[WoW][5.0.4.16016] x86 Info Dump Thread

[Frosttall]

What is the AURA_INDEX1 for? You're reading the address in your code, but not using it further. Btw, can't seem to get it working with those offsets ...

I've just reversed Blizzards code and they actually read every single index of an aura, but I've noticed that it's totally useless and removed that part. Seems like that I forgot it, I'll edit it.

Thank you



But what is the matter? What can't you get work?

[Rage Hunter]

Has anyone found EquippedBagGUID? (The offset of the 4 bags your player has equipped)

EquippedBagGUID = 0xCDBC40 (not sure)

[yossarian87]

I want to disagree with these WoWContainerFields.

enum WoWContainerField : DWORD
{
	CONTAINER_FIELD_NUM_SLOTS                        = ITEM_END + 0x0,
	CONTAINER_FIELD_SLOTS                            = ITEM_END + 0x1,
	CONTAINER_END                                    = ITEM_END + 0x49
};

I'm seeing this:

enum WoWContainerField : DWORD
{
	CONTAINER_FIELD_SLOTS                            = ITEM_END + 0x0,
	CONTAINER_FIELD_NUM_SLOTS                        = ITEM_END + 0x48,
	CONTAINER_END                                    = ITEM_END + 0x49
};

[yossarian87]

EquippedBagGUID = 0xCDBC40 (not sure)

This works for me!

[Vandra]

Character's inventory slots if someone have use of this:

            visibleitem_1 = 0xE48,
            visibleitem_2 = visibleitem_1 + 0x8,
            visibleitem_3 = visibleitem_2 + 0x8,
            visibleitem_4 = visibleitem_3 + 0x8,
            visibleitem_5 = visibleitem_4 + 0x8,
            visibleitem_6 = visibleitem_5 + 0x8,
            visibleitem_7 = visibleitem_6 + 0x8,
            visibleitem_8 = visibleitem_7 + 0x8,
            visibleitem_9 = visibleitem_8 + 0x8,
            visibleitem_10 = visibleitem_9 + 0x8,
            visibleitem_11 = visibleitem_10 + 0x8,
            visibleitem_12 = visibleitem_11 + 0x8,
            visibleitem_13 = visibleitem_12 + 0x8,
            visibleitem_14 = visibleitem_13 + 0x8,
            visibleitem_15 = visibleitem_14 + 0x8,
            visibleitem_16 = visibleitem_15 + 0x8,
            visibleitem_17 = visibleitem_16 + 0x8,
            visibleitem_18 = visibleitem_17 + 0x8,
            visibleitem_19 = visibleitem_18 + 0x8,

[dunmcl]

Maybe, someone know offsets for read item name. For example, this code I use to read GameObject name:


public uint
ObjectNamePtr = 0x1B8,
ObjectNameOffs = 0xB4;


uint name1 = MyObjectManager.Memory.ReadUInt((uint)ObjectPointer + WoWOffsets.Instance.ObjectNamePtr);
uint name2 = MyObjectManager.Memory.ReadUInt(name1 + WoWOffsets.Instance.ObjectNameOffs);
resname = Encode(MyObjectManager.Memory.ReadASCIIString(name2, 100));


So, I need ItemNamePtr and ItemNameOffs. Help me please. Thanks for any reply.

[rafalsk]

at first glance looks like the CompareUnitFaction-thing (0x48C200) used by CGUnit_C__UnitReaction has changed quite a bit? Can't see it reading the g_FactionDB directly ; seems to call some subroutine (0x2ED900 ) - which returns hash-values => hash values are then being compared by an intact HashCompare subroutine located at 0x480A10 as usually. Any comment would be appreciated.

Update: I have reversed the whole thing and got it to work. Results are very similar to the GetRow function (not surprisingly as it also reads data from the DB), which you guys have already presented, though in a less universal form so to say. Will add some sources soon.

[TOM_RUS]

"RecordSize" is still required to get the actual pointer to the DBC record.

