Click to Move - Explained

[Apoc]

I'm tired of seeing the same questions being asked over and over about how to get CTM working, etc, etc. I'm also tired of people claiming that their 'passive' bot (which uses CTM) is actually passive.

I'm going to detail the ways I know of; to make CTM 'work'. And also detail the pros/cons of them. I'll go into as much detail as I can; but please, take what I say with a grain of salt.

Common Misconceptions

1. CTM does NOT know how 'far' it should be from something it's interacting with, or moving to. Period. WoW either figures this out internally via a function call (explained later), or you must figure it out yourself.
2. Each CTM action is TIMESTAMPED. (The timestamp changes every 'frame' while a CTM action is being carried out as well. [This includes moving, etc])
3. There are TWO points in the global CTM struct. A 'clicked' point, and a 'destination' point. The latter being created by WoW for internal reasons. (Mostly the 'randomized' ending location)
4. While no CTM action is in progress; the 'type' of action is 0x13 (Default action, or no action)
5. There is no way to stop CTM using CTM itself, without having Lua errors being thrown. (This has to do with WoW firing the AUTOFOLLOW_END event when 0x3 is passed as a click type.) Note: You can click your current position; however if the users PC is slow, or has a high ping, you may end up doing a 180.

Click Types

        public enum ClickToMoveType
        {
            FaceTarget = 0x1,
            Face = 0x2,
            /// <summary>
            /// Will throw a UI error. Have not figured out how to avoid it!
            /// </summary>
            Stop_ThrowsException = 0x3,
            Move = 0x4,
            NpcInteract = 0x5,
            Loot = 0x6,
            ObjInteract = 0x7,
            FaceOther = 0x8,
            Skin = 0x9,
            AttackPosition = 0xA,
            AttackGuid = 0xB,
            ConstantFace = 0xC,
            None = 0xD,

            Attack = 0x10,
            Idle = 0x13,
        }

Those are the 'current' click types that I'm aware of. (There may be more, there most likely are, 0xE and 0xF are missing.)

Enabling CTM

There are 2 ways that I'm aware of to enable CTM programatically. One of which can be done in 2 ways; and the other is simply a quick memory write.

1. Set the 'AutoInteract' CVar to 1/0. This can be done via a Lua call (SetCVar("AutoInteract", 1)) or editing the CVar in memory. The former is the easier of the two.
2. Setting the current input control flags to OR in 0x400000. (g_inputControl.Flags |= 0x400000)

Obviously; you can turn it on manually via the game options, but where's the fun in that?

Global CTM Struct Layout

This is quite possibly outdated; and useless to most of you. However, this should provide an easy way (for C# users) to read the full struct at once.

        [StructLayout(LayoutKind.Sequential)]
        public struct ClickToMoveInfoStruct
        {
            public float InteractionDistance;

            private float Unknown3F;
            private float Unknown4F;
            public uint Timestamp;
            public uint ActionType;
            public ulong InteractGuid;

            /// <summary>
            /// Check == 2 (This might be some sort of flag?)
            /// Always 2 when using some form of CTM action. 0 otherwise.
            /// </summary>
            public uint IsClickToMoving;

            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 21)]
            private uint[] Unknown6U;

            /// <summary>
            /// This will change in memory as WoW figures out where exactly we're going to stop. (Also the actual end location)
            /// </summary>
            public Point Dest;

            /// <summary>
            /// This is wherever we actually 'clicked' in game.
            /// </summary>
            public Point Click;
        }

Using Click To Move via Injection

There are currently 2 ways (well; 2 'easy' ways) to actually use CTM via injection.

1. Call the engine function CGPlayer_C__ClickToMove
2. Write values to the global CTM struct.

Calling the engine function is obviously the 'safer' and easier way. As it includes error checking, and also can handle setting the required interaction distance, etc.

The function prototype is as follows:

BOOL __thiscall CGPlayer_C__ClickToMove(WoWActivePlayer *this, CLICKTOMOVETYPE clickType, WGUID *interactGuid, WOWPOS *clickPos, float precision)

Do note; you may omit 'useless' params (pass 0) if they are not used for that current action. Eg; interacting with a unit doesn't require the click position. The destination is set automatically by WoW. It will also fail if you can't 'click' that place. (An error message will be displayed)

The other way (writing to the global CTM struct) is VERY RISKY. It takes only a single addition to the code that actually uses the CTM struct, to see if it was modified outside of a 'proper' function call. However; the process is still, fairly simple.

