[Tutorial]Creating D3D8 Base | Wallhack

[Voltage552]

YOU MUST DO THIS FIRST

INSTALLING VISUAL C++ 2008

LINK : https://www.microsof*****m/express/Dow...008-Visual-CPP
HOW-TO : Select Visual C++ 2008 Express Edition under Visual Studios 2008 Express and click Free Download

INSTALLING DIRECT-X SDK

LINK : https://www.microsof*****m/downloads/d...displaylang=en
HOW-TO : Click download and install this SDK

ADDING DIRECT-X INCLUDE FILES IN VC++

STEP 1. Install Direct-X SDK
STEP 2. Open VC++
STEP 3. Select Tools -> Option -> Projects and Solutions -> VC++ Directories
STEP 4. In VC ++ Directories, go to the drop-down menu and select Include Files
STEP 5. Add the code below

C:\Program Files\Microsoft DirectX 9.0 SDK (Summer 2004)\Include

ADDING DIRECT-X LIBRARY FILES IN VC++

STEP 1. Install Direct-X SDK
STEP 2. Open VC++
STEP 3. Select Tools -> Option -> Projects and Solutions -> VC++ Directories
STEP 4. In VC ++ Directories, go to the drop-down menu and select Library Files
STEP 5. Add the code below

C:\Program Files\Microsoft DirectX 9.0 SDK (Summer 2004)\Lib

--------------------------------------

Here's a tutorial on how to create a d3d8 / Sudden attack base!

---------------------------------------------

Open up Visual C++ 2008
Create: Project...
Choose Win32 Console Application
If you do not see it, look at Project types and click on Visual C++

Screenshot


You should see the picture below be presented on your Visual C++
Press NEXT

Screenshot


Do not touch anything else. Application type - Select "DLL"
Press FINISH

Screenshot


You should see the screenshot below presented on your Visual C++
Right click and remove dllmain.cpp*
* - Remove because it is already defined in the base source I will give you.

Screenshot


Click the green arrow on the top to debug / release. Alternately, you can just build / rebuild (for those who know how to use C++ IDE)

Screenshot


---------------------------------------------
Base Source Code
---------------------------------------------
Replace your main cpp file with this.

#include "stdafx.h"
#include <windows.h>

#include <d3d8.h>
#pragma comment(lib, "d3d8.lib")

typedef HRESULT (WINAPI* CreateDevice_Prototype)        (LPDIRECT3D8, UINT, D3DDEVTYPE, HWND, DWORD, D3DPRESENT_PARAMETERS*, LPDIRECT3DDEVICE8*);
typedef HRESULT (WINAPI* Reset_Prototype)               (LPDIRECT3DDEVICE8, D3DPRESENT_PARAMETERS*);
typedef HRESULT (WINAPI* EndScene_Prototype)            (LPDIRECT3DDEVICE8);
typedef HRESULT (WINAPI* DrawIndexedPrimitive_Prototype)(LPDIRECT3DDEVICE8, D3DPRIMITIVETYPE, UINT, UINT, UINT, UINT);

CreateDevice_Prototype         CreateDevice_Pointer         = NULL;
Reset_Prototype                Reset_Pointer                = NULL;
EndScene_Prototype             EndScene_Pointer             = NULL;
DrawIndexedPrimitive_Prototype DrawIndexedPrimitive_Pointer = NULL;

HRESULT WINAPI Direct3DCreate8_VMTable    (VOID);
HRESULT WINAPI CreateDevice_Detour        (LPDIRECT3D8, UINT, D3DDEVTYPE, HWND, DWORD, D3DPRESENT_PARAMETERS*, LPDIRECT3DDEVICE8*);
HRESULT WINAPI Reset_Detour               (LPDIRECT3DDEVICE8, D3DPRESENT_PARAMETERS*);
HRESULT WINAPI EndScene_Detour            (LPDIRECT3DDEVICE8);
HRESULT WINAPI DrawIndexedPrimitive_Detour(LPDIRECT3DDEVICE8, D3DPRIMITIVETYPE, UINT, UINT, UINT, UINT);

PDWORD Direct3D_VMTable = NULL; 

BOOL WINAPI DllMain(HINSTANCE hinstModule, DWORD dwReason, LPVOID lpvReserved)
{
  if(dwReason == DLL_PROCESS_ATTACH)
  {
    DisableThreadLibraryCalls(hinstModule);

    if(Direct3DCreate8_VMTable() == D3D_OK)
    return TRUE;
  }

  return FALSE;
}

HRESULT WINAPI Direct3DCreate8_VMTable(VOID)
{
  LPDIRECT3D8 Direct3D_Object = Direct3DCreate8(D3D_SDK_VERSION);

  if(Direct3D_Object == NULL)
  return D3DERR_INVALIDCALL;
  
