Bloog Bot

Chapter 8
Drew Kestell, 2018
[email protected]

Sentience

At the end of Chapter 7, we created the implementation for the EnumerateVisibleObjects function. We successfully called the function from the WoW client and saw a bunch of objects around the player. Our code can currently differentiate between different types of objects using the ObjectType property on the WoWObject class, but that's not entirely useful by itself. What we really want is to bring our different object types of life by giving them distinct properties and methods. We'll do that by creating a class hierarchy using WoWObject as the base.

Each object type defined on our ObjectType enum represents a distinct type of object in the game with its own set of properties. For example - it makes sense for a Player or Unit to have Health, but not necessarily an Item. But all objects have a guid that's used to uniquely identify that object, which is why Guid is on the base class (WoWObject). I mentioned above the object types are represented using a class hierarchy. Because each object type is its own class, these classes each have their own distinct properties to represent the state and behavior of the object types. The properties on the different object types have been discovered through reverse engineering the WoW client, but like usual we're going to build on the work of others and look them up. Take a look at this page to see a pretty thorough breakdown of the different object types.

We aren't going to implement every object type right now. One of the primary goals of a bot is to find and kill enemies, so Unit is probably a good place to start. Create a class WoWUnit that inherits from WoWObject, and give the new class a constructor that calls the constructor on the base class to satisfy the compiler:

class WoWUnit : WoWObject
{
    internal WoWUnit(IntPtr pointer, ulong guid, ObjectType objectType)
        : base(pointer, guid, objectType)
    {
    }
}

Right now the WoWUnit class is exactly the same as WoWObject, so let's change that. First, we have to understand an implementation detail in the WoW client. Units have their details stored in a separate memory location. These details are known as "Descriptors". For each unit, the memory location of its descriptor collection is stored at a 0x8 byte offset from the base address of the unit. So there are two steps to finding the health of a unit. First, we have to find the memory address of its descriptor collection by reading a pointer from memory at BaseAddress + 0x8, then we read an int from memory using DescriptorCollectionAddress + HealthOffset. To find the HealthOffset, check out the wowdev wiki I linked above. Under the Unit Fields section you'll see the line: UNIT_FIELD_HEALTH=0x58. This means that the Health property is located at an offset of 0x58 bytes from the DescriptorCollection address. This is a bit tricky, because we're searching memory in two steps. First we have to find the address of the unit's DescriptorCollection, then we add the HealthOffset to the memory location of the DescriptorCollection.

To assist with reading memory to get the unit's health, we're going to modify our MemoryReader class. Recall from a previous chapter that we created a MemoryReader class with a single method to read bytes from the WoW client's memory. We're going to add a new method to read ints. Code below:

unsafe class MemoryReader
{
    internal byte ReadByte(IntPtr address) => *(byte*)address;

    internal int ReadInt(IntPtr address) => *(int*)address;
}

In order to use MemoryReader from our WoWUnit class, we're going to pass in a reference through the constructor. Then we'll add a Health property that uses the MemoryReader to read the unit's health from memory. Putting it all together, it looks like this:

class WoWUnit : WoWObject
{
    // DESCRIPTORS
    const int DESCRIPTOR_OFFSET = 0x8;
    const int HEALTH_OFFSET = 0x58;

    readonly MemoryReader memoryReader;

    internal WoWUnit(MemoryReader memoryReader, IntPtr pointer, ulong guid, ObjectType objectType)
        : base(pointer, guid, objectType)
    {
        this.memoryReader = memoryReader;
    }

    internal int Health
    {
        get
        {
            var ptr = memoryReader.ReadInt(IntPtr.Add(Pointer, DESCRIPTOR_OFFSET));
            return memoryReader.ReadInt(new IntPtr(ptr + HEALTH_OFFSET));
        }
    }
}

