wotlk WoW 3.3.5 Patcher (Custom Item Fix) r001

No more sketchy download required.

As the offsets were not posted, and the source not posted, I figured i'd post all changes made when making the item.dbc modification:

61BE58h 
Original:
43 61
Changed:
7C 7C

358186h
Original:
8B 01 6A 01 99 6A 00 68 70 EB 5E 00 33 C2 8D 4D
F8 51 2B C2 50 B9 28 D8 C5 00 C7 45 F8 00 00 00
00 C7 45 FC 00 00 00 00 E8 7D 3C F2 FF 85 C0 74
07 8B 40 08 8B E5 5D C3 33 C0 8B E5 5D C3 CC CC
CC CC CC CC CC CC CC

Changed:
56 8B 31 89 F0 6A 01 99 6A 00 68 70 EB 5E 00 33
C2 8D 4D F8 51 2B C2 50 B9 28 D8 C5 00 C7 45 F8
00 00 00 00 C7 45 FC 00 00 00 00 E8 7A 3C F2 FF
85 C0 74 08 8B 40 08 5E 8B E5 5D C3 89 F0 5E 89
EC 5D E9 89 E4 FA FF

358136h
Original:
8B 01 6A 01 99 6A 00 68 70 EB 5E 00 33 C2 8D 4D
F8 51 2B C2 50 B9 28 D8 C5 00 C7 45 F8 00 00 00
00 C7 45 FC 00 00 00 00 E8 CD 3C F2 FF 85 C0 74
07 8B 40 04 8B E5 5D C3 33 C0 8B E5 5D C3 CC CC
CC CC CC CC CC CC CC

Changed:
56 8B 31 89 F0 6A 01 99 6A 00 68 70 EB 5E 00 33
C2 8D 4D F8 51 2B C2 50 B9 28 D8 C5 00 C7 45 F8
00 00 00 00 C7 45 FC 00 00 00 00 E8 CA 3C F2 FF
85 C0 74 08 8B 40 04 5E 8B E5 5D C3 89 F0 5E 89
EC 5D E9 A9 E4 FA FF

309E03h
Original:
8B 40 0C 8B 0D 5C 3D AD 00 3B C1 7C 24 3B 05 58
3D AD 00 7F 1C 2B C1 8B 0D 6C 3D AD 00 8B 04 81
85 C0 74 0D 8B 40 14

Changed:
8D 48 0C E8 45 E4 04 00 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90

306703h
Original:
8B 40 0C 8B 0D 5C 3D AD 00 3B C1 7C 1B 3B 05 58
3D AD 00 7F 13 2B C1 8B 0D 6C 3D AD 00 8B 04 81
85 C0 74 04 8B 40 14 C3 33 C0 C3 CC CC 8B 41 08
8B 40 0C 8B 0D 5C 3D AD 00 3B C1 7C 1B 3B 05 58
3D AD 00 7F 13 2B C1 8B 0D 6C 3D AD 00 8B 04 81
85 C0 74 04 8B 40 1C C3 33 C0 C3

Changed:
8D 48 0C E9 45 1B 05 00 CC CC CC CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC CC CC CC 8B 41 08
8D 48 0C E9 15 1C 05 00 CC CC CC CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC CC

306683h
Original:
8B 40 0C 8B 0D 5C 3D AD 00 3B C1 7C 1B 3B 05 58
3D AD 00 7F 13 2B C1 8B 0D 6C 3D AD 00 8B 04 81
85 C0 74 04 8B 40 18 C3 33 C0 C3

Changed:
8D 48 0C E9 45 1B 05 00 CC 8B 41 08 8D 48 0C E9
E9 1A 05 00 CC 8D 4D 08 E8 B0 1B 05 00 E9 8C 41
EA FF CC CC CC CC CC CC CC CC CC