You can get RecordSize easily:

[StructLayout(LayoutKind.Sequential)]
struct WoWClientDB
{
    public IntPtr VTable;         // pointer to vtable
    public int NumRows;         // number of rows
    public int MaxIndex;        // maximal row index
    public int MinIndex;        // minimal row index
    public IntPtr Data;           // pointer to actual dbc file data
    public IntPtr FirstRow;       // pointer to first row
    public IntPtr Rows;           // pointer to rows array - not anymore?
    public IntPtr Unk1; // ptr
    public uint Unk2; // 1
    public IntPtr Unk3; // ptr
    public uint RowEntrySize; // 2 or 4
};

[StructLayout(LayoutKind.Sequential)]
struct DBCFile
{
    public uint Magic;
    public int RecordsCount;
    public int FieldsCount;
    public int RecordSize;
    public int StringTableSize;
}

dbInfo = WowMemory.Read<WoWClientDB>(dbc_ptr);
fileHdr = WowMemory.Read<DBCFile>(dbInfo.Data);
int RecordSize = fileHdr.RecordSize;

My DBC class: http://paste2.org/p/2189163
Usage: http://paste2.org/p/2189166

    [StructLayout(LayoutKind.Sequential)]
    struct SpellRec
    {
        public uint Id;                                         // 0        m_ID
        uint _Name;                                             // 1        m_name
        uint _NameSubText;                                      // 2        m_nameSubtext
        uint _Description;                                      // 3        m_description
        uint _AuraDescription;                                  // 4        m_auraDescription
        public uint runeCostID;                                 // 5        SpellRuneCost.dbc
        public uint spellMissileID;                             // 6        SpellMissile.dbc
        public uint spellDescriptionVariableID;                 // 7        SpellDescriptionVariables.dbc
        float unk_f1;                                           // 8        some float value
        public uint SpellScalingId;                             // 9        SpellScaling.dbc
        public uint SpellAuraOptionsId;                         // 10       SpellAuraOptions.dbc
        public uint SpellAuraRestrictionsId;                    // 11       SpellAuraRestrictions.dbc
        public uint SpellCastingRequirementsId;                 // 12       SpellCastingRequirements.dbc
        public uint SpellCategoriesId;                          // 13       SpellCategories.dbc
        public uint SpellClassOptionsId;                        // 14       SpellClassOptions.dbc
        public uint SpellCooldownsId;                           // 15       SpellCooldowns.dbc
        public uint SpellEquippedItemsId;                       // 16       SpellEquippedItems.dbc
        public uint SpellInterruptsId;                          // 17       SpellInterrupts.dbc
        public uint SpellLevelsId;                              // 18       SpellLevels.dbc
        public uint SpellReagentsId;                            // 19       SpellReagents.dbc
        public uint SpellShapeshiftId;                          // 20       SpellShapeshift.dbc
        public uint SpellTargetRestrictionsId;                  // 21       SpellTargetRestrictions.dbc
        public uint SpellTotemsId;                              // 22       SpellTotems.dbc
        public uint ResearchProjectId;                          // 23       ResearchProject.dbc
        public uint SpellMiscId;                                // 24       SpellMisc.dbc

        // read area name using our static memory reading helper class
        public string Name { get { return WowMemory.ReadCString(_Name, 255); } }
    };

[vaxter]

Hi all!

I am new here, first of all thanks you very much for share all this information.

I am writting some test in c#. starting with some easy stuff:
Reading process, getting some of values of static address like playername.
and Now i am starting to play with managerObjects trying to get the playerObject to read here HP and others.

i will put my code here to maybe help others and with others can help me

BlackMagic wow = new BlackMagic(); //Create new function to open wow process
wow.OpenProcessAndThread(SProcess.GetProcessFromWindowTitle("World of Warcraft")); //This Opens "World of Warcraft" window

IntPtr baseWoW = wow.MainModule.BaseAddress;
string playername = wow.ReadASCIIString((uint)baseWoW + (uint)Globals.PlayerName, 24);//Player Name
string realmName = wow.ReadASCIIString((uint)baseWoW + (uint)Globals.CurrentRealm, 64);//Realm Name
            
logText.Text += "Realm Name: " + realmName + "\r\n";
logText.Text += "Player Name: " + playername + "\r\n";

//all right now.

uint currentManager_Pre = wow.ReadUInt((uint) baseWoW + (uint) ObjectManager.CurMgrPointer);
uint currentManager = wow.ReadUInt((uint)currentManager_Pre + (uint)ObjectManager.CurMgrOffset);
uint playerObject = wow.ReadUInt((uint)baseWoW + (uint)Globals.PlayerGUID);
uint descriptors = wow.ReadUInt((uint)playerObject + (uint)Globals.Descriptors);
float playerHP = wow.ReadFloat((uint)descriptors + (uint)UnitFields.Health);

logText.Text += "playerHP: " + playerHP.ToString() + "\r\n";

enums used:

public enum Globals // 5.0.4 16016  
    {
        Descriptors = 0x8,
        PlayerName = 0xDC92D8,
        CurrentRealm = 0xDC9466,
        PHealthOffset = 0x1294,
        PlayerGUID = 0xD0, 
    }

