hamburger12,
CastSpellById is a function call, you cannot do anything useful to it through memory-writing. You are vaguely on the right track though, an injected DLL is the best way to do this, but you are right at the beginning.
I suggest you search around the forums about EndScene hooking, this will enable to call game engine functions from Wow's main thread, if you ever want to use CastSpellById or CTM you will need to learn this ... to start with your DLLMain should look something like this:
Code:
#include <windows.h>
#include <stdio.h>
HRESULT __stdcall MyEndSceneHook(IDirect3DDevice9* pDevice)
{
// Call game engine functions, CTM etc. with relative safety
// Lastly we call the original EndScene function
return originalEndScene(pDevice);
}
BOOL APIENTRY DllMain( HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved )
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
MessageBoxA(NULL,"Hello there, I have just been injected into this process!","Test",MB_OK);
// Hook the DirectX EndScene here replacing it with MyEndSceneHook
break;
}
case DLL_PROCESS_DETACH:
{
MessageBoxA(NULL,"Sorry, gtg now, byyyeee!","Test",MB_OK);
// Unhook the DirectX EndScene here
break;
}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
break;
}
return TRUE;
}
When you get to the point that you have hooked the EndScene correctly, you'll be able to call any of the game engine functions without the need for any ASM.