The 'better' way of doing 'nudge hacks' -
07-22-2008
I noticed that all of the current 'nudge hacks' (awwes etc) are out of process and use sendkeys to turn the character after nudging them.
Using CInputControl you can turn without sending keystrokes etc. The advantage being that the turning is practically instant and you don't even notice your character move at all.
Heres some sample code:
CInputControl.h
Code:
#pragma once
class CInputControl
{
public:
void SetMovementFlag( int iFlag, int Enable, unsigned long dwTime = 0 );
unsigned long GetMovementFlag();
};
CInputControl.cpp
Code:
void CInputControl::SetMovementFlag( int iFlag, int Enable, DWORD dwTime )
{
DWORD SetFlags = 0x005343A0;
DWORD GetTickCount = 0x00BE10FC;
_asm
{
mov eax,GetTickCount
mov ecx, this
push dwTime
push eax
push Enable
push iFlag
call SetFlags
}
}
unsigned long CInputControl::GetMovementFlag()
{
return *reinterpret_cast<unsigned long*>( this + 4 );
}
Yes, its possible to change your coords by a tiny bit then turn, and repeat that. Effectively 'nudging' your character across, through objects/walls/etc.
I read somewhere that you can move something like 0.0012 units without he game kicking up a fuss?
And, err.. one last question (bearing in mind i've not cracked wow open yet)... why have you crammed eax in the middle there?
Now the direct call makes a whole lot more sense anyway, cheers again! =)
You can move about 0.1-0.5 units, I forget the exact amount. Just start at 0.1 and get bigger and bigger until you get dced. Also, what do you mean? GetTickCount is moved into EAX and then pushed, so obviously thats whats in the register, I don't get your question. If you're asking why its moved into EAX and then pushed instead of pushed directly it's because that's how all the code inside WoW that calls the function does it so I basically copied the function call method directly from inside a LUA api.
I took a little look at the wowAPI's command table, and surprisingly found that the functions for movement are not debricated just "deactivated", so i guess there must be a "switch" somewhere to enable them again.
Not that it would help this particular approach but funny anyway... could be used to make a "LUA" based bot or something.
I took a little look at the wowAPI's command table, and surprisingly found that the functions for movement are not debricated just "deactivated", so i guess there must be a "switch" somewhere to enable them again.
Not that it would help this particular approach but funny anyway... could be used to make a "LUA" based bot or something.
Already knew that.
Yeah, thats how I found CInputControl to begin with.
Code:
.text:005345F0 sub_5345F0 proc near ; DATA XREF: .data:00B9E95Co
.text:005345F0 push esi
.text:005345F1 call sub_5330B0
.text:005345F6 push 0
.text:005345F8 mov esi, eax
.text:005345FA call ProtectedLuaCheck
.text:005345FF add esp, 4
.text:00534602 test eax, eax
.text:00534604 jz short loc_534619
.text:00534606 mov eax, GetTickCountVal
.text:0053460B push 0
.text:0053460D push eax
.text:0053460E push 1
.text:00534610 push 10h
.text:00534612 mov ecx, esi
.text:00534614 call CInputControl__SetFlags
.text:00534619
.text:00534619 loc_534619: ; CODE XREF: sub_5345F0+14j
.text:00534619 xor eax, eax
.text:0053461B pop esi
.text:0053461C retn
.text:0053461C sub_5345F0 endp
.text:0053461C
Patch the section I've annotated as Lua_Protection_Patch to enable running of all Blizz-only functions.
IMPORTANT: Warden hashes parts that function so you need to be careful what you change. I personally use a warden patch to stop warden picking up any client mods but if you feel that's too much work you can probably mod the function near the top (away from the jmp/cmp) to get the same effect.
yeah... one thing about Warden that is stupid... it only scans certain offsets. For example... if it scans the "jne" of a function in order to make sure you dont change it to do a hack... how about you simply codecave above it and make sure the "jne" always does what you want?
pwnt much? =P
ex.
1 pop edi
2 cmp eax,1337 /* start scanning
3 je 6
4 call 8675309 //limit your jump
5 jmp 007734101 */end scanning
6 retn
yeah... one thing about Warden that is stupid... it only scans certain offsets. For example... if it scans the "jne" of a function in order to make sure you dont change it to do a hack... how about you simply codecave above it and make sure the "jne" always does what you want?
pwnt much? =P
ex.
1 pop edi
2 cmp eax,1337 /* start scanning
3 je 6
4 call 8675309 //limit your jump
5 jmp 007734101 */end scanning
6 retn
The 'better' way of doing 'nudge hacks'
