Present Hook + Modo Patterno

#include <Windows.h>
#include <d3d9.h>

#pragma comment(lib, "d3d9.lib")

#include "p_D3D.h"

DWORD dwLTClientEXE = NULL;
DWORD dwPresent_Ret = NULL;

void _cdecl PushToConsole ( const char * command )
{
	__asm
	{
		PUSH command
		MOV EAX, dwLTClientEXE 
		CALL EAX
		ADD ESP, 0x4
	}
}

VOID WINAPI hkPresent(LPDIRECT3DDEVICE9 pDevice, const RECT *a, const RECT *b, HWND c, const RGNDATA *d)
{
	DWORD EngineAddr = (DWORD)GetModuleHandle("Engine.exe");

	while( dwLTClientEXE == NULL )
	{
		dwLTClientEXE = FindPattern( EngineAddr, 0x328200, (BYTE *)PATT_CONSOLE, MASK_CONSOLE );

		if(dwLTClientEXE > 0)
			dwLTClientEXE += 0x47;
	}

     PushToConsole( ChamsLig ); 
}

_declspec(naked) void PresentHook()
{
    _asm
	{
        MOV EDI,DWORD PTR SS:[EBP+0x8]
        TEST EDI,EDI
            PUSHFD
            PUSHAD    
            PUSH [EBP+0x18]// D        
        PUSH [EBP+0x14]// C    
        PUSH [EBP+0x10]// B        
        PUSH [EBP+0x0C]// A
        PUSH [EBP+0x08]// Device        
        CALL hkPresent
        POPAD
            POPFD
            jmp dwPresent_Ret
    }
}

VOID CreateDevice(DWORD *dwVTable)
{
    LPDIRECT3D9 pD3d9;
    LPDIRECT3DDEVICE9 pD3DDevice;
    pD3d9 = Direct3DCreate9(D3D_SDK_VERSION);
    if(pD3d9 == NULL)
        return;
    D3DPRESENT_PARAMETERS pPresentParms;
    ZeroMemory(&pPresentParms, sizeof(pPresentParms));
    pPresentParms.Windowed = TRUE;
    pPresentParms.BackBufferFormat = D3DFMT_UNKNOWN;
    pPresentParms.SwapEffect = D3DSWAPEFFECT_DISCARD;
    if(FAILED(pD3d9->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, GetDesktopWindow(), D3DCREATE_SOFTWARE_VERTEXPROCESSING, &pPresentParms, &pD3DDevice)))
        return;
    DWORD *dwTable = (DWORD *)pD3DDevice;
    dwTable = (DWORD *) dwTable[0];
    dwVTable[1] = dwTable[17];//Present
}

DWORD WINAPI Hook(LPVOID lpArgs)
{
    while( GetModuleHandle("d3d9.dll") == NULL)
        Sleep(250);

    DWORD dwVtbl[3] = {0};

    CreateDevice(dwVtbl);

    DWORD PSHOOK = dwVtbl[1] + 0x7;
    dwPresent_Ret = PSHOOK + 0x5; 

JumpFunction( (BYTE *)PSHOOK, (BYTE *)&PresentHook, 5);

    return 0;
}  

BOOL APIENTRY DllMain ( HMODULE hDll, DWORD dwReason, LPVOID )
{
	DisableThreadLibraryCalls(hDll);

	if( dwReason == 1 )
		CreateThread(0, 0, (LPTHREAD_START_ROUTINE) Hook, 0, 0, 0);

	return 1;
}

#define PATT_CONSOLE "\xC7\x5\x00\x00\x00\x00\x00\x00\x00\x00\xC7\x5\x00\x00\x00\x00\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x83\xC4\x00\x68\x00\x00\x00\x00\xB9\x00\x00\x00\x00\xE8\x00\x00\x00\x00\xC3\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\x68\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x59\xC3\xCC\xCC\xCC\xCC\x8B\x44\x24\x00"
#define MASK_CONSOLE "xx????????xx????????x????xx?x????x????x????xxxxxxxxxxxxx????x????xxxxxxxxx"

void *JumpFunction(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp = (BYTE*)malloc(len+5);
	DWORD dwBack;

	VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &dwBack);
	memcpy(jmp, src, len);	
	jmp += len;
	jmp[0] = 0xE9;
	*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
	src[0] = 0xE9;
	*(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
	for (int i=5; i<len; i++)  src[i]=0x90;
	VirtualProtect(src, len, dwBack, &dwBack);
	return (jmp-len);
}

bool bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
	for(;*szMask;++szMask,++pData,++bMask)
		if(*szMask=='x' && *pData!=*bMask)  
			return 0;
	return (*szMask) == NULL;
}

DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
	for(DWORD i=0; i<dwLen; i++)
		if (bCompare((BYTE*)(dwAddress+i),bMask,szMask))  
			return (DWORD)(dwAddress+i);
	return 0;
}

#define ChamsLig "SkelModelStencil 1"
#define ChamsDes "SkelModelStencil 0"