MPGHThe Dark Arts
RegisterLog in

Helpsimple "no fog"

Posts 1–12 of 12 · Page 1 of 1
simple "no fog"
Code:
#include <stdio.h>
#include <fstream>


#include <d3d9.h>
#include <d3dx9.h>
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")

	typedef HRESULT (WINAPI* tDrawIndexedPrimitive)(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE PrimType,INT BaseVertexIndex,UINT MinVertexIndex,UINT NumVertices,UINT startIndex,UINT primCount);
	tDrawIndexedPrimitive oDrawIndexedPrimitive = NULL;
	HRESULT WINAPI hkDrawIndexedPrimitive(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE PrimType,INT BaseVertexIndex,UINT MinVertexIndex,UINT NumVertices,UINT startIndex,UINT primCount)
	{
		pDevice->SetRenderState(D3DRS_FOGENABLE, FALSE);

	return oDrawIndexedPrimitive(pDevice, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
	}
this is my full code of "no fog" (without dllmain). it inject sussesfully, but the fog still in the game, what i'm doing wrong?
#1 ·
Well, some tips from me:
1. This is detected, so dont try it xD
2. You should show your hook so I can help you
3. Look at the ptc method for this
4. NoFog also works when you hook drawtexture (just a tip how I got my chams working)
#2 ·
Quote Originally Posted by Ch40zz-C0d3r View Post
Well, some tips from me:
1. This is detected, so dont try it xD
2. You should show your hook so I can help you
3. Look at the ptc method for this
4. NoFog also works when you hook drawtexture (just a tip how I got my chams working)
1 im using it for another game and i'm not being disconnected.
2 im using http://www.mpgh.net/forum/207-combat...menu-base.html

Code:
/************************************************************************/
/* HOOK                                                                 */
/************************************************************************/
bool HookEndscene()
{
	DWORD D3D9 = (DWORD)LoadLibrary(TEXT("d3d9.dll"));
	if (D3D9)
	{
		DWORD* Addr = *(DWORD**)(FindPattern(D3D9, 0x150000, (BYTE*)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx")+2);
		if (Addr)
		{
			DWORD dwOld;
			_EndScene = Addr[42];
			VirtualProtect((VOID*)(_EndScene+12), 1, PAGE_EXECUTE_READWRITE, &dwOld);
			*(BYTE*)(_EndScene+12) = 0x90;
			VirtualProtect((VOID*)(_EndScene+12), 1, dwOld, &dwOld);
			return true;
		}
	}
	return false;
}

/************************************************************************/
/* EXCEPTION HANDLER                                                    */
/************************************************************************/
LONG CALLBACK Handler(PEXCEPTION_POINTERS Info)
{
	if (Info->ExceptionRecord->ExceptionCode != EXCEPTION_ACCESS_VIOLATION)
	{
		return EXCEPTION_CONTINUE_SEARCH;
	}

	if ((DWORD)Info->ExceptionRecord->ExceptionAddress == _EndScene+13)
	{
		Info->ContextRecord->Eip = (DWORD)Pre_EndScene;
		return EXCEPTION_CONTINUE_EXECUTION;
	}
	return EXCEPTION_CONTINUE_SEARCH;
}

/************************************************************************/
/* MAINTHREAD                                                           */
/************************************************************************/
DWORD WINAPI MyMainThread(LPVOID)
{
	#ifdef CA
	while ( !IsGameReadyToBeHooked() )
		Sleep(25);
	#endif

	main = new cMain();
	menu = new cMenu();
	d3d = new cD3D();

	if(main && menu && d3d)
	{
		if(HookEndscene())
			AddVectoredExceptionHandler(1, Handler);
	}

	return true;
}

/************************************************************************/
/* DLL MAIN                                                             */
/************************************************************************/
BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
	DisableThreadLibraryCalls(hDll);
	switch( dwReason )
	{
	case DLL_PROCESS_ATTACH:
		CreateThread(NULL, NULL, MyMainThread, NULL, NULL, NULL);
		break;
	}
	return true;
}

#3 ·
Quote Originally Posted by cannonpas View Post
1 im using it for another game and i'm not being disconnected.
2 im using http://www.mpgh.net/forum/207-combat...menu-base.html

Code:
/************************************************************************/
/* HOOK                                                                 */
/************************************************************************/
bool HookEndscene()
{
	DWORD D3D9 = (DWORD)LoadLibrary(TEXT("d3d9.dll"));
	if (D3D9)
	{
		DWORD* Addr = *(DWORD**)(FindPattern(D3D9, 0x150000, (BYTE*)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx")+2);
		if (Addr)
		{
			DWORD dwOld;
			_EndScene = Addr[42];
			VirtualProtect((VOID*)(_EndScene+12), 1, PAGE_EXECUTE_READWRITE, &dwOld);
			*(BYTE*)(_EndScene+12) = 0x90;
			VirtualProtect((VOID*)(_EndScene+12), 1, dwOld, &dwOld);
			return true;
		}
	}
	return false;
}

