Updated DIP Engine Hook

are pattern for ru crossfire the same? because the wh doesnt work...

here my code

#include <windows.h>
#include <d3d9.h>
#include <d3dx9.h>

DWORD retDIPHook, DIPHook;
int wallhack = 1;

bool bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
for(;*szMask;++szMask,++pData,++bMask)
if(*szMask=='x' && *pData!=*bMask) return 0;
return (*szMask) == NULL;
}

DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
for(DWORD i=0; i<dwLen; i++)
if (bCompare((BYTE*)(dwAddress+i),bMask,szMask)) return (DWORD)(dwAddress+i);
return 0;
}

__declspec(naked) HRESULT WINAPI aDIPHook()
{
static LPDIRECT3DDEVICE9 pDevice;

__asm
{
MOV ECX, DWORD PTR DS : [EDI]
MOV EDX, DWORD PTR DS : [ECX + 0x148]
MOV DWORD PTR DS : [pDevice], EDI
PUSHAD
}

if (wallhack)
pDevice->SetRenderState(D3DRS_ZENABLE, D3DZB_FALSE);

__asm
{
POPAD
JMP retDIPHook
}
}

bool Ready2Hook()
{
if (GetModuleHandle("CShell.dll") != 0 && GetModuleHandle("ClientFx.fxd") != 0)
return true;
return false;
}

void *DetourCreate( BYTE *src, const BYTE *dst, const int len )
{
BYTE *jmp =( BYTE * ) malloc( len + 5 );
DWORD dwBack;

VirtualProtect( src, len, PAGE_READWRITE, &dwBack );
memcpy( jmp, src, len );
jmp += len;
jmp[0] = 0xE9;
*( DWORD * )( jmp + 1 ) =( DWORD )( src + len - jmp ) - 5;

src[0] = 0xE9;
*( DWORD * )( src + 1 ) = ( DWORD )( dst - src ) - 5;
for( int i=5; i<len; i++ )
src[i] = 0x90;
VirtualProtect( src, len, dwBack, &dwBack );

return( jmp - len );
}

DWORD WINAPI Call()
{
while (!Ready2Hook())
Sleep(200);

while (TRUE)
{
DIPHook = FindPattern((DWORD)GetModuleHandle("crossfire.exe" ), 0xFFFFFF, (PBYTE)"\x8B\x0F\x8B\x91\x00\x00\x00\x00\x53\x6A\x 00\x55\x6A\x00\x6A\x00\x6A\x04\x57\xFF\xD2\x5F\x5E \x5D\x85\xC0", "0000????00?00?0?0?00000000");
if (DIPHook != 0)
{
retDIPHook = (DIPHook + 0x8);
DetourCreate((PBYTE)DIPHook, (PBYTE)aDIPHook, 8);
}
}
return 0;
}

#define ADDR_DIPENGINE_1 0x004DA306 #define ADDR_DIPENGINE_2 0x004E5C94 __declspec( naked ) HRESULT WINAPI DrawIndexedPrimitive_1( void ) { static LPDIRECT3DDEVICE9 pDevice; static D3DPRIMITIVETYPE Type; static INT BaseVertexIndex; static UINT MinVertexIndex, NumVertices, startIndex, primCount; __asm { mov eax, [ eax + 0x148 ] mov [ primCount ], edi push edi mov [ startIndex ], ecx push ecx mov [ NumVertices ], ebp push ebp mov [ MinVertexIndex ], edx push edx push 0 push 4 mov [ pDevice ], ebx push ebx pushad } pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE ); pDevice->SetRenderState( D3DRS_AMBIENT, 0xFFFF0000 ); pDevice->DrawIndexedPrimitive ( D3DPRIMITIVETYPE::D3DPT_TRIANGLELIST, 0, MinVertexIndex, NumVertices, startIndex, primCount ); pDevice->SetRenderState( D3DRS_AMBIENT, 0xFF00FF00 ); pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_TRUE ); __asm { popad mov edx, ADDR_DIPENGINE_1 add edx, 0x0F jmp edx } } __declspec( naked ) HRESULT WINAPI DrawIndexedPrimitive_2( void ) { static LPDIRECT3DDEVICE9 pDevice; static UINT NumVertices, primCount; __asm { mov ecx, [ eax + 0x148 ] mov [ primCount ], ebp push ebp push 0 mov [ NumVertices ], ebx push ebx push 0 push 0 push 4 mov [ pDevice ], edi push edi pushad } pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE ); pDevice->SetRenderState( D3DRS_AMBIENT, 0xFFFF0000 ); pDevice->DrawIndexedPrimitive ( D3DPRIMITIVETYPE::D3DPT_TRIANGLELIST, 0, 0, NumVertices, 0, primCount ); pDevice->SetRenderState( D3DRS_AMBIENT, 0xFF00FF00 ); pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_TRUE ); __asm { popad mov eax, ADDR_DIPENGINE_2 add eax, 0x11 jmp eax } } DWORD WINAPI dwStartHook( void * ) { while( ( memcmp( ( void * ) ADDR_DIPENGINE_1, "\x8B", 1 ) && ( memcmp( ( void * ) ADDR_DIPENGINE_2, "\x8B", 1 ) ) ) ) Sleep( 10 ); *( BYTE * ) ( ADDR_DIPENGINE_1 + 0x00 ) = 0xE9; *( DWORD * ) ( ADDR_DIPENGINE_1 + 0x01 ) = ( ( DWORD ) DrawIndexedPrimitive_1 - ADDR_DIPENGINE_1 ) - 5; *( BYTE * ) ( ADDR_DIPENGINE_1 + 0x05 ) = 0x90; *( BYTE * ) ( ADDR_DIPENGINE_2 + 0x00 ) = 0xE9; *( DWORD * ) ( ADDR_DIPENGINE_2 + 0x01 ) = ( ( DWORD ) DrawIndexedPrimitive_2 - ADDR_DIPENGINE_2 ) - 5; *( BYTE * ) ( ADDR_DIPENGINE_2 + 0x05 ) = 0x90; return 0; }

DWORD retDIPHook, DIPHook; int wallhack = 1; __declspec(naked) HRESULT WINAPI aDIPHook() { static LPDIRECT3DDEVICE9 pDevice; __asm { MOV EAX, DWORD PTR DS : [EDI] MOV ECX, DWORD PTR DS : [EAX + 0x148] MOV DWORD PTR DS : [pDevice], EDI PUSHAD } if (wallhack) pDevice->SetRenderState(D3DRS_ZENABLE, D3DZB_FALSE); __asm { POPAD JMP retDIPHook } } bool Ready2Hook() { if (GetModuleHandle("CShell.dll") != 0 && GetModuleHandle("ClientFx.fxd") != 0) return true; return false; } DWORD WINAPI Call() { while (!Ready2Hook()) Sleep(200); while (TRUE) { DIPHook = FindPattern((DWORD)GetModuleHandle("crossfire.exe"), 0xFFFFFF, (PBYTE)"\x8B\x07\x8B\x88\x00\x00\x00\x00\x55\x6A\x00\x53\x6A\x00\x6A\x00\x6A\x04\x57\xFF\xD1\x85\xC0\x7C", "0000????00?00?0?0?000000"); if (DIPHook != 0) { retDIPHook = (DIPHook + 0x8); DetourCreate((PBYTE)DIPHook, (PBYTE)aDIPHook, 8); } } return 0; }

Updated DIP Engine Hook

Post a Reply

Similar Threads

Tags for this Thread