Since I updated the game to 25549 I can't find anything in CE, and moreover not a single static pointer (green value in CE). Now I have now idea how to update the little tool I wrote.
Since I updated the game to 25549 I can't find anything in CE, and moreover not a single static pointer (green value in CE). Now I have now idea how to update the little tool I wrote.
It's obfuscated now.
The Free Lunch Is Over - Obfuscation is Coming
"If it compiles, it works."
Seems to load just fine in IDA 7 still, going to play around a bit and see what I can find
EDIT: This still looks the same, still uses static pointers
https://hastebin.com/otuwamoxuq.cpp
Not sure what is going on.
ObjMgrBase = 0x114FD7C <---- untested, but this is the address according to IDA
Maybe they've just done something that confuses CE?
Last edited by oDev; 11-23-2017 at 09:56 AM.
Hmm very interesting
This code might come in handy soon cheatengine-threadstack-finder/ntinfo.cpp at thread-base-addr * makemek/cheatengine-threadstack-finder * GitHub
EDIT: x64 object manager base according to IDA: wow-64.exe+0x1A3C1C0
Last edited by oDev; 11-23-2017 at 11:51 AM.
Seems to work as always for me. Some examplex for x64 rebased to zero 7.2.3.25548
Dumped from normalpatterns as always.Code:internal static cliass Pointers64 { static Pointers64() { ImageBase = System.Diagnostics.Process.GetCurrentProcess().MainModule.BaseAddress; } internal static readonly IntPtr ImageBase; internal struct Manager { internal static readonly IntPtr EnumVisibleObjects; static Manager() { EnumVisibleObjects = ImageBase + 0x006E5400; } } internal static cliass SpellBook { internal static readonly IntPtr Information; internal static readonly IntPtr Count; static SpellBook() { Information = ImageBase + 0x1CAE098; Count = ImageBase + 0x1CAE090; } }
Last edited by lolp1; 11-23-2017 at 06:58 PM.