[7.72 (Tibianic)] Calling "talk" function from DLL (OllyDbg help needed)

[bzykubd]

Hey

I'm trying to call "Talk" function from attached DLL. I'm not a OllyDbg nor assembly expert, and probably I've missed something simple.

I've found, that when I'm sending message, this function is called:



So function address is Tibia.0041F940. And my questions are:

1. how to discover which stack variable is (if any) used by Tibia.0041F940? I see that first variable on stack is 13 which is Enter key ASCII code, second pointer is something related to current character (changes if I relogin on different one)
2. how to discover return value type?
3. is there a method to call function from OllyDbg by address (just to avoid compling c++?) Or any other tool for that?

Currently, when I'm trying to call this function, client closes with error (Instruction from 0x0041f966 reads memory from address 0xc704ecaf. Memory can't be read). Any ideas?

Thank you for help

[Lolrapa]

Hey! sorry I post a question inside your question but how do you call a tibia function form your injected dll? Do you use a pointer to a function?

[bzykubd]

Hey! sorry I post a question inside your question but how do you call a tibia function form your injected dll? Do you use a pointer to a function?

I've used this tutorial:
http://www.codeproject.com/Articles/...ling-by-Addres

And yes, I'm using pointer.

[bzykubd]

Ok folks, I've worked it out

Valid function pointer is: 0x004067C0, pattern is (int, char*).

thanks