THANKS! and another question! hostile/friendly/neutral

[ShoniShilent]

thanks for posting this information, shynd. i have read your info and the stuff at those links but unfortunately have no good way to get ahold of the offsets. i don't see where you posted how you obtained the offsets to begin with. i am so glad you are still posting here, however, and i appreciate your responses here. i feel i could work out some code on my own if i had the new offsets, i.e.:

int startIndex = *0x93E80C;
DWORD factionPointer = *0×93E818;
DWORD totalFactions = *0×93E808;
DWORD hash1, hash2;

however, it might be just as quick for me to make a program that sucks the data out of the FactionTemplate.DBC and makes a small file that is read into my bot program that could be referenced quickly through an array search, etc.

however, i'd like to revisit shynd's code if someone is using this and has updated the code for 3.0.3.

[Shynd]

You'll have to reverse the GetUnitRelation function (I believe there's an address for that function floating around in one of the offset threads) to get the new DBC pointers. Shouldn't be too hard to find.

[ShoniShilent]

also, thank you Unknowned for the posting of the images and the database info. i understand more clearly now how the data is stored and how to read it, etc.

so there is a way to get to this list while in the game and do you know of a pointer that points to this list? or should i make a database file that contains it all and have it load at runtime?

very nice info! this is the sort of stuff i been needing to see and understand-

if i use a tool to get into the .mpq files, which one(s) hold this data? i have all expansions (burning legion and lich king) installed...

is there something that is available that we can use to unpack or pull out these files? a mpq file tool? i did a quick search for stormlib.dll but it seems to be tied to glider?

[ShoniShilent]

You'll have to reverse the GetUnitRelation function (I believe there's an address for that function floating around in one of the offset threads) to get the new DBC pointers. Shouldn't be too hard to find.

would those pointers point to the data Unknowned is talking about here?

also, that function will have in it the address for number of factions, and then the pointer to the actual factions location of this data?

the reason i am asking is because i attached ollydbg and looked at this last night but i didn't see any static pointer addresses within that function that appeared to point to anything that i saw that resembled this data shown here in that .dbc listing. maybe i am confusing the two methods at this point?

i'll try to chase down that LUA function location somebody posted earlier and see if i can parse through it to find any static pointers that correlate to your example code you gave-

[ShoniShilent]

ok,



FOUND THIS FUNCTION CODE AREA WHICH AT 564445:

00564430 /. 55 PUSH EBP
00564431 |. 8BEC MOV EBP,ESP
00564433 |. 51 PUSH ECX
00564434 |. 56 PUSH ESI
00564435 |. 8B75 08 MOV ESI,[ARG.1]
00564438 |. 6A 01 PUSH 1 ; /Arg2 = 00000001
0056443A |. 56 PUSH ESI ; |Arg1
0056443B |. E8 D0922400 CALL WoW.007AD710 ; \WoW.007AD710
00564440 |. 83C4 08 ADD ESP,8
00564443 |. 85C0 TEST EAX,EAX
00564445 |. 74 7C JE SHORT WoW.005644C3


JUMPS TO HERE:


005644C3 |> \68 20009600 PUSH WoW.00960020 ; /Arg2 = 00960020 ASCII "Usage: UnitReaction("unit", "otherUnit")"
005644C8 |. 56 PUSH ESI ; |Arg1
005644C9 |. E8 12AA2400 CALL WoW.007AEEE0 ; \WoW.007AEEE0
005644CE |. 83C4 08 ADD ESP,8
005644D1 |. 33C0 XOR EAX,EAX
005644D3 |. 5E POP ESI
005644D4 |. 8BE5 MOV ESP,EBP
005644D6 |. 5D POP EBP
005644D7 \. C3 RETN



and just above the code location at 564445:

i see the folling code:

0056437E |> \3BC3 CMP EAX,EBX
00564380 |.^ 0F84 3BFFFFFF JE WoW.005642C1
00564386 |. 8B0D 90EBFC00 MOV ECX,DWORD PTR DS:[FCEB90]
0056438C |. 3BC1 CMP EAX,ECX
0056438E |.^ 0F8C 2DFFFFFF JL WoW.005642C1
00564394 |. 3B05 8CEBFC00 CMP EAX,DWORD PTR DS:[FCEB8C]
0056439A |.^ 0F8F 21FFFFFF JG WoW.005642C1
005643A0 |. 2BC1 SUB EAX,ECX
005643A2 |. 8B0D A0EBFC00 MOV ECX,DWORD PTR DS:[FCEBA0]
005643A8 |. 8B0481 MOV EAX,DWORD PTR DS:[ECX+EAX*4]

could 0fceb90 = player factionid ?
and fceb8c = max factions
and fceba0 = start of the factions list Unknowned is talking about?

