How to Dump Wow from Memory....

[Archos]

Thank you for the info. I am curious if this makes any sense?
uvAC1nx.png

[Razzue]

Thank you for the info. I am curious if this makes any sense?
uvAC1nx.png

If you're looking for the OM offset, you can find the pattern for it in my GitHub, just use the SOM patterns instead of the TBC patterns :P then starting digging around xref uses that offset.

[Archos]

Ahh, so I guess TBC/SOM and Retail offsets are the same or close?

[Razzue]

Ahh, so I guess TBC/SOM and Retail offsets are the same or close?

For the most part, majority of the patterns will work between all versions, though field offsets differ vastly from retail. Tbc client is pretty much the same as retail client now :P

[Archos]

Hopefully last question for now, are there any recommended ways for accessing the WoW process memory (read only) from C#?

[Razzue]

Hopefully last question for now, are there any recommended ways for accessing the WoW process memory (read only) from C#?

I just use the generic OpenProcess + Read/Write ProcessMemory calls. Lately I've even started going over board and using a Kernel Driver developed with c# as well... But again that's a tad overkill

[Archos]

Should my process run with administrative privileges? I expect I will need to since I want to send key presses using the interception API. Basically, I want to interact with the game client via key presses while obtaining the data I need for executing actions (rotation, etc.) through reading memory.

I apologize also if I have high jacked this thread into something unrelated. I can start a new one if needed.

[Razzue]

Admin priv's are not requires, though make sure WoW/BNet are without admin rights.
If for personal use, Interception is a bit overkill and SendMessage works fine. If selling... I would still not use interception.. but that's just me :P

Here's a slimmed down version of what my game/keypress handler's like.
You can find what I use for generic type reading in my dumpers client class as well

internalclassClient{
    private static IntPtr Handle;
    private static Process _active;
    private static List<Process> _procs;

    internal static bool Search()
    {
        try
        {
            _procs = new List<Process>();
            var cProcs = Process.GetProcessesByName("WowClassic");
            if (cProcs.Length > 0)
                _procs.AddRange(cProcs);

            if (null == _procs || _procs.Count <= 0)
                throw new Exception("Could not find any wow clients.");

            return null != _procs && _procs.Count > 0;
        }
        catch (Exception) { return false; }
    }

    internal static bool Attach(int id)
    {
        try
        {
            _active = _procs[id];
            Handle = Imports.OpenProcess(Imports.ALL_ACCESS, false, _active.Id);
            return null != _active && Handle != IntPtr.Zero;
        }
        catch (Exception) { return false; }
    }
    
    internal static bool Close()
    {
        try
        {
            if (null == _active)
                throw new Exception("Not attached to a process.");

            var c = 1250;
            _active.Kill();

            while (!_active.HasExited)
            {
                Thread.Sleep(1);
                if (c == 0) break;
                c--;
            }

            if (!_active.HasExited)
                throw new Exception("Process has not exited.");

            return _active.HasExited;
        }
        catch (Exception) { return false; }
    }

    internal static bool Detach()
    {
        try
        {
            _procs = null;
            _active = null;
            return true;
        }
        catch (Exception) { return false; }
    }

    // For Key Sending.
    // Stamp is another class that parses a unix timestam to ms, s or m.
    internal static void PostFull(int[] _Key, int sleep = 20)
    {
        if (sleep < 20) return;
        foreach (var key0 in _Key)
            Imports.PostMessage(Window, Imports.WM_KEYDOWN, key0, 1);

        var old = Stamp.Milliseconds;
        long dif = 0;
        while (dif < sleep)
            dif = Stamp.Milliseconds - old;

        foreach (var key1 in _Key)
            Imports.PostMessage(Window, Imports.WM_KEYUP, key1, 1);
    }

    internal static void PostHalf(int Dir, int[] _Key)
    {
        foreach (var key in _Key)
            Imports.PostMessage(Window, Dir == 0 ? Imports.WM_KEYUP : Dir == 1 ? Imports.WM_KEYDOWN : Imports.WM_KEYUP, key, 0);
    }

}

[doityourself]

If you're having issues with ODF, just use the dumper I linked directly above you by nameeeb. Works fine on all classics and retail. I personally don't follow the op method anymore as my wow clients auto close on ScyllaHide attach 🙃

if used wrong, yes

[Archos]

if used wrong, yes

I did have instances in which I could attach x64dbg to the WoW client process without it crashing but I could not seem to get the correct number of imports to populate.

