Start3D Engine Hook

Combat Arms Brazil:

005382A0   . 833D F83E7700 >CMP DWORD PTR DS:[773EF8],0
005382A7   . 75 36          JNZ SHORT Engine-u.005382DF
005382A9   . 6A 49          PUSH 49
005382AB   . E8 C09BF6FF    CALL Engine-u.004A1E70
005382B0   . 83C4 04        ADD ESP,4
005382B3   . 833D 60BC7600 >CMP DWORD PTR DS:[76BC60],1
005382BA   . 7C 1D          JL SHORT Engine-u.005382D9
005382BC   . A1 4C207400    MOV EAX,DWORD PTR DS:[74204C]
005382C1   . 68 98E76E00    PUSH Engine-u.006EE798
005382C6   . 68 00E86E00    PUSH Engine-u.006EE800                   ;  ASCII "LT_NOTINITIALIZED"
005382CB   . 68 18BE6F00    PUSH Engine-u.006FBE18                   ;  ASCII "Start3D"
005382D0   . 50             PUSH EAX
005382D1   . E8 BAA7F6FF    CALL Engine-u.004A2A90
005382D6   . 83C4 10        ADD ESP,10
005382D9   > B8 49000000    MOV EAX,49
005382DE   . C3             RETN
005382DF   > A1 003F7700    MOV EAX,DWORD PTR DS:[773F00]            => Hook start
005382E4   . 40             INC EAX
005382E5   . A3 003F7700    MOV DWORD PTR DS:[773F00],EAX
005382EA   . 83F8 01        CMP EAX,1
005382ED   . 75 06          JNZ SHORT Engine-u.005382F5              => Hook return
005382EF   . FF15 503F7700  CALL DWORD PTR DS:[773F50]
005382F5   > 33C0           XOR EAX,EAX
005382F7   . C3             RETN

DWORD DeviceGame = 0x877E58; // CA[BR]

DWORD Start3D = 0x5382DF; // CA[BR]
DWORD retStart3D = (Start3D + 0xE);

LPD3DXFONT D3DDirectxFont;
BOOL D3DFontBoolean;

VOID StartFont(LPDIRECT3DDEVICE9 pDevice)
{
	if(D3DDirectxFont)
	{
		D3DDirectxFont->Release();
		D3DDirectxFont = NULL;
		D3DFontBoolean = FALSE;
	}

	if(!D3DFontBoolean)
	{
		D3DXCreateFont(pDevice, 12, 0, 350, 1, 0, 1, 0, 4, 0 | (0<<4), "Arial", &D3DDirectxFont);
		D3DFontBoolean = TRUE;
	}
}

VOID DrawText(INT x, INT y, DWORD Color, CHAR *Text)
{
	RECT Rect;
	SetRect(&Rect, x, y, x, y);
	D3DDirectxFont->DrawText(NULL, Text, -1, &Rect, DT_LEFT | DT_NOCLIP, Color);
}

__declspec(naked)HRESULT WINAPI Start3DMidfunction(VOID)
{
	static LPDIRECT3DDEVICE9 pDevice;

	__asm
	{
		MOV EAX, DWORD PTR DS:[0x773F00]
		INC EAX
		MOV DWORD PTR DS:[0x773F00], EAX
		CMP EAX, 1
		PUSHAD
	}

	if(!pDevice)
		pDevice = **(LPDIRECT3DDEVICE9 **)DeviceGame;
	else
	{
		StartFont(pDevice);

		pDevice->SetRenderState(D3DRS_ZENABLE, D3DZB_FALSE);

		DrawText(50, 50, 0xFFFF0000, "Start3D Engine Hooking");
		DrawText(50, 70, 0xFF0000FF, "Credits: luizimloko => Start3D, Shad0w_ => Midfunction example");

		pDevice->SetRenderState(D3DRS_ZENABLE, D3DZB_TRUE);
	}

	__asm
	{
		POPAD
		JMP DWORD PTR DS:[retStart3D];
	}
}

DWORD WINAPI dwEngineHooking(PVOID)
{
	while(1)
	{
		if(memcmp((PVOID)Start3D, (PVOID)(PBYTE)"\xA1", 1) == 0)
		{
			Sleep(100);
			DetourCreate((PBYTE)Start3D, (PBYTE)Start3DMidfunction, 14);
		}
		Sleep(50);
	}
	return EXIT_SUCCESS;
}

BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
{
	if(dwReason == DLL_PROCESS_ATTACH)
	{
                DisableThreadLibraryCalls(hModule);
		CreateThread(NULL, NULL, &dwEngineHooking, NULL, NULL, NULL);
	}

	return TRUE;
}

Binary Scan: A1 ?? ?? ?? ?? 40 A3 ?? ?? ?? ?? 83 F8 01 75 06 FF 15 ?? ?? ?? ?? 33 C0 C3 CC CC CC CC CC CC CC CC