[WoW] [6.1.2 19865] Release Info Dump Thread

[JamesHook]

enum AreaTriggerFields
{
    Caster = 0x30,
    Duration = 0x40,
    ExplicitScale = 0x4C,
    SpellID = 0x44,
    SpellVisualID = 0x48,
}

enum ContainerFields
{
    NumSlots = 0x388,
    Slots = 0x148,
}

enum ConversationData
{
    Dummy = 0x30,
}

enum ConversationDynamicData
{
    Actors = 0x30,
}

enum CorpseFields
{
    DisplayID = 0x50,
    DynamicFlags = 0xAC,
    FacialHairStyleID = 0xA4,
    FactionTemplate = 0xB0,
    Flags = 0xA8,
    Items = 0x54,
    Owner = 0x30,
    PartyGUID = 0x40,
    SkinID = 0xA0,
}

enum DynamicObjectFields
{
    Caster = 0x30,
    CastTime = 0x4C,
    Radius = 0x48,
    SpellID = 0x44,
    TypeAndVisualID = 0x40,
}

enum GameObjectFields
{
    CreatedBy = 0x30,
    DisplayID = 0x40,
    FactionTemplate = 0x58,
    Flags = 0x44,
    Level = 0x5C,
    ParentRotation = 0x48,
    PercentHealth = 0x60,
    SpellVisualID = 0x64,
    StateAnimID = 0x6C,
    StateAnimKitID = 0x70,
    StateSpellVisualID = 0x68,
    StateWorldEffectID = 0x74,
}

enum ItemDynamicFields
{
    Modifiers = 0x30,
}

enum ItemFields
{
    ContainedIn = 0x40,
    Context = 0x144,
    CreatePlayedTime = 0x13C,
    Creator = 0x50,
    Durability = 0x134,
    DynamicFlags = 0x8C,
    Enchantment = 0x90,
    Expiration = 0x74,
    GiftCreator = 0x60,
    MaxDurability = 0x138,
    ModifiersMask = 0x140,
    Owner = 0x30,
    PropertySeed = 0x12C,
    RandomPropertiesID = 0x130,
    SpellCharges = 0x78,
    StackCount = 0x70,
}

enum ObjectFields
{
    Data = 0x10,
    DynamicFlags = 0x28,
    EntryID = 0x24,
    Guid = 0x,
    Scale = 0x2C,
    Type = 0x20,
}

