4.0 Migration

[Megamike55]

Hmm with some research i think i found out how to use the old method with a slight difference ?

s_curmgr = ((WowBaseAdress+MgrPtr)+MgrOffset)
curobject = (s_curmgr+firstobject)

etc
etc
etc... But still it dosent seem to work, every object is returning 0

Natt, this is the right way. I have confirmed it working using these offsets (as given to us by all the great people in this thread)
ClientConnection = 0x008A5C20, // 4.0.1 13164
CurMgrOffset = 0x4618, // 4.0.1 13164
NextObjectOffset = 0x3C, // 4.0.1 13164
FirstObjectOffset = 0xB4, // 4.0.1 13164

Here is some sample code. There was also someone else in this thread who seemed to be searching for this.

I am hoping someone can help us all out and post the offsets for unit X Y Z positions. I am inexperienced at finding these offsets myself, though I DO know how to use a debugger and watch the memory as it changes. It just takes so darn long.... so if anyone has those offsets, would be very appreciated.

        public uint GetModule(string exename)
        {
            //"focusWind" is a System.Diagnostics.Process object I have
            ProcessModuleCollection ms = focusWind.Modules;
            for (int i = 0; i < ms.Count; i++)
            {
                if (ms[i].ModuleName.ToLower() == exename.ToLower())
                {
                    return (uint)ms[i].BaseAddress;
                }
            }
            return 0;
        }

        public bool SetWindowHandle(string winTitle)
        {
            lookForWin = winTitle;
            foreach (System.Diagnostics.Process p in System.Diagnostics.Process.GetProcesses())
            {
                if (p.MainWindowTitle == lookForWin)
                {
                    //just get the first window with the title specified
                    focusWind = p;
                    break;
                }
            }

            if (focusWind != null)
            {
                baseAddress = GetModule("Wow.exe");
                wow = new BlackMagic(focusWind.MainWindowHandle);
                currMgr = wow.ReadUInt(wow.ReadUInt(baseAddress + (uint)consts.ClientConnection) + (uint)consts.CurMgrOffset);
                return true;
            }
            else return false;
        }

[mnbvc]

vtable indexes should be:
11: GetPosition
13: GetFacing
23: ContainsLoot
33: InInteractRange
45: OnRightClick
56: GetObjectName

does anybody know what they did to InInteractRange? before the patch it took the address of these object whatever fields, which were at this+416, as parameter. these were moved to 456, but when i call the function it crashes

[caytchen]

does anybody know what they did to InInteractRange? before the patch it took the address of these object whatever fields, which were at this+416, as parameter. these were moved to 456, but when i call the function it crashes

How do you call it? The offset 0x1C8 and the virtual function offset 0x20 are correct and it works fine here.

[Megamike55]

Update to my previous post.. I took the time to find the XYZ rotation offsets myself.
So I'll share it..

UNIT Position X,Y,Z,Rotation Offsets (4.0.1 13164)

        PosXOffset = 0x880,
        PosYOffset = 0x880 + 0x4,
        PosZOffset = 0x880 + 0x8,
        RotationOffset = 0x880 + 0x10,

Enjoy.

[kalixe]

Hmm with some research i think i found out how to use the old method with a slight difference ?

s_curmgr = ((WowBaseAdress+MgrPtr)+MgrOffset)
curobject = (s_curmgr+firstobject)

etc
etc
etc... But still it dosent seem to work, every object is returning 0

For Autoit try like that :

$WowBase = _MemoryModuleGetBaseAddress($WowPid,"wow.exe")
$ObjectManager = Read(Read($WowBase+$ClientConnection)+$CurrMgrOffset) ; ObjectManager
$CurrentObject = Read($ObjectManager+$FirstObjectOffset) ; First Object

Func _MemoryModuleGetBaseAddress($iPID, $sModule)
    If Not ProcessExists($iPID) Then Return SetError(1, 0, 0)

    If Not IsString($sModule) Then Return SetError(2, 0, 0)

    Local   $PSAPI = DllOpen("psapi.dll")

    ;Get Process Handle
    Local   $hProcess
    Local   $PERMISSION = BitOR(0x0002, 0x0400, 0x0008, 0x0010, 0x0020) ; CREATE_THREAD, QUERY_INFORMATION, VM_OPERATION, VM_READ, VM_WRITE