Now we need to modify the Callback method on the ObjectManager class to actually use the WoWUnit class. We'll use a switch statement to switch on objectType to determine which type of object to instantiate when populating the object list:

int Callback(int filter, ulong guid)
{
    var pointer = functions.GetObjectPtr(guid);
    var objectType = (ObjectType)memoryReader.ReadByte(
        IntPtr.Add(pointer, 
        OBJECT_TYPE_OFFSET)
    );

    switch (objectType)
    {
        case ObjectType.Unit:
            Objects.Add(new WoWUnit(memoryReader, pointer, guid, objectType));
            break;
        default:
            Objects.Add(new WoWObject(pointer, guid, objectType));
            break;
    }
    
    return 1;
}

The last thing to do is test our code to make sure everything is working correctly. As our object hierarchy gets more complicated, we're going to want the ability to only look at certain types of objects, so let's add a helper method to the ObjectManager class that will only return objects of type WowUnit:

internal IEnumerable<WoWUnit> Units => Objects.OfType<WoWUnit>();

And let's update the Test method in the UI to call this new method and print the unit's health:

void Test()
{
    objectManager.EnumerateVisibleObjects();

    var units = objectManager.Units;
    var unitCount = units.Count();

    Log($"{unitCount} units found:\n");

    foreach (var unit in units)
    {
        Log($"Guid: {unit.Guid}");
        Log($"Pointer: {unit.Pointer}");
        Log($"Health: {unit.Health}");
        Log($"ObjectType: {unit.ObjectType.ToString()}\n");
    }  
}

Now if you log in and click Test, you should see all units around the player, including their health:

It would also be useful to see the name of a unit. As discussed above, a unit's health is stored as a descriptor in a separate memory location. Almost everything you'd want to know about a unit is stored as a descriptor, but names are an exception. To be honest, I'm not sure why, but it's not too hard to find. Searching through the ownedcore client dump thread, I discovered that the pointer to the unit's name is stored at an offset from the base address of the unit. So there are three steps we need to take here. As a side note - at this point I hope the basics of pointer arithmetic and memory reading are clear, so I'm going to explain less about the multiple steps taken to read memory, and instead just show the code (if this is still confusing, go back to the first few chapters and work through the CheatEngine examples until you understand exactly what's happening). Here's the WoWUnit class with the new Name property:

class WoWUnit : WoWObject
{
    // DESCRIPTORS
    const int DESCRIPTOR_OFFSET = 0x8;
    const int HEALTH_OFFSET = 0x58;

    // OTHER
    const int NAME_OFFSET = 0xB30;

    readonly MemoryReader memoryReader;

    internal WoWUnit(MemoryReader memoryReader, IntPtr pointer, ulong guid, ObjectType objectType)
        : base(pointer, guid, objectType)
    {
        this.memoryReader = memoryReader;
    }

    internal int Health
    {
        get
        {
            var ptr = memoryReader.ReadInt(IntPtr.Add(Pointer, DESCRIPTOR_OFFSET));
            return memoryReader.ReadInt(new IntPtr(ptr + HEALTH_OFFSET));
        }
    }

    internal string Name
    {
        get
        {
            var ptr1 = memoryReader.ReadInt(IntPtr.Add(Pointer, NAME_OFFSET));
            var ptr2 = memoryReader.ReadInt((IntPtr)ptr1);
            return memoryReader.ReadString((IntPtr)ptr2);
        }
    }
}

You'll notice a new ReadString method on the MemoryReader class. We'll discuss this in more detail later on, but for now, you can use this code to read strings from the WoW process:

unsafe class MemoryReader
{
    internal byte ReadByte(IntPtr address) => *(byte*)address;

    internal int ReadInt(IntPtr address) => *(int*)address;

    internal string ReadString(IntPtr address)
    {
        var buffer = ReadBytes(address, 512);
        var ret = Encoding.ASCII.GetString(buffer);

        if (ret.IndexOf('\0') != -1)
            ret = ret.Remove(ret.IndexOf('\0'));

        return ret;
    }

    byte[] ReadBytes(IntPtr address, int count)
    {
        var ret = new byte[count];
        var ptr = (byte*)address;

        for (var i = 0; i < count; i++)
            ret[i] = ptr[i];

        return ret;
    }
}

Modify the test method to print the name of each unit, and test again. You should see something like this:

In the next chapter we'll create a class for the player and learn about world position.

Back to Top
...
Subscribe to the RSS feed to keep up with new chapters as they're released

Comments? Leave me a note: