[1.0.1 9558] Traversing the UI

[Tanaris4]

Has anyone been able to successfully iterate throughout the entire UI list? I found a great post here: http://www.ownedcore.com/forums/diab...ml#post2127790 ([Diablo 3][0.2.0.7200] Info Dump Thread)

And believe I have found the appropriate offsets on OS X, but I'm not able to traverse through the entire list. I'll start to loop through and then hit invalid entries such as:

0: Root
1: (null)
2: Root.NormalLayer.BattleNetAchievements_main.LayoutRoot.OverlayContainer.SummaryTab.CategoryList
3: Root.NormalLayer.BattleNetAchievements_main.LayoutRoot.OverlayContainer.SummaryTab.CategoryContent.AchievementIconList
4: Root.NormalLayer.BattleNetAchievements_main.LayoutRoot.OverlayContainer.SummaryTab.SummaryContent.RecentSlot3
5: Root.NormalLayer.BattleNetAchievements_main.LayoutRoot.OverlayContainer.PageHeader.AchievementScore.AchievementScoreValue
6: Root.NormalLayer.BattleNetAchievements_main.LayoutRoot.OverlayContainer.FlatListRadioButtonGroup
7: Root.NormalLayer.BattleNetAchievements_main.LayoutRoot.OverlayContainer.SummaryTab.SummaryContent
8: Root.NormalLayer.BattleNetAchievements_main.LayoutRoot.OverlayContainer.Loading.Animation
9: (null)
10: Root.NormalLayer.BattleNetAchievements_main.LayoutRoot.OverlayContainer.SummaryTab.CategoryContent.Compare.MyProgress.PlayerName
11: Root.NormalLayer.BattleNetAchievements_main.LayoutRoot.OverlayContainer.SummaryTab.CategoryContent.CompareTiled

Or can anyone just point me toward a function I should reverse that iterates? Poking around in memory + trying to follow the above post isn't getting me anywhere :/

Thanks in advance!

[eggsampler]

I dumped this from the login screen with d3advanced (so kinda cheated), Ubuntu Pastebin

[_Mike]

pseudo-code, windows offsets

elementList = [[[[0x156C8CC] + 0x924]] + 8]
listSize = [[[[0x156C8CC] + 0x924]] + 0x40]

for(i = 0; i < listSize; ++i)
{
    uiElement = [elementList + i * 4]
    while(uiElement)
    {
        // do something with uiElement..

        uiElement = [uiElement]; // parent / child / next in group?
    }
}

edit: or actually, I seem to be missing about 1400 elements according to the dump in #2.. Will have to take a closer look when I have some free time

[st0724]

You can find out all the UI stuff by looking at the handler function at 0xB96B10

[Tanaris4]

You can find out all the UI stuff by looking at the handler function at 0xB96B10

which case?

[BitHacker]

Does this help at all?

const void *__cdecl sub_A6A870() { const void *result; // eax@1 char v1; - Pastebin.com


That gives you the main caller to all the UI id's and names ( sub_964C80 )

int __cdecl sub_964C80(int a1, int a2)
{
int v2; // edx@1

*(_DWORD *)a1 = sub_964B40(a2);
*(_DWORD *)(a1 + 4) = v2;
sub_DEC320(a1 + 8, a2, 512);
return a1;
}

a1 = id
a2 = name

Looks like there is 1,589 Id's available.

So, this is the first one? result = (const void *)sub_964C80(&v1, "Root.TopLayer.cutscene");

pretty interesting whats on the bottom:
result = (const void *)sub_964C80(&v1, "Root.TopLayer.cutscene");
memcpy(&unk_164E320, result, 0x208u);
return result;


Seems like the size being created in memory is 0x208u for each entry...

I'm taking a guess the u stands for unsigned?

so decimal is 520 bytes?

That function 964C80 breaks when I hit my INVENTORY and everything else .... :P

This is another nice function:
http://pastebin.com/irXxfT6R

[st0724]

which case?

That is the input (mouse, keystrokes) handler for the ui elements. You can figure out how to, for example, simulate a click by looking at the case for key up or mouse button up.

There's also a UI iterate function. You can find it by setting a memory breakpoint on any visible ui element pointer.