005643A2 |. 8B0D A0EBFC00 MOV ECX,DWORD PTR DS:[FCEBA0]

fceba0 points to (on my machine): 03928FB0

and reading from [03928FB0] points to:

03928FB0 28 92 B9 03

which is 03b99228

which appears to be the location of the data discussed in Unknowned's posting:

which appears as:

03B99228 01 00 00 00 01 00 00 00 48 00 00 00 03 00 00 00
...
...H......
03B99238 02 00 00 00 0C 00 00 00 00 00 00 00 00 00 00 00 ...............
03B99248 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99258 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 ..............
03B99268 48 00 00 00 05 00 00 00 04 00 00 00 0A 00 00 00 H.............
03B99278 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99288 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99298 03 00 00 00 03 00 00 00 48 00 00 00 03 00 00 00 ......H......
03B992A8 02 00 00 00 0C 00 00 00 00 00 00 00 00 00 00 00 ...............
03B992B8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B992C8 00 00 00 00 00 00 00 00 04 00 00 00 04 00 00 00 ..............
03B992D8 48 00 00 00 03 00 00 00 02 00 00 00 0C 00 00 00 H.............
03B992E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B992F8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99308 05 00 00 00 05 00 00 00 48 00 00 00 05 00 00 00 ......H......
03B99318 04 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ...............
03B99328 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99338 00 00 00 00 00 00 00 00 06 00 00 00 06 00 00 00 ..............
03B99348 48 00 00 00 05 00 00 00 04 00 00 00 0A 00 00 00 H.............
03B99358 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99368 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99378 07 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 ..............
03B99388 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99398 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B993A8 00 00 00 00 00 00 00 00 0A 00 00 00 28 00 00 00 ............(...

you can clearly see the hex 48 at location(s) 3b99230 and 3b99268 which correspond to the '72' in the list from the DBC, etc.
however, i need to know of a way to convert 4 bytes 00 00 00 03 (or '3') into bit mask such as 0011 in the same list
(or 00 00 00 0c to 1100, etc.). it appears each faction record is 56 bytes long (or 14 LONGS)

i think i am on to this at this point, but need a help to deal with flags or bitmasks so i can break this data down from it's LONG form into a bit pattern mask.

does this seem like i am getting there? any more help? any ideas how to 'check' the data to convert to bitmask (i.e. 0011 instead of 0x00000003)

i posted all of this because i didn't want people to think i am a total leech or didn't try to do some of this work on my own. thanks again for the help to this point and i look for more responses, ideas, help-

[UnknOwned]

ok,



FOUND THIS FUNCTION CODE AREA WHICH AT 564445:

00564430 /. 55 PUSH EBP
00564431 |. 8BEC MOV EBP,ESP
00564433 |. 51 PUSH ECX
00564434 |. 56 PUSH ESI
00564435 |. 8B75 08 MOV ESI,[ARG.1]
00564438 |. 6A 01 PUSH 1 ; /Arg2 = 00000001
0056443A |. 56 PUSH ESI ; |Arg1
0056443B |. E8 D0922400 CALL WoW.007AD710 ; \WoW.007AD710
00564440 |. 83C4 08 ADD ESP,8
00564443 |. 85C0 TEST EAX,EAX
00564445 |. 74 7C JE SHORT WoW.005644C3


JUMPS TO HERE:


005644C3 |> \68 20009600 PUSH WoW.00960020 ; /Arg2 = 00960020 ASCII "Usage: UnitReaction("unit", "otherUnit")"
005644C8 |. 56 PUSH ESI ; |Arg1
005644C9 |. E8 12AA2400 CALL WoW.007AEEE0 ; \WoW.007AEEE0
005644CE |. 83C4 08 ADD ESP,8
005644D1 |. 33C0 XOR EAX,EAX
005644D3 |. 5E POP ESI
005644D4 |. 8BE5 MOV ESP,EBP
005644D6 |. 5D POP EBP
005644D7 \. C3 RETN



and just above the code location at 564445:

i see the folling code:

