Code:
#include "d3d9.h"
#include <windows.h>
LPDIRECT3DDEVICE9 pDevice;
#pragma comment (lib, "d3d9.lib")
void MakeJMP(BYTE *pAddress, DWORD dwJumpTo, DWORD dwLen)
{
DWORD dwOldProtect, dwBkup, dwRelAddr;
// VirtualProtect(pAddress, dwLen, PAGE_EXECUTE_READWRITE, &dwOldProtect);
dwRelAddr = (DWORD) (dwJumpTo - (DWORD) pAddress) - 5;
*pAddress = 0xE9;
*((DWORD *)(pAddress + 0x1)) = dwRelAddr;
for(DWORD x = 0x5; x < dwLen; x++) *(pAddress + x) = 0x90;
// VirtualProtect(pAddress, dwLen, dwOldProtect, &dwBkup);
return;
}
bool bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
for(;*szMask;++szMask,++pData,++bMask)
if(*szMask=='x' && *pData!=*bMask)
return 0;
return (*szMask) == NULL;
}
DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
for(DWORD i=0; i<dwLen; i++)
if (bCompare((BYTE*)(dwAddress+i),bMask,szMask))
return (DWORD)(dwAddress+i);
return 0;
}
DWORD ndip1;
DWORD DIP;
__declspec( naked ) VOID WINAPI ndip( ) {
__asm
{
MOV EDX,DWORD PTR DS:[EAX];
MOV DWORD PTR DS:[pDevice], EAX
PUSHAD
}
if(pDevice!=0){
pDevice->SetRenderState(D3DRS_ZENABLE, D3DZB_FALSE);
}
__asm{
POPAD
jmp ndip1;
}
}
HANDLE Thead;
int Hack123()
{
Sleep(1000);
DIP = FindPattern((DWORD)0x400000, 0x300000, (PBYTE)"\x8B\x10\x8B\x92\x00\x00\x00\x00\x51\x8B\x4C\x24\x00\x55\x51\x6A\x00\x6A\x00\x50\xFF\xD2\x8B\x43\x00\x8B\x8C\x24", "xxxx????xxxx?xxx?x?xxxxx?xxx");
if(memcmp( ( void * )DIP, ( void * )( PBYTE )"\x8B\x10", 2 ) == 0){
ndip1=DIP+0x2;
MakeJMP((PBYTE)(DIP+0x4D), (DWORD)ndip,5);
memcpy((VOID*)DIP, "\xeb\x4b", 2);
CloseHandle(Thead);
return 0;
}
Hack123();
return 0;
}
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
Thead = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)Hack123, NULL, NULL, NULL);
}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
PLEASE THANKS
CREDITS OHCF