Working on no fall dmg with CE but..

[Ednasil]

I started using CE recently and I need help with finding variables. I can get addresses easily BWH, but variables no. Thanks. btw if its not possible no fall dmg just say.

[Cypher]

Lol, no fall damage requires code injection, I have the code to inject but wow will just die if you inject it, on top of that, unless you modify the code, even if you do get it working it will be highly detectable.

[Demonkunga]

Well doesnt Mountain Climbing work the same way though?

[Ednasil]

Lol, no fall damage requires code injection, I have the code to inject but wow will just die if you inject it, on top of that, unless you modify the code, even if you do get it working it will be highly detectable.

Lol thx I'll try anyways, and to the person above me, no it doesn't hehe.

[Cypher]

Mountain climing changed a variable in memory to allow you to walk up walls, to have no fall damage, you have to inject the following code (taken from BWH):
Full Code

#include "nofalldamage.h"
#include "..\common.h"

VOID NoFallDamage_Stub();

DWORD g_NoFallDamageOffset = NULL;
DWORD g_pOrigNoFallDamageFunc = NULL;
BOOL g_bNoFallDamageEnabled = FALSE;
DWORD g_FallTimeOffset;
DWORD g_FallTimeValue;
DWORD g_WowReturn;

VOID NoFallDamage_Hook(PDWORD pNoFallDamageHook, DWORD dwNoFallDamageOffset)
{
    DWORD dwOldProtect;
    
    g_NoFallDamageOffset = dwNoFallDamageOffset;
    
    if(pNoFallDamageHook && g_NoFallDamageOffset && VirtualProtect(pNoFallDamageHook, 4, PAGE_EXECUTE_READWRITE, &dwOldProtect))
    {
        g_pOrigNoFallDamageFunc = *pNoFallDamageHook + (PtrToUlong(pNoFallDamageHook) + 4);
        *pNoFallDamageHook = PtrToUlong(NoFallDamage_Stub) - (PtrToUlong(pNoFallDamageHook) + 4);
        VirtualProtect(pNoFallDamageHook, 4, dwOldProtect, &dwOldProtect);
    }
}

VOID NoFallDamage_Enable(BOOL bEnable)
{
    g_bNoFallDamageEnabled = bEnable;
}

__declspec(naked) VOID NoFallDamage_Stub()
{
    __asm
    {
        // is no fall damage enabled?
        cmp dword ptr[g_bNoFallDamageEnabled], 0
        je returntowow

        // make sure pointer is not null
        test ecx, ecx
        je returntowow

        // calculate offset to fall time and compare with max value
        mov eax, ecx
        add eax, dword ptr[g_NoFallDamageOffset]
        cmp dword ptr[eax], 0x480
        jle returntowow

        // modify procedure return address
        pop dword ptr[g_WowReturn]
        push returntobwh
        
        // backup offset to fall time and it's current value
        mov dword ptr[g_FallTimeOffset], eax
        push dword ptr[eax]
        pop dword ptr[g_FallTimeValue]

        // set fall time to max value
        mov dword ptr[eax], 0x480

returntowow:
        mov eax, dword ptr[g_pOrigNoFallDamageFunc]
        jmp eax

returntobwh:
        push eax
        
        // restore original fall time
        mov eax, dword ptr[g_FallTimeOffset]
        push dword ptr[g_FallTimeValue]
        pop dword ptr[eax]
        
        pop eax
        
        // return to wow
        push dword ptr[g_WowReturn]
        ret
    }
}

VOID NoFallDamage_UnHook(PDWORD pNoFallDamageHook)
{
    DWORD dwOldProtect;
    if(pNoFallDamageHook && g_pOrigNoFallDamageFunc)
    {
        VirtualProtect(pNoFallDamageHook, 4, PAGE_EXECUTE_READWRITE, &dwOldProtect);
        *pNoFallDamageHook = g_pOrigNoFallDamageFunc - (PtrToUlong(pNoFallDamageHook) + 4);
        VirtualProtect(pNoFallDamageHook, 4, dwOldProtect, &dwOldProtect);
        g_pOrigNoFallDamageFunc = NULL;
    }
}

ASM Only

// is no fall damage enabled?
        cmp dword ptr[g_bNoFallDamageEnabled], 0
        je returntowow

        // make sure pointer is not null
        test ecx, ecx
        je returntowow

        // calculate offset to fall time and compare with max value
        mov eax, ecx
        add eax, dword ptr[g_NoFallDamageOffset]
        cmp dword ptr[eax], 0x480
        jle returntowow

        // modify procedure return address
        pop dword ptr[g_WowReturn]
        push returntobwh
        
        // backup offset to fall time and it's current value
        mov dword ptr[g_FallTimeOffset], eax
        push dword ptr[eax]
        pop dword ptr[g_FallTimeValue]

        // set fall time to max value
        mov dword ptr[eax], 0x480

returntowow:
        mov eax, dword ptr[g_pOrigNoFallDamageFunc]
        jmp eax

returntobwh:
        push eax
        
        // restore original fall time
        mov eax, dword ptr[g_FallTimeOffset]
        push dword ptr[g_FallTimeValue]
        pop dword ptr[eax]
        
        pop eax
        
        // return to wow
        push dword ptr[g_WowReturn]
        ret

[Alkhara Majere]

Mountain climing changed a variable in memory to allow you to walk up walls, to have no fall damage, you have to inject the following code (taken from BWH):

I hate to ask, but..
Is it safe? I know CE is safe, and not dectable if your not a moron, but dosent injecting code go al ADKLASHDAOWAPAIDUAWJ:LKJ S on your ass?

[Cypher]

Injecting code is a lot more detectable than just changing a variable in memory. To hide injected code you really need to know what you're doing.

[Demonkunga]

But theres a low chance you can get caught changing a variable in memory right?

[gotosleep]

No theres no chance. Warden works on the principle that it scans your processes and memory and if it sees something like a speed hack instabans you. Noone so far has been banned using CE wall walking other than being a noob and getting reported.

[Demonkunga]

well thats great to know... i dont use the mountain climbing because i dont want to be banned naturarly. :P although i spent likeand hour or so on gm island and summoned 10 or so ppl there. hope i wont get banned from that haha oh well, **** happens

[tyguy22894]

^^^^ lies.

[gotosleep]

^^^^ lies.

Lol, just cause you dont know how to get there doesn't mean he is lieing(or that he will tell you)