306650h
Original:
8B 41 08 8B 40 0C

Changed:
EB 3A CC CC CC CC

306614h
Original:
CC CC CC CC CC CC CC CC CC CC CC CC 8B 41 08 8B
40 0C

Changed:
8B 41 08 8D 48 0C E9 11 1B 05 00 CC EB F2 CC CC
CC CC

1AB316h
Original:
B9 64 3D AD 00 E8 70 03 0B 00 85 C0 74 05 8B 40
14

Changed:
89 E1 E8 33 CF 1A 00 83 C4 04 85 C0 74 05 90 90
90

1AB0A9h
Original:
83 7B 18 00

Changed:
90 90 85 DB

1AB076h
Original:
B9 64 3D AD 00 E8 10 06 0B 00 8B D8 85 DB
Changed:
89 E1 E8 53 D1 1A 00 E9 84 CC FF FF 85 C0

1AAAFAh
Original:
B9 64 3D AD 00 E8 8C 0B 0B 00 85 C0 74 05 8B 40
14

Changed:
89 E1 E8 4F D7 1A 00 83 C4 04 85 C0 74 05 90 90
90

1AA9D0h
Original:
B9 64 3D AD 00 E8 B6 0C 0B 00 85 C0 74 05 8B 40
14

Changed:
89 E1 E8 79 D8 1A 00 83 C4 04 85 C0 74 05 90 90
90

1AA8A2h
Original:
B9 64 3D AD 00 E8 E4 0D 0B 00 85 C0 74 1F 8B 40
14

Changed:
89 E1 E8 A7 D9 1A 00 83 C4 04 85 C0 74 1F 90 90
90

1AA86Ch
Original:
8B 47 18
Changed:
90 89 F8

1AA821h
Original:
8B 45 08 50 B9 64 3D AD 00 E8 61 0E 0B 00 8B F8
85 FF

Changed:
90 8D 4D 08 E8 A6 D9 1A 00 8B F8 E9 67 BE 15 00
85 C0

1AA6D4h
Original:
B9 64 3D AD 00 E8 B2 0F 0B 00 85 C0 74 05 8B 40
14

Changed:
89 E1 E8 75 DB 1A 00 83 C4 04 85 C0 74 05 90 90
90

1A8C8Eh
Original:
B9 64 3D AD 00 E8 F8 29 0B 00 85 C0 74 05 8B 40
14

Changed:
89 E1 E8 BB F5 1A 00 83 C4 04 85 C0 74 05 90 90
90

1A7CF5h
Original:
A1 5C 3D AD 00 83 C4 04 3B F0 7C 1F 3B 35 58 3D
AD 00 7F 17 8B 15 6C 3D AD 00 8B CE 2B C8 8B 04
8A 85 C0 74 06 83 78 18 00

Changed:
83 C4 04 56 89 E1 E8 D0 04 1B 00 83 C4 04 EB 17
CC 89 C3 89 E1 E8 41 05 1B 00 83 C4 04 E9 6B 33
00 00 CC CC CC CC CC 85 C0

1A575Ch
Original:
50 8B 45 F8 8B 48 14 6A
Changed:
50 90 90 90 8B 4D F8

1A572Eh
Original:
8B 03 50 B9 64 3D AD 00 E8 55 5F 0B
Changed:
90 90 90 90 90 90 89 D9 E8 15 2B 1B

1A5528h
Original:
8B 55 F4 8B 42 14
Changed:
90 90 90 8B 45 F4

1A54EFh
Original:
8B 4D F4 51 B9 64 3D AD 00 E8 93 61 0B
Changed:
00 90 90 90 90 90 90 8D 4D F4 E8 53 2D 1B

1223F7h
Original:
A1 5C 3D AD 00 3B F0 7C 1E 3B 35 58 3D AD 00 7F
16 8B 15 6C 3D AD 00 8B CE 2B C8 8B 04 8A 85 C0
74 05 8B 78 14

Changed:
56 89 E1 E8 51 5E 23 00 83 C4 04 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 85 C0
74 05 89 C7 90

1164ACh
Original:
8B 4E 14
Changed:
89 F1 90

11646Dh
Original:
A1 5C 3D AD 00 3B F0 7C 77 3B 35 58 3D AD 00 7F
6F 2B F0 A1 6C 3D AD 00 8B 34 B0

Changed:
56 89 E1 E8 DB 1D 24 00 83 C4 04 89 C6 90 90 90
90 90 90 90 90 90 90 90 90 90 90

168h
Original:
96 26 76
Changed:
5A C5 75
 

Thanks @00017144 for posting the offsets in a good, readable form :). I thought of doing that but couldn't be arsed, and on myself I only have my messy notes which are not fit for public consumption.