    public enum ObjectManager
    {
        CurMgrPointer = 0x00DC9298,                                             // 5.0.4 16016  
        CurMgrOffset = 0x462C,                                                  // 5.0.4 16016  
        NextObject = 0xC4,                                                      // 5.0.4 16016  
        FirstObject = 0xCC,                                                     // 5.0.4 16016  
        LocalGUID = 0xD0,                                                       // 5.0.4 16016  
    }

public enum ObjectFields
        {
            Guid = 0x0,
            Data = 0x2,
            Type = 0x4,
            Entry = 0x5,
            Scale = 0x6,
            End = 0x7
        };

        public enum UnitFields
        {
            Charm = ObjectFields.End + 0x0,
            Summon = ObjectFields.End + 0x2,
            Critter = ObjectFields.End + 0x4,
            CharmedBy = ObjectFields.End + 0x6,
            SummonedBy = ObjectFields.End + 0x8,
            CreatedBy = ObjectFields.End + 0xA,
            Target = ObjectFields.End + 0xC,
            ChannelObject = ObjectFields.End + 0xE,
            SummonedByHomeRealm = ObjectFields.End + 0x10,
            ChannelSpell = ObjectFields.End + 0x11,
            DisplayPower = ObjectFields.End + 0x12,
            OverrideDisplayPowerID = ObjectFields.End + 0x13,
            Health = ObjectFields.End + 0x14,
            Power = ObjectFields.End + 0x15,
            MaxHealth = ObjectFields.End + 0x1A,
            MaxPower = ObjectFields.End + 0x1B,
            PowerRegenFlatModifier = ObjectFields.End + 0x20,
            PowerRegenInterruptedFlatModifier = ObjectFields.End + 0x25,
            Level = ObjectFields.End + 0x2A,
            FactionTemplate = ObjectFields.End + 0x2B,
            VirtualItemID = ObjectFields.End + 0x2C,
            Flags = ObjectFields.End + 0x2F,
            Flags2 = ObjectFields.End + 0x30,
            AuraState = ObjectFields.End + 0x31,
            AttackRoundBaseTime = ObjectFields.End + 0x32,
            RangedAttackRoundBaseTime = ObjectFields.End + 0x34,
            BoundingRadius = ObjectFields.End + 0x35,
            CombatReach = ObjectFields.End + 0x36,
            DisplayID = ObjectFields.End + 0x37,
            NativeDisplayID = ObjectFields.End + 0x38,
            MountDisplayID = ObjectFields.End + 0x39,
            MinDamage = ObjectFields.End + 0x3A,
            MaxDamage = ObjectFields.End + 0x3B,
            MinOffHandDamage = ObjectFields.End + 0x3C,
            MaxOffHandDamage = ObjectFields.End + 0x3D,
            AnimTier = ObjectFields.End + 0x3E,
            PetNumber = ObjectFields.End + 0x3F,
            PetNameTimestamp = ObjectFields.End + 0x40,
            PetExperience = ObjectFields.End + 0x41,
            PetNextLevelExperience = ObjectFields.End + 0x42,
            DynamicFlags = ObjectFields.End + 0x43,
            ModCastingSpeed = ObjectFields.End + 0x44,
            ModSpellHaste = ObjectFields.End + 0x45,
            ModHaste = ObjectFields.End + 0x46,
            ModHasteRegen = ObjectFields.End + 0x47,
            CreatedBySpell = ObjectFields.End + 0x48,
            NpcFlags = ObjectFields.End + 0x49,
            EmoteState = ObjectFields.End + 0x4B,
            Stats = ObjectFields.End + 0x4C,
            StatPosBuff = ObjectFields.End + 0x51,
            StatNegBuff = ObjectFields.End + 0x56,
            Resistances = ObjectFields.End + 0x5B,
            ResistanceBuffModsPositive = ObjectFields.End + 0x62,
            ResistanceBuffModsNegative = ObjectFields.End + 0x69,
            BaseMana = ObjectFields.End + 0x70,
            BaseHealth = ObjectFields.End + 0x71,
            ShapeshiftForm = ObjectFields.End + 0x72,
            AttackPower = ObjectFields.End + 0x73,
            AttackPowerModPos = ObjectFields.End + 0x74,
            AttackPowerModNeg = ObjectFields.End + 0x75,
            AttackPowerMultiplier = ObjectFields.End + 0x76,
            RangedAttackPower = ObjectFields.End + 0x77,
            RangedAttackPowerModPos = ObjectFields.End + 0x78,
            RangedAttackPowerModNeg = ObjectFields.End + 0x79,
            RangedAttackPowerMultiplier = ObjectFields.End + 0x7A,
            MinRangedDamage = ObjectFields.End + 0x7B,
            MaxRangedDamage = ObjectFields.End + 0x7C,
            PowerCostModifier = ObjectFields.End + 0x7D,
            PowerCostMultiplier = ObjectFields.End + 0x84,
            MaxHealthModifier = ObjectFields.End + 0x8B,
            HoverHeight = ObjectFields.End + 0x8C,
            MinItemLevel = ObjectFields.End + 0x8D,
            MaxItemLevel = ObjectFields.End + 0x8E,
            WildBattlePetLevel = ObjectFields.End + 0x8F,
            BattlePetCompanionID = ObjectFields.End + 0x90,
            BattlePetCompanionNameTimestamp = ObjectFields.End + 0x91,
            End = ObjectFields.End + 0x92
        };

