[Info] How to find CamPos, CamRot and PlayerPos

[wanyancan]

It seems that my thread was directed in two discussions..
Regarding the world to screen transformation, it would be better to post how I find the offsets for CamPos, CamRot and PlayerPos to be used in the transformation. This was remained the same since wow 2.x ...

Use Ida Names search "Skycloudlod", there is only one function referring to this string. At the beginning of that function, you'll find the position offsets which works with my world2screen codes. (note that my wow's version is 3.1.3.10146)

The search will bring you here, almost the end of the function.

.text:004DE84A                 push    ebx             ; char
.text:004DE84B                 push    ebx             ; int
.text:004DE84C                 push    ebx             ; char
.text:004DE84D                 push    esi             ; int
.text:004DE84E                 push    offset sub_4DDAD0 ; int
.text:004DE853                 push    offset a0       ; "0"
.text:004DE858                 push    ebx             ; int
.text:004DE859                 push    ebx             ; int
.text:004DE85A                 push    offset aSkycloudlod ; "SkyCloudLOD"
.text:004DE85F                 mov     dword_1080CE4, esi
.text:004DE865                 mov     byte_1080B68, bl
.text:004DE86B                 mov     dword_108019C, ebx
.text:004DE871                 call    sub_553B30
.text:004DE876                 push    offset a01      ; "0, 1"
.text:004DE87B                 push    esi             ; int
.text:004DE87C                 push    offset sub_4D85A0 ; int
.text:004DE881                 push    offset aSkysunglare ; "SkySunGlare"
.text:004DE886                 mov     dword_1080AE0, eax
.text:004DE88B                 call    sub_550150
.text:004DE890                 add     esp, 34h
.text:004DE893                 mov     dword_1080AF4, esi
.text:004DE899                 pop     esi
.text:004DE89A                 pop     ebx
.text:004DE89B                 mov     esp, ebp
.text:004DE89D                 pop     ebp
.text:004DE89E                 retn
.text:004DE89E sub_4DE610      endp

Goto the beginning of the same function:

.text:004DE610 sub_4DE610      proc near               ; CODE XREF: sub_522DD0+DAp
.text:004DE610
.text:004DE610 var_1C          = dword ptr -1Ch
.text:004DE610 var_10          = dword ptr -10h
.text:004DE610 var_C           = dword ptr -0Ch
.text:004DE610 var_8           = dword ptr -8
.text:004DE610 var_4           = dword ptr -4
.text:004DE610 arg_0           = dword ptr  8
.text:004DE610
.text:004DE610                 push    ebp
.text:004DE611                 mov     ebp, esp
.text:004DE613                 sub     esp, 10h
.text:004DE616                 mov     eax, [ebp+arg_0]
.text:004DE619                 push    ebx
.text:004DE61A                 push    esi
.text:004DE61B                 push    eax
.text:004DE61C                 push    offset unk_108101C
.text:004DE621                 mov     dword_1080ADC, eax
.text:004DE626                 call    sub_4E1730
.text:004DE62B                 fldz
.text:004DE62D                 fst     flt_1080B1C
.text:004DE633                 add     esp, 8
.text:004DE636                 fst     flt_1080B20
.text:004DE63C                 xor     ebx, ebx
.text:004DE63E                 fst     [ebp+var_10]
.text:004DE641                 mov     dword_1080B18, ebx
.text:004DE647                 mov     eax, [ebp+var_10]
.text:004DE64A                 fst     [ebp+var_C]
.text:004DE64D                 mov     ecx, [ebp+var_C]
.text:004DE650                 fst     [ebp+var_8]
.text:004DE653                 mov     edx, [ebp+var_8]
.text:004DE656                 fst     [ebp+var_10]
.text:004DE659                 mov     dwPlayerY, eax  ; player Y
.text:004DE65E                 fst     [ebp+var_C]
.text:004DE661                 mov     eax, [ebp+var_10]
.text:004DE664                 fst     [ebp+var_8]
.text:004DE667                 mov     dwPlayerX, ecx  ; player X
.text:004DE66D                 fst     [ebp+var_10]
.text:004DE670                 mov     ecx, [ebp+var_C]
.text:004DE673                 fst     [ebp+var_C]
.text:004DE676                 mov     dwPlayerZ, edx  ; player Z
.text:004DE67C                 mov     edx, [ebp+var_8]
.text:004DE67F                 fst     [ebp+var_8]
.text:004DE682                 mov     dwCamY, eax     ; camera Y, G_CAMPOS
.text:004DE687                 mov     eax, [ebp+var_10]
.text:004DE68A                 fst     [ebp+var_10]
.text:004DE68D                 mov     dwCamX, ecx     ; cam X
.text:004DE693                 mov     ecx, [ebp+var_C]
.text:004DE696                 fst     [ebp+var_C]
.text:004DE699                 mov     dwCamZ, edx     ; cam Z
.text:004DE69F                 mov     edx, [ebp+var_8]
.text:004DE6A2                 fst     [ebp+var_8]
.text:004DE6A5                 fst     dwCamRotVertical ; cam Y rotation
.text:004DE6AB                 mov     flt_1080B3C, eax ; player Y   << G_PLAYERPOS
.text:004DE6B0                 mov     eax, [ebp+var_10]
.text:004DE6B3                 fst     flt_1080B58
.text:004DE6B9                 fst     flt_1080B5C
.text:004DE6BF                 mov     flt_1080B40, ecx
.text:004DE6C5                 mov     ecx, [ebp+var_C]
.text:004DE6C8                 fst     flt_1080B60
.text:004DE6CE                 mov     flt_1080B44, edx
.text:004DE6D4                 fst     flt_1080B64
.text:004DE6DA                 mov     edx, [ebp+var_8]
.text:004DE6DD                 fst     flt_1080B78
.text:004DE6E3                 mov     flt_1080B48, eax
.text:004DE6E8                 mov     flt_1080B4C, ecx
.text:004DE6EE                 mov     dwCamRotHorizontal, edx ; G_CAMROT
.text:004DE6F4                 mov     byte_1080B68, bl
.text:004DE6FA                 mov     dword_1080B69, ebx
.text:004DE700                 mov     dword_1080B70, 0FFFFFFFFh
.text:004DE70A                 mov     dword_1080B74, ebx
.text:004DE710                 mov     eax, offset flt_1080B88

