UpdateDisplayInfo Model Bug

[DarkLinux]

I have seen parts of this talked about before but I don't think it was ever concluded.

When you do a race change you must set the race id and the character model id so they match. This works until you exit combat. When ending combat the character goes back to that broken state of mesh/model mismatching.

A fix that I have found to work is simply setting the values back after calling update. But if you do it too fast the same mismatching of meshes happens, so I simply wait 4 frames before setting it back.

The problem I'm running into is with druid shapeshifting. I think the problem is I'm setting the values back too soon yet the mesh has not loaded. I would like to find a sold fix for both example, I feel like the state must be saved somewhere and I dont need to wait an arbitrary amount of frames.

player + 0x10 ] + 0x00D4 = Race ( or  player + 0x200 ] + 0x00A4 )
player + 0x10 ] + 0x01A8 = DisplayID ( or  player + 0x200 ] + 0x0178 )
player + 0x10 ] + 0x01AC = NativeDisplayID ( or  player + 0x200 ] + 0x017C )

player + 0x1748 = DisplayID2

Cant tell what this one is used for, no need to update it as UpdateDisplayInfo does that. Setting the value back also does not look to do anything.

player + 0x8 ] + 0x36C = DisplayID3

This also has the players model id, but not in shapeshifting form, the values are different. The value is 5143 when it should be 29405 for a night elf male feral cat druid form. Any ideas what that value is? Also does not look to have an effect if set.


Every 1 in 20 shapeshifts can result in the following, or almost on every loading screen.


Only happens when using other druid models. If I use another NPC model it does not have the same problem, like 47672 works fine.

I was thinking it had something to do with setting the race back too soon. But I did notice on loading screens the model is still not correct for 47672. The model was smaller and did not have the ghost effect, was like it was the normal druid model but with a new skin.

Befor loading screen (correct model display),


After loading screen,



Do I need to clear something? Is it using the previous model's attributes? Calling update 2x does not look to fix the problem.

Any help is appreciated, thanks!

--edit

Did some more testing, waiting 60 frames and then setting the values back works. So I guess I just need to find a way to know when a model has been completely loaded and is safe to revert changes.
I tested the druid model in the human state and it also happens, so not related to the shapeshifting form. I think it has something to do with how high rez the model is.

[danwins]

Doing a bit of assumption here and I'm guessing the reason your running into the texture/mesh reverting is because your setting the race in descriptors before calling UpdateDisplayInfo?

And i'm guessing the reason you are setting and resetting the race is to avoid the issue with Race restricted items?

if so then you should try setting this instead of the race descriptor(note: old version 18414):

.text:0080F3F7                         CGUnit_C__GetCurrentClientRace proc near
.text:0080F3F7                                                                 ; CODE XREF: sub_7BA48C+19Bp
.text:0080F3F7                                                                 ; CGUnit_C__GetDisplaySex+2Dj ...
.text:0080F3F7 8B 81 4C 14 00 00                       mov     eax, [ecx+144Ch]
.text:0080F3FD 85 C0                                   test    eax, eax
.text:0080F3FF 74 09                                   jz      short loc_80F40A
.text:0080F401 F6 81 50 14 00 00 01                    test    byte ptr [ecx+1450h], 1
.text:0080F408 74 0A                                   jz      short locret_80F414
.text:0080F40A
.text:0080F40A                         loc_80F40A:                             ; CODE XREF: CGUnit_C__GetCurrentClientRace+8j
.text:0080F40A 8B 81 E4 00 00 00                       mov     eax, [ecx+0E4h]
.text:0080F410 0F B6 40 58                             movzx   eax, byte ptr [eax+58h]
.text:0080F414
.text:0080F414                         locret_80F414:                          ; CODE XREF: CGUnit_C__GetCurrentClientRace+11j
.text:0080F414 C3                                      retn
.text:0080F414                         CGUnit_C__GetCurrentClientRace endp

I believe setting this(instead of descriptors -> race), NativeDisplayId + Gender would solve this issue and you don't need to toggle it back to fix the race requirement issue you can just leave it as is.

[DarkLinux]

I was playing around with that value based on your older post, but when leaving combat the character flashes.

.text:00007FF700DC8010 CGUnit_C__GetCurrentClientRace proc near
.text:00007FF700DC8010                                         ; CODE XREF: sub_7FF700E0F790+10↓p
.text:00007FF700DC8010                                         ; sub_7FF700E20AF0+27D↓p ...
.text:00007FF700DC8010                 mov     eax, [rcx+2AA8h]
.text:00007FF700DC8016                 test    eax, eax
.text:00007FF700DC8018                 jz      short loc_7FF700DC8023
.text:00007FF700DC801A                 test    byte ptr [rcx+29F4h], 40h
.text:00007FF700DC8021                 jz      short locret_7FF700DC8031
.text:00007FF700DC8023
.text:00007FF700DC8023 loc_7FF700DC8023:                       ; CODE XREF: CGUnit_C__GetCurrentClientRace+8↑j
.text:00007FF700DC8023                 mov     rax, [rcx+200h]
.text:00007FF700DC802A                 movzx   eax, byte ptr [rax+0A4h]
.text:00007FF700DC8031
.text:00007FF700DC8031 locret_7FF700DC8031:                    ; CODE XREF: CGUnit_C__GetCurrentClientRace+11↑j
.text:00007FF700DC8031                 retn
.text:00007FF700DC8031 CGUnit_C__GetCurrentClientRace endp

---edit

Some of my code was wrong, testing again.


