TSXClient - DLL Development

// This script will fix the background at character select screen in Twelve Sky 2
// Programed by MegaByte

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

label(CharacterSelect)
label(CharacterSelectCharacterExists)
label(CharacterCreate)

label(Guanyin)
label(Fujin)
label(Jinong)

label(Done)
label(SetBackground)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here
push eax
push ecx

//ecx contains sub screen
cmp ecx,2 // Char select
je CharacterCreate

CharacterSelect:
// See if character selected
mov ecx,[0118AEDC]
// Check if character exists in that slot
mov eax,1844
imul eax,ecx
add eax,0115EA00
mov ecx,[eax]

cmp ecx,0
jnz CharacterSelectCharacterExists

// If it does get faction value
// Otherwise set background here
MOV EAX,94D
JMP Done

CharacterSelectCharacterExists:
// Get character faction in ECX
add eax,2C // Offset to faction to add to eax
mov ecx,[eax] // Read faction into ecx
jmp SetBackground

CharacterCreate:
// Get Faction value in ecx
mov ecx,[011632F4]
jmp SetBackground

SetBackground:
CMP ecx,2
JE Jinong
CMP ecx 1
JE Fujin
Guanyin:
MOV EAX,94F
JMP Done
Fujin:
MOV EAX,950
JMP Done
Jinong:
MOV EAX,951
JMP Done

Done:
// Set background image
MOV [0118AED4],EAX

pop ecx
pop eax

// Origional Code
originalcode:
mov [ebp-4C],ecx
cmp dword ptr [ebp-4C],01

exit:
jmp returnhere

"TwelveSky2.exe"+62FB7:
jmp newmem
nop
nop
returnhere:

"TwelveSky2.exe"+62D69:
mov [edx+0000826C],00000001

"TwelveSky2.exe"+62D78:
mov [eax+0000826C],00000001

"TwelveSky2.exe"+62D87:
mov [ecx+0000826C],00000001

[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"TwelveSky2.exe"+62FB7:
mov [ebp-4C],ecx
cmp dword ptr [ebp-4C],01
//Alt: db 89 4D B4 83 7D B4 01

"TwelveSky2.exe"+62D69:
mov [edx+0000826C],0000094F

"TwelveSky2.exe"+62D78:
mov [eax+0000826C],00000950

"TwelveSky2.exe"+62D87:
mov [ecx+0000826C],00000951

Find what writes to Faction Value
When its written too set the background to the faction background
It turns out its set right above the nop we just did for gender so we can detour it and put our own code in Hurray

Selected character background
Find the address of selected character 0 1 2

Found it at 0118AEDC
Near it is other interesting stuff like character animation pose rotation etc
0118AEDC Selected Character
0118AEE4 Pose 0 Standing 1 Unsheath ready to attack 2 3 sword down defensive stance 4

1 3 5 7 are attacking like things
0 2 4 6 are standing still things

0118AEE8 Action Can be set to trigger Game Start
0118AEEC Frame
0118AF00 Direction
0118AEE0 Character Create selected weapon
0118AED8 Sub screen eg char select char create

0118AED4 Character Select Background

2377 = Gyunin Loader
2378 = Madin Loader
2379 = Fujin Loader
2380 = Login Screen
2381 = Server Page 2?
2382 = Server Page 3? or just alterntive login screens.. hmm
2383 = Gyunyuin
2384 = Fujin
2385 = Jinong

Find what writes to it

Changing Selected Char
0046721E - 89 91 74820000             - mov [ecx+00008274],edx
00467224 - 83 3D D8E91501 00          - cmp dword ptr [0115E9D8],00
0046722B - 7E 05                      - jle 00467232
0046722D - E9 37060000                - jmp 00467869
00467232 - 8B 45 E8                   - mov eax,[ebp-18]
00467235 - 8B 88 74820000             - mov ecx,[eax+00008274]

Character Created
00469C1D - 89 91 74820000             - mov [ecx+00008274],edx
00469C23 - 8B 45 B4                   - mov eax,[ebp-4C]
00469C26 - C7 80 7C820000 00000000    - mov [eax+0000827C],00000000
00469C30 - 8B 4D B4                   - mov ecx,[ebp-4C]
00469C33 - C7 81 80820000 01000000    - mov [ecx+00008280],00000001
00469C3D - 8B 55 B4                   - mov edx,[ebp-4C]

Loaded Characters
00462DF8 - 89 91 74820000             - mov [ecx+00008274],edx
00462DFE - EB 32                      - jmp 00462E32
00462E00 - 8B 45 E0                   - mov eax,[ebp-20]
00462E03 - 69 C0 44180000             - imul eax,eax
00462E09 - 8B 4D C4                   - mov ecx,[ebp-3C]
00462E0C - 8B 91 74820000             - mov edx,[ecx+00008274]


We can now detour each and manage the background accordingly

	void sendMessage(int c, char *s) //This function is a __thiscall, so this will NOT work
	{
		((void (__cdecl*)(int,char*))ts_send) (c,s);
	}

void sendMessage(int c, char *s)
{
         ((void (__thiscall*)(LPVOID,int,char*))ts_send)(ts_sendecx,c,s); //ts_sendecx is the object pointer
}