PWI - Guide for finding chat message offsets - C# code included

[omarranimado]

dumbfck: you won the wet tshirt contest
very nice, see chat message from time you dont where ingame.

thx for the info to the ah refresh.
so i better check for changed 1 item id in list, before i read next page out.
what tools from me do u exactly mean ?
so i can send some sources, if its not virus releated

maybe i found the time to finish my personal hp with the stuff i release public.
at the moment no free time, much work and i went to another city next month.
so not sending packets ingame, fill packets in reallife with my stuff

from what i read...u sound like some one who long time code and reverse.
im allways happy to read from you

Interest07:
hmmm for me it takes some hours to make the grafical stuff, butt sometime days to code my stuff for pwi.
theres a lot new and i never worked on how to get offsets.
so this time, i can only code...for what i found offsets.

the packet sending struct in autoit makes me problems at this time.
your sample is in c# and i try to convert it to autoit.
but i know not enough about this for the moment, so i think i send mouseclick on page refresh ingame meanwhile *erm*

i not answer here the rest of ur posting.
the reason is: ich spreche besser deutsch als englisch
so i pm u.

meanwhile some look on my ah listener in flash.
very easy to insert flash as autoit gui and it looks much better.
some nice style, mouse over and i realy like the iphone styled countdown i code yesterday
take me 2-3 hours to make the gfx in photoshop and code the function in actionscript.
the red agent, is the mouse over.
the item description background moves from top to bottom on page reload and some stuff u wont see on a screenshot.

at the moment im on the filters functions...so what u see is not all finished.


as u, i code most stuff for me....but i like the cool looking and feel prolly when i use my tools

[dumbfck]

Originally Posted by omarranimado

dumbfck: you won the wet tshirt contest

I did? Woohooo!

Originally Posted by omarranimado

what tools from me do u exactly mean ?
so i can send some sources, if its not virus releated

Well, I'm not sure how useful they'd be to me, as I can normally manage to find mp3s and stuff, but they just sound like some nice little gadgets =]
Wish I knew how to fix viruses though lol - That's pretty impressive.

Originally Posted by omarranimado

from what i read...u sound like some one who long time code and reverse.

Well, I'm not a master at any of it lol. Just done a little bit of a lot of programming languages hehe. All started with embedded ASM / C programming (i.e., microcontrollers etc).
As for reversing - I've only really discovered it in the last 5-6 months. I have a LOT to learn before I can call myself a reverser / hacker, but I'm finding it really interesting at the moment and getting some great tips and ideas from this forum.

Originally Posted by omarranimado

the packet sending struct in autoit makes me problems at this time.
your sample is in c# and i try to convert it to autoit.

I figure it's time I start looking at AutoIt lol... So here's the AutoIt equivalent, in the format used in

Func refreshAhPage($pid, $playerId)
	local $packet, $packetSize
	$packet = '25001A00'
	$packet &= '00001700'
	$packet &= '00002403'
	$packet &= '0000'
	$packet &= _hex($playerId)
	$packet &= '0000'
	$packet &= '00000000'
	$packet &= '00000000'
	$packet &= '00000001'
	$packet &= '14'

    $packetSize = 33
	sendPacket($packet, $packetSize, $pid)
EndFunc

Seems that the _hex function reverses the bytes, so if your ID was 0x00123456, you'd need to call the function like this:

refreshAhPage($pid, 0x56341200)

I was too lazy to dig any deeper, or read the playerId from the client memory ^_^

Your flash AH stuff is looking awesome by the way. You're really working fast on it hehe.

@Interest07 - Holy shit, you built that list yourself? What offsets are those values found in relation to the item object / structures? I can't find anything in the elements.data file that seems to correlate with your values there. I'm wondering if there might be something near those values though.

