Since IsFlying is a Lua function, it's signature has to conform to the Lua specification, and so is:
Code:
int IsFlying (lua_State* L);
- lua_State contains the whole state of Lua. Everything which is available to Lua is somehow referenced there. Therefore, there is only one lua_State in the whole game. There is some memory location which points to the lua_State. You can get it from the Info Dump Thread
- the function returns the number of arguments which should be returned. As IsFlying returns 1 or nil depending on whether you are flying or not, there will be always one argument returned and the return value of the function will therefore be one.
In the info dump thread, you can get the memory location of IsFlying. Go there with OllyDbg (or any other similar tool) to get the disassembled function. Try to fill out as many comment fields as you can. The Info Dump Thread is a real help here. If you are through, log in with a guest account and call the function to fill out even more comment fields. Here is what I get from looking at this function:
Code:
CPU Disasm
Address Hex dump Command Comments
005973F0 /. 55 PUSH EBP
005973F1 |. 8BEC MOV EBP,ESP
005973F3 |. E8 88F1EDFF CALL 00476580 ; GetActivePlayerGUID
005973F8 |. 68 A1000000 PUSH 0A1
005973FD |. 68 C8DB9A00 PUSH OFFSET WoW.009ADBC8 ; ASCII "c:\BuildServer\bs1\work\WoW-code\branches\wow-patch-3_2_2_A-branch\WoW\Source\Object/ObjectClient/Player_C.h"
00597402 |. 6A 10 PUSH 10
00597404 |. 52 PUSH EDX ; Arg2 => guidHigh
00597405 |. 50 PUSH EAX ; Arg1 => guidLow
00597406 |. E8 4507EEFF CALL 00477B50 ; GetObjectByGUID => eax = playerbase, ecx = playerbase+1818, edx = 10
0059740B |. 83C4 14 ADD ESP,14
0059740E |. 85C0 TEST EAX,EAX
00597410 |. 74 5D JE SHORT 0059746F ; return nil if object wasn't returned properly
00597412 |. 8B88 680F0000 MOV ECX,DWORD PTR DS:[EAX+0F68]
00597418 |. 85C9 TEST ECX,ECX
0059741A |. 74 29 JE SHORT 00597445
0059741C |. 8379 14 03 CMP DWORD PTR DS:[ECX+14],3
00597420 |. 75 23 JNE SHORT 00597445 ; if [playerbase+0f68] == 0 || [[playerbase+0f68]+14] != 3 jump
00597422 |. 8B10 MOV EDX,DWORD PTR DS:[EAX] ; 009e6c70
00597424 |. 68 970E0000 PUSH 0E97
00597429 |. 68 347F9D00 PUSH OFFSET WoW.009D7F34 ; ASCII ".\ScriptEvents.cpp"
0059742E |. 8BC8 MOV ECX,EAX
00597430 |. 8B42 3C MOV EAX,DWORD PTR DS:[EDX+3C]
00597433 |. 6A 08 PUSH 8
00597435 |. FFD0 CALL EAX ; call 0065ecc0
00597437 |. 52 PUSH EDX ; Arg2 => guidHigh ([playerbase+794])
00597438 |. 50 PUSH EAX ; Arg1 => guidLow ([playerbase+790])
00597439 |. E8 1207EEFF CALL 00477B50 ; GetObjectByGUID
0059743E |. 83C4 14 ADD ESP,14
00597441 |. 85C0 TEST EAX,EAX
00597443 |. 74 2A JE SHORT 0059746F ; return nil if object wasn't returned properly
00597445 |> 8B88 D8000000 MOV ECX,DWORD PTR DS:[EAX+0D8]
0059744B |. F741 44 00000 TEST DWORD PTR DS:[ECX+44],02000000
00597452 |. 74 1B JE SHORT 0059746F ; if [[eax+0d8]+44] == 02 00 00 00 return nil
00597454 |. D9E8 FLD1 ; else return 1
00597456 |. 8B55 08 MOV EDX,DWORD PTR SS:[ARG.1]
00597459 |. 83EC 08 SUB ESP,8
0059745C |. DD1C24 FSTP QWORD PTR SS:[ARG.RETADDR]
0059745F |. 52 PUSH EDX
00597460 |. E8 ABC52600 CALL 00803A10 ; lua_pushnumber
00597465 |. 83C4 0C ADD ESP,0C
00597468 |. B8 01000000 MOV EAX,1
0059746D |. 5D POP EBP
0059746E |. C3 RETN
0059746F |> 8B45 08 MOV EAX,DWORD PTR SS:[ARG.1] ; return nil
00597472 |. 50 PUSH EAX ; /Arg1 => [ARG.1]
00597473 |. E8 78C52600 CALL 008039F0 ; \WoW.008039F0, lua_pushnil
00597478 |. 83C4 04 ADD ESP,4
0059747B |. B8 01000000 MOV EAX,1
00597480 |. 5D POP EBP
00597481 \. C3 RETN
so, what I can take from this is that your desired info is
Code:
temp = playerbase;
if ([playerbase+0xf68] && [[playerbase+0xf68]+0x14] == 0x3) {
guidL = [playerbase + 0x790];
guidH = [playerbase + 0x794];
temp = GetObjectByGUID(guidL, guidH);
}
return ([[temp+0xd8]+0x44] != 0x2000000) ? 1 : nil;
Couldn't find out what [playerbase+0xf68] represents and what GUID is standing at [playerbase + 0x790] if the if if-branch is taken.
Since I'm new to memory editing there can of course be some errors in this. Feel free to post any improvements or bug reports :-)