  Direct3D_VMTable = (PDWORD)*(PDWORD)Direct3D_Object;
  Direct3D_Object->Release();

  DWORD dwProtect;

  if(VirtualProtect(&Direct3D_VMTable[15], sizeof(DWORD), PAGE_READWRITE, &dwProtect) != 0)
  {
    *(PDWORD)&CreateDevice_Pointer = Direct3D_VMTable[15];
    *(PDWORD)&Direct3D_VMTable[15] = (DWORD)CreateDevice_Detour;

    if(VirtualProtect(&Direct3D_VMTable[15], sizeof(DWORD), dwProtect, &dwProtect) == 0)
    return D3DERR_INVALIDCALL;
  }
  else
  return D3DERR_INVALIDCALL;

  return D3D_OK;
}

HRESULT WINAPI CreateDevice_Detour(LPDIRECT3D8 Direct3D_Object, UINT Adapter, D3DDEVTYPE DeviceType, HWND FocusWindow, 
					DWORD BehaviorFlags, D3DPRESENT_PARAMETERS* PresentationParameters, 
					LPDIRECT3DDEVICE8* Returned_Device_Interface)
{
  HRESULT Returned_Result = CreateDevice_Pointer(Direct3D_Object, Adapter, DeviceType, FocusWindow, BehaviorFlags, 
	                                          PresentationParameters, Returned_Device_Interface);

  DWORD dwProtect;

  if(VirtualProtect(&Direct3D_VMTable[15], sizeof(DWORD), PAGE_READWRITE, &dwProtect) != 0)
  {
    *(PDWORD)&Direct3D_VMTable[15] = *(PDWORD)&CreateDevice_Pointer;
    CreateDevice_Pointer           = NULL;

    if(VirtualProtect(&Direct3D_VMTable[15], sizeof(DWORD), dwProtect, &dwProtect) == 0)
    return D3DERR_INVALIDCALL;
  }
  else
  return D3DERR_INVALIDCALL;

  if(Returned_Result == D3D_OK)
  {
    Direct3D_VMTable = (PDWORD)*(PDWORD)*Returned_Device_Interface;

    *(PDWORD)&Reset_Pointer                = (DWORD)Direct3D_VMTable[14];
    *(PDWORD)&EndScene_Pointer             = (DWORD)Direct3D_VMTable[35];
    *(PDWORD)&DrawIndexedPrimitive_Pointer = (DWORD)Direct3D_VMTable[71];

    *(PDWORD)&Direct3D_VMTable[14] = (DWORD)Reset_Detour;
    *(PDWORD)&Direct3D_VMTable[35] = (DWORD)EndScene_Detour;
    *(PDWORD)&Direct3D_VMTable[71] = (DWORD)DrawIndexedPrimitive_Detour;
  }
    
  return Returned_Result;
}

HRESULT WINAPI Reset_Detour(LPDIRECT3DDEVICE8 Device_Interface, D3DPRESENT_PARAMETERS* PresentationParameters)
{
  return Reset_Pointer(Device_Interface, PresentationParameters);
}

HRESULT WINAPI EndScene_Detour(LPDIRECT3DDEVICE8 Device_Interface)
{
  return EndScene_Pointer(Device_Interface);
}

HRESULT WINAPI DrawIndexedPrimitive_Detour(LPDIRECT3DDEVICE8 Device_Interface, D3DPRIMITIVETYPE Type, 
                                           UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount)
{
  LPDIRECT3DVERTEXBUFFER8 Stream_Data;
  UINT Stride = 0;

  if(Device_Interface->GetStreamSource(0, &Stream_Data, &Stride) == D3D_OK)
  Stream_Data->Release();
  //code
  return DrawIndexedPrimitive_Pointer(Device_Interface, Type, MinIndex, NumVertices, StartIndex, PrimitiveCount);
}

Enjoy your Base!
-Voltage552

I have no idea where the heck this base is from. It was somewhere in my harddrive.

--
How to add WALLHACK
Look at this piece of code right here in the base

HRESULT WINAPI DrawIndexedPrimitive_Detour(LPDIRECT3DDEVICE8 Device_Interface, D3DPRIMITIVETYPE Type, 
                                           UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount)
{
  LPDIRECT3DVERTEXBUFFER8 Stream_Data;
  UINT Stride;

  if(Device_Interface->GetStreamSource(0, &Stream_Data, &Stride) == D3D_OK)
  Stream_Data->Release();
  //code
  return DrawIndexedPrimitive_Pointer(Device_Interface, Type, MinIndex, NumVertices, StartIndex, PrimitiveCount);
}

Now, look more closely at the following.