@Smurfin - Not sure if I have many other tricks up my sleeve now hehe. If I find any, I'll probably gradually post them here.
And as for that sELedit program, I can take no credit for that. That's from

Download the pwTools SVN-Downloader.zip file from that page, unzip it and run the pwtools-binaries.bat file - It will automatically download everything from the SVN =]
There are a lot of cool looking tools in there. They spark a lot of ideas ^^

[Interest07]

I assume you know the offsets to get to items, then within items it is +0x90 for socket list (not that important, 0x94 for nr of sockets) and 0xA4 for addon list (0xA8 for nr of addons)

then in that list

                        newItemMod.modId = MemFunctions.MemReadInt(pr_processHandle, values.addOnList + i * 0x1C);
                        newItemMod.modValue = MemFunctions.MemReadInt(pr_processHandle, values.addOnList + i * 0x1C + 0xC);

I'm not quite sure why those values aren't matching the ones you can find in the seledit program (I've tried it as well). But these are working for me. So yeah it goes wrong occasionally cos it's reading the item description and it takes some trouble to figure out which id corresponds to which line of text (automatically ofc, if i were to manually look for it, it would be easy but time consuming)

I'm considering just changing the addonId in memory and keep reading the description for the changed line. But I'm thinking it would kinda depend on which item type you are using whether you get an actual valid description. If not you get Unknown (value)

[msxgames]

Originally Posted by dumbfck

Func refreshAhPage($pid, $playerId)
	local $packet, $packetSize
	$packet = '25001A00'
	$packet &= '00001700'
	$packet &= '00002403'
	$packet &= '0000'
	$packet &= _hex($playerId)
	$packet &= '0000'
	$packet &= '00000000'
	$packet &= '00000000'
	$packet &= '00000001'
	$packet &= '14'

    $packetSize = 33
	sendPacket($packet, $packetSize, $pid)
EndFunc

I don't get the last 2 lines of the packet "00-00-00-01-14". I get different numbers here, but I don't have a clue what they are. A few examples are "00-43-4A-A4-30" or "00-4D-AA-AC-70". They look like random numbers to me. Anyone has a clue what this is?

Originally Posted by dumbfck

I was too lazy to dig any deeper, or read the playerId from the client memory ^_^

The PlayerId can be found as follows: [[[[baseCall] + 0x1C] + 0x34] + 0x46C]

[dumbfck]

Some of the stuff near the end of the packet string is to do with the current item offset / filters etc, as far as I can tell. refer to my original C# post - I forgot to add the comment in my AutoIt example.

        private byte[] refreshAhPagePkt = new byte[] 
        { 
            //Header
            0x25, 0x00, 0x1A, 0x00,
            0x00, 0x00, 0x17, 0x00,
            0x00, 0x00, 0x24, 0x03,
            0x00, 0x00,
            0x00, 0x00, 0x00, 0x00,     // Player ID
            0x00, 0x00,
            0x00, 0x00, 0x00, 0x00,     
            0x00, 0x00, 0x00, 0x00,     // Start item offset
            0x00, 0x00, 0x00, 0x01,
            0x14
        };

I didn't investigate the filters much further, but I think the very last two bytes on the line commented // start item offset are the current item offset... I.e., there are 16 items per page, so an offset of 0x10 would be page 2. You'd only need this if you're planning to read through a bunch of pages. If you just want to stay on the first page, set this to 0. If you want to refresh the current page you're on, I posted an offset to extract the current AH page a few pages back in this thread.

Have you tried sending with this value as 0? When I tested it earlier, it seemed to work ok for refreshing the first page.



Interest07 - Thanks for the offsets =]
Well.... I dunno if it's just coincidence, but the first two items I checked seem to have values that correlate to sELedit!
Example:


From the item base, +0x1C we can see the value 0x4E1 = 1249 decimal
If we look at property ID 1249 in sELedit, I think the first int32 after the wstring means the number of possible values that this addon can have. This is perhaps a bad example lol, as both options are 118 - However, that 118 correlates to the value at itemBase + (1*0x1C) + 0xC
(0x76 = 118) which matches the +118 Phys. Res. on the item.

Then at itemBase + (2*0x1C) + 0xC we can see
0x45D = 1117 decimal. Take a look in sELedit and this is item property A_H004, with two possible values: 6 or 7. Look just below the 0x45D value in CE and we can see mine has a value of 7, which correlates to the Magic+7 addon of the weap =]
The 6-7 correspond to the item's possible Magic addon outcomes when manufacturing.