i think that i get bad offset to clientConnection, it should work but it do not.
Someone can help me? ^^

TNks in advance!

regards!

[kosacid]

@vaxter your sort of right one problem though you have to run through object manager looking at every object compairing the GUID to your players GUID once they match then pull the info
i use c++ though look at my field dump code that migh get you on the right path

[vaxter]

@kosacid, Tnks friend! all help is welcome.

I understand of your reply that i should iterate over objectmanager looking her type or comparing her GUID depend what i want. in this case i am trying to list all objects.

some like this:
(same enums like post: #70)

            uint currentManager_Pre = wow.ReadUInt((uint) baseWoW + (uint) ObjectManager.CurMgrPointer);
            uint currentManager = wow.ReadUInt((uint)currentManager_Pre + (uint)ObjectManager.CurMgrOffset);
            uint nextObject = wow.ReadUInt((uint)currentManager + (uint)ObjectManager.FirstObject);

            while(nextObject != 0){
                int ObjectType = wow.ReadInt((uint)nextObject + (uint)ObjectFields.Type);
                int objectGUID = wow.ReadInt((uint)nextObject + (uint)ObjectFields.Guid);
                logText.Text += "Object: " + objectGUID + " Type: " + ObjectType + "\r\n";    

                nextObject = wow.ReadUInt((uint)nextObject + (uint)ObjectManager.NextObject);                
            }

but, i am doing wrong other time cose i only list one object with type 0.
Can you give me some of light?

Tnks again ^^

[Neo2003]

C++ enum formatted descriptors:

enum WoWGameObjectField : DWORD
{
	GAMEOBJECT_FIELD_CREATEDBY                       = OBJECT_END + 0x0,
	GAMEOBJECT_FIELD_DISPLAYID                       = OBJECT_END + 0x2,
	GAMEOBJECT_FIELD_FLAGS                           = OBJECT_END + 0x3,
	GAMEOBJECT_FIELD_PARENT_ROTATION                 = OBJECT_END + 0x4,
	GAMEOBJECT_FIELD_ANIM_PROGRESS                   = OBJECT_END + 0x8,
	GAMEOBJECT_FIELD_FACTION_TEMPLATE                = OBJECT_END + 0x9,
	GAMEOBJECT_FIELD_LEVEL                           = OBJECT_END + 0xA,
	GAMEOBJECT_FIELD_PERCENT_HEALTH                  = OBJECT_END + 0xB,
	GAMEOBJECT_END                                   = OBJECT_END + 0xC
};

GAMEOBJECT_FIELD_PERCENT_HEALTH is a wrong name. It's still GAMEOBJECT_BYTES_1 at least for the GOType value contained in this bytes and not related to any health as far as I know.

Neo2003

[rafalsk]

@kosacid, Tnks friend! all help is welcome.

I understand of your reply that i should iterate over objectmanager looking her type or comparing her GUID depend what i want. in this case i am trying to list all objects.

some like this:
(same enums like post: #70)

            uint currentManager_Pre = wow.ReadUInt((uint) baseWoW + (uint) ObjectManager.CurMgrPointer);
            uint currentManager = wow.ReadUInt((uint)currentManager_Pre + (uint)ObjectManager.CurMgrOffset);
            uint nextObject = wow.ReadUInt((uint)currentManager + (uint)ObjectManager.FirstObject);

            while(nextObject != 0){
                int ObjectType = wow.ReadInt((uint)nextObject + (uint)ObjectFields.Type);
                int objectGUID = wow.ReadInt((uint)nextObject + (uint)ObjectFields.Guid);
                logText.Text += "Object: " + objectGUID + " Type: " + ObjectType + "\r\n";    

                nextObject = wow.ReadUInt((uint)nextObject + (uint)ObjectManager.NextObject);                
            }

but, i am doing wrong other time cose i only list one object with type 0.
Can you give me some of light?

