Хак на память Warcraft3

  unit array GlobalUnitArrayForDataPassing
    integer pGlobalUnitArrayForDataPassing=0
 
function PresetSomeArray takes nothing returns nothing
   
    set GlobalUnitArrayForDataPassing[1]=null
    set GlobalUnitArrayForDataPassing[1099]=null
    return
endfunction
 
function TypecastUnitArray takes nothing returns nothing
    local integer GlobalUnitArrayForDataPassing
endfunction
//# +nosemanticerror
function GetUnitArrayAddress takes nothing returns integer
    return GlobalUnitArrayForDataPassing
endfunction
 
function OnAttackDamageCalculationHook takes nothing returns nothing
    local integer isource=GetDataFromDataArray1(65)
    local integer itarget=GetDataFromDataArray1(66)
    local integer result=GetDataFromDataArray1(68)
    if result==1 or SimulatedAttackCounter>0 then
//  in case if result==0 we forced this attack via trigger, but have to push the target manually then
        set tt_unit1=GetDataFromUnitArray(3)//source
        set tt_unit2=GetDataFromUnitArray(4)//target
        if HaveSavedHandle(MHT,GetHandleId(tt_unit1),GetHandleId(tt_unit2)) then
            call ExecuteFunc("AttackReadyToGoInit")
        else
            if GetDataFromDataArray1(67)=='item' then//targettype
                set tt_widget1=tt_unit2
                call ExecuteFunc("ItemAttackReadyToGoInit")
            endif
        endif
    endif
endfunction
 
function InitAttackDamageCalculationHook takes integer pTriggerHandle returns nothing
    local integer old1=RMem(pMeleeAttackCatcher)
    local integer old2=RMem(pMeleeAttackCatcher+4)
    local integer oldprotection = ChangeOffsetProtection(pMeleeAttackCatcher,8,0x40)
//call echo("jook "+Int2Hex(pReservedMemoryForMeleeAttackHook))
   
    set Memory[pReservedMemoryForMeleeAttackHook/4+0]=0x30498B60
    set Memory[pReservedMemoryForMeleeAttackHook/4+1]=0x000000BB
    set Memory[pReservedMemoryForMeleeAttackHook/4+2]=0xE80B8900
    call WMem(pReservedMemoryForMeleeAttackHook+5,DataArray1Address+260)// source address
    set Memory[pReservedMemoryForMeleeAttackHook/4+3]=(GameDLL+0x2DCC40)-(pReservedMemoryForMeleeAttackHook+12)-4
    set Memory[pReservedMemoryForMeleeAttackHook/4+4]=0x000000BB
    set Memory[pReservedMemoryForMeleeAttackHook/4+5]=0x61038900
    call WMem(pReservedMemoryForMeleeAttackHook+17,pGlobalUnitArrayForDataPassing+12)// source GlobalUnitArrayForDataPassing[3]
    set Memory[pReservedMemoryForMeleeAttackHook/4+6]=0x6C798160
    set Memory[pReservedMemoryForMeleeAttackHook/4+7]=0xFFFFFFFF
    set Memory[pReservedMemoryForMeleeAttackHook/4+8]=0xC1833a74
    set Memory[pReservedMemoryForMeleeAttackHook/4+9]=0x0000E86C
    set Memory[pReservedMemoryForMeleeAttackHook/4+10]=0xC88B0000
    call WMem(pReservedMemoryForMeleeAttackHook+38,(GameDLL+0x4786B0)-(pReservedMemoryForMeleeAttackHook+38)-4)
    set Memory[pReservedMemoryForMeleeAttackHook/4+11]=0x000000B8
    set Memory[pReservedMemoryForMeleeAttackHook/4+12]=0x8B088900
    call WMem(pReservedMemoryForMeleeAttackHook+45,DataArray1Address+264)//66 target address
    set Memory[pReservedMemoryForMeleeAttackHook/4+13]=0x1C5B8B19
    set Memory[pReservedMemoryForMeleeAttackHook/4+14]=0x00BBD3FF
    set Memory[pReservedMemoryForMeleeAttackHook/4+15]=0x89000000
    call WMem(pReservedMemoryForMeleeAttackHook+59,DataArray1Address+268)//67 target type
    set Memory[pReservedMemoryForMeleeAttackHook/4+16]=0x00E89003
    set Memory[pReservedMemoryForMeleeAttackHook/4+17]=0xBB000000
    call WMem(pReservedMemoryForMeleeAttackHook+67,(GameDLL+0x2DCC40)-(pReservedMemoryForMeleeAttackHook+67)-4)
    set Memory[pReservedMemoryForMeleeAttackHook/4+18]=pGlobalUnitArrayForDataPassing+16//4 target handle
    set Memory[pReservedMemoryForMeleeAttackHook/4+19]=0x00BB0389
    set Memory[pReservedMemoryForMeleeAttackHook/4+20]=0xC7000000
    call WMem(pReservedMemoryForMeleeAttackHook+79,DataArray1Address+272)//68 result
    set Memory[pReservedMemoryForMeleeAttackHook/4+21]=0x00000103
    set Memory[pReservedMemoryForMeleeAttackHook/4+22]=0x0BEB9000
    set Memory[pReservedMemoryForMeleeAttackHook/4+23]=0x000000BB
    set Memory[pReservedMemoryForMeleeAttackHook/4+24]=0x0003C700
    call WMem(pReservedMemoryForMeleeAttackHook+93,DataArray1Address+272)//68 result
    set Memory[pReservedMemoryForMeleeAttackHook/4+25]=0x61000000
    set Memory[pReservedMemoryForMeleeAttackHook/4+26]=0x90909060
    set Memory[pReservedMemoryForMeleeAttackHook/4+27]=0x00000068
    set Memory[pReservedMemoryForMeleeAttackHook/4+28]=0x0000B800
    call WMem(pReservedMemoryForMeleeAttackHook+27*4+1,pTriggerHandle)
    set Memory[pReservedMemoryForMeleeAttackHook/4+29]=0xD0FF0000
    call WMem(pReservedMemoryForMeleeAttackHook+28*4+2,pTriggerExecute)
    set Memory[pReservedMemoryForMeleeAttackHook/4+30]=0x6104C483
    set Memory[pReservedMemoryForMeleeAttackHook/4+31]=0x8B575651
    set Memory[pReservedMemoryForMeleeAttackHook/4+32]=0xB8BE8BF1
    set Memory[pReservedMemoryForMeleeAttackHook/4+33]=0x8B000002
    set Memory[pReservedMemoryForMeleeAttackHook/4+34]=0x00ACBE84
    set Memory[pReservedMemoryForMeleeAttackHook/4+35]=0x84030000
    set Memory[pReservedMemoryForMeleeAttackHook/4+36]=0x0000A0BE
    set Memory[pReservedMemoryForMeleeAttackHook/4+37]=0x8C860300
    set Memory[pReservedMemoryForMeleeAttackHook/4+38]=0x8B000000
   