The address for camPos camRot and PlayerPos are annotated above. I know that there're many places storing these same variables, but this is the one I used since wow 2.x.

The transformation codes worked correctly no matter your wow is windowed or maximized or using widescreen monitor (there's a modifier factor for widescreen)

For completeness, the codes are attached again. The math is omitted however.

UINT G_CAMPOS = 0x1080B30;  // CAM Y, CAM X(+4), CAM Z(+8)
UINT G_CAMROT = 0x1080B50;  //G_CAMPOS +0x20, camRotX   camRotY(+4)
BOOL scrPos(float x, float y, float z, POINT *pt){
	float camX = ReadFloat(LPCVOID(G_CAMPOS+4)); // camera position
	float camY = ReadFloat(LPCVOID(G_CAMPOS));
	float camZ = ReadFloat(LPCVOID(G_CAMPOS+8));
	float camRotX = ReadFloat(LPCVOID(G_CAMROT));  // camera horizontal direction (0 , 2*pi) north is 0, positive counter-clockwise
	float camRotY = ReadFloat(LPCVOID(G_CAMROT+4)); // camera vertical direction (-pi/2, pi/2) look upward is positive 
	float alpha = asinf(camRotX);
	float cosY = cosf(camRotY);
	float sinY = sinf(camRotY);

	float pos0 = -camX*cosY+cosY*x+camY*sinY-y*sinY;
	float pos1 = cosY*y*cosf(alpha)+x*sinY*cosf(alpha)+(-camY*cosY-camX*sinY)*cosf(alpha)-camZ*sinf(alpha) + z*sinf(alpha);
	float pos2 = -camZ*cosf(alpha)+z*cosf(alpha)-cosY*y*sinf(alpha)-x*sinY*sin(alpha)-(-camY*cosY-camX*sinY)*sin(alpha);
	if (pos1<0.1)
		return FALSE;
	float fov = 3.1415926/2*0.7;  // field of view , view angle is about 0.7

	RECT rect;
	GetClientRect(wowhwnd, &rect);
	float modifier = 1.0f;
	if(1.0*rect.right/rect.bottom>1.5) 
		modifier *=1.15;  // widescreen modifier
	float scrX = -pos0/pos1/tanf(fov/2*1.08*modifier) * rect.right/2;
	float scrY = -pos2/pos1/tanf(fov/2*0.85) * rect.bottom/2;

	//printf("cam (%.1f,%.1f,%.1f), camRot (%.1f,%.1f), obj(%.1f,%.1f,%.1f) scr (%.1f, %.1f)\n", camX, camY, camZ, camRotX, camRotY, x,y,z, scrX, scrY);
	if (abs(scrX)*3>rect.right || abs(scrY)*3>rect.bottom)
		return FALSE;  // out of center 1/3 rectangle.
	pt->x = scrX+rect.right/2; pt->y = scrY+rect.bottom/2;
	return TRUE;
}

[kynox]

Why would you not use the structure from the WorldFrame? You can easily signature scan for the "mov edx, worldFrame; mov eax [edx + cameraOffset]" CGWorldFrame::GetCamera function. I'll include the structure in case you didn't to go down that road.

class CSimpleCamera
{
public:
    virtual float GetFov( );
    virtual idVec3& Forward( idVec3& vecOut );
    virtual idVec3& Right( idVec3& vecOut );
    virtual idVec3& Up( idVec3& vecOut );

    idVec3 Forward( )
    { idVec3 fwd; Forward( fwd ); return fwd; }

    char unknown4[4];
    idVec3 vecPosition;
    idMat3 matFacing;
    float NearZ;
    float FarZ;
    float Fov;
    float Aspect;
};

class CGCamera : public CSimpleCamera
{
public:
    int m_hModel;
    char field_4C[60];
    unsigned __int64 Target;
    char unknown144[8];
    DWORD Flags;
    int unknown156;
    INT64 m_relativeTo;
    char field_A8[112];
    float Distance;
    char unknown272[12];
    float HeightOffset; // How far above the characters origin should we look at?
};

idVec3 is just a float[3], and idMat3 is a float[3][3];