0056437E |> \3BC3 CMP EAX,EBX
00564380 |.^ 0F84 3BFFFFFF JE WoW.005642C1
00564386 |. 8B0D 90EBFC00 MOV ECX,DWORD PTR DS:[FCEB90]
0056438C |. 3BC1 CMP EAX,ECX
0056438E |.^ 0F8C 2DFFFFFF JL WoW.005642C1
00564394 |. 3B05 8CEBFC00 CMP EAX,DWORD PTR DS:[FCEB8C]
0056439A |.^ 0F8F 21FFFFFF JG WoW.005642C1
005643A0 |. 2BC1 SUB EAX,ECX
005643A2 |. 8B0D A0EBFC00 MOV ECX,DWORD PTR DS:[FCEBA0]
005643A8 |. 8B0481 MOV EAX,DWORD PTR DS:[ECX+EAX*4]

could 0fceb90 = player factionid ?
and fceb8c = max factions
and fceba0 = start of the factions list Unknowned is talking about?

005643A2 |. 8B0D A0EBFC00 MOV ECX,DWORD PTR DS:[FCEBA0]

fceba0 points to (on my machine): 03928FB0

and reading from [03928FB0] points to:

03928FB0 28 92 B9 03

which is 03b99228

which appears to be the location of the data discussed in Unknowned's posting:

which appears as:

03B99228 01 00 00 00 01 00 00 00 48 00 00 00 03 00 00 00
...
...H......
03B99238 02 00 00 00 0C 00 00 00 00 00 00 00 00 00 00 00 ...............
03B99248 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99258 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 ..............
03B99268 48 00 00 00 05 00 00 00 04 00 00 00 0A 00 00 00 H.............
03B99278 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99288 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99298 03 00 00 00 03 00 00 00 48 00 00 00 03 00 00 00 ......H......
03B992A8 02 00 00 00 0C 00 00 00 00 00 00 00 00 00 00 00 ...............
03B992B8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B992C8 00 00 00 00 00 00 00 00 04 00 00 00 04 00 00 00 ..............
03B992D8 48 00 00 00 03 00 00 00 02 00 00 00 0C 00 00 00 H.............
03B992E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B992F8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99308 05 00 00 00 05 00 00 00 48 00 00 00 05 00 00 00 ......H......
03B99318 04 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 ...............
03B99328 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99338 00 00 00 00 00 00 00 00 06 00 00 00 06 00 00 00 ..............
03B99348 48 00 00 00 05 00 00 00 04 00 00 00 0A 00 00 00 H.............
03B99358 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99368 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99378 07 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 ..............
03B99388 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B99398 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B993A8 00 00 00 00 00 00 00 00 0A 00 00 00 28 00 00 00 ............(...

you can clearly see the hex 48 at location(s) 3b99230 and 3b99268 which correspond to the '72' in the list from the DBC, etc.
however, i need to know of a way to convert 4 bytes 00 00 00 03 (or '3') into bit mask such as 0011 in the same list
(or 00 00 00 0c to 1100, etc.). it appears each faction record is 56 bytes long (or 14 LONGS)

i think i am on to this at this point, but need a help to deal with flags or bitmasks so i can break this data down from it's LONG form into a bit pattern mask.

does this seem like i am getting there? any more help? any ideas how to 'check' the data to convert to bitmask (i.e. 0011 instead of 0x00000003)

i posted all of this because i didn't want people to think i am a total leech or didn't try to do some of this work on my own. thanks again for the help to this point and i look for more responses, ideas, help-

To use Rep Factions properly you will need to convert them into FactionTemplate since factionID 72 = Ogres, while the 72 you are looking at there is Stormwind.
Think of it as Faction.DBC being the main definition of the Factions while FactionTemplate.DBC being the definition of Sub Factions.

Again taking the Elwyn Forest wolfs into consideration
In Faction.DBC, Beast-Wolf only exsist once since its just the definition of that faction.
While in FactionTemplate Beast-Wolf is refrenced many times, these subfactions have diffrent behaviour when you take Hosility and Friendlyness into consideration.

