Hook Present Engine 6/9/2012
Hook Present Engine 6/9/2012
Code:
#include <windows.h>
#include <d3d9.h>
#include <d3dx9.h>
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
#define PresentEngine 0x004C41AF
DWORD retPresentEngine = ( PresentEngine + 0x5 );
#define Red D3DCOLOR_ARGB( 255, 255, 000, 000 )
#define Green D3DCOLOR_ARGB( 255, 000, 255, 000 )
#define Blue D3DCOLOR_ARGB( 255, 000, 000, 255 )
#define Black D3DCOLOR_ARGB( 255, 000, 000, 000 )
LPD3DXFONT Font;
VOID StartFont( LPDIRECT3DDEVICE9 pDevice )
{
if( Font )
{
Font->Release();
Font = NULL;
}
if( !Font )
{
D3DXCreateFont( pDevice,
14,
0,
FW_BOLD,
1,
0,
DEFAULT_CHARSET,
OUT_DEFAULT_PRECIS,
DEFAULT_QUALITY,
DEFAULT_PITCH | FF_DONTCARE,
"Arial",
&Font );
}
}
VOID WriteText( LPDIRECT3DDEVICE9 pDevice, INT x, INT y, DWORD color, CHAR *text )
{
RECT rect;
SetRect( &rect, x, y, x, y );
Font->DrawText( NULL, text, -1, &rect, DT_NOCLIP | DT_LEFT, color );
}
__declspec( naked ) HRESULT WINAPI PresentMidfunction( )
{
static LPDIRECT3DDEVICE9 pDevice;
__asm
{
MOV ECX, DWORD PTR DS:[EAX]
MOV EDX, DWORD PTR DS:[ECX + 0x44]
MOV DWORD PTR DS:[pDevice], EAX
PUSH 0
PUSHAD
}
StartFont( pDevice );
if( Font )
WriteText( pDevice, 300, 300, Red, "CrossFire: Hook Present Engine" );
__asm
{
POPAD
JMP retPresentEngine
}
}
VOID *DetourCreate( BYTE *src, CONST BYTE *dst, CONST INT len )
{
BYTE *jmp =( BYTE * ) malloc( len + 5 );
DWORD dwBack;
VirtualProtect( src, len, PAGE_READWRITE, &dwBack );
memcpy( jmp, src, len );
jmp += len;
jmp[0] = 0xE9;
*( DWORD * )( jmp + 1 ) = ( DWORD )( src + len - jmp ) - 5;
src[0] = 0xE9;
*( DWORD * )( src + 1 ) = ( DWORD )( dst - src ) - 5;
for( INT i = 5; i < len; i++ )
src[i] = 0x90;
VirtualProtect( src, len, dwBack, &dwBack );
return( jmp - len );
}
DWORD WINAPI StartRoutine( LPVOID )
{
while( TRUE )
{
if( memcmp( ( VOID * )PresentEngine, ( VOID * )( PBYTE )"\x8B\x51", 2 ) == 0 )
{
Sleep( 100 );
DetourCreate( ( PBYTE )PresentEngine, ( PBYTE )PresentMidfunction, 5 );
}
Sleep( 50 );
}
return 0;
}
BOOL WINAPI DllMain( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
if( dwReason == DLL_PROCESS_ATTACH )
{
DisableThreadLibraryCalls( hDll );
MessageBox( 0, "Hook Present Engine", "Crossfire", 0 );
CreateThread( 0, 0, (LPTHREAD_START_ROUTINE)StartRoutine, 0, 0, 0 );
}
return TRUE;
}
Code:
Present: 004C40C0 6A FF PUSH -1 004C40C2 68 78DC6200 PUSH 62DC78 004C40C7 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 004C40CD 50 PUSH EAX 004C40CE 51 PUSH ECX 004C40CF A1 40446A00 MOV EAX,DWORD PTR DS:[6A4440] 004C40D4 33C4 XOR EAX,ESP 004C40D6 50 PUSH EAX 004C40D7 8D4424 08 LEA EAX,DWORD PTR SS:[ESP+8] 004C40DB 64:A3 00000000 MOV DWORD PTR FS:[0],EAX 004C40E1 68 F82F6C00 PUSH 6C2FF8 004C40E6 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8] 004C40EA E8 E12BF5FF CALL 416CD0 004C40EF C74424 10 00000000 MOV DWORD PTR SS:[ESP+10],0 004C40F7 A1 702E6C00 MOV EAX,DWORD PTR DS:[6C2E70]=> DeviceGame 004C40FC 85C0 TEST EAX,EAX 004C40FE 0F84 CB000000 JE 4C41CF 004C4104 F64424 18 04 TEST BYTE PTR SS:[ESP+18],4 004C4109 74 0A JE SHORT 4C4115 004C410B E8 C0EAFFFF CALL 4C2BD0 004C4110 E9 A6000000 JMP 4C41BB 004C4115 803D 1B536B00 00 CMP BYTE PTR DS:[6B531B],0 004C411C 8B00 MOV EAX,DWORD PTR DS:[EAX] 004C411E 8B08 MOV ECX,DWORD PTR DS:[EAX] 004C4120 6A 00 PUSH 0 004C4122 0F84 87000000 JE 4C41AF 004C4128 803D 40556B00 00 CMP BYTE PTR DS:[6B5540],0 