[Question] How to use Object Manager

[Akaike]

Hello guys,

well I figured out how to find the object manager in the x64 bit client but now I have the problem that I have no idea how to use it.

I know that the address for the object manager is 0xA83920 and the first unit offset is 73d8. I know that I can read for example with 0xA83920 + 73d8 + 58 the health of an random unit but how is it possible to read for example the informations from player's target?

It would be great if someone could explain that to me. I would be very, very grateful to this person.

Thank you very much in advance.

[Midi12]

You can do something like this for unit list:

currentunitaddr = objmgrbase + firstunit

while(currentunitaddr != 0)
{
vectorunit.add(currentunitaddr)
currentunitaddr = currentunitaddr + nextunitoffset
}

(this is pseudo code ^^)

For local player you have to find the local player offset from object manager then read values as you are doing it.
For player's target you can iterate over you unit list then check for

localplayer.targetID == currentunit.ID

[Apoc]

Well, again, there's no "object manager" in Wildstar. There's a general Game Manager. It handles just about everything. (From Lua, to input, to actors, to networking) There just happens to be an Actor list in the game manager.

Either way, here's a copy/pasta of my older GameManager class (new one has stuff that I can't really show )

using System;using System.Collections.Generic;


using ApocDev.Common;
using ApocDev.Wildstar.Engine;
using ApocDev.Wildstar.Updates;


using GreyMagic;


using log4net;


namespace ApocDev.Wildstar.Game
{
    public class GameManager
    {
        private static readonly ILog Log = LogManager.GetLogger(typeof(GameManager));
        private static bool _initialized;
        private static PerFrameCachedValue<List<Actor>> _cachedActors;
        private static ExternalProcessMemory Memory { get { return GameEngine.AttachedProcess.Memory; } }
        internal static IntPtr GameMgrPtr { get { return Memory.Read<IntPtr>(Patterns.GameManager); } }


        /// <summary>
        /// A list of all available actors. This list is updated once per frame with new objects. Do not cache actor objects for more than 1 frame of execution.
        /// They are not guaranteed to be valid.
        /// </summary>
        public static List<Actor> Actors { get { return _cachedActors; } }
        /// <summary>
        /// The current local player actor. (Your actual player in-game)
        /// </summary>
        public static Player LocalPlayer { get; private set; }


        /// <summary>
        /// Returns an instance of <see cref="GameLua"/> for Lua snippets in-game. Also provides an Events API for you to also hook in-game Lua events from C#.
        /// </summary>
        public static GameLua Lua { get; private set; }


        /// <summary>
        /// Used from GameLua to grab the LuaState ptr. Since these patterns are specific to GameManager (as they're only valid when in-game)
        /// GameLua has patterns for the secondary Lua states for when out of game.
        /// </summary>
        internal static IntPtr LuaState
        {
            get
            {
                // Doing this because if we're not in game
                if (GameMgrPtr == IntPtr.Zero)
                {
                    return IntPtr.Zero;
                }
                var first = Memory.Read<IntPtr>(GameMgrPtr + (int) Patterns.LuaMgr);
                if (first == IntPtr.Zero)
                {
                    return IntPtr.Zero;
                }
                return Memory.Read<IntPtr>(first + (int) Patterns.LuaMgrLuaState);
            }
        }


        internal static GameManagerPatterns Patterns { get; set; }


        /// <summary>
        /// Initializes the GameManager. Subsequent calls will do nothing.
        /// </summary>
        public static void Init()
        {
            if (_initialized)
            {
                return;
            }


            // Register our hotkeys.
            // Their input window isn't just MainWindowHandle, so we'll just quickly find the Wildstar <version> window that they create
            // And hook our hotkey stuff up to that.
            Hotkeys.Initialize(WindowInterop.GetWindowHandleByClassName(Memory.Process, "WildStar " + GameEngineConfig.GameProcessVersion.Revision));


            Patterns = new GameManagerPatterns(Memory);
            _cachedActors = new PerFrameCachedValue<List<Actor>>(Update);
            Lua = new GameLua();


