Page 1 of 1

Shaiya - Finding Shortcut Text

Posted: Wed Apr 29, 2009 11:27 pm
by zer0
What I want to be able to do is to read the Text of a particular shortcut. I understand that it would be a multi-level pointer but I'm stuck big time.

First I search for the text "Magic Ball", string address returned.
Then search for it's pointer (as it is a char array). I get what looks to be the Skill Data section (Skill Object Perhaps?).
The start of the Record seems to be char array pointer minus 4 bytes. (By checking what reads this address).
So then I search for that Pointer, and get another address.
I check accesses what reads address and it shows this instruction.

Code: Select all

8b 4c 81 fc - mov ecx, [ecx+eax*4-04]
And that is far as I can get. Elv have you been able to backtrack so you can effectively read the text from a shortcut? I'm lost man, please help.

Re: Shaiya - Finding Shortcut Text

Posted: Thu Apr 30, 2009 12:41 am
by Administrator
That's going to be a pain to work with by simple pointer lookups. You could, maybe, use findPatternInProcess() on a piece of code that accesses that, and hopefully read the pointer from there. You might also need to use injection. The easiest way to go about it would just be to find a different approach to what you're trying to do.

Re: Shaiya - Finding Shortcut Text

Posted: Thu Apr 30, 2009 5:24 am
by zer0
Administrator wrote:That's going to be a pain to work with by simple pointer lookups. You could, maybe, use findPatternInProcess() on a piece of code that accesses that, and hopefully read the pointer from there. You might also need to use injection. The easiest way to go about it would just be to find a different approach to what you're trying to do.
FindPattern Process? o_O How would that work or code Injection? I dunno which part of the code the shortcut uses to retrieve the skill text names...
Have you been able to do something similar with any of your scripts?
Simple pointers I can work with, but a 3-level (or even higher) pointer and I'm lost.

Let me explain what I'm trying to do. I want the users on my ZS Shaiya script to not have to worry about setting up shortcuts in a file, as it is read directly from the client. What about OCR via the getPixel function would that be possible mayb?? :o

edit:
What about the Tesseract library?
http://code.google.com/p/tesseract-ocr/

Re: Shaiya - Finding Shortcut Text

Posted: Thu Apr 30, 2009 1:27 pm
by Administrator
You could write a plugin to load and wrap Tesseract, and export the functions to the Lua state. It is a bit overkill to be built-in to MicroMacro. Using the functions MicroMacro already has for reading screen data would be very inaccurate and a pain to write, so I would suggest going that route.

The hotkey bar should contain pointers to skill data. I would suggest finding things from here rather than looking backwards from the skill. That is, place Skill A into hotkey slot 1. Search unknown. Swap Skill A with Skill B, and search changed. Repeat. You might have better luck this way. Try this first.

Re: Shaiya - Finding Shortcut Text

Posted: Sat May 02, 2009 3:05 pm
by 3cmSailorfuku
Administrator wrote:That's going to be a pain to work with by simple pointer lookups. You could, maybe, use findPatternInProcess() on a piece of code that accesses that, and hopefully read the pointer from there. You might also need to use injection. The easiest way to go about it would just be to find a different approach to what you're trying to do.
You are right, of course it is possible with a simple pointer if you know how to calculate it. The easiest way would be a codeinjection.
But still, like he said, you need to swap the skills or similiar to get a good analysis of how the text is allocated in the memory.

Instead of using Tesseract, you can also use a DLL from AutoIt. It has a very easy to use function that loads a bmp, makes a hashsum and scans your desired area.
I think it was called ImageSearch.dll or something, im not so sured.

If we had some expirienced reverse engineer here, he could probably easily tell you how it's done with some magic inline asm.