simple "no fog"

[cannonpas]

#include <stdio.h>
#include <fstream>


#include <d3d9.h>
#include <d3dx9.h>
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")

	typedef HRESULT (WINAPI* tDrawIndexedPrimitive)(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE PrimType,INT BaseVertexIndex,UINT MinVertexIndex,UINT NumVertices,UINT startIndex,UINT primCount);
	tDrawIndexedPrimitive oDrawIndexedPrimitive = NULL;
	HRESULT WINAPI hkDrawIndexedPrimitive(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE PrimType,INT BaseVertexIndex,UINT MinVertexIndex,UINT NumVertices,UINT startIndex,UINT primCount)
	{
		pDevice->SetRenderState(D3DRS_FOGENABLE, FALSE);

	return oDrawIndexedPrimitive(pDevice, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
	}

this is my full code of "no fog" (without dllmain). it inject sussesfully, but the fog still in the game, what i'm doing wrong?

[Ch40zz-C0d3r]

Well, some tips from me:
1. This is detected, so dont try it xD
2. You should show your hook so I can help you
3. Look at the ptc method for this
4. NoFog also works when you hook drawtexture (just a tip how I got my chams working)

[cannonpas]

Well, some tips from me:
1. This is detected, so dont try it xD
2. You should show your hook so I can help you
3. Look at the ptc method for this
4. NoFog also works when you hook drawtexture (just a tip how I got my chams working)

1 im using it for another game and i'm not being disconnected.
2 im using https://www.mpgh.net/forum/207-combat...menu-base.html

/************************************************************************/
/* HOOK                                                                 */
/************************************************************************/
bool HookEndscene()
{
	DWORD D3D9 = (DWORD)LoadLibrary(TEXT("d3d9.dll"));
	if (D3D9)
	{
		DWORD* Addr = *(DWORD**)(FindPattern(D3D9, 0x150000, (BYTE*)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx")+2);
		if (Addr)
		{
			DWORD dwOld;
			_EndScene = Addr[42];
			VirtualProtect((VOID*)(_EndScene+12), 1, PAGE_EXECUTE_READWRITE, &dwOld);
			*(BYTE*)(_EndScene+12) = 0x90;
			VirtualProtect((VOID*)(_EndScene+12), 1, dwOld, &dwOld);
			return true;
		}
	}
	return false;
}

/************************************************************************/
/* EXCEPTION HANDLER                                                    */
/************************************************************************/
LONG CALLBACK Handler(PEXCEPTION_POINTERS Info)
{
	if (Info->ExceptionRecord->ExceptionCode != EXCEPTION_ACCESS_VIOLATION)
	{
		return EXCEPTION_CONTINUE_SEARCH;
	}

	if ((DWORD)Info->ExceptionRecord->ExceptionAddress == _EndScene+13)
	{
		Info->ContextRecord->Eip = (DWORD)Pre_EndScene;
		return EXCEPTION_CONTINUE_EXECUTION;
	}
	return EXCEPTION_CONTINUE_SEARCH;
}

/************************************************************************/
/* MAINTHREAD                                                           */
/************************************************************************/
DWORD WINAPI MyMainThread(LPVOID)
{
	#ifdef CA
	while ( !IsGameReadyToBeHooked() )
		Sleep(25);
	#endif

	main = new cMain();
	menu = new cMenu();
	d3d = new cD3D();

	if(main && menu && d3d)
	{
		if(HookEndscene())
			AddVectoredExceptionHandler(1, Handler);
	}

	return true;
}

/************************************************************************/
/* DLL MAIN                                                             */
/************************************************************************/
BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
	DisableThreadLibraryCalls(hDll);
	switch( dwReason )
	{
	case DLL_PROCESS_ATTACH:
		CreateThread(NULL, NULL, MyMainThread, NULL, NULL, NULL);
		break;
	}
	return true;
}

[OpKilts]

1 im using it for another game and i'm not being disconnected.
2 im using https://www.mpgh.net/forum/207-combat...menu-base.html