            _initialized = true;
        }


        /// <summary>
        /// Only called from the per-frame-cache. No need to make this public!
        /// </summary>
        /// <returns></returns>
        private static List<Actor> Update()
        {
            // This is the only time we'll be null.
            // We want to force exceptions if the person is trying to access actors when not in game.
            if (GameMgrPtr == IntPtr.Zero)
                return null;


            // g_GameMgr->UnitsList->FirstUnit = Actor*
            // ActorList itself is one of their "search table" containers. The first unit is also stored at the end if the struct (0x14)
            var unitsPtr = Memory.Read<IntPtr>(GameMgrPtr + (int) Patterns.ActorList + 0x14);


            List<Actor> ret = new List<Actor>();
            if (unitsPtr == IntPtr.Zero)
            {
                // No actors. Return an empty list.
                // We're going with a never-null approach here, to avoid some shenanigans.
                return ret;
            }


            // Read in the linked list of actors
            Actor cur = new Actor(unitsPtr);
            while (cur != null)
            {
                // Re-dress the unit as a player.
                // TODO: Probably just read the actor type before creating the object.
                // But, we're being a bit lazy at the moment.
                // ActorType is at like actor+0x48 or something. I forget exactly. Simple enough to find.
                if (cur.ActorType == ActorType.Player)
                {
                    cur = new Player(cur.Address);
                }


                ret.Add(cur);


                // actor+0x4C = Actor*
                cur = cur.GetNextActor();
            }


            var lpAddr = Memory.Read<IntPtr>(GameMgrPtr + (int) Patterns.LocalPlayer);
            //Log.DebugOnly("Local Player PTR: " + lpAddr.ToString("X8"));


            // Update the local player if needed.
            if (LocalPlayer == null)
            {
                LocalPlayer = new Player(lpAddr);
            }
            else if (LocalPlayer.Address != lpAddr)
            {
                // TODO: INativeObject.UpdateAddress(lpAddr) to auto-flush all frame caches
                LocalPlayer = new Player(lpAddr);
            }
            return ret;
        }
    }
}

And some patterns

​        [Pattern("8B 0D ? ? ? ? 8B 04 B8 Add 2 Read32 DontRebase", Raw = true)]
        [Pattern64("48 89 1D ? ? ? ? 48 89 40 10 48 8B 83 ? ? ? ? Add 3 Read32 DontRebase", Raw=true)]
        public IntPtr GameManager; // 140A83920  20 39 A8 40 01


        [Pattern("8B 81 ? ? ? ? 85 C0 74 06 8B 80 ? ? ? ? 39 47 04 Add 2 Read32")]
        // Weird optimization in the compiler that causes it to use a single byte for the local player offset here.
        // Whatever, still works.
        [Pattern64("48 8B 50 ? 48 85 D2 75 10 48 8B 41 10 89 50 08 48 83 41 ? ? 8D 42 01 C3 E9 ? ? ? ? Add 3 Read8")]
        public long LocalPlayer;


        [Pattern("8D 89 ? ? ? ? E8 ? ? ? ? 85 C0 74 21 8B 10 Add 2 Read32")]
        [Pattern64("FF 96 ? ? ? ? 48 8B 9E ? ? ? ? 33 D2 48 8B F8 48 F7 B6 ? ? ? ? 48 8B 1C D3 48 85 DB 74 24 0F 1F 00 48 3B 3B 75 13 48 8D 53 10 48 8D 4C 24 ? FF 96 ? ? ? ? 85 C0 75 1B 48 8B 5B 08 Add 2 Read32")]
        public long ActorList;

[-Ryuk-]

Well, again, there's no "object manager" in Wildstar. There's a general Game Manager. It handles just about everything. (From Lua, to input, to actors, to networking) There just happens to be an Actor list in the game manager.

