Trouble In D3D9 Hook [Solved]

Code:

#include "d3d.h"

extern bool debugging;

typedef HRESULT (WINAPI* Reset_Prototype)               (LPDIRECT3DDEVICE9, D3DPRESENT_PARAMETERS*);
typedef HRESULT (WINAPI* EndScene_Prototype)            (LPDIRECT3DDEVICE9);
typedef HRESULT (WINAPI* DrawIndexedPrimitive_Prototype)(LPDIRECT3DDEVICE9, D3DPRIMITIVETYPE, INT, UINT, UINT, UINT, UINT);

int d3dinit()
{
	while(!GetModuleHandleA("d3d9.dll"))
	{
		Sleep(50);
	}
	d3d9handle = (DWORD)GetModuleHandleA("d3d9.dll");
	finddev(d3d9handle, 0x128000);
	pEndScene = (EndScene_Prototype)(DWORD)vTable[42];
	HookVFunc(vTable, 42, (DWORD*)nEndScene);
	return 0;
}

HRESULT WINAPI nEndScene(LPDIRECT3DDEVICE9 pDevice)
{
	MessageBoxA(NULL, "In EndScene", "Debug", MB_OK);
	return pEndScene(pDevice);
}

DWORD** finddev(DWORD base, DWORD len)
{
	unsigned long i = 0, n = 0;

	for( i = 0; i < len; i++ )
	{
        if(*(BYTE *)(base+i+0x00)==0xC7)n++;
	    if(*(BYTE *)(base+i+0x01)==0x06)n++;
	    if(*(BYTE *)(base+i+0x06)==0x89)n++;
	    if(*(BYTE *)(base+i+0x07)==0x86)n++;	
        if(*(BYTE *)(base+i+0x0C)==0x89)n++;
	    if(*(BYTE *)(base+i+0x0D)==0x86)n++;

	    if(n == 6)
		{ 
			pvTable = (DWORD**)(base + i + 2);
			*(DWORD*)&vTable = *(DWORD*)pvTable;
			if(debugging == true)
			{
				char buf[64];
				sprintf(buf, "EndScene: %.8X", vTable[42]);
				MessageBoxA(NULL, buf, "Debug", MB_OK);
			}
			return 0;
		}
			n = 0;
	}
	if(debugging == true)
		MessageBoxA(NULL, "device not found!", "Debug", MB_OK);
	return 0;
}

DWORD* HookVFunc(DWORD* vtable, int index, DWORD *newFunction)
{
	DWORD dwOldProt, *oldFunc;
	VirtualProtect(&vtable[index], 4, PAGE_EXECUTE_READWRITE, &dwOldProt);
	oldFunc=(DWORD*)vtable[index];
	vtable[index]=(DWORD)newFunction;
	VirtualProtect(&vtable[index], 4, dwOldProt, &dwOldProt);
	return oldFunc;
}

I have the correct EndScene address but my hook is not hooking, Because the messagebox shows the correct endscene address but the msgbox in the hooked endscene dosent show

This isn't exactly relevant but is there any reason you're including "d3d.h" rather than "d3d9.h"? As I said, not exactly relevant but whatever. As for the actual hook, your scan for the VTable is ugly as hell and I cbf deciphering it so I'll post the one I use (not sure who found the vtable signature but it's not mine haha)

I'll post it when I get home from work, I finish in about 2 hours.

K and d3d.h is the header, I originally had it as a class but that didnt work out.

Mk here's my GetVTable method:

Code:

DWORD *GetVirtualTable(void)
{
	DWORD* pTable = NULL;        
	DWORD device = ScanPattern((DWORD)GetModuleHandleA(D3D_MODULE), 0x1280000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
	if ( device != 0 )
		pTable = *(DWORD**)(device + 2);
	return pTable;
}

And related #defines and functions.

Code:

#define D3D_MODULE "d3d9.dll"

// Standard signature scanning function.
inline
BOOL bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
	for(;*szMask;++szMask,++pData,++bMask)
		if(*szMask=='x' && *pData!=*bMask) 
			return false;
	return (*szMask) == NULL;
}

//Scan a given pattern over a specified address range.
DWORD ScanPattern(DWORD dwAddress, DWORD dwLen, BYTE *bMask, char *szMask)
{
	for(DWORD i=0; i < dwLen; i++)
		if( bCompare((BYTE*)(dwAddress+i),bMask,szMask))
			return (DWORD)(dwAddress+i);
	return 0;
}

So that should get you the vtable. I have the following enum defined for easy of access:

Code:

