[Retail] v11.0.7 59207 Offsets

[Razzue]

qword_41fca80 is the CameraPtr, right?

All the code is provided above... Use your eyes and the mac offsets. 🙄

[Archos]

What I am saying is I got to the same point you did....

[Razzue]

What I am saying is I got to the same point you did....

No.. no you did not. There is a significant difference between *(float*)(*(IntPtr*)(*(IntPtr*)(Game + Offset1) + Offset2) + ZoomField) and Offset1 + Offset2 + FieldValue = RandomOffsetThatMakesNoSense

[Sweann]

qword_41fca80 is the CameraPtr, right?

Yes, but this is a pointer so you have to read the value and add the offset to that value, as Razzue wrote and gave example.

[Sweann]

`0x41FCA80 + 0x470 + 025C` = 0x41FD14C

Meaning our camera zoom value is at 0x41FD14C.

Read value form game base address + 0x41FCA80 and after that value add 0x470 is the camera ptr, after this address you can add 0x25c which is the zoom value memory location.

[Jinsett]

Ok, so let me set the record straight and clarify a few things here, since you guys are actually trying to help, and I don't want to be an ungrateful PoS.

What I was basically interested in was where the game stores the camera object, not the zoom value. The object that has things like view matrix/xyz/fov, etc, that are writable. I wanted to modify these values via WPM, externally. What I thought the camera object was, is being stored at some 0x3000-something offset from the camera manager base. Is my assumption correct (otherwise why do people constantly list this 0x3*** offset every dump)? My key issue was being able to locate it. Sweann gave me an advice to search for where it's being registered via referencing GetCameraZoom string, which made sense on paper. However, when I was trying to x-ref the dispatch table, things looked the following way in my IDA:

dispatch_table_xref.png

I get no function references, only .data and .pdata sections, which are of no use. The dispatch table pointer itself, however, does seem to be used in some kind of AoE-register function, that iterates over the entire table and does something with it in some way. Can't tell what's happening since it's heavily obfuscated. But I don't see any clean string references, and no '0x3870' offsets, or anything like that. So, am I looking in the right direction in the first place, with my original goal of being able to fiddle with the camera object? If not, what are the ways you guys go to work with the camera programmatically, writing to the angles/matrix, etc.? A bit confused here.

Thanks in advance.

[scizzydo]

Ok, so let me set the record straight and clarify a few things here, since you guys are actually trying to help, and I don't want to be an ungrateful PoS.

What I was basically interested in was where the game stores the camera object, not the zoom value. The object that has things like view matrix/xyz/fov, etc, that are writable. I wanted to modify these values via WPM, externally. What I thought the camera object was, is being stored at some 0x3000-something offset from the camera manager base. Is my assumption correct (otherwise why do people constantly list this 0x3*** offset every dump)? My key issue was being able to locate it. Sweann gave me an advice to search for where it's being registered via referencing GetCameraZoom string, which made sense on paper. However, when I was trying to x-ref the dispatch table, things looked the following way in my IDA:

dispatch_table_xref.png

I get no function references, only .data and .pdata sections, which are of no use. The dispatch table pointer itself, however, does seem to be used in some kind of AoE-register function, that iterates over the entire table and does something with it in some way. Can't tell what's happening since it's heavily obfuscated. But I don't see any clean string references, and no '0x3870' offsets, or anything like that. So, am I looking in the right direction in the first place, with my original goal of being able to fiddle with the camera object? If not, what are the ways you guys go to work with the camera programmatically, writing to the angles/matrix, etc.? A bit confused here.

Thanks in advance.

Your screenshot there is the function to look at. You then go into it, and look at the code inside the function. You will then get the base and offset from there to the camera data you want

[Sweann]

But I don't see any clean string references, and no '0x3870' offsets, or anything like that. .

Archos example screenshot showed everything what we are talinkg about, there is that value 0x470 (retail i guess), but what you searching 0x3870 is an old value for a different version.
With the camera zoom value you can make sure yourself that is the pointer for camper object.

[Jinsett]

Ok, I'm fucking retarded. I just checked the 59207 version and got that exact same offset that has been posted on the first page. Thank you guys so much for your patience. It just changed from the 0x3A58 to the 0x478. And it's just being referenced from the GetActiveCamera function (compared it to the WoD with the debug symbols). No miracles here. On the off-note. Do I have to change the page protection to write to these values? Is that considered a safe practice? Otherwise everything I write to the fields doesn't seem to budge (talking about viewmatrix. Zoom, FoV, etc. work fine)

Edit: ok it seems like pitch/yaw is somewhere at 0x140, etc. And they're writable