Either way, here's a copy/pasta of my older GameManager class (new one has stuff that I can't really show )

using System;using System.Collections.Generic;


using ApocDev.Common;
using ApocDev.Wildstar.Engine;
using ApocDev.Wildstar.Updates;


using GreyMagic;


using log4net;


namespace ApocDev.Wildstar.Game
{
    public class GameManager
    {
        private static readonly ILog Log = LogManager.GetLogger(typeof(GameManager));
        private static bool _initialized;
        private static PerFrameCachedValue<List<Actor>> _cachedActors;
        private static ExternalProcessMemory Memory { get { return GameEngine.AttachedProcess.Memory; } }
        internal static IntPtr GameMgrPtr { get { return Memory.Read<IntPtr>(Patterns.GameManager); } }


        /// <summary>
        /// A list of all available actors. This list is updated once per frame with new objects. Do not cache actor objects for more than 1 frame of execution.
        /// They are not guaranteed to be valid.
        /// </summary>
        public static List<Actor> Actors { get { return _cachedActors; } }
        /// <summary>
        /// The current local player actor. (Your actual player in-game)
        /// </summary>
        public static Player LocalPlayer { get; private set; }


        /// <summary>
        /// Returns an instance of <see cref="GameLua"/> for Lua snippets in-game. Also provides an Events API for you to also hook in-game Lua events from C#.
        /// </summary>
        public static GameLua Lua { get; private set; }


        /// <summary>
        /// Used from GameLua to grab the LuaState ptr. Since these patterns are specific to GameManager (as they're only valid when in-game)
        /// GameLua has patterns for the secondary Lua states for when out of game.
        /// </summary>
        internal static IntPtr LuaState
        {
            get
            {
                // Doing this because if we're not in game
                if (GameMgrPtr == IntPtr.Zero)
                {
                    return IntPtr.Zero;
                }
                var first = Memory.Read<IntPtr>(GameMgrPtr + (int) Patterns.LuaMgr);
                if (first == IntPtr.Zero)
                {
                    return IntPtr.Zero;
                }
                return Memory.Read<IntPtr>(first + (int) Patterns.LuaMgrLuaState);
            }
        }


        internal static GameManagerPatterns Patterns { get; set; }


        /// <summary>
        /// Initializes the GameManager. Subsequent calls will do nothing.
        /// </summary>
        public static void Init()
        {
            if (_initialized)
            {
                return;
            }


            // Register our hotkeys.
            // Their input window isn't just MainWindowHandle, so we'll just quickly find the Wildstar <version> window that they create
            // And hook our hotkey stuff up to that.
            Hotkeys.Initialize(WindowInterop.GetWindowHandleByClassName(Memory.Process, "WildStar " + GameEngineConfig.GameProcessVersion.Revision));


            Patterns = new GameManagerPatterns(Memory);
            _cachedActors = new PerFrameCachedValue<List<Actor>>(Update);
            Lua = new GameLua();


            _initialized = true;
        }


        /// <summary>
        /// Only called from the per-frame-cache. No need to make this public!
        /// </summary>
        /// <returns></returns>
        private static List<Actor> Update()
        {
            // This is the only time we'll be null.
            // We want to force exceptions if the person is trying to access actors when not in game.
            if (GameMgrPtr == IntPtr.Zero)
                return null;


            // g_GameMgr->UnitsList->FirstUnit = Actor*
            // ActorList itself is one of their "search table" containers. The first unit is also stored at the end if the struct (0x14)
            var unitsPtr = Memory.Read<IntPtr>(GameMgrPtr + (int) Patterns.ActorList + 0x14);


            List<Actor> ret = new List<Actor>();
            if (unitsPtr == IntPtr.Zero)
            {
                // No actors. Return an empty list.
                // We're going with a never-null approach here, to avoid some shenanigans.
                return ret;
            }


            // Read in the linked list of actors
            Actor cur = new Actor(unitsPtr);
            while (cur != null)
            {
                // Re-dress the unit as a player.
                // TODO: Probably just read the actor type before creating the object.
                // But, we're being a bit lazy at the moment.
                // ActorType is at like actor+0x48 or something. I forget exactly. Simple enough to find.
                if (cur.ActorType == ActorType.Player)
                {
                    cur = new Player(cur.Address);
                }


                ret.Add(cur);


                // actor+0x4C = Actor*
                cur = cur.GetNextActor();
            }


            var lpAddr = Memory.Read<IntPtr>(GameMgrPtr + (int) Patterns.LocalPlayer);
            //Log.DebugOnly("Local Player PTR: " + lpAddr.ToString("X8"));


