[3.1.3] Player Action Bar Statics

[LegacyAX]

Hey guys, Since I posted and got a few ideas from some nice users, I did a bit of reversing yesterday and found the statics I needed to find the ID of each spell in the users action bar.

So incase anyone else needs them for their private bot project here ya go!

       Action2 = 0x012A2CF4
	Action3 = Action2 + 4
	Action4 = Action3 + 4
	Action5 = Action4 + 4
	Action6 = Action5 + 4
	Action7 = Action6 + 4
	Action8 = Action7 + 4
	Action9 = Action8 + 4
	Action0 = Action9 + 4
	ActionMin = Action0 + 4
	ActionEqu = ActionMin + 4
        
       Example Use: 
       int UserBar2 = wow.ReadInt(Action2);
       int UserBar3 = wow.ReadInt(Action3);

Enjoy :P

-L_AX

[Fabolous1]

            uint Action2, Action3, Action4, Action5, Action6, Action7, Action8, Action9, Action0, ActionMin, ActionEqu;

            Action2 = 0x012A2CF4;
            Action3 = Action2 + 4;
            Action4 = Action3 + 4;
            Action5 = Action4 + 4;
            Action6 = Action5 + 4;
            Action7 = Action6 + 4;
            Action8 = Action7 + 4;
            Action9 = Action8 + 4;
            Action0 = Action9 + 4;
            ActionMin = Action0 + 4;
            ActionEqu = ActionMin + 4;
                
            //Example Use: 
            int UserBar2 = wow.ReadInt(Action2);
            int UserBar3 = wow.ReadInt(Action3);

            Console.WriteLine("UserBar2: {0}", UserBar2);
            Console.WriteLine("UserBar3: {0}", UserBar3);

Returns:

UserBar2: 1090519045
UserBar3: 1090519046

Is that what it's supposed to do? I don't think those are the SpellID's of Haunt and Unstable Affliction, respectively

[LegacyAX]

Throw it in CE as 4 bytes, (int) and it gives you the spell ID of each Action slot. It doesnt work for food items and such.

If you cant figure that out, cant help you.

[luciferc]

Theres more than the action bars spell id . Theres also a type modifier etc. Look into it in OllyDbg more so you can understand it.

[lanman92]

So it's a class of structs I'm guessing. That would be much nicer for the eyes than seeing all those +4's >.>

[Shynd]

Perhaps something like...

		[StructLayout(LayoutKind.Sequential)]
		public struct ActionBar
		{
			public int Action1;
			public int Action2;
			public int Action3;
			public int Action4;
			public int Action5;
			public int Action6;
			public int Action7;
			public int Action8;
			public int Action9;
			public int Action0;
			public int ActionMinus;
			public int ActionEquals;
		}

And then, I guess, if you're using BlackMagic, you could use .ReadObject to read it from memory? I don't know, never used this method, just attempting to make it a little easier on the eyes.

[lanman92]

If you're using clr hosting, can't you cast an instance of a struct/class such as that to an address?

[Shynd]

I know that you can read unmanaged memory into a managed struct with Marshal.PtrToStructure, but I am unsure whether you can do something like struct at address (0xwhatever) and then have it access unmanaged memory whenever you access the struct.

[Apoc]

I know that you can read unmanaged memory into a managed struct with Marshal.PtrToStructure, but I am unsure whether you can do something like struct at address (0xwhatever) and then have it access unmanaged memory whenever you access the struct.

Not without wrapping it in 'reading' properties.

public int Ab1 { get { return ReadInt(foo); } }

[amadmonk]

Unsafe code will work a treat, if you're not scared off by all the "unsafe" tags

Unsafe code in c# == all the simplicity of c# plus all the fun of pointer casting...

[boomingranny]

each actionbar "object" in this struct has 2 data parts:
offset 0 (short) ID
offset 3 (byte) type

where type is
0 = Spell
64 = General Macro
65 = Toon Specific Macro
128 = Item

eg.
actionbar01 = 0x012A2BD0
actionbar - ID =0x012A2BD0
actionbar - type = 0x012A2BD3

I think i read this from wowdev wiki a month or two back.

[UnknOwned]

each actionbar "object" in this struct has 2 data parts:
offset 0 (short) ID
offset 3 (byte) type

where type is
0 = Spell
64 = General Macro
65 = Toon Specific Macro
128 = Item

eg.
actionbar01 = 0x012A2BD0
actionbar - ID =0x012A2BD0
actionbar - type = 0x012A2BD3

I think i read this from wowdev wiki a month or two back.

yup

General Structures - WoW.Dev Wiki

[Nokia5800]

yup

General Structures - WoW.Dev Wiki

unknowned, you happen to still have the CastSpellByID address to call a spell without ASM? If you could share thaqt it would be great, Thank man.

[lanman92]

How do you expect to call a function in another process without ASM??? Jesus christ. Did you think before you said that? Asm, injecting bytes, injecting a ****ing DLL. It's all the same.

[Apoc]

0x004C4DB0 Spell_C_CastSpell

You know it as CastSpellByID

.text:004C4DB0
.text:004C4DB0     ; =============== S U B R O U T I N E =======================================
.text:004C4DB0
.text:004C4DB0     ; <"c:\BuildServer\bs1\work\WoW-code\branches\wow-patch-3_1_3-bra>
.text:004C4DB0     ; Attributes: bp-based frame
.text:004C4DB0
.text:004C4DB0     Spell_C_CastSpell proc near             ; CODE XREF: sub_4C4DF0+126p
.text:004C4DB0                                             ; sub_4C5050+9Ap ...
.text:004C4DB0
.text:004C4DB0     arg_0           = dword ptr  8
.text:004C4DB0     arg_4           = dword ptr  0Ch
.text:004C4DB0     arg_8           = dword ptr  10h
.text:004C4DB0     arg_C           = dword ptr  14h
.text:004C4DB0
.text:004C4DB0 000                 push    ebp
.text:004C4DB1 004                 mov     ebp, esp
.text:004C4DB3 004                 call    ClntObjMgrGetActivePlayer ; Call Procedure
.text:004C4DB8 004                 push    0A1h
.text:004C4DBD 008                 push    offset aCBuildserve_14 ; "c:\\BuildServer\\bs1\\work\\WoW-code\\branch"...
.text:004C4DC2 00C                 push    10h
.text:004C4DC4 010                 push    edx
.text:004C4DC5 014                 push    eax
.text:004C4DC6 018                 call    ClntObjMgrObjectPtr ; Call Procedure
.text:004C4DCB 018                 mov     ecx, [ebp+arg_C]
.text:004C4DCE 018                 mov     edx, [ebp+arg_8]
.text:004C4DD1 018                 push    0
.text:004C4DD3 01C                 push    ecx
.text:004C4DD4 020                 mov     ecx, [ebp+arg_4]
.text:004C4DD7 020                 push    edx
.text:004C4DD8 024                 mov     edx, [ebp+arg_0]
.text:004C4DDB 024                 push    ecx
.text:004C4DDC 028                 push    edx
.text:004C4DDD 02C                 push    eax
.text:004C4DDE 030                 call    sub_4C4140      ; <".\Spell_C.cpp", "GAMESPELLACTIVATE", "GAMEABILITYACTIVATE", "igPlayerInviteDecline">
.text:004C4DE3 030                 add     esp, 2Ch        ; Add
.text:004C4DE6 004                 pop     ebp
.text:004C4DE7 000                 retn                    ; Return Near from Procedure
.text:004C4DE7     Spell_C_CastSpell endp
.text:004C4DE7
.text:004C4DE7     ; ---------------------------------------------------------------------------