[classic] Why I can't read WOW memory

[wkingnet]

Forgive me for being a beginner and apologies for the disaster that Coronavirus has caused to the world.

I learned the https://www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-bots-programs/wow-memory-editing/319172-guide-how-make-wow-bot-complete-newbs.html]this thread ([Guide] How to make a Wow bot for complete newbs!) and tried to read the memory of World of Warcraft.

autoit cannot read the wow memory , but I manually add addresses in CE and works fine.

screenshot:
(click to big pic)


My environment:
windows 10 x64, UAC closed, antivirus software closed, autoit lastest


this is my code:

#include  ".\include\NomadMemory.au3"
#include  <MsgBoxConstants.au3>

Global Const $CurMgrPointer = 0x2387C88
Global Const $FirstObjectOffset = 0x18
Global Const $NextObjectOffset = 0x70
Global Const $LocalGUID  = 0xB8
Global Const $UnitName1 = 0x17B8
Global Const $UnitName2 = 0xE0

Func GETWOWBASEADDRESS($PID)

	$HSNAP = DllCall("Kernel32.dll", "HANDLE", "CreateToolhelp32Snapshot", "DWORD", 8, "DWORD", $PID)

	$STMODULE = DllStructCreate("DWORD dwSize;DWORD th32ModuleID;DWORD th32ProcessID;" & "DWORD GlblcntUsage;DWORD ProccntUsage;ptr modBaseAddr;" & "DWORD modBaseSize;HANDLE hModule;WCHAR szModule[256];" & "WCHAR szExePath[260]")

	DllStructSetData($STMODULE, "dwSize", DllStructGetSize($STMODULE))

	$RET = DllCall("Kernel32.dll", "BOOLEAN", "Module32FirstW", "HANDLE", $HSNAP[0], "ptr", DllStructGetPtr($STMODULE))

	IF ($RET[0] = False) Then
		DllCall("Kernel32.dll", "BOOLEAN", "CloseHandle", "HANDLE", $HSNAP[0])
		Return 0
	Else
		$RET[0] = True
		Do
			If DllStructGetData($STMODULE, "szModule") = "Wowclassic.exe" Then

				DllCall("Kernel32.dll", "BOOLEAN", "CloseHandle", "HANDLE", $HSNAP[0])

				Return DllStructGetData($STMODULE, "modBaseAddr")
			EndIf
			$RET = DllCall("Kernel32.dll", "BOOLEAN", "Module32NextW", "HANDLE", $HSNAP[0], "ptr", DllStructGetPtr($STMODULE))
		Until $RET[0] = False
	EndIf
EndFunc   ;==>GETWOWBASEADDRESS

$PID = WinGetProcess("World of Warcraft")
Global $WowBase = GetWoWBaseAddress($PID)
$hWow = _MemoryOpen($PID)
ConsoleWrite('@@ Debug(' &    @SCripTLineNumber & ') : $hWow = ' & $hWow[0] & $hWow[1] &    @CRLF) ;### Debug Console
Hex($WowBase + $CurMgrPointer)
ConsoleWrite('@@ Debug(' &    @SCripTLineNumber & ') : $PID = ' & $PID &    @CRLF) ;### Debug Console
ConsoleWrite('@@ Debug(' &    @SCripTLineNumber & ') : $WowBase = ' & $WowBase &    @CRLF) ;### Debug Console
ConsoleWrite('@@ Debug(' &    @SCripTLineNumber & ') : Hex($WowBase + $CurMgrPointer) = ' & Hex($WowBase + $CurMgrPointer) &    @CRLF) ;### Debug Console

$curMgr = _MemoryRead("0x" & Hex($WowBase + $CurMgrPointer), $hWow , "dword")
MsgBox(262144, 'debug line ~' &    @SCripTLineNumber, '$curMgr:' &    @CRLF & $curMgr) ;### Debug MSGBOX
$pGUID = _MemoryRead("0x" & Hex($curMgr + $LocalGUID ), $hWow , "UINT64")
ConsoleWrite('@@ Debug(' &    @SCripTLineNumber & ') : $curMgr = ' & $curMgr &    @CRLF) ;### Debug Console
ConsoleWrite('@@ Debug(' &    @SCripTLineNumber & ') : $pGUID = ' & $pGUID &    @CRLF) ;### Debug Console

autoit debug info:

