W3MPQFNs - Warcraft 3 MPQ filename detector

Any tool that you think is useful, make a thread here and upload it.

Moderator: Cheaters

Forum rules
While crediting should be allowed, please keep down the advertising. If you know who it's from, and they have a website, please link to it as a basic courtesy.
User avatar
xsuperloadx
Newcomer
Posts: 21
Joined: July 30th, 2007, 2:46 pm

W3MPQFNs - Warcraft 3 MPQ filename detector

Post by xsuperloadx »

This my little program can detect every file which Warcraft 3 loads from any MPQ archive.
That doesn't mean it will detect every file in map archive, it generally detects less files than RMPQEx, but it could be useful if some jass trickery were used to hide filenames (I don't know such map, so I hope there are some :D).

Press Start to attach to Warcraft 3 process.
Press Stop to detach from Warcraft 3 process.

You can open MPQ archive and press save listfile in archive to save files which are in archive only.

It will probably need admin rights because it writes to Warcraft 3 process memory.

It works on versions 1.23a - 1.24b. I didn't test other versions, so it should work on more.
EDIT:
I forgot to mention that running more of these things at once can result in undefined behavior.

Details:
It changes 1st instruction in Ordinal268 exported function of Storm module (279 can also be used, but some filenames may miss) to jump to my allocated memory filled with my assembly code which sends filename string to my app, then it jumps back.
You do not have the required permissions to view the files attached to this post.
Last edited by xsuperloadx on September 16th, 2009, 10:29 pm, edited 2 times in total.
User avatar
Senethior459
Forum Staff
Posts: 2618
Joined: June 2nd, 2007, 6:53 pm
Title: I Just Lost the Game

Re: W3MPQFNs - Warcraft 3 MPQ filename detector

Post by Senethior459 »

It looks pretty useful, thanks for sharing!

Are you the author of this, by the way?
Spoiler:
In case anyone doesn't trust it, it's probably safe. Results of a scan:
[ArcaVir]
2009-09-16 Found nothing
[G DATA]
2009-09-16 Found nothing
[A-Squared]
2009-09-16 Found nothing
[Ikarus]
2009-09-16 Found nothing
[Avast! antivirus]
2009-09-16 Found nothing
[Kaspersky Anti-Virus]
2009-09-16 Found nothing
[Grisoft AVG Anti-Virus]
2009-09-16 Found nothing
[ESET NOD32]
2009-09-16 Found nothing
[Avira AntiVir]
2009-09-16 Found nothing
[Norman Virus Control]
2009-09-16 Found nothing
[Softwin BitDefender]
2009-09-16 Found nothing
[Panda Antivirus]
2009-09-16 Found nothing
[ClamAV]
2009-09-16 Found nothing
[Quick Heal]
2009-09-16 Found nothing
[CPsecure]
2009-09-16 Found nothing
[Sophos]
2009-09-16 Found nothing
[Dr.Web]
2009-09-16 Found nothing
[VirusBlokAda VBA32]
2009-09-15 Found nothing
[Frisk F-Prot Antivirus]
2009-09-16 Found nothing
[VirusBuster]
2009-09-16 Found nothing
[F-Secure Anti-Virus]
2009-09-16 Found nothing
My Warcraft III Tool Collection
If you want to chat/game with me:
Blizzard: Senethior459#1962
Discord: Kyle#7409
Steam: Spacekidkyle
User avatar
Ken
Spice Pirate
Posts: 862
Joined: January 29th, 2009, 5:35 pm
Title: LHC
Location: Canada

Re: W3MPQFNs - Warcraft 3 MPQ filename detector

Post by Ken »

He would be.

