D3D - WallHack Code

**Jojo77** · 04-17-2014

WallHack - SuddenAttack

Code:

#include <iostream>

#include <d3d8.h>
LPDIRECT3DDEVICE8 m_pD3Ddev; 
BYTE DIPOpCodes[7];
DWORD dwDIP_hook, dwDIP_ret;
BYTE ImJumpingBack = 0x00;
LPDIRECT3DDEVICE8 
Device_Interface;
D3DPRIMITIVETYPE 
PrimitiveType;
UINT 
MinIndex, 
NumVertices, 
StartIndex, 
PrimitiveCount;
UINT 
Offset = 0,
Stride = 0;
HRESULT (WINAPI* DrawIndexedPrimitive_Pointer)
(LPDIRECT3DDEVICE8, D3DPRIMITIVETYPE,  UINT, UINT, UINT, UINT);
LPDIRECT3DVERTEXBUFFER8 
Stream_Data;

__declspec(naked) void MyDIP( )
{
__asm
{
MOV EDI,DWORD PTR SS:[EBP+0x8]
XOR EBX,EBX 
MOV m_pD3Ddev, EDI; 
PUSHFD 
PUSHAD

MOV EAX,DWORD PTR SS:[EBP+0x1C]
MOV DWORD PTR DS:[PrimitiveCount], EAX
MOV ECX,DWORD PTR SS:[EBP+0x18]
MOV DWORD PTR DS:[StartIndex], ECX
MOV EDX,DWORD PTR SS:[EBP+0x14]
MOV DWORD PTR DS:[NumVertices], EDX
MOV EAX,DWORD PTR SS:[EBP+0x10]
MOV DWORD PTR DS:[MinIndex], EAX
MOV EDX,DWORD PTR SS:[EBP+0x0C]
MOV DWORD PTR DS:[PrimitiveType], EDX
MOV EAX,DWORD PTR SS:[EBP+0x08]
MOV DWORD PTR DS:[Device_Interface], EAX
}
if( ImJumpingBack )
goto Jumpback;
ImJumpingBack = 0x01;
if( m_pD3Ddev->GetStreamSource(0, &Stream_Data, &Stride) == D3D_OK )
Stream_Data->Release();
if(Stride==32||Stride==40||Stride==44)
{

m_pD3Ddev->SetRenderState( D3DRS_ZENABLE,false );
DrawIndexedPrimitive_Pointer(Device_Interface, PrimitiveType,MinIndex, 
NumVertices, StartIndex, PrimitiveCount);
m_pD3Ddev->SetRenderState( D3DRS_ZENABLE, true );


}

ImJumpingBack = 0x00;
Jumpback:
__asm
{
POPAD
POPFD
CMP EDI,EBX 
jmp dwDIP_ret;
}
}
VOID  WriteMemory(PVOID dwAdd, void *val, int bytes)
{
DWORD d, ds; 
VirtualProtect(dwAdd, bytes, PAGE_EXECUTE_READWRITE, &d);
memcpy(dwAdd, val, bytes); 
VirtualProtect(dwAdd,bytes,d,&ds);
}

DWORD  FindPattern(DWORD dwdwAdd,DWORD dwLen,BYTE *bMask,char * szMask)
{
for(DWORD i=0; i<dwLen; i++)
if (this->bCompare((BYTE*)(dwdwAdd+i),bMask,szMask)) return (DWORD)(dwdwAdd+i);
return 0;
}
HINSTANCE  pGetModuleHandle(LPCWSTR szModule) 
{
HINSTANCE hModule = NULL;
if(!(hModule = GetModuleHandleW(szModule))) 
{
hModule = LoadLibraryW(szModule);
} 
return hModule;
} 
void *DetourFunc(BYTE *src, const BYTE *dst, const int len)
{
BYTE *jmp = (BYTE*)malloc(len+5);
DWORD dwBack;
VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
memcpy(jmp, src, len); 
jmp += len;
jmp[0] = 0xE9;
*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
src[0] = 0x90; 
src[1] = 0x90; 
src[2] = 0xE9;
*(DWORD*)(&src[3]) = (DWORD)(dst - src) - 7;
for (int i=7; i<len; i++) src[i] = 0x90;
VirtualProtect(src, len, dwBack, &dwBack);
return (jmp-len);
}

INT Thread_XD3DXINIT( )
{

Dx8Hook(L"d3d8.dll");
WriteMemory((void *)DIPOpCodes, (void *)"\x8B\x7D\x08\x33\xDB\x3B\xFB", 7);

while( 1 )
{
Sleep( 1000 );
if(memcmp((void *)DIPOpCodes, (void *)dwDIP_hook, 7) == 0 )
DetourFunc((PBYTE)dwDIP_hook, (PBYTE)MyDIP, 7);

}

return NULL;
}

VOID Dx8Hook( LPCWSTR D3D8 )
{
DWORD * VTable;
DWORD hD3D = NULL;
while (!hD3D) hD3D = (DWORD)pGetModuleHandle(D3D8);
DWORD PPPDevice = FindPattern(hD3D, 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
memcpy( &VTable, (VOID *)(PPPDevice + 2), 4);
dwDIP_hook=VTable[71]+0x2D;
dwDIP_ret = dwDIP_hook + 0x7;
*(PDWORD)&DrawIndexedPrimitive_Pointer = (DWORD)VTable[71];
} 
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{  
if( fdwReason == 1 )
{
CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)Thread_XD3DXINIT, NULL, NULL, NULL);

return TRUE;
}
return FALSE;
}

Enjoy ;$$