ui+docs: the GUID token's real spelling, 40-yard interact, and the whole patch map

Working down the 29 `.tdata` hooks from the realm's patched `WoW.exe`.
Most turned out to be already ported; two were wrong here, and one of
those was wrong in a way that mattered.

**The GUID token was the wrong string.** `unit::guid_token` wrote 16
lowercase hex digits and no prefix. The realm writes `0x` + 16 upper-case
digits: its formatter at `0xd06500` — which `UnitExists`'s second return
goes through — lays down `0x30 0x78` then sixteen nibbles each `+0x37`
above 9, and its parser at `0xd06650` demands the `0x` and takes upper
case only. grom's own addons agree from the other end: BigWigs decides a
string is a GUID with `string.sub(guidOrName, 1, 2) == "0x"`
(`MageTools.lua:963`), and AI_VoiceOver reads fields from position 3 and
mints its own with `format("0x%04X%06X%06X", …)`.

Same number, wrong string, and wrong where it mattered most:
`UNIT_CASTEVENT` and the aura events carry these tokens, so every such
test read our GUIDs as unit *names* and every `sub(3, …)` field read came
out two characters off. Now written the realm's way; both spellings and
either case are accepted on the way in, since refusing one buys nothing.
Pinned literally rather than by round trip — a round trip held fine
through the whole bug.

**`CheckInteractDistance` type 4 is 40 yards, not 30.** `0x48bafd` jumps
to `0xd0686c`, which tests the type against 4 and compares against the
float the section carries at `0xd06868`: `1600.0`, squared thresholds.
Stock 1.12's `900.0` is still what the other three types use.

`docs/ADDON_COMPAT.md` now carries all 39 hook sites of both sections
with a status each: 10 in `.octoql` (one feature, the quest log, ported),
and 29 in `.tdata` — the aura ids, the master looter, `UnitExists`'s
GUID, the char-create mask and `CHAT_MSG_HARDCORE` already done; the two
challenge-mode functions needing nothing, because the realm's own
`ChallengeList.lua` defines them in Lua for exactly our case; four read
but unported with the reason (unnamed struct fields, no consumer in the
corpus); and three that cannot apply to a client that loads no DLLs.

Also `scripts/dll-surface.py`, which asks the injected DLLs the same
question. Their export tables are one `DllMain` each, but a DLL that
registers a Lua function must point at the name: collecting NUL-delimited
identifier strings the image holds a pointer to cuts `ClassicAPI.dll`
from 2872 CamelCase candidates to 706, and subtracting the 1.12 census,
Lua's own names and benilla's real surface leaves a candidate list the
addon corpus can rank. It is a list to read, not a specification —
statically linked libraries contribute their own strings, and
`UnitXP_SP3.dll` yields nothing. It found 38 names in `nampower.dll` that
grom's addons call and this file did not know about; they are written
down rather than guessed at.