I tested on a piece of armour too and got the same results. They all had hits in sELedit.

I need to test some more, but if this is consistent, all we need to do is find out how to automagically convert A_DEF5 to "Phys. Res. +" etc.

Unfortunately, with sELedit, the guy who made it has only released config files for PWI and CN versions. I don't know if he has some magical way of getting the file structures, but as far as I can tell, (at some point at least) it was all done manually and he's had to figure out what all the lists correspond to. That's pretty painstaking, having taken a look at the file structure myself.
I found that list 69 is recipes for items =]... I should prolly tell him so he can update his configs hehe.

[msxgames]

Yes, it works with that packet. But I am scared that PWI will find out by checking the packets that they receive. All these packets contain the same "error". My character will be banned like that, so I prefer to send correct packets.

[dumbfck]

Just did some more testing - Seems the filter values are the bytes directly after the playerID. As for the last:
0x00, 0x00, 0x00, 0x00
0x00, 0x00, 0x00, 0x00 <-- Item offset
0x00, 0x00, 0x00, 0x01
0x14

I can't seem to do anything to get different values in there, except for the item offset. Refreshing page 0 always yeilds 0x00s for those bytes for me. Kinda makes me wonder where and how you're seeing these values?

The way I check... Set a breakpoint in Olly at the first instruction inside the sendPackets function (address 0x64FB50 in PWI v510)
Then click the refresh page, or next / previous page buttons in AH. When Olly breaks, right click the second value in the stack -> show in dump.
This will show the packet string that is being sent. The third value in the stack is the byte count for the packet.

Is this what you're doing too?

[SunB]

Hi guys,
Could you please post a guide for extract the item data form the Data files?
I am stuck when finding the real name of an item in inventory but I got the rendered text whenever your mouse is hover this item...

[Interest07]

Yes, this example corresponds to the values in my list as well. But not all of them do? Maybe when I looked the last time I just got unlucky


Would be really nice to have the complete list of this lol

[omarranimado]

Originally Posted by dumbfck

Well, I'm not sure how useful they'd be to me, as I can normally manage to find mp3s and stuff, but they just sound like some nice little gadgets =]
Wish I knew how to fix viruses though lol - That's pretty impressive.

virus studie are much impressive.
they way some god work is not so impressed as the work will be.
everytime it used the lazyness of the user.

here some example:
hide ur tool from user views....hows that going ?
just easy...set ur tool between user gui and system.
if user use stuff like windows file search, taskmanager: the gui send a comand to system: gui -> system

now our tool is between: gui-> tool -> system
got from gui the comand to search for xyz.
he check if in the search is maybe the filename of virus.
if so...he wait for system result: system -> tool XXX Gui

now virus delete from search result his own name, send the result now back to user gui: tool -> Gui
user see "patched" result: no virusname found

u can use this way for a lot, like registry, files...
think about it.

more hard work is, hide functions from antivirus soft..like injection.

Originally Posted by dumbfck

Well, I'm not a master at any of it lol. Just done a little bit of a lot of programming languages hehe. All started with embedded ASM / C programming (i.e., microcontrollers etc).
As for reversing - I've only really discovered it in the last 5-6 months. I have a LOT to learn before I can call myself a reverser / hacker, but I'm finding it really interesting at the moment and getting some great tips and ideas from this forum.

yeah reversing is fun.
its hard work and from the beginnings...wen u only change a byte to patch registration process...to today, some interesting ways and impressions.
im also no real man for that, just learn on every problem.
in my last case, i need to convert some tousend sound samples from ejay music maker.

there hardcoded in a pack file.
so first find out how they stored, next code a tool to extract them.
then found out files are in a ejay sound format: pxd
so reversing the dll again to find out what functions for that inside.
next find out how the function is called and then code a tool to convert pxd sample to mp3 sample.

was fun and sometime i got crazy

Originally Posted by dumbfck

I figure it's time I start looking at AutoIt lol... So here's the AutoIt equivalent, in the format used in