typedef enum VTABLE_INDICES { I_QUERYINTERFACE, I_ADDREF, I_RELEASE, I_TESTCOOPERATIVELEVEL, I_GETAVAILABLETEXTUREMEM, I_EVICTMANAGEDRESOURCES, I_GETDIRECT3D, I_GETDEVICECAPS, I_GETDISPLAYMODE, I_GETCREATIONPARAMETERS, I_SETCURSORPROPERTIES, I_SETCURSORPOSITION, I_SHOWCURSOR, I_CREATEADDITIONALSWAPCHAIN, I_GETSWAPCHAIN, I_GETNUMBEROFSWAPCHAINS, I_RESET, I_PRESENT, I_GETBACKBUFFER, I_GETRASTERSTATUS, I_SETDIALOGBOXMODE, I_SETGAMMARAMP, I_GETGAMMARAMP, I_CREATETEXTURE, I_CREATEVOLUMETEXTURE, I_CREATECUBETEXTURE, I_CREATEVERTEXBUFFER, I_CREATEINDEXBUFFER, I_CREATERENDERTARGET, I_CREATEDEPTHSTENCILSURFACE, I_UPDATESURFACE, I_UPDATETEXTURE, I_GETRENDERTARGETDATA, I_GETFRONTBUFFERDATA, I_STRETCHRECT, I_COLORFILL, I_CREATEOFFSCREENPLAINSURFACE, I_SETRENDERTARGET, I_GETRENDERTARGET, I_SETDEPTHSTENCILSURFACE, I_GETDEPTHSTENCILSURFACE, I_BEGINSCENE, I_ENDSCENE, I_CLEAR, I_SETTRANSFORM, I_GETTRANSFORM, I_MULTIPLYTRANSFORM, I_SETVIEWPORT, I_GETVIEWPORT, I_SETMATERIAL, I_GETMATERIAL, I_SETLIGHT, I_GETLIGHT, I_LIGHTENABLE, I_GETLIGHTENABLE, I_SETCLIPPLANE, I_GETCLIPPLANE, I_SETRENDERSTATE, I_GETRENDERSTATE, I_CREATESTATEBLOCK, I_BEGINSTATEBLOCK, I_ENDSTATEBLOCK, I_SETCLIPSTATUS, I_GETCLIPSTATUS, I_GETTEXTURE, I_SETTEXTURE, I_GETTEXTURESTAGESTATE, I_SETTEXTURESTAGESTATE, I_GETSAMPLERSTATE, I_SETSAMPLERSTATE, I_VALIDATEDEVICE, I_SETPALETTEENTRIES, I_GETPALETTEENTRIES, I_SETCURRENTTEXTUREPALETTE, I_GETCURRENTTEXTUREPALETTE, I_SETSCISSORRECT, I_GETSCISSORRECT, I_SETSOFTWAREVERTEXPROCESSING, I_GETSOFTWAREVERTEXPROCESSING, I_SETNPATCHMODE, I_GETNPATCHMODE, I_DRAWPRIMITIVE, I_DRAWINDEXEDPRIMITIVE, I_DRAWPRIMITIVEUP, I_DRAWINDEXEDPRIMITIVEUP, I_PROCESSVERTICES, I_CREATEVERTEXDECLARATION, I_SETVERTEXDECLARATION, I_GETVERTEXDECLARATION, I_SETFVF, I_GETFVF, I_CREATEVERTEXSHADER, I_SETVERTEXSHADER, I_GETVERTEXSHADER, I_SETVERTEXSHADERCONSTANTF, I_GETVERTEXSHADERCONSTANTF, I_SETVERTEXSHADERCONSTANTI, I_GETVERTEXSHADERCONSTANTI, I_SETVERTEXSHADERCONSTANTB, I_GETVERTEXSHADERCONSTANTB, I_SETSTREAMSOURCE, I_GETSTREAMSOURCE, I_SETSTREAMSOURCEFREQ, I_GETSTREAMSOURCEFREQ, I_SETINDICES, I_GETINDICES, I_CREATEPIXELSHADER, I_SETPIXELSHADER, I_GETPIXELSHADER, I_SETPIXELSHADERCONSTANTF, I_GETPIXELSHADERCONSTANTF, I_SETPIXELSHADERCONSTANTI, I_GETPIXELSHADERCONSTANTI, I_SETPIXELSHADERCONSTANTB, I_GETPIXELSHADERCONSTANTB, I_DRAWRECTPATCH, I_DRAWTRIPATCH, I_DELETEPATCH, I_CREATEQUERY };

So, I use my own hook method so I can't post how to set up the hook but basically:

Code:

while (!GetModuleHandleA(D3D_MODULE)) { Sleep(100); }

DWORD *vtable = GetVirtualTable();
if (vtable > 0)
{
    //Set hook with at address 'vtable[I_ENDSCENE]'
}

Well i got it to hook EndScene in tf2, So Thanks @Jason for the scanning functions.

Marked Solved.

How do you know the size of the VTable, if (for instance) you wants to copy it.

Probably would have been best to ask that in a new thread, this one is months old. As for the size, just count the number of members in the enum I included then multiply by sizeof(DWORD)

Ah ok. I was more curious at to how it would be done in a generic fashion. For instance, is the last member 0 in VC++ compile applications? or is there no automated way to find this?

Originally Posted by megamandos

Ah ok. I was more curious at to how it would be done in a generic fashion. For instance, is the last member 0 in VC++ compile applications? or is there no automated way to find this?

I don't think they'd have a zero'd last member as each function is mapped, there's no point in doing that from a compiler point of view and I doubt they wanna just make the hackers happy.

the vtable is the import address table for the d3d9 dll. open up d3d9 dll in ida pro and see the exports

Originally Posted by kibbles18

the vtable is the import address table for the d3d9 dll. open up d3d9 dll in ida pro and see the exports

Bitchin' thanks

Originally Posted by kibbles18

the vtable is the import address table for the d3d9 dll. open up d3d9 dll in ida pro and see the exports

No, no it isn't.

Trouble In D3D9 Hook [Solved]

Post a Reply

Similar Threads

Tags for this Thread