Start3D Engine Hook
Hello, i make this hook at long time ago, but i dont use anymore, appreciate:
Code:
Combat Arms Brazil: 005382A0 . 833D F83E7700 >CMP DWORD PTR DS:[773EF8],0 005382A7 . 75 36 JNZ SHORT Engine-u.005382DF 005382A9 . 6A 49 PUSH 49 005382AB . E8 C09BF6FF CALL Engine-u.004A1E70 005382B0 . 83C4 04 ADD ESP,4 005382B3 . 833D 60BC7600 >CMP DWORD PTR DS:[76BC60],1 005382BA . 7C 1D JL SHORT Engine-u.005382D9 005382BC . A1 4C207400 MOV EAX,DWORD PTR DS:[74204C] 005382C1 . 68 98E76E00 PUSH Engine-u.006EE798 005382C6 . 68 00E86E00 PUSH Engine-u.006EE800 ; ASCII "LT_NOTINITIALIZED" 005382CB . 68 18BE6F00 PUSH Engine-u.006FBE18 ; ASCII "Start3D" 005382D0 . 50 PUSH EAX 005382D1 . E8 BAA7F6FF CALL Engine-u.004A2A90 005382D6 . 83C4 10 ADD ESP,10 005382D9 > B8 49000000 MOV EAX,49 005382DE . C3 RETN 005382DF > A1 003F7700 MOV EAX,DWORD PTR DS:[773F00] => Hook start 005382E4 . 40 INC EAX 005382E5 . A3 003F7700 MOV DWORD PTR DS:[773F00],EAX 005382EA . 83F8 01 CMP EAX,1 005382ED . 75 06 JNZ SHORT Engine-u.005382F5 => Hook return 005382EF . FF15 503F7700 CALL DWORD PTR DS:[773F50] 005382F5 > 33C0 XOR EAX,EAX 005382F7 . C3 RETN
Code:
DWORD DeviceGame = 0x877E58; // CA[BR]
DWORD Start3D = 0x5382DF; // CA[BR]
DWORD retStart3D = (Start3D + 0xE);
LPD3DXFONT D3DDirectxFont;
BOOL D3DFontBoolean;
VOID StartFont(LPDIRECT3DDEVICE9 pDevice)
{
if(D3DDirectxFont)
{
D3DDirectxFont->Release();
D3DDirectxFont = NULL;
D3DFontBoolean = FALSE;
}
if(!D3DFontBoolean)
{
D3DXCreateFont(pDevice, 12, 0, 350, 1, 0, 1, 0, 4, 0 | (0<<4), "Arial", &D3DDirectxFont);
D3DFontBoolean = TRUE;
}
}
VOID DrawText(INT x, INT y, DWORD Color, CHAR *Text)
{
RECT Rect;
SetRect(&Rect, x, y, x, y);
D3DDirectxFont->DrawText(NULL, Text, -1, &Rect, DT_LEFT | DT_NOCLIP, Color);
}
__declspec(naked)HRESULT WINAPI Start3DMidfunction(VOID)
{
static LPDIRECT3DDEVICE9 pDevice;
__asm
{
MOV EAX, DWORD PTR DS:[0x773F00]
INC EAX
MOV DWORD PTR DS:[0x773F00], EAX
CMP EAX, 1
PUSHAD
}
if(!pDevice)
pDevice = **(LPDIRECT3DDEVICE9 **)DeviceGame;
else
{
StartFont(pDevice);
pDevice->SetRenderState(D3DRS_ZENABLE, D3DZB_FALSE);
DrawText(50, 50, 0xFFFF0000, "Start3D Engine Hooking");
DrawText(50, 70, 0xFF0000FF, "Credits: luizimloko => Start3D, Shad0w_ => Midfunction example");
pDevice->SetRenderState(D3DRS_ZENABLE, D3DZB_TRUE);
}
__asm
{
POPAD
JMP DWORD PTR DS:[retStart3D];
}
}
DWORD WINAPI dwEngineHooking(PVOID)
{
while(1)
{
if(memcmp((PVOID)Start3D, (PVOID)(PBYTE)"\xA1", 1) == 0)
{
Sleep(100);
DetourCreate((PBYTE)Start3D, (PBYTE)Start3DMidfunction, 14);
}
Sleep(50);
}
return EXIT_SUCCESS;
}
BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
{
if(dwReason == DLL_PROCESS_ATTACH)
{
DisableThreadLibraryCalls(hModule);
CreateThread(NULL, NULL, &dwEngineHooking, NULL, NULL, NULL);
}
return TRUE;
}
Code:
Binary Scan: A1 ?? ?? ?? ?? 40 A3 ?? ?? ?? ?? 83 F8 01 75 06 FF 15 ?? ?? ?? ?? 33 C0 C3 CC CC CC CC CC CC CC CC