Just write your action type, the GUID/Position of the click, and away you go. However; you do need to remember that you're keeping up on quite a few more addresses (while the function call is only 1, and can be patch diffed easily)

Using Click To Move Out of Process

Use a World2Screen click. That's your only way to do it, and stay completely passive. (As Cypher has documented in his thread here.

If you want to still go in process anyway; see the above methods for injection. I highly suggest you avoid CTM if you're totally passive!

There was more I was going to add to this thread... but I'm a bit lazy and tired. So I'll add more later.

[furang]

Perfect tut, Apoc. I've just learnt that few weeks ago. I guess this would be suitable here
Click To Move - WoW.Dev Wiki
Besides action types there's lots useful when CTMing

Memory Click To Move Block by By Malu05 - 2007
Offset Type Description Additional Details
0x0 = float ? ?
0x4 = float TURN_SCALE Value determining the scale of the turn (only when turning more than 180 degrees?),
0x8 = float ? ?
0xC = float INTERACTION_DISTANCE Value determining how far from the targeted position the player should stop.
0x1C = INT ACTION_TYPE The action trigger. See details about Action Type Below.
0x20 = 8int InteractGUID
0x74 = float X move to
0x78 = float Y move to
0x7C = float Z move to

You should also know where to write action type and coords to goto or guid to interact/attack to or distance. I guess everyone should also look through this link.
PS. I wish it were similar tut for Lua_DoString. 2 weeks i'm trying to get it working, but vainly. The thread is at next page.

[Tanaris4]

For those WRITING to memory (not the injection method) - here are recommended distances to write to memory based on what you are doing (it's also good to write to the scale):

	// Set our scale!
	float scale = 13.962634f;

	// Set our distance to the target until we stop moving
	float distance = 0.5f;	// Default for just move to position
	if ( type == ctmAttackGuid ){
		distance = 3.66f;
	}
	else if ( type == ctmInteractNpc ){
		distance = 2.75f;
	}
	else if ( type == ctmInteractObject ){
		distance = 4.5f;
	}

[Apoc]

WoW actually has a function that decides the distance for each action (based on current context)

Here's the func;

char __usercall ClickToMove__GetInteractDistanceOfAction<al>(WGUID *guid<eax>, CLICKTOMOVETYPE ctmType<edx>, WoWUnit *unit<ebx>, float *pInteractDistance<edi>)
{
  WoWUnit *v4; // eax@4
  char result; // al@5
  WoWObject *v6; // eax@9
  WoWObject *v7; // eax@12
  int v8; // ST04_4@13
  char *v9; // ST08_4@13
  int *v10; // ST0C_4@13
  WoWObject *v11; // ST10_4@13
  WoWObject *v12; // eax@15
  WoWObject *v13; // esi@15
  int v14; // eax@16
  int v16; // [sp+4h] [bp-4h]@13
  char v17; // [sp+0h] [bp-8h]@13