    If $iPID > 0 Then
        Local $hProcess = DllCall("kernel32.dll", "ptr", "OpenProcess", "dword", $PERMISSION, "int", 0, "dword", $iPID)
        If $hProcess[0] Then
            $hProcess = $hProcess[0]
        EndIf
    EndIf

    ;EnumProcessModules
    Local   $Modules = DllStructCreate("ptr[1024]")
    Local   $aCall = DllCall($PSAPI, "int", "EnumProcessModules", "ptr", $hProcess, "ptr", DllStructGetPtr($Modules), "dword", DllStructGetSize($Modules), "dword*", 0)
    If $aCall[4] > 0 Then
        Local   $iModnum = $aCall[4] / 4
        Local   $aTemp
        For $i = 1 To $iModnum
            $aTemp =  DllCall($PSAPI, "dword", "GetModuleBaseNameW", "ptr", $hProcess, "ptr", Ptr(DllStructGetData($Modules, 1, $i)), "wstr", "", "dword", 260)
            If $aTemp[3] = $sModule Then
                DllClose($PSAPI)
                Return Ptr(DllStructGetData($Modules, 1, $i))
            EndIf
        Next
    EndIf

    DllClose($PSAPI)
    Return SetError(-1, 0, 0)

EndFunc

[arthanos2]

seem to be unable to read the descriptors, is it no longer pbase + 0x8 ?

[Megamike55]

seem to be unable to read the descriptors, is it no longer pbase + 0x8 ?

Descriptors pointer is still at 0x8
I didn't have to touch my descriptors code at all, same as from 3.3.5, once I plugged in the values from the Pastie page (as given to us from JuJuBoSc):

Also some change for enumerate the object manager :

[...]

EDIT : For who want descriptors by index : #1217984 - Pastie

[Arutha532]

Found the GameObject xyz:

GameObjectX = 0x110, 
GameObjectY = GameObjectX + 0x4, 
GameObjectZ = GameObjectX + 0x8,

Anyone found the Camera_Pointer and Camera_Offset?

[JuJuBoSc]

        public enum Globals
        {

            PlayerName = 0x008A5C58,                    // 4.0.1 13164
            CurrentAccount = 0x00D6D518,                // 4.0.1 13164
            CurrentRealm = 0x008A5ADE,                  // 4.0.1 13164
            CurrentTargetGUID = 0x009816B0,             // 4.0.1 13164
            MouseOverGUID = 0x009816A0,                 // 4.0.1 13164
            PetGUID = 0x009ED9A8,                       // 4.0.1 13164
            FollowGUID = 0x008BD7F8,                    // 4.0.1 13164
            ComboPoint = 0x00981751,                    // 4.0.1 13164
            LootWindow = 0x009EE9E0,                    // 4.0.1 13164
            SpellBookNumSpells = 0x9DDD7C,              // 4.0.1 13164
            SpellBookSpellsPtr = 0x9DDD80,              // 4.0.1 13164
            Movement_Field = 0x100,                     // 4.0.1 13164
            SpellCooldownPtr = 0x00980968,              // 4.0.1 13164
            Timestamp = 0x008A7F54,                     // 4.0.1 13164
            UnitName1 = 0xA0C,                          // 4.0.1 13164
            UnitName2 = 0x60,                           // 4.0.1 13164
            ObjName1 = 0x1CC,                           // 4.0.1 13164
            ObjName2 = 0x94,                            // 4.0.1 13164
            nbItemsSellByMerchant = 0x009F1848,         // 4.0.1 13164
            BuildNumber = 0x00958B54,                   // 4.0.1 13164
            GetMinimapZoneText = 0x0098167C,            // 4.0.1 13164
            GetZoneText = 0x00981688,                   // 4.0.1 13164
            GetSubZoneText = 0x00981684,                // 4.0.1 13164
            GetZoneID = 0x00981710,                     // 4.0.1 13164
            IsBobbingOffset = 0xBC,                     // 4.0.1 13164 -- Guessed, just lazy ...
            ChatboxIsOpen = 0x00978B48,                 // 4.0.1 13164
            IsMouseButtonPressed = 0x0097A768,          // 4.0.1 13164
            MouseOverItemId_Ptr = 0x00981674,           // 4.0.1 13164
            MouseOverItemId_Offset = 0x2B8,             // 4.0.1 13164
            MouseOverSpellId_Offset = 0x2BC,            // 4.0.1 13164
            RuneState = 0x009DFFCC,                     // 4.0.1 13164
            RuneType = 0x009DFF68,                      // 4.0.1 13164
            IsInGame = 0x00981692,                      // 4.0.1 13164
            MountsListPtr = 0x009DDDDC,                 // 4.0.1 13164
            MountsCount = 0x009DDDD8,                   // 4.0.1 13164
            IsIndoors = 0x0079FD21,                     // 4.0.1 13164
            PlayerNameCache = 0x00881988,               // 4.0.1 13164
            NumUnspentTalents = 0x009F4524,             // 4.0.1 13164
            IsUsableAction = 0x009EDC58,                // 4.0.1 13164
            IsUsableActionNoMana = 0x009EDA18,          // 4.0.1 13164
            PlayerOffsetUnk1 = 0x1380,                  // 4.0.1 13164 lua_GetMoney
            GetMoneyOffset = 0x1128,                    // 4.0.1 13164 lua_GetMoney

