Battle End Reward Review

KO enemy actor → live player EXP fan-out → gold reward and inactive item-drop handler.

EXP 획득 계산

몬스터별 EXP 기준값과 Lv를 EXE stat row에서 자동으로 채운다. Lv는 actual row +0x06, 즉 HP-view -0x02다.

계산 순서

  1. enemyExpBase = 몬스터 EXP 기준값(+0x04)
  2. diff = min(abs(enemyLevel - playerLevel), 10)
  3. enemyLevel < playerLevel 이면 max(enemyExpBase - enemyExpBase * diff * 12 / 100, 1)
  4. enemyLevel >= playerLevel 이면 enemyExpBase + enemyExpBase * diff * diff / 100
  5. EXP 페널티 장비/상태가 있으면 max(result / 2, 1)

핵심 규칙

  • 몬스터별 EXP 기준값은 enemy stat HP-view +0x04에서 온다. 전투 actor에서는 enemy actor +0x14로 materialize된다.
  • 몬스터 레벨은 실제 stat row prefix +0x06에서 온다. HP-view export 기준으로는 -0x02이며, 전투 actor +0x06으로 복사되어 EXP 공식이 소비한다.
  • HP-view +0x36은 다음 실제 row prefix +0x06을 읽는 값이므로 한 행 밀린 다음 몬스터 레벨이다.
  • 레벨 차이는 최대 10까지만 반영된다.
  • 몬스터 레벨이 주인공보다 낮으면 EXP가 감소하고, 그래도 최소 1은 획득한다.
  • 몬스터 레벨이 같거나 높으면 EXP 기준값 이상을 획득한다.
  • 일부 장비/상태 페널티가 걸리면 계산된 EXP를 절반으로 줄이되 최소 1은 유지한다.
획득 EXP
-

예시: 원숭이 EXP 기준값 22, 몬스터 Lv 2

주인공 Lv몬스터 Lv차이획득 EXP
12122
22022
32120
42217
52315
62412
7259
8267
9274
10281
11291
122101

Summary

Flow

stepVAstatusmeaning
defeated actor scan0x0040dfb8확정target range helper(0x433c99/0x433dc0)로 전투 대상 범위를 돌며 actor kind +0x04가 enemy 쪽이고 +0x62 bit 0x40(KO)인 actor만 보상 대상으로 처리한다.
EXP fan-out to live players0x0040e028확정player actor slot 0x4576e8 범위를 돌며 +0x62 bit 0x80 비활성/기절 제외 actor에게만 0x42157b 경험치 공식을 적용하고 player +0x14 current EXP에 더한다.
EXP formula0x0042157b확정player/enemy actor +0x06 level 차이를 최대 10으로 clamp하고, enemy actor +0x14 EXP base를 기준으로 보정한다. enemy actor +0x14는 enemy stat row actual +0x0c byte(HP-view +0x04)에서 온다.
equipment EXP penalty0x00421699확정player/equipment class table 0x457798 == 0x1d 또는 0x457799 in (0x0b, 0x17)이면 EXP를 절반으로 줄이되 1 미만으로 내리지 않는다.
gold reward0x00435736확정defeated actor +0x44 gold를 global money 0x4576e0에 더하고 0x000f423f(999999)로 cap한다.
global money initial value0x004576e0확정PE .data의 0x004576e0 dword 초기값이 200이다. 새 프로세스/처음부터 시작의 기본 소지금 200과 일치하며, 같은 주소가 보상/상점 흐름에서 읽고 쓰인다.
level-up carryover0x0042177f확정레벨업 처리 후 player actor +0x14 current EXP는 (current EXP - required EXP actor +0x16) * 3 / 4로 축소되어 다음 레벨 잔여 경험치가 된다.
item-drop handler0x0043577c확정defeated actor +0x40 item id가 0이 아니면 +0x41 확률/분모로 random(0x427730)을 돌린다. 성공 시 0x422093(item id, 1)로 소지품을 1개 추가한다.