    set Memory[pReservedMemoryForMeleeAttackHook/4+39]=0x00008C8E
    set Memory[pReservedMemoryForMeleeAttackHook/4+40]=0x988E8900
    set Memory[pReservedMemoryForMeleeAttackHook/4+41]=0xC7000000
   
    set Memory[pReservedMemoryForMeleeAttackHook/4+42]=0x00008C86
    set Memory[pReservedMemoryForMeleeAttackHook/4+43]=0x00000000
    set Memory[pReservedMemoryForMeleeAttackHook/4+44]=0xBE8C8B00
    set Memory[pReservedMemoryForMeleeAttackHook/4+45]=0x00000094
    set Memory[pReservedMemoryForMeleeAttackHook/4+46]=0x88BE948B
    set Memory[pReservedMemoryForMeleeAttackHook/4+47]=0xE9000000
    set Memory[pReservedMemoryForMeleeAttackHook/4+48]=GameDLL + 0xC697E - (pReservedMemoryForMeleeAttackHook/4+48)*4 - 4
   
    set Memory[pMeleeAttackCatcher/4]=0xE9E9E9E9
    set Memory[pMeleeAttackCatcher/4+1]=0x90909090
   
    call WMem(pMeleeAttackCatcher + 1, pReservedMemoryForMeleeAttackHook - pMeleeAttackCatcher - 5 )
   
    call ChangeOffsetProtection(pMeleeAttackCatcher,8,oldprotection)
   
   
//  pushad
//mov ecx,[ecx+30]
//mov ebx,13455E1C
//mov [ebx],ecx
//call Game.dll+2DCC40
//mov ebx,1824008C
//mov [ebx],eax
//popad
//pushad
//cmp [ecx+6C],FFFFFFFF
//je 177F8918
//add ecx,6C
//call Game.dll+4786B0
//mov ecx,eax
//mov eax,13455E20
//mov [eax],ecx
//mov ebx,[ecx]
//mov ebx,[ebx+1C]
//call ebx
//mov ebx,13455E24
//mov [ebx],eax
//nop
//call Game.dll+2DCC40
//mov ebx,18240090
//mov [ebx],eax
//mov ebx,13455E28
//mov [ebx],00000001
//nop
//jmp 177F8923
//mov ebx,13455E28
//mov [ebx],00000000
//popad
//pushad
//nop
//nop
//nop
//push 00101D61
//mov eax,Game.dll+3C3F40
//call eax
//add esp,04
//popad
//push ecx
//push esi
//push edi
//mov esi,ecx
//mov edi,[esi+000002B8]
//mov eax,[esi+edi*4+000000AC]
//add eax,[esi+edi*4+000000A0]
//add eax,[esi+000000B0]
 
//mov ecx,[esi+b0]
//mov [esi+bc],ecx
//mov [esi+b0],0
//
//mov ecx,[esi+edi*4+00000094]
//mov edx,[esi+edi*4+00000088]
//jmp Game.dll+C697E
 
endfunction
 
//mmehack init
set pReservedMemoryForMeleeAttackHook = pCallFastCallWith1Args + 35000//+200
 
//main
set pGlobalUnitArrayForDataPassing=RMem(GetUnitArrayAddress() +0xC)
set t=CreateTrigger()
    call TriggerAddAction(t,function OnAttackDamageCalculationHook)
    call InitAttackDamageCalculationHook(GetHandleId(t))