269 data-gated failures, identical to the baseline, all nine gates green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SgstFWtn1RxEJ5kVrpgYwn
This commit is contained in:
2026-10-23 19:57:26 -06:00
co-authored by Claude Opus 5
parent cae59cdc11
commit ada08720bb
12 changed files with 339 additions and 34 deletions
@@ -405,9 +405,10 @@ mod tests {
let s = seeded();
// HIGH_UNIT (0xF130) in the top 16 bits, entry 1234 at bits 24-47.
let creature: u64 = (0xF130u64 << 48) | (1234u64 << 24) | 7;
let token = crate::script::guid_token(creature);
assert_eq!(
s.eval::<i64>(&format!(
r#"return C_CreatureInfo.GetCreatureID("{creature:016x}")"#
r#"return C_CreatureInfo.GetCreatureID("{token}")"#
))
.unwrap(),
1234
@@ -214,7 +214,7 @@ mod tests {
.unwrap();
assert_eq!(guids.len(), 2);
assert!(
guids.iter().all(|g| g.len() == 16),
guids.iter().all(|g| g.len() == 18 && g.starts_with("0x")),
"16-hex-digit tokens, the same shape UnitGUID hands out: {guids:?}"
);
@@ -875,7 +875,7 @@ mod tests {
assert_eq!(
s.eval::<(String, String)>("return tip:GetUnitGUID()")
.unwrap(),
("Hogger".to_string(), "00000000deadbeef".to_string()),
("Hogger".to_string(), "0x00000000DEADBEEF".to_string()),
"the name and the 16-hex-digit guid token, in GetUnit()'s two-value shape"
);
// The second value is what pfUI feeds `UnitTokenFromGUID`, so it has to round-trip.
@@ -890,7 +890,7 @@ mod tests {
assert_eq!(
s.eval::<String>("local _, g = tip:GetUnitGUID() return g")
.unwrap(),
"00000000deadbeef",
"0x00000000DEADBEEF",
"still Hogger's guid: the tooltip is still showing Hogger"
);
assert_eq!(
@@ -99,7 +99,9 @@ mod tests {
);
let guid = s.eval::<String>(r#"return UnitGUID("target")"#).unwrap();
assert_eq!(guid.len(), 16);
// "0x" + 16 digits: the realm writes `0x` + 16 uppercase digits (`unit::guid_token`).
assert_eq!(guid.len(), 18);
assert!(guid.starts_with("0x"));
assert_eq!(
s.eval::<String>(&format!(r#"return UnitTokenFromGUID("{guid}")"#))
.unwrap(),
+10 -3
View File
@@ -17,9 +17,16 @@ use mlua::{Lua, Value};
use super::char_stats::InventorySlots;
use super::Model;
/// `CheckInteractDistance`'s squared thresholds for types 1..=4, `{10², 11.1111², 10², 30²}`
/// (`0x48ba00`, from the `.rdata` at `0x804498`, `0x804490`, `0x80448c`, `0x8044a4`).
pub const INTERACT_DIST_SQ: [f64; 4] = [100.0, 123.45678, 100.0, 900.0];
/// `CheckInteractDistance`'s squared thresholds for types 1..=4. Stock 1.12 is
/// `{10², 11.1111², 10², 30²}` (`0x48ba00`, from the `.rdata` at `0x804498`, `0x804490`,
/// `0x80448c`, `0x8044a4`).
///
/// Deviation from stock, and faithful to what grom runs: type 4 is **40 yards**, not 30. His
/// client's `WoW.exe` patches it, in the `.tdata` section — `CheckInteractDistance+0xfd`
/// (`0x48bafd`) jumps to `0xd0686c`, which is `cmp $0x4,%esi` on the distance type and, on a
/// match, `fcomps 0xd06868`, a float the section carries as **1600.0**. Squared thresholds, so
/// 40 yards. The other three types fall through to the stock compare untouched.
pub const INTERACT_DIST_SQ: [f64; 4] = [100.0, 123.45678, 100.0, 1600.0];
/// `CanInspect`'s threshold squared (`0xb4d918`, the `.rdata` 10.0 at `0x804498` squared by
/// `0x48a1b0`); vmangos checks the same 10 yards (`INSPECT_DISTANCE`, `ObjectDefines.h:26`).
@@ -234,7 +234,7 @@ fn get_name_true_answers_the_plates_guid() {
assert_eq!(
s.eval::<String>("return WorldFrame:GetChildren():GetName(1)")
.unwrap(),
format!("{key:016x}"),
crate::script::guid_token(key),
"GetName(1) is the SuperWoW GUID token"
);
assert!(s
@@ -143,10 +143,11 @@ fn a_unit_keeps_its_nameplate_token_for_the_whole_life_of_its_plate() {
let token_of = |s: &mut UiScript, guid: u64, name: &str| -> Option<String> {
// Which token names this unit, asked the way an addon would: by its name, over the 1..40
// the token space can reach.
let token = crate::script::guid_token(guid);
s.eval::<Option<String>>(&format!(
r#"for i = 1, 40 do
local t = "nameplate" .. i
if UnitExists(t) and UnitGUID(t) == "{guid:016x}" then
if UnitExists(t) and UnitGUID(t) == "{token}" then
if UnitName(t) ~= "{name}" then return "WRONG-NAME:" .. t end
return t
end
@@ -233,7 +234,7 @@ fn the_three_plate_events_fire_once_each_on_their_own_edge() {
// Created first: pfUI's added-handler is a no-op until `plate.nameplate` exists, and
// that field is what its created-handler installs (`nameplates.lua:589`).
"CREATED Button".to_string(),
