Transports

[RoKFenris]

Here is some information for those like me that are content to just read memory.

The GUID for the transport is currently stored at offset -8 from the x value for mobs and players (i.e., in 3.1.1, x is at 0x798 and the transport GUID is at 0x790).

At least for mobs and objects that act as transports, there is a 4x4 float matrix used to compute the final position of everything on said transport. It is stored at [currObj+0xf3c]+0x10 for mobs and at currObj+0x1a8 for objects, again for 3.1.1.

Calling T00 to T15 the array elements for the matrix in the order they are stored in memory, OX, OY and OZ being the position you read from memory for the mob/player that is in the transport, and X, Y and Z the real position:
X = OX*T00 + OY*T04 + OZ*T08 + T12
Y = OX*T01 + OY*T05 + OZ*T09 + T13
Z = OX*T02 + OY*T06 + OZ*T10 + T14

As for the facing, it is just the sum of the transport facing (read in the usual way) and the player/mob facing.

This has been tested and found working with the tournament mounts, the ships flying over the same region and the tram.

[UnknOwned]

Transport GUID's have always been quite interesting as they have since wow was released been a hub for exploits and hacks.

There are and have been many exploits related to transport GUID's.
The first was a temporary bug bag when Captain Placeholder was around and the battleground patch where you could port to any instance in the game, that was quickly fixed though.

Back at that time there was also no check when you left a GUID, so this was used as a telehack untill it at some time went public and Blizzard became aware of it a few patches before TBC.

Then the invalid GUID check that 'we' managed to keep away from the public to aorund 3.0.9 where you could create your own item (clietnside) with a fake transport GUID and then travel with it anywhere in your current instance.

Then we have the simple transport spoof where you can change the position of the transport instantly wihtout disconnected (as the server does not check your position, but rather a "spline". Making it possible to drop of anywhere on that spline at any time)...

[Cursed]

More information please

[Zephir]

yes please

[Robske]

Thats a more elegant fix for my SoTA transport ship workaround thanks

Unknowned, you keep amazing me, awesome information

[UnknOwned]

Thats a more elegant fix for my SoTA transport ship workaround thanks

Unknowned, you keep amazing me, awesome information

What is there to say?

The old method was what we called "The Magic Carpet" as we could spawn a object, jump on to it and move the object anywhere in the world and then jump off, and the server didn't care.
But now the server will disconnect you if you use a fake GUID.

But for the current exploits, Just find the structure that controls the loop transports (look for stuff that reads from the TPN dbc) Find the variable that controls the offset and manually set it. If you know how the DBC work you can easily locate the "end" points of the travel and just link thoes to the structure.

Very easy...