 Spoiler

Func refreshAhPage($pid, $playerId)
local $packet, $packetSize
$packet = '25001A00'
$packet &= '00001700'
$packet &= '00002403'
$packet &= '0000'
$packet &= _hex($playerId)
$packet &= '0000'
$packet &= '00000000'
$packet &= '00000000'
$packet &= '00000001'
$packet &= '14'

$packetSize = 33
sendPacket($packet, $packetSize, $pid)
EndFunc

Seems that the _hex function reverses the bytes, so if your ID was 0x00123456, you'd need to call the function like this:

refreshAhPage($pid, 0x56341200)

I was too lazy to dig any deeper, or read the playerId from the client memory ^_^

thanks for this!
i give it a try wen i went to new city.
i wonder why in interests c# sample are so much stuff like: 0x25, 0x00, 0x1A, 0x00
and how to convert this to autoit, like u did: $packet = '25001A00'
that was my problem, i start like this:
$packet = '25'
$packet = '00'
$packet = '1A'

at the moment i use client unfreeze, send mouseclick to refresh button.
but im interested to understand how the packet stuff goes, seams lot more what can be done with this and interests me

Originally Posted by dumbfck

Your flash AH stuff is looking awesome by the way. You're really working fast on it hehe.

thanks for that
but i have no time now and it goes so slooooow at the moment
only 7 days left and then i move to another city...then time without internet comes to me.

but someday....i rule the world *erm* finish my tool

btw: this board is realy nice.
1 of 3 places were much discussion about pw, maybe more..but cant read chinese

[Smurfin]

finally, got my chatlog working but with all hex and the <><><> thingy, is that ingame color command ?

 Spoiler

now trying omarranimado's getppllist but still haven't gotten it to work

[omarranimado]

Originally Posted by Smurfin

finally, got my chatlog working but with all hex and the <><><> thingy, is that ingame color command ?
[/spoiler]

u mean like ^FFE400 ?
thats #FFE400 in html style like <font color="#FFE400">Text</font>
this color, worldchat

rest is postet id, smiley...

take a look in first post spoilers:

chatTable.Columns.Add("p->msg", typeof(string));
chatTable.Columns.Add("msgID", typeof(string));
chatTable.Columns.Add("Scope", typeof(string));
chatTable.Columns.Add("Message", typeof(string));
chatTable.Columns.Add("itemID", typeof(string));
chatTable.Columns.Add("smiley", typeof(string));
chatTable.Columns.Add("uk1", typeof(string));
chatTable.Columns.Add("uk3", typeof(string));
chatTable.Columns.Add("uk4", typeof(string));
chatTable.Columns.Add("uk5", typeof(string));
chatTable.Columns.Add("uk6", typeof(string));


"Local", // 0
"World", // 1
"Squad", // 2
"Faction", // 3
"Whisper", // 4
"5", // 5
"6", // 6
"Trade", // 7
"Notification", // 8
"System", // 9
"Gen. Info", // 0xa
"Local info(b)", // 0xb
"Local info(c)", // 0xc

Originally Posted by Smurfin

now trying omarranimado's getppllist but still haven't gotten it to work

^^its not founded from me, i just used the offsets

just a tipp, ppl counter is like:

$ppl_counter = memread(memread(memread(memread(memread($REAL_BASE _ADDRESS) + 0x1C) + 0x1C) +0x20) + 0x14)

[dumbfck]

Yep and as for the part in <a><b><c>
a - unknown - always seems to be 3
b - Message type - Same as the message type value in the message struct.
c - Unknown - Always seems to be 0

omarranimado - Awesome, thanks for the dumbfck edition of the MP3 program, that's really cool ^_^
Unfortunately, I couldn't get it to work on XP. I'm guessing it was built for Win7 / Vista?
It threw the error "Cant initiate Bass.dll"
I traced it back a little bit - Bass.dll needed wer.dll and ieshims.dll - So I tried to install those. But, they required ncrypt.dll - Which in turn required bcrypt.dll.
On trying to register bcrypt.dll, I got a different error, and dependency walker said
"Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module."

At this point, I gave up lol.

