Desert Bunker

I recently came across a relatively new MMORPG called Shaiya from Aeria Games. The first thing that came to my mind was, “I’ve got to build a bot for this game.” Instead of taking the long and grueling route of reverse engineering incoming/outgoing packets and having to deal with updated versions of the game (blah blah BLAH,) I’m taking the easier way out and building a bot using the AutoIt3 scripting language. With AutoIt, one could simulate keystrokes, mouse clicks, mouse movements, and various other naturally occurring Windows events. While tinkering with the game for a few days, I found a way to get a hold of the game’s textures. These can be used for any number of reasons but I’m going to use these for color tracking.

The major goal of this bot is to have the ability to target enemies to attack. To do this, the bot will need to know the location of your enemies. We can assume that finding the location of objects in memory would be a difficult trial and error process, so this is out of the question for now. For tracking the enemy’s location, I want to try coloring the enemy’s textures either directly or indirectly and use a script that will look for a certain unique color that is unlikely to be anywhere else on the screen but the target’s surface texture. To color these textures we’re going to have to either intercept and modify a DirectX call or we can take the quicker route; Find the Shaiya textures and modify them directly, using MSpaint or Photoshop to flatten the texture with a single and unique color, e.g., hot pink, lime green.

I had hard time figuring out how to extract the data from Shaiya’s information repository, data.saf. After looking at data.sah, it seems that this is the file that contains the titles and directory structure for the files within data.saf. Data.saf itself isn’t encrypted, but certain items within might be. There’s not a lot of information about these files and their structure when doing quick search on Google. So I set out to find another way to get these textures; Ripping them from Shaiya during runtime.

One of the few programs I found that does this quite beautifully for me is 3D Ripper DX. 3D Ripper, as the name implies, rips 3D textures from any game that uses DirectX. In order to use this though, we’re going to need a GameGuard bypass otherwise 3D Ripper will cause a ‘Hack Detected’ message to appear.

Thanks to jewbacca from the Cheat Engine forums has made a bypass available for all to use, at least until the game gets patched. You can get it here: Shaiya GameGuard Bypass. Make sure you have all current Shaiya patches, then backup the game.exe in your \AeriaGames\Shaiya directory. Place the GG bypassed game.exe from the RAR into the directory. Launch 3D Ripper, make sure the ‘Capture All Textures’ box is checked, and create a new folder on your Desktop to output all of the DDS files.

The Job

Run Shaiya from 3D Ripper by selecting the new game.exe that we just replaced and clicking Launch. 3DRip will inject into Shaiya, and you’ll now be able to capture all textures being used in a single rendered frame by pressing F12. They’ll all be dumped in that folder you made.

Voila! You should now have a bunch of textures; At least a few of these being from the enemies you intend to target later on.

Here’s a gallery of some of the textures I picked up: [slideshow=2]

Now we just need to figure out how to.. Get them back in the game.. Heh.. It seems that either the game, or the texture ripper creates a random string and uses this as the title for the texture when dumped. This will be a problem when trying to identify what the original name was, and where it’s supposed to lie within data.saf. Alas, I leave that task those out there who are already hard at work with this, and I wish them good luck!

As always, questions or comments are immensely appreciated. Thanks for reading.