enum PlayerFields
{
    Amplify = 0x237C,
    ArenaFaction = 0x38C,
    AvgItemLevelEquipped = 0x104C,
    AvgItemLevelTotal = 0x1048,
    Avoidance = 0x2394,
    BagSlotFlags = 0x29B4,
    BankBagSlotFlags = 0x29C4,
    BlockPercentage = 0x233C,
    BuybackPrice = 0x2778,
    BuybackTimestamp = 0x27A8,
    CharacterPoints = 0x231C,
    Cleave = 0x239C,
    Coinage = 0x1C0C,
    CombatRatingExpertise = 0x2338,
    CombatRatings = 0x27E4,
    CritPercentage = 0x2348,
    CurrentBattlePetBreedQuality = 0x1050,
    CurrentSpecID = 0x1040,
    DodgePercentage = 0x2340,
    DuelArbiter = 0x340,
    DuelTeam = 0x390,
    ExploredZones = 0x23B0,
    FakeInebriation = 0x1038,
    FarsightObject = 0x1BD4,
    Glyphs = 0x2930,
    GlyphSlots = 0x2918,
    GlyphSlotsEnabled = 0x2948,
    GuildDeleteDate = 0x37C,
    GuildLevel = 0x380,
    GuildRankID = 0x378,
    GuildTimeStamp = 0x394,
    HairColorID = 0x384,
    HomeRealmTimeOffset = 0x2988,
    InsertItemsLeftToRight = 0x29E0,
    InvSlots = 0x1054,
    ItemLevelDelta = 0x29B0,
    KnownTitles = 0x1BE4,
    LfgBonusFactionID = 0x29A4,
    Lifesteal = 0x2390,
    LifetimeHonorableKills = 0x27DC,
    LifetimeMaxRank = 0x276C,
    LocalFlags = 0x2768,
    LootSpecID = 0x29A8,
    LootTargetGUID = 0x360,
    MainhandExpertise = 0x232C,
    Mastery = 0x2378,
    MaxLevel = 0x28F4,
    MaxTalentTiers = 0x2320,
    ModDamageDoneNeg = 0x26F0,
    ModDamageDonePercent = 0x270C,
    ModDamageDonePos = 0x26D4,
    ModHealingDonePercent = 0x2730,
    ModHealingDonePos = 0x2728,
    ModHealingPercent = 0x272C,
    ModPeriodicHealingDonePercent = 0x2734,
    ModPetHaste = 0x298C,
    ModResiliencePercent = 0x2754,
    ModSpellPowerPercent = 0x2750,
    ModTargetPhysicalResistance = 0x2764,
    ModTargetResistance = 0x2760,
    Multistrike = 0x2380,
    MultistrikeEffect = 0x2384,
    NextLevelXP = 0x1C18,
    NoReagentCostMask = 0x2908,
    OffhandCritPercentage = 0x2350,
    OffhandExpertise = 0x2330,
    OverrideAPBySpellPowerPercent = 0x275C,
    OverrideSpellPowerByAPPercent = 0x2758,
    OverrideSpellsID = 0x29A0,
    OverrideZonePVPType = 0x29AC,
    ParryPercentage = 0x2344,
    PetSpellPower = 0x294C,
    PlayerFlags = 0x370,
    PlayerFlagsEx = 0x374,
    PlayerTitle = 0x1034,
    ProfessionSkillLine = 0x2978,
    PvpInfo = 0x2864,
    PvpMedals = 0x2774,
    PvpPowerDamage = 0x23A8,
    PvpPowerHealing = 0x23AC,
    QuestCompleted = 0x29E4,
    QuestLog = 0x398,
    RangedCritPercentage = 0x234C,
    RangedExpertise = 0x2334,
    Readiness = 0x2388,
    Researching = 0x2950,
    RestState = 0x388,
    RestStateBonusPool = 0x26D0,
    RuneRegen = 0x28F8,
    SelfResSpell = 0x2770,
    ShieldBlock = 0x2370,
    ShieldBlockCritPercentage = 0x2374,
    Skill = 0x1C1C,
    Speed = 0x238C,
    SpellCritPercentage = 0x2354,
    Sturdiness = 0x2398,
    SummonedBattlePetGUID = 0x2990,
    TaxiMountAnimKitID = 0x1044,
    TrackCreatureMask = 0x2324,
    TrackResourceMask = 0x2328,
    UiHitModifier = 0x2980,
    UiSpellHitModifier = 0x2984,
    Versatility = 0x23A0,
    VersatilityBonus = 0x23A4,
    VirtualPlayerRealm = 0x103C,
    VisibleItems = 0xF50,
    WatchedFactionIndex = 0x27E0,
    WeaponAtkSpeedMultipliers = 0x2744,
    WeaponDmgMultipliers = 0x2738,
    WowAccount = 0x350,
    XP = 0x1C14,
    YesterdayHonorableKills = 0x27D8,
}

enum SceneObjectFields
{
    CreatedBy = 0x38,
    RndSeedVal = 0x34,
    SceneType = 0x48,
    ScriptPackageID = 0x30,
}

