WoW Reverse Engineering Notes — Sept 11, 2016 (z-axis rendering & memory analysis)

CBI - Changes back immediately
DCBI - Doesn't change back immediately

Base - 009F0000

Found the (temporary) address with the value that renders the characters either higher or lower than its actual z-axis value. Only client side

v--- below I did a 'What writes to this address?'

was being called constantly - with no moving

What is movsd?
CE says above, "move data from string to string"

???

moving on as I don't think much can be gleaned from this code


Did a jump in game and found a bunch of addresses that lit up. Went from 1 to quite a few

I chose the following because it refers to ecx


+ 0x20 from base of obj

ecx is generally the beginning of an object

ecx here is at 458423B0

and at offset 0x20 is where we can change the value (float - 32 bit) to make the character appear higher or lower on the z-axis - graphically on the client side

so this code is happening at 00DC76CE (base is 009F0000) meaning this should occur at [using prog calculator] 3D76CE - this can be looked in static analysis so,,,,,,,
 


let's try to find a static pointer in memory for 458423B0

only one?? that's weird right? ...


  1. Looks like spacing between different structures in memory
  2. Look at the pattern - 69 sticks out ... and not for that reason
  3. The memory address and what it points to


Doesn't look the address and its value that we care about are part of the pattern
Nor is it the beginning of the structure in memory


Did a 'What writes to this address?' - no addresses even when moving/jumping.

Did a 'What accesses this address?' - no addresses even when moving...


Decided to look at the first address in what appears to be the structure --- 458419E8

'What writes to this address?' -- nothing


Disregard the above. Somehow the debugger wasn't working.

Did a 'What accesses this address?' on 458419F4



+ 0x124 from base of obj

ECX looks promissing - 458418D0

Code occurs at 00CF20E9 which is [using calc] 3020E9


458418D0

seems to be the base of the object

so let's try to find where this object's address is stored in memory


Found three green addresses!!!


Let's work backwards to try and create a Cheat Engine pointer that will get us to this address consistently


boom!!!

tried /reload and even the temporary address didn't change

trying a logout and even a new character...


Found it! The first of the three seems to work consistently between different game characters
The other two addresses are pointing at a different memory address then the first one which is the one I tried adding offsets to first


OK so... 017D545C or [using calc] DE545C


So here are the interesting addresses we can look at using static analysis

  • 0x003D76CE (code)
  • 0x003020E9 (code)
  • 0x00DE545C (static pointer)

Also, this happens when you try moving after setting the z-axis to something other than its original


Looks for this string too, and maybe add breakpoint to its code. Look at stack to find what happens before disconnect




Nice there aren't a bazillion cross refs..


Took a quick look at OwnedCore to see if the offset DE545C was listed in the helpful Memory Editing section


WOO!!! Looks like I reversed the place where LocalPlayer's pointer is stored... Now I need to figure that out for myself using the cross references above and / or looking at the structure in memory