Looks like a lot of that stuff is included in IE8 on Win7 and Vista, but unfortunately not on XP.

If I get my second box up and running again (Win7) I'll give it another try. But thanks again anyway =]


Interest07 - D'oh! Thought it seemed to good to be true
Guess I got lucky with those two items. Definitely gonna take a deeper look at this sometime though.


*Edit:

Originally Posted by SunB

Hi guys,
Could you please post a guide for extract the item data form the Data files?
I am stuck when finding the real name of an item in inventory but I got the rendered text whenever your mouse is hover this item...

We're still working on this - hopefully we'll have a solution soon =]

[Smurfin]

Originally Posted by omarranimado

u mean like ^FFE400 ?
thats #FFE400 in html style like <font color="#FFE400">Text</font>
this color, worldchat

rest is postet id, smiley...

take a look in first post spoilers:




^^its not founded from me, i just used the offsets

just a tipp, ppl counter is like:

I missed the string separation from dmbfck's code then, only the chat type, I hope autoit can handle multiple colors in GUICtrlCreateListView box, because it can't display multiple colors in an editbox all colors in there will use the last color setting, it'll look ugly and doesn't match the chat type color.

tks for the info, I'll double check my script later whether it has the correct format for the offsets or not, if all else fails then probably the offsets are different because pw indo is still in older version or it's just me

Originally Posted by dumbfck

Yep and as for the part in <a><b><c>
a - unknown - always seems to be 3
b - Message type - Same as the message type value in the message struct.
c - Unknown - Always seems to be 0

owh ok, so far only have seen the 'a' , should run the chatlog longer and see what type it is in the game if it ever appears here. Could be a horn or something else.

[omarranimado]

Originally Posted by dumbfck

omarranimado - Awesome, thanks for the dumbfck edition of the MP3 program, that's really cool ^_^
Unfortunately, I couldn't get it to work on XP. I'm guessing it was built for Win7 / Vista?
It threw the error "Cant initiate Bass.dll"
I traced it back a little bit - Bass.dll needed wer.dll and ieshims.dll - So I tried to install those. But, they required ncrypt.dll - Which in turn required bcrypt.dll.
On trying to register bcrypt.dll, I got a different error, and dependency walker said
"Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module."

At this point, I gave up lol.

hm weierd, its not a system dll.
just a dll to work with streaming audio.

BASS is an audio library for use in Windows and Mac OSX software. Its purpose is to provide developers with powerful and efficient sample, stream (MP3, MP2, MP1, OGG, WAV, AIFF, custom generated, and more via add-ons), MOD music (XM, IT, S3M, MOD, MTM, UMX), MO3 music (MP3/OGG compressed MODs), and recording functions. All in a tiny DLL, under 100KB* in size.

On Windows, BASS requires DirectX 3 or above for output, and takes advantage of DirectSound and DirectSound3D hardware accelerated drivers, when available. On OSX, BASS uses CoreAudio for output, and OSX 10.3 or above is recommended. Both PowerPC and Intel Macs are supported.

in source u see:

;################################################# #############################
; function: load bass.dll
;################################################# #############################
_Bass_startup(@ScriptDir & "\daten\bass.dll")
If @error Then
MsgBox(0, "Fehler", "bass.dll not found!")
Exit
EndIf
;Initalize bass. Required for most functions.
_BASS_Init (0, -1, 44100, 0, "")

;Check if bass iniated. If not, we cannot continue.
If @error Then
MsgBox(0, "Fehler", "Cant initiate Bass.dll!")
Exit
EndIf

your the first who cant run it
hmmm...im shure u have directx

u can tell me more ?