enum UnitFields
{
    AnimTier = 0x1AC,
    AttackPower = 0x284,
    AttackPowerModNeg = 0x28C,
    AttackPowerModPos = 0x288,
    AttackPowerMultiplier = 0x290,
    AttackRoundBaseTime = 0x17C,
    AuraState = 0x178,
    BaseHealth = 0x27C,
    BaseMana = 0x278,
    BattlePetCompanionGUID = 0xB0,
    BattlePetCompanionNameTimestamp = 0x2FC,
    BattlePetDBID = 0xC0,
    BoundingRadius = 0x188,
    ChannelObject = 0xC8,
    ChannelSpell = 0xD8,
    Charm = 0x30,
    CharmedBy = 0x60,
    CombatReach = 0x18C,
    CreatedBy = 0x80,
    CreatedBySpell = 0x1D4,
    Critter = 0x50,
    DemonCreator = 0x90,
    DisplayID = 0x190,
    DisplayPower = 0xE4,
    EffectiveLevel = 0x158,
    EmoteState = 0x1E0,
    FactionTemplate = 0x15C,
    Flags = 0x16C,
    Flags2 = 0x170,
    Flags3 = 0x174,
    Health = 0xEC,
    HoverHeight = 0x2E8,
    InteractSpellID = 0x300,
    Level = 0x154,
    LookAtControllerID = 0x32C,
    LookAtControllerTarget = 0x330,
    LooksLikeCreatureID = 0x328,
    LooksLikeMountID = 0x324,
    MaxDamage = 0x1A0,
    MaxHealth = 0x108,
    MaxHealthModifier = 0x2E4,
    MaxItemLevel = 0x2F4,
    MaxOffHandDamage = 0x1A8,
    MaxPower = 0x10C,
    MaxRangedDamage = 0x2A8,
    MinDamage = 0x19C,
    MinItemLevel = 0x2F0,
    MinItemLevelCutoff = 0x2EC,
    MinOffHandDamage = 0x1A4,
    MinRangedDamage = 0x2A4,
    ModBonusArmor = 0x274,
    ModCastingSpeed = 0x1C0,
    ModHaste = 0x1C8,
    ModHasteRegen = 0x1D0,
    ModRangedHaste = 0x1CC,
    ModSpellHaste = 0x1C4,
    MountDisplayID = 0x198,
    NativeDisplayID = 0x194,
    NpcFlags = 0x1D8,
    OverrideDisplayPowerID = 0xE8,
    PetExperience = 0x1B8,
    PetNameTimestamp = 0x1B4,
    PetNextLevelExperience = 0x1BC,
    PetNumber = 0x1B0,
    Power = 0xF0,
    PowerCostModifier = 0x2AC,
    PowerCostMultiplier = 0x2C8,
    PowerRegenFlatModifier = 0x124,
    PowerRegenInterruptedFlatModifier = 0x13C,
    RangedAttackPower = 0x294,
    RangedAttackPowerModNeg = 0x29C,
    RangedAttackPowerModPos = 0x298,
    RangedAttackPowerMultiplier = 0x2A0,
    RangedAttackRoundBaseTime = 0x184,
    ResistanceBuffModsNegative = 0x258,
    ResistanceBuffModsPositive = 0x23C,
    Resistances = 0x220,
    ScaleDuration = 0x320,
    Sex = 0xE0,
    ShapeshiftForm = 0x280,
    StateAnimID = 0x308,
    StateAnimKitID = 0x30C,
    StateSpellVisualID = 0x304,
    StateWorldEffectID = 0x310,
    StatNegBuff = 0x20C,
    StatPosBuff = 0x1F8,
    Stats = 0x1E4,
    Summon = 0x40,
    SummonedBy = 0x70,
    SummonedByHomeRealm = 0xDC,
    Target = 0xA0,
    VirtualItemID = 0x160,
    WildBattlePetLevel = 0x2F8,
}

[NitroGlycerine]

$SpellCooldownPtr = $WowBase + 0xD28E30

[WiNiFiX]

@Torpedoes

Hi, could I please get clarification on a few of your offsets you post.

1.
I have determined that you use LocalPlayer -> Descriptor -> for Health, Max Health, etc.., but I don't see you define any values for energy (for feral druids), since power is their mana amount, have you got offsets for these available?

2.
I use the below code to get my current target GUID

var TargetGuid = mem.Read<uint>(new IntPtr(0xE35F20), true);

but when i loop through all objects in entities, I am unable to find any GUID with the same number, I am using the below logic to loop through the entities.

IntPtr EntityList = mem.Read<IntPtr>(new IntPtr(0xD3B358), true);
IntPtr FirstObj = mem.Read<IntPtr>(EntityList + 0x0C, false);
byte EntityType = mem.Read<byte>(FirstObj + 0x0C, false);

IntPtr curObj = FirstObj;

while (curObj.ToInt64() != 0 && (curObj.ToInt64() & 1) == 0)
{
    byte Type = mem.Read<byte>(curObj + 0x0C, false);               
    IntPtr Descriptor = mem.Read<IntPtr>(curObj + 0x04, false);
    uint GlobalID = mem.Read<uint>(curObj + 0x00, false);        // I have tried mem.Read<uint>(Descriptor + 0x00, false); aswell. 
    uint EntityID = mem.Read<uint>(curObj + 0x24, false);

    if ((GlobalID == TargetGuid) || (EntityID == TargetGuid))
    {
       // This is never reached
    }

    var nextObj = mem.Read<IntPtr>(IntPtr.Add(curObj, 0x3C), false);
    if (nextObj == curObj)
       break;
    else
       curObj = nextObj;
}

[Torpedoes]

I have determined that you use LocalPlayer -> Descriptor -> for Health, Max Health, etc.., but I don't see you define any values for energy (for feral druids), since power is their mana amount, have you got offsets for these available?

