Any ways to enable addons/scripts in WoD Beta?

[pcmdxx]

Hi guys,

I just wanted to know if you know how the scripts/addons are blocked in the WoD Beta? I know there were for cata/mop some tools to enable addons.

Currently, when you try to run the script/run command inside the chat you get a Lua Message from Interface/FrameXML.lua that scripts are not allowed.

It is possible to inject code and overwrite this? Where is the FrameXML code saved? Is it inside the exe or loaded from the new MPQ format?

greetings,

pcmd

[xalcon]

Well, I dont have beta access, but I knew from the MoP Beta the /dump command still worked and there was some lua code to redefine /run

If /dump is working, this might help: http://www.ownedcore.com/forums/worl...un-script.html (MoP beta - enabling /run /script)

[pcmd]

what I saw so far is the DUMP Slashcommand protected by the function IsGMClient() which is only loaded when you have the GM MPQs? Already tried this.

I dont know which functions where changed by the MoP Addon enabler.

Already tried to search for some with OllyDbg but it pretty sucks for me compared to IDA Pro which I dont own longer ^^

[xalcon]

IsGMClient IS always present, at least on live, but it's setting eax to 0 which can be interpreted as nil (since nothing gets returned). If IsGMClient is used, it should be easy to patch, but I've no beta key to test

[TOM_RUS]

Looks at IsAddOnLoadable (called by GetAddOnInfo lua, easy to find) for unlocking addons and at IsGMClient for /dump. After you have it done, you can also make script/run to work.

There's a check in IsAddOnLoadable like this

if (addon->security == 1) // INSECURE
{
    *loadableState = 5; // INSECURE
    return 0;
}

[cadcamzy]

Looks at IsAddOnLoadable (called by GetAddOnInfo lua, easy to find) for unlocking addons and at IsGMClient for /dump. After you have it done, you can also make script/run to work.

There's a check in IsAddOnLoadable like this

if (addon->security == 1) // INSECURE
{
    *loadableState = 5; // INSECURE
    return 0;
}

Please guide how to find IsAddOnLoadable , and HEX edit wow.exe

Thank!

[TOM_RUS]

Please guide how to find IsAddOnLoadable , and HEX edit wow.exe

Thank!

For wow.exe build 6.0.1.18505 change byte 0x75 to 0xEB at 0x00373A0E with your favorite hex editor.

[cadcamzy]

Thank very much!

[blamani]

wouldn't that trigger the signature check and prevent the login?

[TOM_RUS]

wouldn't that trigger the signature check and prevent the login?

No.

filler

[pcmdxx]

Thank you so much! Looking later into and try to make a screenshot guide if I manage to reproduce TOM_RUS way.


greetings,

pcmd

[Znuff]

Well, wow.exe is not getting run by the Beta client.

You need to run WoWB.exe (or WoWB-64.exe).

Those .exe's don't contain 0x75 at 0x00373A0E :-(

[TOM_RUS]

Well, wow.exe is not getting run by the Beta client.

You need to run WoWB.exe (or WoWB-64.exe).

Those .exe's don't contain 0x75 at 0x00373A0E :-(

And how is that a problem? You can still run wow.exe (or wowt.exe or wowtr.exe or any x64 counterpart exe) manually.

CBA looking offsets for all 8 exe's because essentially they all the same.

[airjqqq]

For wowB-64.exe build 6.0.1.18505, also change the byte 0x75 to 0xEB at 0x0068d5fc. This will just enable the addon to load.

Add the code below to any .lua file you load will enable the script with "/run" or "/script" and the "/dump". It is much easier than find addresses stuff.

RunScript=function(a) 
    loadstring(a)();
end; 

if DevTools_Dump then
    SlashCmdList["DUMP"] = function(msg)
        local fcn = loadstring("DevTools_Dump({"..msg.."})");
        fcn();
    end
end

[TOM_RUS]

For wowB-64.exe build 6.0.1.18505, also change the byte 0x75 to 0xEB at 0x0068d5fc. This will just enable the addon to load.

Add the code below to any .lua file you load will enable the script with "/run" or "/script" and the "/dump". It is much easier than find addresses stuff.

RunScript=function(a) 
    loadstring(a)();
end; 

if DevTools_Dump then
    SlashCmdList["DUMP"] = function(msg)
        local fcn = loadstring("DevTools_Dump({"..msg.."})");
        fcn();
    end
end

Or you can add to some addon:

RunScript=function(a) loadstring(a)() end
IsGMClient=function() return true end

that does same thing (enable /dump, /script and /run)