        }

        public enum BattleNet
        {

            NetClientPtr = 0x8A5C2C,                    // 4.0.1 13164
            nbAccounts = 0x1144,                        // 4.0.1 13164 // lua_GetGameAccountInfo
            AccountName1 = 0x1148,                      // 4.0.1 13164 // lua_GetGameAccountInfo
            AccountName2 = 0x104,                       // 4.0.1 13164 // lua_GetGameAccountInfo

        }

        public enum Container
        {

            EquippedBagGUID = 0x009F84D0,               // 4.0.1 13164
            MaxSlot = 0x910,                            // 4.0.1 13164
            ItemGUIDStart = 0x918,                      // 4.0.1 13164

        }

        public enum IsAutoAttacking
        {

            CGActionBar__IsCurrentAction = 0x0049AC50,  // 4.0.1 13164
            AutoAttackGUID = 0xAD8,                     // 4.0.1 13164

            ActiveSpellsPtr = 0x007F9B80,               // 4.0.1 13164
            ActiveSpellsSpellId = 0x20,                 // 4.0.1 13164 -- Need testing

        }

        public enum ActionBar
        {

            CurrentActionBar = 0x009EE318,              // 4.0.1 13164
            ActionBarFirstSlot = 0x009EE0D8,            // 4.0.1 13164
            ActionBarBonus = 0x009EE31C,                // 4.0.1 13164
            TotemBarTotem1Id = 0x009EE2EC,              // 4.0.1 13164
            GetActionCount = 0x009EDE98,                // 4.0.1 13164

        }

        public enum Battleground
        {

            BattlegroundStartTickcount = 0x009E06C0,    // 4.0.1 13164
            IsBattlegroundFinished = 0x009E06D0,        // 4.0.1 13164
            BattlegroundWinner = 0x009E06D4,            // 4.0.1 13164
            UISelectedBattlegroundId = 0x009E0684,      // 4.0.1 13164
            BattlegroundInfo = 0x009E0600,              // 4.0.1 13164
            BattlegroundInfo_Id = 0x0,                  // 4.0.1 13164
            BattlegroundInfo_Status = 0x0C,             // 4.0.1 13164
            BattlegroundInfo_ArraySize = 0x40,          // 4.0.1 13164

        }

        public enum CGUnit_C__GetCreatureType
        {

            CGUnit_C__GetCreatureType = 0x001BF1F0,     // 4.0.1 13164
            Offset1 = 0xA0C,                            // 4.0.1 13164
            Offset2 = 0x10,                             // 4.0.1 13164

        }

        public enum Macros
        {

            nbGeneralMacros = 0x00A0BBA0,               // 4.0.1 13164
            nbSpecificMacros = 0x00A0BBA4,              // 4.0.1 13164
            Base = 0x00A0BBC4,                          // 4.0.1 13164
            Next = 0x10,                                // 4.0.1 13164
            Name = 0x20,                                // 4.0.1 13164
            Icon = 0x60,                                // 4.0.1 13164
            Body = 0x160,                               // 4.0.1 13164
            IsCharSpecific = 0x1000000,                 // 4.0.1 13164

        }

        public enum Keybindings
        {

            Base = 0x009DDF24,                          // 4.0.1 13164
            First = 0xC8,                               // 4.0.1 13164
            Next = 0xC0,                                // 4.0.1 13164
            KeyString = 0x14,                           // 4.0.1 13164
            ActionString = 0x28,                        // 4.0.1 13164