  if ( !byte_1051E08[12 * ctmType] || stru_1051E11[12 * ctmType] )
  {
    result = 1;
  }
  else
  {
    switch ( ctmType )
    {
      case CLICKTYPE_NpcInteract:
        v4 = (WoWUnit *)ClntObjMgrObjectPtr(*guid, OT_UNIT);
        if ( v4 )
        {
          _EAX = v4->UnitInfo;
          __asm { fld     dword ptr [eax+0ECh];  }
          result = 1;
          __asm
          {
            fmul    ds:flt_9A2D6C   ; flt_9A2D6C
            fadd    ds:flt_9A0DA0   ; flt_9A0DA0
            fmul    st, st          ; 
            fstp    dword ptr [edi] ; 
          }
        }
        else
        {
          __asm { fld     flt_12979B8     ; flt_12979B8 }
          result = 1;
          __asm { fstp    dword ptr [edi] ;  }
        }
        return result;
      case CLICKTYPE_Move:
        __asm { fld     flt_1051E00     ; jumptable 00693A24 case 1 }
        result = 1;
        __asm { fstp    dword ptr [edi] ;  }
        return result;
      case CLICKTYPE_Stop_ThrowsException:
        __asm { fld     flt_1051DF4     ; jumptable 00693A24 case 0 }
        result = 1;
        __asm { fstp    dword ptr [edi] ;  }
        return result;
      case CLICKTYPE_Loot:
      case CLICKTYPE_AttackPosition:
        v6 = ClntObjMgrObjectPtr(*guid, OT_UNIT);
        if ( v6 )
        {
          sub_649920(v6);
          __asm { fsub    ds:flt_9E65B4   ; flt_9E65B4 }
          result = 1;
          __asm
          {
            fmul    st, st          ; 
            fstp    dword ptr [edi] ; 
          }
        }
        else
        {
          __asm { fld     ds:flt_9A78EC   ; flt_9A78EC }
          result = 1;
          __asm
          {
            fmul    st, st          ; 
            fstp    dword ptr [edi] ; 
          }
        }
        return result;
      case CLICKTYPE_AttackGuid:
        v7 = ClntObjMgrObjectPtr(*guid, OT_UNIT);
        if ( !v7 )
          goto LABEL_RETURN_0;
        v11 = v7;
        v10 = &v16;
        v9 = &v17;
        v8 = dword_113F7DC;
        goto LABEL_GETSPELLRANGE;
      case CLICKTYPE_ObjInteract:
        __asm { fld     flt_1297930     ; jumptable 00693A24 case 4 }
        result = 1;
        __asm
        {
          fmul    st, st          ; 
          fstp    dword ptr [edi] ; 
        }
        return result;
      case CLICKTYPE_Skin:
        v12 = ClntObjMgrObjectPtr(*guid, OT_OBJECT);
        v13 = v12;
        if ( !v12 || (v14 = sub_4E9C50(v12), !v14) )
          goto LABEL_RETURN_0;
        v11 = v13;
        v10 = &v16;
        v9 = &v17;
        v8 = v14;
LABEL_GETSPELLRANGE:
        Spell_C__GetSpellRange(unit, v8, v9, v10, v11);
        __asm
        {
          fld     [ebp+var_4]     ; 
          fmul    ds:flt_9BCF2C   ; flt_9BCF2C
        }
        result = 1;
        __asm
        {
          fmul    st, st          ; 
          fstp    dword ptr [edi] ; 
        }
        break;
      default:
LABEL_RETURN_0:
        result = 0;
        break;
    }
  }
  return result;
}

ASM version:

