Simple Chams [Source]

This is the latest request.
A simple chams with pink in it.
I also included a much better endscene.
Enjoy.

Credits: So many places...
I typed every bit of it...
Just had a lot of projects I was able to look at, chose what I needed..
Trial and error.

You're more than welcome to change the color and logo to your own I don't give a crap, have fun with it.
I can make a really simple menu out of this, or a more complex one, would anyone like a tutorial?

Code:

#pragma comment (lib, "d3dx9.lib")
#pragma comment (lib, "d3d9.lib")

#include <Windows.h>
#include "Colors.h"
#include <d3d9.h>
#include <d3dx9.h>
#include <iostream>
#include <fstream>
#include <detours.h>
#include <stdio.h>
#include <vector>
#include "d3d9types.h"

using namespace std;
bool Generated = false;

//Chams
#pragma intrinsic(_ReturnAddress)
#define Player_ReturnAddress 0x615CCB
//Chams

#define HOOK(func,addy)	o##func = (t##func)DetourFunction((PBYTE)addy,(PBYTE)hk##func)
#define D3D_RELEASE(D3D_PTR) if( D3D_PTR ){ D3D_PTR->Release(); D3D_PTR = NULL; }
#define ES	0
#define DIP	1
#define RES 2

DWORD VTable[3] = { 0 };
DWORD WINAPI FindWin(LPVOID);
DWORD D3DEndScene;
DWORD D3DReset;
DWORD D3DDrawIndexedPrimitive;
DWORD WINAPI VirtualMethodTableRepatchingLoopToCounterExtensionRepatching(LPVOID);
PDWORD Direct3D_VMTable = NULL;

BYTE CodeFragmentES[5] = { 0, 0, 0, 0, 0 };
BYTE CodeFragmentR[5] = { 0, 0, 0, 0, 0 };
BYTE CodeFragmentDIP[5] = { 0, 0, 0, 0, 0 };

HRESULT WINAPI Direct3DCreate9_VMTable(VOID);
HRESULT WINAPI hkReset(LPDIRECT3DDEVICE9, D3DPRESENT_PARAMETERS*);
typedef HRESULT(WINAPI* tEndScene)(LPDIRECT3DDEVICE9 LeHaxzor);
typedef HRESULT(WINAPI* DrawIndexedPrimitive_)(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount);
typedef HRESULT(WINAPI* tDrawIndexedPrimitive)(LPDIRECT3DDEVICE9 LeHaxzor, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount);
typedef HRESULT(WINAPI* tReset)(LPDIRECT3DDEVICE9, D3DPRESENT_PARAMETERS*);
tReset oReset;
DrawIndexedPrimitive_ oDrawIndexedPrimitive = NULL;
tEndScene oEndScene;


//font
LPD3DXFONT	g_pFont = NULL;
//font

DWORD FindDevice(DWORD Len)
{
	DWORD dwObjBase = 0;

	dwObjBase = (DWORD)LoadLibrary("d3d9.dll");
	while (dwObjBase++ < dwObjBase + Len)
	{
		if ((*(WORD*)(dwObjBase + 0x00)) == 0x06C7
			&& (*(WORD*)(dwObjBase + 0x06)) == 0x8689
			&& (*(WORD*)(dwObjBase + 0x0C)) == 0x8689
			) {
			dwObjBase += 2; break;
		}
	}
	return(dwObjBase);
}

DWORD GetDeviceAddress(int VTableIndex)
{
	PDWORD VTable;
	*(DWORD*)&VTable = *(DWORD*)FindDevice(0x128000);
	return VTable[VTableIndex];
}

//Generate Texture for chams
LPDIRECT3DTEXTURE9 White;
LPDIRECT3DTEXTURE9 Pink;
LPDIRECT3DTEXTURE9 Black;
LPDIRECT3DTEXTURE9 Blue;
LPDIRECT3DTEXTURE9 Red;
LPDIRECT3DTEXTURE9 Yellow;
LPDIRECT3DTEXTURE9 Green;
LPDIRECT3DTEXTURE9 Purple;
LPDIRECT3DTEXTURE9 Cyan;
LPDIRECT3DTEXTURE9 Turquoise;
LPDIRECT3DTEXTURE9 Orange;
//Generate Texture for chams
//Color for menu
//Color for menu



//----------------------------------------------------------------------------------------------------//
//Drawing
void DrawShadowText(int x, int y, D3DCOLOR color, char* String)
{
	RECT Font;
	Font.bottom = 0;
	Font.left = x;
	Font.top = y;
	Font.right = 0;

	RECT Fonts;
	Fonts.bottom = 0;
	Fonts.left = x + 1;
	Fonts.top = y + 1;
	Fonts.right = 0;

	g_pFont->DrawTextA(0, String, strlen(String), &Fonts, DT_NOCLIP, 0xFF010101);
	g_pFont->DrawTextA(0, String, strlen(String), &Font, DT_NOCLIP, color);
}
void DrawString(int x, int y, D3DCOLOR color, const char *fmt, ...)
{
	RECT FontPos = { x, y, x + 120, y + 16 };
	char buf[1024] = { '\0' };
	va_list va_alist;

	va_start(va_alist, fmt);
	vsprintf_s(buf, fmt, va_alist);
	va_end(va_alist);

	g_pFont->DrawText(NULL, buf, -1, &FontPos, DT_NOCLIP, color);
}
//Drawing


//Generate Texture for chams
HRESULT GenerateTexture(LPDIRECT3DDEVICE9 LeHaxzor, IDirect3DTexture9 **ppD3Dtex, DWORD colour32)
{
	if (FAILED(LeHaxzor->CreateTexture(8, 8, 1, 0, D3DFMT_A4R4G4B4, D3DPOOL_MANAGED, ppD3Dtex, NULL)))
		return E_FAIL;

	WORD colour16 = ((WORD)((colour32 >> 28) & 0xF) << 12)
		| (WORD)(((colour32 >> 20) & 0xF) << 8)
		| (WORD)(((colour32 >> 12) & 0xF) << 4)
		| (WORD)(((colour32 >> 4) & 0xF) << 0);

	D3DLOCKED_RECT d3dlr;
	(*ppD3Dtex)->LockRect(0, &d3dlr, 0, 0);
	WORD *pDst16 = (WORD*)d3dlr.pBits;

	for (int xy = 0; xy < 8 * 8; xy++)
		*pDst16++ = colour16;

	(*ppD3Dtex)->UnlockRect(0);

	return S_OK;
}
//Generate Texture for chams

HRESULT WINAPI hkDrawIndexedPrimitive(LPDIRECT3DDEVICE9 LeHaxzor, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount)
{
	//DIP

	//Chams
	void* ReturnAddress = _ReturnAddress();
	if (ReturnAddress != NULL && ReturnAddress == (void *)Player_ReturnAddress)
	{
		LeHaxzor->SetTexture(0, Pink);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, false);
		LeHaxzor->DrawIndexedPrimitive(PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, true);
		LeHaxzor->SetTexture(0, Turquoise);
	}
	//Chams

	return oDrawIndexedPrimitive(LeHaxzor, PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
}

HRESULT WINAPI hkReset(LPDIRECT3DDEVICE9 LeHaxzor, D3DPRESENT_PARAMETERS* PresP)
{
	//Reset
	D3D_RELEASE(g_pFont);

	return oReset(LeHaxzor, PresP);
}

HRESULT WINAPI hkEndScene(LPDIRECT3DDEVICE9 LeHaxzor)
{
	if (g_pFont == NULL) D3DXCreateFont(LeHaxzor, 15, 0, FW_BOLD, 1, 0, DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, ANTIALIASED_QUALITY, DEFAULT_PITCH | FF_DONTCARE, "red", &g_pFont);


		//Menu Start
		DrawShadowText(100, 100, D3DCOLOR_ARGB(255, 0, 255, 255), "LeHaxzor made this shit from scratch"); // Cyan
		//Menu End