Originally Posted by Smurfin

I missed the string separation from dmbfck's code then, only the chat type, I hope autoit can handle multiple colors in GUICtrlCreateListView box, because it can't display multiple colors in an editbox all colors in there will use the last color setting, it'll look ugly and doesn't match the chat type color.

yep, autoit can make colored listview colums.
heres a sample for that:

 Spoiler

#Include <GuiConstantsEx.au3>
#include <WindowsConstants.au3>
#Include <GuiListView.au3>

;custom draw constants
;~ Global Const $CDDS_ITEM = 0x10000
;~ Global Const $CDDS_MAPPART = 0x5
;~ Global Const $CDDS_POSTERASE = 0x4
;~ Global Const $CDDS_POSTPAINT = 0x2
;~ Global Const $CDDS_PREERASE = 0x3
;~ Global Const $CDDS_PREPAINT = 0x1
;~ Global Const $CDDS_SUBITEM = 0x20000
;~ Global Const $CDDS_ITEMPOSTERASE = BitOR($CDDS_ITEM, $CDDS_POSTERASE)
;~ Global Const $CDDS_ITEMPOSTPAINT = BitOR($CDDS_ITEM, $CDDS_POSTPAINT)
;~ Global Const $CDDS_ITEMPREERASE = BitOR($CDDS_ITEM, $CDDS_PREERASE)
;~ Global Const $CDDS_ITEMPREPAINT = BitOR($CDDS_ITEM, $CDDS_PREPAINT)

;~ Global Const $CDIS_CHECKED = 0x8
;~ Global Const $CDIS_DEFAULT = 0x20
;~ Global Const $CDIS_DISABLED = 0x4
;~ Global Const $CDIS_FOCUS = 0x10
;~ Global Const $CDIS_GRAYED = 0x2
;~ Global Const $CDIS_HOT = 0x40
;~ Global Const $CDIS_INDETERMINATE = 0x100
;~ Global Const $CDIS_MARKED = 0x80
;~ Global Const $CDIS_SELECTED = 0x1
;~ Global Const $CDIS_SHOWKEYBOARDCUES = 0x200

;~ Global Const $CDRF_DODEFAULT = 0x0
;~ Global Const $CDRF_NEWFONT = 0x2
;~ Global Const $CDRF_NOTIFYITEMDRAW = 0x20
;~ Global Const $CDRF_NOTIFYPOSTERASE = 0x40
;~ Global Const $CDRF_NOTIFYPOSTPAINT = 0x10
;~ Global Const $CDRF_NOTIFYSUBITEMDRAW = 0x20
;~ Global Const $CDRF_SKIPDEFAULT = 0x4

;fonts for custom draw example
;bold
Global $aFont1 = DLLCall("gdi32.dll","int","CreateFont", "int", 14, "int", 0, "int", 0, "int", 0, "int", 700, _
                        "dword", 0, "dword", 0, "dword", 0, "dword", 0, "dword", 0, "dword", 0, "dword", 0, _
                        "dword", 0, "str", "")
;italic
Global $aFont2 = DLLCall("gdi32.dll","int","CreateFont", "int", 14, "int", 0, "int", 0, "int", 0, "int", 400, _
                        "dword", 1, "dword", 0, "dword", 0, "dword", 0, "dword", 0, "dword", 0, "dword", 0, _
                        "dword", 0, "str", "")
                        


$hGUI = GUICreate("Listview Custom Draw", 400, 300)

$cListView = GUICtrlCreateListView("", 2, 2, 394, 268, -1, BitOR($LVS_EX_GRIDLINES, $LVS_EX_FULLROWSELECT))
$hListView = GUICtrlGetHandle($cListView)
GUICtrlCreateInput("", 50, 275, 100, 15)

_GUICtrlListView_InsertColumn($hListView, 0, "Column 1", 100)
_GUICtrlListView_InsertColumn($hListView, 1, "Column 2", 100)
_GUICtrlListView_InsertColumn($hListView, 2, "Column 3", 100)

; Add items
For $i = 1 To 30
    _GUICtrlListView_AddItem($hListView, "Row" & $i & ": Col 1", $i-1)
    For $j = 1 To 2
        _GUICtrlListView_AddSubItem ($hListView, $i-1, "Row" & $i & ": Col " & $j+1, $j)
    Next
Next

$tNewProc = DllCallbackRegister("_NewWindowProc", "int", "hwnd;uint;wparam;lparam")
$pOldProc = _WinAPI_SetWindowLong($hGUI, -4, DllCallbackGetPtr($tNewProc))
GUIRegisterMsg($WM_NOTIFY, "WM_NOTIFY")
GUISetState()

