Originally Posted by
Matrix-X
Bom Atualizei esse hook a uns dias atras e resolvi postar
Code:
#include <Windows.h>
#include <d3d9.h>
#include <d3dx9.h>
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
#define DipEngine 0x0062080D
DWORD retDipEngine = DipEngine + 0x7;
bool OnChams = false;
_declspec (naked) HRESULT WINAPI DipMidFunction()
{
static LPDIRECT3DDEVICE9 pDevice;
_asm
{
PUSH EAX
MOV DWORD PTR DS:[pDevice], EAX
MOV EAX, DWORD PTR DS:[ECX + 0x148]
PUSHAD
}
if(OnChams)
{
pDevice->SetRenderState(D3DRS_ZENABLE, D3DZB_FALSE);
pDevice->SetRenderState(D3DRS_AMBIENT, D3DCOLOR_ARGB(255,255,000,000));
}
if(GetAsyncKeyState(VK_F9)&1) OnChams =! OnChams;
_asm
{
POPAD
JMP retDipEngine
}
}
void *DetourFunc(BYTE *src, const BYTE *dst, const int len)
{
BYTE *jmp = (BYTE*)malloc(len+5);
DWORD dwback;
VirtualProtect(src, len, PAGE_READWRITE, &dwback);
memcpy(jmp, src, len); jmp += len;
jmp[0] = 0xE9;
*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
src[0] = 0xE9;
*(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
VirtualProtect(src, len, dwback, &dwback);
return (jmp-len);
}
void _cdecl StartRoutine(void*)
{
while(true)
{
if(memcmp((void*)DipEngine, (void*)(PBYTE)"\x50", 1)==0)
{
Sleep(250);
DetourFunc((PBYTE)DipEngine, (PBYTE)DipMidFunction, 7);
}
}
}
BOOL APIENTRY DllMain(HINSTANCE hinstDLL, DWORD reason, LPVOID lpvReserved)
{
if(reason == DLL_PROCESS_ATTACH)
{
DisableThreadLibraryCalls(hinstDLL);
CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)StartRoutine,NULL,NULL,NULL);
return TRUE;}
return TRUE;}
Update
Binary String:
Code:
8B 08 52 ?? ?? ?? ?? 52 ?? ?? ?? ?? 52 ?? ?? ?? ?? 52 ?? ?? ?? ?? 52 6A 04 50 8B 81
Code:
006207F4 |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
006207F6 |. 52 PUSH EDX
006207F7 |. 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]
006207FB |. 52 PUSH EDX
006207FC |. 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18]
00620800 |. 52 PUSH EDX
00620801 |. 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14]
00620805 |. 52 PUSH EDX
00620806 |. 8B5424 28 MOV EDX,DWORD PTR SS:[ESP+28]
0062080A |. 52 PUSH EDX
0062080B |. 6A 04 PUSH 4
0062080D |. 50 PUSH EAX
0062080E |. 8B81 48010000 MOV EAX,DWORD PTR DS:[ECX+148]
00620814 |. FFD0 CALL EAX
Créditos:
@WE11ington
@Shad0w_
@azorbix
@Code64
@Matrix-X <- me
Olá garotas frenéticas, segue codigo para a utilização de cores duplicadas frontal e costas, só lembrem que o HackShield tem scans em hooks engine agora, para testes e ver que funcionava ativem somente dentro do jogo ou aba meu personagem.