Formula

Global Money

VAsectionfile offsetinitialcaprefs0x+2 refsinitial bytesconclusion
0x004576e0.data0x000556e0200999999120c8 00 00 00 00 00 00 00 00 00 00 00 03 03 00 00global money dword; PE initial value is 200 and reward/shop handlers read or mutate the same address

Runtime Bridge

levelup-reward runtime: 전투 중 캡처에서 EXP 88→100→0→7, level 1→2, HP 30→35, MP 18→21이 정적 레벨업 구간 근처에서 잡힘. battle-exp-level-gold 관찰치의 gold 212→215도 원숭이 gold 3과 일치.

enemy원숭이
enemy EXP base22 enemy stat HP-view +0x04
level-up carryover88 + 22 = 110; carry 10 * 3 / 4 = 7
gold212 + 3 = 215
matches observationTrue
runtime tracehwanse-runtime-trace-2026-07-09T04-25-54-466Z-levelup-reward.manifest.json frames [903, 989]
direct reward write capturedTrue. levelup-reward 캡처는 value-probe로 EXP 88→100→0→7, level 1→2, HP/MP 성장 후보를 정적 level-up 주소 근처에서 직접 잡는다.

Runtime Event Counts

Runtime Resource Labels

Runtime Trace Summary

tracemanifestframesdirectnote
levelup-rewardhwanse-runtime-trace-2026-07-09T04-25-54-466Z-levelup-reward.manifest.json[903, 989]Truelevelup-reward 캡처는 value-probe로 EXP 88→100→0→7, level 1→2, HP/MP 성장 후보를 정적 level-up 주소 근처에서 직접 잡는다.
battle-exp-level-goldhwanse-runtime-trace-2026-07-08T07-30-45-360Z-battle-exp-level-gold.manifest.json[3083, 3254]False이전 캡처는 보상 관찰치와 전투 종료 경계 bridge로 유지한다.

Key Runtime Value Changes

framePCaddresslabeloldnewcpu eip
9120x004206900x004870B4animated/display level-or-state candidate100x00420693
9620x004206950x004870CAanimated/display EXP candidate88900x00420698
9630x004206900x004870CAanimated/display EXP candidate90920x00420693
9640x0042068B0x004870CAanimated/display EXP candidate92940x0042068E
9650x004206820x004870CAanimated/display EXP candidate94960x00420685
9660x004206900x004870CAanimated/display EXP candidate96970x00420693
9670x004206950x004870CAanimated/display EXP candidate97980x00420698
9680x004206740x004870CAanimated/display EXP candidate98990x00420678
9690x004218020x00457756player level120x00421807
9690x004218020x004870CAanimated/display EXP candidate991000x00421807
9690x004277630x0045775Aplayer max HP candidate30350x00427769
9690x004277630x0045775Cplayer current HP candidate30350x00427769
9690x004277630x00457760player max MP candidate18210x00427769
9690x004277630x00457762player current MP candidate18210x00427769
9690x004206780x004870CAanimated/display EXP candidate10000x0042067D
9700x004208350x004870B2animated/display HP candidate30310x00420839
9700x004208510x004870B4animated/display level-or-state candidate010x00420853
9700x004206980x004870CAanimated/display EXP candidate010x0042069A
9710x004207C90x004870B2animated/display HP candidate31320x004207CC
9710x004206850x004870CAanimated/display EXP candidate120x0042068B
9720x0042085A0x004870B2animated/display HP candidate32330x00420874
9720x004206930x004870CAanimated/display EXP candidate230x00420695
9730x004206900x004870B2animated/display HP candidate33340x00420693
9730x004206780x004870CAanimated/display EXP candidate340x0042067D
9740x004207B90x004870B2animated/display HP candidate34350x004207BD
9740x004206740x004870CAanimated/display EXP candidate450x00420678
9750x004206930x004870CAanimated/display EXP candidate560x00420695
9760x004206850x004870CAanimated/display EXP candidate670x0042068B
9830x004206A30x004870B4animated/display level-or-state candidate100x004206A5

Runtime Static Address Hits

framecallerPCfunctionmeaning
9690x004217DF0x00427730rnglevel-up HP increase RNG call
9690x0042183B0x00427730rnglevel-up stat RNG call
9690x004218970x00427730rnglevel-up stat RNG call
9690x004218DF0x00427730rnglevel-up stat RNG call
9690x004219270x00427730rnglevel-up stat RNG call
9690x0042196F0x00427730rnglevel-up stat RNG call
9690x004219AD0x00427730rnglevel-up luck/random branch call