.text:006939F0     ; =============== S U B R O U T I N E =======================================
.text:006939F0
.text:006939F0     ; Attributes: bp-based frame
.text:006939F0
.text:006939F0     ; char __usercall ClickToMove__GetInteractDistanceOfAction<al>(WGUID *guid<eax>, CLICKTOMOVETYPE ctmType<edx>, WoWUnit *unit<ebx>, float *pInteractDistance<edi>)
.text:006939F0     ClickToMove__GetInteractDistanceOfAction proc near
.text:006939F0                                             ; CODE XREF: CGPlayer_C__ClickToMove+93p
.text:006939F0
.text:006939F0     var_8           = byte ptr -8
.text:006939F0     var_4           = dword ptr -4
.text:006939F0
.text:006939F0 000                 push    ebp
.text:006939F1 004                 mov     ebp, esp
.text:006939F3 004                 lea     ecx, [edx+edx*2] ; Load Effective Address
.text:006939F6 004                 add     ecx, ecx        ; Add
.text:006939F8 004                 add     ecx, ecx        ; Add
.text:006939FA 004                 sub     esp, 8          ; Integer Subtraction
.text:006939FD 00C                 cmp     byte_1051E08[ecx], 0 ; Compare Two Operands
.text:00693A04 00C                 jz      loc_693B81      ; Jump if Zero (ZF=1)
.text:00693A04
.text:00693A0A 00C                 cmp     byte ptr stru_1051E11.anonymous_0[ecx], 0 ; Compare Two Operands
.text:00693A11 00C                 jnz     loc_693B81      ; Jump if Not Zero (ZF=0)
.text:00693A11
.text:00693A17 00C                 lea     ecx, [edx-3]    ; Load Effective Address
.text:00693A1A 00C                 cmp     ecx, 8          ; switch 9 cases
.text:00693A1D 00C                 push    esi
.text:00693A1E 010                 ja      loc_693B7A      ; default
.text:00693A1E                                             ; jumptable 00693A24 case 5
.text:00693A1E
.text:00693A24 010                 jmp     ds:off_693B88[ecx*4] ; switch jump
.text:00693A24
.text:00693A2B
.text:00693A2B     loc_693A2B:                             ; DATA XREF: .text:off_693B88o
.text:00693A2B 010                 mov     ecx, [eax+4]    ; jumptable 00693A24 case 2
.text:00693A2E 010                 mov     edx, [eax]
.text:00693A30 010                 push    492Dh
.text:00693A35 014                 push    offset a_Unit_c_cpp ; ".\\Unit_C.cpp"
.text:00693A3A 018                 push    8               ; filter
.text:00693A3C 01C                 push    ecx
.text:00693A3D 020                 push    edx             ; guid
.text:00693A3E 024                 call    ClntObjMgrObjectPtr ; Call Procedure
.text:00693A3E
.text:00693A43 024                 add     esp, 14h        ; Add
.text:00693A46 010                 test    eax, eax        ; Logical Compare
.text:00693A48 010                 jz      short loc_693A6D ; Jump if Zero (ZF=1)
.text:00693A48
.text:00693A4A 010                 mov     eax, [eax+0D0h]
.text:00693A50 010                 fld     dword ptr [eax+0ECh] ; Load Real
.text:00693A56 010                 mov     al, 1
.text:00693A58 010                 fmul    ds:flt_9A2D6C   ; Multiply Real
.text:00693A5E 010                 pop     esi
.text:00693A5F 00C                 fadd    ds:flt_9A0DA0   ; Add Real
.text:00693A65 00C                 fmul    st, st          ; Multiply Real
.text:00693A67 00C                 fstp    dword ptr [edi] ; Store Real and Pop
.text:00693A69 00C                 mov     esp, ebp
.text:00693A6B 004                 pop     ebp
.text:00693A6C 000                 retn                    ; Return Near from Procedure
.text:00693A6C
.text:00693A6D     ; ---------------------------------------------------------------------------
.text:00693A6D
.text:00693A6D     loc_693A6D:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+58j
.text:00693A6D 010                 fld     flt_12979B8     ; Load Real
.text:00693A73 010                 mov     al, 1
.text:00693A75 010                 fstp    dword ptr [edi] ; Store Real and Pop
.text:00693A77 010                 pop     esi
.text:00693A78 00C                 mov     esp, ebp
.text:00693A7A 004                 pop     ebp
.text:00693A7B 000                 retn                    ; Return Near from Procedure
.text:00693A7B
.text:00693A7C     ; ---------------------------------------------------------------------------
.text:00693A7C
.text:00693A7C     loc_693A7C:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+34j
.text:00693A7C                                             ; DATA XREF: .text:off_693B88o
.text:00693A7C 010                 fld     flt_1051E00     ; jumptable 00693A24 case 1
.text:00693A82 010                 mov     al, 1
.text:00693A84 010                 fstp    dword ptr [edi] ; Store Real and Pop
.text:00693A86 010                 pop     esi
.text:00693A87 00C                 mov     esp, ebp
.text:00693A89 004                 pop     ebp
.text:00693A8A 000                 retn                    ; Return Near from Procedure
.text:00693A8A
.text:00693A8B     ; ---------------------------------------------------------------------------
.text:00693A8B
.text:00693A8B     loc_693A8B:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+34j
.text:00693A8B                                             ; DATA XREF: .text:off_693B88o
.text:00693A8B 010                 fld     flt_1051DF4     ; jumptable 00693A24 case 0