Do
Until GUIGetMsg() = $GUI_EVENT_CLOSE
DLLCall("gdi32.dll","int","DeleteObject", "hwnd", $aFont1[0])
DLLCall("gdi32.dll","int","DeleteObject", "hwnd", $aFont2[0])
_WinAPI_SetWindowLong($hGUI, -4, $pOldProc)
DllCallbackFree($tNewProc)
Exit

Func _NewWindowProc($hWnd, $Msg, $wParam, $lParam)
    If $Msg = $WM_NOTIFY Then
        Local $iRet = WM_NOTIFY($hWnd, $Msg, $wParam, $lParam)
        If $iRet <> $GUI_RUNDEFMSG Then Return $iRet
    EndIf
    Return _CallWindowProc($pOldProc, $hWnd, $Msg, $wParam, $lParam)
EndFunc
Func _CallWindowProc($pOldProc, $hWnd, $Msg, $wParam, $lParam)
    Local $aRet = DllCall('user32.dll', 'uint', 'CallWindowProc', 'ptr', $pOldProc, 'hwnd', $hWnd, 'uint', $Msg, 'wparam', $wParam, 'lparam', $lParam)
;~  If @error Then Return 0
    Return $aRet[0]
EndFunc
Func WM_NOTIFY($hWnd, $Msg, $wParam, $lParam)
    Local $hWndFrom, $iIDFrom, $iCode, $tNMHDR

