Code:
#include "d3dbase.h"
#include "XOR.h"
LPD3DXFONT pFont;
VOID StartFont( LPDIRECT3DDEVICE9 pDevice )
{
if( pFont )
{
pFont->Release();
pFont = 0;
}
if( !pFont )
{
D3DXCreateFont( pDevice,
14,
0,
FW_BOLD,
1,
0,
DEFAULT_CHARSET,
OUT_DEFAULT_PRECIS,
ANTIALIASED_QUALITY,
DEFAULT_PITCH | FF_DONTCARE,
"Arial",
&pFont );
}
}
DWORD retPRESENT10;
__declspec(naked) void Present10()
{
static LPDIRECT3DDEVICE9 pDevice;
__asm
{
MOV EDI, EDI
PUSH EBP
MOV EBP, ESP
MOV ESI, DWORD PTR SS : [EBP + 0x8]
MOV pDevice, ESI
}
if (pDevice)
{
StartFont(pDevice);
}
__asm
{
POPAD
JMP retPRESENT10
}
}
DWORD retPRESENT7;
__declspec(naked) void Present7()
{
static LPDIRECT3DDEVICE9 pDevice;
__asm
{
MOV EDI, EDI
PUSH EBP
MOV EBP, ESP
PUSH ESI
PUSH EDI
MOV EDI, DWORD PTR SS : [EBP + 8]
MOV pDevice, EDI
}
if (pDevice)
{
DoMenu(pDevice);
DoHackMemory(pDevice);
}
__asm
{
POPAD
JMP retPRESENT7
}
}
DWORD retPRESENT8;
__declspec(naked) void Present8()
{
static LPDIRECT3DDEVICE9 pDevice;
__asm
{
MOV EDI, EDI
PUSH EBP
MOV EBP, ESP
MOV EAX, DWORD PTR SS : [EBP + 0x8]
MOV pDevice, EAX
}
if (pDevice)
{
DoHackDirectx(pDevice);
}
__asm
{
POPAD
JMP retPRESENT8
}
}
VOID *DetourFunction(BYTE *src, CONST BYTE *dst, CONST INT len)
{
BYTE *jmp =( BYTE * ) malloc( len + 5 );
DWORD dwBack;
VirtualProtect( src, len, PAGE_READWRITE, &dwBack );
memcpy( jmp, src, len );
jmp += len;
jmp[0] = 0xE9;
*( DWORD * )( jmp + 1 ) = ( DWORD )( src + len - jmp ) - 5;
src[0] = 0xE9;
*( DWORD * )( src + 1 ) = ( DWORD )( dst - src ) - 5;
for( INT i = 5; i < len; i++ )
src[i] = 0x90;
VirtualProtect( src, len, dwBack, &dwBack );
return( jmp - len );
}
void Ellang()
{
DWORD hD3D = (DWORD)LoadLibraryA(ed3d9);
DWORD GetAddressP10 = FindPattern(hD3D, 0x128000, (PBYTE)"\x8B\xFF\x55\x8B\xEC\x83\xE4\xF8\x83\xEC\x0C\x56\x8B\x75\x08\x85\xF6\x74\x05\x8D\x46\x04\xEB\x02\x33\xC0\x6A\x00\x50\x8D\x4C\x24\x10\xE8\x00\x00\x00\x00\xF7\x46\x00\x00\x00\x00\x00\x74\x07\xBE\x00\x00\x00\x00\xEB\x17", "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx????xx?????xxx????xx");
if (GetAddressP10)
{
retPRESENT10 = GetAddressP10 + 0xC;
DetourFunction((PBYTE)GetAddressP10, (PBYTE)Present10, 5);
}
DWORD GetAddressP7 = FindPattern(hD3D, 0x128000, (PBYTE)"\x8B\xFF\x55\x8B\xEC\x56\x57\x8B\x7D\x08\x85\xFF\x74\x44\x8D\x77\x04\x83\x7E\x18\x00\x0F\x85\x00\x00\x00\x00\xF6\x47\x2C\x02", "xxxxxxxxxxxxxxxxxxxxxxx????xxxx");
if (GetAddressP7)
{
retPRESENT7 = GetAddressP7 + 0x7;
DetourFunction((PBYTE)GetAddressP7, (PBYTE)Present7, 5);
}
DWORD GetAddressP8 = FindPattern(hD3D, 0x128000, (PBYTE)"\x8B\xFF\x55\x8B\xEC\x83\xE4\xF8\x83\xEC\x0C\x56\x8B\x75\x08\x85\xF6\x74\x48\x8D\x46\x04\x83\x64\x24\x0C\x00\x83\x78\x18\x00\x89\x44\x24\x08\x75\x3A\xF7\x46\x00\x00\x00\x00\x00\x0F\x85\x00\x00\x00\x00\x6A\x00\xFF\x75\x18\x8B\xCE\xFF\x75\x14\xFF\x75\x10\xFF\x75\x0C\xE8\x00\x00\x00\x00\x8B\xF0\x8D\x4C\x24\x08\xE8\x00\x00\x00\x00", "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx?????xx????xxxxxxxxxxxxxxxxx????xxxxxxx????");
if (GetAddressP8)
{
retPRESENT8 = GetAddressP8 + 0xC;
DetourFunction((PBYTE)GetAddressP8, (PBYTE)Present8, 5);
}
}
BOOL WINAPI DllMain( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
DisableThreadLibraryCalls( hDll );
if( dwReason == DLL_PROCESS_ATTACH )
{
MessageBox( 0, "CrossFire Project", "HOOK", 0 );
CreateThread( 0, 0, ( LPTHREAD_START_ROUTINE )Ellang, 0, 0, 0 );
}
return TRUE;
}