.text:00693A91 010                 mov     al, 1
.text:00693A93 010                 fstp    dword ptr [edi] ; Store Real and Pop
.text:00693A95 010                 pop     esi
.text:00693A96 00C                 mov     esp, ebp
.text:00693A98 004                 pop     ebp
.text:00693A99 000                 retn                    ; Return Near from Procedure
.text:00693A99
.text:00693A9A     ; ---------------------------------------------------------------------------
.text:00693A9A
.text:00693A9A     loc_693A9A:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+34j
.text:00693A9A                                             ; DATA XREF: .text:off_693B88o
.text:00693A9A 010                 mov     ecx, [eax+4]    ; jumptable 00693A24 cases 3,7
.text:00693A9D 010                 mov     edx, [eax]
.text:00693A9F 010                 push    493Fh
.text:00693AA4 014                 push    offset a_Unit_c_cpp ; ".\\Unit_C.cpp"
.text:00693AA9 018                 push    8               ; filter
.text:00693AAB 01C                 push    ecx
.text:00693AAC 020                 push    edx             ; guid
.text:00693AAD 024                 call    ClntObjMgrObjectPtr ; Call Procedure
.text:00693AAD
.text:00693AB2 024                 add     esp, 14h        ; Add
.text:00693AB5 010                 test    eax, eax        ; Logical Compare
.text:00693AB7 010                 jz      short loc_693AD2 ; Jump if Zero (ZF=1)
.text:00693AB7
.text:00693AB9 010                 push    eax
.text:00693ABA 014                 mov     ecx, ebx
.text:00693ABC 014                 call    sub_649920      ; Call Procedure
.text:00693ABC
.text:00693AC1 010                 fsub    ds:flt_9E65B4   ; Subtract Real
.text:00693AC7 010                 mov     al, 1
.text:00693AC9 010                 pop     esi
.text:00693ACA 00C                 fmul    st, st          ; Multiply Real
.text:00693ACC 00C                 fstp    dword ptr [edi] ; Store Real and Pop
.text:00693ACE 00C                 mov     esp, ebp
.text:00693AD0 004                 pop     ebp
.text:00693AD1 000                 retn                    ; Return Near from Procedure
.text:00693AD1
.text:00693AD2     ; ---------------------------------------------------------------------------
.text:00693AD2
.text:00693AD2     loc_693AD2:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+C7j
.text:00693AD2 010                 fld     ds:flt_9A78EC   ; Load Real
.text:00693AD8 010                 mov     al, 1
.text:00693ADA 010                 fmul    st, st          ; Multiply Real
.text:00693ADC 010                 pop     esi
.text:00693ADD 00C                 fstp    dword ptr [edi] ; Store Real and Pop
.text:00693ADF 00C                 mov     esp, ebp
.text:00693AE1 004                 pop     ebp
.text:00693AE2 000                 retn                    ; Return Near from Procedure
.text:00693AE2
.text:00693AE3     ; ---------------------------------------------------------------------------
.text:00693AE3
.text:00693AE3     loc_693AE3:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+34j
.text:00693AE3                                             ; DATA XREF: .text:off_693B88o
.text:00693AE3 010                 mov     ecx, [eax+4]    ; jumptable 00693A24 case 8
.text:00693AE6 010                 mov     edx, [eax]
.text:00693AE8 010                 push    494Bh
.text:00693AED 014                 push    offset a_Unit_c_cpp ; ".\\Unit_C.cpp"
.text:00693AF2 018                 push    8               ; filter
.text:00693AF4 01C                 push    ecx
.text:00693AF5 020                 push    edx             ; guid
.text:00693AF6 024                 call    ClntObjMgrObjectPtr ; Call Procedure
.text:00693AF6
.text:00693AFB 024                 add     esp, 14h        ; Add
.text:00693AFE 010                 test    eax, eax        ; Logical Compare
.text:00693B00 010                 jz      short loc_693B7A ; default
.text:00693B00                                             ; jumptable 00693A24 case 5
.text:00693B00
.text:00693B02 010                 mov     edx, dword_113F7DC
.text:00693B08 010                 push    eax
.text:00693B09 014                 lea     eax, [ebp+var_4] ; Load Effective Address
.text:00693B0C 014                 push    eax
.text:00693B0D 018                 lea     ecx, [ebp+var_8] ; Load Effective Address
.text:00693B10 018                 push    ecx
.text:00693B11 01C                 push    edx
.text:00693B12 020                 jmp     short loc_693B5D ; Jump
.text:00693B12
.text:00693B14     ; ---------------------------------------------------------------------------
.text:00693B14
.text:00693B14     loc_693B14:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+34j
.text:00693B14                                             ; DATA XREF: .text:off_693B88o
.text:00693B14 010                 fld     flt_1297930     ; jumptable 00693A24 case 4
.text:00693B1A 010                 mov     al, 1
.text:00693B1C 010                 fmul    st, st          ; Multiply Real
.text:00693B1E 010                 pop     esi
.text:00693B1F 00C                 fstp    dword ptr [edi] ; Store Real and Pop
.text:00693B21 00C                 mov     esp, ebp
