessHandle, IntPtr.Zero, 1024, MEM_COMMIT, PAGE_READWRITE); WriteMemory(ProcessHandle, mobIdAdres, mobID); string pStr = "608B35" + AlignDWORD(mobIdAdres) + "8B3D" + AlignDWORD(KO_FLDB) + "6A01568BCFBF" + AlignDWORD(KO_FMSM) + "FFD7890D" + AlignDWORD(fonksiyonSonucuAdres) + "61C3"; Byte[] pBytes = ConvHEX2ByteArray(pStr); ExecuteRemoteCode(pBytes, ProcessHandle); ReadProcessMemory(ProcessHandle,fonksiyonSonucuAdres,sonucByteDizi,4,0); fonksiyonSonucu = BitConverter.ToInt32(sonucByteDizi, 0); VirtualFreeEx(ProcessHandle, mobIdAdres, 0, MEM_RELEASE); VirtualFreeEx(ProcessHandle, fonksiyonSonucuAdres, 0, MEM_RELEASE); return fonksiyonSonucu; }

Best Regards,
[/quote]

alınıtı