[Archos]

Admin priv's are not requires, though make sure WoW/BNet are without admin rights.
If for personal use, Interception is a bit overkill and SendMessage works fine. If selling... I would still not use interception.. but that's just me :P

Here's a slimmed down version of what my game/keypress handler's like.
You can find what I use for generic type reading in my dumpers client class as well

internalclassClient{
    private static IntPtr Handle;
    private static Process _active;
    private static List<Process> _procs;

    internal static bool Search()
    {
        try
        {
            _procs = new List<Process>();
            var cProcs = Process.GetProcessesByName("WowClassic");
            if (cProcs.Length > 0)
                _procs.AddRange(cProcs);

            if (null == _procs || _procs.Count <= 0)
                throw new Exception("Could not find any wow clients.");

            return null != _procs && _procs.Count > 0;
        }
        catch (Exception) { return false; }
    }

    internal static bool Attach(int id)
    {
        try
        {
            _active = _procs[id];
            Handle = Imports.OpenProcess(Imports.ALL_ACCESS, false, _active.Id);
            return null != _active && Handle != IntPtr.Zero;
        }
        catch (Exception) { return false; }
    }
    
    internal static bool Close()
    {
        try
        {
            if (null == _active)
                throw new Exception("Not attached to a process.");

            var c = 1250;
            _active.Kill();

            while (!_active.HasExited)
            {
                Thread.Sleep(1);
                if (c == 0) break;
                c--;
            }

            if (!_active.HasExited)
                throw new Exception("Process has not exited.");

            return _active.HasExited;
        }
        catch (Exception) { return false; }
    }

    internal static bool Detach()
    {
        try
        {
            _procs = null;
            _active = null;
            return true;
        }
        catch (Exception) { return false; }
    }

    // For Key Sending.
    // Stamp is another class that parses a unix timestam to ms, s or m.
    internal static void PostFull(int[] _Key, int sleep = 20)
    {
        if (sleep < 20) return;
        foreach (var key0 in _Key)
            Imports.PostMessage(Window, Imports.WM_KEYDOWN, key0, 1);

        var old = Stamp.Milliseconds;
        long dif = 0;
        while (dif < sleep)
            dif = Stamp.Milliseconds - old;

        foreach (var key1 in _Key)
            Imports.PostMessage(Window, Imports.WM_KEYUP, key1, 1);
    }

    internal static void PostHalf(int Dir, int[] _Key)
    {
        foreach (var key in _Key)
            Imports.PostMessage(Window, Dir == 0 ? Imports.WM_KEYUP : Dir == 1 ? Imports.WM_KEYDOWN : Imports.WM_KEYUP, key, 0);
    }

}

This is strictly personal use.

I noticed a JSON file is created along with a CS file. I assume you have a program that uses a combination of the Offset_Manager class in the CS file and info from JSON to read data from the process memory?

[Razzue]

This is strictly personal use.

I noticed a JSON file is created along with a CS file. I assume you have a program that uses a combination of the Offset_Manager class in the CS file and info from JSON to read data from the process memory?

The JSON is just a collection of the selected patterns in a .JSON value (allows users to edit names/patterns, add new entries etc instead of editing them in source, and needing to re-compile) the .CS is what I use to read game memory

I use a slightly altered version that posts results to a database, with the idea to be running this on a PC/VM and auto dump wow whenever it updates, plus a nice lil discord bot to ping me if a pattern ever fails (produces 0x0 or 0x30096)

[Archos]

How do you know the type of the data being read from the offset?

[Razzue]

How do you know the type of the data being read from the offset?

GitHub - mmalka/TheNoobBot: TheNoobBot is a bot for World of Warcraft live.

GitHub - Lbniese/LazyBot: Currently supports WoW Version: 6.1.0 19702

And hours upon hours spent searching through this forum ++ a lot of guesswork And of course with the help of some of the peeps that were in this forum regularly.

[Archos]

GitHub - mmalka/TheNoobBot: TheNoobBot is a bot for World of Warcraft live.

GitHub - Lbniese/LazyBot: Currently supports WoW Version: 6.1.0 19702

And hours upon hours spent searching through this forum ++ a lot of guesswork

I know what you mean. I have been at a party for the last 3 hours browsing OwnedCore on my iPhone. Would it be good if I store offset and type (string/int) together?