DIP Engine 2 Updated

[luizimloko]

The function of DIP Engine has changed then some loggers can't find the address of it.
This hook is already DETECTED by X-TRAP

004C3432  |. 8B9C24 3C02000>|MOV EBX,DWORD PTR SS:[ESP+23C]
004C3439  |> 8B55 08        |MOV EDX,DWORD PTR SS:[EBP+8]
004C343C  |. 2B5424 10      |SUB EDX,DWORD PTR SS:[ESP+10]
004C3440  |. 0FB74D 00      |MOVZX ECX,WORD PTR SS:[EBP]
004C3444  |. 8B35 E8527200  |MOV ESI,DWORD PTR DS:[7252E8]         => Device Game
004C344A  |. B8 ABAAAAAA    |MOV EAX,AAAAAAAB
004C344F  |. F7E2           |MUL EDX
004C3451  |. 0FB745 02      |MOVZX EAX,WORD PTR SS:[EBP+2]
004C3455  |. 8BFA           |MOV EDI,EDX
004C3457  |. D1EF           |SHR EDI,1
004C3459  |. 894424 24      |MOV DWORD PTR SS:[ESP+24],EAX
004C345D  |. 894C24 20      |MOV DWORD PTR SS:[ESP+20],ECX
004C3461  |. E8 DAA00000    |CALL crossfir.004CD540
004C3466  |. 57             |PUSH EDI
004C3467  |. 8BD6           |MOV EDX,ESI
004C3469  |. 8B02           |MOV EAX,DWORD PTR DS:[EDX]
004C346B  |. 8B5424 14      |MOV EDX,DWORD PTR SS:[ESP+14]
004C346F  |. 8B08           |MOV ECX,DWORD PTR DS:[EAX]
004C3471  |. 52             |PUSH EDX
004C3472  |. 8B5424 2C      |MOV EDX,DWORD PTR SS:[ESP+2C]
004C3476  |. 52             |PUSH EDX
004C3477  |. 8B5424 2C      |MOV EDX,DWORD PTR SS:[ESP+2C]
004C347B  |. 52             |PUSH EDX
004C347C  |. 6A 00          |PUSH 0
004C347E  |. 6A 04          |PUSH 4
004C3480  |. 50             |PUSH EAX
004C3481  |. 8B81 48010000  |MOV EAX,DWORD PTR DS:[ECX+148]
004C3487  |. FFD0           |CALL EAX                               => Return

DWORD DIPEngine = 0x4C3480; // Search the address inside of crossfire.exe, this address is for Crossfire[AL]
DWORD retDIPEngine = ( DIPEngine + 0x7 );

__declspec( naked ) HRESULT WINAPI DIPEngineMidfunction( VOID )
{
	static LPDIRECT3DDEVICE9 pDevice;

	__asm
	{
		PUSH EAX
		MOV DWORD PTR DS:[pDevice], EAX
		MOV EAX, DWORD PTR DS:[ECX + 0x148]
		PUSHAD
	}

	pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
	
	// Others stuffs here ...

	__asm
	{
		POPAD
		JMP DWORD PTR DS:[retDIPEngine]
	}
}

Screen Shoot Proof:

Crédits:
@Shad0w_ => Midfunction mehtod
@WE11ington => Posted this method +/- 9-10 months ago

[6ixth]

Nice work.

[GoldWhite]

How do this hook undetected?

[remzkee0903]

@luizimloko Yes, you're right.. the currently logger I'm using in the DIP Engine 2 becomes 0x00000000. Thanks for this update bro.

by the way.. do you have the DIP Engine 2 pattern for CFPH? Thanks..

[luizimloko]

@luizimloko Yes, you're right.. the currently logger I'm using in the DIP Engine 2 becomes 0x00000000. Thanks for this update bro.

by the way.. do you have the DIP Engine 2 pattern for CFPH? Thanks..

I think it is the same ...

[mamo007]

Good Job , But i need Endscence or present hook ..