You are of course welcome to patch it by yourself too, but please make 100% sure you are using a clean and unmodified 3.3.5.12340 enUS wow.exe before applying. The patcher takes care of that and will checksum the file before&after to make 100% sure the patch and resulting binary is correct.

I also welcome any bug reports and if anyone has the technical experience to help with the last part of fixing the MaterialID to make it 100% can contact me to discuss the technical details on what exactly were done, how and why.

4 minutes ago, kebabstorm said:

Thanks @00017144 for posting the offsets in a good, readable form :). I thought of doing that but couldn't be arsed, and on myself I only have my messy notes which are not fit for public consumption.

You are of course welcome to patch it by yourself too, but please make 100% sure you are using a clean and unmodified 3.3.5.12340 enUS wow.exe before applying. The patcher takes care of that and will checksum the file before&after to make 100% sure the patch and resulting binary is correct.

I also welcome any bug reports and if anyone has the technical experience to help with the last part of fixing the MaterialID to make it 100% can contact me to discuss the technical details on what exactly were done, how and why.

You should append the source to your github so others can extend it if they have time to do such(possibly solving the materialID thing), possibly with the notes. I've done some pretty messy notes before about binary mods and others have still been able to make something out of it. Messy is better than a shot in the dark.

As well as 010 Editor has an export feature for offsets, took a bit of formatting but not bad to do.

You are absolutely right, and I plan to eventually clean up my notes (so they make sense to other people than me) and do a proper post-mortem when I have the time and energy for it. The "source" is right now literally those offsets and they can make sense to reverse-engineers who by diffing can look at what has been done but it would definitely help to post all my findings and understanding I made in the process of creating the patch. As it wasn't as easy as simply patching couple of functions like what was done in the TBC version of the patch since 1) Item.dbc of 3.3.5 has 8 fields instead of 3 in 2.4.3 and 2) The paradigm of accessing dbc/cache is different in 3.3.5 and 3) lot of code was inlined by the compiler to not use a function but rather inline parts of the item.dbc and/or cache retrieval functions in-place making it sometimes rather difficult to patch the original functions 4) i had to understand exactly what many functions are looking for / doing to only patch the places where it's supposed to instead of blindly patching everything, to not modify any original functionality or break anything. I also found a problem in the original TBC patch which I posted to reddit about hoping the original dev contacts me so I can explain what's wrong and how to fix it.

31 minutes ago, 00017144 said:

No more sketchy download required.

As the offsets were not posted, and the source not posted, I figured i'd post all changes made when making the item.dbc modification:

 

61BE58h 
Original:
43 61
Changed:
7C 7C

358186h
Original:
8B 01 6A 01 99 6A 00 68 70 EB 5E 00 33 C2 8D 4D
F8 51 2B C2 50 B9 28 D8 C5 00 C7 45 F8 00 00 00
00 C7 45 FC 00 00 00 00 E8 7D 3C F2 FF 85 C0 74
07 8B 40 08 8B E5 5D C3 33 C0 8B E5 5D C3 CC CC
CC CC CC CC CC CC CC

Changed:
56 8B 31 89 F0 6A 01 99 6A 00 68 70 EB 5E 00 33
C2 8D 4D F8 51 2B C2 50 B9 28 D8 C5 00 C7 45 F8
00 00 00 00 C7 45 FC 00 00 00 00 E8 7A 3C F2 FF
85 C0 74 08 8B 40 08 5E 8B E5 5D C3 89 F0 5E 89
EC 5D E9 89 E4 FA FF

