Created
July 13, 2020 08:43
-
-
Save barncastle/1c2c4790282437f655b8e8c8091969a2 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using (var pm = new ProcessMemory("Wow")) | |
{ | |
var clientconnection = 0x1244054; | |
var off = pm.Read<uint>(clientconnection - 0x400000 + pm.BaseAddress.ToInt32()); | |
for (var opcode = 0; opcode < 0xFFF; opcode++) | |
{ | |
// normal opcode check from NetClient::ProcessMessage | |
if ((opcode & 0x440) != 64) | |
continue; | |
// hash from NetClient::ProcessMessage | |
var condensed = opcode & 0x3F | ((opcode & 0x380 | (opcode >> 1) & 0x7C00) >> 1); | |
var jams = pm.Read<uint>(off + condensed * 4 + 344 * 4); | |
if (jams == 0) | |
continue; | |
var handler = jams - ((opcode | (opcode << 16)) ^ 0x62A3A31D); | |
var rebase = handler - pm.BaseAddress.ToInt32() + 0x400000; | |
if (rebase < 0) | |
continue; | |
Console.WriteLine("{0:X4} {1:X8}", opcode, rebase); | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment