DIP Engine 2 Updated
DIP Engine 2 Updated
The function of DIP Engine has changed then some loggers can't find the address of it.
This hook is already DETECTED by X-TRAP
This hook is already DETECTED by X-TRAP
Code:
004C3432 |. 8B9C24 3C02000>|MOV EBX,DWORD PTR SS:[ESP+23C] 004C3439 |> 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8] 004C343C |. 2B5424 10 |SUB EDX,DWORD PTR SS:[ESP+10] 004C3440 |. 0FB74D 00 |MOVZX ECX,WORD PTR SS:[EBP] 004C3444 |. 8B35 E8527200 |MOV ESI,DWORD PTR DS:[7252E8] => Device Game 004C344A |. B8 ABAAAAAA |MOV EAX,AAAAAAAB 004C344F |. F7E2 |MUL EDX 004C3451 |. 0FB745 02 |MOVZX EAX,WORD PTR SS:[EBP+2] 004C3455 |. 8BFA |MOV EDI,EDX 004C3457 |. D1EF |SHR EDI,1 004C3459 |. 894424 24 |MOV DWORD PTR SS:[ESP+24],EAX 004C345D |. 894C24 20 |MOV DWORD PTR SS:[ESP+20],ECX 004C3461 |. E8 DAA00000 |CALL crossfir.004CD540 004C3466 |. 57 |PUSH EDI 004C3467 |. 8BD6 |MOV EDX,ESI 004C3469 |. 8B02 |MOV EAX,DWORD PTR DS:[EDX] 004C346B |. 8B5424 14 |MOV EDX,DWORD PTR SS:[ESP+14] 004C346F |. 8B08 |MOV ECX,DWORD PTR DS:[EAX] 004C3471 |. 52 |PUSH EDX 004C3472 |. 8B5424 2C |MOV EDX,DWORD PTR SS:[ESP+2C] 004C3476 |. 52 |PUSH EDX 004C3477 |. 8B5424 2C |MOV EDX,DWORD PTR SS:[ESP+2C] 004C347B |. 52 |PUSH EDX 004C347C |. 6A 00 |PUSH 0 004C347E |. 6A 04 |PUSH 4 004C3480 |. 50 |PUSH EAX 004C3481 |. 8B81 48010000 |MOV EAX,DWORD PTR DS:[ECX+148] 004C3487 |. FFD0 |CALL EAX => Return
Code:
DWORD DIPEngine = 0x4C3480; // Search the address inside of crossfire.exe, this address is for Crossfire[AL]
DWORD retDIPEngine = ( DIPEngine + 0x7 );
__declspec( naked ) HRESULT WINAPI DIPEngineMidfunction( VOID )
{
static LPDIRECT3DDEVICE9 pDevice;
__asm
{
PUSH EAX
MOV DWORD PTR DS:[pDevice], EAX
MOV EAX, DWORD PTR DS:[ECX + 0x148]
PUSHAD
}
pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
// Others stuffs here ...
__asm
{
POPAD
JMP DWORD PTR DS:[retDIPEngine]
}
}
Crédits:
@Shad0w_ => Midfunction mehtod
@WE11ington => Posted this method +/- 9-10 months ago
Nice work. 
How do this hook undetected?
@luizimloko Yes, you're right.. the currently logger I'm using in the DIP Engine 2 becomes 0x00000000. Thanks for this update bro.
by the way.. do you have the DIP Engine 2 pattern for CFPH? Thanks..
by the way.. do you have the DIP Engine 2 pattern for CFPH? Thanks..
Originally Posted by remzkee0903
@luizimloko Yes, you're right.. the currently logger I'm using in the DIP Engine 2 becomes 0x00000000. Thanks for this update bro.
by the way.. do you have the DIP Engine 2 pattern for CFPH? Thanks..
by the way.. do you have the DIP Engine 2 pattern for CFPH? Thanks..
Good Job , But i need Endscence or present hook ..
I think crossfire is scanning now every hooked thing in crossfire.exe or cshell thats why the dip engine is detected by xtrap^^
nice work 
Originally Posted by luizimloko
The function of DIP Engine has changed then some loggers can't find the address of it.
