[Help] Cant get a player name

[avizer]

wat am I doing wrong?
Result in attach file(empty string)

Console.WriteLine("WoW list:");
            Console.WriteLine("========================");
            Process[] procs = Process.GetProcesses();
            int[] WowIds = new int[100];
            int i = 0;
            for (int j = 0; j < procs.Length; j++)
            {
                if (procs[j].ProcessName == "Wow")
                {
                    Console.WriteLine("#" + i + ": " + procs[j].Id);
                    WowIds[i] = procs[j].Id;
                    i++;
                }
            }
            Console.WriteLine("========================");
            Console.Write("Attach: ");
            i = int.Parse(Console.ReadLine());
            BlackMagic wow = new BlackMagic(WowIds[i]);
            string PlayerName = wow.ReadASCIIString(0x00EC3180, 12);
            Console.WriteLine(PlayerName);

[Erke]

I might be wrong but I think you need to do ImageBase + 0x00EC3180 in your ReadASCIIString

[avizer]

ImageBase ?

[Aethereal]

The address of the Main Module (Process.MainModule.BaseAddress); usually 0x400000

[Jadd]

The address of the Main Module (Process.MainModule.BaseAddress); usually 0x400000

Depends on whether ASLR is enabled.

[avizer]

Thx dude!
I use it:

 IntPtr BaseAddress = wow.MainModule.BaseAddress;

[OMLinux]

Depends on whether ASLR is enabled.

Is there way to disable ASLR at the startup of process?

Here is VMem table of Wow.exe mappings (proc/wow_pid/maps contents)? Why there are 3 mapping (first one looks like standard win base address, but too small)? Is ASLR root of it or it wine-only specific (I mean 3 mapped addresses, not ASLR).

virtual address space	perm	offset	device	inode	path
00400000-00401000	r--p	00000000	08:18	17826132	~/bin/wow/Wow.exe
00ede000-00f92000	rw-p	00adc000	08:18	17826132	~/bin/wow/Wow.exe
0131c000-01415000	r--p	00b90000	08:18	17826132	~/bin/wow/Wow.exe

Last question. There are a lot offsets posted on this forum (rebased to Wow.exe mapping address as I understand). Are local player GUID, name, CurrentZoneName and so on located on stack or in heap?

[xalcon]

ASLR is a security feature and yes, you can disable it. There are (at least) two ways to do so: Either disable it globally (using registry settings) or remove the flag from the PE header (http://www.ownedcore.com/forums/worl...aft-patch.html (Disable ASLR in World of Warcraft (patch)))

But realy, dont disable ASLR. Its there for a reason. As long as you have the proper permissions (which I guess you have when you develop hacks/bots) there should be no problem having ASLR enabled.

Last question. There are a lot offsets posted on this forum (rebased to Wow.exe mapping address as I understand). Are local player GUID, name, CurrentZoneName and so on located on stack or in heap?

What the ****... are you talking about? Do you even know the difference between stack and heap?... It wouldn't make sense when those offsets are located on the stack... just think about it.

[avizer]

And another question:
why, as a result of executing this code, I have the zeros?
(Result in attach file)

uint objMgr = wow.ReadUInt((int)Offsets.ObjectManager.clientConnection + (uint)BaseAddress);
            uint objMgrNext = wow.ReadUInt(objMgr + (int)Offsets.ObjectManager.objectManager);
            uint curObject = wow.ReadUInt(objMgrNext + (int)Offsets.ObjectManager.FirstObject);

            uint PlayerGUID = wow.ReadUInt(objMgrNext + (uint)Offsets.ObjectManager.LocalGUID);
            Console.WriteLine(PlayerGUID);
            while (curObject != 0 && (curObject % 2) == 0)
            {
                uint ObjectType = wow.ReadUInt(curObject + (uint)Offsets.WoWUnitFields.ChannelObject);
                uint objGUID = wow.ReadUInt(curObject + (uint)Offsets.WoWObjectFields.Guid);
                Console.WriteLine(ObjectType);
                switch (ObjectType)
                {
                    case (int)Offsets.WoWObjectType.Unit:
                        Console.WriteLine("Unit");
                        break;
                    case (int)Offsets.WoWObjectType.Item:
                        Console.WriteLine("Item");
                        break;
                    case (int)Offsets.WoWObjectType.Container:
                        Console.WriteLine("Container");
                        break;
                    case (int)Offsets.WoWObjectType.Corpse:
                        Console.WriteLine("Corpse");
                        break;
                    case (int)Offsets.WoWObjectType.GameObject:
                        Console.WriteLine("GameObject");
                        break;
                    case (int)Offsets.WoWObjectType.DynamicObject:
                        Console.WriteLine("DynamicObject");
                        break;
                    case (int)Offsets.WoWObjectType.Player:
                        Console.WriteLine("Player " + objGUID);
                        break;
                }

                if (objGUID == PlayerGUID)
                    Console.WriteLine("Me detected!");

                curObject = wow.ReadUInt(curObject + (int)Offsets.ObjectManager.NextObject);
            }

public enum ObjectManager
        {
            clientConnection = 0xEC3140,
            objectManager = 0x462C,
            FirstObject = 0xCC,
            NextObject = 0x34,
            LocalGUID = 0xE8
        };
public enum WoWObjectFields
        {
            Guid = 0x0
        };
public enum WoWUnitFields
        {
             ChannelObject = 0x68
        };

[xalcon]

• Is WoW running in 32 Bit Mode?
• Is your application running with Administrator Privileges?
• Is your ObjMgr Pointer pointing to valid location/not a nullpointer?
• Are you using the latest wow client? (5.4.7 17930)

And just a sidenote, the GUID is a UInt64, not UInt32.

[avizer]

• Is WoW running in 32 Bit Mode?
• Is your application running with Administrator Privileges?
• Is your ObjMgr Pointer pointing to valid location/not a nullpointer?
• Are you using the latest wow client? (5.4.7 17930)

And just a sidenote, the GUID is a UInt64, not UInt32.

1. yes
2. yes
3. As a result of
uint objMgrx = wow.ReadUInt((int)Offsets.ObjectManager.clientConnection);
I have 0. Or I do not understand?
4. yes

[Jadd]

uint objMgrx = wow.ReadUInt((int)Offsets.ObjectManager.clientConnection);
I have 0. Or I do not understand?

WTF? This code isn't even from the snippet you provided in the previous post. Please do us a favour and come back when you have any idea how to ask for programming support.

[avizer]

WTF? This code isn't even from the snippet you provided in the previous post. Please do us a favour and come back when you have any idea how to ask for programming support.

xalcon asked: "Is your ObjMgr Pointer pointing to valid location/not a nullpointer?"
I have not this line of code. I answered the question

What's the problem with ObjectMngr?

[OMLinux]

What the ****... are you talking about? Do you even know the difference between stack and heap?... It wouldn't make sense when those offsets are located on the stack... just think about it.

Sorry, It was my mistake (strong headache). I understand different between stack and heap quite good (offsets are not pointing heap). It should be data segment (bss? Am I right?). On the other hand CurManager (as data) located on stack (or heap), but there's static poiter in data segment, that pointed to it?

[avizer]

pls help ^^