[Question] What are Descriptors?

[sylvisj]

Hello,
This is something I've been wondering for a while which no one seems to be able to explain. I see the term 'Descriptor' thrown around a lot in relation to offsets. Digging through this forum, gamedeception, and google have plenty of results for the descriptors / offset values themselves, but no explanation as to what a descriptor actually is.
So, I ask:
What are these descriptors? What makes them so useful, how are they found, and why are there no real references to what they are?
I'm perfectly happy with any explanations or links to resources with the answer, or even nudges in the right direction.

[_Mike]

This is my understanding of it, but I'm not sure if it's 100% accurate. I haven't spent much time studying the descriptors aside from writing a simple function to read them.

Every object in wow has a large array of data filled with information about the object. Then you have the descriptors as indices in to that array.
I don't know why they're called 'descriptors'. I imagine the name comes from that they describe the data they point to.

An example:
Say we want to get the target of an object.. By looking at the various descriptors we can assume UNIT_FIELD_TARGET is the one we want.
Going by the UNIT_FIELD part of the name we'd know that the descriptor is only valid for objects with the type of Unit (and classes which inherit from Unit, like Player), so objects like an item for example can't have a target.
From looking in the info thread we see

UNIT_FIELD_TARGET = 0x50,
UNIT_FIELD_CHANNEL_OBJECT = 0x58,

So we know the field is 8 bytes long, and can assume it's a GUID
So to find the target guid we read 8 bytes from (address of the object's descriptor table)+0x50

Hope this was understandable enough.

[sylvisj]

Ok, that makes sense, thank you for the reply.
I had figured that about the WoW game objects having an array to more information, seeming to start just after the GUID.

That brings me to another question though - where did the names come from? Buried within WoW, a PDB, just assigned by one of the reversers working with these indices, etc?

[_Mike]

That brings me to another question though - where did the names come from? Buried within WoW, a PDB, just assigned by one of the reversers working with these indices, etc?

They're in wow.exe. Do a string search for OBJECT_FIELD_GUID in a debugger or disassembler and look at the cross references if you want to see how they are used.

[jjaa]

I'm pretty sure the main purpose of the descriptors is to have an easy way to get the object information from the server to the client. Why they have string references, i'm not entirely sure. Basically they are an offset (sometimes they will be posted as offsets or as indexes) from the object information pointer that describes certain data. Each object type has a entry into its descriptor array. For example the Object is at +0x8 Unit is at +0xF8. However given the way they are stored you can access all of the descriptors for every type through the object information pointer (all the offsets dumped here are intended for that) providing that you add the previous size of the array to what you are accessing, this is why the Unit field descriptors start at 0x8 and not 0x0 (indexes here!). 0x8 is the size of the object descriptor array. Similarly the Player descriptors start 0xA8 and not 0. This distinction is important, because many bots will access the descriptor purely through the +0x8 object info pointer however WoW will not e.g 0x5BDC00 (get health) does this:

 *(_DWORD *)(*(_DWORD *)(this + 0xF8) + 0x48)

rather than

 *(_DWORD *)(*(_DWORD *)(this + 0x8) + 0x68)

[sylvisj]

They're in wow.exe. Do a string search for OBJECT_FIELD_GUID in a debugger or disassembler and look at the cross references if you want to see how they are used.

Doing so now, thanks much!

0x8 is the size of the object descriptor array. Similarly the Player descriptors start 0xA8 and not 0. This distinction is important, because many bots will access the descriptor purely through the +0x8 object info pointer however WoW will not e.g 0x5BDC00 (get health) does this:

Thanks much - this is very good to know.

[amadmonk]

I'm pretty sure the main purpose of the descriptors is to have an easy way to get the object information from the server to the client.

++this. AFAIK, the descriptors let the server *selectively* update only portions of the wow object list. For instance, it's far more efficient to just update the target guid of unit X, the unit flags of unit Y, and the position of object Z, than it would be to have to re-send the entire data of those three objects. The descriptors are simply a handy way to index into the objects so that the server can selectively update portions of their data.

[namreeb]

I know of several games who serialize objects using strings to identify field names. At least WoW doesn't pass the string literally in the packet (I don't think). HoN does.

[sylvisj]

++this. AFAIK, the descriptors let the server *selectively* update only portions of the wow object list. For instance, it's far more efficient to just update the target guid of unit X, the unit flags of unit Y, and the position of object Z, than it would be to have to re-send the entire data of those three objects. The descriptors are simply a handy way to index into the objects so that the server can selectively update portions of their data.

makes sense, thanks.