WALLHACK + SuperKill

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

BYTE bWHShellCode[ ]
{
	0x55,
	0x56,
	0x57,
	0x8B, 0xF8,
	0x60,
	0xA1, 0x00, 0x00, 0x00, 0x00,
	0xC7, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x61,
	0xE9, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00,
	0x00, 0x00,
};

const bool bDataCompare( const BYTE *pData, const BYTE *bMask, const char *szMask )
{
	for( ; *szMask; ++szMask, ++pData, ++bMask )
		if( *szMask == 'x' && *pData != *bMask )
			return 0;
	return ( *szMask ) == NULL;
}

DWORD FindPattern( DWORD dwModule, DWORD dwLen, BYTE *bMask, char *szMask )
{
	for( DWORD i = 0; i < dwLen; i++ )
		if( bDataCompare( ( BYTE * ) ( dwModule + i ), bMask, szMask ) )
			return ( DWORD ) ( dwModule + i );
	return EXIT_SUCCESS;
}

DWORD WINAPI dwStartRoutine( void *lpReserved )
{
	DWORD ADDR_MID_HOOK		= NULL,
		  ADDR_SHELLCODE	= NULL,
		  ADDR_WALLHACK		= NULL,
		  ADDR_RETURN		= NULL;

	while( !GetModuleHandle( L"ClientFX.fxd" ) )
		Sleep( 1 );

	ADDR_MID_HOOK = FindPattern( 0x400000, 0x1154000,
		( PBYTE ) "\x55\x56\x57\x8B\xF8\x8B\xF1\x75\x00", ( char * ) "xxxxxxxx?" );

	ADDR_SHELLCODE = ( DWORD ) VirtualAlloc( 0, sizeof( bWHShellCode ), MEM_COMMIT, PAGE_EXECUTE_READWRITE );

	ADDR_WALLHACK = ( ADDR_MID_HOOK + 0x10 );
	ADDR_WALLHACK = *( DWORD * ) ( ADDR_WALLHACK + 0x01 );
	ADDR_WALLHACK += 0xA4;

	ADDR_RETURN = ( ADDR_MID_HOOK + 0x05 );

	//Shellcode Midfunction.
	DWORD lpflOldProtect = NULL;
	VirtualProtect( ( PVOID ) ADDR_SHELLCODE, sizeof( bWHShellCode ), PAGE_EXECUTE_READWRITE, &lpflOldProtect );

	memcpy( ( PVOID ) ADDR_SHELLCODE, bWHShellCode, sizeof( bWHShellCode ) );
	*( DWORD   * ) ( ADDR_SHELLCODE + 0x07 )	= ( DWORD ) ( ADDR_SHELLCODE + 0x17 );
	*( DWORD   * ) ( ADDR_SHELLCODE + 0x17 )	= ( DWORD ) ADDR_WALLHACK;
	*( ( DWORD * ) ( ADDR_SHELLCODE + 0x13 ) )	= ( DWORD ) ( ADDR_RETURN - ( DWORD ) ( ADDR_SHELLCODE + 0x12 ) ) - 5;

	VirtualProtect( ( PVOID ) ADDR_SHELLCODE, sizeof( bWHShellCode ), lpflOldProtect, &lpflOldProtect );

	//Org. function jmp.
	VirtualProtect( ( PVOID ) ADDR_MID_HOOK, 5, PAGE_EXECUTE_READWRITE, &lpflOldProtect );

	*( BYTE  * ) ( ADDR_MID_HOOK + 0x00 ) = 0xE9;
	*( DWORD * ) ( ADDR_MID_HOOK + 0x01 ) = ( DWORD ) ( ADDR_SHELLCODE - ADDR_MID_HOOK ) - 5;

	VirtualProtect( ( PVOID ) ADDR_MID_HOOK, 5, lpflOldProtect, &lpflOldProtect );

	return EXIT_SUCCESS;
}

BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved )
{
	switch( ul_reason_for_call )
	{
	case DLL_PROCESS_ATTACH:
		CreateThread( 0, 0, &dwStartRoutine, 0, 0, 0 );
		break;
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}