004C412F 74 7E JE SHORT 4C41AF 004C4131 8B15 D04D6B00 MOV EDX,DWORD PTR DS:[6B4DD0] 004C4137 52 PUSH EDX 004C4138 68 C04D6B00 PUSH 6B4DC0 004C413D 68 C04D6B00 PUSH 6B4DC0 004C4142 50 PUSH EAX 004C4143 8B41 44 MOV EAX,DWORD PTR DS:[ECX+44] 004C4146 FFD0 CALL EAX 004C4148 8B0D 702E6C00 MOV ECX,DWORD PTR DS:[6C2E70] 004C414E 8B01 MOV EAX,DWORD PTR DS:[ECX] 004C4150 8B0D D04D6B00 MOV ECX,DWORD PTR DS:[6B4DD0] 004C4156 8B10 MOV EDX,DWORD PTR DS:[EAX] 004C4158 8B52 44 MOV EDX,DWORD PTR DS:[EDX+44] 004C415B 6A 00 PUSH 0 004C415D 51 PUSH ECX 004C415E 68 E84D6B00 PUSH 6B4DE8 004C4163 68 E84D6B00 PUSH 6B4DE8 004C4168 50 PUSH EAX 004C4169 FFD2 CALL EDX 004C416B 8B15 D04D6B00 MOV EDX,DWORD PTR DS:[6B4DD0] 004C4171 A1 702E6C00 MOV EAX,DWORD PTR DS:[6C2E70] 004C4176 8B00 MOV EAX,DWORD PTR DS:[EAX] 004C4178 8B08 MOV ECX,DWORD PTR DS:[EAX] 004C417A 6A 00 PUSH 0 004C417C 52 PUSH EDX 004C417D 68 FC4D6B00 PUSH 6B4DFC 004C4182 68 FC4D6B00 PUSH 6B4DFC 004C4187 50 PUSH EAX 004C4188 8B41 44 MOV EAX,DWORD PTR DS:[ECX+44] 004C418B FFD0 CALL EAX 004C418D 8B0D 702E6C00 MOV ECX,DWORD PTR DS:[6C2E70] 004C4193 8B01 MOV EAX,DWORD PTR DS:[ECX] 004C4195 8B0D D04D6B00 MOV ECX,DWORD PTR DS:[6B4DD0] 004C419B 8B10 MOV EDX,DWORD PTR DS:[EAX] 004C419D 8B52 44 MOV EDX,DWORD PTR DS:[EDX+44] 004C41A0 6A 00 PUSH 0 004C41A2 51 PUSH ECX 004C41A3 68 D84D6B00 PUSH 6B4DD8 004C41A8 68 D84D6B00 PUSH 6B4DD8 004C41AD EB 09 JMP SHORT 4C41B8 004C41AF 8B51 44 MOV EDX,DWORD PTR DS:[ECX+44]=> Present 004C41B2 6A 00 PUSH 0 004C41B4 6A 00 PUSH 0 004C41B6 6A 00 PUSH 0 004C41B8 50 PUSH EAX 004C41B9 FFD2 CALL EDX 004C41BB B8 702E6C00 MOV EAX,6C2E70 004C41C0 E8 9B20F9FF CALL 456260 004C41C5 C705 54556B00 00000000 MOV DWORD PTR DS:[6B5554],0 004C41CF 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4] 004C41D3 E8 182BF5FF CALL 416CF0 004C41D8 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 004C41DC 64:890D 00000000 MOV DWORD PTR FS:[0],ECX 004C41E3 59 POP ECX 004C41E4 83C4 10 ADD ESP,10 004C41E7 C3 RETN
Code:
Pattern Scan for to update adress PresentEngine: \x8B\x51\x00\x6A\x00\x6A\x00\x6A\x00\x50\xFF\xD2\xB8\x00\x00\x00\x00\xE8\x00\x00\x00\x00\xC7\x05\x00\x00\x00\x00 xx?x?x?x?xxxx????x????xx????
Code:
Binary Scan for to update adress PresentEngine: 8B 51 ?? 6A ?? 6A ?? 6A ?? 50 FF D2 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ??
Credits:
Detour -> Azorbix
Midfunction -> Shad0w_
Me -> WE11ington
Thank you 
You just need to build menu class & etc, or use other public d3d bases.
Originally Posted by Avene
ⓘYou just need to build menu class & etc, or use other public d3d bases.
THIS IS GOOD FUCKING WORK!!
I wish i could do this by myself
i have my own menu and stuff, but my problem is i dont know how to hook and stuff
, it would be really really appreciated if you can teach me how to hookand stuff i know almost everything about C++ and D3D programming
omg cant believe you did that again lol
Originally Posted by giniyat101
omg cant believe you did that again lol
nice copy pasta from other site
Leechers!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!
This was already patched while ago in other version...
detected for CF NA , also what's the injector u use
Originally Posted by Ryuesi
detected for CF NA , also what's the injector u use
Originally Posted by Avene
hack tool detected? or what error?
LEECHED ONLY. . . .
What detours work?