358136h
Original:
8B 01 6A 01 99 6A 00 68 70 EB 5E 00 33 C2 8D 4D
F8 51 2B C2 50 B9 28 D8 C5 00 C7 45 F8 00 00 00
00 C7 45 FC 00 00 00 00 E8 CD 3C F2 FF 85 C0 74
07 8B 40 04 8B E5 5D C3 33 C0 8B E5 5D C3 CC CC
CC CC CC CC CC CC CC

Changed:
56 8B 31 89 F0 6A 01 99 6A 00 68 70 EB 5E 00 33
C2 8D 4D F8 51 2B C2 50 B9 28 D8 C5 00 C7 45 F8
00 00 00 00 C7 45 FC 00 00 00 00 E8 CA 3C F2 FF
85 C0 74 08 8B 40 04 5E 8B E5 5D C3 89 F0 5E 89
EC 5D E9 A9 E4 FA FF

309E03h
Original:
8B 40 0C 8B 0D 5C 3D AD 00 3B C1 7C 24 3B 05 58
3D AD 00 7F 1C 2B C1 8B 0D 6C 3D AD 00 8B 04 81
85 C0 74 0D 8B 40 14

Changed:
8D 48 0C E8 45 E4 04 00 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90

306703h
Original:
8B 40 0C 8B 0D 5C 3D AD 00 3B C1 7C 1B 3B 05 58
3D AD 00 7F 13 2B C1 8B 0D 6C 3D AD 00 8B 04 81
85 C0 74 04 8B 40 14 C3 33 C0 C3 CC CC 8B 41 08
8B 40 0C 8B 0D 5C 3D AD 00 3B C1 7C 1B 3B 05 58
3D AD 00 7F 13 2B C1 8B 0D 6C 3D AD 00 8B 04 81
85 C0 74 04 8B 40 1C C3 33 C0 C3

Changed:
8D 48 0C E9 45 1B 05 00 CC CC CC CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC CC CC CC 8B 41 08
8D 48 0C E9 15 1C 05 00 CC CC CC CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC CC

306683h
Original:
8B 40 0C 8B 0D 5C 3D AD 00 3B C1 7C 1B 3B 05 58
3D AD 00 7F 13 2B C1 8B 0D 6C 3D AD 00 8B 04 81
85 C0 74 04 8B 40 18 C3 33 C0 C3

Changed:
8D 48 0C E9 45 1B 05 00 CC 8B 41 08 8D 48 0C E9
E9 1A 05 00 CC 8D 4D 08 E8 B0 1B 05 00 E9 8C 41
EA FF CC CC CC CC CC CC CC CC CC

306650h
Original:
8B 41 08 8B 40 0C

Changed:
EB 3A CC CC CC CC

306614h
Original:
CC CC CC CC CC CC CC CC CC CC CC CC 8B 41 08 8B
40 0C

Changed:
8B 41 08 8D 48 0C E9 11 1B 05 00 CC EB F2 CC CC
CC CC

1AB316h
Original:
B9 64 3D AD 00 E8 70 03 0B 00 85 C0 74 05 8B 40
14

Changed:
89 E1 E8 33 CF 1A 00 83 C4 04 85 C0 74 05 90 90
90

1AB0A9h
Original:
83 7B 18 00

Changed:
90 90 85 DB

1AB076h
Original:
B9 64 3D AD 00 E8 10 06 0B 00 8B D8 85 DB
Changed:
89 E1 E8 53 D1 1A 00 E9 84 CC FF FF 85 C0