>"D:\Program Files\AutoIt3\SciTE\AutoIt3Wrapper\AutoIt3Wrapper.exe" /run /prod /ErrorStdOut /in "D:\我的文档\AutoIt\wow\wow_test.au3" /UserParams    
+>17:55:25 启动 AutoIt3Wrapper v.18.708.1148.0 SciTE v.4.1.0.0 
键盘:00000409  操作系统:WIN_10/  CPU:X64  系统架构:X64  语言环境:0804  系统代码页:936    脚本编码: 256 UTF8 无 BOM
SciTE 本机目录 => D:\Program Files\AutoIt3\SciTE  SciTE 用户目录 => C:\Users\Administrator\AppData\Local\AutoIt v3\SciTE 
AutoIt3Wrapper 用户目录 => C:\Users\Administrator\AppData\Local\AutoIt v3\SciTE\AutoIt3Wrapper
>运行 AU3Check (3.3.14.5)  程序路径: D:\Program Files\AutoIt3  脚本路径: D:\我的文档\AutoIt\wow\wow_test.au3
+>17:55:25 AU3Check 语法检查结束. 退出码: 0
!运行: (3.3.14.5):D:\Program Files\AutoIt3\autoit3_x64.exe "D:\我的文档\AutoIt\wow\wow_test.au3"    
--> 点击 Ctrl+Alt+Break 重新启动, 或点击 Ctrl+Break 停止脚本执行
@@ Debug(41) : $hWow = 1624
@@ Debug(43) : $PID = 14992
@@ Debug(44) : $WowBase = 0x00007FF60B670000
@@ Debug(45) : Hex($WowBase + $CurMgrPointer) = 00007FF60D9F7C88
@@ Debug(50) : $curMgr = 0
@@ Debug(51) : $pGUID = 0
+>17:55:28 AutoIt3.exe 执行脚本结束. 退出码: 0
+>17:55:28 AutoIt3Wrapper 完成脚本处理.
>退出代码: 0    耗时: 3.991

[wkingnet]

OK, I attempt to successfully resolve this issue.

The cause of the error is: NomadMemory are not supported 64-bit programs.

When writing the tutorial, World of Warcraft was still a 32-bit program, so everything was fine. But now World of Warcraft is a 64-bit program, so NomadMemory cannot read the memory of a 64-bit program.

I switched to KryMemory and read it successfully. KryMemory download link: KryMemory [UDF] - AutoIt Example Scripts - AutoIt Forums

now my code:

#include ".\include\KryMemory.au3"

Global Const $CurMgrPointer = 0x2387C88  ;good
Global Const $FirstObjectOffset = 0x18  ;good
Global Const $NextObjectOffset = 0x70   ;good
Global Const $LocalGUID  = 0xB8   ;;good
Global Const $UnitName1 = 0x17B8
Global Const $UnitName2 = 0xE0
Global Const $PlayerNameAddr = 0x2688828

$Handle = _Process_Open("wowclassic.exe")
ConsoleWrite('@@ Debug(' & @SCripTLineNumber & ') : $Handle_PID = ' & $Handle[2] & @CRLF) ;### Debug Console

; Makes sure the process was opened.
If @Error Then
    ConsoleWriteError("The specified process could not be opened. Error: " & @Error & @CRLF)
    Exit(0)
EndIf

Global $WowBase = _Process_GetBaseAddress($Handle)

$curMgr = _Process_ReadMemory($Handle, ($WowBase + $CurMgrPointer),"UINT64")
ConsoleWrite('@@ Debug(' & @SCripTLineNumber & ') : $curMgr = ' & HEX($curMgr) & @CRLF) ;### Debug Console

[wkingnet]

$curMgr = _MemoryRead("0x" & Hex($WowBase + $CurMgrPointer), $hWow , "dword") <-----
...
$pGUID = _MemoryRead("0x" & Hex($curMgr + $LocalGUID ), $hWow , "UINT64")

I don't think it's a dword. Same with GUID.

Yes, thank you very much. It's a UINT64 indeed

[baby110]

冠状病毒原来是你带来，你个s b

[ejt]

GUID is 128-bit so it would be 2*UINT64 just fyi

[wkingnet]

冠状病毒原来是你带来，你个s b

This is very funny and sad. Friends from all over the world have not scolded the Chinese yet, the Chinese themselves scolded the Chinese first.