I'm not yet tracking Combo Points and Runes, I probably will track those in the future though. For now, your best bet is finding them yourself.

I use the below code to get my current target GUID but when i loop through all objects in entities, I am unable to find any GUID with the same number, I am using the below logic to loop through the entities.

I suggest looking at the Cheat Engine tables I provided, you'll be able to see the data types for each of the offsets as well as their values. Then build your application bit by bit to ensure the values you're reading from memory match the values you see in Cheat Engine.

A couple notes about your code. First of all, GUID's are 128-Bit integers, you're reading a uint which is only 32-Bit. Second be careful when using IntPtr to read pointers in-game, if your application is 64-Bit and you're reading from a 32-Bit WoW then you're reading 8 bytes worth of information instead of 4 bytes, which is not what you want. It's better to state an explicit value depending on whether WoW is 32 or 64 Bit. And finally, make sure you add the wow base address to the global offsets, otherwise you'll get the address at 0xE35F20, instead of Wow.exe + 0xE35F20.

[WiNiFiX]

@Torpedoes,

Thanks, looking at the cheat-engine layout didn't even register, I will do so.
Regarding the offsets I am adding wow's base address when needed, I am getting most of the data I need not all of it.
Thanks for the tips on the x86 and x64 pointers I was not aware of those differences.

Judging by the fact that you not tracking energy, I assume you are playing (or more accurately "watching your pc play" a spell caster :P)

[Torpedoes]

Judging by the fact that you not tracking energy, I assume you are playing (or more accurately "watching your pc play" a spell caster :P)

I mainly play spell casters yeah but that's not the reason I'm not tracking it. I only track offsets which my applications require, which is Sonar and Wild-Catch at the moment, as well as some other unreleased products. As I develop more and more apps, the offset list will grow.

[WiNiFiX]

@Torpedoes

I am using
var TargetGuid = mem.Read<byte>(new IntPtr(0xE35F20), 16, true);
as suggested, but i think I am mis-interpreting EntityID and GlobalID, I was assuming that one of them was the GUID of the object, but it appears that is not the case.
What exactly do they refer to, I am unable to see them in your cheat engine tables.

[Torpedoes]

I think I am mis-interpreting EntityID and GlobalID, I was assuming that one of them was the GUID of the object, but it appears that is not the case.
What exactly do they refer to?

Entity ID = NPC ID (i.e. wowhead.com/npc=17968)
Global ID = 16-Byte GUID.

I am unable to see them in your cheat engine tables.

Cheat Engine > Memory View > Tools > Dissect Data / Structures - then - Structures > Unit
Put in the base address of the Unit (i.e. Player or NPC) and you'll see their information.

[WiNiFiX]

For those interested I found the offset for Energy @ 0x0F8
Thanks again for your tips Torpedoes, been of great help, I have learnt a lot in CE this evening.

[Torpedoes]

For those interested I found the offset for Energy @ 0x0F8
Thanks again for your tips Torpedoes, been of great help, I have learnt a lot in CE this evening.

I guess the fact that combo points are no longer target specific made things easier. Although Death Knight runes are also worth looking into but those seem more complicated.

[WiNiFiX]

I guess the fact that combo points are no longer target specific made things easier. Although Death Knight runes are also worth looking into but those seem more complicated.

Haven't got that far yet.

1. Today's goal was tracking energy
2. Next goal is to track debuffs on target so i don't re-apply them
3. Then i will worry about combo-points. - Edit: Found this quicker than expected its 0x0FC;

I am slowly trying to build my own out-of-process bot, that just sends keystrokes, (purely rotational) I don't trust anthrax because it claims to be out of process,
but it doesn't explain how it crashes wow if you load an incorrect class profile, if its out of process sending keystrokes and mouse clicks alone can't crash wow.exe,
ofc I have raised this question with Nom, but no reply seems the norm on those forums.

Once completed I will release the C# source on the forums.