"NAME_PLATE_UNIT_ADDED nameplate1 plate=yes name=Wolf guid=1111000000000001"
"NAME_PLATE_UNIT_ADDED nameplate1 plate=yes name=Wolf guid=0x1111000000000001"
.to_string(),
],
"arg1 is the plate frame on created and the token on added, and the token already \
@@ -254,7 +255,7 @@ fn the_three_plate_events_fire_once_each_on_their_own_edge() {
log(&mut s),
vec![
"CREATED Button".to_string(),
"NAME_PLATE_UNIT_ADDED nameplate2 plate=yes name=Bear guid=1111000000000002"
"NAME_PLATE_UNIT_ADDED nameplate2 plate=yes name=Bear guid=0x1111000000000002"
.to_string(),
]
);
@@ -266,9 +267,9 @@ fn the_three_plate_events_fire_once_each_on_their_own_edge() {
assert_eq!(
log(&mut s),
vec![
"NAME_PLATE_UNIT_REMOVED nameplate2 plate=yes name=Bear guid=1111000000000002"
"NAME_PLATE_UNIT_REMOVED nameplate2 plate=yes name=Bear guid=0x1111000000000002"
.to_string(),
"NAME_PLATE_UNIT_ADDED nameplate2 plate=yes name=Boar guid=1111000000000003"
"NAME_PLATE_UNIT_ADDED nameplate2 plate=yes name=Boar guid=0x1111000000000003"
.to_string(),
],
"the departure is dispatched before the arrival that reuses its slot, and no plate frame \
@@ -290,7 +291,7 @@ fn the_removal_event_still_finds_both_the_departing_unit_and_its_plate() {
assert_eq!(
log(&mut s),
vec![
"NAME_PLATE_UNIT_REMOVED nameplate1 plate=yes name=Wolf guid=1111000000000001"
"NAME_PLATE_UNIT_REMOVED nameplate1 plate=yes name=Wolf guid=0x1111000000000001"
.to_string()
]
);
@@ -365,7 +366,7 @@ fn a_plate_tokens_target_names_the_unit_that_plate_unit_is_targeting() {
)
.unwrap());
assert!(
s.eval::<bool>(r#"return UnitGUID("nameplate1target") == "1111000000000004""#)
s.eval::<bool>(r#"return UnitGUID("nameplate1target") == "0x1111000000000004""#)
.unwrap(),
"it names the targeted unit, not the plate unit"
);
@@ -384,7 +385,7 @@ fn a_plate_tokens_target_names_the_unit_that_plate_unit_is_targeting() {
/// Prefer absent over wrong, the rule the whole token space is built under: a plate whose unit the
/// app could not snapshot names *nothing*. `UnitExists` answering true for a token with no GUID, no
/// name and no health is a wrong answer no caller can detect, and a zero GUID would additionally
/// make `Model::unit`'s raw-GUID fallback resolve `"0000000000000000"` to it.
/// make `Model::unit`'s raw-GUID fallback resolve `"0x0000000000000000"` to it.
#[test]
fn a_plate_with_no_unit_snapshot_names_nothing_rather_than_a_blank_unit() {
let mut s = vm();
@@ -396,7 +397,7 @@ fn a_plate_with_no_unit_snapshot_names_nothing_rather_than_a_blank_unit() {
"the plate is up, but its token names no unit"
);
assert!(
s.eval::<bool>(r#"return UnitGUID("0000000000000000") == nil"#)
s.eval::<bool>(r#"return UnitGUID("0x0000000000000000") == nil"#)
.unwrap(),
"and the zero GUID resolves to nothing, so the raw-GUID grammar cannot reach it"
);
@@ -417,14 +418,14 @@ fn a_rebuilt_vm_re_announces_every_plate_from_slot_one() {
drive(&mut s, &[feed(WOLF, "Wolf"), feed(BEAR, "Bear")]);
drive(&mut s, &[feed(BEAR, "Bear")]);
assert!(s
.eval::<bool>(r#"return UnitGUID("nameplate2") == "1111000000000002""#)
.eval::<bool>(r#"return UnitGUID("nameplate2") == "0x1111000000000002""#)
.unwrap());
let mut fresh = vm();
drive(&mut fresh, &[feed(BEAR, "Bear")]);
assert!(
fresh
.eval::<bool>(r#"return UnitGUID("nameplate1") == "1111000000000002""#)
.eval::<bool>(r#"return UnitGUID("nameplate1") == "0x1111000000000002""#)
.unwrap(),
"the surviving unit is slot 1 in the new VM: slot identity does not outlive the VM that \
announced it"
@@ -433,7 +434,7 @@ fn a_rebuilt_vm_re_announces_every_plate_from_slot_one() {
log(&mut fresh),
vec![
"CREATED Button".to_string(),
"NAME_PLATE_UNIT_ADDED nameplate1 plate=yes name=Bear guid=1111000000000002"
"NAME_PLATE_UNIT_ADDED nameplate1 plate=yes name=Bear guid=0x1111000000000002"
.to_string(),
]
);
@@ -609,7 +610,7 @@ fn pfuis_own_oncreate_body_runs_on_the_frame_the_created_event_hands_it() {
-- property worth pinning is that the engine art is gone, not which falsy it is.
local border = np.original.border:GetTexture()
return np.unit == "nameplate1"
and np.cachedGuid == "1111000000000001"
and np.cachedGuid == "0x1111000000000001"
and (border == nil or border == "")
and np.raidicon:GetParent() == np.raidiconframe"#
)
@@ -644,7 +645,7 @@ fn pfuis_own_oncreate_body_runs_on_the_frame_the_created_event_hands_it() {
s.eval::<Option<String>>("return cleared")
.unwrap()
.as_deref(),
