Interacting with object

[miceiken]

So I've come to the point where I need to interact with units, so I got a hold of the interact asm function and freshed it up, however it does crash at:

Core.WBM.Asm.InjectAndExecute(codecave);

with the simple and explaning error:

Injection failed for some reason.

The Interact() function:

public void Interact()
        {
            Core.WBM.Asm.Clear();
            Core.WBM.Asm.AddLine("fs mov eax, [0x2C]");
            Core.WBM.Asm.AddLine("mov eax, [eax]");
            Core.WBM.Asm.AddLine("add eax, 0x10");
            Core.WBM.Asm.AddLine("mov dword [eax], {0}", new object[] { CurMgr });
            Core.WBM.Asm.AddLine("mov ecx, {0}", new object[] { BaseAddress });
            Core.WBM.Asm.AddLine("call {0}", new object[] { VMTPtr(VMT_Interact) });

            UIntPtr smsg = Imports.GetProcAddress(LoadLibrary("User32.dll"), "SendMessageA");

            Core.WBM.Asm.AddLine("push {0}", Core.WBM.ProcessId);
            Core.WBM.Asm.AddLine("push {0}", Core.WBM.ProcessId);
            Core.WBM.Asm.AddLine("push {0}", 0xBEEF);
            Core.WBM.Asm.AddLine("push {0}", (IntPtr)Core.hWnd);
             
            Core.WBM.Asm.AddLine("mov eax, {0}", smsg);
            Core.WBM.Asm.AddLine("call eax");

            Core.WBM.Asm.AddLine("retn");

            uint codecave = Core.WBM.AllocateMemory();
            Core.WBM.Asm.InjectAndExecute(codecave);
            Core.WBM.FreeMemory(codecave);
        }

        uint VMTPtr(uint offset)
        {
            return Core.WBM.ReadUInt(Core.WBM.ReadUInt(BaseAddress) + offset);
        }

and where I call it:

                if (curObj.Type == 3)       // NPC
                {
                    NPCObject NPCO = new NPCObject(curObj.BaseAddress);
                    NPCObjectList.Add(curObj.GUID, NPCO);
                    NPCDump.WriteLine("[Name: " + NPCO.Name + "] [GUID: " + NPCO.GUID + "] [Health: " + NPCO.Health.ToString() + "/" + NPCO.MaxHealth.ToString() + " (" + NPCO.HealthPercent.ToString() + "%)] [Position: " + NPCO.Location.ToString() + "]");
                    if (NPCO.Location.DistanceToSelf <= 15)
                    {
                        NPCO.Interact();
                    }
                }

[ramey]

I'm so glad I don't have to do ugly code caving

[YetiHunter]

Well you have a lot of stuff in the codecave that isn't needed (in my opinion, which does not mean anything ^^)
Im doing it this way and it works fine:

            wow.Asm.Clear();
            wow.Asm.AddLine("fs mov eax, [0x2C]");
            wow.Asm.AddLine("mov eax, [eax]");
            wow.Asm.AddLine("add eax, 0x10");
            wow.Asm.AddLine("mov dword [eax], {0}", ObjectManager.objectManagerBase);
            wow.Asm.AddLine("mov ecx, {0}", obj.BaseAddress);
            wow.Asm.AddLine("call {0}", VMT38);
            wow.Asm.AddLine("retn");

[miceiken]

That's it?
I take objectManagerBase is the same as curMgr
and what is VMT38 defined as?

[YetiHunter]

What is curMgr holding?

VMT38:

uint VMT38 = wow.ReadUInt((wow.ReadUInt(obj.BaseAddress)) + (38 * 4));

[miceiken]

Okay, thanks.
about curMgr, I was wondering if objectManagerBase as used in your code is the same as curMgr:

Core.WBM.ReadUInt(Core.WBM.ReadUInt(clientConnectionOffset) + objectManagerOffset);

[YetiHunter]

yes it's the same

[miceiken]

Okay, thanks for the help, I do now have this (entire Asm injection)

        public void Interact()
        {
            Core.WBM.Asm.Clear();
            Core.WBM.Asm.AddLine("fs mov eax, [0x2C]");
            Core.WBM.Asm.AddLine("mov eax, [eax]");
            Core.WBM.Asm.AddLine("add eax, 0x10");
            Core.WBM.Asm.AddLine("mov dword [eax], {0}", CurMgr);
            Core.WBM.Asm.AddLine("mov ecx, {0}", BaseAddress);
            Core.WBM.Asm.AddLine("call {0}", VMTPtr(VMT_Interact));
            Core.WBM.Asm.AddLine("retn");

            uint codecave = Core.WBM.AllocateMemory();
            Core.WBM.Asm.InjectAndExecute(codecave);
            Core.WBM.FreeMemory(codecave);
        }

It does crash with the same error however, am I missing a debug privilige or a instance to the mainthread? I am pretty blank at this stuff.

[YetiHunter]

try doing the

uint codecave = Core.WBM.AllocateMemory();

before the asm stuff

[miceiken]

Tried that now, yet it fails.

        public void Interact()
        {
            uint codecave = Core.WBM.AllocateMemory();
            Core.WBM.Asm.Clear();

            Core.WBM.Asm.AddLine("fs mov eax, [0x2C]");
            Core.WBM.Asm.AddLine("mov eax, [eax]");
            Core.WBM.Asm.AddLine("add eax, 0x10");
            Core.WBM.Asm.AddLine("mov dword [eax], {0}", CurMgr);
            Core.WBM.Asm.AddLine("mov ecx, {0}", BaseAddress);
            Core.WBM.Asm.AddLine("call {0}", VMTPtr(VMT_Interact));
            Core.WBM.Asm.AddLine("retn");

            Core.WBM.Asm.InjectAndExecute(codecave);
            Core.WBM.FreeMemory(codecave);
        }

        uint VMTPtr(uint offset)
        {
            return Core.WBM.ReadUInt(Core.WBM.ReadUInt(BaseAddress) + offset);
        }

[miceiken]

Am I missing some pieces? kynox mentioned that I am missing size allocation.

[YetiHunter]

try moving the objects baseaddress into eac not ecx

edit:
works for me without allocationsize as well

[miceiken]

Didn't work either...
I haven't set a debug privilige nor injected to a thread, might this be it?

[YetiHunter]

into eac not ecx

sorry i was mistaken there.

is yout program "attached" to wow?
else your curMgr would hold a nullpointer reference i think.

[miceiken]

Yes, why of course it is