[OS X] How to find PLUA offsets on OS X?

[peafish]

Hello everybody

I’m trying to find the offsets for a working PLUA hack on Mac OS X.

Memory editing works well with gdb from Xcode with this one-liner:

echo "set {char[6]}0x10054cd90={0xb8,0x01,0x00,0x00,0x00,0xc3}" | gdb attach `ps ax|grep Warcraft|grep -v grep|awk '{print $1}'`

(that worked for the OS X x64 build 16669)

but now that the client is updated, I’m having a hard time finding the correct offsets. I read the stickies but they are all very Windows centric. I installed IDA but from what I gather, I’ll have to run a remote debugger to get access to the memory of the running process. The remote debugger doesn’t seem to run on 10.8 though. Has anybody successfully done this on Mountain Lion?
Is there a better resource for OS X WoW memory hacking than this particular forum somewhere?

[bockwurst25]

Hi, did you find anything? I search a long time for lua hack on os x, without pocketgnome and pocketgoblin.

[peafish]

I only found the (old and outdated) gist for previous versions:

https://gist.github.com/mavril/4020888

the guy stopped updating it though.

[peafish]

Still looking for some input on this. I’m setting up a separate machine with 10.7 at the moment to run the debugger on.

[sbn666]

Also looking for input on this. I've tried using the IDA Pro trial to look for something but I honestly have no idea what to look for.