[ShoniShilent]

first of all, thanks to those who responded in here and for taking it easy on me while i kept asking for more information. i appreciate all of the responses.

i just wanted to post what i have done to this point and to report that (for now and the regions where i am testing this at) it seems to work. i hope this will help somebody. also, if someone sees potential problems or something wrong with what i am doing, then please report.

you need to gather a bit of information first.

1) right at the beginning of my bot program, i gather into an array the values of the FactionID data for the following:

Dim FactionSupport(5000)
Dim FactionFriend(5000)
Dim FactionHostile(5000)

i do this by gathering some initial data by using the following static addresses:

MaxFactionIdAddress=$fceb8c
FactionIdPointerAddress=$fceba0

getting the value at ($fceb8c) gives me the total number of factionID's, or MaxFactionID.

the value at ($fceba0) is the starting point to the pointers to each FactionID's data or FactionIDPointerBaseAddress.

i have a loop that goes from 1 to MaxFactionID gathering the pointers to each FactionID's data and stores them.

use your own programming language but basically:

for i = 1 to MaxFactionID

read memory type LONG (4 bytes pointer) at FactionIDPointerBaseAddress + ((i-1) * 4)

which we will call PointerValue and then read memory (4 bytes LONG pointer) at that location (read the memory at (PointerValue) to get the FactionID data base for that FactionID)

which we will call CurrentBase

then read three LONG values from CurrentBase at the following locations and store them in the array:

FactionSupport(i) = memory read LONG at (CurrentBase + (3 * 4))
FactionFriend(i) = memory read LONG at (CurrentBase + (4 * 4))
FactionHostile(i) = memory read LONG at (CurrentBase + (5 * 4))


these correspond to the values 03 00 00 00, 02 00 00 00, and 0C 00 00 00:

03B99228 01 00 00 00 01 00 00 00 48 00 00 00 03 00 00 00
...
...H......
03B99238 02 00 00 00 0C 00 00 00 00 00 00 00 00 00 00 00 ...............

that you see in the previous posts above.

next i

this will load the arrays,

FactionSupport(x)
FactionFriend(x)
FactionHostile(x)

with the bit mask data you saw in the above posts.

2) during your Object Linked List Loop, gather the FactionID value for your player:

PlayerFactionID = [[PlayerBase + 0x08] + 0x36 * 4]

3) use the following to determine the hostility of the Mob (you will use the MobBase of each Mob as you iterate through the Linked List Loop) by utilizing the Faction Arrays we created above:

MobFactionID = [[MobBase + 0x08] + 0x36 * 4]

if FactionHostile(MobFactionID ) = 0 (i.e. bitmask is 0000) then object is neutral

if FactionHostile(MobFactionID) & 1 (i.e. right bit of bitmask is 1, for instance 0001 or 0101 or 0011 which corresponds to the fact that this unit is hostile to both alliance and horde) then object is hostile. (the & is a Bitwise AND Operator action)

if FactionHostile(MobFactionID) & FactionFriend(PlayerFactionID) (i.e. we are checking to see if the hostile bit mask of the MOB has any matches to the friend bit mask of the PLAYER using the Bitwise AND Operator again) then object is hostile. (for instance if the MOB hostile bit mask is 1010 and the PLAYER friend bitmask is 0010 then the MOB is hostile, while a hostile bit mask is 1100 and the PLAYER friend bitmask is 0010 would not coincide and the MOB would be friendly to the PLAYER)

otherwise, i have the Mob as friendly

this seems to work well for me for displaying the correct colors for each MOB on my radar and for determining who to attack if the bot is doing MOB grinding, etc.

i hope this helps. thanks again to all who helped.

i am still looking into trying to gather the HUMAN PLAYER names so i can label them in the radar like i have objects and MOBS labelled. any help in giving me some base locations similar to what i did here for the hostility would be appreciated-

[Cypher]

I just wanted to say:
tldr.

Function calls ftw.

[UnknOwned]

1) right at the beginning of my bot program, i gather into an array the values of the FactionID data for the following:

Dim FactionSupport(5000)
Dim FactionFriend(5000)
Dim FactionHostile(5000)
...

Unless you know that you are going to use exactly 5000 instances in the arrays it is good manners to use:

Dim FactionSupport(1)
Dim FactionFriend(1)
Dim FactionHostile(1)

And expand it with _ArrayAdd
because of: Overkill, Exceed, Ubound(), etc....

