[Warcraft III] Game State Checking 1.22

[Rufus]

Since no one posted an update to this yet :p.

This works by checking the opcode of a game class that is null unless you are inside a game.

Warcraft_CheckGameState proc
;//Game state checking function

.data
    FXN_GameClass dd 6FAA1988h

.code

    ;//Move GameClass into EAX
    mov eax, FXN_GameClass

    ;//Check to see if we're in a game and return true/false.
    .if byte ptr [eax] == 0h
        mov eax, 0
    .else
        mov eax, 1
    .endif
    ret

Warcraft_CheckGameState endp

[Epsilon]

Originally Posted by Rufus

Since no one posted an update to this yet :p.

This works by checking the opcode of a game class that is null unless you are inside a game.

I think it's not exactly a class, but the address of a global variable inside Game.dll's .data section which points to the address of the first member of a dynamically allocated structure.

[oMBra]

can this be made with autoit?

[Rufus]

Originally Posted by oMBra

can this be made with autoit?

I have never used auto-it or any other cheap shot easy-make programs, but I'm sure if auto-it can read the process memory it shouldn't be a problem.

[oMBra]

yes he can read / write etc but i dunno how to go to " mov eax, FXN_GameClass "... what language is that?

[Rufus]

ignore all that and just read the memory for offset 6FAA1988 and if its 00h it means no game is active.

[oMBra]

with 00h do u mean the value located at that offset?

[Zephyrix]

Originally Posted by oMBra

with 00h do u mean the value located at that offset?

Precisely.

[oMBra]

I searched it and I didnt found that

[Rufus]

Pretty sure you did not have to search for anything.

[Dyndrilliac]

Originally Posted by Rufus

This works by checking the opcode of a game class that is null unless you are inside a game.

Originally Posted by Epsilon

I think it's not exactly a class, but the address of a global variable inside Game.dll's .data section which points to the address of the first member of a dynamically allocated structure.

Actually, it's a byte pointer (a pointer to a byte).

[zev]

Originally Posted by Dyndrilliac

Actually, it's a byte pointer (a pointer to a byte).

No, I don't think it is.

Blizzard most likely did it like this:

typedef struct tStructure {
        // Members
} STRUCTURE, *PSTRUCTURE;
 
PSTRUCTURE g_pStructure = ( PSTRUCTURE )malloc( sizeof( STRUCTURE ));

[Dyndrilliac]

You're wrong. Think about it. The code reads a value from a given address, which is always going to be a one or zero. This is traditionally called a boolean. And while a boolean could be fit into a single bit, bytes are the smallest common data unit, and it is more likely that Blizzard's developers simply used either C++'s intrinsic "bool" type, or C's "BOOL" typedef, both of which resolves to bytes. Therefore, an address that points to this byte, must therefore be a byte pointer. As a matter of fact, if you read the code, the address is placed in EAX, and then the code treats EAX as a byte pointer. Ipso facto, it's a byte pointer. While we're on the subject...

bool AreYouInGame() {
     return (*(BYTE*)(0x6FAA1988));
}

[zev]

Originally Posted by Dyndrilliac

You're wrong. Think about it. The code reads a value from a given address, which is always going to be a one or zero. This is traditionally called a boolean. And while a boolean could be fit into a single bit, bytes are the smallest common data unit, and it is more likely that Blizzard's developers simply used either C++'s intrinsic "bool" type, or C's "BOOL" typedef, both of which resolves to bytes. Therefore, an address that points to this byte, must therefore be a byte pointer. As a matter of fact, if you read the code, the address is placed in EAX, and then the code treats EAX as a byte pointer. Ipso facto, it's a byte pointer.

It does read an address which points to a class initialised at gamestart, if the user isn't ingame, it points to NULL.

I understand your logic, but I reversed those parts of Warcraft's game code myself and it's not a boolean.

Of course, you can still apply boolean logic to it :p

Although, it could be that we'r talking about different topics, are you refering to Rufus' code or to the actual data?

[Dyndrilliac]

...

Ok, I don't know how else to say this. What the **** do you think NULL is? It's a constant for zero. If a piece of data can only be a one or a zero, it is a boolean. Not a pointer to the instance of a class. Do you know why? Because if it were a pointer to the instance of a class, checking for one would not work. The data would be the address at memory where the instance of the class is located, and thus the gamestate check function that was posted would fail.

[zev]

Originally Posted by Dyndrilliac

...

Ok, I don't know how else to say this. What the **** do you think NULL is? It's a constant for zero. If a piece of data can only be a one or a zero, it is a boolean. Not a pointer to the instance of a class. Do you know why? Because if it were a pointer to the instance of a class, checking for one would not work. The data would be the address at memory where the instance of the class is located, and thus the gamestate check function that was posted would fail.

Not in game:


In game:


Just because you can apply boolean logic to it, doesn't mean that it was implemented as a boolean by the Blizzard programmer.

The code posted in this thread doesn't check for one either, it checks for 0.
( It could be heavily improved by using boolean logic, though )