DIP Hook | NtCreateThreadEx

#include <windows.h>
#include <d3d9.h>
#include <d3dx9.h>
#include <iostream>
#include <fstream>
#include <tlhelp32.h>
#include <process.h>
#include <stdint.h>
#include <string>

#pragma comment(lib,"d3d9.lib")
#pragma comment(lib,"d3dx9.lib")

using namespace std;

ofstream ofile;
LPD3DXFONT pFont;

#include <time.h>
#include "XOR.h"
#include "main.h"

DWORD FindDeviceDIP,retMyDIP;

#define sWeapon 36
#define sMap 24
#define sSkyWalls 28
#define sBody 44
#define sHead 40

int d3dwallhack=1;

void D3DFunction (LPDIRECT3DDEVICE9 pDevice)
{
	IDirect3DVertexBuffer9* pStreamData = NULL;
              UINT pOffsetInBytes , pStride;
              pDevice->GetStreamSource(0,&pStreamData,&pOffsetInBytes,&pStride);

	if(d3dwallhack)
	{
	    if (pStride == sBody|| pStride == sHead || pStride == sWeapon)
	    {
            pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
	    }
	}
}
__declspec(naked) HRESULT WINAPI MyDIP()
{
	static LPDIRECT3DDEVICE9 pDevice;

	__asm
	{
		MOV EDI,EDI
		PUSH EBP
		MOV EBP,ESP
		MOV EAX,DWORD PTR SS:[EBP + 0x8]
		MOV pDevice,EAX
	}
	D3DFunction(pDevice);
	__asm
	{
		JMP retMyDIP
	}
}
void HookDIP ()
{
	while(!Ready2Hook())
		Sleep(200);

	DWORD hD3D = (DWORD)GetModuleHandle(ed3d9);
	DWORD *vtbl;

	DWORD adr = FindPattern(hD3D, 0x128000, (BYTE*)"\xc7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "00????00????00");
	if(adr)
	{
		memcpy(&vtbl,(void*)(adr + 2),4);
		retMyDIP = vtbl[147] + 0x5;
		MakeJMP((PBYTE)vtbl[147],(DWORD)MyDIP,0x5);
	}
}

HMODULE Kernel32Dll;

extern "C"
{
    BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
    {
        switch (fdwReason)
        {
        case DLL_PROCESS_ATTACH:
            DisableThreadLibraryCalls(hinstDLL);
			EraseHeaders(hinstDLL);
			ErasePEHeader(hinstDLL);
			HideModule(hinstDLL);
            FreeLibrary(Kernel32Dll);
            Kernel32Dll = LoadLibrary("Kernel32.dll");
            TerminateThreadAddress=(unsigned char*) GetProcAddress(Kernel32Dll,"TerminateThread");
            HANDLE HandleProzess = OpenProcess (PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,false,GetCurrentProcessId());
            NtCreateThreadEx (HandleProzess ,
                              (void*)HookDIP ,
                              (void*)hinstDLL );

            CloseHandle (HandleProzess);

            //Sleep(3000);
            break;
        }
        return TRUE;
    }
}

#pragma warning(disable:4996)

bool bCompare (const BYTE* pData, const BYTE* bMask, const char* szMask)
{
	for(; *szMask; ++szMask, ++pData, ++bMask)
		if(*szMask=='0' && *pData != *bMask)
			return false;
	return (*szMask) == 0;
}

DWORD FindPattern (DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
	for(DWORD i=0; i<dwLen; i++)
		if (bCompare((BYTE*)(dwAddress + i), bMask, szMask))  
			return (DWORD)(dwAddress + i);
	return false;
}

// MODULE //

typedef struct _LDR_MODULE
{
	LIST_ENTRY InLoadOrderModuleList;
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	PVOID BaseAddress;
	PVOID EntryPoint;
	ULONG SizeOfImage;
}LDR_MODULE, *PLDR_MODULE;

typedef struct _PEB_LDR_DATA 
{
	ULONG Length;
	BOOLEAN Initialized;
	PVOID SsHandle;
	LIST_ENTRY InLoadOrderModuleList;
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
}PEB_LDR_DATA, *PPEB_LDR_DATA;

typedef struct _PEB 
{
	BYTE Reserved1[2];
	BYTE BeingDebugged;
	BYTE Reserved2[1];
	PVOID Reserved3[2];
	PPEB_LDR_DATA Ldr;
}PEB, *PPEB;

void HideModule (HINSTANCE hModule)
{
	PEB* peb;
	LDR_MODULE* ldr;
	
	peb = (PEB*)__readfsdword(0x30);
	
	ldr = (LDR_MODULE*)peb->Ldr->InLoadOrderModuleList.Flink;

	while(ldr->BaseAddress != 0)
	{
		if(ldr->BaseAddress == hModule)
		{
			if(ldr->InLoadOrderModuleList.Blink != 0)
				(ldr->InLoadOrderModuleList.Blink)->Flink = ldr->InLoadOrderModuleList.Flink;	
			
			if(ldr->InLoadOrderModuleList.Blink != 0)
				(ldr->InLoadOrderModuleList.Flink)->Blink = ldr->InLoadOrderModuleList.Blink;
			
			if(ldr->InInitializationOrderModuleList.Blink != 0)
				(ldr->InInitializationOrderModuleList.Blink)->Flink = ldr->InInitializationOrderModuleList.Flink;
			
			if(ldr->InInitializationOrderModuleList.Flink != 0)
				(ldr->InInitializationOrderModuleList.Flink)->Blink = ldr->InInitializationOrderModuleList.Blink;

			if(ldr->InMemoryOrderModuleList.Flink != 0)
				(ldr->InMemoryOrderModuleList.Blink)->Flink = ldr->InMemoryOrderModuleList.Flink;

			if(ldr->InMemoryOrderModuleList.Flink != 0)
				(ldr->InMemoryOrderModuleList.Flink)->Blink = ldr->InMemoryOrderModuleList.Blink;
		}
		ldr = (LDR_MODULE*)ldr->InLoadOrderModuleList.Flink;
	}
}

void EraseHeaders (HINSTANCE hModule)
{
	PIMAGE_DOS_HEADER pDoH;
	PIMAGE_NT_HEADERS pNtH;
	DWORD i, ersize, protect;

	if(!hModule) return;

	pDoH = (PIMAGE_DOS_HEADER)(hModule);
	pNtH = (PIMAGE_NT_HEADERS)((LONG)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);

	ersize = sizeof(IMAGE_DOS_HEADER);
	if(VirtualProtect(pDoH, ersize, PAGE_READWRITE, &protect))
	{
		for(i=0; i < ersize; i++)
			*(BYTE*)((BYTE*)pDoH + i) = 0;
	}

	ersize = sizeof(IMAGE_NT_HEADERS);
	if(pNtH && VirtualProtect(pNtH, ersize, PAGE_READWRITE, &protect))
	{
		for(i=0; i < ersize; i++)
			*(BYTE*)((BYTE*)pNtH + i) = 0;
	}
	return;
}

void ErasePEHeader (HINSTANCE hModule)
{
	MEMORY_BASIC_INFORMATION mbi;
	VirtualQuery((LPCVOID)hModule, &mbi, sizeof(mbi));
	VirtualProtect(mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &mbi.Protect);
	ZeroMemory((PVOID)hModule, 4096);
	VirtualProtect(mbi.BaseAddress, mbi.RegionSize, mbi.Protect, NULL);
	FlushInstructionCache(GetCurrentProcess(), (LPCVOID)mbi.BaseAddress, mbi.RegionSize);
}

void MakeJMP(BYTE *pAddress, DWORD dwJumpTo, DWORD dwLen)
{
    DWORD dwOldProtect, dwBkup, dwRelAddr;
    VirtualProtect(pAddress, dwLen, PAGE_EXECUTE_READWRITE, &dwOldProtect);
    dwRelAddr = (DWORD) (dwJumpTo - (DWORD) pAddress) - 5;
    *pAddress = 0xE9;
    *((DWORD *)(pAddress + 0x1)) = dwRelAddr;
    for(DWORD x = 0x5; x < dwLen; x++) *(pAddress + x) = 0x90;
	VirtualProtect(pAddress, dwLen, dwOldProtect, &dwBkup);
    return;
}
bool Ready2Hook ()
{
   if(GetModuleHandle(eCShell) != 0 && GetModuleHandle(eClient) != 0)
	   return true;
   return false;
}
struct NtCreateThreadExBuffer
{
  ULONG Size;
  ULONG Unknown1;
  ULONG Unknown2;
  PULONG Unknown3;
  ULONG Unknown4;
  ULONG Unknown5;
  ULONG Unknown6;
  PULONG Unknown7;
  ULONG Unknown8;
};


HANDLE NtCreateThreadEx(
		HANDLE InProcess,
		void* InRemoteThreadStart,
		void* InRemoteCallback)
	{
		typedef DWORD WINAPI NtCreateThreadEx_PROC(
			PHANDLE ThreadHandle,
			ACCESS_MASK DesiredAccess,
			LPVOID ObjectAttributes,
			HANDLE ProcessHandle,
			LPTHREAD_START_ROUTINE lpStartAddress,
			LPVOID lpParameter,
			BOOL CreateSuspended,
			DWORD dwStackSize,
			LPVOID Unknown1,
			LPVOID Unknown2,
			LPVOID Unknown3
		);

		// this will only work for vista and later...
		NtCreateThreadEx_PROC* VistaCreateThread = (NtCreateThreadEx_PROC*)
			GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtCreateThreadEx");

		if(VistaCreateThread == NULL)
			return NULL;

		HANDLE			hRemoteThread = NULL;
		HRESULT			hRes = 0;

		if(!SUCCEEDED(hRes = VistaCreateThread(
				&hRemoteThread,
				0x1FFFFF, // all access
				0,
				InProcess,
				(LPTHREAD_START_ROUTINE)InRemoteThreadStart,
				InRemoteCallback,
				FALSE,
				0,
				0,
				0,
				0
				)))
			return NULL;

		return hRemoteThread;
	}
unsigned char Backup[5], *TerminateThreadAddress;        /** Backup**/
/** Dummy Function **/
BOOL WINAPI MyTerminateThread(
    HANDLE hThread,
    DWORD dwExitCode)
{
    return true;
}

#ifdef BUILD_DLL
#define DLL_EXPORT __declspec(dllexport)
#else
#define DLL_EXPORT __declspec(dllimport)
#endif


#ifdef __cplusplus
extern "C"
{
#endif

    void DLL_EXPORT PCeumel( void );

#ifdef __cplusplus
}
#endif

Search yourself :P