    $tNMHDR = DllStructCreate($tagNMHDR, $lParam)
    $hWndFrom = DllStructGetData($tNMHDR, "hWndFrom")
    $iIDFrom = DllStructGetData($tNMHDR, "IDFrom")
    $iCode = DllStructGetData($tNMHDR, "Code")
    Switch $hWndFrom
        Case $hListView
            Switch $iCode
                Case $NM_CUSTOMDRAW
                    If Not _GUICtrlListView_GetViewDetails($hWndFrom) Then Return $GUI_RUNDEFMSG
                    Local $tCustDraw = DllStructCreate('hwnd hwndFrom;int idFrom;int code;' & _
                                        'dword DrawStage;hwnd hdc;long rect[4];dword ItemSpec;int ItemState;dword Itemlparam;' & _
                                        'dword clrText;dword clrTextBk;int SubItem;' & _
                                        'dword ItemType;dword clrFace;int IconEffect;int IconPhase;int PartID;int StateID;long rectText[4];int Align', _ ;winxp or later
                                        $lParam), $iDrawStage, $iItem, $iSubitem, $hDC, $tRect, $iColor1, $iColor2, $iColor3
                    $iDrawStage = DllStructGetData($tCustDraw, 'DrawStage')
                    Switch $iDrawStage
                        Case $CDDS_PREPAINT
                            Return $CDRF_NOTIFYITEMDRAW
                        Case $CDDS_ITEMPREPAINT
                            Return $CDRF_NOTIFYSUBITEMDRAW
                        Case $CDDS_ITEMPOSTPAINT
                        Case BitOR($CDDS_ITEMPREPAINT, $CDDS_SUBITEM)
                            $iItem = DllStructGetData($tCustDraw, 'ItemSpec')
                            $iSubitem = DllStructGetData($tCustDraw, 'SubItem')
                            If _GUICtrlListView_GetItemSelected($hWndFrom, $iItem) Then
                                $hDC = DllStructGetData($tCustDraw, 'hdc');_WinAPI_GetDC($hWndFrom)
                                $tRect = DllStructCreate('long;long;long;long')
                                If $iSubitem = 0 Then
                                    DllCall('user32.dll','int','SendMessage', 'hwnd',$hWndFrom, 'uint',$LVM_GETSUBITEMRECT, 'wparam',$iItem, 'lparam',DllStructGetPtr($tRect))
                                    DllStructSetData($tRect, 1, 2)
                                    DllCall('user32.dll', 'int', 'FillRect', 'ptr', $hDC, 'ptr', DllStructGetPtr($tRect), 'int', _WinAPI_GetStockObject(4))
                                EndIf
                                DllStructSetData($tRect, 1, 2)
                                DllStructSetData($tRect, 2, $iSubitem)
                                DllCall('user32.dll','int','SendMessage', 'hwnd',$hWndFrom, 'uint',$LVM_GETSUBITEMRECT, 'wparam',$iItem, 'lparam',DllStructGetPtr($tRect))
                                Local $sText = _GUICtrlListView_GetItemText($hWndFrom, $iItem, $iSubitem)
                                DLLCall("gdi32.dll","int","SetTextColor", "ptr", $hDC, "int", RGB2BGR(0xffff00))
                                DLLCall("gdi32.dll","int","SetBkMode", "ptr", $hDC, "int", 1)
                                Local $iAlign = 6
                                If $iSubitem = 0 Then $iAlign = 2
                                DllStructSetData($tRect, 1, DllStructGetData($tRect, 1)+$iAlign)
                                _WinAPI_DrawText($hDC, $sText, $tRect, 0x8000) ;; $DT_END_ELLIPSIS
;~                              _WinAPI_ReleaseDC($hWndFrom, $hDC)                          
                                Return $CDRF_SKIPDEFAULT
                            EndIf
                            Switch $iItem
                                Case 0 To 9 ;for rows 1-10 lets do this
                                    $iColor1 = RGB2BGR(0xFBFFD8)
                                    $iColor2 = RGB2BGR(-1)
                                    $iColor3 = RGB2BGR(0xFF0000)
                                    If Mod($iSubitem, 2) Then ;odd columns
                                        DllStructSetData($tCustDraw, 'clrTextBk', $iColor1)
                                        DllStructSetData($tCustDraw, 'clrText', 0)
                                    Else ;even columns
                                        DllStructSetData($tCustDraw, 'clrTextBk', $iColor2)
                                        DllStructSetData($tCustDraw, 'clrText', $iColor3)
                                    EndIf
                                Case 10 To 19 ;for rows 11-20 lets do this
                                    $iColor1 = RGB2BGR(0xFBFFD8)
                                    $iColor2 = RGB2BGR(0x3DF8FF)
                                    $hDC = DllStructGetData($tCustDraw, 'hdc')
                                    If Mod($iItem, 2) Then
                                        If Mod($iSubitem, 2) Then
                                            DllStructSetData($tCustDraw, 'clrTextBk', $iColor1)
                                        Else
                                            DllStructSetData($tCustDraw, 'clrTextBk', $iColor2)
                                        EndIf
                                        DLLCall("gdi32.dll","hwnd","SelectObject", "hwnd", $hDC, "hwnd", $aFont1[0]) ;select our chosen font into DC
                                    Else
                                        If Mod($iSubitem, 2) Then
                                            DllStructSetData($tCustDraw, 'clrTextBk', $iColor2)
                                        Else
                                            DllStructSetData($tCustDraw, 'clrTextBk', $iColor1)
                                        EndIf
                                        DLLCall("gdi32.dll","hwnd","SelectObject", "hwnd", $hDC, "hwnd", $aFont2[0])
                                    EndIf
                                Case 20 To 29 ;for rows 21-30 lets do this
                                    $iColor1 = RGB2BGR(0xFBFFD8)
                                    $iColor2 = RGB2BGR(-1)
                                    If Mod($iItem, 2) Then ;odd rows
                                        DllStructSetData($tCustDraw, 'clrTextBk', $iColor2)
                                    Else
                                        DllStructSetData($tCustDraw, 'clrTextBk', $iColor1)
                                    EndIf                           
                            EndSwitch
                            Return $CDRF_NEWFONT
                        Case BitOR($CDDS_ITEMPOSTPAINT, $CDDS_SUBITEM)                      
                        Case Else
                    EndSwitch
            EndSwitch
    EndSwitch
    Return $GUI_RUNDEFMSG
EndFunc   ;==>WM_NOTIFY

Func RGB2BGR($iColor)
    Return BitAND(BitShift(String(Binary($iColor)), 8), 0xFFFFFF)
EndFunc