		//Chams
		if (!Generated) {
			if (Red == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&red, sizeof(red), &Red);
			if (Orange == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&orange, sizeof(orange), &Orange);
			if (Green == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bGreen, sizeof(bGreen), &Green);
			if (Blue == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bBlue, sizeof(bBlue), &Blue);
			if (White == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bWhite, sizeof(bWhite), &White);
			if (Yellow == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bYellow, sizeof(bYellow), &Yellow);
			if (Pink == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bPink, sizeof(bPink), &Pink);
			if (Turquoise == NULL)D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bTur, sizeof(bTur), &Turquoise);
			if (Black == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bBlack, sizeof(bBlack), &Black);
			//Chams
			Generated = true;
		}


	return oEndScene(LeHaxzor);
}


LRESULT CALLBACK MsgProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
	return DefWindowProc(hwnd, uMsg, wParam, lParam); 
}
void DX_Init(DWORD* table)
{
	WNDCLASSEX wc = { sizeof(WNDCLASSEX), CS_CLASSDC, MsgProc, 0L, 0L, GetModuleHandle(NULL), NULL, NULL, NULL, NULL, "DX", NULL };
	RegisterClassEx(&wc);
	HWND hWnd = CreateWindow("DX", NULL, WS_OVERLAPPEDWINDOW, 100, 100, 300, 300, GetDesktopWindow(), NULL, wc.hInstance, NULL);
	LPDIRECT3D9 pD3D = Direct3DCreate9(D3D_SDK_VERSION);
	D3DPRESENT_PARAMETERS d3dpp;
	ZeroMemory(&d3dpp, sizeof(d3dpp));
	d3dpp.Windowed = TRUE;
	d3dpp.SwapEffect = D3DSWAPEFFECT_DISCARD;
	d3dpp.BackBufferFormat = D3DFMT_UNKNOWN;
	LPDIRECT3DDEVICE9 pd3dDevice;
	pD3D->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, hWnd, D3DCREATE_SOFTWARE_VERTEXPROCESSING, &d3dpp, &pd3dDevice);
	DWORD* pVTable = (DWORD*)pd3dDevice;
	pVTable = (DWORD*)pVTable[0];

	table[ES] = pVTable[42];
	table[DIP] = pVTable[82];
	table[RES] = pVTable[16];

	DestroyWindow(hWnd);
}

//Hook
DWORD WINAPI MyThread(LPVOID)
{
	while (GetModuleHandle("d3d9.dll") == NULL) {
		Sleep(250);
	}

	DX_Init(VTable);

	HOOK(EndScene, VTable[ES]);
	HOOK(DrawIndexedPrimitive, VTable[DIP]);
	HOOK(Reset, VTable[RES]);

	return 0;
}

BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpvReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH) {

		CreateThread(0, 0, MyThread, 0, 0, 0);
	}

	return TRUE;
}

- - - Updated - - -

For No smoke no fog.
At top

#define Smoke 0X619DA0

In DIP

if (ReturnAddress != NULL && ReturnAddress == (void *)Smoke)
{
return D3D_OK;
}

Originally Posted by LeHaxzor

But do you mean something like this?

Code:

	int MyStride;
	if ((NumVertices == 128 && PrimitiveCount == 120 && MyStride == 16)) {
		LeHaxzor->SetTexture(0, Orange);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, false);
		LeHaxzor->DrawIndexedPrimitive(PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, true);
		LeHaxzor->SetTexture(0, Turquoise);
	}

That's right !
I believe you LeHaxzor: sometimes the models are so fragmented that it is not possible to do that way

I compiled you code.
It works great but ...
I have a little problem - Can you help me?

In windowed mode: everything is OK when I inject
In Full Screen mode: just after the injection the game is back to full screen automatically but it does not have the mouse focus. The mouse focus stays with the background apps to which I don't have access because of the game in full screen.
So I am forced to play in windowed mode.
I tried several injectors: Winject, RemoteDLL, Extreme Injector, etc -> All give that same problem

Do you have that problem in Full Screen?
Do you have a walk around this prob?

Thanks man.

Simple Chams [Source]

Post a Reply

Similar Threads

Tags for this Thread