.text:00693B23 004                 pop     ebp
.text:00693B24 000                 retn                    ; Return Near from Procedure
.text:00693B24
.text:00693B25     ; ---------------------------------------------------------------------------
.text:00693B25
.text:00693B25     loc_693B25:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+34j
.text:00693B25                                             ; DATA XREF: .text:off_693B88o
.text:00693B25 010                 mov     ecx, [eax+4]    ; jumptable 00693A24 case 6
.text:00693B28 010                 mov     edx, [eax]
.text:00693B2A 010                 push    495Bh
.text:00693B2F 014                 push    offset a_Unit_c_cpp ; ".\\Unit_C.cpp"
.text:00693B34 018                 push    1               ; filter
.text:00693B36 01C                 push    ecx
.text:00693B37 020                 push    edx             ; guid
.text:00693B38 024                 call    ClntObjMgrObjectPtr ; Call Procedure
.text:00693B38
.text:00693B3D 024                 mov     esi, eax
.text:00693B3F 024                 add     esp, 14h        ; Add
.text:00693B42 010                 test    esi, esi        ; Logical Compare
.text:00693B44 010                 jz      short loc_693B7A ; default
.text:00693B44                                             ; jumptable 00693A24 case 5
.text:00693B44
.text:00693B46 010                 push    esi
.text:00693B47 014                 call    sub_4E9C50      ; Call Procedure
.text:00693B47
.text:00693B4C 014                 add     esp, 4          ; Add
.text:00693B4F 010                 test    eax, eax        ; Logical Compare
.text:00693B51 010                 jz      short loc_693B7A ; default
.text:00693B51                                             ; jumptable 00693A24 case 5
.text:00693B51
.text:00693B53 010                 push    esi
.text:00693B54 014                 lea     ecx, [ebp+var_4] ; Load Effective Address
.text:00693B57 014                 push    ecx
.text:00693B58 018                 lea     edx, [ebp+var_8] ; Load Effective Address
.text:00693B5B 018                 push    edx
.text:00693B5C 01C                 push    eax
.text:00693B5C
.text:00693B5D
.text:00693B5D     loc_693B5D:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+122j
.text:00693B5D 020                 push    ebx
.text:00693B5E 024                 call    Spell_C__GetSpellRange ; Call Procedure
.text:00693B5E
.text:00693B63 024                 fld     [ebp+var_4]     ; Load Real
.text:00693B66 024                 fmul    ds:flt_9BCF2C   ; Multiply Real
.text:00693B6C 024                 add     esp, 14h        ; Add
.text:00693B6F 010                 mov     al, 1
.text:00693B71 010                 pop     esi
.text:00693B72 00C                 fmul    st, st          ; Multiply Real
.text:00693B74 00C                 fstp    dword ptr [edi] ; Store Real and Pop
.text:00693B76 00C                 mov     esp, ebp
.text:00693B78 004                 pop     ebp
.text:00693B79 000                 retn                    ; Return Near from Procedure
.text:00693B79
.text:00693B7A     ; ---------------------------------------------------------------------------
.text:00693B7A
.text:00693B7A     loc_693B7A:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+2Ej
.text:00693B7A                                             ; ClickToMove__GetInteractDistanceOfAction+34j ...
.text:00693B7A 010                 xor     al, al          ; default
.text:00693B7A                                             ; jumptable 00693A24 case 5
.text:00693B7C 010                 pop     esi
.text:00693B7D 00C                 mov     esp, ebp
.text:00693B7F 004                 pop     ebp
.text:00693B80 000                 retn                    ; Return Near from Procedure
.text:00693B80
.text:00693B81     ; ---------------------------------------------------------------------------
.text:00693B81
.text:00693B81     loc_693B81:                             ; CODE XREF: ClickToMove__GetInteractDistanceOfAction+14j
.text:00693B81                                             ; ClickToMove__GetInteractDistanceOfAction+21j
.text:00693B81 00C                 mov     al, 1
.text:00693B83 00C                 mov     esp, ebp
.text:00693B85 004                 pop     ebp
.text:00693B86 000                 retn                    ; Return Near from Procedure
.text:00693B86
.text:00693B86     ClickToMove__GetInteractDistanceOfAction endp
.text:00693B86
.text:00693B86     ; ---------------------------------------------------------------------------
.text:00693B87                     align 4
.text:00693B88     off_693B88      dd offset loc_693A8B    ; DATA XREF: ClickToMove__GetInteractDistanceOfAction+34r
.text:00693B88                     dd offset loc_693A7C    ; jump table for switch statement
.text:00693B88                     dd offset loc_693A2B
.text:00693B88                     dd offset loc_693A9A
.text:00693B88                     dd offset loc_693B14
.text:00693B88                     dd offset loc_693B7A
.text:00693B88                     dd offset loc_693B25
.text:00693B88                     dd offset loc_693A9A
.text:00693B88                     dd offset loc_693AE3
.text:00693BAC                     align 10h
.text:00693BB0