            // Update the local player if needed.
            if (LocalPlayer == null)
            {
                LocalPlayer = new Player(lpAddr);
            }
            else if (LocalPlayer.Address != lpAddr)
            {
                // TODO: INativeObject.UpdateAddress(lpAddr) to auto-flush all frame caches
                LocalPlayer = new Player(lpAddr);
            }
            return ret;
        }
    }
}

And some patterns

​        [Pattern("8B 0D ? ? ? ? 8B 04 B8 Add 2 Read32 DontRebase", Raw = true)]
        [Pattern64("48 89 1D ? ? ? ? 48 89 40 10 48 8B 83 ? ? ? ? Add 3 Read32 DontRebase", Raw=true)]
        public IntPtr GameManager; // 140A83920  20 39 A8 40 01


        [Pattern("8B 81 ? ? ? ? 85 C0 74 06 8B 80 ? ? ? ? 39 47 04 Add 2 Read32")]
        // Weird optimization in the compiler that causes it to use a single byte for the local player offset here.
        // Whatever, still works.
        [Pattern64("48 8B 50 ? 48 85 D2 75 10 48 8B 41 10 89 50 08 48 83 41 ? ? 8D 42 01 C3 E9 ? ? ? ? Add 3 Read8")]
        public long LocalPlayer;


        [Pattern("8D 89 ? ? ? ? E8 ? ? ? ? 85 C0 74 21 8B 10 Add 2 Read32")]
        [Pattern64("FF 96 ? ? ? ? 48 8B 9E ? ? ? ? 33 D2 48 8B F8 48 F7 B6 ? ? ? ? 48 8B 1C D3 48 85 DB 74 24 0F 1F 00 48 3B 3B 75 13 48 8D 53 10 48 8D 4C 24 ? FF 96 ? ? ? ? 85 C0 75 1B 48 8B 5B 08 Add 2 Read32")]
        public long ActorList;

Could you share some some of you GameLua?

[Apoc]

It's just basic Lua. They just inline quite a few things so you need to deal with it specifically.

The only issue with Wildstar's Lua, is that at any given time, there's up to 5 or so active Lua states. Only one of them is used "in-game" so you need to get the correct one, or you don't have access to all the loaded libs.

[Master674]

It's just basic Lua. They just inline quite a few things so you need to deal with it specifically.

The only issue with Wildstar's Lua, is that at any given time, there's up to 5 or so active Lua states. Only one of them is used "in-game" so you need to get the correct one, or you don't have access to all the loaded libs.

There is also a "pre-game" pointer to the lua states before you're in the game world (char select screen etc).

[Apoc]

There is also a "pre-game" pointer to the lua states before you're in the game world (char select screen etc).

Not from what I've seen. They do have a func that does what is basically a "does this lua_State exist in our state list?". But I actually haven't found the pre-game state pointer at the moment either.

Then again, I've only looked for it during the login screen. (Laziness really)

[Master674]

Not from what I've seen. They do have a func that does what is basically a "does this lua_State exist in our state list?". But I actually haven't found the pre-game state pointer at the moment either.

Then again, I've only looked for it during the login screen. (Laziness really)

Take a look at the function that contains the unicode string pregamereloadui.

[Akaike]

@Midi12: Thank you very much for your pseudo code but I already tried something like that but still without success ...

@Apoc:
Wow, thank you very, very much for sharing your code it helped me a little bit and but I'm still a noob in this subject and I never worked with patterns before. As I see you use the x32 bit client version to reverse everything, right?

I got an idea how my object manager could be but now I have the problem that swichting to the next object is too slow or maybe I just have wrong addresses. Sometimes it doesn't switch to the next object and it's just depends on luck if it finds the current id from the player's target.

By the way again, I use the x64 bit client but I already tried it with the x86 too.

The addresses for the x86 clients which I found are:
"WildStar64.exe"+008577A8 + 3c // for local player
"WildStar64.exe"+008577A8 + 5d18 // for a random unit or first unit, I'm not sure.
"WildStar64.exe"+008577A8 + 5d18 + 54 //for the next unit?

