Solved: how to detect despawns/monster deaths?

[mrwizeman]

anyone care to share an address for "OnRemoveSpawn", or knows which packet tells the client to remove a dead npc?

Is it in the SMSG_COMPRESSED_UPDATE_OBJECT packet perhaps? I can decompress it if needed, but I dont wanna mess with it if its gonna be a dead end.

Is there an event for it?

I dont want to iterate through the objectmanager and keep track of all the guids unless its absolutely necasary, so please, if you know of a function that gets called when a npc despawns, feel free to reply.

[Cypher]

WoWUnit should have a virtual destructor. You could hook that if you want, that should tell you when an NPC or PC is being destroyed.

[mrwizeman]

Thank you for the answer, it got me to fire up olly and set a bp on UNIT_DIED from thereon it was easy to trace back to the function I needed namely 0x06C4FF0
OnUnitDied as I call it and when it gets called it has the objptr to the unit that just died in ecx...
Guid is found at ecx+0x30 and unitname is a pointer at ecx+0x38 at ecx+0xc have the number 0x2c which is used in a case statement in the jumptable at 1052A10 and no surprise... it will resolve to UNIT_DEAD...

text:006C503D                 mov     ecx, [edi+0Ch]
.text:006C5040                 mov     edx, off_1052A10[ecx*4]

Anyway now when I look at it in IDA I see that I should be able to just grab the death directly from the packet...
so anyway if someone else ever asks about this here is the codesnippet from version 3.2.2.10505 that should be enough info to get a solid OnDeath function working...

.text:0047A410 ClntObjMgrInitialize proc near          ; CODE XREF: ClntObjMgrCreate+77p
.text:0047A410                 mov     eax, TlsIndex
.text:0047A415                 mov     ecx, large fs:2Ch
.text:0047A41C                 push    esi
.text:0047A41D                 mov     esi, [ecx+eax*4]
.text:0047A420                 mov     edx, [esi+8]
.text:0047A426                 mov     ecx, [edx+0D0h]
.text:0047A42C                 push    0
.text:0047A42E                 push    offset Packet_SMSG_UPDATE_OBJECT
.text:0047A433                 push    0A9h
.text:0047A438                 call    NetClient__SetMessageHandler
.text:0047A43D                 mov     eax, [esi+8]
.text:0047A443                 mov     ecx, [eax+0D0h]
.text:0047A449                 push    0
.text:0047A44B                 push    offset Packet_SMSG_COMPRESSED_UPDATE_OBJECT
.text:0047A450                 push    1F6h
.text:0047A455                 call    NetClient__SetMessageHandler
.text:0047A45A                 mov     ecx, [esi+8]
.text:0047A460                 mov     ecx, [ecx+0D0h]
.text:0047A466                 push    0
.text:0047A468                 push    offset Packet_SMSG_DESTROY_OBJECT
.text:0047A46D                 push    0AAh
.text:0047A472                 call    NetClient__SetMessageHandler
.text:0047A477                 pop     esi
.text:0047A478                 retn
.text:0047A478 ClntObjMgrInitialize endp