[Cypher]

Better decompiled version:

char __usercall WoWClickToMove__GetInteractDistanceOfAction<al>(int a1<eax>, int a2<edx>, int a3<ebx>, int a4<edi>)
{
  int v4; // eax@4
  char result; // al@5
  double v6; // st7@5
  int v7; // eax@9
  double v8; // st7@10
  int v9; // eax@12
  int v10; // eax@15
  int v11; // esi@15
  int v12; // eax@16
  int v13; // [sp-14h] [bp-1Ch]@13
  char *v14; // [sp-10h] [bp-18h]@13
  float *v15; // [sp-Ch] [bp-14h]@13
  int v16; // [sp-8h] [bp-10h]@13
  char v17; // [sp+0h] [bp-8h]@13
  float v18; // [sp+4h] [bp-4h]@13

  if ( !byte_1051E08[12 * a2] || byte_1051E11[12 * a2] )
  {
    result = 1;
  }
  else
  {
    switch ( a2 )
    {
      case 5:
        v4 = WoWGetObjectForGuid(*(_DWORD *)a1, *(_DWORD *)(a1 + 4), 8);
        if ( v4 )
        {
          v6 = *(float *)(*(_DWORD *)(v4 + 208) + 236);
          result = 1;
          *(float *)a4 = (v6 * 0.5 + 2.0) * (v6 * 0.5 + 2.0);
        }
        else
        {
          result = 1;
          *(_DWORD *)a4 = *(_DWORD *)&flt_12979B8;
        }
        return result;
      case 4:
        result = 1;
        *(_DWORD *)a4 = *(_DWORD *)&flt_1051E00;
        return result;
      case 3:
        result = 1;
        *(_DWORD *)a4 = *(_DWORD *)&flt_1051DF4;
        return result;
      case 6:
      case 10:
        v7 = WoWGetObjectForGuid(*(_DWORD *)a1, *(_DWORD *)(a1 + 4), 8);
        if ( v7 )
        {
          v8 = sub_649920(v7);
          result = 1;
          *(float *)a4 = (v8 - 1.333333373069763) * (v8 - 1.333333373069763);
        }
        else
        {
          result = 1;
          *(float *)a4 = 5.0 * 5.0;
        }
        return result;
      case 11:
        v9 = WoWGetObjectForGuid(*(_DWORD *)a1, *(_DWORD *)(a1 + 4), 8);
        if ( !v9 )
          goto LABEL_19;
        v16 = v9;
        v15 = &v18;
        v14 = &v17;
        v13 = dword_113F7DC;
        goto LABEL_18;
      case 7:
        result = 1;
        *(float *)a4 = flt_1297930 * flt_1297930;
        return result;
      case 9:
        v10 = WoWGetObjectForGuid(*(_DWORD *)a1, *(_DWORD *)(a1 + 4), 1);
        v11 = v10;
        if ( !v10 || (v12 = sub_4E9C50(v10), !v12) )
          goto LABEL_19;
        v16 = v11;
        v15 = &v18;
        v14 = &v17;
        v13 = v12;
LABEL_18:
        WoWSpell_C__GetSpellRange(a3, v13, v14, v15, v16);
        result = 1;
        *(float *)a4 = v18 * 0.8999999761581421 * v18 * 0.8999999761581421;
        break;
      default:
LABEL_19:
        result = 0;
        break;
    }
  }
  return result;
}

[flukes1]

Better decompiled version:

char __usercall WoWClickToMove__GetInteractDistanceOfAction<al>(int a1<eax>, int a2<edx>, int a3<ebx>, int a4<edi>)
{
  int v4; // eax@4
  char result; // al@5
  double v6; // st7@5
  int v7; // eax@9
  double v8; // st7@10
  int v9; // eax@12
  int v10; // eax@15
  int v11; // esi@15
  int v12; // eax@16
  int v13; // [sp-14h] [bp-1Ch]@13
  char *v14; // [sp-10h] [bp-18h]@13
  float *v15; // [sp-Ch] [bp-14h]@13
  int v16; // [sp-8h] [bp-10h]@13
  char v17; // [sp+0h] [bp-8h]@13
  float v18; // [sp+4h] [bp-4h]@13

