-
Member
[8.3.0] Looking for someone to verify the camera matrix offsets I found
Hello,
I'm working with client build 8.3.0 33369. I'm looking for the camera matrix. I have found two potential candidates for the Camera base:
OFFSET_CAMERA_BASE_C1: 0x28BC980
OFFSET_CAMERA_BASE_C2: 0x2A5A8D8
Candidate 1 (OFFSET_CAMERA_BASE_C1 above) seems to be the correct offset for the camera's base because it has X, Y, and Z positions which change as I move the camera around. The matrix would be at the following offsets:
OFFSET_CAMERA_MATRIX_X_X = 0x338
OFFSET_CAMERA_MATRIX_Y_X = 0x33C
OFFSET_CAMERA_MATRIX_Z_X = 0x340
OFFSET_CAMERA_MATRIX_X_Y = 0x348
OFFSET_CAMERA_MATRIX_Y_Y = 0x34C
OFFSET_CAMERA_MATRIX_Z_Y = 0x350
OFFSET_CAMERA_MATRIX_X_Z = 0x358
OFFSET_CAMERA_MATRIX_Y_Z = 0x35C
OFFSET_CAMERA_MATRIX_Z_Z = 0x360
However, I'm not too confident in this assessment because I expect the matrix to be one continuous block in memory. This has a 4-byte gap every 12 bytes.
The second candidate (OFFSET_CAMERA_BASE_C2) does not automatically update the camera's X, Y, and Z position when I move the camera around--so I'm not too sure if this is the correct offset to use. It does have what appears to be a valid and continuous matrix at the following offsets:
OFFSET_CAMERA_MATRIX_X_X = 0x3F0,
OFFSET_CAMERA_MATRIX_Y_X = 0x3F4,
OFFSET_CAMERA_MATRIX_Z_X = 0x3F8,
OFFSET_CAMERA_MATRIX_X_Y = 0x3FC,
OFFSET_CAMERA_MATRIX_Y_Y = 0x400,
OFFSET_CAMERA_MATRIX_Z_Y = 0x404,
OFFSET_CAMERA_MATRIX_X_Z = 0x408,
OFFSET_CAMERA_MATRIX_Y_Z = 0x40C,
OFFSET_CAMERA_MATRIX_Z_Z = 0x410,
However, OFFSET_CAMERA_MATRIX_Z_X and OFFSET_CAMERA_MATRIX_X_Z have very small values, (for example: 9.19609374e-06 and 3.07694499e-05 respectfully). I also expect zaxis.y to be 0 (based on other threads showing their matrices on OwnedCore); however, it is not 0. In fact, it is zaxis.z that has a value of 0.
Is anyone able to verify which offsets are correct? Did I totally miss the mark, or am I in looking in the right place?
Thanks!
-
This works for me
Code:
// Wow x64 Version 8.3.0 33369 Feb 13 2020
public static Int64 pCurrentWorldFrame = 0x2A5A8D8;
public static Int64 CameraOffset = 0x3438;
[StructLayout(LayoutKind.Sequential)]
internal struct CameraRecord
{
private readonly Int64 u0;
private readonly Int64 u1;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)]
internal readonly float[] Location;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 9)]
internal readonly float[] Matrix;
internal readonly float FOV;
}
Int64 cameraAddress = VGContext.Mem64.Read<Int64>(VGContext.Mem64.Read<Int64>(VGContext.Mem64.Rebase(Offsets.pCurrentWorldFrame)) + Offsets.CameraOffset);
CameraRecord TheCamera = VGContext.Mem64.Read<CameraRecord>(cameraAddress);
-
Post Thanks / Like - 1 Thanks
CodeBytes (1 members gave Thanks to counted for this useful post)
-
Member
Thanks for the reply, counted. I actually just came here to say that I found the camera at 0x3438; but you beat me to it. I was caught up at the wrong point in memory because I hadn't looked at a matrix in memory before. To find the correct matrix, I logged into classic and used the information found here (Offsets for 1.13.3.33526) to view the matrix in memory. Once I knew what I was looking for, it was pretty obvious what the matrix should look like and finding it on retail was no problem. Experience plays a big part in recognizing what you are looking for.
Thanks again for taking the time to share what you found.
-
If you look at Script_GetCameraZoom you can find both the worldFrame Pointer and the Current Camera offset.
-
Post Thanks / Like - 1 Thanks
CodeBytes (1 members gave Thanks to counted for this useful post)
-
Member
That was a very useful tip, thank you.
Code:
.text:00007FF6B77EBA80 sub_7FF6B77EBA80 proc near ; CODE XREF: sub_7FF6B67E0400+240p
.text:00007FF6B77EBA80 ; sub_7FF6B67E0850+17p ...
.text:00007FF6B77EBA80 mov rax, cs:qword_7FF6B90BA8D8
.text:00007FF6B77EBA87 test rax, rax
.text:00007FF6B77EBA8A jz short locret_7FF6B77EBA94
.text:00007FF6B77EBA8C mov rax, [rax+3438h]
.text:00007FF6B77EBA93 retn
.text:00007FF6B77EBA94 ; ---------------------------------------------------------------------------
.text:00007FF6B77EBA94
.text:00007FF6B77EBA94 locret_7FF6B77EBA94: ; CODE XREF: sub_7FF6B77EBA80+Aj
.text:00007FF6B77EBA94 retn
.text:00007FF6B77EBA94 sub_7FF6B77EBA80 endp