1AAAFAh
Original:
B9 64 3D AD 00 E8 8C 0B 0B 00 85 C0 74 05 8B 40
14

Changed:
89 E1 E8 4F D7 1A 00 83 C4 04 85 C0 74 05 90 90
90

1AA9D0h
Original:
B9 64 3D AD 00 E8 B6 0C 0B 00 85 C0 74 05 8B 40
14

Changed:
89 E1 E8 79 D8 1A 00 83 C4 04 85 C0 74 05 90 90
90

1AA8A2h
Original:
B9 64 3D AD 00 E8 E4 0D 0B 00 85 C0 74 1F 8B 40
14

Changed:
89 E1 E8 A7 D9 1A 00 83 C4 04 85 C0 74 1F 90 90
90

1AA86Ch
Original:
8B 47 18
Changed:
90 89 F8

1AA821h
Original:
8B 45 08 50 B9 64 3D AD 00 E8 61 0E 0B 00 8B F8
85 FF

Changed:
90 8D 4D 08 E8 A6 D9 1A 00 8B F8 E9 67 BE 15 00
85 C0

1AA6D4h
Original:
B9 64 3D AD 00 E8 B2 0F 0B 00 85 C0 74 05 8B 40
14

Changed:
89 E1 E8 75 DB 1A 00 83 C4 04 85 C0 74 05 90 90
90

1A8C8Eh
Original:
B9 64 3D AD 00 E8 F8 29 0B 00 85 C0 74 05 8B 40
14

Changed:
89 E1 E8 BB F5 1A 00 83 C4 04 85 C0 74 05 90 90
90

1A7CF5h
Original:
A1 5C 3D AD 00 83 C4 04 3B F0 7C 1F 3B 35 58 3D
AD 00 7F 17 8B 15 6C 3D AD 00 8B CE 2B C8 8B 04
8A 85 C0 74 06 83 78 18 00

Changed:
83 C4 04 56 89 E1 E8 D0 04 1B 00 83 C4 04 EB 17
CC 89 C3 89 E1 E8 41 05 1B 00 83 C4 04 E9 6B 33
00 00 CC CC CC CC CC 85 C0

1A575Ch
Original:
50 8B 45 F8 8B 48 14 6A
Changed:
50 90 90 90 8B 4D F8

1A572Eh
Original:
8B 03 50 B9 64 3D AD 00 E8 55 5F 0B
Changed:
90 90 90 90 90 90 89 D9 E8 15 2B 1B

1A5528h
Original:
8B 55 F4 8B 42 14
Changed:
90 90 90 8B 45 F4

1A54EFh
Original:
8B 4D F4 51 B9 64 3D AD 00 E8 93 61 0B
Changed:
00 90 90 90 90 90 90 8D 4D F4 E8 53 2D 1B

1223F7h
Original:
A1 5C 3D AD 00 3B F0 7C 1E 3B 35 58 3D AD 00 7F
16 8B 15 6C 3D AD 00 8B CE 2B C8 8B 04 8A 85 C0
74 05 8B 78 14

Changed:
56 89 E1 E8 51 5E 23 00 83 C4 04 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 85 C0
74 05 89 C7 90

1164ACh
Original:
8B 4E 14
Changed:
89 F1 90

11646Dh
Original:
A1 5C 3D AD 00 3B F0 7C 77 3B 35 58 3D AD 00 7F
6F 2B F0 A1 6C 3D AD 00 8B 34 B0

Changed:
56 89 E1 E8 DB 1D 24 00 83 C4 04 89 C6 90 90 90
90 90 90 90 90 90 90 90 90 90 90

168h
Original:
96 26 76
Changed:
5A C5 75
 

Thats a lots of offsets lol far more than all changes in my edited exe 

4 minutes ago, Alastor Strix'Efuartus said:

Thats a lots of offsets lol far more than all changes in my edited exe 

I don't lie, it was a lot of work indeed. I saw the TBC version and thought to myself, oh well, this'll be easy. But the rabbit hole went deep.

Just now, kebabstorm said:

I don't lie, it was a lot of work indeed. I saw the TBC version and thought to myself, oh well, this'll be easy. But the rabbit hole went deep.

I can see some fun servers using this for sure but I will stick to making item.dbc

25 minutes ago, 00017144 said:

As well as 010 Editor has an export feature for offsets, took a bit of formatting but not bad to do.

I still use HIEW for my editing which is (originally) a DOS program from over two decades ago

Thanks for your work and sharing it!

2 hours ago, kebabstorm said:

I still use HIEW for my editing which is (originally) a DOS program from over two decades ago

Do you have a IDA DB that you were using? something some named functions and i may find the mat Id you're looking for

I'm using the same old IDB from TOM_RUS which has been floating around for years, where most functions remain unnamed (it's been great help though still, no doubt). I wouldn't know if a more recent one is available somewhere. That could help though.

