Hi all,

Hope someone can help,

I currently use the user32.dll PrintWindow() function to take screenshots of obscured windows. My question is:

Is it possible to extract only part of the obscured window / the equivalent of PrintWindow(handle, bitmap, x, y, width, height).

Thanks,

div.

I think you'll want to look into the gdi32 BitBlt function.

BTW: You do know that with Vista (at least Home Premium, which I have) you can scrape pixels from overlapped windows... That was a enough reason for me to upgrade from XP to Vista. No need to worry about table overlapping anymore.

What function(s) now work on Vista overlapped windows? Are you talking about GetPixel()?

hey guys - well vista has some new fancy gd rendering functions. From my reading vista automatically holds copies of all rendered windows in memory, which allows it to perform the new taskbar window preview for example. So operations like GetPixel will look to the window in memory - ignoring the window on the desktop.

Anyway - this is my ripping of some great work done by http://siwu.info

Its the first time I have ever decompiled a win32 DLL so bear with my limited/inaccurate/incorrect! knowledge!!

user32.dll PrintWindow() -> points to this function "xxxPrintWindow" in win32k.sys @ BF8A40E2

1 * Sets the window to layered using SetRedirectedWindow()
2 * Redraws completely the window using UpdateWindow() in the newly created empty off screen bitmap
3 * Gets the DC of the new of the window with GetDCEx()
4 * Copies the bitmap to the provided DC using NtGdiBitBlt()
5 * Releases the new DC
6 * Unsets the layered attribute

taken from : http://siwu.info/7/reverse-engineering- ... thing.html

SOOOO!!
Basically if we could get at that DC at 3* could we read the pixel data? without the BitBlt copying?
It would save time, but I have NOOO idea how to hack dlls or whatever you do to fix it :/

anyone with knowledge for me to absorb?!

Yes, I'm talking about GetPixel(). In Vista (as I mentioned: at least in Home Premium) GetPixel does get the pixel from the real window and not the topmost one. It doesn't matter how many of them are stacked. I've run my scraping app so that there were 10 stacked iPoker tables and they all were scraped 100% perfectly.

This is how I do it:


(this._handle has the window handle for the poker table window.)

what speeds are you getting with this operation TMC?

the XP PrintWindow() can produce in the region of 5-10 Bitmaps/sec.

How many pixels/sec can you get using this?

Thanks for the info. I use Vista so I can abandon the whole process of bringing the window to the foreground just check a pixel.

I just tested and for uncovered window I managed to get 81pixels/ms so ~81000 pixels/sec. And for covered window, it was ~70pix/ms so 70000 pixels/sec.

With PrintWindow you are probably copying quite a lot of redundant data, right? I mean, you are not actually utilizing that many pixels from the bitmaps.

My tracking process does not continously need to scrape the bitmap during the hand, so I wouldn't need to get the window bitmap that often at all. I only need to scrape mostly at the beginning of the hand and even then I only need very small portion of the pixels of the poker table window.

Well, ok, just realized that my tracker actually does scrape the pixels on the action buttons to detect when a table is waiting for an action, if the application needs that feature. But even then it is scraping just a few pixels here and there, no need to get the whole client window bitmap.

That's a great tip for Vista TooMuchCoffee.

Too bad you can't do it in XP.

Well, give some, get some... I think that's one of the reasons why Vista is so heavy to run compared to XP. If you would do it in XP, it would have a very hardware-demanding GUI as well. Having N windows totally stacked and being able to access the client window bitmaps on each of them is bound to demand some HW from the computer...

But IMO: If you are serious about botting and don't want to have monitors to enable non-overlapped tables, then Vista is the way to go. But that's just IMO.

I have Quad Core CPU (though just the Q6600), 4G RAM and NVidia Geforce 8800 GT and Vista gives 5,7 as the rating so I can't say this setup is sluggish at all. Actually I'm quite posivitely pleased in Vista, after the initial shock of having to find things in different places compared to XP. But I wouldn't try to run Vista in a lot lower-level HW.

Are you worried at all about the casino taking a screenshot and seeing a number of tables stacked on top of each other?

FullTilt will let you BitBlt stacked tables in XP.

Not really. I haven't done any botting for ages... Just played with my "Grind Master"-software which helped me to 12-table without having to spread the tables all over.

But once the botting starts, I'd prolly go with miniview tables, stacked semi-overlapping.

I would've thought that more direct means of getting data from the client would be preferable. But I guess it is easier to screenscrape a few things, so I have to agree.

But about having multiple monitors... There must be a way to make Windows think (or act) like you have multiple monitors when you don't. This might be overly complicated though, especially compared to using the GetPixel() function on overlapped windows in Vista. But it gets around the proposed difficulty with screenshots being taken by the client, and can be used in XP.

Also, I know Windows allows you to place windows outside of the screen, but I'm not sure if you're still able to screenscrape them when they are out there. But it would be a way to get the type of functionality you have in Vista in XP. Of course screenshots would have to be handled somehow in this case.
My HW is not really great, and I'm certain Vista would be slow if I got it. However, as a friend said, Vista is the future, and with a bot in (extremely early) development, it may be best to write it with Vista in mind. One of those writing a bot with me is running Vista because some HP drivers don't work in XP, among other things, and these compatibility issues will only get worse in time. Another reason to get Vista.. And he doesn't want to run a VM with XP on a Vista host, because it would likely make things even slower than they already are, rendering the PC practically useless when the bot is running.

Do you know if Vista has considerable change in the WinAPI implementation (or anything else worth considering for botting)? Or would hooking it be more or less the same as in XP?
I'm relatively new to all this, but I've seen people talking about the problem with clients possibly taking a screenshot once in a while, and every time, I'd think:
Isn't it possible to just hook onto whatever function is used to get the screenshot, and cause it to return a fake one, or cause it to call a function to spread out and bring to the foreground the windows that were last used or whatever you needed done to make you look innocent, much in the same way one would hook the NtQuerySystemInformation and NtQueryDirectoryFile functions to hide processes and files?

I might be way off on this, but I don't see why you wouldn't be able to do something like that.

I agree, that hooking & memory scanning & protocol parsing might be more robust ways to go, but might also take huge effort to make them properly. Well, hooking isn't that bad, but there are still things that I need to scrape at most sites, like where is the dealer button and who got dealt cards. At some sites I need to get the blind posters, if they are not told on the chat.

From my early IT-years (read -84...-86) when I got my first comp, a C64, I remember seeing some memory monitor-app for making trainers for games. There you would search easily for memory areas that had some changing data, like if you had "life" on a game and it was running from 1000 towards 0, you could semi-easily spot the memory address that stored the "life" and utilize that in a trainer. I have been toying with the idea of making such a tool for Windows, if there isn't one already. Obviously there are debuggers, but a tool that would concentrate just on finding memory locations that have some changing data and you would get rid of all static memory which isn't involved in tracking the game information. With that sort of tool it might be easy to reverse-engineer the internal memory handling of a poker client and make robust information retrieval.


Well, at least my Windows is pretty uninterested in enabling a 2nd monitor if one isn't hooked to the videocard... Might need some driver tweaking, I guess as it's prolly the driver that informs windows about the monitors.


I haven't bumbed into any problems yet, my hooking code works just as well in XP as in Vista. In fact, a friend of mine is in charge of the hooking code and he is making it in XP and I'm running it in Vista. So works just fine.

Cheat Engine (http://www.cheatengine.org/) does pretty much exactly what you describe. I use it for all sorts of things