Another bitmap brute-forcing thread

[junkew]

Waiting for the fasm version and see if OP gets any version 100% running.

[Werty]

Updated version, and a possible solution to get the faster version running with tool.exe.

Arrays are slow in AutoIt, strings are fast, so got rid of the arrays...

expandcollapse popup

#include <GDIPlus.au3>
#include <WinAPI.au3>
HotKeySet("{ESC}", "_exit")

;Be sure $posx and $posy is pointing at the correct spot!
Global $posx = 37+16, $posy = 38+16 , $result = "", $code1, $code2, $code3, $code4, $capture, $pixels = DllStructCreate('dword[2816]')

;Lookup table to avoid searching
Global $lookup = "1000000000004000000000000000006000320000000000009000008000000000700000000000000000000000000000000000000000000000005"

;Test section
;--------------------------------------------------------------
$gui = GUICreate("Getnumber", 640, 480, 100, 100)
       GUISetState()
       WinWaitActive($gui); <--- necessary or screencapture fails

            _GDIPlus_Startup()
$graphics = _GDIPlus_GraphicsCreateFromHWND($gui)
   $image = _GDIPlus_BitmapCreateFromFile("3.png")
            _GDIPlus_GraphicsDrawImageRect($graphics, $image, 16, 16, 176, 56)
;--------------------------------------------------------------
;/Test section

    $hDDC = _WinAPI_GetWindowDC($gui)
    $hCDC = _WinAPI_CreateCompatibleDC($hDDC)
 $capture = _WinAPI_CreateCompatibleBitmap($hDDC, 88, 32)
            _WinAPI_SelectObject($hCDC, $capture)
            _WinAPI_BitBlt($hCDC, 0, 0, 88, 32, $hDDC, $posx, $posy, 0x00CC0020)
            _WinAPI_ReleaseDC($gui, $hDDC) ; <----NOTICE
            _WinAPI_DeleteDC($hCDC)

$result = Getnumber($result)
Consolewrite("Result: " & $result & @crlf)

While 1
   Sleep(10)
WEnd

Func Getnumber($result)

    Local $value = 64, $code1 = 0, $code2 = 0, $code3 = 0, $code4 = 0
    DllCall('gdi32.dll', 'dword', 'GetBitmapBits', 'ptr', $capture, 'dword', DllStructGetSize($pixels), 'ptr', DllStructGetPtr($pixels))

For $loop = 1 To 2816 Step 440
    $code1 += DllStructGetData($pixels, 1, $loop   ) > 4278190080 ? $value:0
    $code2 += DllStructGetData($pixels, 1, $loop+29) > 4278190080 ? $value:0
    $code3 += DllStructGetData($pixels, 1, $loop+58) > 4278190080 ? $value:0
    $code4 += DllStructGetData($pixels, 1, $loop+87) > 4278190080 ? $value:0
    $value /= 2
Next
    Return StringMid($lookup, $code1+1, 1) & StringMid($lookup, $code2+1, 1) & StringMid($lookup, $code3+1, 1) & StringMid($lookup, $code4+1, 1)
EndFunc

Func _exit()
    _GDIPlus_Shutdown()
    Exit
 EndFunc

As for the possible solution to get it to work with tool.exe, notice the "NOTICE" in above script, in the helpfile under GetWindowDC() it says...
 

Quote

After painting is complete, the _WinAPI_ReleaseDC() function must be called to release the device context. Not releasing
the window device context has serious effects on painting requested by applications.

We may have been lucky that it worked at all with our gui as the gui is OWNED by us, so leaving out ReleaseDC() worked, but we dont OWN the tool.exe, so maybe try including the ReleaseDC(), you would have to put all the WinAPI stuff back into the loop, but as you said earlier, they are pretty fast as you saw no big changes in speed putting them outside the loop. it was the bitblt that required more time as we used the whole desktop that took time.

 

Edited February 23 by Werty