---edit

But at the same time, this does not look to fix the druid form. But I did find something called "HighResModelSwap.cpp", going to look into that a little more.

Do you know if " test byte ptr [rcx+29F4h], 40h" needs to be set?

.text:00007FF700DC7F60 sub_7FF700DC7F60 proc near              ; CODE XREF: sub_7FF700DB4AF0+7C↑p
.text:00007FF700DC7F60                                         ; sub_7FF700DB7F20+3C↑p ...
.text:00007FF700DC7F60
.text:00007FF700DC7F60 var_28          = qword ptr -28h
.text:00007FF700DC7F60 var_20          = dword ptr -20h
.text:00007FF700DC7F60 var_18          = qword ptr -18h
.text:00007FF700DC7F60 var_10          = qword ptr -10h
.text:00007FF700DC7F60
.text:00007FF700DC7F60                 push    rbx
.text:00007FF700DC7F62                 sub     rsp, 40h
.text:00007FF700DC7F66                 mov     edx, [rcx+2AA8h]
.text:00007FF700DC7F6C                 mov     rbx, rcx
.text:00007FF700DC7F6F                 test    edx, edx
.text:00007FF700DC7F71                 jz      short loc_7FF700DC7FF0
.text:00007FF700DC7F73                 test    byte ptr [rcx+29F4h], 40h
.text:00007FF700DC7F7A                 jnz     short loc_7FF700DC7FF0
.text:00007FF700DC7F7C                 xor     eax, eax
.text:00007FF700DC7F7E                 lea     r8, [rsp+48h+var_18]
.text:00007FF700DC7F83                 lea     rcx, off_7FF7020685C0
.text:00007FF700DC7F8A                 mov     [rsp+48h+var_20], eax
.text:00007FF700DC7F8E                 xor     r9d, r9d
.text:00007FF700DC7F91                 mov     [rsp+48h+var_28], rax
.text:00007FF700DC7F96                 mov     [rsp+48h+var_18], rax
.text:00007FF700DC7F9B                 mov     [rsp+48h+var_10], rax
.text:00007FF700DC7FA0                 call    sub_7FF700BA13D0
.text:00007FF700DC7FA5                 mov     rcx, [rbx+10h]
.text:00007FF700DC7FA9                 mov     r8, rax
.text:00007FF700DC7FAC                 movzx   edx, byte ptr [rcx+20h]
.text:00007FF700DC7FB0                 shr     dl, 4
.text:00007FF700DC7FB3                 test    dl, 1
.text:00007FF700DC7FB6                 jz      short loc_7FF700DC7FCA
.text:00007FF700DC7FB8                 test    rbx, rbx
.text:00007FF700DC7FBB                 jz      short loc_7FF700DC7FCA
.text:00007FF700DC7FBD                 mov     rcx, [rbx+2BD8h]
.text:00007FF700DC7FC4                 movzx   edx, byte ptr [rcx+4Eh]
.text:00007FF700DC7FC8                 jmp     short loc_7FF700DC7FD8
.text:00007FF700DC7FCA ; ---------------------------------------------------------------------------
.text:00007FF700DC7FCA
.text:00007FF700DC7FCA loc_7FF700DC7FCA:                       ; CODE XREF: sub_7FF700DC7F60+56↑j
.text:00007FF700DC7FCA                                         ; sub_7FF700DC7F60+5B↑j
.text:00007FF700DC7FCA                 mov     rax, [rbx+200h]
.text:00007FF700DC7FD1                 movzx   edx, byte ptr [rax+0A7h]
.text:00007FF700DC7FD8
.text:00007FF700DC7FD8 loc_7FF700DC7FD8:                       ; CODE XREF: sub_7FF700DC7F60+68↑j
.text:00007FF700DC7FD8                 test    edx, edx
.text:00007FF700DC7FDA                 jnz     short loc_7FF700DC7FE6
.text:00007FF700DC7FDC                 mov     eax, [r8+1Ch]
.text:00007FF700DC7FE0                 add     rsp, 40h
.text:00007FF700DC7FE4                 pop     rbx
.text:00007FF700DC7FE5                 retn
.text:00007FF700DC7FE6 ; ---------------------------------------------------------------------------
.text:00007FF700DC7FE6
.text:00007FF700DC7FE6 loc_7FF700DC7FE6:                       ; CODE XREF: sub_7FF700DC7F60+7A↑j
.text:00007FF700DC7FE6                 mov     eax, [r8+20h]
.text:00007FF700DC7FEA                 add     rsp, 40h
.text:00007FF700DC7FEE                 pop     rbx
.text:00007FF700DC7FEF                 retn
.text:00007FF700DC7FF0 ; ---------------------------------------------------------------------------
.text:00007FF700DC7FF0
.text:00007FF700DC7FF0 loc_7FF700DC7FF0:                       ; CODE XREF: sub_7FF700DC7F60+11↑j
.text:00007FF700DC7FF0                                         ; sub_7FF700DC7F60+1A↑j
.text:00007FF700DC7FF0                 mov     rax, [rcx+200h]
.text:00007FF700DC7FF7                 mov     eax, [rax+17Ch]
.text:00007FF700DC7FFD                 add     rsp, 40h
.text:00007FF700DC8001                 pop     rbx
.text:00007FF700DC8002                 retn
.text:00007FF700DC8002 sub_7FF700DC7F60 endp

Base address is 00007FF700760000.