D3D Chams...

#include <windows.h>
#include <d3d9.h>
#include <d3dx9.h>
#include "stdafx.h"
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")

// NUMPAD1 => On/Off chams.
// NUMPAD2 => Change colors.

#define DIPEngine 0x004B766D
DWORD retDIPEngine = ( DIPEngine + 0x8 );

INT chams;
INT color;
INT chams2;
#define Red     D3DCOLOR_ARGB( 255, 255, 000, 000 )
#define Green   D3DCOLOR_ARGB( 255, 000, 255, 000 )
#define Blue    D3DCOLOR_ARGB( 255, 000, 000, 255 )
#define Black   D3DCOLOR_ARGB( 255, 000, 000, 000 )

HRESULT GenerateTexture(IDirect3DDevice9 *pD3Ddev, IDirect3DTexture9 **ppD3Dtex, DWORD colour32)
{
    if( FAILED(pD3Ddev->CreateTexture(8, 8, 1, 0, D3DFMT_A4R4G4B4, D3DPOOL_MANAGED, ppD3Dtex, NULL)) )
        return E_FAIL;
     
    WORD colour16 =    ((WORD)((colour32>>28)&0xF)<<12)
            |(WORD)(((colour32>>20)&0xF)<<8)
            |(WORD)(((colour32>>12)&0xF)<<4)
            |(WORD)(((colour32>>4)&0xF)<<0);
 
    D3DLOCKED_RECT d3dlr;    
    (*ppD3Dtex)->LockRect(0, &d3dlr, 0, 0);
    WORD *pDst16 = (WORD*)d3dlr.pBits;
 
    for(int xy=0; xy < 8*8; xy++)
        *pDst16++ = colour16;
 
    (*ppD3Dtex)->UnlockRect(0);
 
    return S_OK;
}
__declspec( naked ) HRESULT WINAPI DIPMidfunction( )
{
    static LPDIRECT3DDEVICE9 pDevice;

    __asm
    {
        MOV EDX, DWORD PTR DS:[EAX]
        MOV EDX, DWORD PTR DS:[EDX + 0x148]
        MOV DWORD PTR DS:[pDevice], EAX
        PUSHAD
    }
    if( GetAsyncKeyState(VK_NUMPAD1)&1 )
        chams = !chams;
		if( GetAsyncKeyState(VK_NUMPAD9)&1)
		Chams( pDevice, Red );
    __asm
    {
        POPAD
        JMP retDIPEngine
    }
}

void *DetourCreate( BYTE *src, const BYTE *dst, const int len )
{
    BYTE *jmp =( BYTE * ) malloc( len + 5 );
    DWORD dwBack;

    VirtualProtect( src, len, PAGE_READWRITE, &dwBack );
    memcpy( jmp, src, len );    
    jmp += len;
    jmp[0] = 0xE9;
    *( DWORD * )( jmp + 1 ) = ( DWORD )( src + len - jmp ) - 5;

    src[0] = 0xE9;
    *( DWORD * )( src + 1 ) = ( DWORD )( dst - src ) - 5;
    for( int i = 5; i < len; i++ )
        src[i] = 0x90;
    VirtualProtect( src, len, dwBack, &dwBack );

    return( jmp - len );
}

DWORD WINAPI StartRoutine( LPVOID )
{
    while( TRUE )
    {
        if( memcmp( ( void * )DIPEngine, ( void * )( PBYTE )"\x8B\x10", 2 ) == 0 )
        {
            Sleep(200);
            DetourCreate( ( PBYTE )DIPEngine, ( PBYTE )DIPMidfunction, 8 );
        }
    }
 
    return 0;
}

BOOL WINAPI DllMain( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{ 
    if( dwReason == DLL_PROCESS_ATTACH )
    {
        DisableThreadLibraryCalls( hDll );
        //MessageBoxA( 0, "Hook DIP Engine", "Crossfire", 0 );
        CreateThread( 0, 0, (LPTHREAD_START_ROUTINE)StartRoutine, 0, 0, 0 );
    }
 
    return TRUE;
}

#pragma once

#include <windows.h>
#include <stdio.h>
#include <d3d9.h>
#include <d3dx9.h>

#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")

void Chams( LPDIRECT3DDEVICE9 D3DDEVICE, DWORD COLOR )
{
	D3DDEVICE->SetRenderState( D3DRS_AMBIENT, COLOR );
}

 DipEngine + 0x08