First I'm going to start at a location that I've found previously through a memory editor. In your disassembler
go to address 0x00DBE98D (please note this is not the same in your hex editor) There exists things such as Virtual and Physical addresses, think of the disassembler as loading it as it would load into your memory while you are playing it and if you simply hex editted the file it would be the physical address. You can read on this elsewhere we will just use a simple method of finding what we need to edit. So at 0x00DBE98D we see this:
.text:00DBE98D mov byte ptr [esi+74h], 0
.text:00DBE991 jnz short loc_DBE9DB
Essentially it is putting 0 into that memory pointer in the mov statement and the next line says if not zero then jump to that short location. We are going to replace the 0 with a 1. I am simply going to view the Hex View in IDA at this location and copy the bytes that lead up to this statement "4783FF01C64674" now in Hex Workshop I do a search for that byte sequence (it is long enough that I am sure that I won't have that many collisions) and get one result at 0x009BE989 and at the end of this sequence I see my 0 that I wish to turn into a 1. Ok that wasn't that bad. The next problem is that it compares the sequence if it happened once already it won't load it again. So we follow the jnz to the location and see a cmp (compare) statement nearly at the beginning.
.text:00DBE9DE cmp edi, eax
Lets just switch the compare eax, edi. How? We are simply going to switch code sequence 3B F8 with 3B C7. Just use the hex method above and do the swap. Now lets change the beetle to something fun to kill. Follow the jnz that follows the compare. If you view this code segment you should see this:
.text:00DBEA5D push offset aCreature_oakva ; "CREATURE_OAKVALE_STAG_BEETLE"
All this is doing is pushing the creature string onto a stack. All that is really important is that we know that this game CRC's this string and loads the definition from that CRC so if we push the offset to another string it will load that string. We can even add strings to the exe and have it load those. In the hex view I can see that it is loading 989D2D01, see it? If not you can double click the "offset aCreature_oakva" and IDA will take you to the location. Notice the location is .rdata:012D9D98 that is the same thing essentially is that the endianess of the bytes are not the same. 98 9D 2D 01 in a different endian becomes 01 2D 9D 98. Anyhow, time to find something fun to change. I'm going to choose
.rdata:012C7DDC aCreature_minio db 'CREATURE_MINION_DREADWINGS',0
So I want to replace 989D2D01 with DC7D2C01. I hope you see this. Now to finish this off lets change the number that are going to appear. In this same code segment that appears to be exactly what we are looking for.
.text:00DBEAA4 push 40000000h
40000000h is a Big Endian float value that translates to 2. If you do the hex view in IDA it will show 00000040 this is the same value just different Endians! Don't let that distract you. Let's step this up to 500. So we'll replace this value with 0000FA43.
Well that was it time to test in game.
Please note that this minions die in a short period of time just like the beetle did. You will need to find that value if you want them to live ( I don't think you do though
)
Congrats, I attached ppf of modified data from example to verify.