(Please forgive all technical inaccuracies and inefficient code techniques in this document and the sample code; I’m not a hacker, programmer, or a technical person. Also note, the samples are not meant to be polished, release quality applications.)

One day I was digging around in the There folders for the hell of it (who hasn’t?) and started to notice all these files sitting around that are wide open. I was a little surprised that they’d leave everything open like this, even in a beta. I thought to myself, either these guys have never heard of resource .dlls, or they want people to “hack” There. I’m leaning toward the latter.

The first time I loaded up There, I noticed it was using Flash and the IE Advanced Hosting interfaces. I didn’t know the flash files were sitting in the file system until I started to dig around. Once I found that out, I wondered if I could swap them out for my own. I doubted that it would be possible - surely the There client would do a CRC check or something and detect my “naughty” flash and download the proper, happy, “nice” flash files from the servers. I was wrong - dead wrong.

I’ve never touched Flash in my life (I know more about Flash now than I ever cared to, I’ll tell you that!), so the first thing I did was get a hold of a Flash MX and a Flash decompiler (from a friend). It all looked pretty simple and straightforward, so I whipped out MX and built a quick replacement for the emotionsbar (a.k.a action bar). I compiled my Flash, dropped it in the appropriate directory, and fired up There. Lo and behold, There snapped my flash right in! Evil thoughts of f**king up There danced in my head.

I spent the evening mucking around adding features that duplicated what There’s flash code was doing. After an hour or two of fun, I decided to bag the whole deal. I figured one of the techy-geeky dudes that plays There must have already built some fancy crazy Flash apps that replace There’s and do sport things like control winamp, or provide access to external IM sources like Trillian.

After a few months, I happened to run into someone talking about hacking up There. After a conversation with them, my interest sparked up a bit again. I decided to start up some new experiments with There and document the hell out of it all. Here we are.

Ever hit http://localhost:9999? Try it sometime, but first put There into “debug” mode [CTRL-SHIFT-L]. It turns out There.exe has a mini http server built into it. The old-school plain-Jane HTML interface is not very pleasing to look at though. It makes me feel like I am back in the early 90s.

I thought a great way to learn the “secrets” of There and get the strain off my eyes would be to write my own happy front-end to the local server. Easy-peasy! I got a good deal of the functionality working before I decided to scrap it. Why have some external web interface when I have can build one in flash and have it run inside There!?

compass.zip

Having scrapped the idea of an external web interface that would be gimped and unable to do all the fancy things the flash running inside There can do, I figured the compass would make a great “debug” panel. I could make it any size I wanted, I could have it talk http://localhost:9999, and I could use all the crazy FSCommand call-backs to the There client.

Getting the basics working was pretty damn easy, in spite of the fact that Flash pretty much sucks. I’ve learned to really hate this tool over the last few days (It should be called Crapromedia Crash, not Macromedia Flash). Flash code can talk to whatever is hosting it (in this case There.exe) by calling getURL(). There seems to support a wide variety of callback commands, though it appears that many of them are dependent on being called from the “right” flash app.

There does all the work of setting the size and allocating a “stage”. It only takes a few lines of code to get There to show your flash app.

iWidth = 250;
iHeight = 150;
getURL("FSCommand:setStageWidthHeight", "width=" + iWidth + "&height=" + iHeight);
getURL("FSCommand:setTextureBitDepth", "depth=32");
getURL("FSCommand:setWidthHeight", "width=" + iWidth + "&height=" + "100");

After getting a basic window up, I ported over the code my web front end had to get the current pilot info and location. I set the flash app to poll every 5 seconds to update the data.

http://127.0.0.1:9999/ClientLoginGui/pilotInfo
http://127.0.0.1:9999/ihost/doblocation?doid=YOUR_DOID

Certainly it’s not a very fancy app, nor was it much of a challenge to get going. Next thing to add is…more features! Ideally, I’d like to front-end as much of http://localhost:9999 as I can, and add support for all of the FSCommand callbacks that will work from the compass. For now, I’ve decided to put the compass/debug app on hold and try my hand at something more interesting.

emotionsbar.zip

Last night I was talking to my wife and showing her my little app. I asked her if she could think of anything that I could build that would illustrate some useful end-user functionality. The built in emotions bar is pretty useless, and everyone seems to be running external macro apps to do complex combos. Why not build one that runs inside There?!

Honestly, this project has very little to do with “hacking” There, although I did discover a few useful things. 90% of the challenge was learning how to do stuff in the piece-of-garbage that is Flash. Sending text from a flash app to There couldn’t be easier.

getURL( "FSCommand:addChatText", "text=hello world” );

Need to talk to something in the local file system? There will oblige. I didn’t try it in other directories, but it works all over the /Resource folder. Point the URL to whatever you need to suck down, and you’re in business.

http://127.0.0.1:9999/Resources/Emotionsbar/emotionsbar.xml

The first big hurdle was building the UI on the fly from the XML. I wanted this thing to be 100% end-user configurable. Up to three user-defined tabs and ten user defined buttons per tab seemed sufficient. I also wanted to support very basic macros with delays and looping. The XML looks like this:

<emotionbar>
<tab title="Tab One">
<macro title="Do Stuff">
<step type="text" delay="500">'yes'</step>
<step type="text" delay="0">Yes!</step>
</macro>
</tab>
</emotionbar>

Getting Flash to create components on the fly was barely documented, but I managed to figure out how to make it work. Strange thing, I found that There has a hook for getting XML for their emotions bar, but they aren’t using it! There flash has all the buttons 100% hard coded in it. I wonder why theirs is so gimped? Who cares! I have my new fancy fully configurable emotionsbar!

I also added rudimentary support for the new voice chat features as a built-in tab.

I leave it up to someone else to build a better, polished, release quality macro/emotions bar.

Expect to see a Part II and beyond. I have roughly 15 pages of notes sitting around on all sorts of arcane There matters that need sorting out. There are many, many, many, many, many things to figure out. Just a few things on my list:

Document every FSCommand being used.
Figure out what everything in http://120.0.0.1:9999 is about.
Reverse engineer the Flash IM protocol.
Figure out the deal with “There Script” (all the .ts files).
Reverse engineer the There wire protocol.
OLE automating the five or so com objects There has registered.