My code looks like that now:

curObj = ProcessReader.readUInt((long)ProcessReader.readUInt64((long)ProcessReader.base_adress + 0xA85920) + 0x73e8);

if (id != objects.Length)
{
if (objects[id] != curObj && curObj != 0)
{

if (id == 0)
 {
 objects[id] = curObj;

 id++;

 }
 else if (id != 0 && objects[id - 1] != curObj)
 {
 objects[id] = curObj;

 id++;

 }

ProcessReader.readUInt((long)ProcessReader.readUInt64((long)ProcessReader.readUInt64((long)ProcessReader.base_adress + 0xA85920) + 0x73e8) + 0x78); 
// I'm not sure if this is the correct offset for the next unit but it shows another unit than (base_adress + 0xA85920) + 0x73e8

 }
 }

Thank you very much again for sharing and your help, I hope you can give me a few more tips .

[Apoc]

Erm, yeah. I do most of my reversing on x86. But that code works for both x86 and x64.

That's why I use IntPtr instead of uint/ulong to represent pointers.

Also; that first actor in the list, is just the first actor in the list. It's a linked list, each actor contains an pointer to the next actor. (The final one will have a "Next" pointer of 0)

[Apoc]

Take a look at the function that contains the unicode string pregamereloadui.

Good call.

I'll add patterns for it. Thanks

[Akaike]

Hm, okay. Now my only problem is to find the pointer to the next actor. At the moment my addresses maybe are wrong, they switch very slow automatically.

// actor+0x4C = Actor* <- This is what you use? 4c for the next unit?



Thank you very much in advance!

[Apoc]

Hm, okay. Now my only problem is to find the pointer to the next actor. At the moment my addresses maybe are wrong, they switch very slow automatically.

// actor+0x4C = Actor* <- This is what you use? 4c for the next unit?



Thank you very much in advance!

Reverse the game a little. It's all there.

[Akaike]

I think now I'm on the right way to find what I need . Thank you again.

[psior]

Hm, okay. Now my only problem is to find the pointer to the next actor. At the moment my addresses maybe are wrong, they switch very slow automatically.

// actor+0x4C = Actor* <- This is what you use? 4c for the next unit?

Thank you very much in advance!

This is snippet of code I used to find it:

WildStar64.exe+335CAE - 8B9F E8 730000 - xorps rbx,[rdi+000073E8] <---offset to the start of the list
WildStar64.exe+335CB5 - 48 85 DB - test rbx,rbx
WildStar64.exe+335CB8 - 74 59 - je WildStar64.exe+335D13
WildStar64.exe+335CBA - 66 0F1F 44 00 00 - nop [rax+rax+00]
WildStar64.exe+335CC0 - 41 8B D6 - mov edx,r14d
WildStar64.exe+335CC3 - 48 8B CB - mov rcx,rbx
WildStar64.exe+335CC6 - E8 75771A00 - call WildStar64.exe+4DD440
WildStar64.exe+335CCB - 4C 39 AB 380F0000 - cmp [rbx+00000F38],r13
WildStar64.exe+335CD2 - 75 36 - jne WildStar64.exe+335D0A
WildStar64.exe+335CD4 - 48 8D 8F F0730000 - lea rcx,[rdi+000073F0]
WildStar64.exe+335CDB - 4C 39 AB 80000000 - cmp [rbx+00000080],r13
WildStar64.exe+335CE2 - 75 26 - jne WildStar64.exe+335D0A
WildStar64.exe+335CE4 - 48 89 8B 80000000 - mov [rbx+00000080],rcx
WildStar64.exe+335CEB - 48 8B 01 - mov rax,[rcx]
WildStar64.exe+335CEE - 48 8D 93 88000000 - lea rdx,[rbx+00000088]
WildStar64.exe+335CF5 - 48 89 02 - mov [rdx],rax
WildStar64.exe+335CF8 - 48 89 19 - mov [rcx],rbx
WildStar64.exe+335CFB - 48 8B 02 - mov rax,[rdx]
WildStar64.exe+335CFE - 48 85 C0 - test rax,rax
WildStar64.exe+335D01 - 74 07 - je WildStar64.exe+335D0A
WildStar64.exe+335D03 - 48 89 90 80000000 - mov [rax+00000080],rdx
WildStar64.exe+335D0A - 48 8B 5B 78 - mov rbx,[rbx+78] <-- next object

rdi contains the address of the "Game Manager" in the above code, it iterates the list by reading 0x78 into each structure for the pointer