[Question] What method do you use to find static Z address?

[Tanaris4]

I've noticed in the white paper it shows 2 different methods for determining the base player address. It also (I believe) has the static Z address and then loops through memory until it finds the player w/that exact Z coordinate - then you have the current player address.

My question - if you don't already have the static Z address - how do you find it?

I"m familiar w/using IDA Pro, assembly, and checking out memory - but I'm just stumped as how you find the original Z address.

Any help would be greatly appreciated (note: don't flame... I know... yet another right? I'm trying to do this on a mac - which has different addresses so I can't use the static Z address). I've found the static MAP ID for the player on a mac (unfortunately like 10 addresses, haven't narrowed it down further). But I'm not certain how to find Z.

Thanks!

[Shynd]

Search unknown; get on a table, search increased; get off of the table, search decreased; repeat.

[argh44z]

I'd just find the address of the g_clientConnection global variable inside of the OSX binary. Should be pretty easy to do with IDA (begin by looking for ".\\ObjectMgrClient.cpp" in the string list, and then view the xrefs to it). From there, you can find the address of the object manager inside of the clientconnection stucture. That will give you the current player GUID and the object list.

Can you upload the current OSX wow binary somewhere btw?

[Tanaris4]

It's been uploaded here:
RapidShare: Easy Filehosting

Still attempting to find it in IDA Pro - unable to find it. Hopefully it uses the same source tree as the windows version.

Edit: The app is here: World of Warcraft.app\Contents\MacOS\World of Warcraft

Edit: I lied - found it :-) db './ObjectMgrClient/ObjectMgrClient.cpp',0

Still trying to get to the static Z address - will post updates if/when I find it

[argh44z]

That's not it-- that's just a string that gets passed into a logging or assert function (the OSX client seems to be like the win32 PTR client in terms of coming with the asserts and such-- very useful).

What you are looking for is 0x00B6D1BC. That's g_currentConnection. Jump to that address and look at the xrefs. There are many instances of it checking to see if that variable is NULL.

[Tanaris4]

How did you go from getting the xrefs of g_clientConnection to finding 0x00B6D1BC - think I'm missing a next step here

Not sure how you found the sub_1A99CA func either