Finding something that dosent have a visible value.

[cenron]

So I been having pretty good luck finding offsets for things like GUID and health and so on. However how do you find offsets for something like "ClickToMove"?

I have searched the forum and there is a lot of information on CTM, and lots of people asking for offsets, but no one ever asks, "How do you find the CTM function.
I don't really know where to start with finding something like this because there is no value associated with it, or lua function, or string ( that I can find ). So my questions is two part.

1) If you had never looked at wow's code, and your trying to find ClickToMove how would you do it?
2) Whats the current address, so when I do go looking for it, and I think i found it, i can compare to make sure its the right address...

Ugghh, this stuff is so frustrating, I wish I was already UBER L33T, and didn't have to put so many hours into this and still no find what I am looking for!

[Corthezz]

While your character is running with CTM there has to be a value which is different than it is when you are not moving with CTM. In general every change you can see is obviously also a value which is being changed in the memory. If you cant determine any value which could represent the state/change you can use cheat engine and scan for changed / unchanged values.

Let me give you an example for CTM:
Dont move your character
Scan for an unknown initial value
Start a ctm movement
Do a Next Scan for changed values while the character is stil moving (CTM idle != CTM run, obviously there must have something changed)
Wait til your character finishes or interrupts the CTM movement
Scan for changed value again
Scan a few time for non changed values (CTM idle -> CTM idle, no change)

Rinse and repeat until you found your address. When you have found your address you can dig deeper in IDA / OllyDBG.

[cenron]

While your character is running with CTM there has to be a value which is different than it is when you are not moving with CTM. In general every change you can see is obviously also a value which is being changed in the memory. If you cant determine any value which could represent the state/change you can use cheat engine and scan for changed / unchanged values.

Let me give you an example for CTM:
Dont move your character
Scan for an unknown initial value
Start a ctm movement
Do a Next Scan for changed values while the character is stil moving (CTM idle != CTM run, obviously there must have something changed)
Wait til your character finishes or interrupts the CTM movement
Scan for changed value again
Scan a few time for non changed values (CTM idle -> CTM idle, no change)

Rinse and repeat until you found your address. When you have found your address you can dig deeper in IDA / OllyDBG.

Hmm I would think that things like X,Y,Z position, and render states would mess up your results on this because they change when you move and dont change when you stop......I guess to kind of expand on your idea. You can do exactly those steps but after you do the few unchanged scans you can move around using the keyboard and not the click to move and check to unchanged values while your moving.

Ill give it a go when I get home...

also for anyone that finds this thread, there is now a tutorial posted.....

http://www.ownedcore.com/forums/worl...ml#post3054611 ([HowTo] Find ClickToMove)

[xalcon]

Hmm I would think that things like X,Y,Z position, and render states would mess up your results on this because they change when you move and dont change when you stop......I guess to kind of expand on your idea. You can do exactly those steps but after you do the few unchanged scans you can move around using the keyboard and not the click to move and check to unchanged values while your moving.

Ill give it a go when I get home...

also for anyone that finds this thread, there is now a tutorial posted.....

http://www.ownedcore.com/forums/worl...ml#post3054611 ([HowTo] Find ClickToMove)

Actually, thats the way I'm doing it in the tutorial :P I just dont use the position values but some well known flags (ActionType), but the process is the same.