WoWME for Warlords of Draenor

[Cromon]

Hello all

As you may know there is a new archive format in WoD and some were concerned, that model edits might get a downer with that.

After some investigation a simple change on the wow.exe allows you to load arbirtrary files from the harddisc instead of the archives. This feature is normally only available for certain interface textures like buttons, checkboxes and so on, but ive changed to exe to load every file first from the harddisc and then get the one from the archives.

Thus if you'd like to overwrite World\Maps\Draenor\Draenor.wdt you'd create that file with this folders in your wow directory and it will load that file instead of the one in the archive.

It includes WowB for x86 and x64.

VSC x86: https://www.virustotal.com/de/file/3...is/1396881459/
VSC x64: https://www.virustotal.com/de/file/6...is/1396881846/

Download:
File-Upload.net - WoWME.rar

Example:
http://puu.sh/7ZxLp.jpg (changed UI_MAINMENU_BURNINGCRUSADE to UI_MAINMENU)

Greetings
Cromon

[Ehnoah]

Awesome

Now we need all file names and here we go. Hope they not fix it that fast.

[Cromon]

There are two easy ways to get the files:
1. Wait/look for a public list
2. Take the latest MOP build, create a combined listfile of all MPQs -> covers approx 95% of all filenames. Extract map.dbc from the new client. Loop through all the maps and check all adts (from 0/0to 64/64) -> you get all terrain files. Loop through all adt files and extract wmo and m2 paths -> all non-creature and non-gameobject models. Open the creature, item, gameobject and spell dbcs and extract all model files -> all gameobject, creature, item and spell m2 files. Extract textures from adt, wmo and m2. Youll have > 99% of all files.

[hurricup]

If you digged an exe file, can you say how original names being hashed? As far as i understand we've got a hash system with buckets saved in indicies and data in data banks.
I belive, that if you know an original filename, you may hash it, look for a checksum in hash buckets and find an offset in databank.

[Cromon]

You can use wows CASOpenFile, CASReadFile and CASCloseFile to extract files by normal name without knowing the actual hash function.

[hurricup]

Where are they? Opened WowB in IDA - no such sybmols. But i'm not rly experienced with debugging.
And i'd like to make my own extractor, don't wanna depend on wow. Doubt that they will change a hash function.
A little help with algorithm would be helpful.

[Master674]

Where are they? Opened WowB in IDA - no such sybmols. But i'm not rly experienced with debugging.
And i'd like to make my own extractor, don't wanna depend on wow. Doubt that they will change a hash function.
A little help with algorithm would be helpful.

Check the strings. PTR/Test should have Release Assertions enabled.

[gurluas]

Is it possible to somehow use the file recognition of the client to extract files with their name intact instead of gibberish?

[akspa420]

Is it possible to somehow use the file recognition of the client to extract files with their name intact instead of gibberish?

That's what I'm thinking that the mmo-c guys have done. It's likely that there's an api that the wow exe uses to interface with the casc.

[Xel]

That's what I'm thinking that the mmo-c guys have done. It's likely that there's an api that the wow exe uses to interface with the casc.

Is it possible to somehow use the file recognition of the client to extract files with their name intact instead of gibberish?

Read what Cromon said.

[ulminia]

Read what Cromon said.

ither im stupider then i though but i cant find these on the web ><

[Cromon]

You cant find what?

[ulminia]

" CASOpenFile, CASReadFile and CASCloseFile "

[Cromon]

You find them in the client. There is nothing in the web. Those are functionx from the wow.exe.

[ulminia]

ok i feel dumb ..