This hook is already DETECTED by X-TRAP
This hook is already DETECTED by X-TRAP
Code:
004C3432 |. 8B9C24 3C02000>|MOV EBX,DWORD PTR SS:[ESP+23C] 004C3439 |> 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8] 004C343C |. 2B5424 10 |SUB EDX,DWORD PTR SS:[ESP+10] 004C3440 |. 0FB74D 00 |MOVZX ECX,WORD PTR SS:[EBP] 004C3444 |. 8B35 E8527200 |MOV ESI,DWORD PTR DS:[7252E8] => Device Game 004C344A |. B8 ABAAAAAA |MOV EAX,AAAAAAAB 004C344F |. F7E2 |MUL EDX 004C3451 |. 0FB745 02 |MOVZX EAX,WORD PTR SS:[EBP+2] 004C3455 |. 8BFA |MOV EDI,EDX 004C3457 |. D1EF |SHR EDI,1 004C3459 |. 894424 24 |MOV DWORD PTR SS:[ESP+24],EAX 004C345D |. 894C24 20 |MOV DWORD PTR SS:[ESP+20],ECX 004C3461 |. E8 DAA00000 |CALL crossfir.004CD540 004C3466 |. 57 |PUSH EDI 004C3467 |. 8BD6 |MOV EDX,ESI 004C3469 |. 8B02 |MOV EAX,DWORD PTR DS:[EDX] 004C346B |. 8B5424 14 |MOV EDX,DWORD PTR SS:[ESP+14] 004C346F |. 8B08 |MOV ECX,DWORD PTR DS:[EAX] 004C3471 |. 52 |PUSH EDX 004C3472 |. 8B5424 2C |MOV EDX,DWORD PTR SS:[ESP+2C] 004C3476 |. 52 |PUSH EDX 004C3477 |. 8B5424 2C |MOV EDX,DWORD PTR SS:[ESP+2C] 004C347B |. 52 |PUSH EDX 004C347C |. 6A 00 |PUSH 0 004C347E |. 6A 04 |PUSH 4 004C3480 |. 50 |PUSH EAX 004C3481 |. 8B81 48010000 |MOV EAX,DWORD PTR DS:[ECX+148] 004C3487 |. FFD0 |CALL EAX => Return
Code:
DWORD DIPEngine = 0x4C3480; // Search the address inside of crossfire.exe, this address is for Crossfire[AL]
DWORD retDIPEngine = ( DIPEngine + 0x7 );
__declspec( naked ) HRESULT WINAPI DIPEngineMidfunction( VOID )
{
static LPDIRECT3DDEVICE9 pDevice;
__asm
{
PUSH EAX
MOV DWORD PTR DS:[pDevice], EAX
MOV EAX, DWORD PTR DS:[ECX + 0x148]
PUSHAD
}
pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
// Others stuffs here ...
__asm
{
POPAD
JMP DWORD PTR DS:[retDIPEngine]
}
}
@Shad0w_ => Midfunction mehtod
@WE11ington => Posted this method +/- 1 year ago (for CA 1 year and 5 months, idk....)
Originally Posted by XarutoUsoCrack
Taked Combat Arms DIP Engine from refference ?
Originally Posted by luizimloko
no, i find it alone ...
Originally Posted by Skaterforeva1
I have been in combat arm section for ever. This is definitely from there, just updated it for crossfire lol.
Originally Posted by luizimloko
you think that same pattern scan for CA works on CF ?
And i think hooking in crossfire is detected ..
Anyway thanks
Are you there endScene / present hook?
DWORD WINAPI StartRoutine( LPVOID )
{
while( TRUE )
{
if( memcmp( ( VOID * )DIPEngine, ( VOID * )( PBYTE )"\x8B\x07", 2 ) == 0 ) <=== Right?
{
Sleep( 100 );
DetourCreate( ( PBYTE )DIPEngine, ( PBYTE )DIPEngineMidfunction, 7 ); <== Right?
}
Sleep( 50 );
}
return 0;
}
{
while( TRUE )
{
if( memcmp( ( VOID * )DIPEngine, ( VOID * )( PBYTE )"\x8B\x07", 2 ) == 0 ) <=== Right?
{
Sleep( 100 );
DetourCreate( ( PBYTE )DIPEngine, ( PBYTE )DIPEngineMidfunction, 7 ); <== Right?
}
Sleep( 50 );
}
return 0;
}
This thread is closed for replies.