Code:
00620860 /$ 8B0D 28958700 MOV ECX,DWORD PTR DS:[879528]
00620866 |. 56 PUSH ESI
00620867 |. 8BF1 MOV ESI,ECX
00620869 |. E8 92F5F5FF CALL Engine.0057FE00
0062086E |. 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14] => Start Hook
00620872 |. 8B06 MOV EAX,DWORD PTR DS:[ESI]
00620874 |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
00620876 |. 52 PUSH EDX
00620877 |. 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10]
0062087B |. 52 PUSH EDX
0062087C |. 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18]
00620880 |. 52 PUSH EDX
00620881 |. 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+14]
00620885 |. 52 PUSH EDX
00620886 |. 8B5424 28 MOV EDX,DWORD PTR SS:[ESP+28]
0062088A |. 52 PUSH EDX
0062088B |. 6A 04 PUSH 4
0062088D |. 50 PUSH EAX
0062088E |. 8B81 48010000 MOV EAX,DWORD PTR DS:[ECX+148]
00620894 |. FFD0 CALL EAX
00620896 |. 5E POP ESI
00620897 \. C2 1400 RETN 14
Code:
#include <windows.h>
#include <d3d9.h>
// Actual Address: 14/09/2013
#define DIPEngine 0x0062086E
INT chams;
#define Red D3DCOLOR_ARGB( 255, 255, 000, 000 )
#define Green D3DCOLOR_ARGB( 255, 000, 255, 000 )
#define Blue D3DCOLOR_ARGB( 255, 000, 000, 255 )
#define Black D3DCOLOR_ARGB( 255, 000, 000, 000 )
__declspec( naked ) HRESULT WINAPI DIPMidfunction( )
{
static LPDIRECT3DDEVICE9 pDevice;
static INT BaseVertexIndex;
static UINT MinVertexIndex, NumVertices, startIndex, primCount;
__asm
{
MOV EDX,DWORD PTR SS:[ESP+0x14]
MOV EAX,DWORD PTR DS:[ESI]
MOV ECX,DWORD PTR DS:[EAX]
MOV DWORD PTR DS:[primCount],EDX
PUSH EDX
MOV EDX,DWORD PTR SS:[ESP+0x10]
MOV DWORD PTR DS:[startIndex],EDX
PUSH EDX
MOV EDX,DWORD PTR SS:[ESP+0x18]
MOV DWORD PTR DS:[NumVertices],EDX
PUSH EDX
MOV EDX,DWORD PTR SS:[ESP+0x14]
MOV DWORD PTR DS:[MinVertexIndex],EDX
PUSH EDX
MOV EDX,DWORD PTR SS:[ESP+0x28]
MOV DWORD PTR DS:[BaseVertexIndex],EDX
PUSH EDX
PUSH 4
MOV DWORD PTR SS:[pDevice],EAX
PUSH EAX
MOV EAX,DWORD PTR DS:[ECX+0x148]
CALL EAX
PUSHAD
}
pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_TRUE );
pDevice->SetRenderState( D3DRS_AMBIENT, Red );
pDevice->DrawIndexedPrimitive( D3DPT_TRIANGLELIST, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount );
pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
pDevice->SetRenderState( D3DRS_AMBIENT, Green );
__asm
{
POPAD
POP ESI
RETN 0x14
}
}
void *DetourCreate( BYTE *src, const BYTE *dst, const int len )
{
BYTE *jmp = ( BYTE * )malloc( len + 5 );
DWORD dwBack;
VirtualProtect( src, len, PAGE_EXECUTE_READWRITE, &dwBack );
memcpy( jmp, src, len );
jmp += len;
jmp[0] = 0xE9;
*( DWORD * )( jmp + 1 ) = ( DWORD )( src + len - jmp ) - 5;
src[0] = 0xE9;
*( DWORD * )( src + 1 ) = ( DWORD )( dst - src ) - 5;
for( int i = 5; i < len; i++ )
src[i] = 0x90;
VirtualProtect( src, len, dwBack, &dwBack );
return ( jmp - len );
}
BOOL CheckModules( VOID )
{
if( GetModuleHandleA("d3d9.dll") != NULL
&& GetModuleHandleA("CShell.dll") != NULL
&& GetModuleHandleA("ClientFX.fxd") != NULL )
return TRUE;
return FALSE;
}
VOID WINAPI StartRoutine( LPVOID )
{
while( !CheckModules( ) )
Sleep(100);
while( TRUE ) {
if( GetAsyncKeyState(VK_NUMPAD1)&1 )
DetourCreate( (PBYTE)DIPEngine, (PBYTE)DIPMidfunction, 6 );
Sleep(100);
}
}
BOOL WINAPI DllMain( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
DisableThreadLibraryCalls( hDll );
if( dwReason == DLL_PROCESS_ATTACH )
CreateThread( NULL, NULL, (LPTHREAD_START_ROUTINE)StartRoutine, NULL, NULL, NULL );
return TRUE;
}
Créditos: Hook Verde
