---
# System prepended metadata

title: Assembly-Language-Beast
tags: [solved]

---

# Assembly-Language-Beast

there is [source code](https://github.com/terrynini/Assembly-Language-Beast.git) for this challenge  

the main difference is in `C_Monster_Generate` and `Monsters_TickTock`  
the assigned Monster ID in `C_Monster_Generate` were xored with 0x55  
```cpp=
(&Monster_array_ID_e1be)[(Monster_count_4af2 ^ 0x55) * 0x44] = Monster_count_4af2;
Monster_count_4af2 = (Monster_count_4af2 ^ 0x55) + 1 ^ 0x55;
```
and in `Monsters_TickTock` after monster died it calls a function  
then its ID is xor with flag
```cpp=
last_mon = (Monster_count_4af2 ^ 0x55) - 1;
Monster_count_4af2 = last_mon ^ 0x55;
if ((int)(Player_Main_Health_Max_dddc ^ 0x55) / 2 < 
(int)(Player_Main_Health_Now_dde0 ^ 0x55))
{
Player_Main_Health_Now_dde0 = Player_Main_Health_Max_dddc;
}
else {
Player_Main_Health_Now_dde0 =
     (int)(Player_Main_Health_Max_dddc ^ 0x55) / 2 + 
     (Player_Main_Health_Now_dde0 ^ 0x55) ^
     0x55;
}
iVar1 = (int)((&Monster_array_ID_e1be)[last_mon * 0x44] ^ 0x819f) % 0x32;
(&flag_5270)[iVar1] = (byte)(&Monster_array_ID_e1be)[last_mon * 0x44] ^ 
(&flag_5270)[iVar1];
```
then it renders the flag if all monster dies  
```cpp=
if (Monster_count_4af2 != 0x55) {
return;
}
render_flag?_4824();
SetState_17ce(4);
```

simply patch the binary in `C_Monster_Generate`  
where sets Health_Now of monster  
```cpp=
(&Monster_array_Health_Now_e1a2)[(Monster_count_4af2 ^ 0x55) * 0x44] =
         (&Monster_array_Health_Max_e19e)[(Monster_count_4af2 ^ 0x55) * 0x44];
```
patch the `mov at 0x3a1f` to `xor eax, eax` so the monster's health is zero  

![](https://i.imgur.com/DCFn13X.png)

run the patched game and gets the flag  

![](https://i.imgur.com/vm5TLDf.png)



###### tags: `solved`