Runtime Text Draws

Item Drop Source

Evidence

battle KO reward loop 0x0040dfb8..0x0040e0c2
  40dfc0:	57                   	push   edi
  40dfc1:	e8 d3 5c 02 00       	call   0x433c99
  40dfc6:	33 c9                	xor    ecx,ecx
  40dfd2:	ff 45 fc             	inc    DWORD PTR [ebp-0x4]
  40dfd5:	e8 e6 5d 02 00       	call   0x433dc0
  40dfda:	33 c9                	xor    ecx,ecx
  40dff1:	33 c9                	xor    ecx,ecx
  40dff3:	8a 48 04             	mov    cl,BYTE PTR [eax+0x4]
  40dff6:	83 f9 02             	cmp    ecx,0x2
  40e010:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  40e013:	f6 c1 40             	test   cl,0x40
  40e016:	0f 84 95 00 00 00    	je     0x40e0b1
  40e02b:	33 c0                	xor    eax,eax
  40e02d:	a0 e8 76 45 00       	mov    al,ds:0x4576e8
  40e032:	3b 45 f8             	cmp    eax,DWORD PTR [ebp-0x8]
  40e047:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  40e04a:	f6 c1 80             	test   cl,0x80
  40e04d:	0f 84 05 00 00 00    	je     0x40e058
  40e06d:	50                   	push   eax
  40e06e:	e8 08 35 01 00       	call   0x42157b
  40e073:	83 c4 08             	add    esp,0x8
  40e083:	33 d2                	xor    edx,edx
  40e085:	66 8b 51 14          	mov    dx,WORD PTR [ecx+0x14]
  40e089:	03 c2                	add    eax,edx
  40e08e:	8b 0c 8d 30 db 59 00 	mov    ecx,DWORD PTR [ecx*4+0x59db30]
  40e095:	66 89 41 14          	mov    WORD PTR [ecx+0x14],ax
  40e099:	e9 8a ff ff ff       	jmp    0x40e028
  40e0a8:	50                   	push   eax
  40e0a9:	e8 88 76 02 00       	call   0x435736
  40e0ae:	83 c4 04             	add    esp,0x4
EXP reward formula 0x0042157b..0x0042177f
  421587:	33 c9                	xor    ecx,ecx
  421589:	66 8b 48 06          	mov    cx,WORD PTR [eax+0x6]
  42158d:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  421590:	33 d2                	xor    edx,edx
  421592:	66 8b 50 06          	mov    dx,WORD PTR [eax+0x6]
  421596:	3b ca                	cmp    ecx,edx
  4215a1:	33 c9                	xor    ecx,ecx
  4215a3:	66 8b 48 06          	mov    cx,WORD PTR [eax+0x6]
  4215a7:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  4215aa:	33 d2                	xor    edx,edx
  4215ac:	66 8b 50 06          	mov    dx,WORD PTR [eax+0x6]
  4215b0:	2b ca                	sub    ecx,edx
  4215be:	33 c9                	xor    ecx,ecx
  4215c0:	66 8b 48 06          	mov    cx,WORD PTR [eax+0x6]
  4215c4:	8b 45 0c             	mov    eax,DWORD PTR [ebp+0xc]
  4215c7:	33 d2                	xor    edx,edx
  4215c9:	66 8b 50 06          	mov    dx,WORD PTR [eax+0x6]
  4215cd:	2b ca                	sub    ecx,edx
  4215d6:	25 ff ff 00 00       	and    eax,0xffff
  4215db:	83 f8 0a             	cmp    eax,0xa
  4215de:	0f 8c 05 00 00 00    	jl     0x4215e9
  4215f0:	33 c9                	xor    ecx,ecx
  4215f2:	66 8b 48 06          	mov    cx,WORD PTR [eax+0x6]
  4215f6:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  4215f9:	33 d2                	xor    edx,edx
  4215fb:	66 8b 50 06          	mov    dx,WORD PTR [eax+0x6]
  4215ff:	3b ca                	cmp    ecx,edx
  42160a:	33 c9                	xor    ecx,ecx
  42160c:	66 8b 48 14          	mov    cx,WORD PTR [eax+0x14]
  421610:	8b 45 0c             	mov    eax,DWORD PTR [ebp+0xc]
  421613:	33 d2                	xor    edx,edx