[Cypher]

Unless you know that you are going to use exactly 5000 instances in the arrays it is good manners to use:

Dim FactionSupport(1)
Dim FactionFriend(1)
Dim FactionHostile(1)

And expand it with _ArrayAdd
because of: Overkill, Exceed, Ubound(), etc....

I don't know how AutoIt works. But thats technically incorrect from a performance point of view.

Whilst you're right that you don't want to over allocate, you don't want to under allocate either. This is important. Memory management has a very high overhead, futhermore, lots of small allocations will cause fragmentation of memory. You're better off doing what the C++ STL containers do (they were programmed by the experts, best in the field, to be fast and efficient), ie allocating a chunk of memory to begin with, then every time you run out, allocate twice as much. You're better off with some 'wasted' space than you are doing constant allocations.

[ShoniShilent]

i don't mean to sound rude, but WTF is AutoIt? people keep bringing that name up on alot of postings, and alot of MY postings. I am programming with a full fledged language and calling Windows API's. my code is completely converted to full assembly language after compilation. Also this:

I just wanted to say:
tldr.

Function calls ftw.

means absolutely nothing to me. If you are saying something positive then thanks. If you are cutting me down then i don't get the joke and perhaps that makes it more funny to you..?!?

I appreciate all the help and postings. I honestly do. I didn't put 1000's of hours into my bot like many here did and I am appreciative of all the hours saved from those who know more and pioneered all of the prelim work. However, some of this posturing and flexing of muscles is beyond me. I am not using the built-in code within the wow.exe to do my botting, but that doesn't make my efforts somehow 'wrong'. i don't want my characters or anyone else who uses the bot to get into trouble from some stupid injection or code mistake. Now if you want to show me a quick way to disable WARDEN, then I'll attach debuggers at runtime and breakpoint and reverse all day without fear. But I spent literally full DAYS playing with my toons to get them to their respective levels and I don't want to get my account banned. I already had some close calls so I know the dangers are real.

regarding the bounds of the DIM arrays, thanks for the suggestion! The number of FactionID's (MaxFactionID) seems to be static and you can determine this even before logging in by reading from that static address i posted earlier. It seems to be about 2000 something (I don't remember exactly). I just did a hard check in the code to set it to 1 if it was less than 1 and set it to MaxFactionID if it was greater than MaxFactionID. I just over-allocated enough space as Cypher stated.

Once again, I hope I helped here by posting what I discovered and how I utilized the info people kindly posted here.

thanks again!

[Cypher]

i don't mean to sound rude, but WTF is AutoIt? people keep bringing that name up on alot of postings, and alot of MY postings. I am programming with a full fledged language and calling Windows API's. my code is completely converted to full assembly language after compilation. Also this:

I just wanted to say:
tldr.

Function calls ftw.

means absolutely nothing to me. If you are saying something positive then thanks. If you are cutting me down then i don't get the joke and perhaps that makes it more funny to you..?!?

I appreciate all the help and postings. I honestly do. I didn't put 1000's of hours into my bot like many here did and I am appreciative of all the hours saved from those who know more and pioneered all of the prelim work. However, some of this posturing and flexing of muscles is beyond me. I am not using the built-in code within the wow.exe to do my botting, but that doesn't make my efforts somehow 'wrong'. i don't want my characters or anyone else who uses the bot to get into trouble from some stupid injection or code mistake. Now if you want to show me a quick way to disable WARDEN, then I'll attach debuggers at runtime and breakpoint and reverse all day without fear. But I spent literally full DAYS playing with my toons to get them to their respective levels and I don't want to get my account banned. I already had some close calls so I know the dangers are real.

regarding the bounds of the DIM arrays, thanks for the suggestion! The number of FactionID's (MaxFactionID) seems to be static and you can determine this even before logging in by reading from that static address i posted earlier. It seems to be about 2000 something (I don't remember exactly). I just did a hard check in the code to set it to 1 if it was less than 1 and set it to MaxFactionID if it was greater than MaxFactionID. I just over-allocated enough space as Cypher stated.

Once again, I hope I helped here by posting what I discovered and how I utilized the info people kindly posted here.

thanks again!

Wall of useless text crits you for 5k. You die.