Some("1111000000000001"),
Some("0x1111000000000001"),
"pfUI's removal handler reached the departing plate's own cached GUID and dropped it — \
with a nil plate there, that cache would leak for the session"
);
+24 -5
View File
@@ -308,14 +308,33 @@ pub struct UnitCastState {
/// existing `String`-typed unit-token parameter here, which a raw 8-byte binary string would not
/// reliably do.
pub fn guid_token(guid: u64) -> String {
format!("{guid:016x}")
format!("0x{guid:016X}")
}
/// The inverse of [`guid_token`]: `None` for anything that isn't exactly 16 hex digits, so a real
/// token name (`"player"`, `"party1"`, …) never misparses as a GUID.
/// The inverse of [`guid_token`]: `None` for anything that isn't 16 hex digits, with the `0x`
/// optional, so a real token name (`"player"`, `"party1"`, …) never misparses as a GUID.
///
/// The prefix is optional on the way **in** and always written on the way **out**, because the
/// realm's own client writes it and addons test for it. Its formatter — `0xd06500` in the `.tdata`
/// section of the patched `WoW.exe`, which `UnitExists`'s second return goes through — lays down
/// `0x30 0x78` ("0x"), then sixteen nibbles each `+0x37` above `9`, so uppercase. Its parser
/// (`0xd06650`, reached from the unit-token resolver at `0x515c14`) demands the `0x` and accepts
/// `0`-`9` and `A`-`F` only. grom's own addons agree from the other side: BigWigs decides a string
/// is a GUID with `string.sub(guidOrName, 1, 2) == "0x"` (`MageTools.lua:963`), and AI_VoiceOver
/// both reads fields from position 3 and mints its own with `format("0x%04X%06X%06X", …)`.
///
/// This client used to write sixteen lowercase digits and no prefix, which is the same number and
/// the wrong string: every such test read our GUIDs as unit *names*, and every `sub(3, …)` field
/// read came out shifted by two. `UNIT_CASTEVENT` and the aura events carry these
/// (`benilla-app`'s `ui_cast_events`, `ui_aura`), so it was wrong wherever it mattered most.
/// Lower case is still accepted in, since nothing is gained by refusing it.
pub(crate) fn token_guid(token: &str) -> Option<u64> {
(token.len() == 16 && token.bytes().all(|b| b.is_ascii_hexdigit()))
.then(|| u64::from_str_radix(token, 16).ok())
let body = token
.strip_prefix("0x")
.or_else(|| token.strip_prefix("0X"))
.unwrap_or(token);
(body.len() == 16 && body.bytes().all(|b| b.is_ascii_hexdigit()))
.then(|| u64::from_str_radix(body, 16).ok())
.flatten()
}
+39 -3
View File
@@ -1923,9 +1923,10 @@ fn superwow_guid_owner_and_mark_tokens_resolve() {
.eval::<String>(r#"local _, guid = UnitExists("target") return guid"#)
.unwrap();
assert_eq!(
guid.len(),
16,
"a 16-hex-digit opaque id, guid_token's shape"
guid,
super::guid_token(42),
"`0x` + 16 uppercase digits, guid_token's shape — the form the realm's own client writes \
and addons test for with `sub(guid, 1, 2) == \"0x\"`"
);
assert_eq!(
s.eval::<String>(&format!(r#"return UnitName("{guid}")"#))
@@ -2206,3 +2207,38 @@ fn pfuis_aggro_scan_walks_past_the_nameplate_tokens_to_reach_the_raid_ones() {
"only the seated `player` exists; the point is that the walk reached `raid1` at all"
);
}
/// The GUID token's exact spelling, against the three independent sources that fix it — the
/// realm's own formatter, and two of grom's addons reading the other end.
///
/// Literal rather than round-tripped through [`super::guid_token`], which would assert nothing: a
/// round trip held while this client wrote sixteen lowercase digits and no prefix, and every addon
/// that tests `sub(guid, 1, 2) == "0x"` read those as unit *names*.
#[test]
fn a_guid_token_is_0x_and_sixteen_upper_case_digits() {
assert_eq!(
super::guid_token(0xF130_0000_04D2_0007),
"0xF130000004D20007"
);
assert_eq!(super::guid_token(42), "0x000000000000002A");
assert_eq!(super::guid_token(0).len(), 18);
// Accepted back with the prefix, without it, and in either case: nothing is gained by
// refusing a spelling, and the realm's own parser (`0xd06650`) takes upper case only.
for token in [
"0xF130000004D20007",
"0XF130000004D20007",
"F130000004D20007",
"f130000004d20007",
] {
assert_eq!(
super::token_guid(token),
Some(0xF130_0000_04D2_0007),
"{token}"
);
}
// And a real token name is still never a GUID.
for name in ["player", "target", "party1", "nameplate1", "", "0x", "0xZZ"] {
assert_eq!(super::token_guid(name), None, "{name}");
}
}