  421615:	66 8b 50 14          	mov    dx,WORD PTR [eax+0x14]
  421619:	8b 45 fc             	mov    eax,DWORD PTR [ebp-0x4]
  42163b:	33 c9                	xor    ecx,ecx
  42163d:	66 8b 48 14          	mov    cx,WORD PTR [eax+0x14]
  421641:	8b 45 fc             	mov    eax,DWORD PTR [ebp-0x4]
  42164b:	0f 8d 0b 00 00 00    	jge    0x42165c
  421651:	66 c7 45 fc 01 00    	mov    WORD PTR [ebp-0x4],0x1
  421657:	e9 00 00 00 00       	jmp    0x42165c
  421664:	33 c9                	xor    ecx,ecx
  421666:	66 8b 48 14          	mov    cx,WORD PTR [eax+0x14]
  42166a:	8b 45 fc             	mov    eax,DWORD PTR [ebp-0x4]
  4216a7:	33 c9                	xor    ecx,ecx
  4216a9:	8a 8c c0 98 77 45 00 	mov    cl,BYTE PTR [eax+eax*8+0x457798]
  4216b0:	89 4d f8             	mov    DWORD PTR [ebp-0x8],ecx
  4216d0:	25 ff ff 00 00       	and    eax,0xffff
  4216d5:	c1 e8 01             	shr    eax,0x1
  4216d8:	66 89 45 fc          	mov    WORD PTR [ebp-0x4],ax
  4216dc:	e9 06 00 00 00       	jmp    0x4216e7
  4216e1:	66 c7 45 fc 01 00    	mov    WORD PTR [ebp-0x4],0x1
  4216e7:	e9 14 00 00 00       	jmp    0x421700
  42170e:	33 c9                	xor    ecx,ecx
  421710:	8a 8c c0 99 77 45 00 	mov    cl,BYTE PTR [eax+eax*8+0x457799]
  421717:	89 4d f4             	mov    DWORD PTR [ebp-0xc],ecx
  421737:	25 ff ff 00 00       	and    eax,0xffff
  42173c:	c1 e8 01             	shr    eax,0x1
  42173f:	66 89 45 fc          	mov    WORD PTR [ebp-0x4],ax
  421743:	e9 06 00 00 00       	jmp    0x42174e
  421748:	66 c7 45 fc 01 00    	mov    WORD PTR [ebp-0x4],0x1
  42174e:	e9 1e 00 00 00       	jmp    0x421771
gold reward / item-drop handler 0x00435736..0x004357d0
  435742:	33 c9                	xor    ecx,ecx
  435744:	66 8b 48 44          	mov    cx,WORD PTR [eax+0x44]
  435748:	89 4d fc             	mov    DWORD PTR [ebp-0x4],ecx
  43574b:	a1 e0 76 45 00       	mov    eax,ds:0x4576e0
  435750:	03 45 fc             	add    eax,DWORD PTR [ebp-0x4]
  435753:	3d 3f 42 0f 00       	cmp    eax,0xf423f
  435758:	0f 86 0f 00 00 00    	jbe    0x43576d
  43575e:	c7 05 e0 76 45 00 3f 	mov    DWORD PTR ds:0x4576e0,0xf423f
  435765:	42 0f 00
  435770:	33 c9                	xor    ecx,ecx
  435772:	66 8b 48 44          	mov    cx,WORD PTR [eax+0x44]
  435776:	01 0d e0 76 45 00    	add    DWORD PTR ds:0x4576e0,ecx
  43577c:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  43577f:	33 c9                	xor    ecx,ecx
  435781:	8a 48 40             	mov    cl,BYTE PTR [eax+0x40]
  435784:	85 c9                	test   ecx,ecx
  43578c:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  43578f:	66 0f b6 40 41       	movzx  ax,BYTE PTR [eax+0x41]
  435794:	50                   	push   eax
  435795:	e8 96 1f ff ff       	call   0x427730
  43579a:	83 c4 04             	add    esp,0x4
  4357aa:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  4357ad:	8a 40 40             	mov    al,BYTE PTR [eax+0x40]
  4357b0:	50                   	push   eax
  4357b1:	e8 dd c8 fe ff       	call   0x422093
  4357b6:	83 c4 08             	add    esp,0x8
  4357b9:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  4357bc:	8a 40 40             	mov    al,BYTE PTR [eax+0x40]
  4357bf:	e9 07 00 00 00       	jmp    0x4357cb
money add/subtract VM helper 0x00406a38..0x00406ae8
  406a5a:	8b 40 04             	mov    eax,DWORD PTR [eax+0x4]