/************************************************************************/
/* EXCEPTION HANDLER                                                    */
/************************************************************************/
LONG CALLBACK Handler(PEXCEPTION_POINTERS Info)
{
	if (Info->ExceptionRecord->ExceptionCode != EXCEPTION_ACCESS_VIOLATION)
	{
		return EXCEPTION_CONTINUE_SEARCH;
	}

	if ((DWORD)Info->ExceptionRecord->ExceptionAddress == _EndScene+13)
	{
		Info->ContextRecord->Eip = (DWORD)Pre_EndScene;
		return EXCEPTION_CONTINUE_EXECUTION;
	}
	return EXCEPTION_CONTINUE_SEARCH;
}

/************************************************************************/
/* MAINTHREAD                                                           */
/************************************************************************/
DWORD WINAPI MyMainThread(LPVOID)
{
	#ifdef CA
	while ( !IsGameReadyToBeHooked() )
		Sleep(25);
	#endif

	main = new cMain();
	menu = new cMenu();
	d3d = new cD3D();

	if(main && menu && d3d)
	{
		if(HookEndscene())
			AddVectoredExceptionHandler(1, Handler);
	}

	return true;
}

/************************************************************************/
/* DLL MAIN                                                             */
/************************************************************************/
BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
	DisableThreadLibraryCalls(hDll);
	switch( dwReason )
	{
	case DLL_PROCESS_ATTACH:
		CreateThread(NULL, NULL, MyMainThread, NULL, NULL, NULL);
		break;
	}
	return true;
}

Ahhh, the @matypatty way
#4 ·
Quote Originally Posted by OpKilts View Post
Ahhh, the @matypatty way
Also known as Structured Exception Handling
#5 ·
Quote Originally Posted by Saltine View Post

Also known as Structured Exception Handling
I guess it got out
#6 ·
Quote Originally Posted by Flengo View Post


I guess it got out
Yea I stuck it in my menu base

Pretty sure nofog is possible via puchtoconsole (not sure after this new ptc shit, havent kept up with the changes) which would be the preferred method as nexon protects DIP as much as it protects its employees virginity's.
#7 ·
well i dont know much about programmer JOB but i think when you are a full time coder and are paid to do that... your virginity is hard to lose...
#8 ·
Well, thanks for posting hook.
It seems like you are only hooking endscene xD
As maty points out dip hooking is the hardest job on this game. I wasted 2 days doing it, and got it working 2 ways.
But full chams are not possibile with my method. (but which means nofog would work)

Quote Originally Posted by Flengo View Post


I guess it got out
Its easier as you think. You take an address and use VirtualProtect to protect this address with read/write flags so any access results in an application crash. Thats why you install a "VectoredExceptionHandler". Instead of crashing the application runs that.
Now you can check different things like the ExceptionAddress or ExceptionCode. Also you can CHNAGE data like EIP from ContextRecord pointer. The awesome thing is, if you know a bit asm, EIP is the register which says whats the next line to continue. It behaves like a JMP without memory modification
#9 · edited ·
So I have a working DIP hook and the good old chams, but first I had to write a driver that does a ssdt hook on getcontextthread, so that it returns that no debug registers are changed... and then a simple hwbp hook on DIP ...I know the way is quite complicated in comparision how easy it was to hook DIP some time ago
#10 ·
Quote Originally Posted by BadBurrito View Post
So I have a working DIP hook and the good old chams, but first I had to write a driver that does a ssdt hook on getcontextthread, so that it returns that no debug registers are changed... and then a simple hwbp hook on DIP ...I know the way is quite complicated in comparision how easy it was to hook DIP some time ago
Well I think there is no way without coding a bypass.
#11 ·
Quote Originally Posted by Ch40zz-C0d3r View Post
Well I think there is no way without coding a bypass.
Hooking DIP the "normal" way is still undetected for NA, on the other hand EU requires a bypass since it crashes after about 10 seconds.
#12 ·
Posts 1–12 of 12 · Page 1 of 1

Post a Reply

Similar Threads

Spammers CornerFavorite QuoteEleMentX 13 Combat Arms Europe Hacks😎 Combat Arms EU Simple Chams,No Fog,WallhackKEkellermanz 1 GeneralWhen I quote people it quotes in my colour?HysteriaHysteria 2 EntertainmentMPGH IRC Chat Quote Threadi eat treesi eat trees 746 EntertainmentMPGH AIM Chat Quote Threadace76543ace76543 30

Tags for this Thread

None

Talk with us