//code

INFO
Stride 40 and 44 are the body model of Sudden Attack. (One's upper, one's lower)
WALL HACK ---
Add this below the "//code"

bool wallhack;
if(Stride == 40 && wallhack || Stride == 44 && wallhack)
{
   Device_Interface->SetRenderState(D3DRS_ZENABLE, D3DZB_FALSE);
}

To make this work, you need to add a hotkey.

Add this below the wallhack code.

if ((GetAsyncKeyState(VK_NUMPAD1)&1) == 1) //Numpad 1
     wallhack = !wallhack;//Start Wallhack

If you press NUMPAD 1, wallhack will start.


--Enjoy-- Voltage552
Originally wrote for SANA section , but re-posted here since it fits here too.

[why06]

The base just mysteriously showed up on your harddrive hmmmm? I would prefer if you had some idea who wrote this code, but I know they too, probably took most of it from some one else's detouring method. However the tutorial is yours even if the code is not. I'll leave it for now, unless too many people object.


Also I have a question. Does anyone know if this macro: Direct3DCreate8(D3D_SDK_VERSION);
will always return the current D3D object, even if another one was already created? Because that's how this guy detoured all these functions. With pointers to different functions. The technique is actually pretty amazing. Has a certain beauty to it you know... =/

[Voltage552]

Well, it didn't mysteriously appear. I was looking through it and found this base among some other bases. It was quite simple so I just put it here. If anyone knows who made it, I'll be glad to put the credits here.

[comwhat]

1>c:\documents and settings\tera\my documents\visual studio 2008\projects\koreak\koreak\koreak.cpp(122) : warning C4700: uninitialized local variable 'wallhack' used

what's the matter??

[Void]

@Why's question.

Modules are only loaded once, he creates a IDirect3D8 object so he could find the CreateDevice address, nothing more. I can tell this is copy and pasted, hooking CreateDevice to get the device address won't for CA ( well atleast not for me ) and probably a lot of other games, it seems to be detected.

By the way, for you people using Direct3D 9 and not 8. CreateDevice is the 16th on the virtual table for IDirect3D9.

[treeham]

1>c:\documents and settings\tera\my documents\visual studio 2008\projects\koreak\koreak\koreak.cpp(122) : warning C4700: uninitialized local variable 'wallhack' used

what's the matter??

[IMG]https://raoworld.files.*********.com/2009/01/facepalm.jpg[/IMG]

Gosh I don't know...!

C&P choob.

[andybuibee]

hey sorry to bother u voltage, I don't know what happened but I did everything you said up to point where it says "Click the green arrow on the top to debug / release. Alternately, you can just build / rebuild (for those who know how to use C++ IDE)" I pressed it and it says "Please specify the name of the executable file to be used for the debug session" It's my first time using Visual C++ 2008 so I would be extremely glad if you explained it >.<. Thanks for the release!

[Void]

hey sorry to bother u voltage, I don't know what happened but I did everything you said up to point where it says "Click the green arrow on the top to debug / release. Alternately, you can just build / rebuild (for those who know how to use C++ IDE)" I pressed it and it says "Please specify the name of the executable file to be used for the debug session" It's my first time using Visual C++ 2008 so I would be extremely glad if you explained it >.<. Thanks for the release!

DLL's can't be loaded into memory alone, you have to have an executable loading it. Or you can ignore that, press cancel, and inject.

[why06]

What David said. Just build it normally. You don't have to debug it unless you want to. =/
Just click F7. (no u will not die)

[andybuibee]

Thanks! So I've done all of the things said above.. where do I go to get my DLL?

[Void]

Debug or release folder in your project folder. You should consider learning C++ from the beginning. Doing this won't really get you anywhere.

[andybuibee]

Debug or release folder in your project folder. You should consider learning C++ from the beginning. Doing this won't really get you anywhere.

Thanks once again! I'm going to try to learn it :X.

[Gordon`]

i dont recommend to use GetStreamSource. it drops alot of fps (in warrock and ca)

[Void]

i dont recommend to use GetStreamSource. it drops alot of fps (in warrock and ca)

He's right, hook SetStreamSource and record the stride from there. More FPS = good.

[boxxymays]

How would you go about finding the stride number for other games?