  406a5d:	03 05 e0 76 45 00    	add    eax,DWORD PTR ds:0x4576e0
  406a63:	3d 3f 42 0f 00       	cmp    eax,0xf423f
  406a68:	0f 83 14 00 00 00    	jae    0x406a82
  406a74:	8b 40 04             	mov    eax,DWORD PTR [eax+0x4]
  406a77:	01 05 e0 76 45 00    	add    DWORD PTR ds:0x4576e0,eax
  406a7d:	e9 0a 00 00 00       	jmp    0x406a8c
  406a82:	c7 05 e0 76 45 00 3f 	mov    DWORD PTR ds:0x4576e0,0xf423f
  406a89:	42 0f 00
  406a9b:	8b 40 40             	mov    eax,DWORD PTR [eax+0x40]
  406a9e:	8b 0d e0 76 45 00    	mov    ecx,DWORD PTR ds:0x4576e0
  406aa4:	39 48 04             	cmp    DWORD PTR [eax+0x4],ecx
  406acc:	f7 d8                	neg    eax
  406ace:	29 05 e0 76 45 00    	sub    DWORD PTR ds:0x4576e0,eax
  406ad4:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
shop/inventory money checks 0x0040fd11..0x0041004f
  40fd27:	66 8b 5c 81 02       	mov    bx,WORD PTR [ecx+eax*4+0x2]
  40fd2c:	a1 e0 76 45 00       	mov    eax,ds:0x4576e0
  40fd31:	2b d2                	sub    edx,edx
  40fd33:	f7 f3                	div    ebx
  40fd35:	a2 3b e3 59 00       	mov    ds:0x59e33b,al
  40fdae:	66 8b 5c 81 02       	mov    bx,WORD PTR [ecx+eax*4+0x2]
  40fdb3:	a1 e0 76 45 00       	mov    eax,ds:0x4576e0
  40fdb8:	2b d2                	sub    edx,edx
  40fdba:	f7 f3                	div    ebx
  40fdbc:	a2 3b e3 59 00       	mov    ds:0x59e33b,al
  40fdd0:	03 c1                	add    eax,ecx
  40fdd2:	83 f8 0a             	cmp    eax,0xa
  40fdd5:	0f 8e 14 00 00 00    	jle    0x40fdef
  40fe22:	66 8b 5c 81 02       	mov    bx,WORD PTR [ecx+eax*4+0x2]
  40fe27:	a1 e0 76 45 00       	mov    eax,ds:0x4576e0
  40fe2c:	2b d2                	sub    edx,edx
  40fe2e:	f7 f3                	div    ebx
  40fe30:	a2 3b e3 59 00       	mov    ds:0x59e33b,al
  41003b:	f7 d8                	neg    eax
  41003d:	29 05 e0 76 45 00    	sub    DWORD PTR ds:0x4576e0,eax
  410043:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
level-up carryover 0x0042177f..0x00421b33
  42179e:	8a 88 e9 76 45 00    	mov    cl,BYTE PTR [eax+0x4576e9]
  4217a4:	8d 04 49             	lea    eax,[ecx+ecx*2]
  4217a7:	c1 e0 03             	shl    eax,0x3
  4217c7:	8b 45 ec             	mov    eax,DWORD PTR [ebp-0x14]
  4217ca:	66 ff 40 06          	inc    WORD PTR [eax+0x6]
  4217ce:	8b 45 ec             	mov    eax,DWORD PTR [ebp-0x14]
  4219e0:	8b 45 e4             	mov    eax,DWORD PTR [ebp-0x1c]
  4219e3:	66 ff 40 06          	inc    WORD PTR [eax+0x6]
  4219e7:	8b 45 e4             	mov    eax,DWORD PTR [ebp-0x1c]
  421aed:	33 c9                	xor    ecx,ecx
  421aef:	66 8b 48 14          	mov    cx,WORD PTR [eax+0x14]
  421af3:	8b 45 e4             	mov    eax,DWORD PTR [ebp-0x1c]
  421af6:	33 d2                	xor    edx,edx
  421af8:	66 8b 50 16          	mov    dx,WORD PTR [eax+0x16]
  421afc:	2b ca                	sub    ecx,edx
  421afe:	8d 04 49             	lea    eax,[ecx+ecx*2]
  421b01:	99                   	cdq
  421b05:	03 c2                	add    eax,edx
  421b07:	c1 f8 02             	sar    eax,0x2
  421b0a:	8b 4d e4             	mov    ecx,DWORD PTR [ebp-0x1c]
  421b0d:	66 89 41 14          	mov    WORD PTR [ecx+0x14],ax
  421b11:	33 c9                	xor    ecx,ecx
  421b24:	00 00 00
  421b27:	b0 01                	mov    al,0x1
  421b29:	e9 00 00 00 00       	jmp    0x421b2e

Open Questions