I also must say, this is nice stuff. One suggestion I might make is that for saving files, make default extension be .txt. I dislike having to type it myself. :(
Spoiler:
xkiska wrote:BARTIMEAUS is more understandable then u
Senethior459 wrote:Wow, Dream Theatre reminds me of Dragonforce, but with real skill.
Ozzapoo wrote:We laughed, we cried. Trashed.
FatherSpace: You don't find smart chicks hawt?
GeorgeMots: not anymore, im fed up with that kind of girls
FatherSpace: lol
FatherSpace: What happened?
GeorgeMots: most smart girls find out that i date/do/see other girls....
FatherSpace: ...
FatherSpace: So monogamy is your enemy?
Bartimaeus: Hmm, well, I hope my sister hasn't been kidnapped.
FatherSpace: What happened, Bart?
Bartimaeus: She walked out of the house saying that she was going over to some friends, and it's been like two hours, and my mom is trying to get a hold of her, which she's been unable to.
Bartimaeus: I can also hear three car alarms going off.
GeorgeMots: how old is she?
Bartimaeus: I haven't a clue. Probably 17.
UndeadxAssassin: wut
AbusivePie: You don't know how old your sister is?
Bartimaeus: Nope.
UndeadxAssassin: Epic fail
GeorgeMots: is she cute??
Bartimaeus: So, uh, how about you get into the Christmas spirit and put that avatar on before I do it myself and take away your bloody avatar-changin' rights?
UndeadxAssassin: If I thought of a random one...
UndeadxAssassin: Like....
UndeadxAssassin: I'll get back to you on that
User avatar
xsuperloadx
Newcomer
Posts: 21
Joined: July 30th, 2007, 2:46 pm

Re: W3MPQFNs - Warcraft 3 MPQ filename detector

Post by xsuperloadx »

Yes, I'm author of this.

And I purposedly not added .txt as default extension to increase awareness of file extensions. I guess it's a stupid idea :D. k i'll fix it.
User avatar
Senethior459
Forum Staff
Posts: 2618
Joined: June 2nd, 2007, 6:53 pm
Title: I Just Lost the Game

Re: W3MPQFNs - Warcraft 3 MPQ filename detector

Post by Senethior459 »

I like it not having the .txt extension. It's an extra four characters; if it actually mattered, you could type them yourself. But it doesn't. Also, when things have a .txt extension and I try to open them, it decides it's an executable text file (script) and asks me if i should run, open in terminal, edit, or cancel. The same exact file, but without .txt, will just open when I try to open it (Yes, this applies to Linux, but files without extensions can be opened by Windows, too. A text file without .txt at the end will still be opened in Notepad by doubleclicking it, as will most any format).
My Warcraft III Tool Collection
If you want to chat/game with me:
Blizzard: Senethior459#1962
Discord: Kyle#7409
Steam: Spacekidkyle
User avatar
duckweed2005
Newcomer
Posts: 14
Joined: June 19th, 2008, 6:13 am

Re: W3MPQFNs - Warcraft 3 MPQ filename detector

Post by duckweed2005 »

I tested this on DotA All-Stars 6.64 and found out that to get almost all the filenames you either have to :

Method 1: go battle.net or Garena and play -wtf mode with other ppl with -ardm till all heros are picked (to load the data)

or

Method 2: do the same with AI (but theres no 6.64 AI yet)

Can't you add a function to load a existing listfile (like normal MPQ editors) to find out as many filenames as possible before doing the memory scanning part? This will make the process much easier and faster. Thx.


EDIT: Or it would be better to merge this with a MPQ editor =D
M4R7yN
Newcomer
Posts: 17
Joined: August 1st, 2012, 4:59 pm

Re: W3MPQFNs - Warcraft 3 MPQ filename detector

Post by M4R7yN »

Help me.

After loading of any maps, in listfile 2 lines:
Maps\Demo\mapname.w3x
(attributes)
User avatar
Fukki
Old Wrinkly Member
Posts: 226
Joined: April 19th, 2010, 1:48 pm
Location: In The World

Re: W3MPQFNs - Warcraft 3 MPQ filename detector

Post by Fukki »

disable your war3 theme and try again
Image
M4R7yN
Newcomer
Posts: 17
Joined: August 1st, 2012, 4:59 pm

Re: W3MPQFNs - Warcraft 3 MPQ filename detector

Post by M4R7yN »

Fukki wrote:disable your war3 theme and try again
1 warcraft3 with dota2hq mod
2 warcraft3 with standard theme

i check program on 1 and 2 warcraft3

All the same to delete?
User avatar
KangTooJee
Old Wrinkly Member
Posts: 202
Joined: September 15th, 2010, 5:09 am
Title: Legenda

Re: W3MPQFNs - Warcraft 3 MPQ filename detector

Post by KangTooJee »

M4R7yN wrote:Help me.

After loading of any maps, in listfile 2 lines:
Maps\Demo\mapname.w3x
(attributes)
Please help me.. I got same problem as him..
I never install any war3 theme