/************************************************************************/
/* HOOK                                                                 */
/************************************************************************/
bool HookEndscene()
{
	DWORD D3D9 = (DWORD)LoadLibrary(TEXT("d3d9.dll"));
	if (D3D9)
	{
		DWORD* Addr = *(DWORD**)(FindPattern(D3D9, 0x150000, (BYTE*)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx")+2);
		if (Addr)
		{
			DWORD dwOld;
			_EndScene = Addr[42];
			VirtualProtect((VOID*)(_EndScene+12), 1, PAGE_EXECUTE_READWRITE, &dwOld);
			*(BYTE*)(_EndScene+12) = 0x90;
			VirtualProtect((VOID*)(_EndScene+12), 1, dwOld, &dwOld);
			return true;
		}
	}
	return false;
}

/************************************************************************/
/* EXCEPTION HANDLER                                                    */
/************************************************************************/
LONG CALLBACK Handler(PEXCEPTION_POINTERS Info)
{
	if (Info->ExceptionRecord->ExceptionCode != EXCEPTION_ACCESS_VIOLATION)
	{
		return EXCEPTION_CONTINUE_SEARCH;
	}

	if ((DWORD)Info->ExceptionRecord->ExceptionAddress == _EndScene+13)
	{
		Info->ContextRecord->Eip = (DWORD)Pre_EndScene;
		return EXCEPTION_CONTINUE_EXECUTION;
	}
	return EXCEPTION_CONTINUE_SEARCH;
}

/************************************************************************/
/* MAINTHREAD                                                           */
/************************************************************************/
DWORD WINAPI MyMainThread(LPVOID)
{
	#ifdef CA
	while ( !IsGameReadyToBeHooked() )
		Sleep(25);
	#endif

	main = new cMain();
	menu = new cMenu();
	d3d = new cD3D();

	if(main && menu && d3d)
	{
		if(HookEndscene())
			AddVectoredExceptionHandler(1, Handler);
	}

	return true;
}

/************************************************************************/
/* DLL MAIN                                                             */
/************************************************************************/
BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
	DisableThreadLibraryCalls(hDll);
	switch( dwReason )
	{
	case DLL_PROCESS_ATTACH:
		CreateThread(NULL, NULL, MyMainThread, NULL, NULL, NULL);
		break;
	}
	return true;
}

Ahhh, the @matypatty way

[Saltine]

Ahhh, the @matypatty way

Also known as Structured Exception Handling

[[MPGH]Flengo]

Also known as Structured Exception Handling

I guess it got out

[matypatty]

I guess it got out

Yea I stuck it in my menu base

Pretty sure nofog is possible via puchtoconsole (not sure after this new ptc shit, havent kept up with the changes) which would be the preferred method as nexon protects DIP as much as it protects its employees virginity's.

[gotter]

well i dont know much about programmer JOB but i think when you are a full time coder and are paid to do that... your virginity is hard to lose...

[Ch40zz-C0d3r]

Well, thanks for posting hook.
It seems like you are only hooking endscene xD
As maty points out dip hooking is the hardest job on this game. I wasted 2 days doing it, and got it working 2 ways.
But full chams are not possibile with my method. (but which means nofog would work)

I guess it got out

Its easier as you think. You take an address and use VirtualProtect to protect this address with read/write flags so any access results in an application crash. Thats why you install a "VectoredExceptionHandler". Instead of crashing the application runs that.
Now you can check different things like the ExceptionAddress or ExceptionCode. Also you can CHNAGE data like EIP from ContextRecord pointer. The awesome thing is, if you know a bit asm, EIP is the register which says whats the next line to continue. It behaves like a JMP without memory modification

[BadBurrito]

So I have a working DIP hook and the good old chams, but first I had to write a driver that does a ssdt hook on getcontextthread, so that it returns that no debug registers are changed... and then a simple hwbp hook on DIP ...I know the way is quite complicated in comparision how easy it was to hook DIP some time ago

[Ch40zz-C0d3r]

So I have a working DIP hook and the good old chams, but first I had to write a driver that does a ssdt hook on getcontextthread, so that it returns that no debug registers are changed... and then a simple hwbp hook on DIP ...I know the way is quite complicated in comparision how easy it was to hook DIP some time ago

Well I think there is no way without coding a bypass.

[arun823]

Well I think there is no way without coding a bypass.

Hooking DIP the "normal" way is still undetected for NA, on the other hand EU requires a bypass since it crashes after about 10 seconds.