3.0.2 Addresses

[RoKFenris]

I am working on updating my project and already found some 3.0.2 addresses. Since I haven't seen anyone posting them, here they are:

Targetting:
0x010A38A0 : Mouseover GUID
0x010A38B0 : Target GUID
0x010A38B8 : Last Target GUID
0x010A38D0 : Focus GUID

Factions:
0X00FCCB6C : Index of the last faction
0x00FCCB70 : Index of the first faction
0x00FCCB80 : Pointer for the faction array

0x011C8248 : g_clientConnection
[g_clientConnection] + 0x285C : objMgr

0x011AC3B8 + 0x8 : Player name database

0x012DF9E4 : Static X
0x012DF9E8 : Static Y
0x012DF9EC : Static Z

Some other offsets have also changed:

Offsets for the base address:
UnitFields : 0x108 (was 0x120)
X : 0x7d0
Y : 0x7d4
Z : 0x7d8
Heading : 0x7dc
Mob name : [ [currObj + 0x9b0] + 0x03c]
Object name: [ [currObj + 0x1f4] + 0x078 ]

Offsets for UnitFields:
Health : 0x44
Power1 : 0x48
MaxHealth : 0x64
MaxPower1 : 0x68
Level : 0xbc
Faction : 0xc0

Offsets for ObjectFields:
The unit type is now a byte inside GAMEOBJECT_BYTES_1. It's offset is 0x045.

Edit: added a little more information.

[Nesox]

oh, nice ive got some up my sleeves too

ZoneID: 0x10A2230
MapID: 0x009BA384
Player Name: 0x011C8280

[Cursed]

Having a problem updating atm...
Could someone post kynox's offsetdumper result?

[UnknOwned]

Seem like the PB structure is the same as it was throughout wrath- alpha and beta. Quite confusing with all the pointers leading to "playerbase" now, and the fact that its changed from direct pointer to multi-level.

Little tiny bit more work for each update.

[Xarg0]

I'll post the offset dumpers result as soon as my WoW Update is finsihed, but my ADSL1000 is as slow as a snail.

[UnknOwned]

Finally... 8 minutes to run my script without "World Server Down".

I got all pointers that I use.
Anyway, for "playerbase" they changed the link for the 2nd pointer but its still a 3 level deep

[Dearleader]

Anyone figure out how to get objMgr from TLS index yet?

[Xarg0]

I'm still downloading the patch >.<

[kynox]

Anyone figure out how to get objMgr from TLS index yet?

You enumate the TLS on the Main WoW thread and get the variable at the index. OR, use g_ConnectionMgr.

[Cypher]

Heads ups:
The g_ConnectionMgr offset has changedto 285Ch as seen here:

loc_46FB99:
mov     ecx, TlsIndex
mov     edx, large fs:2Ch
mov     esi, [edx+ecx*4]
mov     ecx, ClientServices__ClientConnection
mov     [ecx+285Ch], eax
mov     edx, ClientServices__ClientConnection
mov     [esi+8], eax
mov     [eax+0D0h], edx
call    sub_46FAE0
mov     eax, [esi+8]
mov     [eax+0CCh], edi
pop     edi
pop     esi
pop     ebp
retn
CObjectMgr__CreateObjectMgr endp

Descriptor dumpers will need a small update to work again due to some function offset changes. I have fixed my dumper and posted a corrected one in the other thread.

[kynox]

As posted by the OP:

0x011C8248 : g_clientConnection
[g_clientConnection] + 0x285C : objMgr

fffffail Cypher :>

[Dearleader]

As posted by the OP:



fffffail Cypher :>

Cyphers green text makes his better!

[Cypher]

As posted by the OP:



fffffail Cypher :>

NOU.

I quote from the great kynox:
"That would be like finding an atom in a universe" <-- MEGA FAIL.

[Nesox]

or u can get it this way but u have to update the offset each patch

Process.EnterDebugMode();

 hProcess = Memory.OpenProcess(Memory.GetProcessIdByProcessName("wow.exe"));

WoWObjectManager ObjectManager = new WoWObjectManager();

ObjectManager.CodeAddress = dwFindPattern(hProcess, 0x400000, 0x600000,
            "EB 02 33 C0 8B 0D 00 00 00 00 64 8B 15 00 00 00 00 8B 34 8A 8B 0D 00 00 00 00 89 81 00 00 00 00",
            "xxxxxx????xxx????xxxxx????xx????");
            if (ObjectManager.CodeAddress == uint.MaxValue)
                throw new Exception("Could not find game routine from which we get the g_clientConnection pointer.");

            ObjectManager.g_clientConnection = Memory.ReadUInt(hProcess, (ObjectManager.CodeAddress + 0x16));
            ObjectManager.s_curMgr = Memory.ReadUInt(hProcess, (ObjectManager.g_clientConnection) + 0x285C);

[Cypher]

Errr. Thats exactly the way we're talking about Nesox.

Both the OP and I posted it.