AntiAfk Problem

[flo8464]

Hey!

I am currently trying to implement some anti afk for my bot as it always went afk.
After some reversing I stumbled accross CSimpleTop::m_eventTime, which is increased after every hardware event, realtime like I thought.
Freezing it kept me staying afk/logging out, so it seems to be the right value.

I wrote this code:

std::uintptr_t const LAST_HARDWARE_EVENT = 0xD92B90;

static inline std::uint32_t getLocalTimeMs()
{
return (std::clock() / (CLOCKS_PER_SEC / 1000));
}

static inline std::uint32_t& getLastHardwareEvent()
{
return *reinterpret_cast<std::uint32_t*>(LAST_HARDWARE_EVENT);
}

void WoW:ulseAntiAfk()
{
static std::uint32_t difference =
std::abs(getLocalTimeMs() - getLastHardwareEvent());

std::uint32_t curDifference =
std::abs(getLocalTimeMs() - getLastHardwareEvent());
if(curDifference > difference)
getLastHardwareEvent() += curDifference - difference;
}

It keeps the value synchronised to the 'real' time.
But after some time it stops working.

I investigated it a bit and found out that the value is increased kinda similar to real time but after a while there's a huge gap.
Wtf ist WoW doing there? And is it an option to simply set it to 0xFFFFFFFF every frame?

Thank you.
Regards,
Flo

[miceiken]

Why dont you just write performance count to LastHardwareAction?

        public static void ResetHardwareAction()
        {
            Magic.Write(Offsets.LastHardwareAction, PerformanceCount);
        }

[flo8464]

Why dont you just write performance count to LastHardwareAction?

        public static void ResetHardwareAction()
        {
            Magic.Write(Offsets.LastHardwareAction, PerformanceCount);
        }

Hi.

With PerformanceCount you mean the value returned by QueryPerformanceCounter ?
That value has a much higher resolution, WoW seems to use millisecond resolution.
So using that value of course works (as it is high enough to be never reached by WoW's millisecond comparisons), but it's so easy to detect if the value of the last hardware action is "from the future".
Writing UINT_MAX would be the most easy solution, but surely not the best.

[Thongs]

He means by calling WoW's function at 0x4626D0 (rebased). It's generally referred to as PerformanceCount, GetTickCount or OsGetAsyncTimeMs. If I remember correctly, I think there's also a static address for it if you're trying to get the value from it without being injected.

[flo8464]

He means by calling WoW's function at 0x4626D0 (rebased). It's generally referred to as PerformanceCount, GetTickCount or OsGetAsyncTimeMs. If I remember correctly, I think there's also a static address for it if you're trying to get the value from it without being injected.

Ok, PerformanceCount/TickCount are very odd names, just because OsGetAsyncTimeMs internally uses them.
I was a bit confused from the disassembly of OsGetAsyncTimeMs, but I use it now, so thanks.

But I am still interested why those timestamps are so far off from the real time.

[MaiN]

Just reverse OsGetAsyncTimeMs. You will see that it does much more than just get the time in ms.

[miceiken]

IIRC you get logged out if you write a timestamp that's too far off, so I don't think uint maxvalue would solve anything.

[Cypher]

Just reverse OsGetAsyncTimeMs. You will see that it does much more than just get the time in ms.

​It also reads your email.

[MaiN]

​It also reads your email.

No no, that's this guy:
&#x202a;O365 MGX Copy wmv&#x202c;&rlm; - YouTube