  if ( !byte_1051E08[12 * a2] || byte_1051E11[12 * a2] )
  {
    result = 1;
  }
  else
  {
    switch ( a2 )
    {
      case 5:
        v4 = WoWGetObjectForGuid(*(_DWORD *)a1, *(_DWORD *)(a1 + 4), 8);
        if ( v4 )
        {
          v6 = *(float *)(*(_DWORD *)(v4 + 208) + 236);
          result = 1;
          *(float *)a4 = (v6 * 0.5 + 2.0) * (v6 * 0.5 + 2.0);
        }
        else
        {
          result = 1;
          *(_DWORD *)a4 = *(_DWORD *)&flt_12979B8;
        }
        return result;
      case 4:
        result = 1;
        *(_DWORD *)a4 = *(_DWORD *)&flt_1051E00;
        return result;
      case 3:
        result = 1;
        *(_DWORD *)a4 = *(_DWORD *)&flt_1051DF4;
        return result;
      case 6:
      case 10:
        v7 = WoWGetObjectForGuid(*(_DWORD *)a1, *(_DWORD *)(a1 + 4), 8);
        if ( v7 )
        {
          v8 = sub_649920(v7);
          result = 1;
          *(float *)a4 = (v8 - 1.333333373069763) * (v8 - 1.333333373069763);
        }
        else
        {
          result = 1;
          *(float *)a4 = 5.0 * 5.0;
        }
        return result;
      case 11:
        v9 = WoWGetObjectForGuid(*(_DWORD *)a1, *(_DWORD *)(a1 + 4), 8);
        if ( !v9 )
          goto LABEL_19;
        v16 = v9;
        v15 = &v18;
        v14 = &v17;
        v13 = dword_113F7DC;
        goto LABEL_18;
      case 7:
        result = 1;
        *(float *)a4 = flt_1297930 * flt_1297930;
        return result;
      case 9:
        v10 = WoWGetObjectForGuid(*(_DWORD *)a1, *(_DWORD *)(a1 + 4), 1);
        v11 = v10;
        if ( !v10 || (v12 = sub_4E9C50(v10), !v12) )
          goto LABEL_19;
        v16 = v11;
        v15 = &v18;
        v14 = &v17;
        v13 = v12;
LABEL_18:
        WoWSpell_C__GetSpellRange(a3, v13, v14, v15, v16);
        result = 1;
        *(float *)a4 = v18 * 0.8999999761581421 * v18 * 0.8999999761581421;
        break;
      default:
LABEL_19:
        result = 0;
        break;
    }
  }
  return result;
}

Not trolling, just genuinely interested in the truthful answer: did you buy Hex-Rays 1.1?

[luciferc]

Great Post but there is a way to Stop CTM Without doing your own Position

[evil2]

The other way (writing to the global CTM struct) is VERY RISKY. It takes only a single addition to the code that actually uses the CTM struct, to see if it was modified outside of a 'proper' function call.

please give more details :-)

hmm.. did blizzard ever add hack-detection to the "normal" client game code? as far i know only the Warden has this job, without any help from the game code (because it can be modified).

[RoKFenris]

Great Post but there is a way to Stop CTM Without doing your own Position

Yep, never used CTM in my project, but any motion key (except for the jump key) should stop CTM.

[Robske]

please give more details :-)

hmm.. did blizzard ever add hack-detection to the "normal" client game code? as far i know only the Warden has this job, without any help from the game code (because it can be modified).

They did in order to catch glider afink.

[Cypher]

please give more details :-)

hmm.. did blizzard ever add hack-detection to the "normal" client game code? as far i know only the Warden has this job, without any help from the game code (because it can be modified).

Yes, several times. To catch Glider and ISXWoW.

[luciferc]

Yep, never used CTM in my project, but any motion key (except for the jump key) should stop CTM.

I am talking about using CTM to stop CTM XD w/o the lag of Going to your own Position.

[natfoth]

Hey guys, can someone help me with this? I dont seem to completly understand how it works. I wrote the values, but im not sure where to put the BOOL and how to call it. Any help would be appreciated.

[Robske]

Hey guys, can someone help me with this? I dont seem to completly understand how it works. I wrote the values, but im not sure where to put the BOOL and how to call it. Any help would be appreciated.

Just out of honest curiousity, is the BOOL you speak the one used in this prototype:

BOOL __thiscall CGPlayer_C__ClickToMove(WoWActivePlayer *this, CLICKTOMOVETYPE clickType, WGUID *interactGuid, WOWPOS *clickPos, float precision)

[natfoth]

Yes, like where do i put that in my code then can i have an example of how to call it?