        }

        public enum CGWorldFrame__GetActiveCamera
        {


            CGWorldFrame__GetActiveCamera = 0x432780,   // 4.0.1 13164
            Camera_Pointer = 0x00981C20,                // 4.0.1 13164
            Camera_Offset = 0x7F48,                     // 4.0.1 13164
            Camera_X = 0x8,                             // 4.0.1 13164
            Camera_Y = 0xC,                             // 4.0.1 13164
            Camera_Z = 0x10,                            // 4.0.1 13164
            Camera_Matrix = 0x14,                       // 4.0.1 13164

        }

        public enum ShapeshiftForm
        {

            CGUnit_C__GetShapeshiftFormId = 0x0071AF70, // 4.0.1 13164

            BaseAddress_Offset1 = 0xF8,                 // 4.0.1 13164 
            BaseAddress_Offset2 = 0x213,                // 4.0.1 13164 

        }

        public enum ObjectManager
        {

            CurMgrPointer = 0x008A5C20,                 // 4.0.1 13164
            CurMgrOffset = 0x4618,                      // 4.0.1 13164
            NextObject = 0x3C,                          // 4.0.1 13164
            FirstObject = 0xB4,                         // 4.0.1 13164
            LocalGUID = 0xC8                            // 4.0.1 13164

        }

        public enum Corpse
        {

            X = 0x009819BC,                              // 4.0.1 13164
            Y = X + 0x4,                                 // 4.0.1 13164
            Z = X + 0x8,                                 // 4.0.1 13164

        }

        public enum SpiritHealer
        {

            X = 0x009819C8,                              // 4.0.1 13164
            Y = X + 0x4,                                 // 4.0.1 13164
            Z = X + 0x8,                                 // 4.0.1 13164

        }

        public enum Party
        {

            s_LeaderGUID = 0x009DD4D8,                  // 4.0.1 13164
            s_Member1GUID = 0x009DD4B8,                 // 4.0.1 13164
            s_Member2GUID = s_Member1GUID + 0x8,        // 4.0.1 13164
            s_Member3GUID = s_Member2GUID + 0x8,        // 4.0.1 13164
            s_Member4GUID = s_Member3GUID + 0x8,        // 4.0.1 13164

        }

        public enum UnitBaseGetUnitAura
        {

            CGUnit_Aura = 0x00061C70,                   // 4.0.1 13164
            AURA_COUNT_1 = 0xF80,                       // 4.0.1 13164
            AURA_COUNT_2 = 0xD04,                       // 4.0.1 13164
            AURA_TABLE_1 = 0xD00,                       // 4.0.1 13164
            AURA_TABLE_2 = 0xD08,                       // 4.0.1 13164
            AURA_SIZE = 0x28,                           // 4.0.1 13164
            AURA_SPELL_ID = 0x8                         // 4.0.1 13164

        }

        public enum IsFlying
        {

            // Reversed from Lua_IsFlying

            Offset = 0x44,                              // 4.0.1 13164
            Mask = 0x2000000,                           // 4.0.1 13164
            IsFlyingCapable_Mask = 0x1000000,           // 4.0.1 13164

        }

        public enum IsSwimming
        {

            // Reversed from Lua_IsSwimming

            Offset = 0xAE8,                             // 4.0.1 13164
            Mask = 0x200000,                            // 4.0.1 13164

        }

        public enum InCombat
        {

            // Reversed from Lua_UnitAffectingCombat

            Offset1 = 0xF8,                             // 4.0.1 13164
            Offset2 = 0x114,                            // 4.0.1 13164
            Mask = 0x13,                                // 4.0.1 13164

        }

        public enum AutoLoot
        {

            Pointer = 0x00981870,                       // 4.0.1 13164
            Offset = 0x30,                              // 4.0.1 13164

        }

        public enum AutoSelfCast
        {

            Pointer = 0x00981878,                       // 4.0.1 13164
            Offset = 0x30,                              // 4.0.1 13164

        }

        public enum ClickToMove
        {

            CGPlayer_C__ClickToMove = 0x1C7E20,         // 4.0.1 13164
            Pointer = 0x981850,                         // 4.0.1 13164
            Offset = 0x30,                              // 4.0.1 13164

        }

        public enum WoWChat
        {

            ChatBufferStart = 0x00983358,               // 4.0.1 13164
            NextMessage = 0x17C0,                       // 4.0.1 13164

        }

        public enum WowObject
        {
            X = 0x880,
            Y = 0x884,
            Z = 0x888,
            R = 0x890,
            P = 0x894,
            GameObjectX = 0x110,
            GameObjectY = 0x114,
            GameObjectZ = 0x118,
        }

All tested and working, all offsets is relative.

Anyone found the Camera_Pointer and Camera_Offset?

        public enum CGWorldFrame__GetActiveCamera
        {

            CGWorldFrame__GetActiveCamera = 0x432780,   // 4.0.1 13164
            Camera_Pointer = 0x00981C20,                // 4.0.1 13164
            Camera_Offset = 0x7F48,                     // 4.0.1 13164
            Camera_X = 0x8,                             // 4.0.1 13164
            Camera_Y = 0xC,                             // 4.0.1 13164
            Camera_Z = 0x10,                            // 4.0.1 13164
            Camera_Matrix = 0x14,                       // 4.0.1 13164

        }

EDIT : AURA_SIZE moved from 0x18 to 0x28.

[mnbvc]

How do you call it? The offset 0x1C8 and the virtual function offset 0x20 are correct and it works fine here.

bool CGGameObject_C::IsInInteractRange()
{
    DWORD dwThis = *(DWORD*)( (DWORD)this + 456 );
    DWORD dwFunc = *(DWORD*)( *(DWORD*)dwThis + 33 );

    typedef bool ( __thiscall * tInInteractRange )( DWORD );
    tInInteractRange pInInteractRange = (tInInteractRange)dwFunc;

    return pInInteractRange( dwThis );
}

but you say 0x20... that was the position before the patch?
old vtable: http://pastebin.com/mLjSPjLn
new vtable: http://pastebin.com/xG107XUQ
so this function was moved one down, and 33 should be right?
but if i try 32 it doesn't work either

[caytchen]

Well I saw your GetPosition VTable offset was off by one, too, so I just assumed you use another index. Turns out it's actually just wrong
The client still uses +0x20 so nothing moved there.

[Seifer]

Simple property for determining the BaseAddress of the World of Warcraft process, given you have a Process object of the instance you want to attach to.

        /// <summary>
        /// Gets or sets the process.
        /// </summary>
        /// <value>The process.</value>
        /// 14/10/2010 16:52
        public static Process Process { get; set; }

        /// <summary>
        /// Gets the base address of the World of Warcraft application.
        /// </summary>
        /// <value>The [IntPtr] BaseAddress.</value>
        /// 14/10/2010 16:55
        public static IntPtr BaseAddress
        {
            get
            {
                var ret = new IntPtr();
                var modules = Process.Modules;

                for (var i=0; i<modules.Count;i++)
                {
                    if (modules[i].ModuleName.Contains("Wow")) ret = modules[i].BaseAddress;
                }

                return ret;
            }
        }

[JuJuBoSc]

Simple property for determining the BaseAddress of the World of Warcraft process, given you have a Process object of the instance you want to attach to.

        /// <summary>
        /// Gets or sets the process.
        /// </summary>
        /// <value>The process.</value>
        /// 14/10/2010 16:52
        public static Process Process { get; set; }

        /// <summary>
        /// Gets the base address of the World of Warcraft application.
        /// </summary>
        /// <value>The [IntPtr] BaseAddress.</value>
        /// 14/10/2010 16:55
        public static IntPtr BaseAddress
        {
            get
            {
                var ret = new IntPtr();
                var modules = Process.Modules;

                for (var i=0; i<modules.Count;i++)
                {
                    if (modules[i].ModuleName.Contains("Wow")) ret = modules[i].BaseAddress;
                }

                return ret;
            }
        }

In this case Process.MainModule.BaseAddress is easier and faster.

[Seifer]

I detest simplicity, and substitute possibly simpler solutions with my own, overcomplicated, arbitrary ones.

[JuJuBoSc]

I detest simplicity.

The .Contains looks tricky if another module contain "Wow"

                if (Name.ToLower() == P.MainModule.ModuleName.ToLower())
                    return P.MainModule.BaseAddress;

                foreach (ProcessModule PM in P.Modules)
                    if (PM.ModuleName.ToLower() == Name.ToLower())
                        return PM.BaseAddress;

This is what I use, not sure how MainModule work internally, Module32First/Next ? Or something else ?