I don't see myself looking into DK's, never liked the class much myself and if Apoc made comments like below, I have no hope of finding it :P

http://www.ownedcore.com/forums/worl...nic-power.html (Runes and Runic Power)

        private uint GetCurrentPower(WoWPowerType power)
        {
            switch (power)
            {
                case WoWPowerType.Health:
                    return GetStorageField<uint>(UnitFields.UNIT_FIELD_HEALTH);
                case WoWPowerType.Mana:
                    return GetStorageField<uint>(UnitFields.UNIT_FIELD_POWER1);
                case WoWPowerType.Rage:
                    return GetStorageField<uint>(UnitFields.UNIT_FIELD_POWER2);
                case WoWPowerType.Energy:
                    return GetStorageField<uint>(UnitFields.UNIT_FIELD_POWER3);
                case WoWPowerType.Focus:
                    return GetStorageField<uint>(UnitFields.UNIT_FIELD_POWER4);
                case WoWPowerType.Happiness:
                    return GetStorageField<uint>(UnitFields.UNIT_FIELD_POWER5);
                //case WoWPowerType.Runes: // TODO: What the hell is this one?
                //    return GetStorageField<uint>(UnitFields.UNIT_FIELD_POWER6);
                case WoWPowerType.RunicPower:
                    return GetStorageField<uint>(UnitFields.UNIT_FIELD_POWER7);
                default:
                    throw new ArgumentOutOfRangeException("power");
            }
        }

[Torpedoes]

I don't trust anthrax because it claims to be out of process, but it doesn't explain how it crashes wow if you load an incorrect class profile, if its out of process sending keystrokes and mouse clicks alone can't crash wow.exe, ofc I have raised this question with Nom, but no reply seems the norm on those forums.

It could be writing to memory, which, if you're not careful, can crash the game and even get you banned.

[JuJuBoSc]

Anthrax use hwbp to handle mouse movements, that's why it may crash if the "debugger" isn't here anymore when an input is sent to wow.

[Evansbee]

I'm having a crazy time with a few things, any tips would be appreciated (i'm doing x64):

(1) buff count
i've found 0x2330 and 0x2440, but they seem to be (uint32_t)flags,(uint32_t)spellID and a packed array of spellIDs, none of them take me to a spell structure where I can dig up the darned count. Thus I believe these are the incorrect offsets for what I want to do.
(2) determining whether the unit is in my party/raid or not. I've had some luck getting their relation to me, but not whether they're in a group or not. Is there some sort of groupID/group count that I'm missing
(3) my own spell cooldowns. I'm just lost here, i saw the offsets earlier about the Script_GetSpellCooldown, but that's not rebased at all and there's no function there. I found the string that's likely being used by lua but all the fu nctions that I find referencing it aren't the actual function that calculates it. I'm a bit lsot.


I don't need to be spoonfed, although a solid description of why there are so many different ways to get aura information would be appreciated. I can do the work, I'm just a bit stuck.

Many thanks!

[Jadd]

I'm having a crazy time with a few things, any tips would be appreciated (i'm doing x64):

(1) buff count
i've found 0x2330 and 0x2440, but they seem to be (uint32_t)flags,(uint32_t)spellID and a packed array of spellIDs, none of them take me to a spell structure where I can dig up the darned count. Thus I believe these are the incorrect offsets for what I want to do.
(2) determining whether the unit is in my party/raid or not. I've had some luck getting their relation to me, but not whether they're in a group or not. Is there some sort of groupID/group count that I'm missing
(3) my own spell cooldowns. I'm just lost here, i saw the offsets earlier about the Script_GetSpellCooldown, but that's not rebased at all and there's no function there. I found the string that's likely being used by lua but all the fu nctions that I find referencing it aren't the actual function that calculates it. I'm a bit lsot.


I don't need to be spoonfed, although a solid description of why there are so many different ways to get aura information would be appreciated. I can do the work, I'm just a bit stuck.

Many thanks!

1. These are for x86, but hopefully it helps you to transfer it over to x64 if you can find the functions which reference them (don't have IDA available at the moment so I can't say where they are referenced, sorry). Haven't looked at these unknown values but buff stack count is probably in there, too.

AuraTable                                                               = 0x10C8,
AuraCount                                                               = 0x1548;

...

    [StructLayout(LayoutKind.Sequential)]
    public struct Aura {
        private int unk1;
        private int unk2;
        private int unk3;
        private int unk4;
        private int unk5;
        private int unk6;
        private int unk7;
        private int unk8;
        private int unk9;
        private int unk10;
        private int unk11;
        private int unk12;
        public int SpellId;
        public int Flags;
        public int Duration;
        public int EndTime;
        private int unk13;
        private int unk14;
    }

3. Spell_C_GetSpellCooldown. Don't have the parameters for this function either, at the moment. I think parameter 1 is spell ID, and parameter 3 is output pointer for a CooldownInfo object.

    public enum CooldownState : uint {
        SpellActive,
        CooldownActive
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct CooldownInfo {
        public int StartTime;
        public int Duration;
        public CooldownState State;
    }