Tnks again ^^

Oh well, in order to read some property, you need to follow objectBase+0x8 (current descriptors offset) + offset of the particular descriptor you are attempting to read.
ex. Guid = mem .ReadUInt64(tempMem.ReadUInt(Holder+0x + GuidOffset)
right, as for the guid, it's being stored in two places (also objBase +0x30 if I remember right, which would save you 1 memory read) but it's always safer to follow the descriptors.
BTW. I would recommend opening a seperate thread, as this might not be the right place for discussion of the basics.

[Apoc]

You can get RecordSize easily:

[StructLayout(LayoutKind.Sequential)]
struct WoWClientDB
{
    public IntPtr VTable;         // pointer to vtable
    public int NumRows;         // number of rows
    public int MaxIndex;        // maximal row index
    public int MinIndex;        // minimal row index
    public IntPtr Data;           // pointer to actual dbc file data
    public IntPtr FirstRow;       // pointer to first row
    public IntPtr Rows;           // pointer to rows array - not anymore?
    public IntPtr Unk1; // ptr
    public uint Unk2; // 1
    public IntPtr Unk3; // ptr
    public uint RowEntrySize; // 2 or 4
};

[StructLayout(LayoutKind.Sequential)]
struct DBCFile
{
    public uint Magic;
    public int RecordsCount;
    public int FieldsCount;
    public int RecordSize;
    public int StringTableSize;
}

dbInfo = WowMemory.Read<WoWClientDB>(dbc_ptr);
fileHdr = WowMemory.Read<DBCFile>(dbInfo.Data);
int RecordSize = fileHdr.RecordSize;

My DBC class: Paste2 - Viewing Paste 2189163
Usage: Paste2 - Viewing Paste 2189166

    [StructLayout(LayoutKind.Sequential)]
    struct SpellRec
    {
        public uint Id;                                         // 0        m_ID
        uint _Name;                                             // 1        m_name
        uint _NameSubText;                                      // 2        m_nameSubtext
        uint _Description;                                      // 3        m_description
        uint _AuraDescription;                                  // 4        m_auraDescription
        public uint runeCostID;                                 // 5        SpellRuneCost.dbc
        public uint spellMissileID;                             // 6        SpellMissile.dbc
        public uint spellDescriptionVariableID;                 // 7        SpellDescriptionVariables.dbc
        float unk_f1;                                           // 8        some float value
        public uint SpellScalingId;                             // 9        SpellScaling.dbc
        public uint SpellAuraOptionsId;                         // 10       SpellAuraOptions.dbc
        public uint SpellAuraRestrictionsId;                    // 11       SpellAuraRestrictions.dbc
        public uint SpellCastingRequirementsId;                 // 12       SpellCastingRequirements.dbc
        public uint SpellCategoriesId;                          // 13       SpellCategories.dbc
        public uint SpellClassOptionsId;                        // 14       SpellClassOptions.dbc
        public uint SpellCooldownsId;                           // 15       SpellCooldowns.dbc
        public uint SpellEquippedItemsId;                       // 16       SpellEquippedItems.dbc
        public uint SpellInterruptsId;                          // 17       SpellInterrupts.dbc
        public uint SpellLevelsId;                              // 18       SpellLevels.dbc
        public uint SpellReagentsId;                            // 19       SpellReagents.dbc
        public uint SpellShapeshiftId;                          // 20       SpellShapeshift.dbc
        public uint SpellTargetRestrictionsId;                  // 21       SpellTargetRestrictions.dbc
        public uint SpellTotemsId;                              // 22       SpellTotems.dbc
        public uint ResearchProjectId;                          // 23       ResearchProject.dbc
        public uint SpellMiscId;                                // 24       SpellMisc.dbc

        // read area name using our static memory reading helper class
        public string Name { get { return WowMemory.ReadCString(_Name, 255); } }
    };

Oh how I hate you right now. I never bothered to check into that enough I suppose. Thanks for the heads up.

[rafalsk]

public enum ShapeshiftFormId
{
             BaseAddressOffset1 = 0xDC,              
            BaseAddressOffset2 = 0x1Cb,
}

The previous one is wrong.

AutoAttack = 0xBB0
isFlying{
ptr=0xE4,
 ofs=0x38
}
public enum BarManager
        {
            startBar = 0xCDC510,
            nextBar = 0x4,
        }
LoginSelectedCharIndex = 0xA729F0