[-[I]fLuX]

I think crossfire is scanning now every hooked thing in crossfire.exe or cshell thats why the dip engine is detected by xtrap^^

[sabatbatu]

nice work

[XarutoUsoCrack]

The function of DIP Engine has changed then some loggers can't find the address of it.
This hook is already DETECTED by X-TRAP

004C3432  |. 8B9C24 3C02000>|MOV EBX,DWORD PTR SS:[ESP+23C]
004C3439  |> 8B55 08        |MOV EDX,DWORD PTR SS:[EBP+8]
004C343C  |. 2B5424 10      |SUB EDX,DWORD PTR SS:[ESP+10]
004C3440  |. 0FB74D 00      |MOVZX ECX,WORD PTR SS:[EBP]
004C3444  |. 8B35 E8527200  |MOV ESI,DWORD PTR DS:[7252E8]         => Device Game
004C344A  |. B8 ABAAAAAA    |MOV EAX,AAAAAAAB
004C344F  |. F7E2           |MUL EDX
004C3451  |. 0FB745 02      |MOVZX EAX,WORD PTR SS:[EBP+2]
004C3455  |. 8BFA           |MOV EDI,EDX
004C3457  |. D1EF           |SHR EDI,1
004C3459  |. 894424 24      |MOV DWORD PTR SS:[ESP+24],EAX
004C345D  |. 894C24 20      |MOV DWORD PTR SS:[ESP+20],ECX
004C3461  |. E8 DAA00000    |CALL crossfir.004CD540
004C3466  |. 57             |PUSH EDI
004C3467  |. 8BD6           |MOV EDX,ESI
004C3469  |. 8B02           |MOV EAX,DWORD PTR DS:[EDX]
004C346B  |. 8B5424 14      |MOV EDX,DWORD PTR SS:[ESP+14]
004C346F  |. 8B08           |MOV ECX,DWORD PTR DS:[EAX]
004C3471  |. 52             |PUSH EDX
004C3472  |. 8B5424 2C      |MOV EDX,DWORD PTR SS:[ESP+2C]
004C3476  |. 52             |PUSH EDX
004C3477  |. 8B5424 2C      |MOV EDX,DWORD PTR SS:[ESP+2C]
004C347B  |. 52             |PUSH EDX
004C347C  |. 6A 00          |PUSH 0
004C347E  |. 6A 04          |PUSH 4
004C3480  |. 50             |PUSH EAX
004C3481  |. 8B81 48010000  |MOV EAX,DWORD PTR DS:[ECX+148]
004C3487  |. FFD0           |CALL EAX                               => Return

DWORD DIPEngine = 0x4C3480; // Search the address inside of crossfire.exe, this address is for Crossfire[AL]
DWORD retDIPEngine = ( DIPEngine + 0x7 );

__declspec( naked ) HRESULT WINAPI DIPEngineMidfunction( VOID )
{
	static LPDIRECT3DDEVICE9 pDevice;

	__asm
	{
		PUSH EAX
		MOV DWORD PTR DS:[pDevice], EAX
		MOV EAX, DWORD PTR DS:[ECX + 0x148]
		PUSHAD
	}

	pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
	
	// Others stuffs here ...

	__asm
	{
		POPAD
		JMP DWORD PTR DS:[retDIPEngine]
	}
}

Crédits:
@Shad0w_ => Midfunction mehtod
@WE11ington => Posted this method +/- 1 year ago (for CA 1 year and 5 months, idk....)

Taked Combat Arms DIP Engine from refference ?

[luizimloko]

Taked Combat Arms DIP Engine from refference ?

no, i find it alone ...

[Skaterforeva1]

no, i find it alone ...

I have been in combat arm section for ever. This is definitely from there, just updated it for crossfire lol.

[luizimloko]

I have been in combat arm section for ever. This is definitely from there, just updated it for crossfire lol.

you think that same pattern scan for CA works on CF ?

[ramo]

you think that same pattern scan for CA works on CF ?

You can search for the exactly same hook by asm commands lines
And i think hooking in crossfire is detected ..
Anyway thanks

[sabatbatu]

Are you there endScene / present hook?

[Astr3Lune]

DWORD WINAPI StartRoutine( LPVOID )
{
while( TRUE )
{
if( memcmp( ( VOID * )DIPEngine, ( VOID * )( PBYTE )"\x8B\x07", 2 ) == 0 ) <=== Right?
{
Sleep( 100 );
DetourCreate( ( PBYTE )DIPEngine, ( PBYTE )DIPEngineMidfunction, 7 ); <== Right?
}
Sleep( 50 );
}

return 0;
}