I found a function for "Get MaterialID" which accesses cache first and item.dbc second, at sub_758ED0 , but it's barely used. From that function you can see that the MaterialID is at *p+404 aka [eax+194h] when retrieving from cache (column 102 @ ItemCache.wdb) or *p+16 aka [eax+10h] when retrieving from DBC (column 5 @ Item.Dbc). Detouring the func where the material is actually set to here would be the way to do it, but the problem is finding the place(s), where to detour from. There's a good chance that it doesn't actually call any func to retrieve it but it's inlined somewhere.

edit: it's this one: https://mega.co.nz/#!GdoCCSKD!U3BFM2bySKF2lW-X5wz4XQJcZp8aH3YZUTRBpLjQU0Q

36 minutes ago, kebabstorm said:

I'm using the same old IDB from TOM_RUS which has been floating around for years, where most functions remain unnamed (it's been great help though still, no doubt). I wouldn't know if a more recent one is available somewhere. That could help though.

I found a function for "Get MaterialID" which accesses cache first and item.dbc second, at sub_758ED0 , but it's barely used. From that function you can see that the MaterialID is at *p+404 aka [eax+194h] when retrieving from cache (column 102 @ ItemCache.wdb) or *p+16 aka [eax+10h] when retrieving from DBC (column 5 @ Item.Dbc). Detouring the func where the material is actually set to here would be the way to do it, but the problem is finding the place(s), where to detour from. There's a good chance that it doesn't actually call any func to retrieve it but it's inlined somewhere.

edit: it's this one: https://mega.co.nz/#!GdoCCSKD!U3BFM2bySKF2lW-X5wz4XQJcZp8aH3YZUTRBpLjQU0Q

There is SndInterfacePlayItemSound 0x4D0020 which seems to control item drop and pickup sounds, well as some third item sound catagory, could be similar

1 hour ago, 00017144 said:

There is SndInterfacePlayItemSound 0x4D0020 which seems to control item drop and pickup sounds, well as some third item sound catagory, could be similar

 

Yeah I checked that route, the thing is that many functions call a similar func sub_4D0090 which takes item's displayid as argument (instead of material) so it seems that even the original client does not always use the materialID field, but instead gets the sound to play from the ItemGroupSounds.dbc using the displayID as key. I've properly patched these calls from the root (not the sound func) so that's why the sound works for custom items in some cases, like picking it up from an action bar or guild bank. That also means that Blizz did an oopsie there and it's possible that item could have different sounds moving it around in your bank/bags and moving it on action bars/guild bank, if the sound entry in Material.dbc from the item's materialID is different to the sound id set in ItemGroupSounds.dbc by its' displayID.

SndInterfacePlayItemSound(sub_4D0020) and sub_4D0090 both call the sub_4C6A40 func to actually play the sound. The problem is that SndInterfacePlayItemSound takes a object pointer (not database ptr or ID) as an argument, so the material part is missing from the actual pointer. Ofc I could patch some hacky mega-detour @ the SndInterfacePlayItemSound replacing the missing materialID, but that's not how I want to go about doing it. As so far I haven't resorted to any "hacky" improper fixes, but patched every other thing at the root where it's supposed to be patched. That "root" where the material is set to the object pointer would be the right way to do it. I just haven't located it. I've found some functions which I believe to be item constructors and trying change material values there, to no avail.

edit: one example for this can be found in CGActionBar__PickupAction (sub_5ABE70) gets the displayID from Item.DBC (or cache, in my patched version) and then calls sub_520D30 with the displayID as an argument which calls sub_4D0090 with the same displayID. Sound is played.

for the other, Lua_PickupContainerItem (sub_5D7FF0) which calls GetBagItem(sub_754390) which returns an (unique, meaning literally the instance of that single item) object pointer which is in turn turned to a guid and the guid is passed to SetCursorItem (sub_520770) which turns it to an object pointer again and finally calls SndInterfacePlayItemSound using that pointer. Since the material part is missing from the object instance, sound is not played.