HOKAI
SO.
Upon CharCreate Success packet return from cacheD - 2 things happens
User::AddNewCharID is called along with CDB::RequestCreateInitItems in L2Server.
We're interested in the RequestCreateInit.
It basicly sends usersocket, class id and char id to cacheD.
Fast Forward to cacheD - and specificly to CreateInitItems Packet - thats the handler for aforementioned l2server packet.
In this packet\function there's this little gem:
000000000051D3B9 call CUser__RegisterInitialShortcut
This function several times uses the DB::Execute(In a wrapped form) function with a string found here:
off_6A5760
Which happens to be : "{Call dbo.lin_SetShortCut (?, ?, ?, ?, ?, ?)}".
So - you could hook the register initial shortcut and do your ownstuff db class and just set off the shortcuts yourself
(Remember to learn IDs and types and stuff).
OR
Change the param values on stack for the executes inside the function.
FYI This is for GF - but i assume it's 99,99999999999% same for C4.